Module secrets 

Values copied into a worktree from the person’s secret files (a .env that [worktree] include copies): masked in everything speccoder shows or hands on — command and check output, tool results, messages — as [redacted:NAME], each in the forms it may be printed in (as is, base64, hex, URL-encoded).

The values are held for the process, never written anywhere: masking more than one worktree’s values everywhere is the safe direction.

Constants

MIN_LEN

The shortest value masked: shorter ones are flags and ports.

Functions

dotenv

The NAME=value pairs of a dotenv file: export and quotes dropped (a quoted value may span lines), comments and blank lines skipped.

found_in

The variable whose value (as is) text holds, if any.

longest

The longest form registered, in bytes: how far a value can straddle a cut.

mask

text with every registered value, in each of its forms, replaced by [redacted:NAME].

mask_bytes

mask over bytes that need not be UTF-8: each form replaced where it occurs, every other byte kept.

mask_json

mask over every string in a JSON value.

register

Masks value (the variable name’s) from now on, in this process; once per name and value.

secret_name

Whether a variable’s name says its value is secret: what the commands’ environment drops (crate::verify::process::is_secret), and names with KEY, PASS, PWD, CREDENTIAL, AUTH, PRIVATE, TOKEN or DSN.

to_mask

What a copied secret file’s text gives to mask, as (NAME, value). A dotenv file (named .env*): the variables whose name says secret (secret_name) — each line of a multi-line value too — and any URL with credentials, whole and its password. Any other file (a key, a .netrc): each line, without PEM’s -----BEGIN …----- markers, under the file’s name, and each line’s last word.

worth_masking

Whether value is worth masking: at least MIN_LEN long and not a plain number.