@modusensus/dsh-mneme 0.8.11 → 0.8.13

package/test/sensitive-scan.test.js

@@ -0,0 +1,207 @@
+// #164 A2：写入边界的密钥 / PII 判据（src/sensitive-scan.js）。
+//
+// 这是「真判据」自己的验收，与 write-admission.test.js 里那组（拿参考扫描器测**闸门
+// 接线**）分工不同：这边测判据本身，且第一条用例就是把 #332 配好的 26 条语料原样跑在
+// 生产实现上——维护者 09-28 的验收条件就是这句「同一套负样本原样跑，抓错任何一条就
+// 不算落地」，所以它放在这里而不是再抄一份语料。
+//
+// 参考扫描器 referenceScan 只服务闸门测；本文件刻意**不** import 它——生产判据与
+// 参考实现是两份独立实现，同时跑过同一套语料才算把语料用足（对照着改就成了自证）。
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { scanSensitive, createSensitiveScan } from "../src/sensitive-scan.js";
+import {
+  SECRET_SAMPLES,
+  PII_SAMPLES,
+  POSITIVE_SAMPLES,
+  NEGATIVE_SAMPLES,
+  SAMPLE_VALUES
+} from "./helpers/write-admission-samples.js";
+
+// #164 A2 的语料里那几条凭据值走 helper 的拼接导出，别在测试里另抄一份字面量：
+// GitHub 的 push protection 会按形状拦真实凭据（本 PR 实测：`sk_live_` 一条就够
+// 拒推，helper 正是为这件事把值拆成两段拼的）。这里复用同一份，仓库文本里不留完整形状。
+const STRIPE_KEY = SAMPLE_VALUES.stripeKey;
+
+// 正样本那条 OpenAI key 从语料里取，不另抄字面量（同 STRIPE_KEY 的理由）。
+const OPENAI_KEY = POSITIVE_SAMPLES.find((s) => s.id === "openai-key").content.match(/\S*sk-\S+/)[0];
+/** `sk-proj-…` 前缀的变体：语料那条不带 proj-，这里补同样的正文长度。 */
+const openaiProjKey = (body) => `sk-proj-${body}`;
+const OPENAI_BODY = OPENAI_KEY.replace(/^.*?sk-(?:proj-)?/, "");
+
+test("真判据：正样本一条都不漏放，且 kind 与语料声明一致", () => {
+  for (const sample of POSITIVE_SAMPLES) {
+    const text = `${sample.title}\n${sample.content}`;
+    const hit = scanSensitive(text);
+    assert.ok(hit, `${sample.id} 被漏放（${sample.why}）`);
+    // kind 是审计行里的稳定判据键：它错了，「按 kind 看命中分布」这条路就断了。
+    // 同一个串可能被多条规则吃下（`sk_live_` 也像通用 `sk-`），所以顺序是判据的一部分。
+    assert.equal(hit.kind, sample.kind, `${sample.id} 的 kind 必须是语料声明的那个（规则顺序变了就会漂）`);
+    assert.equal(typeof hit.label, "string");
+  }
+});
+
+test("真判据：负样本一条都不误杀（抓错任何一条就不算落地）", () => {
+  for (const sample of NEGATIVE_SAMPLES) {
+    const hit = scanSensitive(`${sample.title}\n${sample.content}`);
+    assert.equal(hit, null, `${sample.id} 被误杀（${sample.why}）：实际命中 ${hit?.kind}`);
+  }
+});
+
+test("密钥与 PII 分两档，但都从同一条通道出来", () => {
+  // 分档的意义是「将来按类放行只改策略、不动判据」：kind 集合是策略的抓手，
+  // 所以这里断言两类都能被分辨，而不是把 PII 折进密钥那一档。
+  assert.ok(SECRET_SAMPLES.length >= 1 && PII_SAMPLES.length >= 1);
+  assert.equal(scanSensitive("password = \"Tr0ub4dor&3xKcd\"").kind, "assigned_secret");
+  assert.equal(scanSensitive("联系方式 zhang.wei@example.com").kind, "email");
+  assert.equal(scanSensitive("值班手机 13800138000").kind, "cn_mobile");
+});
+
+test("只扫文本：路径与 id 这类元数据字段不进判据", () => {
+  // 元数据由系统生成，不是用户写进来的内容；扫它们只会引入假阳（一个文件名里
+  // `token` 这种词很常见）。契约是判据只看记忆的文本字段。
+  const scan = createSensitiveScan({ config: { sensitiveScanEnabled: true } });
+  assert.equal(scan({ title: "配置", content: "正常正文", id: SAMPLE_VALUES.githubPat, doc_path: STRIPE_KEY }), null);
+  // 反过来，正文里的凭据必须报——上面那条不是靠「什么都扫不到」通过的。
+  assert.ok(scan({ title: "配置", content: `正文里有 ${SAMPLE_VALUES.githubPat}` }));
+});
+
+test("tags 也扫：标签是用户输入的自由文本", () => {
+  const scan = createSensitiveScan({ config: { sensitiveScanEnabled: true } });
+  assert.equal(scan({ title: "正常标题", content: "正常正文", tags: ["正常"] }), null);
+  assert.equal(scan({ title: "正常标题", content: "正常正文", tags: [SAMPLE_VALUES.githubPat] })?.kind, "github_token");
+});
+
