Expand description
Shape-based, best-effort secret redaction — the one Rust implementation
SPEC_ERROR_COPY_EVERYWHERE_2026_09_24.md §4.5 asks every formatter that
puts error/log text on the clipboard to share, instead of each inventing
its own. Moved here from crates/srv/src/backend/continuity.rs, which
only recognized credential-prefixed tokens and PEM private keys — enough
for a continuation packet, not enough for raw stderr and request details
(Codex P1 on #3689).
Deliberately manual string scanning, not the regex crate: nothing in
this workspace depends on regex today, and continuity.rs’s own
pre-existing redaction (kept here unchanged) already established that as
the house style for this kind of text scan.
Mirrored on the TypeScript side by frontend/app/errors/redact.ts, and
both are tested against the same docs/specs/fixtures/redaction-vectors.json
so the two can’t drift apart (§4.5).
Functions§
- redact_
private_ keys - Blanks PEM private keys (
-----BEGIN ... PRIVATE KEY-----blocks), never a certificate. Public —continuity.rs’s own tests exercise this pass in isolation (ReAgent P0 on #3643: a certificate ahead of a key must not end the scan and let the key through). - redact_
secrets - The full redaction pipeline. Order matters: the original credential-prefix and private-key passes run first (unchanged, so their existing callers’ exact output is preserved byte-for-byte on inputs that only they match), then the newer, broader shape-based passes.