@desplega.ai/agent-swarm 1.164.1 → 1.166.0

package/src/tests/secret-scrubber.test.ts

@@ -1,12 +1,14 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import {
   clearVolatileSecretsForTesting,
+  isSensitiveKey,
   refreshSecretScrubberCache,
   registerSensitiveKeyName,
   registerVolatileSecret,
   scrubObject,
   scrubSecrets,
 } from "../utils/secret-scrubber";
+import { randomToken } from "./synthetic-secret-helpers";
 
 // Snapshot/restore process.env between tests so env-derived cache entries
 // don't leak across cases.
@@ -233,7 +235,8 @@ describe("scrubSecrets — regex patterns", () => {
 
   test("regex patterns catch tokens even when env is empty", () => {
     // Fresh env — no secrets registered — regex should still catch well-known shapes.
-    const out = scrubSecrets("token=example-ghp_1234567890abcdefABCDEF1234567890ABCD");
+    // `note=` is not a sensitive key, so only the token-shape pass can fire.
+    const out = scrubSecrets(`note=example-${"ghp_"}1234567890abcdefABCDEF1234567890ABCD`);
     expect(out).toContain("[REDACTED:github_token]");
   });
 
@@ -538,6 +541,32 @@ describe("scrubSecrets — env dumps and escaped forms", () => {
     expect(scrubSecrets(jsonBody(s))).toBe(jsonBody(want));
   });
 
