@ciphyrshq/sdk 3.0.0 → 3.0.1

package/src/protect-tool.test.js

@@ -1,446 +0,0 @@
-/**
- * protectTool — authorization wrapper for the published @ciphyrshq/sdk.
- * Run with: npm test   (node --test src/**\/*.test.js)
- *
- * This package ships to customers at v2.6.0 and had no tests at all, while the
- * 0.1.0 `ciphyrs` package next door had seventy. The gap showed: protectTool
- * accepted a redact_args verdict as "permitted" and then invoked the tool with
- * the CALLER'S ORIGINAL ARGUMENTS, so a redaction rule reported success on the
- * dashboard while the tool received the raw value. Nothing was wired to notice.
- *
- * So the organising question here is not "does it block?" — blocking was fine.
- * It is: WHEN THE POLICY SAYS SOMETHING OTHER THAN YES OR NO, DOES ANYTHING
- * ACTUALLY HAPPEN?
- */
-
-import './no-network.test-helper.js'
-import { describe, it, beforeEach, afterEach } from 'node:test'
-import assert from 'node:assert/strict'
-import { protectTool, ToolBlocked, ToolApprovalTimeout } from './protect-tool.js'
-import { spanStorage, traceStorage, remoteStorage } from './context.js'
-
-// protectTool announces wrapped tools on a 2s debounce. The timer is unref'd
-// so it cannot hold the runner open, but a client without _announceTools skips
-// the registry entirely and keeps these tests free of background work.
-const clientOf = (toolCheck, approvalStatus) => ({
-  _toolCheck: toolCheck,
-  _approvalStatus: approvalStatus,
-})
-
-const wrap = (client, fn, opts = {}) =>
-  protectTool(client, { agent: 'billing-bot', name: 'charge', ...opts }, fn)
-
-// ── redact_args: the verdict that did nothing ───────────────────────────────
-
-describe('protectTool — redact_args must actually redact', () => {
-  const REDACTED = { card: '****4242', amount: 50 }
-
-  it('invokes the tool with the server\'s redacted args, not the caller\'s', async () => {
-    let seen
-    const charge = wrap(clientOf(async () => ({ action: 'redact_args', redacted_args: REDACTED })),
-      async (a) => { seen = a; return 'ok' })
-    await charge({ card: '4111111111114242', amount: 50 })
-    assert.equal(seen.card, '****4242')
-    assert.ok(!JSON.stringify(seen).includes('4111111111114242'),
-      'the raw PAN reached the tool despite a redaction policy')
-  })
-
-  it('still returns the tool\'s value', async () => {
-    const charge = wrap(clientOf(async () => ({ action: 'redact_args', redacted_args: REDACTED })),
-      async () => 'receipt-1')
-    assert.equal(await charge({ card: '4111111111114242' }), 'receipt-1')
-  })
-
-  it('redacts positional arguments too, matching how they were sent', async () => {
-    // serializeArgs puts positional args under `args`, so the redaction comes
-    // back the same way. Unwrapping one shape and not the other would leave
-    // positional callers silently unredacted.
-    let seen
-    const charge = wrap(clientOf(async () => ({
-      action: 'redact_args', redacted_args: { args: ['****4242', 50] },
-    })), async (...a) => { seen = a })
-    await charge('4111111111114242', 50)
-    assert.deepEqual(seen, ['****4242', 50])
-  })
-
-  it('refuses when redaction is demanded but none was supplied', async () => {
-    // There is no safe way to guess what should have been masked, and running
-    // on the originals is precisely the leak this closes.
