@desplega.ai/agent-swarm 1.165.0 → 1.166.0

package/src/tests/secret-registry.test.ts

@@ -0,0 +1,355 @@
+/**
+ * The API-side secret registry (src/be/secret-registry.ts) and the scrubber's
+ * combined known-value matcher.
+ *
+ * Every secret here is built at runtime from random bytes. Assertions check
+ * both directions: the value is gone, and the `[REDACTED:` marker plus the
+ * surrounding non-secret text survive.
+ */
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { __resetEncryptionKeyForTests, encryptSecret } from "../be/crypto";
+import {
+  closeDb,
+  createAgent,
+  createMcpServer,
+  getDbClient,
+  initDb,
+  upsertSwarmConfig,
+} from "../be/db";
+import { upsertMcpOAuthToken } from "../be/db-queries/mcp-oauth";
+import {
+  getOAuthApp,
+  updateAuthorizationTokens,
+  upsertAuthorization,
+  upsertOAuthApp,
+} from "../be/db-queries/oauth";
+import { createScriptApi, insertScript, rotateScriptApiSecret } from "../be/scripts/db";
+import { encodedForms, loadSecretRegistry, registerStoredSecret } from "../be/secret-registry";
+import {
+  clearVolatileSecretsForTesting,
+  refreshSecretScrubberCache,
+  registerVolatileSecret,
+  scrubSecrets,
+} from "../utils/secret-scrubber";
+import { randomToken } from "./synthetic-secret-helpers";
+
+let tempDir: string;
+let savedKey: string | undefined;
+let agentId: string;
+
+/**
+ * A synthetic secret with `/`, `+` and `=` in it, so its URL-encoded form
+ * differs from the raw value and its base64 is not just alphanumerics.
+ */
+function makeSecret(label: string): string {
+  return [label, `${randomToken(12)}/${randomToken(12)}+${randomToken(8)}=`].join("_");
+}
+
+const PREFIX = "deploy step 4 printed";
+const SUFFIX = "and moved on";
+
+function wrap(form: string): string {
+  return `${PREFIX} ${form} ${SUFFIX}`;
+}
+
+/** Every encoded shape of `value` a log line can carry, keyed by shape name. */
+function shapes(value: string): Record<string, string> {
+  return {
+    raw: value,
+    base64: Buffer.from(value).toString("base64"),
+    base64url: Buffer.from(value).toString("base64url"),
+    urlEncoded: encodeURIComponent(value),
+  };
+}
+
+/** The value survives scrubbing in every shape (nothing knows it yet). */
+function expectKnownNowhere(value: string): void {
+  for (const form of Object.values(shapes(value))) {
+    expect(scrubSecrets(wrap(form))).toBe(wrap(form));
+  }
+}
+
+/** The value is redacted in every shape, marker and context intact. */
+function expectRedactedEverywhere(value: string, name: string): void {
+  for (const [shape, form] of Object.entries(shapes(value))) {
+    const out = scrubSecrets(wrap(form));
+    expect({ shape, leaked: out.includes(form) }).toEqual({ shape, leaked: false });
+    expect(out).toBe(`${PREFIX} [REDACTED:${name}] ${SUFFIX}`);
+  }
+  // Embedded in a larger base64 blob at each byte offset mod 3 (Basic auth).
