deepdebug-local-agent 1.4.0 → 1.6.0

package/test/la-protocol-v2/content-handlers.test.js

@@ -0,0 +1,627 @@
+// F3-07: content.request handlers (kinds file and diff) behind LOCAL_AGENT_CONTENT_HANDLERS. Real V2Session, real handler,
+// real files and git repos on disk; the control plane is the in-memory ReferenceCp. What is NOT here: real gateway (tools/interop).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { waitFor, uuid, TENANT } from "./helpers/reference-cp.js";
+import { setup, write, git, initRepo, tmpDir } from "./helpers/content-rig.js";
+
+const GH = "ghp_" + "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8";
+const AWS = "AKIAIOSFODNN7EXAMPLE";
+const PEM = "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n-----END RSA PRIVATE KEY-----";
+const SECRETS = [GH, AWS, "MIIEowIBAAKCAQEAxxxxxxxxxxxxxxxxxxxxxxxxxxxx"];
+
+/** Every byte of content that went out, per chunk and joined (a secret must be absent from both). */
+function wireContent(rig) {
+    const chunks = rig.cp.received.filter((f) => f.type === "content.response").map((f) => Buffer.from(f.payload.data, "base64").toString("utf8"));
+    return { chunks, joined: chunks.join("") };
+}
+
+async function withRig(opts, body) {
+    const rig = await setup(opts);
+    try { await body(rig); } finally { await rig.stop(); }
+}
+
+// ------------------------------------------------------------------------------------------ file: the happy path
+
+test("file: an id minted by the agent is served; the request is acked `accepted` before the answer; content type from the extension", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "docs/readme.md", "# hello\n");
+        write(rig.root(), "src/data.json", '{"a":1}');
+        write(rig.root(), "src/a.txt", "plain");
+        const r = await rig.request({ ref: rig.mint("file", "docs/readme.md") });
+        assert.deepEqual([r.status, r.contentType, r.text], ["ok", "text/markdown", "# hello\n"]);
+        assert.equal((await rig.request({ ref: rig.mint("file", "src/data.json") })).contentType, "application/json");
+        assert.equal((await rig.request({ ref: rig.mint("file", "src/a.txt") })).contentType, "text/plain");
+        assert.ok(rig.cp.acksFromLa.some((a) => a.status === "accepted"), "the LA acked the content.request itself");
+        const frame = r.frames[0];
+        assert.equal(frame.workspaceId, "ws-1");
+        assert.equal(frame.payload.totalBytes, 8);
+    });
+});
+
+test("file: 100 KiB goes out in 4 chunks and the CP rebuilds it byte for byte; exactly the size limit is accepted", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        const data = Buffer.from("line of text number x\n".repeat(5000)).subarray(0, 100 * 1024);
+        write(rig.root(), "big.txt", data);
+        const r = await rig.request({ ref: rig.mint("file", "big.txt") });
+        assert.equal(r.status, "ok");
+        assert.equal(r.chunks, 4);
+        assert.ok(r.body.equals(data));
+        write(rig.root(), "max.txt", Buffer.alloc(rig.config.maxBytes, 0x61));
+        const m = await rig.request({ ref: rig.mint("file", "max.txt") });
+        assert.equal(m.status, "ok");
+        assert.equal(m.chunks, rig.config.maxBytes / 32768);
+        assert.equal(m.body.length, rig.config.maxBytes);
+    });
+});
+
+test("file: unicode names, spaces and a root reached through a symlink work", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "Dir Com Espaço/ficheiro ü ñ 日本.txt", "olá");
+        assert.equal((await rig.request({ ref: rig.mint("file", "Dir Com Espaço/ficheiro ü ñ 日本.txt") })).text, "olá");
+    });
+});
+
+test("file: range is applied to the bytes as served, and past the end is an empty ok", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "r.txt", "0123456789");
+        const ref = rig.mint("file", "r.txt");
+        assert.equal((await rig.request({ ref, range: { offset: 2, length: 3 } })).text, "234");
+        assert.equal((await rig.request({ ref, range: { offset: 8, length: 100 } })).text, "89");
+        const past = await rig.request({ ref, range: { offset: 500, length: 10 } });
+        assert.deepEqual([past.status, past.body.length], ["ok", 0]);
+    });
+});
+
+// ------------------------------------------------------------------------------------------ refs: opaque ids, nothing is a path
+
+test("ref: path-like refs are never interpreted as paths: traversal, absolute, NUL, %2e%2e, unicode tricks -> not_found, nothing echoed", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        const outside = tmpDir(); rig.dirs.push(outside);
