devrites 3.2.28 → 4.0.0

package/engine/internal/lib/secretscan_test.go

@@ -0,0 +1,555 @@
+package lib
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"testing/iotest"
+
+	"github.com/devrites/devrites/internal/testutil"
+)
+
+func runSecretScanGit(t *testing.T, project string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", project}, args...)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+	}
+	return string(out)
+}
+
+func runSecretScanGitInput(t *testing.T, project string, input io.Reader, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", project}, args...)...)
+	cmd.Stdin = input
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+	}
+	return string(out)
+}
+
+func runSecretScanGitRedacted(t *testing.T, project string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", project}, args...)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatal("redacted Git fixture command failed")
+	}
+	return string(out)
+}
+
+type secretScanZeroReader struct{}
+
+func (secretScanZeroReader) Read(p []byte) (int, error) {
+	for i := range p {
+		p[i] = 0
+	}
+	return len(p), nil
+}
+
+type secretScanCountingReader struct {
+	remaining int64
+	consumed  int64
+	maxRead   int
+}
+
+func (r *secretScanCountingReader) Read(p []byte) (int, error) {
+	if r.remaining == 0 {
+		return 0, io.EOF
+	}
+	if len(p) > r.maxRead {
+		p = p[:r.maxRead]
+	}
+	if int64(len(p)) > r.remaining {
+		p = p[:int(r.remaining)]
+	}
+	n := len(p)
+	r.remaining -= int64(n)
+	r.consumed += int64(n)
+	return n, nil
+}
+
+type secretScanCappedWriter struct {
+	remaining int
+}
+
+func (w *secretScanCappedWriter) Write(p []byte) (int, error) {
+	if len(p) <= w.remaining {
+		w.remaining -= len(p)
+		return len(p), nil
+	}
+	n := w.remaining
+	w.remaining = 0
+	return n, nil
+}
+
+func TestBoundedSecretScanBufferStopsSourceConsumptionAtLimit(t *testing.T) {
+	const (
+		totalBytes = int64(1 << 20)
+		limitBytes = int64(4500)
+		readBytes  = 1024
+	)
+	source := &secretScanCountingReader{remaining: totalBytes, maxRead: readBytes}
+	output := &boundedSecretScanBuffer{limit: limitBytes}
+	copied, err := io.Copy(output, source)
+	if !errors.Is(err, errSecretScanLimit) {
+		t.Fatalf("copy error = %v, want scan limit; copied=%d consumed=%d", err, copied, source.consumed)
+	}
+	if copied != limitBytes {
+		t.Fatalf("copied = %d, want %d", copied, limitBytes)
+	}
+	if source.consumed != 5*readBytes {
+		t.Fatalf("source consumed = %d, want %d", source.consumed, 5*readBytes)
+	}
+	if output.Len() != int(limitBytes) {
+		t.Fatalf("buffered = %d, want %d", output.Len(), limitBytes)
+	}
+	t.Logf("source consumed=%d copied=%d buffered=%d total=%d", source.consumed, copied, output.Len(), totalBytes)
+}
+
+func TestSecretScanScansExactStagedBlobWithoutDisclosure(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	path := "staged.txt"
+	secret := "ghp_" + strings.Repeat("a", 32)
+	testutil.WriteFile(t, filepath.Join(project, path), secret+"\n")
+	runSecretScanGit(t, project, "add", "--", path)
+	stagedOID := strings.TrimSpace(runSecretScanGit(t, project, "rev-parse", ":"+path))
+	if stagedOID == "" {
+		t.Fatal("staged blob ID is empty")
+	}
+	testutil.WriteFile(t, filepath.Join(project, path), "safe worktree bytes\n")
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 3 {
+		t.Fatalf("want staged blob block rc=3 got %d", code)
+	}
+	combined := out.String() + err.String()
+	if strings.Contains(combined, secret) {
+		t.Fatal("secret material disclosed")
+	}
+}
+
+func TestSecretScanSkipsDeletedWorktreePaths(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	runSecretScanGit(t, project, "config", "user.email", "tests@example.invalid")