+  // retry: wall-clock bound on a shared CI runner; a quadratic rescan takes seconds.
+  test(
+    "an unterminated escaped JSON value resumes the key scan where it stopped",
+    () => {
+      // The value walk stops on the bare quote; the next key still redacts.
+      const s = String.raw`log \"token\":\"abc\\"password\":\"s3cr3tval\" end`;
+      expect(scrubSecrets(s)).toBe(
+        String.raw`log \"token\":\"abc\\"password\":\"[REDACTED:password]\" end`,
+      );
+
+      // ~200 KB single lines of escaped key fragments whose values never close.
+      for (const fragment of [
+        String.raw`\\\"token\\\":\\\"`,
+        String.raw`\"token\":\"\\\"`,
+        String.raw`\"token\":\"\\`,
+        String.raw`\"token\":\"`,
+      ]) {
+        const input = fragment.repeat(Math.ceil(200_000 / fragment.length));
+        const start = performance.now();
+        scrubSecrets(input);
+        expect(performance.now() - start).toBeLessThan(50);
+      }
+    },
+    { retry: 2 },
+  );
+
   test("a quoted value closed at end of line may span lines", () => {
     const dump = `${declareX("DEMO_MULTI_TOKEN", "line1\nline2")}\n${declareX("USER", "deploy")}`;
     const want = `declare -x DEMO_MULTI_TOKEN="[REDACTED:DEMO_MULTI_TOKEN]"\n${declareX("USER", "deploy")}`;
@@ -558,3 +587,290 @@ describe("scrubSecrets — env dumps and escaped forms", () => {
     }
   });
 });
+
+// Every credential below is built at runtime; nothing secret-shaped is a literal.
+function pemBlock(label: string): string {
+  const body = Array.from({ length: 5 }, () => randomToken(64)).join("\n");
+  return `-----BEGIN ${label}PRIVATE KEY-----\n${body}\n-----END ${label}PRIVATE KEY-----`;
+}
+
+interface ProbeCase {
+  shape: string;
+  input: string;
+  want: string;
+  secret: string;
+}
+
+function probeCases(): ProbeCase[] {
+  const cases: ProbeCase[] = [];
+  const add = (shape: string, secret: string, input: string, want: string) =>
+    cases.push({ shape, input, want, secret });
+  let s = randomToken(24);
+  add("bare PRIVATE_KEY=", s, `PRIVATE_KEY=${s}`, "PRIVATE_KEY=[REDACTED:PRIVATE_KEY]");
+  s = randomToken(24);
+  add("bare SECRET=", s, `SECRET=${s} next`, "SECRET=[REDACTED:SECRET] next");
+  s = randomToken(10);
+  add("bare PASSWORD=", s, `PASSWORD='${s}'`, "PASSWORD='[REDACTED:PASSWORD]'");
+  s = randomToken(32);
+  add("lowercase api_key=", s, `api_key=${s}`, "api_key=[REDACTED:api_key]");
+  s = randomToken(32);
+  add(
+    "dotted SLACK.BOT.TOKEN=",
+    s,
+    `SLACK.BOT.TOKEN=${s}`,
+    "SLACK.BOT.TOKEN=[REDACTED:SLACK.BOT.TOKEN]",
+  );
+  s = randomToken(40);
+  add(
+    "AWS_SECRET_ACCESS_KEY=",
+    s,
+    `export AWS_SECRET_ACCESS_KEY=${s}`,
+    "export AWS_SECRET_ACCESS_KEY=[REDACTED:AWS_SECRET_ACCESS_KEY]",
+  );
+  s = randomToken(40);
+  add(
+    "INI aws_secret_access_key = …",
+    s,
+    `[default]\naws_secret_access_key = ${s}\nregion = us-east-1`,
+    "[default]\naws_secret_access_key = [REDACTED:aws_secret_access_key]\nregion = us-east-1",
+  );
+  s = randomToken(20);
+  add(
+    "DATABASE_URL with userinfo",
+    s,
+    `DATABASE_URL=postgres://app:${s}@db.example:5432/x`,
+    "DATABASE_URL=postgres://app:[REDACTED:url_password]@db.example:5432/x",
+  );
+  s = randomToken(20);
+  add(
+    "https URL with userinfo",
+    s,
+    `git clone https://bob:${s}@git.example/r.git`,
+    "git clone https://bob:[REDACTED:url_password]@git.example/r.git",
+  );
+  for (const label of ["RSA ", "OPENSSH "]) {
+    const pem = pemBlock(label);
+    add(
+      `${label}PEM block`,
+      pem.split("\n")[2] ?? "",
+      `key:\n${pem}\ndone`,
+      `key:\n-----BEGIN ${label}PRIVATE KEY-----[REDACTED:private_key]-----END ${label}PRIVATE KEY-----\ndone`,
+    );
+  }