-    let ran = false
-    const charge = wrap(clientOf(async () => ({ action: 'redact_args' })),
-      async () => { ran = true })
-    await assert.rejects(() => charge({ card: '4111111111114242' }), ToolBlocked)
-    assert.equal(ran, false)
-  })
-
-  it('leaves args untouched on a plain allow', async () => {
-    let seen
-    const charge = wrap(clientOf(async () => ({ action: 'allow' })), async (a) => { seen = a })
-    await charge({ card: '4111111111114242' })
-    assert.equal(seen.card, '4111111111114242')
-  })
-})
-
-// ── The rest of the verdict surface ─────────────────────────────────────────
-
-describe('protectTool — verdicts', () => {
-  it('runs the tool on allow', async () => {
-    let ran = false
-    await wrap(clientOf(async () => ({ action: 'allow' })), async () => { ran = true })({})
-    assert.equal(ran, true)
-  })
-
-  it('runs the tool on log_only — it observes, it does not stop', async () => {
-    let ran = false
-    await wrap(clientOf(async () => ({ action: 'log_only' })), async () => { ran = true })({})
-    assert.equal(ran, true)
-  })
-
-  it('does not run the tool on block, and carries the rule that fired', async () => {
-    let ran = false
-    const charge = wrap(clientOf(async () => ({
-      action: 'block', reason: 'over the ceiling',
-      rule_id: 'r-1', rule_name: 'Refund ceiling', decision_id: 'd-9',
-    })), async () => { ran = true })
-    await assert.rejects(charge, (e) => {
-      assert.ok(e instanceof ToolBlocked)
-      assert.equal(e.ruleId, 'r-1')
-      assert.equal(e.ruleName, 'Refund ceiling')
-      assert.equal(e.decisionId, 'd-9')
-      return true
-    })
-    assert.equal(ran, false, 'the blocked tool executed anyway')
-  })
-
-  it('blocks on an action it does not recognise — allow-list, not deny-list', async () => {
-    const charge = wrap(clientOf(async () => ({ action: 'quarantine' })), async () => {})
-    await assert.rejects(charge, ToolBlocked)
-  })
-
-  it('accepts `decision` as an alias for `action`', async () => {
-    let ran = false
-    await wrap(clientOf(async () => ({ decision: 'allow' })), async () => { ran = true })({})
-    assert.equal(ran, true)
-  })
-})
-
-// ── Reachability ────────────────────────────────────────────────────────────
-//
-// This block changed posture. protectTool used to fail OPEN, so an outage of
-// OURS executed the customer's tool with nobody having authorised it — while
-// guard.wrap and scan.protect on the same client refused to proceed under the
-// identical outage. Tool execution is the path that moves money, so it is the
-// one that gets the safe default.
-
-describe('protectTool — when Ciphyrs is unreachable', () => {
-  const boom = () => clientOf(async () => { throw new Error('ECONNREFUSED') })
-
-  it('fails CLOSED by default — the tool does not run', async () => {
-    let ran = false
-    await assert.rejects(wrap(boom(), async () => { ran = true })({}), ToolBlocked)
-    assert.equal(ran, false, 'an outage of ours executed an unauthorised tool call')
-  })
-
-  it('says what happened and how to opt out', async () => {
-    // A default that changes under a customer on upgrade has to explain
-    // itself in the one place they will actually look: the error.
-    await assert.rejects(wrap(boom(), async () => {})({}), (e) => {
-      assert.ok(/did not run/i.test(e.message), e.message)
-      assert.ok(/fails closed by default/i.test(e.message), e.message)
-      assert.ok(/failOpen: true/.test(e.message), e.message)
-      return true
-    })
-  })
-
-  it('runs the tool when the call explicitly asks to fail open', async () => {
-    let ran = false
-    await wrap(boom(), async () => { ran = true }, { failOpen: true })({})
-    assert.equal(ran, true)
-  })
-
-  it('runs the tool when the CLIENT asks to fail open', async () => {
-    let ran = false
-    const c = { ...boom(), _failOpen: true }
-    await wrap(c, async () => { ran = true })({})
-    assert.equal(ran, true)
-  })
-
-  it('lets a call override a fail-open client back to closed', async () => {
-    let ran = false
-    const c = { ...boom(), _failOpen: true }
-    await assert.rejects(wrap(c, async () => { ran = true }, { failOpen: false })({}), ToolBlocked)
-    assert.equal(ran, false)
-  })
-
-  it('still honours the legacy failClosed: TRUE — against a fail-open client', async () => {
-    // This assertion used to be made against a DEFAULT client, where the new
-    // default already fails closed: it passed whether the legacy key was read
-    // or thrown away, so it guarded nothing. The posture only has to be read
-    // for the test to mean anything when something else is pulling the other
-    // way — here, a client-wide failOpen the key must override.
