Documentation
¶
Overview ¶
Package redact masks resolved secret values out of log output.
Skill secrets (RMI-OMNIAGENT-200/201/202) are resolved once from a vault and then threaded into MCP subprocess environments, OpenAPI auth headers, and compiled-skill env maps (RMI-OMNIAGENT-203/209/210). None of those paths intentionally log the resolved value, but nothing previously stopped a future debug line — or a naive %v/%+v dump of a skill's internal config — from leaking one. Register call sites register each resolved value here; NewHandler wraps a slog.Handler so any log record containing a registered value has it masked before it reaches the underlying handler.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewHandler ¶
NewHandler wraps next so records it handles have registered secret values masked first.
func Register ¶
func Register(vals ...string)
Register adds resolved secret values to the redaction set. Empty values and values shorter than minSecretLen are ignored. Safe for concurrent use.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler wraps an slog.Handler, masking registered secret values out of the message and every attribute (including nested groups) of each record.
Source Files