deepdebug-local-agent 1.12.1 → 1.13.1

package/test/la-protocol-v2/chat-dlp-json.test.js

@@ -0,0 +1,169 @@
+// LA-3 review fix: the event lines of agent2 are JSON; the DLP must judge their DECODED strings, not the serialized line (inside JSON a quoted value is \" and the
+// assignment patterns stopped matching). Unit (maskEventLine), disk (ChatStore) and fuzz of formats. The wire (job.stream body) is in chat-la.test.js.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { maskEventLine, WITHHELD_LINE } from "../../src/la-protocol-v2/chat/dlp.js";
+import { resolveChatConfig } from "../../src/la-protocol-v2/chat/config.js";
+import { createChatStore } from "../../src/la-protocol-v2/chat/store.js";
+
+const TENANT = "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f";
+const ENV = { LOCAL_AGENT_DLP_MODE: "enforce", LOCAL_AGENT_DLP_BLOCK_CLASSES: "private-key" };
+const PW = "Sup3rS3cretValue!99";
+const KEY = "abcd1234efgh5678ijkl9999";
+const SECRETS = [PW, KEY];
+const mask = (o) => maskEventLine(typeof o === "string" ? o : JSON.stringify(o), WITHHELD_LINE, { env: ENV, source: "t" });
+const leaks = (text) => SECRETS.filter((s) => text.includes(s));
+
+const CASES = {
+    "object with secret-named keys (the reviewer's case)": { type: "tool_result", content: { db_password: PW, api_key: KEY } },
+    "token with a quoted assignment": { type: "token", content: `the config says password = "${PW}" ok` },
+    "summary answer with a quoted assignment": { type: "summary", content: { answer: `use password = "${PW}" and api_key: "${KEY}"`, conversationId: "x" } },
+    "tool output: a JSON document inside a string": { type: "tool_result", output: JSON.stringify({ db_password: PW, api_key: KEY }) },
+    "tool output: env file with single quotes": { type: "tool_result", output: `DB_PASSWORD='${PW}'\nAPI_KEY='${KEY}'\n` },
+    "nested quotes and escapes": { type: "token", content: `say \\"password = \\\\\\"${PW}\\\\\\"\\"` },
+    "array of objects": { type: "x", items: [{ client_secret: PW }, [{ apiKey: KEY }]] },
+    "secret after a line break": { type: "token", content: `line one\r\nline two\npassword = "${PW}"\n\napi_key=\t${KEY}` },
+    "unicode escapes written in the raw line": null,   // below: the raw line carries \\u escapes
+    "key named __proto__": null,
+};
+
+for (const [name, ev] of Object.entries(CASES)) {
+    if (!ev) continue;
+    test(`maskEventLine: ${name} - no secret survives and the line is still JSON`, () => {
+        const m = mask(ev);
+        assert.equal(m.withheld, false, m.text);
+        assert.deepEqual(leaks(m.text), []);
+        assert.ok(m.total > 0);
+        assert.doesNotThrow(() => JSON.parse(m.text));
+        assert.equal(JSON.parse(m.text).type, ev.type, "the structure is kept");
+    });
+}
+
+test("maskEventLine: the raw line spells the secret with \\u escapes and \\/ : decoded before judging", () => {
+    const esc = (s) => [...s].map((c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`).join("");
+    const raw = `{"type":"token","content":"password \\u003d \\"${PW}\\"","d\\u0062_password":"${esc(PW)}"}`;
+    const m = mask(raw);
+    assert.equal(m.withheld, false);
+    assert.deepEqual(leaks(m.text), []);
+    assert.ok(!m.text.includes(PW) && !JSON.parse(m.text).content.includes(PW));
+});
+
+test("maskEventLine: __proto__ key and a secret used as a KEY are handled, no prototype pollution", () => {
+    const raw = `{"type":"x","__proto__":{"db_password":"${PW}"},"sk-ant-${"a1".repeat(15)}":"v"}`;
+    const m = mask(raw);
+    assert.equal(m.withheld, false);
+    assert.deepEqual(leaks(m.text), []);
+    assert.ok(!m.text.includes("sk-ant-a1a1"), "a secret in a key is masked as well");
+    assert.equal({}.db_password, undefined);
+});
+
+test("maskEventLine: a line that is not JSON is masked as text; a bare JSON scalar too", () => {
+    for (const raw of [`not json password = "${PW}"`, JSON.stringify(`password = "${PW}"`), "{\"type\":\"token\",\"content\":\"cut off password = \\\""]) {
+        const m = mask(raw);
+        assert.deepEqual(leaks(m.text), [], raw);
+    }
+});
+
+test("maskEventLine: fail closed - DLP not enforce, a blocked class, oversize, too deep -> the whole line is withheld", () => {
+    const ok = JSON.stringify({ type: "token", content: "hello" });
+    assert.equal(maskEventLine(ok, WITHHELD_LINE, { env: { LOCAL_AGENT_DLP_MODE: "warn" } }).withheld, true);
+    assert.equal(maskEventLine(ok, WITHHELD_LINE, { env: {} }).withheld, true);
+    const pem = { type: "tool_result", output: "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAxxxxxxxxxxxxxxxx\n-----END RSA PRIVATE KEY-----" };
+    const w = mask(pem);
+    assert.deepEqual([w.withheld, w.text], [true, WITHHELD_LINE]);
+    assert.equal(maskEventLine(ok, WITHHELD_LINE, { env: { ...ENV, LOCAL_AGENT_DLP_MAX_BYTES: "3" } }).withheld, true);
+    let deep = "x";
+    for (let i = 0; i < 200; i++) deep = { a: deep };
+    assert.equal(mask(deep).withheld, true);
+    assert.equal(mask("{\"a\":" + "[".repeat(5) + "]".repeat(5) + "}").withheld, false, "shallow nesting is fine");
+});
+
