Module redact 

Header-name redaction list applied to network.json by default (and to any tool-originated log line). Per design.md §"Secrets are redacted", credential-bearing headers are replaced with "[redacted]" unless the caller passes --network-redact off.

Server response bodies pass through unmodified — redaction is for tool-captured metadata only.

Constants

ALWAYS_REDACTED

Header names that are always redacted (case-insensitive match).

REDACTED_SUFFIXES

Header-name suffixes that trigger redaction (case-insensitive match against the full header). Catches x-api-token, x-csrf-token, x-shared-secret, etc.

REDACTED_VALUE

Sentinel string written in place of redacted values.

Functions

redact_userinfo_passwords

Mask the password component of every scheme://user:pass@host userinfo found in arbitrary text, leaving the rest byte-for-byte intact.

should_redact

Returns true if header_name should be redacted under the default policy. Case-insensitive.