@vellumai/credential-executor 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/__tests__/command-workspace.test.ts

@@ -1,1050 +0,0 @@
-/**
- * CES workspace staging and output copyback tests.
- *
- * Covers:
- * 1. Staged input materialisation (files copied read-only into scratch).
- * 2. Undeclared output rejection (only declared outputs are copied back).
- * 3. Copyback path validation (path traversal, absolute paths rejected).
- * 4. Symlink traversal (symlinks pointing outside scratch dir rejected).
- * 5. Secret-bearing artifact rejection (exact secrets and auth patterns).
- * 6. Output scan standalone tests.
- */
-
-import { describe, expect, test, beforeEach, afterEach } from "bun:test";
-import {
-  mkdirSync,
-  writeFileSync,
-  readFileSync,
-  existsSync,
-  symlinkSync,
-  statSync,
-  rmSync,
-} from "node:fs";
-import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-import { tmpdir } from "node:os";
-
-import {
-  validateRelativePath,
-  validateContainedPath,
-  checkSymlinkEscape,
-  stageInputs,
-  copybackOutputs,
-  cleanupScratchDir,
-  type WorkspaceStageConfig,
-} from "../commands/workspace.js";
-
-import { scanOutputFile } from "../commands/output-scan.js";
-
-// ---------------------------------------------------------------------------
-// Test helpers
-// ---------------------------------------------------------------------------
-
-/** Create a temp directory for a test and return its path. */
-function makeTempDir(prefix: string): string {
-  const dir = join(tmpdir(), `ces-test-${prefix}-${randomUUID()}`);
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-
-/** Set up a workspace dir with some files for testing. */
-function setupWorkspace(): {
-  workspaceDir: string;
-  cleanup: () => void;
-} {
-  const workspaceDir = makeTempDir("workspace");
-
-  // Create some sample workspace files
-  writeFileSync(join(workspaceDir, "input.txt"), "Hello from workspace");
-  mkdirSync(join(workspaceDir, "subdir"), { recursive: true });
-  writeFileSync(
-    join(workspaceDir, "subdir", "nested.json"),
-    JSON.stringify({ data: "test" }),
-  );
-
-  return {
-    workspaceDir,
-    cleanup: () => rmSync(workspaceDir, { recursive: true, force: true }),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// 1. Staged input materialisation
-// ---------------------------------------------------------------------------
-
-describe("stageInputs", () => {
-  let workspaceDir: string;
-  let cleanup: () => void;
-
-  beforeEach(() => {
-    const ws = setupWorkspace();
-    workspaceDir = ws.workspaceDir;
-    cleanup = ws.cleanup;
-  });
-
-  afterEach(() => {
-    cleanup();
-  });
-
-  test("copies declared inputs into scratch directory", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "input.txt" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    const staged = stageInputs(config);
-
-    try {
-      // File exists in scratch
-      const scratchFile = join(staged.scratchDir, "input.txt");
-      expect(existsSync(scratchFile)).toBe(true);
-
-      // Content matches
-      const content = readFileSync(scratchFile, "utf-8");
-      expect(content).toBe("Hello from workspace");
-
-      // Recorded in stagedInputs
-      expect(staged.stagedInputs).toEqual(["input.txt"]);
-    } finally {
-      cleanupScratchDir(staged.scratchDir);
-    }
-  });
-
-  test("concurrent stagings get isolated scratch directories", () => {
-    // run_authenticated_command relies on each invocation getting its own
-    // scratch dir so that interleaved commands cannot read or clobber each
-    // other's staged inputs/outputs. Same config, two stagings → distinct dirs.