+        write(outside, "passwd", "OUTSIDE-CONTENT");
+        write(rig.root(), "src/a.txt", "inside");
+        const hostile = ["../../etc/passwd", "../" + path.basename(outside) + "/passwd", path.join(outside, "passwd"), "/etc/passwd", "src/a.txt", "src/../src/a.txt",
+            "..%2f..%2fetc%2fpasswd", "%2e%2e/%2e%2e/etc/passwd", "src/a.txt\u0000.png", "..\\..\\windows\\win.ini", "ｓｒｃ/ａ.txt", "src/a.txt ", "./src/a.txt", "‮src/a.txt", "cr1_" + "A".repeat(22), "ZZMARKERZZ/../x"];
+        for (const ref of hostile) {
+            // the schema refuses control characters in `ref` (the CP cannot even send the NUL one); the others reach the handler
+            if (/[\u0000-\u001f]/.test(ref)) continue;
+            const r = await rig.request({ ref });
+            assert.equal(r.status, "not_found", ref);
+            assert.equal(r.body.length, 0);
+            assert.equal(r.errorCode, undefined, "no code needed for not_found");
+        }
+        const wire = rig.everything();
+        assert.equal(wire.includes("OUTSIDE-CONTENT"), false);
+        assert.equal(wire.includes("ZZMARKERZZ"), false, "the ref is never echoed");
+        assert.equal(wire.includes(path.basename(outside)), false);
+        assert.equal(wire.includes(path.basename(rig.root())), false);
+    });
+});
+
+test("ref: unknown and expired ids are not_found; an expired id does not come back", async () => {
+    let t = 5_000_000;
+    await withRig({ dlp: "enforce", now: () => t, env: { LOCAL_AGENT_CONTENT_REF_TTL_MS: "60000" } }, async (rig) => {
+        write(rig.root(), "a.txt", "x");
+        const id = rig.mint("file", "a.txt");
+        assert.equal((await rig.request({ ref: id })).status, "ok");
+        t += 59_000;
+        assert.equal((await rig.request({ ref: id })).status, "ok");
+        t += 2_000;
+        assert.equal((await rig.request({ ref: id })).status, "not_found");
+        t = 5_000_000;
+        assert.equal((await rig.request({ ref: id })).status, "not_found", "gone for good, not just late");
+        assert.equal((await rig.request({ ref: "cr1_" + crypto.randomBytes(16).toString("base64url") })).status, "not_found");
+    });
+});
+
+test("ref: an id of workspace A does not open anything through workspace B (both registered), nor through an unregistered one", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root("ws-1"), "a.txt", "A-CONTENT");
+        write(rig.root("ws-2"), "a.txt", "B-CONTENT");
+        const idA = rig.mint("file", "a.txt", "ws-1");
+        assert.equal((await rig.request({ ref: idA, workspaceId: "ws-1" })).text, "A-CONTENT");
+        const cross = await rig.request({ ref: idA, workspaceId: "ws-2" });
+        assert.equal(cross.status, "not_found");
+        assert.equal(cross.body.length, 0);
+        assert.equal((await rig.request({ ref: idA, workspaceId: "ws-unknown" })).status, "not_found");
+        assert.equal((await rig.request({ ref: idA, workspaceId: "default" })).status, "not_found");
+        assert.equal(rig.everything().includes("B-CONTENT"), false);
+    });
+});
+
+test("ref: a workspace that belongs to another tenant is not served, even with a valid id", async () => {
+    const rootA = tmpDir(); const rootB = tmpDir();
+    await withRig({ dlp: "enforce", workspaces: { "ws-1": { root: rootA }, "ws-foreign": { root: rootB, tenantId: "9d1f6a2c-0000-4000-8000-000000000000" } } }, async (rig) => {
+        write(rootA, "a.txt", "mine"); write(rootB, "a.txt", "FOREIGN");
+        const id = rig.registry.mint({ workspaceId: "ws-foreign", root: rootB, kind: "file", rel: "a.txt" }).id;
+        assert.equal((await rig.request({ ref: id, workspaceId: "ws-foreign" })).status, "not_found");
+        assert.equal(rig.everything().includes("FOREIGN"), false);
+    });
+    fs.rmSync(rootA, { recursive: true, force: true }); fs.rmSync(rootB, { recursive: true, force: true });
+});
+
+test("ref: a frame for another tenant never reaches the handler (the session refuses it as tenant_mismatch)", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "a.txt", "x");
+        const f = rig.cp.frameWith("content.request", { kind: "file", ref: rig.mint("file", "a.txt"), actor: { userId: "u-1", role: "member" } }, { requestId: uuid() });
+        f.tenantId = "9d1f6a2c-0000-4000-8000-000000000000";
+        rig.cp.sendRaw(JSON.stringify(f));
+        await waitFor(() => rig.cp.peerErrors.length > 0);
+        assert.equal(rig.cp.peerErrors[0], "tenant_mismatch");
+        assert.equal(rig.handler.stats.received, 0);
+    });
+});
+
