@wenathlan/devthink 2.0.13 → 2.0.15

package/tests/secretvault.test.ts

@@ -0,0 +1,188 @@
+import { describe, expect, it } from "vitest";
+import {
+  inmemoryvault,
+  secretleakscan,
+  secretshapecarrying,
+  vaultcovers,
+  vaultdelete,
+  vaultdigestof,
+  vaultentryof,
+  vaultprompttext,
+  vaultstore,
+  vaultvaluefor,
+  vaultview,
+} from "../security.js";
+
+const now = 1_800_000_000_000;
+
+describe("secretvault", () => {
+  it("stores secrets behind the vault seam while only metadata persists", async () => {
+    const seam = inmemoryvault();
+    const entry = await vaultstore({
+      seam,
+      label: "Bank login",
+      scope: "https://bank.example",
+      profileid: "profile",
+      provenance: "user",
+      value: "hunter2",
+      now,
+    });
+    expect(entry.label).toBe("Bank login");
+    expect(entry.scope).toBe("https://bank.example");
+    expect(entry.algorithm).toBe("sha-256");
+    expect(entry.digest.startsWith("sha256:")).toBe(true);
+    expect(JSON.stringify(entry)).not.toContain("hunter2");
+    const value = await vaultvaluefor({ seam, entry });
+    expect(value.ok).toBe(true);
+    expect(value.value).toBe("hunter2");
+    expect(value.reason).toMatch(/last possible moment/);
+  });
+
+  it("derives the sha-256 verification digest of a value so no plaintext persists", async () => {
+    const digest = await vaultdigestof("token-value");
+    expect(digest.startsWith("sha256:")).toBe(true);
+    expect(digest.length).toBe("sha256:".length + 64);
+    expect(await vaultdigestof("token-value")).toBe(digest);
+    expect(await vaultdigestof("other")).not.toBe(digest);
+  });
+
+  it("refuses vault records without a label, a scope or a digest", () => {
+    expect(() =>
+      vaultentryof({
+        label: "  ",
+        scope: "https://bank.example",
+        profileid: "p",
+        provenance: "user",
+        digest: "sha256:abc",
+        now,
+      }),
+    ).toThrow(/label/);
+    expect(() =>
+      vaultentryof({ label: "Bank", scope: "", profileid: "p", provenance: "user", digest: "sha256:abc", now }),
+    ).toThrow(/scope/);
+    expect(() =>
+      vaultentryof({
+        label: "Bank",
+        scope: "https://bank.example",
+        profileid: "p",
+        provenance: "user",
+        digest: "raw",
+        now,
+      }),
+    ).toThrow(/digest/);
+  });
+
+  it("drops a secret from the seam so no value and no copy remains", async () => {
+    const seam = inmemoryvault();
+    const entry = await vaultstore({
+      seam,
+      label: "Api key",
+      scope: "https://api.example",
+      profileid: "p",
+      provenance: "session",
+      value: "secret-value",
+      now,
+    });
+    const dropped = await vaultdelete({ seam, entry });
+    expect(dropped.dropped).toBe(true);
+    expect(dropped.reason).toMatch(/no value and no copy remains/);
+    const missing = await vaultvaluefor({ seam, entry });
+    expect(missing.ok).toBe(false);
+    expect(missing.reason).toMatch(/holds no value/);
+  });
+
+  it("scopes every vault record to exactly one origin", () => {
+    const entry = {
+      vaultid: "v",
+      label: "Bank",
+      scope: "https://bank.example",
+      profileid: "p",
+      provenance: "user" as const,
+      algorithm: "sha-256" as const,
+      digest: "sha256:abc",
+      createdat: now,
+    };
+    expect(vaultcovers(entry, "https://bank.example")).toBe(true);
+    expect(vaultcovers(entry, "https://lookalike.bank.example")).toBe(false);
+    expect(vaultcovers(entry, "https://other.example")).toBe(false);
+  });
+
+  it("refuses secrets that leaked into step options, variables and plan texts", async () => {
+    const seam = inmemoryvault();
+    const entry = await vaultstore({
+      seam,
+      label: "Bank login",
+      scope: "https://bank.example",
+      profileid: "p",
+      provenance: "user",
+      value: "hunter2",
+      now,