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "input.txt" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    const a = stageInputs(config);
-    const b = stageInputs(config);
-
-    try {
-      expect(a.scratchDir).not.toBe(b.scratchDir);
-      expect(existsSync(a.scratchDir)).toBe(true);
-      expect(existsSync(b.scratchDir)).toBe(true);
-    } finally {
-      cleanupScratchDir(a.scratchDir);
-      cleanupScratchDir(b.scratchDir);
-    }
-  });
-
-  test("staged inputs are read-only", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "input.txt" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    const staged = stageInputs(config);
-
-    try {
-      const scratchFile = join(staged.scratchDir, "input.txt");
-      const stat = statSync(scratchFile);
-      // Permission should be 0o444 (read-only for all)
-      const mode = stat.mode & 0o777;
-      expect(mode).toBe(0o444);
-    } finally {
-      cleanupScratchDir(staged.scratchDir);
-    }
-  });
-
-  test("stages nested directory inputs", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "subdir/nested.json" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    const staged = stageInputs(config);
-
-    try {
-      const scratchFile = join(staged.scratchDir, "subdir", "nested.json");
-      expect(existsSync(scratchFile)).toBe(true);
-      const content = JSON.parse(readFileSync(scratchFile, "utf-8"));
-      expect(content.data).toBe("test");
-    } finally {
-      cleanupScratchDir(staged.scratchDir);
-    }
-  });
-
-  test("stages multiple inputs", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [
-        { workspacePath: "input.txt" },
-        { workspacePath: "subdir/nested.json" },
-      ],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    const staged = stageInputs(config);
-
-    try {
-      expect(staged.stagedInputs).toEqual([
-        "input.txt",
-        "subdir/nested.json",
-      ]);
-      expect(existsSync(join(staged.scratchDir, "input.txt"))).toBe(true);
-      expect(
-        existsSync(join(staged.scratchDir, "subdir", "nested.json")),
-      ).toBe(true);
-    } finally {
-      cleanupScratchDir(staged.scratchDir);
-    }
-  });
-
-  test("rejects input with path traversal (..)", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "../etc/passwd" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    expect(() => stageInputs(config)).toThrow("path traversal");
-  });
-
-  test("rejects input with absolute path", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "/etc/passwd" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    expect(() => stageInputs(config)).toThrow("absolute path");
-  });
-
-  test("rejects input with empty path", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    expect(() => stageInputs(config)).toThrow("empty");
-  });
-
-  test("rejects input that does not exist in workspace", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [{ workspacePath: "nonexistent.txt" }],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    expect(() => stageInputs(config)).toThrow("does not exist");
-  });
-
-  test("cleans up scratch dir on staging failure", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [
-        { workspacePath: "input.txt" },        // exists — will succeed
-        { workspacePath: "nonexistent.txt" },   // doesn't exist — will fail
-      ],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    try {
-      stageInputs(config);
-    } catch {
-      // Expected failure — scratchDir should have been cleaned up.
-      // We can't easily capture scratchDir since the function throws,
-      // but we verify the throw happens.
-    }
-    // The fact that it threw means cleanup was attempted.
-  });
-
-  test("with no inputs produces an empty scratch dir", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [],
-      secrets: new Set(),
-    };
-
-    const staged = stageInputs(config);
-
-    try {
-      expect(existsSync(staged.scratchDir)).toBe(true);
-      expect(staged.stagedInputs).toEqual([]);
-    } finally {
-      cleanupScratchDir(staged.scratchDir);
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 2. Undeclared output rejection
-// ---------------------------------------------------------------------------
-
-describe("copybackOutputs — undeclared output rejection", () => {
-  let workspaceDir: string;
-  let scratchDir: string;
-  let cleanup: () => void;
-
-  beforeEach(() => {
-    workspaceDir = makeTempDir("ws-copyback");
-    scratchDir = makeTempDir("scratch-copyback");
-    cleanup = () => {
-      rmSync(workspaceDir, { recursive: true, force: true });
-      rmSync(scratchDir, { recursive: true, force: true });
-    };
-  });
-
-  afterEach(() => {
-    cleanup();
-  });
-
-  test("copies declared output to workspace", () => {
-    // Create output file in scratch
-    writeFileSync(join(scratchDir, "result.txt"), "output data");
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "result.txt", workspacePath: "result.txt" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(true);