+test("ref: a workspace re-opened on another directory invalidates the ids minted for the old root", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "a.txt", "old root");
+        const id = rig.mint("file", "a.txt");
+        const other = tmpDir(); rig.dirs.push(other);
+        write(other, "a.txt", "NEW ROOT");
+        rig.wsMap.set("ws-1", { root: other });
+        const r = await rig.request({ ref: id });
+        assert.equal(r.status, "not_found");
+        assert.equal(r.text, "");
+    });
+});
+
+// ------------------------------------------------------------------------------------------ path checks at read time
+
+test("file: sensitive files are forbidden by name (an id for them cannot be minted) and by link (a harmless name pointing to .env)", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), ".env", "DB_PASSWORD=hunter2hunter2");
+        write(rig.root(), "certs/server.pem", "PEMDATA");
+        write(rig.root(), ".git/config", "[remote]\n\turl = https://user:tok@host/r.git");
+        for (const rel of [".env", "certs/server.pem", ".git/config"]) assert.equal(rig.mint("file", rel), null, rel);
+        // an id minted for an innocent file that is later replaced by a link to .env
+        write(rig.root(), "src/innocent.txt", "fine");
+        const id = rig.mint("file", "src/innocent.txt");
+        fs.rmSync(path.join(rig.root(), "src/innocent.txt"));
+        fs.symlinkSync("../.env", path.join(rig.root(), "src/innocent.txt"));
+        const r = await rig.request({ ref: id });
+        assert.equal(r.status, "forbidden");
+        assert.equal(r.body.length, 0);
+        assert.equal(rig.everything().includes("hunter2"), false);
+    });
+});
+
+test("file: the deny list is configurable (LOCAL_AGENT_CONTENT_DENY_GLOBS) and applied at read time too", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_DENY_GLOBS: "private-notes/, *.hush" } }, async (rig) => {
+        write(rig.root(), "private-notes/n.txt", "n"); write(rig.root(), "a.hush", "h");
+        assert.equal(rig.mint("file", "private-notes/n.txt"), null);
+        assert.equal(rig.mint("file", "a.hush"), null);
+        write(rig.root(), "ok.txt", "ok");
+        const id = rig.mint("file", "ok.txt");
+        fs.rmSync(path.join(rig.root(), "ok.txt"));
+        fs.symlinkSync("a.hush", path.join(rig.root(), "ok.txt"));
+        assert.equal((await rig.request({ ref: id })).status, "forbidden");
+    });
+});
+
+test("file: a symlink that leaves the workspace (swapped in after the id was minted) is forbidden and its target is never read", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        const outside = tmpDir(); rig.dirs.push(outside);
+        write(outside, "secret.txt", "OUTSIDE-SECRET-CONTENT");
+        write(outside, "d/x.txt", "OUTSIDE-DIR-CONTENT");
+        write(rig.root(), "a.txt", "fine"); write(rig.root(), "sub/b.txt", "fine");
+        const a = rig.mint("file", "a.txt");
+        const b = rig.mint("file", "sub/b.txt");
+        fs.rmSync(path.join(rig.root(), "a.txt"));
+        fs.symlinkSync(path.join(outside, "secret.txt"), path.join(rig.root(), "a.txt"));
+        fs.rmSync(path.join(rig.root(), "sub"), { recursive: true });
+        fs.symlinkSync(path.join(outside, "d"), path.join(rig.root(), "sub"));
+        write(outside, "d/b.txt", "OUTSIDE-DIR-CONTENT");
+        assert.equal((await rig.request({ ref: a })).status, "forbidden");
+        assert.equal((await rig.request({ ref: b })).status, "forbidden");
+        assert.equal(rig.everything().includes("OUTSIDE"), false);
+    });
+});
+
+test("file: missing file, a directory and an id minted for a path that never existed are not_found", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "d/x.txt", "x");
+        assert.equal((await rig.request({ ref: rig.mint("file", "nope.txt") })).status, "not_found");
+        assert.equal((await rig.request({ ref: rig.mint("file", "d") })).status, "not_found");
+    });
+});
+
+test("file: a file above the limit is payload_too_large WITHOUT being read (3 GiB sparse file answered at once)", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "huge.bin", "");
+        fs.truncateSync(path.join(rig.root(), "huge.bin"), 3 * 1024 ** 3);
+        const t0 = Date.now();
+        const r = await rig.request({ ref: rig.mint("file", "huge.bin") });
+        assert.deepEqual([r.status, r.errorCode, r.body.length], ["error", "payload_too_large", 0]);
+        assert.ok(Date.now() - t0 < 1500);
+        write(rig.root(), "over.txt", Buffer.alloc(rig.config.maxBytes + 1, 0x61));
+        assert.equal((await rig.request({ ref: rig.mint("file", "over.txt") })).errorCode, "payload_too_large");
