audit

Documentation

Overview

Package audit provides a structured audit logger for CLI command invocations. It logs command name, resolved configuration, and sanitised environment state so operators can trace what happened without exposing secret values.

Secrets are logged as presence/absence only — never their values.

Index

• func LogCommandStart(log *slog.Logger, command string, configPath string)
• func SanitiseKey(key, value string) string

Functions

func LogCommandStart

func LogCommandStart(log *slog.Logger, command string, configPath string)

LogCommandStart emits a structured audit log entry when a CLI command begins. It records the command name, config file source, and sanitised environment.

func SanitiseKey

func SanitiseKey(key, value string) string

SanitiseKey returns "set" or "unset" for known secret keys, or the actual value for non-secret keys. This is safe to use in log messages.