+	runSecretScanGit(t, project, "config", "user.name", "DevRites Tests")
+	path := "deleted.txt"
+	testutil.WriteFile(t, filepath.Join(project, path), "safe baseline\n")
+	runSecretScanGit(t, project, "add", "--", path)
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+	if err := os.Remove(filepath.Join(project, path)); err != nil {
+		t.Fatal(err)
+	}
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), nil, strings.NewReader(""), &out, &err); code != 0 {
+		t.Fatalf("deleted worktree path returned %d, stdout=%q stderr=%q", code, out.String(), err.String())
+	}
+}
+
+func TestSecretScanIgnoresReplacementOfHEADWhenEnumeratingStagedBlobs(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	runSecretScanGit(t, project, "config", "user.email", "tests@example.invalid")
+	runSecretScanGit(t, project, "config", "user.name", "DevRites Tests")
+	path := "payload.txt"
+	testutil.WriteFile(t, filepath.Join(project, path), "safe baseline\n")
+	runSecretScanGit(t, project, "add", "--", path)
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+
+	secret := "ghp_" + strings.Repeat("h", 32)
+	testutil.WriteFile(t, filepath.Join(project, path), secret+"\n")
+	runSecretScanGit(t, project, "add", "--", path)
+	stagedTree := strings.TrimSpace(runSecretScanGit(t, project, "write-tree"))
+	replacement := strings.TrimSpace(runSecretScanGitRedacted(t, project, "commit-tree", stagedTree, "-m", "replacement"))
+	head := strings.TrimSpace(runSecretScanGit(t, project, "rev-parse", "HEAD"))
+	runSecretScanGitRedacted(t, project, "replace", head, replacement)
+	if control := runSecretScanGit(t, project, "diff", "--cached", "--raw", "--"); control != "" {
+		t.Fatal("replacement ref did not suppress the unprotected control diff")
+	}
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 3 {
+		t.Fatalf("want replacement-resistant staged block rc=3 got %d", code)
+	}
+	if strings.Contains(out.String()+err.String(), secret) {
+		t.Fatal("secret material disclosed")
+	}
+}
+
+func TestSecretScanIgnoresReplacementOfStagedBlob(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	runSecretScanGit(t, project, "config", "user.email", "tests@example.invalid")
+	runSecretScanGit(t, project, "config", "user.name", "DevRites Tests")
+	testutil.WriteFile(t, filepath.Join(project, "baseline.txt"), "baseline\n")
+	runSecretScanGit(t, project, "add", "--", "baseline.txt")
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+
+	path := "payload.txt"
+	secret := "ghp_" + strings.Repeat("i", 32)
+	testutil.WriteFile(t, filepath.Join(project, path), secret+"\n")
+	runSecretScanGit(t, project, "add", "--", path)
+	stagedOID := strings.TrimSpace(runSecretScanGit(t, project, "rev-parse", ":"+path))
+	safePath := filepath.Join(project, "safe-object.txt")
+	testutil.WriteFile(t, safePath, "safe replacement bytes\n")
+	safeOID := strings.TrimSpace(runSecretScanGit(t, project, "hash-object", "-w", "--no-filters", "--", safePath))
+	if err := os.Remove(safePath); err != nil {
+		t.Fatal(err)
+	}
+	runSecretScanGitRedacted(t, project, "replace", stagedOID, safeOID)
+	if control := runSecretScanGitRedacted(t, project, "cat-file", "-p", stagedOID); control != "safe replacement bytes\n" {
+		t.Fatal("replacement ref did not substitute the unprotected control blob")
+	}
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 3 {
+		t.Fatalf("want replacement-resistant staged block rc=3 got %d", code)
+	}
+	if strings.Contains(out.String()+err.String(), secret) {
+		t.Fatal("secret material disclosed")
+	}
+}
+
+func TestSecretScanRedactsSecretShapedStagedPath(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	pathSecret := "ghp_" + strings.Repeat("j", 32)