-    let ran = false
-    const c = { ...boom(), _failOpen: true }
-    await assert.rejects(wrap(c, async () => { ran = true }, { failClosed: true })({}), ToolBlocked)
-    assert.equal(ran, false, 'the legacy failClosed: true no longer closes a fail-open client')
-  })
-
-  it('still honours the legacy failClosed: FALSE — nobody who asked for fail-open loses it', async () => {
-    // The whole risk of changing a published default. `failClosed: false` is
-    // a caller who wrote their posture down; re-reading it as "made no choice"
-    // and applying the new default would be the silent upgrade break.
-    let ran = false
-    await wrap(boom(), async () => { ran = true }, { failClosed: false })({})
-    assert.equal(ran, true)
-  })
-
-  it('a NULL failClosed is not a posture — it fails closed like any unset value', async () => {
-    // A posture read out of a JSON config, a database column or a spread
-    // default arrives as null far more often than as undefined, and `!null`
-    // is true: this used to run the tool during an outage because nobody had
-    // set the option.
-    let ran = false
-    await assert.rejects(wrap(boom(), async () => { ran = true }, { failClosed: null })({}), ToolBlocked)
-    assert.equal(ran, false, 'an unset posture resolved to fail OPEN')
-  })
-
-  it('a string "false" posture is read as written, not as truthiness', async () => {
-    // `Boolean('false')` is true, so failOpen from an env var said fail open.
-    let ran = false
-    await assert.rejects(wrap(boom(), async () => { ran = true }, { failOpen: 'false' })({}), ToolBlocked)
-    assert.equal(ran, false)
-  })
-
-  it('a verdict-less response must not read as allow', async () => {
-    // `action || decision || 'allow'` turns an empty 200 into permission. A
-    // proxy or a half-deployed gateway produces exactly that.
-    let ran = false
-    const empty = clientOf(async () => ({ status: 'ok' }))
-    await assert.rejects(wrap(empty, async () => { ran = true })({}),
-      (e) => e instanceof ToolBlocked && /no verdict/i.test(e.message))
-    assert.equal(ran, false)
-  })
-
-  it('a caller who fails open accepts the verdict-less response too', async () => {
-    let ran = false
-    await wrap(clientOf(async () => ({ status: 'ok' })), async () => { ran = true }, { failOpen: true })({})
-    assert.equal(ran, true)
-  })
-})
-
-// ── Which step is asking ────────────────────────────────────────────────────
-//
-// The gateway's trust.001 rule correlates an exported tool span against the
-// gate call that authorised it BY SPAN ID (lib/trust-checks.js,
-// unverifiedToolSpans). A span id is worth sending only when it names the span
-// this tool call will export as a TOOL span — and protectTool emits no span, so
-// the ambient span is normally the enclosing AGENT span.
-//
-// Sending that agent-span id is strictly worse than sending nothing, because
-// the gateway reads the two halves separately:
-//   - the exact match compares ids, and an agent-span id can never equal a
-//     tool-span id, so that path stays dead either way;
-//   - spanCorrelatedAgents() reads ANY non-`gs_` id as proof this agent CAN be
-//     correlated, which moves it out of trust.001's abstention and into
-//     judgement on the unvalidated (agent, tool) ±2-minute fallback.
-//
-// So the wrong id converts "we refuse to judge you" into a high-severity
-// enforcement_bypass accusation decided by a guess. Field names below are the
-// gateway's: POST /v1/guard/tool-check destructures `trace_id` and `span_id`.