+  const gcpPem = pemBlock("");
+  add(
+    "GCP service-account JSON private_key",
+    gcpPem.split("\n")[2] ?? "",
+    JSON.stringify({
+      type: "service_account",
+      private_key: `${gcpPem}\n`,
+      client_email: "bot@x.example",
+    }),
+    '{"type":"service_account","private_key":"-----BEGIN PRIVATE KEY-----[REDACTED:private_key]-----END PRIVATE KEY-----\\n","client_email":"bot@x.example"}',
+  );
+  s = `${randomToken(30)}.${randomToken(20)}`;
+  add(
+    "Authorization: Bearer (raw)",
+    s,
+    `Authorization: Bearer ${s}\nAccept: */*`,
+    "Authorization: Bearer [REDACTED:authorization]\nAccept: */*",
+  );
+  s = randomToken(40);
+  add(
+    "Authorization: Bearer (JSON headers)",
+    s,
+    JSON.stringify({ headers: { Authorization: `Bearer ${s}`, Accept: "x" } }),
+    '{"headers":{"Authorization":"Bearer [REDACTED:authorization]","Accept":"x"}}',
+  );
+  s = randomToken(32);
+  add("x-api-key header", s, `x-api-key: ${s}`, "x-api-key: [REDACTED:x_api_key]");
+  s = randomToken(40);
+  add(
+    "curl -H 'Authorization: token …'",
+    s,
+    `curl -H 'Authorization: token ${s}' https://api.example/x`,
+    "curl -H 'Authorization: token [REDACTED:authorization]' https://api.example/x",
+  );
+  s = randomToken(14);
+  add(
+    "curl --password",
+    s,
+    `curl --user bob --password ${s} https://x.example`,
+    "curl --user bob --password [REDACTED:curl_password] https://x.example",
+  );
+  s = randomToken(14);
+  add(
+    "curl -u user:pass",
+    s,
+    `curl -u bob:${s} https://x.example`,
+    "curl -u bob:[REDACTED:curl_password] https://x.example",
+  );
+  s = `${randomToken(8)}\\"${randomToken(8)}`;
+  add(
+    'JSON "password" (with an escaped quote)',
+    s,
+    `{"user":"bob","password":"${s}"}`,
+    '{"user":"bob","password":"[REDACTED:password]"}',
+  );
+  s = randomToken(32);
+  add('JSON "apiKey"', s, JSON.stringify({ apiKey: s }), '{"apiKey":"[REDACTED:apiKey]"}');
+  s = randomToken(32);
+  add(
+    'JSON "client_secret"',
+    s,
+    JSON.stringify({ client_id: "abc", client_secret: s }),
+    '{"client_id":"abc","client_secret":"[REDACTED:client_secret]"}',
+  );
+  s = randomToken(32);
+  add(
+    "YAML token:",
+    s,
+    `auth:\n  token: ${s}\n  user: bob\n`,
+    "auth:\n  token: [REDACTED:token]\n  user: bob\n",
+  );
+  return cases;
+}
+
+describe("scrubSecrets — structured credentials (audit probe)", () => {
+  for (const { shape, input, want, secret } of probeCases()) {
+    test(shape, () => {
+      expect(secret.length).toBeGreaterThan(8);
+      // Raw, and JSON-escaped as the line lands in session_logs.
+      for (const [text, expected] of [
+        [input, want],
+        [jsonBody(input), jsonBody(want)],
+      ]) {
+        const out = scrubSecrets(text);
+        expect(out).not.toContain(secret);
+        expect(out).toContain("[REDACTED:");
+        expect(out).toBe(expected as string);
+        expect(scrubSecrets(out)).toBe(out);
+      }
+    });
+  }
+
+  test("a JSON private_key value is consumed whole across \\n escapes", () => {
+    const tail = randomToken(24);
+    const input = JSON.stringify({ private_key: `${randomToken(16)}\n${tail}\n` });
+    expect(scrubSecrets(input)).toBe('{"private_key":"[REDACTED:private_key]"}');
+  });
+
+  test("a sensitive key nested under a dotted path still counts", () => {
+    const s = randomToken(20);
+    expect(scrubSecrets(`config.SECRETS_ENCRYPTION_KEY=${s}`)).toBe(
+      "config.SECRETS_ENCRYPTION_KEY=[REDACTED:config.SECRETS_ENCRYPTION_KEY]",
+    );
+  });
+
+  test("isSensitiveKey normalizes case, camelCase, dots and dashes", () => {
+    for (const key of [
+      "apiKey",
+      "client_secret",
+      "x-api-key",
+      "slack.bot.token",