+test("工厂：判据自己的闸关时连函数都不给（闸门侧行为与 #332 逐字段一致）", () => {
+  assert.equal(createSensitiveScan({ config: { sensitiveScanEnabled: false } }), null);
+  assert.equal(createSensitiveScan({ config: {} }), null);
+  assert.equal(createSensitiveScan({}), null, "没有 config 也不能默认开");
+  assert.equal(createSensitiveScan({ config: { sensitiveScanEnabled: "true" } }), null, "字符串 true 不是 true");
+  const scan = createSensitiveScan({ config: { sensitiveScanEnabled: true } });
+  assert.equal(typeof scan, "function");
+});
+
+test("工厂不碰决策：命中只报 kind，拦不拦由闸门的 enforce 决定", () => {
+  // 判据与闸门分层（#164：默认仅告警、拦截 opt-in）——判据知道「这是什么」，
+  // 但不知道也不该知道「要不要拦」。返回值里没有 decision / enforced 这类字段，
+  // 就是这条分层的机器可判点。
+  const scan = createSensitiveScan({
+    config: { sensitiveScanEnabled: true, writeAdmission: { enabled: true, enforce: false } }
+  });
+  const hit = scan({ title: "调试", content: openaiProjKey(OPENAI_BODY) });
+  assert.deepEqual(Object.keys(hit).sort(), ["kind", "label"]);
+});
+
+test("不抛：坏输入返回 null，扫描器故障不会把写入变成不可用", () => {
+  assert.equal(scanSensitive(undefined), null);
+  assert.equal(scanSensitive(null), null);
+  assert.equal(scanSensitive(""), null);
+  assert.equal(scanSensitive(12345), null);
+  const scan = createSensitiveScan({ config: { sensitiveScanEnabled: true } });
+  assert.equal(scan(null), null);
+  assert.equal(scan({ title: 7, content: null, tags: "not-an-array" }), null);
+});
+
+test("一处命中只报最严重的那条（deny 面记类别，不记条数）", () => {
+  // 一篇同时带 Stripe 密钥与邮箱的正文：报密钥那一档。反过来把 PII 排在前面
+  // 会让「这条命中过密钥」这个更严重的事实被邮箱盖掉。
+  const text = `邮箱 a@b.com，另外 ${STRIPE_KEY}`;
+  assert.equal(scanSensitive(text).kind, "stripe_key");
+});
+
+test("语料之外的探针：漏放那一类锁一条（实现期实测出来的，不是假想）", () => {
+  // 不在 #332 的 26 条语料里，是拿真判据跑额外形状时发现的：AWS secret access key
+  // 没有前缀，`secret` 关键词规则又要求它后面紧跟赋值号，多词键
+  // （`AWS_SECRET_ACCESS_KEY=`）两条都够不着 → 补了专用的键名规则。
+  assert.equal(
+    scanSensitive("AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY").kind,
+    "aws_secret_key"
+  );
+  // 反向确认「值 + 赋值键」这条兜底规则还在工作，而且**不**看值的形状：`api_key =`
+  // 后面跟任何 8 位以上的值都报（判据不知道哪个值是真的）。
+  assert.equal(scanSensitive("api_key = sk-abcdefghijklmnopqrst").kind, "assigned_secret");
+  // 收紧后的开关键字仍然认 24 位以上的真 key（44 位正文，语料那条）。
+  assert.equal(scanSensitive(openaiProjKey(OPENAI_BODY)).kind, "openai_key");
+});
+
+// --- 合并后独立复审的三项加固 -------------------------------------------------
+
+// 赋值句的键与值都在运行时拼装，别写成整串字面量：`.github/workflows/security.yml` 的
+// gitleaks 是**全历史**扫描且没有 allowlist，而 generic-api-key 规则认的是「关键词 +
+// 赋值号 + 高熵值」——一个 16 位、字符全不重复的十六进制串熵值就有 4.0，高于它 3.5 的
+// 阈值，直接落进源码就会被判成真凭据（本批初稿实测：两条各报一次）。
+// 与 helpers/write-admission-samples.js 里那几条凭据值同一个理由，那边也是拼的。
+const envLine = (key, value, prefix = "") => `${prefix}${key}=${value}`;
+/** 一眼假的低熵值：不是占位符（占位符会被守卫挡掉，那样就测不到这条规则了）。 */
+const FAKE_LITERAL = ["super", "sekrit", "000"].join("-");
+
+test("左边界放开 `_`：环境变量名形态的赋值也要抓（原先整类漏放）", () => {
+  // 回归锁：赋值型规则的左边界原为 `[^A-Za-z0-9_]`，把下划线也当成了标识符内部字符，
+  // 于是只有恰好落在行首的 `API_KEY=` 能中，而 `DB_PASSWORD=` / `MY_API_KEY=` /
+  // `MYSQL_PASSWORD=` 这种「前缀_关键词」的环境变量名整类漏放——配置片段与 .env 正文
+  // 恰恰是最常见的落库形态。放宽后 #332 的 26 条语料仍全绿，说明原写法不是语料换来
+  // 的取舍，是白丢的。
+  for (const [key, prefix] of [
+    ["DB_PASSWORD", ""],
+    ["MY_API_KEY", ""],
