AGENTS.md@packages/redact git:20261009.95ca1efA

Immutable. This exact content never changes and is served at /api/v1/blob/c505ef28f22a3888.

# @shadowclone/redact

Removes secrets and identifying paths from text. Packages call it before text reaches a model, a log, or a report.

<!-- package-facts:start -->

(generated by `bun run guides`; do not edit by hand)

- Package name: `@shadowclone/redact`
- Workspace dependencies: `@shadowclone/core`
- External dependencies: none
- Export subpaths: `.`

<!-- package-facts:end -->

## Owns

- `src/rules.ts`: the ordered `redactionRules`. Each rule has a label.
- `src/entropy.ts`: the Shannon entropy filter for tokens with no known format.
- `src/index.ts`: `redactSecrets`, `redactionLabels`, and `materializeSnapshot`.
- `src/corpus/`: `secrets.ts` and `benign.ts`, the strings that the tests use.

## Rules

- This package depends only on `core`.
- Every rule has its own label. A test checks that each rule produces its label.
- Redaction is idempotent. A test runs every corpus string through it twice.
- Redaction leaves every string in `src/corpus/benign.ts` unchanged. A test checks this.
- `redactSecrets` replaces the home folder with `~`.
- `materializeSnapshot` returns the parsed value and the redacted text from one read of the file.

## Tests

Run `bun test` in this folder, or `bun test packages/redact` from the root. Add a failing string to `src/corpus/secrets.ts` before you add a rule. The tests need no other tool.

Update this file in the same commit when you change the package purpose, public exports, dependencies, or a rule above.