+      "secretAccessKey",
+      "SENTRY_DSN",
+      "DEPLOY_CREDENTIALS",
+      "passwd",
+    ]) {
+      expect(isSensitiveKey(key)).toBe(true);
+    }
+    for (const key of [
+      "PWD",
+      "SORT_KEY",
+      "primaryKey",
+      "contextKey",
+      "max_tokens",
+      "token_count",
+      "nextPageToken",
+      "GOOGLE_APPLICATION_CREDENTIALS",
+      "MCP_BASE_URL",
+    ]) {
+      expect(isSensitiveKey(key)).toBe(false);
+    }
+  });
+});
+
+describe("scrubSecrets — over-redaction guards", () => {
+  test("non-secret text stays byte-identical, raw and JSON-escaped", () => {
+    const sha = randomToken(40)
+      .toLowerCase()
+      .replace(/[^0-9a-f]/g, "0");
+    const png = `data:image/png;base64,${Buffer.from(randomToken(60)).toString("base64")}`;
+    const lines = [
+      "max_tokens=4096",
+      '"input_tokens": 1234',
+      "token_count: 12",
+      "PWD=/workspace",
+      "SORT_KEY=abc",
+      "primaryKey: id",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: testing workflow syntax
+      "password: ${{ secrets.DB_PASSWORD }}",
+      "token: <your-token>",
+      "Authorization: Bearer [REDACTED:x]",
+      `commit ${sha}`,
+      crypto.randomUUID(),
+      `task: ${crypto.randomUUID()}`,
+      png,
+      "https://github.com/org/repo",
+      "const password = getPassword()",
+      // Code and prose that share a key name with a credential.
+      "  token: string;",
+      "  password: process.env.DB_PASSWORD",
+      "token = get_token()",
+      "    password = pwd",
+      "Authorization: Bearer followed by the token",
+      '{"nextPageToken":"CAoQAA","secret":false,"token":null}',
+      "docker run -u 1000:1000 -u node:node img",
+      "echo $PW | docker login --password-stdin",
+      "http://localhost:3013/x?email=a@b.example",
+      "GOOGLE_APPLICATION_CREDENTIALS=/home/worker/.config/gcloud/sa.json",
+      "      - uses: actions/checkout@v4",
+      "postgres://app:***@db.example/x",
+    ];
+    for (const line of lines) {
+      expect(scrubSecrets(line)).toBe(line);
+      expect(scrubSecrets(jsonBody(line))).toBe(jsonBody(line));
+    }
+    const all = lines.join("\n");
+    expect(scrubSecrets(all)).toBe(all);
+    expect(scrubSecrets(jsonBody(all))).toBe(jsonBody(all));
+  });
+
+  // Each input is ~200 KB and built to make a naive pattern backtrack.
+  // Allow shared-runner headroom; a real ReDoS on these inputs takes seconds.
+  // retry: tolerate transient contention without weakening the per-input guard.
+  test(
+    "new key-context rules stay linear on 200 KB adversarial input",
+    () => {
+      const inputs = [
+        `-----BEGIN RSA PRIVATE KEY-----${"A".repeat(200_000)}`,
+        "-----BEGIN RSA PRIVATE KEY-----\n".repeat(6_000),
+        `"password": "${"\\\\".repeat(100_000)}`,
+        `\\"password\\": \\"${"\\\\".repeat(100_000)}`,
+        `"password": "${"a".repeat(200_000)}`,
+        `\\"password\\": \\"${"a".repeat(200_000)}`,
+        `"password": "`.repeat(14_000),
+        `token: ${"a".repeat(200_000)} x`,
+        "token: a\n".repeat(25_000),
+        `password = ${"a".repeat(200_000)} x`,
+        "Authorization: Bearer ".repeat(9_000),
+        `Authorization: Bearer ${"A".repeat(200_000)}[`,
+        "a".repeat(200_000),
+        `https://${"u".repeat(200_000)}`,
+        "a://a:".repeat(33_000),
+        " -u a:".repeat(33_000),
+        `curl -u ${"a".repeat(200_000)}`,
+        "a.".repeat(100_000),
+        "\\n".repeat(100_000),
+        `"${"a".repeat(63)}":`.repeat(3_000),
+      ];
+      for (const input of inputs) {
+        const start = performance.now();
+        scrubSecrets(input);
+        expect(performance.now() - start).toBeLessThan(500);
+      }
+    },
+    { retry: 2 },
+  );
+});

