Documentation
¶
Overview ¶
Package redact is how the programs under scripts/ that drive a real instance print: through one Printer, which masks what a run can carry.
`gates transcript` forbids fmt.Print*, os.Stdout, os.Stderr, log and log/slog in every driver, which leaves Printer.write as the one place a line reaches a terminal. So a print that bypasses the masking is not something to remember; the gate refuses it.
The masking is the server's own (internal/redact): tokens, URLs with their hosts and namespace paths, addresses and application ids, with stable placeholders so a transcript still reads as a story — {host 1} in one result is {host 1} in the next. Secrets a job log can carry are masked on top. Values with no shape — the username the run signed in as, the scratch project's path — are registered with Known.
What it cannot hide: titles, bodies, comments and file contents. The live driver reads only the scratch project it created (docs/architecture.md §9.1), which is what keeps them harmless, and Summary says so on every run.
Index ¶
Constants ¶
const ( KindHost = core.KindHost KindPath = core.KindPath KindUser = core.KindUser // KindID is a numeric id the run learned from the instance: the // scratch project's, a user's. KindID = core.KindID )
Kinds a driver registers with Known. They are the server's, so a transcript and a doctor report name things the same way.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Printer ¶
type Printer struct {
// contains filtered or unexported fields
}
A Printer is the only way a driver writes anything.
func NewPrinter ¶
NewPrinter writes the run to the terminal.
func NewPrinterTo ¶
NewPrinterTo writes somewhere else, which is how a test reads what a run would have printed.
type Redactor ¶
type Redactor struct {
// Off returns text unchanged. Only for a terminal nobody else sees.
Off bool
// contains filtered or unexported fields
}
A Redactor replaces instance-specific values with stable placeholders.
func NewRedactor ¶
NewRedactor returns a redactor with nothing registered.
func (*Redactor) Do ¶
Do masks text. Secrets first, so a token inside a URL is one mask rather than half of one.
Source Files