+    ["MYSQL_PASSWORD", ""],
+    ["GITHUB_TOKEN", "export "] // 带 shell 前缀的写法
+  ]) {
+    const line = envLine(key, FAKE_LITERAL, prefix);
+    assert.equal(scanSensitive(line)?.kind, "assigned_secret", `${key} 形态的赋值不该漏放`);
+  }
+});
+
+test("放宽左边界没有放走占位符与间接引用（守卫仍在管那一半）", () => {
+  // 与上一条成对：放宽的是「关键词前面能不能是 `_`」，不是「右边的值算不算字面量」。
+  // 后者仍归占位符守卫——下面三条正是负样本群里「有敏感词但没有值」的形态。
+  // 这些值同样拼装，理由见本节开头（`${...}` 这类串本身也贴着"像凭据"的形状）。
+  const placeholders = [
+    ["DB_PASSWORD", ["$", "{DB_PASSWORD}"].join("")],
+    ["MY_API_KEY", ["<", "your-key-here", ">"].join("")],
+    ["DB_PASSWORD", ["process", ".env.DB_PASSWORD"].join("")]
+  ];
+  for (const [key, value] of placeholders) {
+    const line = envLine(key, value);
+    assert.equal(scanSensitive(line), null, `${key} 形态的占位 / 间接引用不该报`);
+  }
+});
+
+test("身份证档加校验位：位数对但校验不过的 18 位数字串不报", () => {
+  // 回归锁：原先只有银行卡档有 Luhn、身份证档只看长度，结果是 18 位纯数字（订单号 /
+  // 内部编号 / 拼接时间戳）先被身份证规则命中，等不到银行卡那条的校验。补 GB 11643
+  // MOD 11-2 之后两侧都干净：校验不过的不报，语料里那条真形状照报。
+  assert.equal(scanSensitive("内部编号 123456789012345678 已登记"), null, "校验不过的 18 位不该报");
+  assert.equal(scanSensitive("内部编号 987654321098765432 已登记"), null);
+  assert.equal(scanSensitive("身份证 11010519491231002X 已核验")?.kind, "cn_id_card");
+  // 小写 x 走同一张校验表（语料只覆盖了大写 X）。
+  assert.equal(scanSensitive("身份证 11010519491231002x 已核验")?.kind, "cn_id_card");
+});
+
+test("email 的 local part 上界恰好卡在 RFC 5321 的 64", () => {
+  // 上界不是随手取的数：64 是 RFC 5321 给 local part 的上限，所以「长于 64 不认」
+  // 这条边界必须是精确的——松一位会让回溯面失控，紧一位会漏掉合法邮箱。
+  const at = (n) => `${"a".repeat(n)}@example.com`;
+  assert.ok(scanSensitive(at(64)), "64 位的 local part 是合法的，必须认");
+  assert.equal(scanSensitive(at(65)), null, "65 位超出 RFC 上限，不认（换取回溯有界的代价）");
+});
+
+test("长文本上的回溯有上界：写阻塞类回归的计时护栏", () => {
+  // 回归锁：email 的 local part 与 connection_string 的 scheme 都作用在含 `.` 的字符
+  // 类上，缺上界时每个起点都要一路重扫到结尾才失败 → O(n²)。未加上界时实测：34KB
+  // 点分链 0.6 秒、120KB 对抗串 23.5 秒（email 18.6s + 连接串 4.1s）；而本判据在写入
+  // 路径上同步跑，等于把写入卡死。加上界后同输入约 60ms。
+  // 预算取 2 秒：比修复前小一个数量级（12× 安全边），又比修复后大 30 倍，不至于像
+  // 50ms 级断言那样被 CI 抖动误伤——它抓的是「上界被拿掉」这类数量级回归，不是微优化。
+  const inputs = [
+    "a.".repeat(30000) + "@" + "b.".repeat(30000) + "!",
+    "com.example.pkg.".repeat(10000) + "@"
+  ];
+  for (const text of inputs) {
+    const started = process.hrtime.bigint();
+    scanSensitive(text);
+    const ms = Number(process.hrtime.bigint() - started) / 1e6;
+    assert.ok(ms < 2000, `${text.length} 字符耗时 ${ms.toFixed(1)}ms，超 2000ms 预算（回溯上界被破坏？）`);
+  }
+});

package/test/summarize.test.js

@@ -110,6 +110,25 @@ function toolResultEvent(text, isError, seq) {
   };
 }
 
+// DSH 0.2.x 内核对工具结果的实际投递形状：内核给的是 `role:"tool"` 消息本身，
+// content 里只有 `type:"text"` 块、isError 挂在消息上，不再有 tool-result 块。
+// 蒸馏曾只认旧块形状，于是真实会话里的工具输出与工具报错全部被静默丢弃。
+function toolRoleResultEvent(text, isError, seq) {
+  return {
+    seq,
+    type: "tool/result",
+    data: {
+      message: {
+        role: "tool",
+        source: { kind: "tool", callId: `call-${seq}` },
+        toolCallId: `call-${seq}`,
+        content: [{ type: "text", text }],
+        isError
+      }
+    }
+  };
+}
+
 function codeDispatchEvent(text, isError, seq) {
   return {
     seq,