-
-describe('protectTool — span attribution on the tool gate', () => {
-  const sent = () => {
-    const calls = []
-    return [calls, clientOf(async (p) => { calls.push(p); return { action: 'allow' } })]
-  }
-
-  it('does NOT send the id of an enclosing agent span — only its trace', async () => {
-    const [calls, c] = sent()
-    await spanStorage.run({ trace_id: 'tr_abc', span_id: 'sp_def', kind: 'agent' },
-      () => wrap(c, async () => {})({ amount: 1 }))
-    assert.equal(calls[0].trace_id, 'tr_abc', 'the trace id is always true and always useful')
-    assert.ok(!('span_id' in calls[0]),
-      'sent an agent span id: it can never match a tool span, and it tells trust.001 to judge this agent on the fallback')
-  })
-
-  it('does not send the id of an llm or retriever span either', async () => {
-    for (const kind of ['llm', 'retriever', undefined]) {
-      const [calls, c] = sent()
-      await spanStorage.run({ trace_id: 'tr_k', span_id: 'sp_k', kind },
-        () => wrap(c, async () => {})({}))
-      assert.ok(!('span_id' in calls[0]), `sent the id of a ${kind} span`)
-    }
-  })
-
-  it('DOES send the span id when the enclosing span is a tool span', async () => {
-    // The one case where the wrapper knows the id names the span this call
-    // will export: the customer opened `span(name, { kind: 'tool' })` around
-    // it. This is the only way the exact-match path can ever fire.
-    for (const kind of ['tool', 'tool_use', 'tool_call']) {
-      const [calls, c] = sent()
-      await spanStorage.run({ trace_id: 'tr_t', span_id: 'sp_tool', kind },
-        () => wrap(c, async () => {})({}))
-      assert.equal(calls[0].span_id, 'sp_tool', `dropped a ${kind} span id, which is the one worth sending`)
-      assert.equal(calls[0].trace_id, 'tr_t')
-    }
-  })
-
-  it('does not attribute to a remote parent span — that is the CALLER\'s span', async () => {
-    // A propagated context carries no span kind, and the span it names belongs
-    // to whoever called us. Its id can never be this tool call's tool span.
-    const [calls, c] = sent()
-    await remoteStorage.run({ trace_id: 'tr_rem', span_id: 'sp_rem' },
-      () => wrap(c, async () => {})({}))
-    assert.equal(calls[0].trace_id, 'tr_rem', 'the distributed trace is still worth reporting')
-    assert.ok(!('span_id' in calls[0]), 'claimed the calling process\'s span as this tool call\'s span')
-  })
-
-  it('sends the trace id alone when a trace is open but no span is', async () => {
-    const [calls, c] = sent()
-    await traceStorage.run({ trace_id: 'tr_only' }, () => wrap(c, async () => {})({}))
-    assert.equal(calls[0].trace_id, 'tr_only')
-    assert.ok(!('span_id' in calls[0]), 'invented a span id for a trace with no open span')
-  })
-
-  it('OMITS both rather than fabricating when there is no span at all', async () => {
-    const [calls, c] = sent()
-    await wrap(c, async () => {})({})
-    assert.ok(!('span_id' in calls[0]), 'fabricated a span id with no span open')
-    assert.ok(!('trace_id' in calls[0]), 'fabricated a trace id with no trace open')
-  })
-
-  it('drops a gateway-shaped span id rather than echoing it back', async () => {
-    // `gs_…` is what the gateway mints for a caller that sent nothing, and the
-    // rule reads it as "not producer-supplied". An upstream can put one in our
-    // baggage; sending it on would claim we chose it — even from a tool span.
-    const [calls, c] = sent()
-    await spanStorage.run({ trace_id: 'tr_x', span_id: 'gs_deadbeef', kind: 'tool' },
-      () => wrap(c, async () => {})({}))
-    assert.equal(calls[0].trace_id, 'tr_x')
-    assert.ok(!('span_id' in calls[0]))
-  })
-})
-
-describe('protectTool — the tracer supplies the span kind it will export', () => {
-  // The rule above is only enforceable if the ambient store actually says what
-  // kind of span it is. It did not until this change, which is why protectTool
-  // could not tell an agent span from a tool span in the first place.
-  it('a real tracer span carries its kind into the ambient context', async () => {
-    const { CiphyrsTracer } = await import('./tracer.js')
-    const { activeSpanKind } = await import('./context.js')
-    // A fake client, a flush interval no test will reach, and no heartbeat:
-    // this asserts what the ambient store holds, not what ingestion does.