+        const small = await setup({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "4096" } });
+        try {
+            write(small.root(), "f.txt", Buffer.alloc(4097, 0x61));
+            assert.equal((await small.request({ ref: small.mint("file", "f.txt") })).errorCode, "payload_too_large");
+        } finally { await small.stop(); }
+    });
+});
+
+// ------------------------------------------------------------------------------------------ binary
+
+test("binary: in enforce it cannot be inspected and is withheld (forbidden); invalid UTF-8 counts as binary", async () => {
+    const bin = Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47, 0, 0, 0, 1]), crypto.randomBytes(5000)]);
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "logo.png", bin);
+        write(rig.root(), "latin1.txt", Buffer.from([0x63, 0x61, 0x66, 0xe9, 0xff, 0xfe]));
+        const r = await rig.request({ ref: rig.mint("file", "logo.png") });
+        assert.equal(r.status, "forbidden");
+        assert.equal(r.body.length, 0);
+        assert.equal((await rig.request({ ref: rig.mint("file", "latin1.txt") })).status, "forbidden");
+    });
+});
+
+// ------------------------------------------------------------------------------------------ DLP
+
+test("DLP enforce: a secret in the middle of a file never goes out in clear; the rest of the file does", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        const text = `${"x = 1\n".repeat(4000)}token = "${GH}"\naws_key=${AWS}\n${PEM}\n${"y = 2\n".repeat(4000)}`;
+        write(rig.root(), "config.txt", text);
+        const r = await rig.request({ ref: rig.mint("file", "config.txt") });
+        assert.equal(r.status, "ok");
+        for (const s of SECRETS) assert.equal(r.text.includes(s), false, s.slice(0, 8));
+        assert.match(r.text, /\[REDACTED:github_token\]/);
+        assert.match(r.text, /\[REDACTED:aws_access_key_id\]/);
+        assert.match(r.text, /\[REDACTED:pem_private_key\]/);
+        assert.ok(r.text.startsWith("x = 1\n") && r.text.trimEnd().endsWith("y = 2"));
+        const w = wireContent(rig);
+        for (const s of SECRETS) { assert.equal(w.joined.includes(s), false); for (const c of w.chunks) assert.equal(c.includes(s), false); }
+        const rec = rig.handler.audit.tail(1)[0];
+        assert.equal(rec.dlpMode, "enforce");
+        assert.ok(rec.dlpHits >= 3);
+        assert.equal(JSON.stringify(rec).includes(GH), false);
+    });
+});
+
+test("DLP enforce: a secret that would straddle two chunks is found (the whole text is masked BEFORE it is split)", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        for (const cut of [1, 17, 20, 39]) { // the token starts `cut` bytes before the 32 KiB boundary
+            const head = "a".repeat(32766 - cut - 1) + "\n"; // + "k=" => the token starts `cut` bytes before the boundary
+            const text = head + `k=${GH}\n` + "z\n".repeat(100);
+            const start = text.indexOf(GH);
+            assert.ok(start < 32768 && start + GH.length > 32768, "the token crosses the 32 KiB chunk boundary of the ORIGINAL file");
+            write(rig.root(), `straddle-${cut}.txt`, text);
+            const r = await rig.request({ ref: rig.mint("file", `straddle-${cut}.txt`) });
+            assert.equal(r.status, "ok");
+            assert.ok(r.chunks >= 2);
+            const w = wireContent(rig);
+            assert.equal(w.joined.includes(GH), false);
+            for (const c of w.chunks) assert.equal(c.includes(GH.slice(0, 12)), false, "not even a fragment (cut " + cut + ")");
+        }
+    });
+});
+
+test("DLP warn and off (F3-07b): no content is served at all, the answer is protocol_unsupported and nothing was read", async () => {
+    for (const dlp of ["warn", "off"]) {
+        await withRig({ dlp }, async (rig) => {
+            write(rig.root(), "c.txt", `k=${GH}\n`);
+            const r = await rig.request({ ref: rig.mint("file", "c.txt") });
+            assert.deepEqual([r.status, r.errorCode, r.body.length], ["error", "protocol_unsupported", 0], dlp);
+            assert.equal(r.text.includes(GH), false);
+            const rec = rig.handler.audit.tail(1)[0];
+            assert.deepEqual([rec.status, rec.errorCode, rec.bytes], ["error", "protocol_unsupported", 0]);
+        });
+    }
+});
+
+test("DLP enforce: a hit in LOCAL_AGENT_DLP_BLOCK_CLASSES withholds the whole file (forbidden, no body)", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_DLP_BLOCK_CLASSES: "private-key" } }, async (rig) => {
+        write(rig.root(), "k.txt", `before\n${PEM}\nafter\n`);