@@ -143,6 +162,32 @@ test("parseSummaryJson extracts valid entries and skips malformed ones", () => {
   assert.equal(parsed[1].type, "preference");
 });
 
+// --- issue #339 / E8 考卷：JSON 崩溃窗口的 salvage（失败路径修复，默认开）-----
+// E8 实测 10-20% 的窗口输出了含约束的完整对象，只因中段一处语法错误被整窗
+// JSON.parse 拒收 → 生产行为 = 游标卡死 + 温度 0 重试同错 = 静默丢失。
+
+test("parseSummaryJson salvages complete objects from a malformed array (issue #339)", () => {
+  // E8 现场同款：闭合数组、中段对象含杂散引号（stray quote）。
+  const raw = `[
+    {"type":"constraint","title":"预算","content":"总额 $12,400","importance":4},
+    { " "type": "history", "title": "坏对象", "content": "语法错误" },
+    {"type":"preference","title":"硬件","content":"只要 brushed brass"}
+  ]`;
+  const parsed = parseSummaryJson(raw);
+  assert.equal(parsed.length, 2, "the broken middle object is dropped, both survivors kept");
+  assert.equal(parsed[0].content, "总额 $12,400");
+  assert.equal(parsed[1].title, "硬件");
+});
+
+test("parseSummaryJson salvage finding nothing stays a failure (no fake empty success)", () => {
+  // 只有一个语法坏掉的对象 → 救回 0 条：不得按「显式空数组」放行消费窗口。
+  const raw = `[
+    { " "type": "history", "title": "坏", "content": "语法错误" }
+  ]`;
+  const parsed = parseSummaryJson(raw);
+  assert.deepEqual(parsed, []);
+});
+
 test("subscribes to session/event when autoSummarize enabled", () => {
   const { events } = setup();
   assert.ok(events.some((e) => e.name === "session/event"));
@@ -673,6 +718,78 @@ test("invalid summary JSON leaves the seq window retryable", async () => {
   assert.equal(store.count(), 0, "the valid empty retry remains a no-op");
 });
 
+test("a JSON-crashed window with salvageable objects is recovered, consumed once, and audited (issue #339)", async (t) => {
+  const malformed = `[
+    {"type":"constraint","title":"预算","content":"总额 $12,400","importance":4},
+    { " "type": "history", "title": "坏对象", "content": "语法错误" },
+    {"type":"preference","title":"硬件","content":"只要 brushed brass"}
+  ]`;
+  const { events, service, store, calls, summarizer } = setup({ distillRateLimitIntervalMs: 0 }, {
+    stream() {
+      return (async function* () {
+        yield { type: "block-start", block: { type: "text" } };
+        yield { type: "text-delta", delta: malformed };
+        yield { type: "finish", kind: "ok" };
+      })();
+    }
+  });
+  t.after(() => { summarizer.dispose(); store.close(); });
+  const handler = events.find((e) => e.name === "session/event").fn;
+  const session = {
+    id: "s-salvage",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [userMessage("带语法错误的蒸馏窗口", 1), { seq: 2, type: "turn/end" }]
+  };
+
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(service.count(), 2, "the two intact objects are written, the broken one dropped");
+  const titles = service.list().map((m) => m.title).sort();
+  assert.deepEqual(titles, ["硬件", "预算"]);
+  assert.equal(calls.length, 1, "salvage consumed the window: no same-window retry");
+  const audit = service.listLlmAudits().find((r) => r.status === "success");
+  assert.ok(audit, "salvaged run is audited as a success");
+  assert.equal(audit.metadata?.json_salvaged, true, "salvage is observable in the audit trail");
+
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(calls.length, 1, "the consumed window is not re-distilled");