+    });
+    const leaked = await secretleakscan({ candidates: ["plain text", "hunter2", ""], entries: [entry] });
+    expect(leaked.leaks).toEqual(["hunter2"]);
+    expect(leaked.reason).toMatch(/never ride step options/);
+    const clean = await secretleakscan({ candidates: ["plain text"], entries: [entry] });
+    expect(clean.leaks).toEqual([]);
+    expect(clean.reason).toMatch(/no leaked secret/);
+  });
+
+  it("refuses raw typed values behind masked field shapes in step options", () => {
+    const carrying = secretshapecarrying({
+      kind: "fillform",
+      target: "#login",
+      options: JSON.stringify({ fields: [{ name: "password", value: "hunter2" }] }),
+    });
+    expect(carrying.carries).toBe(true);
+    expect(carrying.reason).toMatch(/vault at the last possible moment/);
+    const clean = secretshapecarrying({
+      kind: "fillform",
+      target: "#login",
+      options: JSON.stringify({ fields: [{ name: "username", value: "anna" }] }),
+    });
+    expect(clean.carries).toBe(false);
+    const rawoption = secretshapecarrying({ kind: "type", target: "#card", value: "4242" });
+    expect(rawoption.carries).toBe(false);
+  });
+
+  it("serves the vault view with labels and scopes only", () => {
+    const entry = {
+      vaultid: "v",
+      label: "Bank login",
+      scope: "https://bank.example",
+      profileid: "p",
+      provenance: "user" as const,
+      algorithm: "sha-256" as const,
+      digest: "sha256:abc",
+      createdat: now,
+      lastusedat: now + 5,
+    };
+    const view = vaultview([entry]);
+    expect(view).toEqual([
+      {
+        vaultid: "v",
+        label: "Bank login",
+        scope: "https://bank.example",
+        provenance: "user",
+        createdat: now,
+        lastusedat: now + 5,
+      },
+    ]);
+    expect(JSON.stringify(view)).not.toContain("sha256:abc");
+  });
+
+  it("prompts with the credential label only and never the value", () => {
+    const entry = {
+      vaultid: "v",
+      label: "Bank login",
+      scope: "https://bank.example",
+      profileid: "p",
+      provenance: "user" as const,
+      algorithm: "sha-256" as const,
+      digest: "sha256:abc",
+      createdat: now,
+    };
+    const prompt = vaultprompttext(entry, "https://bank.example");
+    expect(prompt).toContain("Bank login");
+    expect(prompt).toMatch(/value stays behind the vault/);
+  });
+});

package/tests/selcache.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it } from "vitest";
+import {
+  advanceselcachegeneration,
+  cacheselentry,
+  invalidateselcacheonmutations,
+  invalidateselcacheonnavigation,
+  openselcache,
+  revalidateselentry,
+  selcacheentries,
+  selcachelookup,
+  selcachestats,
+  stalegenerationfailure,
+} from "../memory.js";
+import { selcachegate } from "../policy.js";
+import { sessionmemory } from "../memory.js";
+
+const now = 1_800_000_000_000;
+
+class fakeadapter {
+  private readonly data = new Map<string, unknown>();
+  async get<T>(key: string): Promise<T | undefined> {
+    return this.data.get(key) as T | undefined;
+  }
+  async set<T>(key: string, value: T): Promise<void> {
+    this.data.set(key, value);
+  }
+}
+
+describe("selcache hit, invalidation and revalidation", () => {
+  it("caches one resolution per selector under the current generation", () => {
+    let cache = openselcache("run1");
+    cache = cacheselentry(cache, { selector: "#a", resolution: "resolved:#a" });
+    cache = cacheselentry(cache, { selector: "#a", resolution: "resolved:#a:second" });
+    expect(cache.entries).toHaveLength(1);
+    expect(cache.entries[0]?.resolution).toBe("resolved:#a:second");
+    expect(() => openselcache(" ")).toThrow(/run id/i);
+    expect(() => cacheselentry(cache, { selector: " ", resolution: "x" })).toThrow(/selector/i);
+  });
+
+  it("advances the generation on every dom mutation batch so old hits go stale", () => {