+test("maskEventLine: harmless content is untouched (same JSON), a placeholder is not masked twice", () => {
+    const ev = { type: "token", content: "total = 42; the password policy is documented in README", n: 3, ok: true, z: null };
+    const m = mask(ev);
+    assert.deepEqual(JSON.parse(m.text), ev);
+    assert.equal(m.total, 0);
+    const once = mask({ type: "token", content: `password = "${PW}"` });
+    const twice = mask(once.text);
+    assert.equal(twice.text, once.text, "idempotent: the egress mask over the stored mask changes nothing");
+});
+
+test("fuzz: random wrappers around secrets in strings, keys, arrays and line breaks never leak", () => {
+    let seed = 12345;
+    const rnd = (n) => { seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed % n; };
+    const names = ["password", "db_password", "api_key", "apiKey", "client_secret", "auth_token", "PASSWD", "secret", "access_token"];
+    const quotes = ['"', "'", "", '\\"', "`"];
+    const seps = [" = ", ": ", "=", ":", "=>", " : "];
+    const pre = ["", "\n", "\r\n", "  ", "export ", "{ ", "foo bar\n\n"];
+    for (let i = 0; i < 400; i++) {
+        const sec = i % 2 ? PW : KEY;
+        const q = quotes[rnd(quotes.length)];
+        const text = `${pre[rnd(pre.length)]}${names[rnd(names.length)]}${seps[rnd(seps.length)]}${q}${sec}${q}${pre[rnd(pre.length)]}`;
+        const shape = rnd(4);
+        const ev = shape === 0 ? { type: "token", content: text }
+            : shape === 1 ? { type: "tool_result", output: { [names[rnd(names.length)]]: sec, other: [text] } }
+                : shape === 2 ? { type: "summary", content: { answer: text } }
+                    : { type: "tool_result", output: JSON.stringify({ [names[rnd(names.length)]]: sec }) };
+        const m = mask(ev);
+        assert.deepEqual(leaks(m.text), [], `iteration ${i}: ${JSON.stringify(ev)}`);
+        JSON.parse(m.text);
+    }
+});
+
+function mkStore() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "la-chat-dlpjson-"));
+    const env = { ...ENV, LOCAL_AGENT_CHAT: "true", LOCAL_AGENT_CHAT_DIR: dir };
+    const config = resolveChatConfig(env, () => {});
+    const store = createChatStore({ dir, tenantId: TENANT, config, env, log: { info() {}, warn() {}, log() {} } });
+    return { dir, store, stop: () => { store.close(); fs.rmSync(dir, { recursive: true, force: true }); } };
+}
+
+test("disk: quoted secrets in a token, a tool result and a summary are not in the .jsonl", async () => {
+    const t = mkStore();
+    try {
+        const id = crypto.randomUUID();
+        const rec = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "hi" });
+        rec.append(JSON.stringify({ type: "token", content: `password = "${PW}"` }));
+        rec.append(JSON.stringify({ type: "tool_result", content: { db_password: PW, api_key: KEY } }));
+        rec.append(JSON.stringify({ type: "tool_result", output: JSON.stringify({ db_password: PW }) }));
+        rec.append(JSON.stringify({ type: "summary", content: { answer: `password = "${PW}"`, conversationId: id } }));
+        rec.finish("done");
+        await t.store.flush();
+        const disk = fs.readFileSync(path.join(t.dir, TENANT, `${id}.jsonl`), "utf8");
+        assert.deepEqual(leaks(disk), [], "no secret on the disk");
+        assert.match(disk, /REDACTED/);
+        const r = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 0 });
+        assert.equal(r.events.length, 4);
+        assert.deepEqual(leaks(JSON.stringify(r.events)), []);
+        const s = t.store.readSession({ conversationId: id, workspaceId: "ws-1" });
+        assert.deepEqual(leaks(JSON.stringify(s)), []);
+    } finally { t.stop(); }
+});
+
+test("begin on a conversation that already has its end mark does not truncate it: the old file is archived", async () => {
+    const t = mkStore();
+    try {
+        const id = crypto.randomUUID();
+        const a = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "first run" });
+        a.append(JSON.stringify({ type: "token", content: "FIRST-RUN-EVENT" }));
+        a.finish("done");
+        await t.store.flush();
+        const file = path.join(t.dir, TENANT, `${id}.jsonl`);
+        const before = fs.readFileSync(file, "utf8");
+        assert.match(before, /"k":"end"/);
+        const b = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "second run" });
+        b.append(JSON.stringify({ type: "token", content: "SECOND-RUN-EVENT" }));
+        b.finish("done");
+        await t.store.flush();
+        const now = fs.readFileSync(file, "utf8");
+        assert.ok(!now.includes("FIRST-RUN-EVENT") && now.includes("SECOND-RUN-EVENT"), "the live file is the new run's");
+        const archived = fs.readdirSync(path.join(t.dir, TENANT)).filter((n) => n.startsWith(`${id}.`) && n !== `${id}.jsonl`);
+        assert.equal(archived.length, 1, "the finished conversation was kept, not truncated");
+        assert.equal(fs.readFileSync(path.join(t.dir, TENANT, archived[0]), "utf8"), before);
+        assert.equal((fs.statSync(path.join(t.dir, TENANT, archived[0])).mode & 0o777), 0o600);
+    } finally { t.stop(); }
+});