+  for (const user of ["ab:", "abc:", "abcd:"]) {
+    const basic = `Authorization: Basic ${Buffer.from(`${user}${value}`).toString("base64")} ok`;
+    expect(scrubSecrets(basic)).toMatch(
+      new RegExp(
+        `^Authorization: Basic [A-Za-z0-9+/]{4,8}\\[REDACTED:${escapeRe(name)}\\][A-Za-z0-9+/=]{0,4} ok$`,
+      ),
+    );
+  }
+}
+
+function escapeRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+beforeAll(async () => {
+  savedKey = process.env.SECRETS_ENCRYPTION_KEY;
+  process.env.SECRETS_ENCRYPTION_KEY = randomBytes(32).toString("base64");
+  __resetEncryptionKeyForTests();
+  tempDir = mkdtempSync(join(tmpdir(), "secret-registry-"));
+  closeDb();
+  initDb(join(tempDir, "registry.sqlite"));
+  refreshSecretScrubberCache();
+  const agent = await createAgent({ name: "registry-worker", isLead: false, status: "idle" });
+  agentId = agent.id;
+});
+
+afterAll(() => {
+  closeDb();
+  clearVolatileSecretsForTesting();
+  if (savedKey === undefined) delete process.env.SECRETS_ENCRYPTION_KEY;
+  else process.env.SECRETS_ENCRYPTION_KEY = savedKey;
+  __resetEncryptionKeyForTests();
+  refreshSecretScrubberCache();
+  rmSync(tempDir, { recursive: true, force: true });
+});
+
+describe("secret registry boot load", () => {
+  test("redacts every stored secret and its encoded forms after a simulated restart", async () => {
+    const configValue = makeSecret("regcfg");
+    await upsertSwarmConfig({
+      scope: "agent",
+      scopeId: agentId,
+      key: "REGISTRY_PROBE_TOKEN",
+      value: configValue,
+      isSecret: true,
+    });
+
+    const clientSecret = makeSecret("regclient");
+    const accessToken = makeSecret("regaccess");
+    const refreshToken = makeSecret("regrefresh");
+    await upsertOAuthApp("regprovider", {
+      clientId: "registry-client",
+      clientSecret,
+      authorizeUrl: "https://auth.example.test/authorize",
+      tokenUrl: "https://auth.example.test/token",
+      redirectUri: "https://swarm.example.test/callback",
+      scopes: "read",
+    });
+    const app = await getOAuthApp("regprovider");
+    if (!app) throw new Error("oauth app missing");
+    await upsertAuthorization({ appId: app.id, accessToken, refreshToken });
+
+    const server = await createMcpServer({
+      name: `registry-mcp-${randomToken(6)}`,
+      transport: "http",
+      url: "https://mcp.example.test",
+      scope: "swarm",
+    });
+    const mcpAccess = makeSecret("regmcp");
+    await upsertMcpOAuthToken({
+      mcpServerId: server.id,
+      accessToken: mcpAccess,
+      refreshToken: null,
+      resourceUrl: "https://mcp.example.test/",
+      authorizationServerIssuer: "https://as.example.test",
+      authorizeUrl: "https://as.example.test/authorize",
+      tokenUrl: "https://as.example.test/token",
+      clientSource: "manual",
+    });
+
+    const script = await insertScript({
+      name: `registry-probe-${randomToken(6)}`,
+      scope: "agent",
+      scopeId: agentId,
+      source: "export default async function run() { return {}; }",
+      description: "registry probe",
+      intent: "test fixture",
+      signatureJson: "{}",
+      argsJsonSchema: null,
+      agentId,
+      typeChecked: true,
+    });
+    const api = await createScriptApi({ scriptId: script.id, agentId, authMode: "bearer" });
+    if (!api.token) throw new Error("bearer token missing");
+    const scriptToken = api.token;
+
+    // Simulated restart: the scrubber forgets everything registered at write time.
