mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 18:37:24 +00:00
OrcaWinandOrcaWin
5480f48d5b
* test: remove low-value runtime packaging and diagnostic suites * test: clear scan-progress listeners after AI Vault IPC cases --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
58 lines
2.1 KiB
JavaScript
58 lines
2.1 KiB
JavaScript
// Pin identifier shapes from live agent transcripts so the commit-time scrub gate cannot leak account IDs.
|
|
import { readdirSync, readFileSync } from 'node:fs'
|
|
import { join } from 'node:path'
|
|
import { describe, expect, it } from 'vitest'
|
|
import {
|
|
formatFindings,
|
|
redactTranscript,
|
|
scanTranscriptForSecrets
|
|
} from './pty-transcript-secret-scan.mjs'
|
|
|
|
describe('pty transcript secret scan', () => {
|
|
it('finds credentials an agent may echo while signing in', () => {
|
|
const kinds = scanTranscriptForSecrets(
|
|
[
|
|
'token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dBjftJeZ4CVP',
|
|
'key: AIzaSyA1234567890abcdefghijklmnopqrstu',
|
|
'refresh: 1//0gLm34XyZabcdefghijklmnopqrstuvwx',
|
|
'Authorization: Bearer abcdefghijklmnopqrstuvwxyz012345'
|
|
].join('\n')
|
|
).map((finding) => finding.kind)
|
|
expect(kinds).toEqual(['jwt', 'google-api-key', 'google-refresh-token', 'bearer-token'])
|
|
})
|
|
|
|
it('finds the resumable conversation id agy prints on exit', () => {
|
|
const findings = scanTranscriptForSecrets(
|
|
'Resume with -c (or command below):\nagy --conversation=26dc1986-9eec-456a-a534-d93e5c1076c2'
|
|
)
|
|
expect(findings).toHaveLength(1)
|
|
expect(findings[0].kind).toBe('uuid')
|
|
})
|
|
})
|
|
|
|
describe('redaction', () => {
|
|
it('leaves the rest of the screen byte-for-byte untouched', () => {
|
|
const text = 'line one\nuser@corp.io\nline three'
|
|
expect(redactTranscript(text).text).toBe('line one\nXXXXXXXXXXXX\nline three')
|
|
})
|
|
})
|
|
|
|
describe('committed transcripts', () => {
|
|
// Enforce in CI: recorder warnings can be skipped, while committed transcripts persist.
|
|
const fixtureDir = join(
|
|
import.meta.dirname,
|
|
'../../..',
|
|
'..',
|
|
'src',
|
|
'main',
|
|
'runtime',
|
|
'__fixtures__'
|
|
)
|
|
const transcripts = readdirSync(fixtureDir).filter((entry) => entry.endsWith('.txt'))
|
|
|
|
it.each(transcripts)('%s carries no account identifier or credential', (name) => {
|
|
const findings = scanTranscriptForSecrets(readFileSync(join(fixtureDir, name), 'utf8'))
|
|
expect(findings, formatFindings(name, findings)).toEqual([])
|
|
})
|
|
})
|