+        write(rig.root(), "ok.txt", `just ${AWS}\n`);
+        const r = await rig.request({ ref: rig.mint("file", "k.txt") });
+        assert.deepEqual([r.status, r.body.length], ["forbidden", 0]);
+        assert.equal(rig.everything().includes("before"), false);
+        assert.match((await rig.request({ ref: rig.mint("file", "ok.txt") })).text, /REDACTED:aws_access_key_id/);
+    });
+});
+
+test("DLP enforce: above LOCAL_AGENT_DLP_MAX_BYTES it fails closed with payload_too_large (never the oversize placeholder as if it were content)", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_DLP_MAX_BYTES: "1000" } }, async (rig) => {
+        write(rig.root(), "a.txt", `${"a".repeat(2000)}${GH}`);
+        const r = await rig.request({ ref: rig.mint("file", "a.txt") });
+        assert.deepEqual([r.status, r.errorCode, r.body.length], ["error", "payload_too_large", 0]);
+        assert.equal(rig.everything().includes("dlp_oversize"), false);
+    });
+});
+
+test("DLP enforce: masking that makes the text grow past the limit is payload_too_large, not a truncated answer", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "25000" } }, async (rig) => {
+        write(rig.root(), "many.txt", `${AWS} `.repeat(1000)); // 21 KB -> 29 KB once masked
+        const r = await rig.request({ ref: rig.mint("file", "many.txt") });
+        assert.deepEqual([r.status, r.errorCode], ["error", "payload_too_large"]);
+        assert.equal(rig.everything().includes(AWS), false);
+    });
+});
+
+test("DLP: the mode is read from LOCAL_AGENT_DLP_MODE at each request; leaving enforce stops serving at once (no opt-out), going back resumes", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "c.txt", `k=${GH}\n`);
+        const id = rig.mint("file", "c.txt");
+        assert.equal((await rig.request({ ref: id })).text.includes(GH), false);
+        rig.env.LOCAL_AGENT_DLP_MODE = "off";
+        const off = await rig.request({ ref: id });
+        assert.deepEqual([off.status, off.errorCode, off.text], ["error", "protocol_unsupported", ""]);
+        rig.env.LOCAL_AGENT_DLP_MODE = "enforce";
+        assert.equal((await rig.request({ ref: id })).status, "ok");
+    });
+});
+
+test("range after masking: the offsets refer to what is served, and a range cannot cut a secret out of the masking", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "r.txt", `AAAA\n${GH}\nBBBB\n`);
+        const ref = rig.mint("file", "r.txt");
+        const whole = (await rig.request({ ref })).text;
+        assert.equal(whole, "AAAA\n[REDACTED:github_token]\nBBBB\n");
+        // asking for the bytes where the token WAS in the original returns bytes of the masked text, never of the token
+        const slice = await rig.request({ ref, range: { offset: 5, length: 20 } });
+        assert.equal(slice.text, whole.slice(5, 25));
+        assert.equal(slice.text.includes("ghp_"), false);
+    });
+});
+
+// ------------------------------------------------------------------------------------------ other kinds
+
+test("every other kind of the allowlist answers `error` + protocol_unsupported (the code already used for \"no handler\"), reading nothing", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "a.txt", "x");
+        const ref = rig.mint("file", "a.txt");
+        for (const kind of ["incident.detail", "incident.stack", "log.window", "log.groups", "chat.session", "wiki.page", "job.stream", "job.timeline", "approval.detail", "report"]) {
+            const r = await rig.request({ kind, ref });
+            assert.deepEqual([r.status, r.errorCode, r.body.length], ["error", "protocol_unsupported", 0], kind);
+        }
+    });
+});
+
+test("an id minted for a file is not valid as a diff, and the other way round", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "a.txt", "x");
+        assert.equal((await rig.request({ kind: "diff", ref: rig.mint("file", "a.txt") })).status, "not_found");
+        assert.equal((await rig.request({ kind: "file", ref: rig.mint("diff", null) })).status, "not_found");
+    });
+});
+
+// ------------------------------------------------------------------------------------------ diff
+
+function repoWithChanges(root) {
+    write(root, "src/app.js", "const a = 1;\n");
+    write(root, "src/other.js", "const o = 1;\n");
+    write(root, ".env", "API=old\n");
+    write(root, "keys/server.pem", "OLDPEM\n");
+    write(root, "logo.bin", Buffer.from([0, 1, 2, 3]));
+    git(root, "init", "-q", "-b", "main");
+    git(root, "add", "-f", "-A");
+    git(root, "commit", "-q", "-m", "init");
+    write(root, "src/app.js", `const a = 2;\nconst token = "${GH}";\n`);
