Documentation
¶
Overview ¶
Package eventlog fans run events out to sinks: the --json JSONL stream and the opt-in SQLite event log. Every sink receives the same event types and payloads, so they cannot drift apart.
Index ¶
Constants ¶
const ( // LevelMetadata stores no prompt, assistant, tool-argument, tool-output // or submission bodies: each is replaced by its length. LevelMetadata = "metadata" // LevelFull stores bodies, redacted and size-capped. LevelFull = "full" )
Levels control how much of each event is stored.
const DefaultMaxPayloadBytes = 64 << 10
DefaultMaxPayloadBytes caps one stored event payload.
const MinSecretLen = 6
MinSecretLen keeps short values (e.g. "1" or "true") from being treated as secrets and redacting unrelated text.
const Redacted = "[REDACTED]"
Redacted replaces every secret the Redactor finds.
Variables ¶
var BodyKeys = []string{"text", "arguments", "output", "submission", "task", "content", "prompt", "question"}
BodyKeys are the payload fields that carry bodies; at LevelMetadata they are replaced by <key>_len.
var SchemaVersion = func() int { m := embeddedMigrations(); return m[len(m)-1].version }()
SchemaVersion is the newest schema this binary writes.
Functions ¶
func DSN ¶
DSN returns the driver connection string for path: WAL journaling, a busy timeout so concurrent runs wait instead of failing, and immediate write transactions so they take the write lock up front.
func SecretEnvName ¶
SecretEnvName reports whether an environment variable's value is treated as a secret: names ending in _KEY, _TOKEN, _SECRET or _PASSWORD.
Types ¶
type JSONL ¶
type JSONL struct {
// contains filtered or unexported fields
}
JSONL writes each event as one JSON object and newline, with its kind under "type". After the first failed write it stops and Err reports the error.
type Options ¶
type Options struct {
Path string
Level string // LevelMetadata (default) or LevelFull
MaxDays int // prune runs older than this at open; 0 keeps all
MaxRuns int // keep at most this many runs, including the new one; 0 keeps all
MaxPayloadBytes int // 0 means DefaultMaxPayloadBytes
Redactor *Redactor
Run RunInfo
// Step returns the current step for each event; nil records 0.
Step func() int
// Warn is called at most once, on the caller's goroutine, after the
// first failed write. Later writes are dropped.
Warn func(msg string)
// Now overrides the clock in tests.
Now func() time.Time
}
Options configures an SQLite sink.
type Redactor ¶
type Redactor struct {
// contains filtered or unexported fields
}
Redactor masks secret values and, optionally, token-shaped strings. It is safe for concurrent use.
func EnvRedactor ¶
EnvRedactor is NewRedactor(os.Environ(), extra...).
func NewRedactor ¶
NewRedactor masks the values of secret-named variables in env (KEY=VALUE entries, typically os.Environ()) and the given extra values, such as env values set in the config, plus token-shaped strings.
func NewValueRedactor ¶
NewValueRedactor masks exactly vals (values shorter than MinSecretLen are skipped), each also in its JSON-escaped form, and with patterns also token-shaped strings.
func (*Redactor) Add ¶
Add registers more secret values, such as credentials refreshed during the run.
func (*Redactor) PartialSuffix ¶
PartialSuffix returns the length of the longest suffix of s that is the start, but not the whole, of a secret value: output a reader should hold back until more arrives, so a secret split across reads is still masked.
type SQLite ¶
type SQLite struct {
// contains filtered or unexported fields
}
SQLite is a Sink that writes events to an SQLite database from a background goroutine, batching inserts in transactions. Write failures never surface as errors: Warn is called once and later events are dropped.
func Open ¶
Open creates or migrates the database at opts.Path, prunes old runs, and records a new run. The caller decides what an error means; tinyagent warns and runs without the log.
func (*SQLite) Close ¶
func (s *SQLite) Close()
Close flushes buffered events, marks the run ended if no result was recorded, and closes the database. A write failure is reported through Warn (once), never returned.
Source Files