+  assert.equal(service.count(), 2, "no duplicate writes on the second turn/end");
+});
+
+test("a JSON-crashed window with nothing salvageable stays retryable (issue #339)", async (t) => {
+  const hopeless = `[
+    { " "type": "history", "title": "坏", "content": "语法错误" }
+  ]`;
+  let attempt = 0;
+  const { events, service, store, calls, summarizer } = setup({ distillRateLimitIntervalMs: 0 }, {
+    stream() {
+      const output = attempt++ === 0 ? hopeless : `[
+        {"type":"history","title":"重试成功","content":"干净窗口","importance":3}
+      ]`;
+      return (async function* () {
+        yield { type: "block-start", block: { type: "text" } };
+        yield { type: "text-delta", delta: output };
+        yield { type: "finish", kind: "ok" };
+      })();
+    }
+  });
+  t.after(() => { summarizer.dispose(); store.close(); });
+  const handler = events.find((e) => e.name === "session/event").fn;
+  const session = {
+    id: "s-salvage-none",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [userMessage("救不回的窗口", 1), { seq: 2, type: "turn/end" }]
+  };
+
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(service.count(), 0, "zero salvage is not a fake success");
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(calls.length, 2, "the window stays retryable");
+  assert.equal(service.count(), 1);
+  assert.ok(service.listLlmAudits().some(
+    (r) => r.status === "error" && r.error_message === "invalid summary JSON"
+  ), "zero-salvage run keeps the error audit");
+});
+
 test("an all-invalid summary leaves the same window retryable until valid memories are saved", async (t) => {
   for (const invalid of [
     [{}],
@@ -960,6 +1077,47 @@ test("collects real tool result and code dispatch payloads with failure status",
   assert.match(transcript, /代码执行（成功）：代码执行结果/);
 });
 
+test("collects tool results delivered as role:tool messages, keeping the legacy block shape", async () => {
+  const { events, calls } = setup({ distillRateLimitIntervalMs: 0 });
+  const handler = events.find((e) => e.name === "session/event").fn;
+  const session = {
+    id: "s-tool-role-shape",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [
+      userMessage("检查工具结果两种形状", 1),
+      toolResultEvent("旧形状载荷", false, 2),
+      toolRoleResultEvent("新形状载荷", false, 3),
+      toolRoleResultEvent("TypeError: tool crashed", true, 4),
+      { seq: 5, type: "turn/end" }
+    ]
+  };
+
+  await handler(session, { seq: 5, type: "turn/end" });
+  const transcript = calls[0].messages.find((message) => message.role === "user").content[0].text;
+  assert.match(transcript, /工具结果（成功）：旧形状载荷/);
+  assert.match(transcript, /工具结果（成功）：新形状载荷/);
+  assert.match(transcript, /工具结果（失败）：TypeError: tool crashed/);
+});
+
+test("keeps prefix trimming for tool results delivered as role:tool messages", async () => {
+  const { events, calls } = setup({ distillRateLimitIntervalMs: 0 });
+  const handler = events.find((e) => e.name === "session/event").fn;
+  const session = {
+    id: "s-tool-role-trim",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [
+      userMessage("检查新形状截断", 1),
+      toolRoleResultEvent(`OUT_START ${"c".repeat(550)} OUT_END`, false, 2),