+    write(root, ".env", "API=NEWSECRETVALUE-1234567890\n");
+    write(root, "keys/server.pem", "NEWPEM-CONTENT\n");
+    write(root, "logo.bin", Buffer.from([0, 9, 9, 9]));
+    write(root, "untracked.txt", "UNTRACKED-NEVER-IN-A-DIFF\n");
+}
+
+test("diff: `worktree` is the work tree against HEAD; sensitive files are left out, secrets are masked, untracked files are not there", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        repoWithChanges(rig.root());
+        const r = await rig.request({ kind: "diff", ref: "worktree" });
+        assert.equal(r.status, "ok");
+        assert.equal(r.contentType, "text/x-diff");
+        assert.match(r.text, /^diff --git a\/src\/app\.js b\/src\/app\.js/m, "relative to the workspace root");
+        assert.match(r.text, /-const a = 1;/);
+        assert.match(r.text, /\[REDACTED:github_token\]/);
+        assert.equal(r.text.includes(GH), false);
+        assert.equal(r.text.includes(".env"), false);
+        assert.equal(r.text.includes("NEWSECRETVALUE"), false);
+        assert.equal(r.text.includes("server.pem") || r.text.includes("NEWPEM"), false);
+        assert.equal(r.text.includes("UNTRACKED"), false);
+        assert.match(r.text, /Binary files a\/logo\.bin and b\/logo\.bin differ/);
+        assert.equal(wireContent(rig).joined.includes(GH), false);
+    });
+});
+
+test("diff: a minted id can ask for one file; a sensitive path cannot be minted; an unchanged file is an empty ok", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        repoWithChanges(rig.root());
+        const one = await rig.request({ kind: "diff", ref: rig.mint("diff", "src/app.js") });
+        assert.equal(one.status, "ok");
+        assert.match(one.text, /src\/app\.js/);
+        assert.equal(one.text.includes("other.js"), false);
+        assert.equal(rig.mint("diff", ".env"), null);
+        const unchanged = await rig.request({ kind: "diff", ref: rig.mint("diff", "src/other.js") });
+        assert.deepEqual([unchanged.status, unchanged.body.length], ["ok", 0]);
+        const whole = await rig.request({ kind: "diff", ref: rig.mint("diff", null) });
+        assert.match(whole.text, /src\/app\.js/);
+    });
+});
+
+test("diff: not a repository, or a repository without commits -> not_found; another workspace's id does not diff this one", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root("ws-1"), "a.txt", "x");
+        assert.equal((await rig.request({ kind: "diff", ref: "worktree" })).status, "not_found");
+        git(rig.root("ws-1"), "init", "-q", "-b", "main");
+        assert.equal((await rig.request({ kind: "diff", ref: "worktree" })).status, "not_found", "no HEAD yet");
+        repoWithChanges(rig.root("ws-2"));
+        const id = rig.mint("diff", null, "ws-2");
+        assert.equal((await rig.request({ kind: "diff", ref: id, workspaceId: "ws-1" })).status, "not_found");
+        assert.equal((await rig.request({ kind: "diff", ref: "worktree", workspaceId: "ws-unknown" })).status, "not_found");
+    });
+});
+
+test("diff: a workspace inside a bigger repository only shows its own subtree", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        const top = rig.root();
+        write(top, "pkg/in.txt", "1\n"); write(top, "outside.txt", "1\n");
+        git(top, "init", "-q", "-b", "main"); git(top, "add", "-A"); git(top, "commit", "-q", "-m", "i");
+        write(top, "pkg/in.txt", "2\n"); write(top, "outside.txt", "OUTSIDE-CHANGE\n");
+        rig.wsMap.set("ws-sub", { root: path.join(top, "pkg") });
+        const r = await rig.request({ kind: "diff", ref: "worktree", workspaceId: "ws-sub" });
+        assert.equal(r.status, "ok");
+        assert.match(r.text, /in\.txt/);
+        assert.equal(r.text.includes("OUTSIDE-CHANGE") || r.text.includes("outside.txt"), false);
+    });
+});
+
+test("diff: repository config cannot run anything (fsmonitor, external diff, textconv) and GIT_DIR in the agent's env is ignored", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        const root = rig.root();
+        repoWithChanges(root);
+        const marker = path.join(tmpDir(), "PWNED"); rig.dirs.push(path.dirname(marker));
+        const script = path.join(path.dirname(marker), "evil.sh");
+        fs.writeFileSync(script, `#!/bin/sh\ntouch "${marker}"\nexit 0\n`, { mode: 0o755 });
+        git(root, "config", "core.fsmonitor", script);
+        git(root, "config", "diff.external", script);
+        git(root, "config", "diff.evil.textconv", script);
+        write(root, ".gitattributes", "*.js diff=evil\n");