+    clearVolatileSecretsForTesting();
+    for (const value of [configValue, clientSecret, accessToken, refreshToken, mcpAccess]) {
+      expectKnownNowhere(value);
+    }
+    expect(scrubSecrets(wrap(scriptToken))).toBe(wrap(scriptToken));
+
+    const loaded = await loadSecretRegistry();
+    expect(loaded.failed).toBe(0);
+    expect(loaded.config).toBeGreaterThanOrEqual(1);
+    expect(loaded.oauth).toBeGreaterThanOrEqual(4);
+    expect(loaded.scriptApi).toBeGreaterThanOrEqual(1);
+
+    expectRedactedEverywhere(configValue, "config:REGISTRY_PROBE_TOKEN");
+    expectRedactedEverywhere(clientSecret, "oauth:regprovider:client_secret");
+    expectRedactedEverywhere(accessToken, "oauth:regprovider:access_token");
+    expectRedactedEverywhere(refreshToken, "oauth:regprovider:refresh_token");
+    expectRedactedEverywhere(mcpAccess, `oauth:mcp-${server.id}:access_token`);
+    expectRedactedEverywhere(scriptToken, `script-api:${api.id}`);
+  });
+
+  test("a row that cannot be decrypted is counted and does not block the rest", async () => {
+    const good = makeSecret("reggood");
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "REGISTRY_GOOD_SECRET",
+      value: good,
+      isSecret: true,
+    });
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    await getDbClient().run(
+      `INSERT INTO swarm_config (id, scope, scopeId, key, value, isSecret, envPath, description, createdAt, lastUpdatedAt, encrypted)
+       VALUES (?, 'global', NULL, 'REGISTRY_WRONG_KEY_SECRET', ?, 1, NULL, NULL, ?, ?, 1)`,
+      [id, encryptSecret(makeSecret("regbad"), randomBytes(32)), now, now],
+    );
+    try {
+      clearVolatileSecretsForTesting();
+      const loaded = await loadSecretRegistry();
+      expect(loaded.failed).toBe(1);
+      expectRedactedEverywhere(good, "config:REGISTRY_GOOD_SECRET");
+    } finally {
+      await getDbClient().run("DELETE FROM swarm_config WHERE id = ?", [id]);
+    }
+  });
+});
+
+describe("secret registry write hooks", () => {
+  test("a write after boot is redacted without a reload", async () => {
+    clearVolatileSecretsForTesting();
+    await loadSecretRegistry();
+
+    const configValue = makeSecret("regwrite");
+    await upsertSwarmConfig({
+      scope: "agent",
+      scopeId: agentId,
+      key: "REGISTRY_LATE_TOKEN",
+      value: configValue,
+      isSecret: true,
+    });
+    expectRedactedEverywhere(configValue, "config:REGISTRY_LATE_TOKEN");
+
+    const app = await getOAuthApp("regprovider");
+    if (!app) throw new Error("oauth app missing");
+    const auth = await upsertAuthorization({ appId: app.id, accessToken: makeSecret("regseed") });
+    const refreshedAccess = makeSecret("regrefreshed");
+    const refreshedRefresh = makeSecret("regrotated");
+    await updateAuthorizationTokens(auth.id, {
+      accessToken: refreshedAccess,
+      refreshToken: refreshedRefresh,
+    });
+    expectRedactedEverywhere(refreshedAccess, "oauth:regprovider:access_token");
+    expectRedactedEverywhere(refreshedRefresh, "oauth:regprovider:refresh_token");
+
+    const [scriptApiId] = (
+      await getDbClient().query<{ id: string }>("SELECT id FROM script_apis LIMIT 1")
+    ).map((r) => r.id);
+    if (!scriptApiId) throw new Error("script api missing");
+    const rotated = await rotateScriptApiSecret(scriptApiId);
+    if (!rotated?.token) throw new Error("rotation failed");
