Documentation
¶
Overview ¶
Package privacy provides utilities for protecting sensitive data.
Package privacy provides privacy tag handling for engram.
Index ¶
- func Clean(text string) string
- func ContainsSecrets(text string) bool
- func IsEntirelyPrivate(text string) bool
- func RedactSecrets(text string) string
- func SanitizeObservation(narrative string, facts []string) bool
- func StripAllTags(text string) string
- func StripMemoryTags(text string) string
- func StripPrivateTags(text string) string
- type DetectedSecret
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Clean ¶
Clean performs full privacy cleaning on text. This is the main function to use before storing any user content.
func ContainsSecrets ¶
ContainsSecrets checks if the given text contains any patterns that look like secrets. Returns true if potential secrets are detected.
func IsEntirelyPrivate ¶
IsEntirelyPrivate checks if the text is entirely within <private> tags.
func RedactSecrets ¶
RedactSecrets replaces detected secrets with a redaction marker. This allows the text to be stored while protecting sensitive data.
func SanitizeObservation ¶
SanitizeObservation checks multiple fields of an observation for secrets. Returns true if any secrets were found. This function is used as a validation gate before storing observations.
func StripAllTags ¶
StripAllTags removes both private and memory context tags.
func StripMemoryTags ¶
StripMemoryTags removes all <engram-context>...</engram-context> content from text.
func StripPrivateTags ¶
StripPrivateTags removes all <private>...</private> content from text.
Types ¶
type DetectedSecret ¶ added in v0.4.0
type DetectedSecret struct {
Name string // deterministic: "auto:{hash[:8]}"
Value string // the raw secret value
}
DetectedSecret represents a secret value found in text, with a deterministic name derived from a SHA-256 hash prefix of the value.
func ExtractSecrets ¶ added in v0.4.0
func ExtractSecrets(text string) []DetectedSecret
ExtractSecrets scans text for secret patterns and returns all unique matches. Each secret gets a deterministic name based on the SHA-256 hash of its value, ensuring idempotent vault storage (same secret = same name = one entry).
Source Files