+        const decoy = tmpDir(); rig.dirs.push(decoy);
+        write(decoy, "x", "x"); git(decoy, "init", "-q", "-b", "main"); git(decoy, "add", "-A"); git(decoy, "commit", "-q", "-m", "d");
+        process.env.GIT_DIR = path.join(decoy, ".git");
+        try {
+            const r = await rig.request({ kind: "diff", ref: "worktree" });
+            assert.equal(r.status, "ok");
+            assert.match(r.text, /src\/app\.js/, "the diff is of the workspace, not of GIT_DIR");
+        } finally { delete process.env.GIT_DIR; }
+        assert.equal(fs.existsSync(marker), false, "no command named by the repository config ran");
+    });
+});
+
+test("diff: above the size limit is payload_too_large (git is stopped while it streams)", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "20000" } }, async (rig) => {
+        write(rig.root(), "big.txt", "a\n");
+        git(rig.root(), "init", "-q", "-b", "main"); git(rig.root(), "add", "-A"); git(rig.root(), "commit", "-q", "-m", "i");
+        write(rig.root(), "big.txt", "change number x\n".repeat(5000));
+        const r = await rig.request({ kind: "diff", ref: "worktree" });
+        assert.deepEqual([r.status, r.errorCode], ["error", "payload_too_large"]);
+    });
+});
+
+// ------------------------------------------------------------------------------------------ cancellation, limits, backpressure
+
+test("cancel in the middle of a stream: no further chunk is read or sent, the slot and the memory come back, the audit says cancelled", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "big.txt", Buffer.alloc(rig.config.maxBytes, 0x61));
+        const requestId = uuid();
+        rig.cp.silent = true; // the CP never acks: 8 chunks fit the window, the rest waits (backpressure)
+        rig.cp.sendData("content.request", { kind: "file", ref: rig.mint("file", "big.txt"), actor: { userId: "u-1", role: "member" } }, { workspaceId: "ws-1", requestId });
+        await waitFor(() => rig.cp.received.filter((f) => f.type === "content.response").length === 8);
+        assert.equal(rig.handler.inflight, 1);
+        assert.ok(rig.handler.reservedBytes > 0);
+        assert.equal(rig.session.snapshot.waiting, 1, "the 9th chunk waits for a slot and the loop is blocked on it: the other 23 are not even built");
+        assert.equal(rig.handler.cancel(requestId), true);
+        await waitFor(() => rig.handler.inflight === 0);
+        assert.equal(rig.handler.reservedBytes, 0);
+        assert.equal(rig.session.snapshot.waiting, 0);
+        const before = rig.cp.received.filter((f) => f.type === "content.response").length;
+        rig.cp.silent = false;
+        await new Promise((r) => setTimeout(r, 150));
+        assert.equal(rig.cp.received.filter((f) => f.type === "content.response").length, before, "nothing more was sent");
+        assert.equal(rig.handler.audit.tail(1)[0].status, "cancelled");
+        assert.equal(rig.handler.stats.cancelled, 1);
+        assert.equal(rig.handler.cancel(requestId), false, "already gone");
+    });
+});
+
+test("the request deadline (LOCAL_AGENT_CONTENT_TOTAL_MS) stops a stream the CP does not consume", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_TOTAL_MS: "1000" } }, async (rig) => {
+        write(rig.root(), "big.txt", Buffer.alloc(rig.config.maxBytes, 0x61));
+        rig.cp.silent = true;
+        const requestId = uuid();
+        rig.cp.sendData("content.request", { kind: "file", ref: rig.mint("file", "big.txt"), actor: { userId: "u-1", role: "member" } }, { workspaceId: "ws-1", requestId });
+        await waitFor(() => rig.handler.audit.tail(1).length === 1, 4000);
+        assert.ok(["cancelled", "timeout"].includes(rig.handler.audit.tail(1)[0].status));
+        assert.equal(rig.handler.inflight, 0);
+        assert.equal(rig.handler.reservedBytes, 0);
+        assert.equal(rig.session.snapshot.waiting, 0);
+    });
+});
+
+test("backpressure: with a slow consumer the window of the session holds (at most 8 chunks unacked) and the file still arrives intact", async () => {
+    await withRig({ dlp: "enforce", cp: {} }, async (rig) => {
+        const data = crypto.randomBytes(Math.floor(rig.config.maxBytes / 2)).toString("base64").slice(0, Math.floor(rig.config.maxBytes / 2));
+        write(rig.root(), "big.txt", data);
+        rig.cp.ackDelayMs = 20;
+        let maxUnacked = 0;
+        const iv = setInterval(() => { maxUnacked = Math.max(maxUnacked, rig.session.snapshot.unacked); }, 2);
+        const r = await rig.request({ ref: rig.mint("file", "big.txt"), waitMs: 8000 });
+        clearInterval(iv);
+        assert.equal(r.status, "ok");
