Documentation
¶
Overview ¶
Package sensitivepath classifies command audits for sensitive path/intent access. Classification is a separate claim from secret redaction and from host capture coverage: matching a path pattern does not prove the file was opened unless structured tool evidence supports that.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultPatternDescriptions ¶
func DefaultPatternDescriptions() []string
DefaultPatternDescriptions returns bilingual documentation lines for the built-in pattern set (for docs generation / help text).
Types ¶
type Class ¶
type Class string
Class is the sensitivity category that matched.
const ( // ClassNone means no pattern matched. ClassNone Class = "" // ClassDotenv covers .env style files. ClassDotenv Class = "dotenv" // ClassSSHKey covers SSH private key paths and basenames. ClassSSHKey Class = "ssh_key" // ClassCloudCreds covers cloud credential files and directories. ClassCloudCreds Class = "cloud_creds" // ClassBrowserProfile covers browser profile/cookie paths. ClassBrowserProfile Class = "browser_profile" // ClassKeyMaterial covers PEM/key files and OS keychains. ClassKeyMaterial Class = "key_material" // ClassCustom covers user-supplied exact substrings. ClassCustom Class = "custom" )
Known sensitivity classes.
type Classification ¶
type Classification struct {
Matched bool `json:"matched"`
Class Class `json:"class,omitempty"`
Operation Operation `json:"operation,omitempty"`
Evidence Evidence `json:"evidence,omitempty"`
Coverage Coverage `json:"coverage,omitempty"`
Redaction RedactionClaim `json:"redaction,omitempty"`
MatchedPath string `json:"matched_path,omitempty"`
IntentOnly bool `json:"intent_only"`
Summary string `json:"summary,omitempty"`
CoverageGap string `json:"coverage_gap,omitempty"`
}
Classification is the separable sensitive-path claim for one audit event.
func Classify ¶
func Classify(in Input) Classification
Classify returns the sensitive-path claim for the given audit material. Empty or non-matching input yields Matched=false with coverage derived from truncation / observability of the payload.
func ClassifyCommandBody ¶
func ClassifyCommandBody(body string, extra []string) Classification
ClassifyCommandBody classifies a command_executed event body that follows Traceary's "command\n\nINPUT:\n...\n\nOUTPUT:\n..." shape.
type Coverage ¶
type Coverage string
Coverage is the audit-trail completeness claim for this event.
const ( // CoverageComplete means command plus I/O material is present and untruncated. CoverageComplete Coverage = "complete" // CoveragePartial means useful material exists but is incomplete (e.g. truncated). CoveragePartial Coverage = "partial" // CoverageUnobservable means there is not enough material to judge. CoverageUnobservable Coverage = "unobservable" )
Known coverage levels for the audit payload quality claim.
type Evidence ¶
type Evidence string
Evidence describes how strong the path-access claim is.
const ( // EvidenceCommandTextOnly means only shell/command text matched; file open // is not proven. EvidenceCommandTextOnly Evidence = "command_text_only" // EvidenceStructuredFileTool means a host file tool reported a path. EvidenceStructuredFileTool Evidence = "structured_file_tool" // EvidenceUnresolvedPath means a pattern matched but the path could not be // resolved against a workspace root. EvidenceUnresolvedPath Evidence = "unresolved_path" )
type Input ¶
type Input struct {
Command string
Input string
Output string
ToolName string
InputTruncated bool
OutputTruncated bool
InputRedacted bool
OutputRedacted bool
ExtraPatterns []string
}
Input is the raw material used to classify one audit.
type Operation ¶
type Operation string
Operation is the inferred access operation.
const ( // OpUnknown means the operation could not be inferred. OpUnknown Operation = "unknown" // OpRead is a read-like operation. OpRead Operation = "read" // OpWrite is a write-like operation. OpWrite Operation = "write" // OpStat is a metadata/stat operation. OpStat Operation = "stat" // OpList is a directory listing operation. OpList Operation = "list" )
Known access operations.
type RedactionClaim ¶
type RedactionClaim string
RedactionClaim is independent from sensitivity matching.
const ( // RedactionUnknown means redaction status was not determined. RedactionUnknown RedactionClaim = "unknown" // RedactionApplied means redaction markers were applied on capture. RedactionApplied RedactionClaim = "applied" // RedactionUnnecessary means no secret patterns required redaction. RedactionUnnecessary RedactionClaim = "unnecessary" RedactionUnavailable RedactionClaim = "unavailable" // RedactionFailed means redaction was attempted and failed. RedactionFailed RedactionClaim = "failed" )
Known redaction claim values (separate from sensitivity match).
Source Files