-    expect(result.outputs).toHaveLength(1);
-    expect(result.outputs[0]!.success).toBe(true);
-
-    // File should exist in workspace
-    const wsFile = join(workspaceDir, "result.txt");
-    expect(existsSync(wsFile)).toBe(true);
-    expect(readFileSync(wsFile, "utf-8")).toBe("output data");
-  });
-
-  test("rejects output file not present in scratch directory", () => {
-    // Do NOT create the file in scratch
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "missing.txt", workspacePath: "missing.txt" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.success).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("does not exist");
-
-    // File should NOT exist in workspace
-    expect(existsSync(join(workspaceDir, "missing.txt"))).toBe(false);
-  });
-
-  test("undeclared files in scratch are not copied to workspace", () => {
-    // Create two files in scratch, but only declare one
-    writeFileSync(join(scratchDir, "declared.txt"), "safe");
-    writeFileSync(join(scratchDir, "undeclared.txt"), "sneaky");
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "declared.txt", workspacePath: "declared.txt" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(true);
-    expect(existsSync(join(workspaceDir, "declared.txt"))).toBe(true);
-    // Undeclared file must NOT appear in workspace
-    expect(existsSync(join(workspaceDir, "undeclared.txt"))).toBe(false);
-  });
-
-  test("copies output to a different workspace path than scratch path", () => {
-    writeFileSync(join(scratchDir, "output.json"), '{"result": true}');
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        {
-          scratchPath: "output.json",
-          workspacePath: "reports/output.json",
-        },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(true);
-    expect(
-      existsSync(join(workspaceDir, "reports", "output.json")),
-    ).toBe(true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 3. Copyback path validation
-// ---------------------------------------------------------------------------
-
-describe("copybackOutputs — path validation", () => {
-  let workspaceDir: string;
-  let scratchDir: string;
-  let cleanup: () => void;
-
-  beforeEach(() => {
-    workspaceDir = makeTempDir("ws-pathval");
-    scratchDir = makeTempDir("scratch-pathval");
-    cleanup = () => {
-      rmSync(workspaceDir, { recursive: true, force: true });
-      rmSync(scratchDir, { recursive: true, force: true });
-    };
-  });
-
-  afterEach(() => {
-    cleanup();
-  });
-
-  test("rejects scratch path with path traversal", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        {
-          scratchPath: "../../../etc/shadow",
-          workspacePath: "shadow",
-        },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("path traversal");
-  });
-
-  test("rejects workspace path with path traversal", () => {
-    writeFileSync(join(scratchDir, "data.txt"), "safe data");
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        {
-          scratchPath: "data.txt",
-          workspacePath: "../../etc/crontab",
-        },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("path traversal");
-  });
-
-  test("rejects absolute scratch path", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        {
-          scratchPath: "/etc/passwd",
-          workspacePath: "passwd",
-        },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("absolute path");
-  });
-
-  test("rejects absolute workspace path", () => {
-    writeFileSync(join(scratchDir, "output.txt"), "data");
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        {
-          scratchPath: "output.txt",
-          workspacePath: "/tmp/evil/output.txt",
-        },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("absolute path");
-  });
-
-  test("rejects empty scratch path", () => {
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "", workspacePath: "output.txt" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("empty");
-  });
-
-  test("rejects empty workspace path", () => {
-    writeFileSync(join(scratchDir, "output.txt"), "data");
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "output.txt", workspacePath: "   " },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("empty");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 4. Symlink traversal rejection
-// ---------------------------------------------------------------------------
-
-describe("copybackOutputs — symlink escape", () => {
-  let workspaceDir: string;
-  let scratchDir: string;
-  let outsideDir: string;
-  let cleanup: () => void;
-
-  beforeEach(() => {
-    workspaceDir = makeTempDir("ws-symlink");
-    scratchDir = makeTempDir("scratch-symlink");
-    outsideDir = makeTempDir("outside-symlink");
-    // Create a secret file outside scratch
-    writeFileSync(join(outsideDir, "secret.key"), "top-secret-data");
-    cleanup = () => {
-      rmSync(workspaceDir, { recursive: true, force: true });
-      rmSync(scratchDir, { recursive: true, force: true });