+    expectRedactedEverywhere(rotated.token, `script-api:${scriptApiId}`);
+  });
+});
+
+describe("combined known-value matcher", () => {
+  test("encodedForms covers base64, base64url and URL encoding without the raw value", () => {
+    const value = makeSecret("regforms");
+    const forms = encodedForms(value);
+    expect(forms).toContain(Buffer.from(value).toString("base64"));
+    expect(forms).toContain(Buffer.from(value).toString("base64url"));
+    expect(forms).toContain(encodeURIComponent(value));
+    expect(forms).not.toContain(value);
+  });
+
+  test("longest value wins when one known value is a prefix of another", () => {
+    clearVolatileSecretsForTesting();
+    const short = `regshort_${randomToken(16)}`;
+    const long = `${short}${randomToken(12)}`;
+    registerVolatileSecret(short, "SHORT_ONE");
+    registerVolatileSecret(long, "LONG_ONE");
+    expect(scrubSecrets(`a ${long} b ${short} c`)).toBe(
+      "a [REDACTED:LONG_ONE] b [REDACTED:SHORT_ONE] c",
+    );
+  });
+
+  test("regex metacharacters in a value match literally", () => {
+    clearVolatileSecretsForTesting();
+    const value = `reg.*+?^\${}()|[]\\_${randomToken(16)}`;
+    registerVolatileSecret(value, "META_ONE");
+    const lookalike = value.replace(".*", "xx");
+    expect(scrubSecrets(`x ${value} y ${lookalike} z`)).toBe(
+      `x [REDACTED:META_ONE] y ${lookalike} z`,
+    );
+  });
+
+  test("an env value keeps its env name when it is also registered as volatile", () => {
+    clearVolatileSecretsForTesting();
+    const envKey = `REGISTRY_ENV_${randomToken(6).toUpperCase()}_TOKEN`;
+    const value = `regenv_${randomToken(24)}`;
+    process.env[envKey] = value;
+    try {
+      refreshSecretScrubberCache();
+      registerVolatileSecret(value, "volatile-name");
+      expect(scrubSecrets(`v=${value};`)).toBe(`v=[REDACTED:${envKey}];`);
+    } finally {
+      delete process.env[envKey];
+      refreshSecretScrubberCache();
+    }
+  });
+
+  // Timing-sensitive (wall-clock ratio on a shared CI runner): retry absorbs a
+  // noisy-neighbour spike; a real regression fails every attempt.
+  test(
+    "200 known values cost no more than 2x the 20-value baseline over 10k lines",
+    () => {
+      const lines: string[] = [];
+      for (let i = 0; i < 10_000; i++) {
+        lines.push(
+          `{"type":"assistant","line":${i},"text":"ran step ${i} in /workspace/repo with id ${randomToken(16)} and exit 0"}`,
+        );
+      }
+
+      const timeWith = (count: number): number => {
+        clearVolatileSecretsForTesting();
+        const values: string[] = [];
+        for (let i = 0; i < count; i++) {
+          const value = makeSecret(`regbench${i}`);
+          values.push(value);
+          registerStoredSecret(value, `bench:${i}`);
+        }
+        // Some lines carry a known value, so the replace path is exercised too.
+        const corpus = lines.map((line, i) =>
+          i % 100 === 0 ? `${line} ${values[i % count]}` : line,
+        );
+        for (const line of corpus.slice(0, 500)) scrubSecrets(line); // warm-up + matcher build
+        const runs: number[] = [];
+        for (let r = 0; r < 3; r++) {
+          const start = performance.now();
+          for (const line of corpus) scrubSecrets(line);
+          runs.push(performance.now() - start);
+        }
+        // Spot-check correctness on the same corpus.