+	contentSecret := "ghp_" + strings.Repeat("k", 32)
+	path := "report-" + pathSecret + ".txt"
+	if err := os.WriteFile(filepath.Join(project, path), []byte(contentSecret+"\n"), 0o644); err != nil {
+		t.Fatal("cannot create secret-shaped path fixture")
+	}
+	runSecretScanGitRedacted(t, project, "add", "--", path)
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 3 {
+		t.Fatalf("want secret-shaped path block rc=3 got %d", code)
+	}
+	combined := out.String() + err.String()
+	if !strings.Contains(out.String(), `source="<redacted-path>"`) {
+		t.Fatal("stdout lacks redacted source metadata")
+	}
+	if strings.Contains(combined, pathSecret) || strings.Contains(combined, contentSecret) {
+		t.Fatal("secret-shaped path or content material disclosed")
+	}
+}
+
+func TestSecretScanRejectsOversizedStdin(t *testing.T) {
+	stdin := io.LimitReader(secretScanZeroReader{}, (64<<20)+1)
+	var out, err bytes.Buffer
+	if code := SecretScan(t.TempDir(), []string{"--stdin"}, stdin, &out, &err); code != 2 {
+		t.Fatalf("want oversized stdin refusal rc=2 got %d", code)
+	}
+	if out.Len() != 0 {
+		t.Fatal("oversized stdin produced stdout")
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect stdin\n"; got != want {
+		t.Fatal("stderr lacks the redacted fail-closed stdin diagnostic")
+	}
+}
+
+func TestSecretScanRejectsOversizedStagedBlob(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	runSecretScanGit(t, project, "config", "user.email", "tests@example.invalid")
+	runSecretScanGit(t, project, "config", "user.name", "DevRites Tests")
+	runSecretScanGit(t, project, "commit", "--allow-empty", "-qm", "baseline")
+	oid := strings.TrimSpace(runSecretScanGitInput(t, project, io.LimitReader(secretScanZeroReader{}, (64<<20)+1), "hash-object", "-w", "--stdin"))
+	runSecretScanGit(t, project, "update-index", "--add", "--cacheinfo", "100644,"+oid+",large.bin")
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 2 {
+		t.Fatalf("want oversized staged blob refusal rc=2 got %d", code)
+	}
+	if out.Len() != 0 {
+		t.Fatal("oversized staged blob produced stdout")
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect staged blobs\n"; got != want {
+		t.Fatal("stderr lacks the redacted fail-closed staged blob diagnostic")
+	}
+}
+
+func TestSecretScanRejectsTooManyStagedEntries(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	runSecretScanGit(t, project, "config", "user.email", "tests@example.invalid")
+	runSecretScanGit(t, project, "config", "user.name", "DevRites Tests")
+	runSecretScanGit(t, project, "commit", "--allow-empty", "-qm", "baseline")
+	oid := strings.TrimSpace(runSecretScanGitInput(t, project, strings.NewReader("safe\n"), "hash-object", "-w", "--stdin"))
+	var entries strings.Builder
+	for i := 0; i < 4097; i++ {
+		entries.WriteString("100644 blob ")
+		entries.WriteString(oid)
+		entries.WriteByte('\t')
+		entries.WriteString("entry-")
+		entries.WriteString(strconv.Itoa(i))
+		entries.WriteByte('\n')
+	}
+	runSecretScanGitInput(t, project, strings.NewReader(entries.String()), "update-index", "--index-info")
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 2 {
+		t.Fatalf("want staged entry limit refusal rc=2 got %d", code)
+	}
+	if out.Len() != 0 {
+		t.Fatal("excessive staged entries produced stdout")
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect staged index\n"; got != want {
+		t.Fatal("stderr lacks the redacted fail-closed staged index diagnostic")
+	}
+}
+
+func TestSecretScanRejectsExcessiveFindings(t *testing.T) {
+	secret := "ghp_" + strings.Repeat("l", 32)
+	var body strings.Builder
+	for i := 0; i < 4097; i++ {