-      rmSync(outsideDir, { recursive: true, force: true });
-    };
-  });
-
-  afterEach(() => {
-    cleanup();
-  });
-
-  test("rejects symlink pointing outside scratch directory", () => {
-    // Create a symlink in scratch that points to the outside secret
-    const symlinkPath = join(scratchDir, "sneaky.txt");
-    symlinkSync(join(outsideDir, "secret.key"), symlinkPath);
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "sneaky.txt", workspacePath: "sneaky.txt" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("symlink");
-    expect(result.outputs[0]!.reason).toContain("outside");
-
-    // Secret must NOT appear in workspace
-    expect(existsSync(join(workspaceDir, "sneaky.txt"))).toBe(false);
-  });
-
-  test("allows symlink pointing within scratch directory", () => {
-    // Create a regular file and a symlink to it, both within scratch
-    writeFileSync(join(scratchDir, "real.txt"), "safe data");
-    const symlinkPath = join(scratchDir, "link.txt");
-    symlinkSync(join(scratchDir, "real.txt"), symlinkPath);
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "link.txt", workspacePath: "link.txt" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(true);
-    expect(existsSync(join(workspaceDir, "link.txt"))).toBe(true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 5. Secret-bearing artifact rejection
-// ---------------------------------------------------------------------------
-
-describe("copybackOutputs — secret scanning", () => {
-  let workspaceDir: string;
-  let scratchDir: string;
-  let cleanup: () => void;
-
-  beforeEach(() => {
-    workspaceDir = makeTempDir("ws-secrets");
-    scratchDir = makeTempDir("scratch-secrets");
-    cleanup = () => {
-      rmSync(workspaceDir, { recursive: true, force: true });
-      rmSync(scratchDir, { recursive: true, force: true });
-    };
-  });
-
-  afterEach(() => {
-    cleanup();
-  });
-
-  test("rejects output containing an exact secret match", () => {
-    const secretValue = "ghp_SuperSecretTokenValue1234567890abcdef";
-    writeFileSync(
-      join(scratchDir, "output.txt"),
-      `Here is the token: ${secretValue}\n`,
-    );
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "output.txt", workspacePath: "output.txt" },
-      ],
-      secrets: new Set([secretValue]),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.success).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("security scan");
-    expect(result.outputs[0]!.scanResult?.violations.length).toBeGreaterThan(0);
-
-    // File must NOT exist in workspace
-    expect(existsSync(join(workspaceDir, "output.txt"))).toBe(false);
-  });
-
-  test("rejects output with AWS credentials pattern", () => {
-    writeFileSync(
-      join(scratchDir, "config"),
-      `[default]\naws_access_key_id = AKIAIOSFODNN7EXAMPLE\naws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n`,
-    );
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "config", workspacePath: "config" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.success).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("security scan");
-  });
-
-  test("rejects output with PEM private key", () => {
-    writeFileSync(
-      join(scratchDir, "key.pem"),
-      `-----BEGIN RSA PRIVATE KEY-----\nMIIBogIBAAJBALRiMLAHudeSA...\n-----END RSA PRIVATE KEY-----\n`,
-    );
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "key.pem", workspacePath: "key.pem" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("security scan");
-  });
-
-  test("rejects .netrc file by filename", () => {
-    writeFileSync(
-      join(scratchDir, ".netrc"),
-      "machine example.com login user password pass123",
-    );
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: ".netrc", workspacePath: ".netrc" },
-      ],
-      secrets: new Set(),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs[0]!.reason).toContain("security scan");
-  });
-
-  test("allows clean output with no secrets", () => {
-    writeFileSync(
-      join(scratchDir, "report.json"),
-      JSON.stringify({ status: "ok", count: 42 }),
-    );
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "report.json", workspacePath: "report.json" },
-      ],
-      secrets: new Set(["my-secret-value"]),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(true);
-    expect(result.outputs[0]!.success).toBe(true);
-    expect(
-      existsSync(join(workspaceDir, "report.json")),
-    ).toBe(true);
-  });
-
-  test("mixed results: one output passes, another fails", () => {
-    const secret = "SuperSecretToken123";
-    writeFileSync(join(scratchDir, "clean.txt"), "safe content");
-    writeFileSync(join(scratchDir, "dirty.txt"), `token=${secret}`);
-
-    const config: WorkspaceStageConfig = {
-      workspaceDir,
-      inputs: [],
-      outputs: [
-        { scratchPath: "clean.txt", workspacePath: "clean.txt" },
-        { scratchPath: "dirty.txt", workspacePath: "dirty.txt" },
-      ],
-      secrets: new Set([secret]),
-    };
-
-    const result = copybackOutputs(config, scratchDir);
-
