Module log_sanitizer 

Prepares logs and issue text for publication with @link-foundation/sensitive-data-sanitizer, the sanitizer shared by start-command, gh-upload-log and hive-mind (issue #250).

The library CLI runs with --credentials-only, --env-secrets and --gh-config; it streams the log from stdin, keeps invalid UTF-8 bytes and writes a new private file atomically (--output). Its error messages are value-free and only their ERR_* code is kept here.

One rule stays here: the library masks an unquoted or single-quoted Authorization: <scheme> <value> to the end of the line, which drops the rest of a logged one-line JSON prompt (issue #249). The pre-pass below masks only the scheme and its token first; the library keeps values that already start with [REDACTED]. Remove it with sensitive-data-sanitizer#45.

Structs

AuthorizationHeaderMask

Masks Authorization: <scheme> <token> as Authorization: [REDACTED] byte-wise, so invalid UTF-8 passes through unchanged, holding at most HOLDBACK pending bytes.

PreparedLog

Private temporary copy; dropping it removes its file and directory.

Constants

BLOCK_SIZE

OVERRIDE

Path of the library CLI to use instead of the one on PATH.

PACKAGE

The library version the JavaScript package depends on.

Functions

ensure_sanitizer_available

Install the library CLI with an available JavaScript package manager.

find_sanitizer

The library CLI: START_SENSITIVE_DATA_SANITIZER, else sensitive-data-sanitizer on PATH.

sanitize_log_to_temp

Create a private sanitized copy of a log. The source is never modified; any failure removes the copy and returns a value-free message.

sanitize_log_to_temp_with_env

sanitize_text

Sanitize a short text, such as the failing command quoted in an issue.

sanitize_text_with_env