module

Fluxion::Executor::Redaction

Removes secrets and terminal control sequences from anything Fluxion is about to show, log, or persist.

Two independent jobs, both mandatory:

  • Secrets must not reach the terminal, the state file, or a plan. A profile legitimately carries tokens in env, and package managers echo URLs, so the leak paths are ordinary rather than exotic.
  • Untrusted text must not be able to drive the terminal. Package names, command output, and remote error messages all end up on screen; without stripping, any of them could move the cursor, clear the display, or forge a line of Fluxion's own output.

Constants

MASK = "<redacted>"
MIN_MASKABLE_SECRET = 4
QUOTED_OR_TOKEN = "(?:\"[^\"]*\"?|'[^']*'?|[^\\s,;\\]}]+)"

A quoted string or a bare token. Used as the value half of every assignment pattern so --token "a b" masks the whole quoted value.

SENSITIVE_NAME = "(?:api[._-]?key|access[._-]?key|private[._-]?key|key[._-]?passphrase|passphrase|authorization|token|secret|password|passwd|credentials?)"

Names that almost always hold a secret. Written once and reused for environment variables, --flag value pairs, and name=value text.

Instance methods

mask_values(text : String, environment : Enumerable(ShellEnvironmentVariable)) : String

Masks the literal values of sensitive environment variables.

Pattern matching cannot catch a token that looks like an ordinary word, so when Fluxion knows the actual secret it replaces it directly.

Source
redact(text : String) : String

Masks anything that looks like a credential.

Source
redact_command(command : Array(String), environment : Enumerable(ShellEnvironmentVariable)) : Array(String)
Source
redact_output(text : String, environment : Enumerable(ShellEnvironmentVariable)) : String

Full treatment for a line of command output.

Source
sanitize(text : String) : String

Multi-line text safe to print, keeping the line structure.

Source
sanitize_command(command : Array(String)) : Array(String)

Sanitizes an argv vector for display.

Handled per argument rather than on the joined string so an argument following a sensitive flag is masked whole — --password hunter2 hides the value even though hunter2 looks like nothing in particular.

Source
sanitize_line(text : String) : String

A single line safe to print: no control sequences, no secrets, no embedded newlines that could forge a second line of output.

Source
sensitive_name?(name : String) : Bool

True when a name suggests its value is a secret. Splits camelCase first so githubToken is caught as well as GITHUB_TOKEN.

Source
strip_controls(text : String, preserve_newlines : Bool = false) : String

Strips everything that could steer the terminal.

Escape sequences are removed in order — OSC, then CSI, then anything else introduced by ESC — because an OSC payload can legitimately contain bytes that look like the start of a CSI sequence.

Source

Nested types