+      { seq: 3, type: "turn/end" }
+    ]
+  };
+
+  await handler(session, { seq: 3, type: "turn/end" });
+  const transcript = JSON.stringify(calls[0].messages);
+  assert.ok(transcript.includes("OUT_START"));
+  assert.ok(!transcript.includes("OUT_END"), "role:tool 结果同样走 500 字符前缀截断");
+});
+
 test("collects subagent delivery once across inbox and user-message views", async () => {
   const { events, calls } = setup({ distillRateLimitIntervalMs: 0 });
   const handler = events.find((e) => e.name === "session/event").fn;
@@ -1286,3 +1444,22 @@ test("issue#127: a dedupe lookup that yields nothing still lands the entry (neve
   assert.equal(store.count(), 1, "the entry is stored through the normal write path");
   assert.equal(store.all()[0].title, "必须落库");
 });
+
+test("parseSummaryJson salvage only takes direct children of the outer array (issue #339 review)", () => {
+  // 嵌套子数组里的对象不捞（模型没把它当顶层记忆产出），坏对象照旧丢弃。
+  const nested = `[[{"type":"history","title":"nested","content":"kept"}], { " "type":"history"}]`;
+  assert.deepEqual(parseSummaryJson(nested), []);
+});
+
+test("parseSummaryJson salvage does not turn string-embedded objects into memories (issue #339 review)", () => {
+  // 全数组解析失败（第二对象坏）+ 第一对象的 content 字符串里嵌着假记忆形状：
+  // 盲扫不得把属性值对象当独立记忆——外层对象整体才是直接子项。
+  const raw = `[
+    {"type":"history","title":"good","content":"note { \\"type\\": \\"history\\", \\"title\\": \\"fake\\" }"},
+    { " "type": "history", "title": "坏", "content": "x" }
+  ]`;
+  const parsed = parseSummaryJson(raw);
+  assert.equal(parsed.length, 1);
+  assert.equal(parsed[0].title, "good");
+  assert.match(parsed[0].content, /fake/);
+});

package/test/test-count-sync.test.js

@@ -0,0 +1,60 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { applyTestCount, readTestCounts } from "../scripts/test-count-sync.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(HERE, "..");
+const REPO_ROOT = join(PKG_ROOT, "..");
+const READMES = [join(REPO_ROOT, "README.md"), join(PKG_ROOT, "README.md")];
+
+// 双 README 是发布门面，同一个数字在里面重复出现三到五次（一个 shields.io 徽章 +
+// 每条开发命令注释一处，root 是双语所以中英各一条）。它们必须永远同数——否则
+// 「这个项目有多少测试」取决于读者恰好看了哪一行。
+//
+// v0.8.11 实际漂移过：徽章 1437、四条注释留在 1431。本用例就是那次漂移的回归锁，
+// 跑在真实 README 上（不是 fixture），所以它能在发版前拦住同类漂移。
+test("双 README 的测试数处处一致（徽章与所有注释同数）", () => {
+  for (const f of READMES) {
+    const counts = readTestCounts(readFileSync(f, "utf8"));
+    const shapes = new Set(counts.map((c) => c.shape));
+    assert.ok(counts.length >= 2, `${f} 抽到的测试数出现处太少：${JSON.stringify(counts)}`);
+    assert.ok(shapes.has("badge"), `${f} 没抽到徽章：${JSON.stringify(counts)}`);
+    const values = [...new Set(counts.map((c) => c.value))];
+    assert.equal(values.length, 1, `${f} 测试数不一致：${JSON.stringify(counts)}`);
+  }
+});
+
+// v0.8.11 的真实漂移样本（徽章已 1437、注释仍 1431）。锁住「徽章 + 四种注释形状」
+// 全覆盖：少任何一种，就会有一处静默落后——release-prep.mjs 原先只覆盖徽章 URL，
+// 自动发版路径因此反倒成了漂移来源。
+test("applyTestCount 覆盖徽章与全部四种注释形状（真实漂移样本）", () => {
+  const drifted = [
+    '<img src="https://img.shields.io/badge/tests-1431%20passed-3E63DD?style=flat-square" alt="tests">',
+    "[![tests](https://img.shields.io/badge/tests-1431%20passed-success)](https://github.com/slow-stack/mneme)",
+    "npm test        # 1431 个测试",