-    expect(result.allSucceeded).toBe(false);
-    expect(result.outputs).toHaveLength(2);
-
-    const cleanResult = result.outputs.find((o) => o.scratchPath === "clean.txt");
-    const dirtyResult = result.outputs.find((o) => o.scratchPath === "dirty.txt");
-
-    expect(cleanResult!.success).toBe(true);
-    expect(dirtyResult!.success).toBe(false);
-
-    expect(existsSync(join(workspaceDir, "clean.txt"))).toBe(true);
-    expect(existsSync(join(workspaceDir, "dirty.txt"))).toBe(false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 6. Output scan standalone tests
-// ---------------------------------------------------------------------------
-
-describe("scanOutputFile", () => {
-  test("detects exact secret match", () => {
-    const secret = "sk_live_abcdef1234567890";
-    const content = `API response: ${secret}\n`;
-    const result = scanOutputFile("output.txt", content, new Set([secret]));
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("exact match"))).toBe(true);
-  });
-
-  test("ignores empty secret values", () => {
-    const content = "some output";
-    const result = scanOutputFile("output.txt", content, new Set([""]));
-    expect(result.safe).toBe(true);
-  });
-
-  test("detects netrc-format credentials", () => {
-    const content = "machine api.example.com login admin password hunter2";
-    const result = scanOutputFile("output.txt", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("netrc"))).toBe(true);
-  });
-
-  test("detects AWS secret access key pattern", () => {
-    const content = "aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
-    const result = scanOutputFile("config", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("AWS"))).toBe(true);
-  });
-
-  test("detects PEM private key", () => {
-    const content = "-----BEGIN PRIVATE KEY-----\nbase64data\n-----END PRIVATE KEY-----";
-    const result = scanOutputFile("key.pem", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("PEM private key"))).toBe(true);
-  });
-
-  test("detects OpenSSH private key", () => {
-    const content = "-----BEGIN OPENSSH PRIVATE KEY-----\nbase64data\n-----END OPENSSH PRIVATE KEY-----";
-    const result = scanOutputFile("id_ed25519", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("OpenSSH"))).toBe(true);
-  });
-
-  test("detects Docker registry auth token", () => {
-    const content = '{"auths":{"registry.example.com":{"auth":"dXNlcjpwYXNzd29yZA=="}}}';
-    const result = scanOutputFile("config.json", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("Docker"))).toBe(true);
-  });
-
-  test("detects npm auth token", () => {
-    const content = "//registry.npmjs.org/:_authToken = npm_XXXXXXXXXXXXXXXXXXXXX";
-    const result = scanOutputFile(".npmrc", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("npm"))).toBe(true);
-  });
-
-  test("flags .env filename as auth-bearing", () => {
-    const content = "DATABASE_URL=postgres://localhost/mydb";
-    const result = scanOutputFile(".env", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("auth-bearing config"))).toBe(true);
-  });
-
-  test("flags .netrc filename as auth-bearing", () => {
-    // Even without matching content patterns, the filename itself is flagged
-    const content = "# empty netrc";
-    const result = scanOutputFile(".netrc", content, new Set());
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("auth-bearing config"))).toBe(true);
-  });
-
-  test("allows clean JSON output", () => {
-    const content = JSON.stringify({ repos: ["a", "b"], count: 2 });
-    const result = scanOutputFile("repos.json", content, new Set(["my-secret"]));
-    expect(result.safe).toBe(true);
-    expect(result.violations).toHaveLength(0);
-  });
-
-  test("allows plain text output without secrets", () => {
-    const content = "Build succeeded\n42 tests passed\n0 failures";
-    const result = scanOutputFile("build-log.txt", content, new Set());
-    expect(result.safe).toBe(true);
-  });
-
-  test("handles Buffer content", () => {
-    const secret = "bufferSecret123";
-    const content = Buffer.from(`data: ${secret}\n`, "utf-8");
-    const result = scanOutputFile("output.bin", content, new Set([secret]));
-    expect(result.safe).toBe(false);
-    expect(result.violations.some((v) => v.includes("exact match"))).toBe(true);
-  });
-
-  test("accumulates multiple violations", () => {
-    const secret = "my-leaked-secret";
-    const content = `machine example.com login user password ${secret}`;
-    const result = scanOutputFile(".netrc", content, new Set([secret]));
-    expect(result.safe).toBe(false);
-    // Should have at least 3 violations: exact match, filename, and content pattern
-    expect(result.violations.length).toBeGreaterThanOrEqual(3);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Path validation standalone tests
-// ---------------------------------------------------------------------------
-
-describe("validateRelativePath", () => {
-  test("accepts simple relative path", () => {
-    expect(validateRelativePath("file.txt", "test")).toBeUndefined();
