redact

Documentation

Overview

Package redact scrubs secret-bearing key tokens (metered run keys and BYOI vendor keys) from transcripts and diffs before they are persisted to disk.

It is a pure, dependency-free helper — it holds no inference-provider handle and imports nothing from the commercial billing layer — so the self-extension authoring packages (engine, opencode, proposer, router) can run their untrusted authoring output through it without pulling the commercial credential lifecycle into their dependency graph.

Index

• func Redact(s, key string) string

Functions

func Redact

func Redact(s, key string) string

Redact replaces the exact key and any mallcop-sk-*/sk-ant-*/sk-<20+> token in s with a fixed marker. The exact-string pass runs first so the EXACT key is always scrubbed regardless of its shape (a vendor "sk-ant-..." or "sk-..." BYOI key is caught by this pass even where the regexp is conservative); the regexp then catches any other key. Callers MUST run transcripts through Redact before persisting them to disk.