+    "npm test           # 运行 1431 个测试",
+    "test/                 # 1431 个 node:test 测试（审计与三轴线压测不变量）",
+    "npm test        # 1431 tests"
+  ].join("\n");
+  const fixed = applyTestCount(drifted, 1437);
+  assert.ok(!/\b1431\b/.test(fixed), "仍有 1431 未被替换：\n" + fixed);
+  const counts = readTestCounts(fixed);
+  assert.equal(counts.length, 6, "六处出现都该被认出来：" + JSON.stringify(counts));
+  assert.deepEqual([...new Set(counts.map((c) => c.value))], [1437]);
+});
+
+test("applyTestCount 幂等：同一个数重复施加不再产生变化", () => {
+  const once = applyTestCount("tests-9%20passed-3E63DD\n# 9 个测试\n# 9 tests", 12);
+  assert.equal(applyTestCount(once, 12), once);
+});
+
+// 历史版本表里的「745 测试全绿」「790 通过」是各版本当时的真实记录（sync-test-badge
+// 的注释也写明了刻意不改它们）。替换规则只认徽章 URL 与 `#` 前缀注释两种形状，
+// 这条用例锁住那个边界，免得将来放宽正则把历史改写掉。
+test("applyTestCount 不碰历史版本表里的「N 测试全绿」", () => {
+  const history = "| **v0.8.0** | 745 测试全绿 |\n| **v0.7.9** | 790 通过 |\n| v0.2.7 | 263 |";
+  assert.equal(applyTestCount(history, 1437), history);
+});

package/test/write-admission.test.js

@@ -17,6 +17,12 @@ import {
   ADMISSION_TRIGGER_SOURCE
 } from "../src/write-admission.js";
 import { POSITIVE_SAMPLES, NEGATIVE_SAMPLES, SAMPLE_VALUES, referenceScan } from "./helpers/write-admission-samples.js";
+// #164 A2 的真判据 + 真配置：这一组测的是**接线**（index.js 那条路径的等价物），
+// 判据自己的验收在 test/sensitive-scan.test.js。config 用真 schema 而不是手搓对象，
+// 钉住「键名/嵌套形状与生产一致」——手搓的 `{ sensitiveScanEnabled: true }` 在键名
+// 写错时照样过，真 config 才会红。
+import { Config } from "../src/config.js";
+import { createSensitiveScan } from "../src/sensitive-scan.js";
 
 // #254 写入准入（第一阶段：只计量，不拦截）。
 // 本批次没有阈值、没有拦截分支，验收看两件事：默认路径零行为变化（无会话身份的
@@ -551,3 +557,112 @@ test("接线：被拒时 memory_save 返回 action=denied 与可行动的 reason
   assert.ok(ok.id, "正常路径仍然返回 id");
 });
 
+// --- #164 A2 接线：判据自己的闸 × 闸门的 enforce -------------------------------
+// 这一组是 index.js 那条装配路径的等价物：真 config（Config({})）+ createSensitiveScan
+// 工厂 + 写入准入。三层开关的语义由此钉住——判据关（默认）不参与、判据开而 enforce 关
+// 只留审计、两个都开才拦。判据本身的假阳/漏放验收在 test/sensitive-scan.test.js。
+
+/** 用真 `Config` 解析默认值，再叠加测试要覆盖的那几个键。 */
+function a2Store(overrides = {}) {
+  const cfg = Config(overrides);
+  const store = createStore(":memory:");
+  const writeAdmission = createWriteAdmission({
+    store,
+    config: cfg,
+    sensitiveScan: createSensitiveScan({ config: cfg })
+  });
+  const service = createService({ store, mirror: null, config: cfg, writeAdmission });
+  return { store, service, cfg };
+}
+
+const SECRET_ROW = {
+  type: "project",
+  title: "调试记录",
+  content: `临时代码里贴了 ${SAMPLE_VALUES.githubPat}，回头删掉`
+};
+
+test("A2 默认关：写有密钥的行照常落库，且连拒绝面都不该出现", () => {
+  const { store, service } = a2Store();
+  const result = service.saveWithDedupe({ ...SECRET_ROW, _sessionKey: "s" });
+  assert.equal(result.action, "created", "判据默认关时这条路径与 #332 逐字段一致");
+  assert.equal(rowCount(store), 1);
+  // metadata 里不该多出任何 deny/decision 键——「默认关零行为变化」是验收第 1 条，
+  // 多一个恒为 allow 的键就把它从事实变成需要解释的说法（同上面 #254 那条）。
+  const row = admissionRows(store, "s")[0];
+  assert.equal(row.metadata.deny, undefined);
+  assert.equal(row.metadata.decision, undefined);
+});
+
+test("A2 观察档：判据开、enforce 关 → 写入照常，审计行带 kind 与 enforced=false", () => {