+		body.WriteString(secret)
+		body.WriteByte('\n')
+	}
+	var out, err bytes.Buffer
+	if code := SecretScan(t.TempDir(), []string{"--stdin"}, strings.NewReader(body.String()), &out, &err); code != 2 {
+		t.Fatalf("want finding limit refusal rc=2 got %d", code)
+	}
+	if out.Len() != 0 {
+		t.Fatal("excessive findings produced stdout")
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect stdin\n"; got != want {
+		t.Fatal("stderr lacks the redacted fail-closed stdin diagnostic")
+	}
+	if strings.Contains(err.String(), secret) {
+		t.Fatal("finding limit diagnostic disclosed secret material")
+	}
+}
+
+func TestSecretScanFailsClosedOnOutputWriterOverflow(t *testing.T) {
+	stdout := &secretScanCappedWriter{remaining: 1}
+	var err bytes.Buffer
+	if code := SecretScan(t.TempDir(), []string{"--stdin"}, strings.NewReader("safe"), stdout, &err); code != 2 {
+		t.Fatalf("want output writer overflow rc=2 got %d", code)
+	}
+	if got, want := err.String(), "secret-scan: cannot report result\n"; got != want {
+		t.Fatal("stderr lacks the redacted fail-closed output diagnostic")
+	}
+}
+
+func TestSecretScanBlocksHighSeverityTouchedFile(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	testutil.WriteFile(t, filepath.Join(root, "ACTIVE"), "leak\n")
+	testutil.WriteFile(t, filepath.Join(root, "work", "leak", "touched-files.md"), candidateTestManifest(candidateTestRow{state: "present", path: "secrets.txt", slice: "S-1", reason: "Credential check."}))
+	secret := "ghp_" + strings.Repeat("f", 32)
+	testutil.WriteFile(t, filepath.Join(project, "secrets.txt"), secret+"\n")
+	var out, err bytes.Buffer
+	if code := SecretScan(root, nil, strings.NewReader(""), &out, &err); code != 3 {
+		t.Fatalf("want block rc=3 got %d", code)
+	}
+	if strings.Contains(out.String()+err.String(), secret) {
+		t.Fatal("secret material disclosed")
+	}
+}
+
+func TestSecretScanSlugUsesCandidateWithoutGitFallback(t *testing.T) {
+	project, root := writeCandidateTestWorkspace(t, candidateTestManifest())
+	secret := "ghp_" + strings.Repeat("m", 32)
+	writeCandidateTestFile(t, project, "unmanifested.txt", secret+"\n")
+
+	var out, err bytes.Buffer
+	if code := SecretScan(root, []string{"feature"}, strings.NewReader(""), &out, &err); code != 0 {
+		t.Fatalf("empty candidate returned %d, stdout=%q stderr=%q", code, out.String(), err.String())
+	}
+	if got := out.String(); got != "secret-scan: PASS\n" {
+		t.Fatalf("stdout=%q", got)
+	}
+}
+
+func TestSecretScanSlugSkipsDeletedCandidateRows(t *testing.T) {
+	project, root := writeCandidateTestWorkspace(t, candidateTestManifest(candidateTestRow{state: "deleted", path: "removed.txt", slice: "S-1", reason: "Removed."}))
+	secret := "ghp_" + strings.Repeat("n", 32)
+	writeCandidateTestFile(t, project, "unmanifested.txt", secret+"\n")
+
+	var out, err bytes.Buffer
+	if code := SecretScan(root, []string{"feature"}, strings.NewReader(""), &out, &err); code != 0 {
+		t.Fatalf("deleted candidate returned %d, stdout=%q stderr=%q", code, out.String(), err.String())
+	}
+}
+
+func TestSecretScanSlugFailsClosedOnInvalidCandidate(t *testing.T) {
+	for _, test := range []struct {
+		name     string
+		manifest string
+	}{
+		{name: "missing"},
+		{name: "legacy", manifest: "# Touched files\n\n## Touched files\n- `source.go`\n"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			_, root := writeCandidateTestWorkspace(t, test.manifest)
+			var out, err bytes.Buffer
+			if code := SecretScan(root, []string{"feature"}, strings.NewReader(""), &out, &err); code != 2 {
+				t.Fatalf("code=%d stdout=%q stderr=%q", code, out.String(), err.String())
+			}
+			if out.Len() != 0 || !strings.Contains(err.String(), "candidate manifest") {