+        expect(scrubSecrets(corpus[100] ?? "")).toContain("[REDACTED:bench:");
+        return runs.sort((a, b) => a - b)[1] ?? 0;
+      };
+
+      const baseline = timeWith(20);
+      const scaled = timeWith(200);
+      console.log(
+        `[secret-registry bench] 20 values: ${baseline.toFixed(1)} ms, 200 values: ${scaled.toFixed(1)} ms (10k lines)`,
+      );
+      expect(scaled).toBeLessThanOrEqual(baseline * 2);
+    },
+    { retry: 2, timeout: 60_000 },
+  );
+});

package/src/tests/secret-rules.test.ts

@@ -0,0 +1,230 @@
+import { describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { convertGoRegex, stripKeyPrefix } from "../../scripts/gen-secret-rules";
+import { GITLEAKS_RULES } from "../utils/secret-rules.generated";
+import {
+  clearVolatileSecretsForTesting,
+  scrubSecrets,
+  setGitleaksPassEnabledForTesting,
+} from "../utils/secret-scrubber";
+import { buildNegatives, buildPositives } from "./fixtures/secret-corpus";
+import { randomToken } from "./synthetic-secret-helpers";
+
+describe("convertGoRegex", () => {
+  test("turns a leading (?i) into the i flag", () => {
+    expect(convertGoRegex("(?i)abc")).toEqual({ source: "abc", flags: "i" });
+  });
+
+  test("scopes a mid-pattern (?i) to the rest of its group", () => {
+    const { source, flags } = convertGoRegex(String.raw`\b(p8e-(?i)[a-z0-9]{4})x`);
+    expect(source).toBe(String.raw`\b(p8e-(?i:[a-z0-9]{4}))x`);
+    const re = new RegExp(source, flags);
+    expect(re.test("p8e-AbCdx")).toBe(true);
+    expect(re.test("P8E-abcdx")).toBe(false);
+    expect(re.test("p8e-abcdX")).toBe(false);
+  });
+
+  test("keeps a mid-pattern (?i) on every later branch of its group", () => {
+    const { source } = convertGoRegex("(a(?i)b|c)d");
+    expect(source).toBe("(a(?i:b)|(?i:c))d");
+    const re = new RegExp(`^${source}$`);
+    expect(re.test("aBd")).toBe(true);
+    expect(re.test("Cd")).toBe(true);
+    expect(re.test("Ab")).toBe(false);
+  });
+
+  test("rewrites named groups, POSIX classes, \\z, \\A and a leading ] in a class", () => {
+    expect(convertGoRegex("(?P<x>a)").source).toBe("(?<x>a)");
+    expect(convertGoRegex("[[:alnum:]]{2}").source).toBe("[A-Za-z0-9]{2}");
+    expect(convertGoRegex(String.raw`\Aa\z`).source).toBe("^a$");
+    expect(convertGoRegex("[^]]+").source).toBe(String.raw`[^\]]+`);
+  });
+
+  test("rejects RE2-only syntax instead of converting it wrong", () => {
+    expect(() => convertGoRegex(String.raw`\pL`)).toThrow(/unsupported escape/);
+    expect(() => convertGoRegex("(?U)a+")).toThrow(/unsupported inline flags/);
+    expect(() => convertGoRegex("[[:graph:]]")).toThrow(/POSIX class/);
+  });
+
+  test("strips the keyword-context name prefix, also inside a leading (?i:", () => {
+    const prefix = String.raw`[\w.-]{0,50}?`;
+    expect(stripKeyPrefix(`${prefix}(?:okta)`)).toBe("(?:okta)");
+    expect(stripKeyPrefix(`${prefix}(?i:${prefix}(?:okta))`)).toBe("(?i:(?:okta))");
+    expect(stripKeyPrefix("(?:okta)")).toBe("(?:okta)");
+  });
+});
+
+describe("generated gitleaks rules", () => {
+  test("every rule compiles under Bun and has a keyword", () => {
+    expect(GITLEAKS_RULES.rules.length).toBeGreaterThan(200);
+    for (const rule of GITLEAKS_RULES.rules) {
+      expect(() => new RegExp(rule.source, `${rule.flags}gd`), rule.id).not.toThrow();
+      expect(rule.keywords.length, rule.id).toBeGreaterThan(0);
+    }
+  });
+
+  test("generic-api-key is excluded with a reason", () => {
+    const excluded = GITLEAKS_RULES.excluded.find((rule) => rule.id === "generic-api-key");
+    expect(excluded?.reason).toBeTruthy();
+    expect(GITLEAKS_RULES.rules.some((rule) => rule.id === "generic-api-key")).toBe(false);
+  });
+
+  // ReDoS bound: the rules were written for RE2 (linear time); JS backtracks.
+  // Timing-sensitive on a shared CI runner, so retry absorbs a noisy-neighbour
+  // spike; a real catastrophic pattern takes seconds and fails every attempt.