-    const collected = []
-    const client = { _baseUrl: 'http://ciphyrs.invalid', trace: { ingest: async () => ({ ok: true }) } }
-    const t = new CiphyrsTracer(client, { projectName: 'billing', flushIntervalMs: 3_600_000 })
-    const trace = t.trace('checkout')
-    await trace.span('refund', { kind: 'tool' }).run(async () => { collected.push(activeSpanKind()) })
-    const s = trace.span('refund_again', { kind: 'tool' }).enter()
-    collected.push(activeSpanKind())
-    s.end()
-    assert.deepEqual(collected, ['tool', 'tool'],
-      'the span kind did not reach the ambient store, so protectTool cannot tell a tool span from an agent span')
-  })
-})
-
-// ── Human approval ──────────────────────────────────────────────────────────
-
-describe('protectTool — require_approval', () => {
-  const pending = { action: 'require_approval', approval_id: 'a-1', approval_timeout_seconds: 0.2 }
-  const opts = { pollIntervalMs: 1 }
-
-  it('runs the tool once a human approves', async () => {
-    let ran = false
-    const statuses = [{ status: 'pending' }, { status: 'approved' }]
-    let i = 0
-    const c = clientOf(async () => pending, async () => statuses[Math.min(i++, 1)])
-    await wrap(c, async () => { ran = true }, opts)({})
-    assert.equal(ran, true)
-  })
-
-  for (const status of ['denied', 'timeout', 'cancelled']) {
-    it(`blocks ON the ${status} itself, not by outwaiting the window`, async () => {
-      // Asserting only "it throws" is too weak: a terminal status the loop
-      // fails to RECOGNISE still ends in a throw once the deadline passes, so
-      // the test stays green while the agent stalls for the whole window on a
-      // decision already made. 'cancelled' was missing for exactly this reason.
-      let ran = false
-      const started = Date.now()
-      const c = clientOf(async () => pending, async () => ({ status }))
-      await assert.rejects(wrap(c, async () => { ran = true }, opts)({}), (e) => {
-        assert.ok(e instanceof ToolBlocked)
-        assert.ok(!(e instanceof ToolApprovalTimeout),
-          'blocked by running out the clock, not by reading the decision')
-        assert.equal(e.action, status)
-        return true
-      })
-      assert.equal(ran, false)
-      assert.ok(Date.now() - started < 200, 'must return as soon as it is decided')
-    })
-  }
-
-  it('blocks when the window closes with nobody deciding', async () => {
-    // Silence is refusal.
-    let ran = false
-    const c = clientOf(async () => pending, async () => ({ status: 'pending' }))
-    await assert.rejects(wrap(c, async () => { ran = true }, opts)({}), ToolApprovalTimeout)
-    assert.equal(ran, false)
-  })
-
-  it('keeps polling through transient errors rather than giving up', async () => {
-    let n = 0
-    const c = clientOf(async () => pending, async () => {
-      if (n++ < 2) throw new Error('ETIMEDOUT')
-      return { status: 'approved' }
-    })
-    let ran = false
-    await wrap(c, async () => { ran = true }, opts)({})
-    assert.equal(ran, true)
-  })
-
-  it('blocks — never runs — if the poll endpoint is broken for the whole window', async () => {
-    let ran = false
-    const c = clientOf(async () => pending, async () => { throw new Error('ECONNREFUSED') })
-    await assert.rejects(wrap(c, async () => { ran = true }, opts)({}), ToolApprovalTimeout)
-    assert.equal(ran, false)
-  })
-})
-
-// ── Wiring ──────────────────────────────────────────────────────────────────
-
-describe('protectTool — argument handling and wiring', () => {
-  it('requires an agent name', () => {
-    assert.throws(() => protectTool(clientOf(async () => ({})), {}, async () => {}),
-      /opts.agent is required/)
-  })
-
-  it('requires a function', () => {
-    assert.throws(() => protectTool(clientOf(async () => ({})), { agent: 'a' }, null),
-      /a function is required/)
-  })
-
-  it('defaults the reported tool name to the function name', async () => {
-    let sent
-    const c = clientOf(async (p) => { sent = p; return { action: 'allow' } })
-    await protectTool(c, { agent: 'billing-bot' }, async function issueRefund() {})({})
-    assert.equal(sent.tool_name, 'issueRefund')
-    assert.equal(sent.agent_name, 'billing-bot')
-  })
-
-  it('unwraps a lone object so rules can address fields by name', async () => {
-    let sent
-    const c = clientOf(async (p) => { sent = p; return { action: 'allow' } })
-    await wrap(c, async () => {})({ amount: 85000 })
-    // A rule reads `args.amount`; sending {args:[{amount}]} would never match.
