sanitizer

Documentation

Overview

Package sanitizer turns raw tool output into privacy-safe error templates (goal.md §8.5, contract C11). The strip order is binding: (1) error codes are extracted and preserved, (2) public package names after node_modules/ segments are kept, then (3) paths, (4) URLs, (5) emails, (6) quoted string literals, (7) hex/base64 token runs, (8) the current user and home dir, and (9) line/column numbers are replaced with placeholders. Raw input never leaves this package unsanitized.

Index

• func CLIOutputExcerpt(normalized string) (string, bool)
• func CanonicalPublicErrorSummary(summary string, stage domain.Stage) string
• func ErrorCode(raw string) string
• func PublicErrorSummary(normalized string) string
• func PublicErrorSummaryWithTruncation(normalized string) (string, bool)
• func Redact(raw string) (clean string, redacted bool)
• func SanitizeClassifiedFailure(raw string, stage domain.Stage, term domain.FailureTermination, _ []string, ...) domain.FailureEvidence
• func SanitizeFailure(raw string, stage domain.Stage, term domain.FailureTermination, _ []string) domain.FailureEvidence
• type SanitizedError
  • func Sanitize(raw string, stage domain.Stage, publicPkgs []string) SanitizedError
  • func (s SanitizedError) Fingerprints() []string

Functions

func CLIOutputExcerpt

func CLIOutputExcerpt(normalized string) (string, bool)

CLIOutputExcerpt reduces a normalized stream to a non-identifying diagnostic shape. Error codes, fixed diagnostic keywords, and sanitizer placeholders survive; every other word (including project, host, file, and customer names in any Unicode script) becomes <text>. The full normalized text may be hashed locally for comparison, but only this shape is persisted as an excerpt.

func CanonicalPublicErrorSummary

func CanonicalPublicErrorSummary(summary string, stage domain.Stage) string

CanonicalPublicErrorSummary revalidates a normalized public-wire summary without introducing facts from the validating host. Raw producers still use SanitizeFailure, which removes their own username and home directory.

func ErrorCode

func ErrorCode(raw string) string

ErrorCode returns the dominant error code in raw, or "" when it carries none.

It is the cheap half of Sanitize, exported because choosing WHICH of a failed command's two streams to sanitize has to happen before sanitizing one, and that choice needs the code and nothing else.

func PublicErrorSummary

func PublicErrorSummary(normalized string) string

PublicErrorSummary keeps the first useful normalized lines within a strict public-wire cap. It is idempotent, which lets the server reject any client value that was not produced by the same canonical normalization.

func PublicErrorSummaryWithTruncation

func PublicErrorSummaryWithTruncation(normalized string) (string, bool)

PublicErrorSummaryWithTruncation also reports whether useful normalized content was omitted by the four-line or 512-byte excerpt bounds.

func Redact

func Redact(raw string) (clean string, redacted bool)

Redact strips identifying material from a short free-text field and says whether it had to.

Sanitize is for tool OUTPUT: it needs a stage, it preserves error codes and public package names, and it produces a fingerprint. An anomaly report's prose fields are neither output nor evidence — they are a sentence a human will read in a queue — and they arrive from a language model that was asked not to include a path and may have included one anyway.

So this applies only the destructive half, in the same order and with the same expressions, and reports the fact of redaction. Both ends run it: the client so nothing identifying is ever sent, the server because the client is a program somebody else can replace.

func SanitizeClassifiedFailure

func SanitizeClassifiedFailure(raw string, stage domain.Stage, term domain.FailureTermination, _ []string,
	outerCommand string, outerStage domain.Stage, actualToolchain string,
	stageEvidence domain.FailureStageEvidence, evidenceGap domain.FailureEvidenceGap) domain.FailureEvidence

SanitizeClassifiedFailure builds public evidence for one actual failure event while preserving the privacy-bounded outer-to-toolchain lineage.

func SanitizeFailure

func SanitizeFailure(raw string, stage domain.Stage, term domain.FailureTermination, _ []string) domain.FailureEvidence

SanitizeFailure builds the public v2 failure contract. The fingerprint is intentionally the cluster identity only: package/version scope and exact environment variants are stored beside it by aggregation, so an otherwise identical failure does not split merely because it ran on another machine.

Types

type SanitizedError

type SanitizedError struct {
	Template      string
	Code          string
	Fingerprint   string
	PublicSymbols []string
}

SanitizedError is the uploadable form of one raw error text.

func Sanitize

func Sanitize(raw string, stage domain.Stage, publicPkgs []string) SanitizedError

Sanitize strips all identifying material from raw per C11 and returns the template, the dominant error code, a stable fingerprint, and the public packages mentioned in raw.

func (SanitizedError) Fingerprints

func (s SanitizedError) Fingerprints() []string

Fingerprints returns the fingerprint this error would carry at each stage it could have been recorded under.

A fingerprint is SHA256("v1|" + stage + "|" + code + "|" + template), so the same error text hashes differently depending on the stage that observed it. Everything that RECORDS an error knows its stage. The agent pasting an error into search_known_solution does not -- it has a build log, not a stage -- and searching with an empty stage produced a hash that could not equal any stored fingerprint, ever, on any install. That silently disabled the largest relevance weight in the ranker (0.60, larger than an exact version match at 0.45) and, with it, the rule that exempts "the failure the caller is explicitly looking for a fix to" from being demoted to REFERENCE_ONLY.

Asking about every observation stage is the honest form of the question: the caller has this error, and does not claim to know when it happened.