+  test(
+    "each rule finishes a 100 KB adversarial input in under 50 ms",
+    () => {
+      const SIZE = 100_000;
+      const fill = (unit: string) => unit.repeat(Math.ceil(SIZE / unit.length)).slice(0, SIZE);
+      const slow: string[] = [];
+      for (const rule of GITLEAKS_RULES.rules) {
+        const re = new RegExp(rule.source, `${rule.flags}gd`);
+        const kw = rule.keywords[0] as string;
+        const inputs = [
+          fill("a"),
+          fill(kw),
+          fill(`${kw} = `),
+          fill(`${kw}_key = "${"a1B2".repeat(4)}`),
+          fill(`${kw}${"aB3-".repeat(30)}\n`),
+          fill(`${kw}.${"a".repeat(60)}.`),
+          fill(`${kw}:${"9".repeat(12)}:`),
+          fill(`${kw}${"=".repeat(20)} `),
+        ];
+        for (const input of inputs) {
+          const start = performance.now();
+          re.lastIndex = 0;
+          for (let m = re.exec(input); m !== null; m = re.exec(input)) {
+            if (m[0].length === 0) re.lastIndex++;
+          }
+          const ms = performance.now() - start;
+          if (ms >= 50) slow.push(`${rule.id}: ${ms.toFixed(1)} ms on ${input.slice(0, 24)}…`);
+        }
+      }
+      expect(slow).toEqual([]);
+    },
+    { retry: 2, timeout: 60_000 },
+  );
+});
+
+describe("secret corpus", () => {
+  const positives = buildPositives();
+
+  test.each(positives.map((p) => [p.name, p] as const))("redacts %s", (_name, p) => {
+    const out = scrubSecrets(p.text);
+    expect(out).not.toContain(p.secret);
+    expect(out).toContain("[REDACTED:");
+    if (p.gitleaksRule) expect(out).toContain(`[REDACTED:gitleaks:${p.gitleaksRule}]`);
+    // Context around the secret survives, and a second scrub is a no-op.
+    expect(out.length).toBeGreaterThan(0);
+    expect(scrubSecrets(out)).toBe(out);
+  });
+
+  test("redacts only the secret of a keyword-context rule, not its key", () => {
+    const p = positives.find((x) => x.name === "mailgun");
+    expect(scrubSecrets(p?.text)).toBe("mailgun: [REDACTED:gitleaks:mailgun-private-api-token]");
+  });
+
+  test("redacts two secrets that share one delimiter", () => {
+    // azure-ad-client-secret consumes a delimiter on each side, so `a b`
+    // shares one space between the two matches.
+    const azure = () =>
+      [randomBytes(3).toString("hex").slice(0, 3), "7Q", "~", randomToken(31)].join("");
+    const pairs: [string, string][] = [[azure(), azure()]];
+    // The same check for every bare-secret positive (no custom context).
+    const again = new Map(buildPositives().map((p) => [p.name, p]));
+    for (const p of positives) {
+      const q = again.get(p.name);
+      if (q && p.text === `the response included ${p.secret} in its body`) {
+        pairs.push([p.secret, q.secret]);
+      }
+    }
+    for (const [a, b] of pairs) {
+      for (const sep of [" ", "\n", "\t"]) {
+        const out = scrubSecrets(`${a}${sep}${b}`);
+        expect(out, `${a.slice(0, 6)}… ${JSON.stringify(sep)}`).not.toContain(a);
+        expect(out, `${b.slice(0, 6)}… ${JSON.stringify(sep)}`).not.toContain(b);
+        expect(out).toMatch(new RegExp(`^\\[REDACTED:[^\\]]+\\]${sep}\\[REDACTED:[^\\]]+\\]$`));
+      }
+    }
+  });
+
+  test("redacts a token whose last character is a dash or equals sign", () => {
+    // `\b` after a trailing `-` backtracks one character and leaves it behind.