+        assert.equal(r.text, data);
+        assert.ok(maxUnacked <= 8, `max unacked ${maxUnacked}`);
+    });
+});
+
+test("limits: above LOCAL_AGENT_CONTENT_MAX_CONCURRENT the extra request gets rate_limited (a code, no content); the first one is not disturbed", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_CONCURRENT: "1", LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES: String(64 * 1024 * 1024) } }, async (rig) => {
+        write(rig.root(), "big.txt", Buffer.alloc(rig.config.maxBytes, 0x61));
+        write(rig.root(), "small.txt", "s");
+        rig.cp.ackDelayMs = 40;
+        const idBig = rig.mint("file", "big.txt"); const idSmall = rig.mint("file", "small.txt");
+        const first = rig.request({ ref: idBig, waitMs: 8000 });
+        await waitFor(() => rig.handler.inflight === 1);
+        const second = await rig.request({ ref: idSmall, waitMs: 8000 });
+        assert.deepEqual([second.status, second.errorCode, second.body.length], ["error", "rate_limited", 0]);
+        const f = await first;
+        assert.equal(f.status, "ok");
+        assert.equal(f.body.length, rig.config.maxBytes);
+        await waitFor(() => rig.handler.inflight === 0);
+        assert.equal((await rig.request({ ref: idSmall })).text, "s", "the slot came back");
+    });
+});
+
+test("limits: the memory reservation (LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES) is enforced too", async () => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "4096", LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES: "16384", LOCAL_AGENT_CONTENT_MAX_CONCURRENT: "8" } }, async (rig) => {
+        assert.equal(rig.config.maxInFlightBytes, 16384); // each request reserves 2 x 4096: two fit
+        write(rig.root(), "a.txt", "a".repeat(4096));
+        rig.cp.ackDelayMs = 100;
+        const ids = Array.from({ length: 3 }, () => rig.mint("file", "a.txt"));
+        const rs = await Promise.all(ids.map((ref) => rig.request({ ref, waitMs: 6000 })));
+        const codes = rs.map((r) => r.errorCode || r.status).sort();
+        assert.deepEqual(codes, ["ok", "ok", "rate_limited"].sort());
+        await waitFor(() => rig.handler.reservedBytes === 0);
+    });
+});
+
+// ------------------------------------------------------------------------------------------ nothing sensitive in wire, audit, logs
+
+test("nothing but codes in errors, audit and logs: no path, no ref, no content, over a mixed run", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "secret-dir-name/CONFIDENTIAL-FILE-NAME.txt", `CONFIDENTIAL-BODY ${GH}`);
+        write(rig.root(), ".env", "X=1");
+        const id = rig.mint("file", "secret-dir-name/CONFIDENTIAL-FILE-NAME.txt");
+        await rig.request({ ref: id });
+        await rig.request({ ref: "secret-dir-name/CONFIDENTIAL-FILE-NAME.txt" });
+        await rig.request({ ref: "../../CONFIDENTIAL-REF-MARKER" });
+        await rig.request({ kind: "report", ref: id });
+        fs.rmSync(path.join(rig.root(), "secret-dir-name"), { recursive: true });
+        await rig.request({ ref: id });
+        const dump = rig.everything() + JSON.stringify(rig.handler.stats);
+        for (const needle of ["CONFIDENTIAL-FILE-NAME", "secret-dir-name", "CONFIDENTIAL-REF-MARKER", path.basename(rig.root()), id, GH]) {
+            assert.equal(dump.includes(needle), false, needle);
+        }
+        // frames with a failure carry a status and a wire code only
+        for (const f of rig.cp.received.filter((x) => x.type === "content.response" && x.payload.status !== "ok")) {
+            assert.deepEqual(Object.keys(f.payload).sort().filter((k) => !["status", "errorCode", "encoding", "data", "byteLength"].includes(k)), []);
+            assert.equal(f.payload.data, "");
+        }
+        const rec = rig.handler.audit.tail(10);
+        assert.equal(rec.length, 5);
+        for (const r of rec) {
+            assert.deepEqual(Object.keys(r).sort(), ["actorRole", "actorSha", "bytes", "chunks", "dlpHits", "dlpMode", "dlpRules", "errorCode", "kind", "ms", "refSha", "requestId", "status", "ts", "workspaceId"]);
+            assert.match(r.refSha, /^[0-9a-f]{16}$/);
+        }
+    });
+});
+
+test("a request without requestId is refused with a rejected ack, not left hanging", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        const before = rig.handler.stats.received;
+        assert.deepEqual(rig.handler.handle({ params: { kind: "file", ref: "x" }, workspaceId: "ws-1" }), { reject: "schema_violation" });
+        assert.equal(rig.handler.stats.received, before + 1);
+    });
+});