package/src/tests/session-costs-golden.test.ts

@@ -344,6 +344,23 @@ describe("Phase 3 — session cost recompute golden fixtures", () => {
     expect(auto.cost.costSource).toBe("unpriced");
   });
 
+  // Boot-seeded rows only: grok rows project the models.dev xAI section.
+  test("grok runs price from the seeded xAI rates", async () => {
+    const body = await postCost({
+      sessionId: "grok-4-6",
+      provider: "grok",
+      model: "grok-4.6",
+      totalCostUsd: 0,
+      inputTokens: 2_000,
+      outputTokens: 300,
+      cacheReadTokens: 1_000,
+    });
+    const expected = (2_000 * 2 + 1_000 * 0.5 + 300 * 6) / 1_000_000;
+
+    expect(body.cost.costSource).toBe("pricing-table");
+    expectExact(body.cost.totalCostUsd, expected);
+  });
+
   test("legacy cache writes without a TTL split keep the 5m class", async () => {
     await seedModelRates("claude", "claude-legacy-cache-write", {
       input: 5,

package/src/tests/slack-egress-scrub.test.ts

@@ -0,0 +1,216 @@
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { App, webApi } from "@slack/bolt";
+import { sendKapsoText } from "../integrations/kapso/client";
+import { installSlackEgressScrub } from "../slack/egress-scrub";
+import type { ExecutorDependencies } from "../workflows/executors/base";
+import { NotifyExecutor } from "../workflows/executors/notify";
+
+// Built at runtime so no secret-shaped literal sits in the repo.
+const SECRET = `ghp_${"Z".repeat(36)}`;
+const REDACTED = "[REDACTED:";
+
+type Captured = { method: string; body: string; params: URLSearchParams };
+
+const captured: Captured[] = [];
+const uploads: Uint8Array[] = [];
+let server: ReturnType<typeof Bun.serve>;
+let baseUrl = "";
+
+beforeAll(() => {
+  installSlackEgressScrub();
+  server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const { pathname } = new URL(req.url);
+      if (pathname.startsWith("/upload/")) {
+        // web-api posts the file as multipart form data under the `body` field.
+        const file = (await req.formData()).get("body") as Blob;
+        uploads.push(new Uint8Array(await file.arrayBuffer()));
+        return new Response("OK");
+      }
+      const method = pathname.replace(/^\/api\//, "");
+      const body = await req.text();
+      captured.push({ method, body, params: new URLSearchParams(body) });
+      if (method === "files.getUploadURLExternal") {
+        return Response.json({ ok: true, upload_url: `${baseUrl}upload/F1`, file_id: "F1" });
+      }
+      if (method === "files.completeUploadExternal") {
+        return Response.json({ ok: true, files: [{ id: "F1" }] });
+      }
+      return Response.json({ ok: true, ts: "1.000001", channel: "C1", messages: [] });
+    },
+  });
+  baseUrl = `http://localhost:${server.port}/`;
+});
+
+afterAll(() => {
+  server.stop(true);
+});
+
+afterEach(() => {
+  captured.length = 0;
+  uploads.length = 0;
+});
+
+function client(): InstanceType<typeof webApi.WebClient> {
+  return new webApi.WebClient("xoxb-test", {
+    slackApiUrl: `${baseUrl}api/`,
+    retryConfig: { retries: 0 },
+  });
+}
+
+function lastCall(method: string): Captured {
+  const call = captured.findLast((c) => c.method === method);
+  if (!call) throw new Error(`no ${method} call captured`);
+  return call;
+}
+
+function expectRedacted(text: string | null | undefined): void {
+  expect(text).toBeTruthy();
+  expect(text).not.toContain(SECRET);
+  expect(text).toContain(REDACTED);
+}
+
+describe("Slack client egress scrub", () => {
+  test("chat.postMessage scrubs text and keeps Block Kit structure", async () => {
+    await client().chat.postMessage({
+      channel: "C1",
+      text: `deploy key ${SECRET}`,
+      unfurl_links: false,
+      unfurl_media: false,
+      blocks: [
+        { type: "section", text: { type: "mrkdwn", text: `token: ${SECRET} end` } },
+        { type: "divider" },
+      ],
+    });
+    const call = lastCall("chat.postMessage");
+    expect(call.body).not.toContain(SECRET);
+    expectRedacted(call.params.get("text"));
+    const blocks = JSON.parse(call.params.get("blocks") ?? "null");
+    expect(Array.isArray(blocks)).toBe(true);
+    expect(blocks).toHaveLength(2);
+    expect(blocks[0].type).toBe("section");
+    expect(blocks[0].text.text).toStartWith("token: ");
+    expect(blocks[0].text.text).toEndWith(" end");
+    expectRedacted(blocks[0].text.text);
