Documentation
¶
Overview ¶
Package secretscan recognizes common secret shapes in free text.
It is deliberately conservative -- keyword and shape based -- so it does not mangle ordinary tool output or refuse ordinary prose. Nothing here proves text is safe: a scanner that found nothing has found nothing, not established that a string holds no credential. Both callers treat it that way. The run trace redacts what it recognizes and still bounds and scopes what it writes; project memory refuses a write it recognizes and still tells the agent that not persisting credentials is its own contract.
Grow the pattern set here rather than in either caller, so what the two recognize cannot drift apart.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Redactor ¶
type Redactor struct {
// contains filtered or unexported fields
}
Redactor redacts both recognized secret shapes and a fixed set of exact values. The exact set is a run's materialized Space Secret values, registered before the Agent starts so they do not drift into a durable trace, a log, or a tool result. It is defense in depth, not a boundary: a value can be encoded or transformed past it, which is why the primary control is withholding the value from the general environment. See docs/design/space-secrets.md §12.
func NewRedactor ¶
NewRedactor builds a Redactor over the given exact values, dropping empty, very short, and oversized ones. A Redactor with no usable values redacts by shape only, exactly like the package Redact.
func (*Redactor) Redact ¶
Redact replaces exact registered values first, then recognized shapes. A nil Redactor redacts by shape only, so a caller never needs to nil-check.
func (*Redactor) RedactExact ¶
RedactExact replaces only the registered exact values, not recognized shapes. It is for a sink where shape-based redaction would mangle output a consumer still needs -- a tool result the model must read to continue its work, where blanking every token-shaped substring would break the run. A nil Redactor returns s unchanged.
Source Files