-    assert.equal(sent.args.amount, 85000)
-  })
-
-  it('survives arguments JSON cannot represent', async () => {
-    let sent
-    const c = clientOf(async (p) => { sent = p; return { action: 'allow' } })
-    const cyclic = { name: 'x' }; cyclic.self = cyclic
-    await wrap(c, async () => {})(cyclic)
-    // Must not throw: a serialization failure inside the guard would take down
-    // the tool call it is supposed to be protecting.
-    assert.ok(sent !== undefined)
-  })
-})

package/src/secret-detector.test.js

@@ -1,155 +0,0 @@
-/**
- * SecretDetector — credential scanning in the published @ciphyrshq/sdk.
- * Run with: npm test
- *
- * A detector has two ways to fail and they are not symmetric. A false positive
- * is noise. A false NEGATIVE is a credential that went out in a prompt and
- * nobody knew — so most of this file is "does it still find X", pinned per
- * pattern so a regex edit cannot quietly narrow one.
- *
- * The third failure is the one this suite was written after: the finding
- * ITSELF leaking the secret. Findings are meant to be safe to log and to show
- * on a dashboard, and value_masked used to reveal the first four and last four
- * characters regardless of length — which on a short match is all of them.
- */
-
-// No test in this package may open a socket — see no-network.test-helper.js.
-// Imported per file because node --test runs each file in its own process.
-import './no-network.test-helper.js'
-import { describe, it } from 'node:test'
-import assert from 'node:assert/strict'
-import { SecretDetector, maskSecret } from './secret-detector.js'
-
-const d = new SecretDetector()
-const types = (text) => d.detect(text).map((f) => f.type)
-
-// ── The masked value must not be the secret ─────────────────────────────────
-
-describe('maskSecret — a mask that hides less than half is not a mask', () => {
-  it('reveals nothing from a short value', () => {
-    // xoxb-1234 is a legal match for the Slack pattern (xox[bpras]- plus one
-    // or more chars). Under the old rule it masked to "xoxb***1234".
-    assert.equal(maskSecret('xoxb-1234'), '***')
-  })
-
-  it('never leaves the majority of a value visible, at any length', () => {
-    for (let n = 1; n <= 80; n++) {
-      const secret = 'a'.repeat(n)
-      const revealed = maskSecret(secret).replace(/\*/g, '').length
-      assert.ok(revealed * 2 <= n || revealed === 0,
-        `length ${n}: ${revealed} of ${n} characters revealed`)
-    }
-  })
-
-  it('is never longer than the value it masks, for values worth masking', () => {
-    // "xoxb***1234" was eleven characters standing in for a nine-character
-    // secret — a tell that the mask was adding information, not removing it.
-    for (let n = 12; n <= 80; n++) {
-      const secret = 'a'.repeat(n)
-      assert.ok(maskSecret(secret).length <= n, `length ${n} grew`)
-    }
-  })
-
-  it('still gives enough of a long key to identify it', () => {
-    // The point of masking rather than dropping: an operator has to be able to
-    // tell WHICH key leaked in order to rotate it.