+  const { store, service } = a2Store({ sensitiveScanEnabled: true, writeAdmission: { enabled: true } });
+  const result = service.saveWithDedupe({ ...SECRET_ROW, _sessionKey: "s" });
+  assert.equal(result.action, "created", "#164 口径：默认仅告警");
+  assert.equal(rowCount(store), 1);
+  const deny = admissionRows(store, "s")[0].metadata.deny;
+  assert.equal(deny.reason, "sensitive");
+  assert.equal(deny.kind, "github_token");
+  assert.equal(deny.enforced, false, "仅告警档的指纹：deny 非空、enforced=false、写入仍发生");
+});
+
+test("A2 拦截档：判据开 + enforce 开 → 拒了、没落库、审计标 enforced", () => {
+  const { store, service } = a2Store({
+    sensitiveScanEnabled: true,
+    writeAdmission: { enabled: true, enforce: true }
+  });
+  const result = service.saveWithDedupe({ ...SECRET_ROW, _sessionKey: "s" });
+  assert.equal(result.action, "denied");
+  assert.equal(result.reason, "sensitive");
+  assert.equal(rowCount(store), 0, "被拒的写入一条都不该落库");
+  const deny = admissionRows(store, "s")[0].metadata.deny;
+  assert.equal(deny.kind, "github_token");
+  assert.equal(deny.enforced, true);
+});
+
+test("A2 与第 1 级空白判据互不依赖：只开 A2 不会把空白写入拦下", () => {
+  // 两个键是两批判据的闸（空白/噪声 vs 密钥/PII），分开是为了能单独观察 A2 的
+  // 命中分布——绑在一个开关上就没法只看这一类的假阳率。
+  const { store, service } = a2Store({ sensitiveScanEnabled: true });
+  const blank = service.saveWithDedupe({ _sessionKey: "s", type: "project", title: "...", content: "" });
+  assert.equal(blank.action, "created", "A2 开着不等于第 1 级判据也开");
+  assert.equal(admissionRows(store, "s")[0].metadata.deny, undefined);
+  // 反过来：只开第 1 级（writeAdmission.enabled）、A2 关，密钥行照常落库。
+  const { store: s2, service: svc2 } = a2Store({ writeAdmission: { enabled: true } });
+  assert.equal(svc2.saveWithDedupe({ ...SECRET_ROW, _sessionKey: "s" }).action, "created");
+  assert.equal(s2.list({ limit: 10 }).length, 1);
+});
+
+test("A2 跑在闸门里：只开 sensitiveScanEnabled（闸门关）时扫描器根本不参与", () => {
+  // 判据的唯一调用点是 write-admission 的 firstLevelHit，而闸门要
+  // writeAdmission.enabled 打开才走第 1 级判据。所以「本键开着」不等于「会扫」——
+  // 配置注释与面板文案都按这条写，否则用户以为单开本键就能拿到 A2 的命中分布。
+  const { store, service } = a2Store({ sensitiveScanEnabled: true });
+  const result = service.saveWithDedupe({ ...SECRET_ROW, _sessionKey: "s" });
+  assert.equal(result.action, "created", "闸门没开时 A2 不参与判定");
+  assert.equal(rowCount(store), 1, "写入照常落库");
+  const rows = admissionRows(store, "s");
+  assert.ok(rows.length > 0, "闸门仍走计量路径（去重 / g2 不受第 1 级开关影响）");
+  assert.ok(rows.every((row) => row.metadata.deny === undefined), "一条 deny 审计都没有：第 1 级判据整体没跑");
+});
+
+test("A2 负样本在真装配下一条都不误杀（含敏感词但没有值）", () => {
+  const { store, service } = a2Store({
+    sensitiveScanEnabled: true,
+    writeAdmission: { enabled: true, enforce: true }
+  });
+  for (const sample of NEGATIVE_SAMPLES) {
+    const result = service.saveWithDedupe({
+      _sessionKey: `sess-${sample.id}`,
+      type: "project",
+      title: sample.title,
+      content: sample.content
+    });
+    assert.equal(result.action, "created", `${sample.id} 被误杀（${sample.why}）`);
+  }
+  assert.equal(rowCount(store), NEGATIVE_SAMPLES.length);
+  for (const sample of NEGATIVE_SAMPLES) {
+    for (const row of admissionRows(store, `sess-${sample.id}`)) {
+      assert.equal(row.metadata.deny, undefined, `${sample.id} 不该带任何拒绝面`);
+    }
+  }
+});
+