+    expect(blocks[1]).toEqual({ type: "divider" });
+    expect(call.params.get("channel")).toBe("C1");
+  });
+
+  test("chat.update and chat.postEphemeral are scrubbed", async () => {
+    const c = client();
+    await c.chat.update({
+      channel: "C1",
+      ts: "1.0",
+      text: `edit ${SECRET}`,
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+    await c.chat.postEphemeral({ channel: "C1", user: "U1", text: `psst ${SECRET}` });
+    expectRedacted(lastCall("chat.update").params.get("text"));
+    expectRedacted(lastCall("chat.postEphemeral").params.get("text"));
+  });
+
+  test("files.uploadV2 scrubs text content, comment and title", async () => {
+    await client().files.uploadV2({
+      channel_id: "C1",
+      content: `line one\nexport GH=${SECRET}\n`,
+      filename: "report.txt",
+      title: `report ${SECRET}`,
+      initial_comment: `see ${SECRET}`,
+    });
+    expect(uploads).toHaveLength(1);
+    const uploaded = new TextDecoder().decode(uploads[0]);
+    expect(uploaded).toStartWith("line one\n");
+    expectRedacted(uploaded);
+    const complete = lastCall("files.completeUploadExternal");
+    expect(complete.body).not.toContain(SECRET);
+    expectRedacted(complete.params.get("initial_comment"));
+    expectRedacted(complete.params.get("files"));
+  });
+
+  test("binary uploads pass through byte-identical", async () => {
+    const bytes = Buffer.concat([Buffer.from([0, 255, 1, 254]), Buffer.from(SECRET)]);
+    await client().files.uploadV2({ channel_id: "C1", file: bytes, filename: "blob.bin" });
+    expect(uploads).toHaveLength(1);
+    expect(Buffer.from(uploads[0]).equals(bytes)).toBe(true);
+  });
+
+  test("a second install does not double-wrap", async () => {
+    const proto = webApi.WebClient.prototype;
+    const before = proto.apiCall;
+    installSlackEgressScrub();
+    expect(proto.apiCall).toBe(before);
+  });
+
+  test("a Bolt App built after install scrubs app.client sends", async () => {
+    const app = new App({
+      token: "xoxb-test",
+      signingSecret: "test-signing-secret",
+      tokenVerificationEnabled: false,
+      clientOptions: { slackApiUrl: `${baseUrl}api/`, retryConfig: { retries: 0 } },
+    });
+    await app.client.chat.postMessage({
+      channel: "C1",
+      text: `bolt ${SECRET}`,
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+    expectRedacted(lastCall("chat.postMessage").params.get("text"));
+  });
+});
+
+describe("WhatsApp and notify egress scrub", () => {
+  const originalFetch = globalThis.fetch;
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  test("sendKapsoText scrubs the message body", async () => {
+    let sent = "";
+    globalThis.fetch = (async (_url: string, init: RequestInit) => {
+      sent = init.body as string;
+      return Response.json({ messages: [{ id: "wamid.X" }] });
+    }) as typeof fetch;
+    const result = await sendKapsoText({
+      apiBaseUrl: "https://kapso.invalid",
+      apiKey: "k",
+      phoneNumberId: "1",
+      to: "2",
+      body: `hola ${SECRET}`,
+    });
+    expect(result.ok).toBe(true);
+    const body = JSON.parse(sent) as { text: { body: string } };
+    expect(body.text.body).toStartWith("hola ");
+    expectRedacted(body.text.body);
+  });
+
+  test("notify executor scrubs the message before posting and in its output", async () => {
+    const posted: string[] = [];
+    const deps = {
+      db: {
+        postMessage: (_channel: string, _agent: string | null, content: string) => {
+          posted.push(content);
+          return { id: "m1" };
+        },
+      },
+      eventBus: { emit: () => {}, on: () => {}, off: () => {} },
+      interpolate: (template: string, ctx: Record<string, unknown>) =>
+        template.replace("{{v}}", String(ctx.v)),
+    } as unknown as ExecutorDependencies;
+    const result = await new NotifyExecutor(deps).run({
+      config: { channel: "swarm", target: "chan", template: "value {{v}}" },
+      context: { v: SECRET },
+      meta: {
+        runId: "00000000-0000-0000-0000-000000000001",
+        stepId: "00000000-0000-0000-0000-000000000002",
+        nodeId: "n",
+        workflowId: "00000000-0000-0000-0000-000000000003",
+        dryRun: false,
+      },
+    });
+    expect(result.status).toBe("success");
+    expectRedacted(posted[0]);
+    expectRedacted((result.output as { message: string }).message);
+  });
+});