secrets

Documentation

Overview

Package secrets keeps the agent from leaking credentials. The agent may USE secrets (commands inherit the process environment, including values loaded from .env) but their values must never reach the model, the event log, or the terminal. Two defenses: refuse to read secret-bearing files, and redact known secret values from every tool result and printed line.

Index

• func IsSecretPath(path string) bool
• func RedactSecretFile(content string) string
• type Redactor
  • func NewFromEnv() *Redactor
  • func (r *Redactor) Add(values ...string)
  • func (r *Redactor) Redact(s string) string

Functions

func IsSecretPath

func IsSecretPath(path string) bool

IsSecretPath reports whether a path likely holds credentials, so its VALUES should be masked when read or diffed (the file is still usable — the agent just operates on it by reference, never seeing the plaintext).

func RedactSecretFile

func RedactSecretFile(content string) string

RedactSecretFile masks the values in a credential-bearing file (or a diff of one), preserving structure so the agent can still reason about and edit it.

Types

type Redactor

type Redactor struct {
	// contains filtered or unexported fields
}

Redactor replaces known secret values with a placeholder.

func NewFromEnv

func NewFromEnv() *Redactor

NewFromEnv collects secret values from the current environment (which, for the agent, already includes anything loaded from .env).

func (*Redactor) Add

func (r *Redactor) Add(values ...string)

Add registers extra secret values to redact.

func (*Redactor) Redact

func (r *Redactor) Redact(s string) string

Redact replaces every known secret value found in s with the placeholder.