+				t.Fatalf("stdout=%q stderr=%q", out.String(), err.String())
+			}
+		})
+	}
+}
+
+func TestSecretScanFailsClosedWhenGitIsUnavailable(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	t.Chdir(project)
+	t.Setenv("PATH", t.TempDir())
+
+	var out, err bytes.Buffer
+	if code := SecretScan(root, nil, strings.NewReader(""), &out, &err); code != 2 {
+		t.Fatalf("want rc=2 got %d stdout=%s stderr=%s", code, out.String(), err.String())
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect changed paths\n"; got != want {
+		t.Fatalf("stderr = %q, want redacted fail-closed diagnostic %q", got, want)
+	}
+}
+
+func TestSecretScanScansPRBodyFromStdinWithoutDisclosure(t *testing.T) {
+	secret := "ghp_" + strings.Repeat("b", 32)
+	var out, err bytes.Buffer
+	if code := SecretScan(t.TempDir(), []string{"--stdin"}, strings.NewReader("review "+secret), &out, &err); code != 3 {
+		t.Fatalf("want stdin block rc=3 got %d", code)
+	}
+	if got := out.String(); !strings.Contains(got, `source="<stdin>" kind=github-token offset=7`) {
+		t.Fatal("stdout lacks safe stdin metadata")
+	}
+	if strings.Contains(out.String()+err.String(), secret) {
+		t.Fatal("secret material disclosed")
+	}
+}
+
+func TestSecretScanFailsClosedOnStdinReadErrorWithoutDisclosure(t *testing.T) {
+	secret := "ghp_" + strings.Repeat("c", 32)
+	var out, err bytes.Buffer
+	if code := SecretScan(t.TempDir(), []string{"--stdin"}, iotest.ErrReader(errors.New(secret)), &out, &err); code != 2 {
+		t.Fatalf("want stdin error rc=2 got %d", code)
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect stdin\n"; got != want {
+		t.Fatal("stderr lacks the redacted fail-closed stdin diagnostic")
+	}
+	if strings.Contains(out.String()+err.String(), secret) {
+		t.Fatal("stdin error disclosed secret material")
+	}
+}
+
+func TestSecretScanRejectsReviewTextInArgvWithoutDisclosure(t *testing.T) {
+	secret := "ghp_" + strings.Repeat("g", 32)
+	var out, err bytes.Buffer
+	if code := SecretScan(t.TempDir(), []string{"--text", secret}, strings.NewReader(""), &out, &err); code != 2 {
+		t.Fatalf("want argv refusal rc=2 got %d", code)
+	}
+	if got, want := err.String(), "secret-scan: review text must be supplied with --stdin\n"; got != want {
+		t.Fatal("stderr lacks the safe stdin remediation")
+	}
+	if strings.Contains(out.String()+err.String(), secret) {
+		t.Fatal("argv refusal disclosed secret material")
+	}
+}
+
+func TestSecretScanScansUnusualStagedEntriesWithoutReadingWorktree(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	runSecretScanGit(t, project, "config", "user.email", "tests@example.invalid")
+	runSecretScanGit(t, project, "config", "user.name", "DevRites Tests")
+	for _, path := range []string{"deleted.txt", "old-name.txt"} {
+		testutil.WriteFile(t, filepath.Join(project, path), "baseline\n")
+	}
+	runSecretScanGit(t, project, "add", "--", "deleted.txt", "old-name.txt")
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+
+	secret := "ghp_" + strings.Repeat("d", 32)
+	if err := os.Remove(filepath.Join(project, "deleted.txt")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(filepath.Join(project, "old-name.txt"), filepath.Join(project, "new-name.txt")); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"new-name.txt", "space name.txt"} {
+		testutil.WriteFile(t, filepath.Join(project, path), secret+"\n")
+	}
+	if err := os.WriteFile(filepath.Join(project, "binary.dat"), append([]byte{0, 1, 2}, []byte(secret)...), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runSecretScanGit(t, project, "add", "-A")
+	// Git for Windows otherwise rejects the fixture's index-only LF path.