-  });
-
-  test("accepts nested relative path", () => {
-    expect(validateRelativePath("dir/subdir/file.txt", "test")).toBeUndefined();
-  });
-
-  test("rejects absolute path", () => {
-    const err = validateRelativePath("/etc/passwd", "test");
-    expect(err).toBeDefined();
-    expect(err).toContain("absolute path");
-  });
-
-  test("rejects path with ..", () => {
-    const err = validateRelativePath("../secret", "test");
-    expect(err).toBeDefined();
-    expect(err).toContain("path traversal");
-  });
-
-  test("rejects path with embedded ..", () => {
-    const err = validateRelativePath("dir/../../../etc/shadow", "test");
-    expect(err).toBeDefined();
-    expect(err).toContain("path traversal");
-  });
-
-  test("rejects empty path", () => {
-    const err = validateRelativePath("", "test");
-    expect(err).toBeDefined();
-    expect(err).toContain("empty");
-  });
-
-  test("rejects whitespace-only path", () => {
-    const err = validateRelativePath("   ", "test");
-    expect(err).toBeDefined();
-    expect(err).toContain("empty");
-  });
-});
-
-describe("validateContainedPath", () => {
-  test("accepts path within root", () => {
-    expect(
-      validateContainedPath("/root/dir/file.txt", "/root/dir", "test"),
-    ).toBeUndefined();
-  });
-
-  test("accepts nested path within root", () => {
-    expect(
-      validateContainedPath("/root/dir/sub/file.txt", "/root/dir", "test"),
-    ).toBeUndefined();
-  });
-
-  test("rejects path outside root", () => {
-    const err = validateContainedPath("/other/file.txt", "/root/dir", "test");
-    expect(err).toBeDefined();
-    expect(err).toContain("escapes");
-  });
-
-  test("rejects path that traverses out of root", () => {
-    const err = validateContainedPath(
-      "/root/dir/../other/file.txt",
-      "/root/dir",
-      "test",
-    );
-    expect(err).toBeDefined();
-    expect(err).toContain("escapes");
-  });
-
-  test("accepts multi-level non-existent path under symlinked root", () => {
-    // On macOS /tmp is a symlink to /private/tmp. Create a real directory
-    // under /tmp so the root resolves through the symlink, then validate a
-    // path with multiple non-existent levels (e.g., reports/output.json where
-    // reports/ also doesn't exist). This exercises the while-loop in the
-    // catch branch iterating more than once before finding an existing ancestor.
-    const base = join("/tmp", `ces-test-multilevel-${randomUUID()}`);
-    mkdirSync(base, { recursive: true });
-    try {
-      // Neither "reports/" nor "reports/output.json" exist on disk
-      const deepPath = join(base, "reports", "output.json");
-      const err = validateContainedPath(deepPath, base, "test");
-      expect(err).toBeUndefined();
-
-      // Verify it also works with even deeper non-existent paths
-      const deeperPath = join(base, "a", "b", "c", "file.txt");
-      const err2 = validateContainedPath(deeperPath, base, "test");
-      expect(err2).toBeUndefined();
-
-      // Verify escape detection still works with multi-level non-existent paths
-      // under a symlinked root — path outside the root should still be rejected
-      const outsidePath = join("/tmp", `ces-test-other-${randomUUID()}`, "a", "b", "file.txt");
-      const err3 = validateContainedPath(outsidePath, base, "test");
-      expect(err3).toBeDefined();
-      expect(err3).toContain("escapes");
-    } finally {
-      rmSync(base, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("checkSymlinkEscape", () => {
-  let testDir: string;
-  let outsideDir: string;
-  let cleanup: () => void;
-
-  beforeEach(() => {
-    testDir = makeTempDir("symcheck");
-    outsideDir = makeTempDir("symcheck-outside");
-    writeFileSync(join(outsideDir, "target.txt"), "outside data");
-    writeFileSync(join(testDir, "internal.txt"), "internal data");
-    cleanup = () => {
-      rmSync(testDir, { recursive: true, force: true });
-      rmSync(outsideDir, { recursive: true, force: true });
-    };
-  });
-
-  afterEach(() => {
-    cleanup();
-  });
-
-  test("returns undefined for regular files", () => {
-    expect(
-      checkSymlinkEscape(join(testDir, "internal.txt"), testDir, "test"),
-    ).toBeUndefined();
-  });
-
-  test("returns undefined for internal symlinks", () => {
-    symlinkSync(
-      join(testDir, "internal.txt"),
-      join(testDir, "link.txt"),
-    );
-    expect(
-      checkSymlinkEscape(join(testDir, "link.txt"), testDir, "test"),
-    ).toBeUndefined();
-  });
-
-  test("returns error for symlinks pointing outside", () => {
-    symlinkSync(
-      join(outsideDir, "target.txt"),
-      join(testDir, "escape.txt"),
-    );
-    const err = checkSymlinkEscape(
-      join(testDir, "escape.txt"),
-      testDir,
-      "test",
-    );
-    expect(err).toBeDefined();
-    expect(err).toContain("outside");
-  });
-
-  test("returns undefined for non-existent files", () => {
-    expect(
-      checkSymlinkEscape(join(testDir, "nope.txt"), testDir, "test"),
-    ).toBeUndefined();
-  });
-});