Find, and optionally remove, registered secrets in persisted files

Secrets are redacted when they enter a transcript, a cache or a document, but a value that reached a file before it was registered (for example a key pasted into a prompt and only later loaded with gptr_env()) stays there. gptr_scrub() scans persisted files for the values of every registered secret and their derived forms and reports where they occur. With dry_run = FALSE it rewrites those files, replacing each occurrence with a [secret:NAME] marker; this is the only sanctioned rewrite of append-only session files, each of which then gets a gptr.scrub entry. A key that reached a model or a commit must still be rotated.

Usage

gptr_scrub(paths = NULL, dry_run = TRUE, error = FALSE)

Arguments

paths: NULL for the workspace's sessions, caches, spill files, plans, transcripts and safe relative document paths bound in this project. An explicit character vector of files and directories overrides that scope; directory traversal stays within each root. Binary files and files with existing writer locks (including stale locks) are reported but not rewritten.
dry_run: If TRUE (the default), only report; if FALSE, rewrite the files.
error: If TRUE, signal an error of class gptr_error_secret_found when any file contains a registered secret (for pre-commit hooks and CI).

Value

A data frame with columns file, secret (the variable name) and count; never values. Returned visibly for a dry run, invisibly after a rewrite.

Examples

d = tempfile("proj")
dir.create(d)
writeLines("nothing secret here", file.path(d, "notes.txt"))
gptr_scrub(d)
#> [1] file   secret count 
#> <0 rows> (or 0-length row.names)