+    const tokens = [
+      `ATATT3${randomToken(185)}-`,
+      `ATATT3${randomToken(185)}=`,
+      `glpat-${randomToken(19)}-`,
+      `AIza${randomToken(34)}-`,
+      `npm_${randomToken(35)}-`,
+      `lin_api_${randomToken(39)}-`,
+    ];
+    for (const token of tokens) {
+      for (const tail of ["", " next", "\n"]) {
+        expect(scrubSecrets(`${token}${tail}`), token.slice(0, 6)).toMatch(
+          new RegExp(`^\\[REDACTED:[^\\]]+\\]${tail}$`),
+        );
+      }
+    }
+  });
+
+  test("leaves every negative untouched", () => {
+    const changed = buildNegatives().filter((text) => scrubSecrets(text) !== text);
+    expect(changed).toEqual([]);
+  });
+
+  test("a gitleaks rule below its entropy floor is not a finding", () => {
+    // stripe-access-token has entropy 2; a run of one char has entropy 0.
+    const lowEntropy = ["sk", "live", "a".repeat(24)].join("_");
+    expect(scrubSecrets(`got ${lowEntropy} back`)).toBe(`got ${lowEntropy} back`);
+  });
+
+  test("a rule's allowlist claims a match, and only that match", () => {
+    // vault-service-token allowlists legacy `s.` + 24 letters (no digits).
+    const lettersOnly = `vault said s.${"AbCdEfGhIjKlMnOpQrStUvWx"} ok`;
+    expect(scrubSecrets(lettersOnly)).toBe(lettersOnly);
+    const withDigit = ["s", `${randomToken(23)}7`].join(".");
+    expect(scrubSecrets(`vault said ${withDigit} ok`)).toBe(
+      "vault said [REDACTED:gitleaks:vault-service-token] ok",
+    );
+  });
+});
+
+describe("pass 5 throughput", () => {
+  // Informational budget. Timing-sensitive on a shared CI runner: retry
+  // absorbs a spike; a real regression fails every attempt.
+  test(
+    "10k lines with pass 5 cost under 2x the run without it",
+    () => {
+      const lines: string[] = [];
+      for (let i = 0; i < 10_000; i++) {
+        lines.push(
+          `{"type":"assistant","line":${i},"text":"ran task step ${i} in /workspace/repo with key ${randomToken(16)} and they exit 0"}`,
+        );
+      }
+      const time = (enabled: boolean): number => {
+        setGitleaksPassEnabledForTesting(enabled);
+        for (const line of lines.slice(0, 500)) scrubSecrets(line);
+        const runs: number[] = [];
+        for (let r = 0; r < 3; r++) {
+          const start = performance.now();
+          for (const line of lines) scrubSecrets(line);
+          runs.push(performance.now() - start);
+        }
+        return runs.sort((a, b) => a - b)[1] ?? 0;
+      };
+      try {
+        clearVolatileSecretsForTesting();
+        const without = time(false);
+        const withPass = time(true);
+        console.log(
+          `[secret-rules bench] 10k lines: ${without.toFixed(1)} ms without pass 5, ${withPass.toFixed(1)} ms with it`,
+        );
+        expect(withPass).toBeLessThanOrEqual(without * 2);
+      } finally {
+        setGitleaksPassEnabledForTesting(true);
+      }
+    },
+    { retry: 2, timeout: 60_000 },
+  );
+});

package/src/tests/secret-scrubber.test.ts

@@ -838,7 +838,8 @@ describe("scrubSecrets — over-redaction guards", () => {
   });
 
   // Each input is ~200 KB and built to make a naive pattern backtrack.
-  // retry: wall-clock bound on a shared CI runner; a real ReDoS takes seconds.
+  // Allow shared-runner headroom; a real ReDoS on these inputs takes seconds.
+  // retry: tolerate transient contention without weakening the per-input guard.
   test(
     "new key-context rules stay linear on 200 KB adversarial input",
     () => {
@@ -867,7 +868,7 @@ describe("scrubSecrets — over-redaction guards", () => {
       for (const input of inputs) {
         const start = performance.now();
         scrubSecrets(input);
-        expect(performance.now() - start).toBeLessThan(50);
+        expect(performance.now() - start).toBeLessThan(500);
       }
     },
     { retry: 2 },