+    let cache = cacheselentry(openselcache("run1"), { selector: "#a", resolution: "resolved:#a" });
+    const lookup = selcachelookup(cache, "#a");
+    expect(lookup.hit).toBe(true);
+    expect(lookup.stale).toBe(false);
+    cache = advanceselcachegeneration(cache, now);
+    const stale = selcachelookup(cache, "#a");
+    expect(stale.hit).toBe(false);
+    expect(stale.stale).toBe(true);
+    expect(stale.reason).toMatch(/generation 0 while the run stands at generation 1/i);
+    expect(selcachegate({ selector: "#a", resolution: "resolved:#a", generation: 0 }, 1).allowed).toBe(false);
+    expect(selcachegate({ selector: "#a", resolution: "resolved:#a", generation: 1 }, 1).allowed).toBe(true);
+  });
+
+  it("invalidates wholesale on navigation and selectively on matching mutation fingerprints", () => {
+    let cache = openselcache("run1");
+    cache = cacheselentry(cache, { selector: "#header .logo", resolution: "r1" });
+    cache = cacheselentry(cache, { selector: "#table .row", resolution: "r2" });
+    const navigated = invalidateselcacheonnavigation(cache, now);
+    expect(navigated.entries).toHaveLength(0);
+    expect(navigated.invalidations[0]?.reason).toBe("navigation");
+    expect(navigated.invalidations[0]?.selectors).toEqual(["#header .logo", "#table .row"]);
+    const mutated = invalidateselcacheonmutations(cache, ["#header"], now);
+    expect(mutated.entries.map((entry) => entry.selector)).toEqual(["#table .row"]);
+    expect(mutated.invalidations[0]?.reason).toBe("mutation");
+    expect(mutated.invalidations[0]?.selectors).toEqual(["#header .logo"]);
+  });
+
+  it("revalidates cached hits before the dispatch and overwrites diverging resolutions", () => {
+    let cache = cacheselentry(openselcache("run1"), { selector: "#a", resolution: "resolved:#a" });
+    const confirmed = revalidateselentry(cache, { selector: "#a", freshresolution: "resolved:#a" });
+    expect(confirmed).toBe(cache);
+    const diverged = revalidateselentry(cache, { selector: "#a", freshresolution: "resolved:#a:fresh" });
+    expect(diverged.entries[0]?.resolution).toBe("resolved:#a:fresh");
+    expect(diverged.entries[0]?.generation).toBe(cache.generation);
+    const added = revalidateselentry(cache, { selector: "#b", freshresolution: "resolved:#b" });
+    expect(added.entries.map((entry) => entry.selector)).toEqual(["#a", "#b"]);
+    const stats = selcachestats(cache, [
+      { hit: true, stale: false },
+      { hit: false, stale: true },
+      { hit: true, stale: false },
+    ]);
+    expect(stats).toEqual({ hits: 2, stale: 1, total: 3 });
+    expect(
+      selcacheentries(advanceselcachegeneration(cacheselentry(cache, { selector: "#a", resolution: "r" }), now)),
+    ).toHaveLength(0);
+  });
+
+  it("reports stale generation failures with a reviewed retry hint and prunes at run end", async () => {
+    const failure = stalegenerationfailure({
+      stepid: "s1",
+      runid: "run1",
+      selector: "#a",
+      entrygeneration: 0,
+      currentgeneration: 3,
+      now,
+    });
+    expect(failure.message).toMatch(/generation 0 while the run run1 stands at generation 3/i);
+    expect(failure.retry.allowed).toBe(true);
+    expect(failure.retry.reason).toMatch(/new reviewed dispatch/i);
+    expect(failure.context).toEqual({ selector: "#a", entrygeneration: "0", currentgeneration: "3" });
+    const store = new sessionmemory(new fakeadapter());
+    let state = cacheselentry(openselcache("run1"), { selector: "#a", resolution: "r" });
+    state = advanceselcachegeneration(state, now);
+    await store.setselcachestate(state);
+    expect((await store.getselcachestate("run1"))?.generation).toBe(1);
+    await store.pruneselcache("run1");
+    const pruned = await store.getselcachestate("run1");
+    expect(pruned?.entries).toHaveLength(0);
+    expect(pruned?.generation).toBe(0);
+  });
+});