-    const masked = maskSecret('AKIAIOSFODNN7EXAMPLE')
-    assert.ok(masked.startsWith('AKI'))
-    assert.ok(masked.includes('***'))
-    assert.ok(!masked.includes('IOSFODNN7'))
-  })
-
-  it('applies to what detect() reports, not just the helper', () => {
-    const [finding] = d.detect('token=xoxb-1234')
-    assert.ok(finding)
-    assert.ok(!finding.value_masked.includes('1234'),
-      'the finding published the secret it found')
-  })
-})
-
-// ── Per-pattern coverage ────────────────────────────────────────────────────
-
-describe('SecretDetector — finds each credential class', () => {
-  const CASES = [
-    ['aws_access_key', 'AKIAIOSFODNN7EXAMPLE'],
-    ['github_token', 'ghp_' + 'a'.repeat(36)],
-    ['gitlab_token', 'glpat-' + 'a'.repeat(20)],
-    ['slack_token', 'xoxb-123456789012-abcdefghijkl'],
-    ['stripe_key', 'sk_live_' + 'a'.repeat(24)],
-    ['jwt', 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc123def456'],
-    ['private_key', '-----BEGIN RSA PRIVATE KEY-----'],
-    ['generic_api_key', 'api_key="' + 'a'.repeat(24) + '"'],
-  ]
-
-  for (const [type, sample] of CASES) {
-    it(`detects ${type}`, () => {
-      assert.ok(types(sample).includes(type), `missed ${type} in: ${sample}`)
-    })
-  }
-
-  it('finds a secret embedded in ordinary prose', () => {
-    const text = `Here is the key you asked for: ghp_${'b'.repeat(36)} — do not share it.`
-    assert.ok(types(text).includes('github_token'))
-  })
-
-  it('finds every occurrence, not just the first', () => {
-    const text = `AKIAIOSFODNN7EXAMPLE and AKIA${'B'.repeat(16)}`
-    assert.equal(types(text).filter((t) => t === 'aws_access_key').length, 2)
-  })
-
-  it('reports offsets that actually locate the match', () => {
-    // A consumer redacts text.slice(start, end); off-by-one here leaves a
-    // character of the credential behind.
-    const text = `prefix ghp_${'c'.repeat(36)} suffix`
-    const f = d.detect(text).find((x) => x.type === 'github_token')
-    assert.equal(text.slice(f.start, f.end), `ghp_${'c'.repeat(36)}`)
-  })
-})
-
-// ── Input handling ──────────────────────────────────────────────────────────
-
-describe('SecretDetector — inputs that are not text', () => {
-  for (const [label, input] of [
-    ['null', null], ['undefined', undefined], ['empty string', ''],
-    ['a number', 42], ['an object', { a: 1 }], ['an array', []],
-  ]) {
-    it(`returns [] for ${label} rather than throwing`, () => {
-      // This runs inside the request path of a shipped SDK; throwing here
-      // would take down the call it is meant to be inspecting.
-      assert.deepEqual(d.detect(input), [])
-    })
-  }
-
-  it('finds nothing in clean text', () => {
-    assert.deepEqual(d.detect('Please refund order 1234 for the customer.'), [])
-  })
-
-  it('does not carry regex state between calls', () => {
-    // Every pattern is /g. Reusing a global regex across calls advances
-    // lastIndex and makes the SECOND scan of the same text miss — the classic
-    // way a detector goes quiet under load. detect() clones each pattern.
-    const text = 'AKIAIOSFODNN7EXAMPLE'
-    assert.deepEqual(types(text), types(text))
-    assert.ok(types(text).includes('aws_access_key'))
-  })
-})
-
-// ── Known imprecision, pinned deliberately ──────────────────────────────────
-
-describe('SecretDetector — documented false positives', () => {
-  it('flags any 40-character base64-ish run as a possible AWS secret', () => {
-    // A git SHA-1 is forty hex characters and matches. This is why the pattern
-    // carries confidence 0.7 rather than 0.95: it is a prompt to look, not a
-    // verdict. Pinned so that a future "cleanup" of the confidence field does
-    // not silently promote this to a certainty.
-    const findings = d.detect('commit ' + 'a'.repeat(40) + ' ')
-    const aws = findings.find((f) => f.type === 'aws_secret_key')
-    assert.ok(aws)
-    assert.ok(aws.confidence < 0.8, 'a heuristic must not report high confidence')
-  })
-
-  it('keeps high confidence for patterns that are unambiguous', () => {
-    const gh = d.detect('ghp_' + 'a'.repeat(36))[0]
-    assert.ok(gh.confidence >= 0.95)
-  })
-})