+	runSecretScanGit(t, project, "config", "core.protectNTFS", "false")
+	secretOID := strings.TrimSpace(runSecretScanGitInput(t, project, strings.NewReader(secret), "hash-object", "-w", "--stdin"))
+	indexEntries := "100644 blob " + secretOID + "\tline\nbreak.txt\x00" +
+		"120000 blob " + secretOID + "\tlinked-secret\x00"
+	runSecretScanGitInput(t, project, strings.NewReader(indexEntries), "update-index", "-z", "--index-info")
+
+	for _, path := range []string{"new-name.txt", "space name.txt", "binary.dat"} {
+		testutil.WriteFile(t, filepath.Join(project, path), "safe worktree bytes\n")
+	}
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 3 {
+		t.Fatalf("want unusual staged entries to block rc=3 got %d", code)
+	}
+	for _, path := range []string{"new-name.txt", "space name.txt", "line\nbreak.txt", "binary.dat", "linked-secret"} {
+		if !strings.Contains(out.String(), "source="+strconv.Quote(path)) {
+			t.Errorf("stdout lacks finding for %q", path)
+		}
+	}
+	if strings.Contains(out.String(), "deleted.txt") {
+		t.Fatal("staged deletion was treated as readable content")
+	}
+	if strings.Contains(out.String()+err.String(), secret) {
+		t.Fatal("secret material disclosed")
+	}
+}
+
+func TestSecretScanFailsClosedOnNonBlobIndexEntry(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	runSecretScanGit(t, project, "config", "user.email", "tests@example.invalid")
+	runSecretScanGit(t, project, "config", "user.name", "DevRites Tests")
+	testutil.WriteFile(t, filepath.Join(project, "baseline.txt"), "baseline\n")
+	runSecretScanGit(t, project, "add", "--", "baseline.txt")
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+	commitOID := strings.TrimSpace(runSecretScanGit(t, project, "rev-parse", "HEAD"))
+	runSecretScanGit(t, project, "update-index", "--add", "--cacheinfo", "160000,"+commitOID+",nested-repository")
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 2 {
+		t.Fatalf("want non-blob source rc=2 got %d stdout=%q stderr=%q", code, out.String(), err.String())
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect staged index\n"; got != want {
+		t.Fatalf("stderr = %q, want redacted fail-closed diagnostic %q", got, want)
+	}
+}
+
+func TestSecretScanFailsClosedOnUnreadableStagedBlob(t *testing.T) {
+	project := t.TempDir()
+	runSecretScanGit(t, project, "init", "-q")
+	testutil.WriteFile(t, filepath.Join(project, "missing-object.txt"), "staged bytes\n")
+	runSecretScanGit(t, project, "add", "--", "missing-object.txt")
+	oid := strings.TrimSpace(runSecretScanGit(t, project, "rev-parse", ":missing-object.txt"))
+	if err := os.Remove(filepath.Join(project, ".git", "objects", oid[:2], oid[2:])); err != nil {
+		t.Fatal(err)
+	}
+
+	var out, err bytes.Buffer
+	if code := SecretScan(filepath.Join(project, ".devrites"), []string{"--staged"}, strings.NewReader(""), &out, &err); code != 2 {
+		t.Fatalf("want unreadable blob rc=2 got %d stdout=%q stderr=%q", code, out.String(), err.String())
+	}
+	if got, want := err.String(), "secret-scan: cannot inspect staged blobs\n"; got != want {
+		t.Fatalf("stderr = %q, want redacted fail-closed diagnostic %q", got, want)
+	}
+}

package/engine/internal/lib/util.go

@@ -8,12 +8,12 @@ import (
 	"io"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 	"time"
-)
 
-var errNotGitRepository = errors.New("not a git repository")
+	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/gitenv"
+)
 
 const (
 	gitCommandTimeout = 30 * time.Second
@@ -61,15 +61,6 @@ func runGitCommand(dir string, env []string, args ...string) ([]byte, error) {
 	return runGitCommandIO(dir, env, nil, nil, args...)
 }
 
-func runGitCommandInput(dir string, env []string, input []byte, args ...string) ([]byte, error) {
-	return runGitCommandIO(dir, env, input, nil, args...)
-}
-
-func runGitCommandToWriter(dir string, env []string, stdout io.Writer, args ...string) error {
-	_, err := runGitCommandIO(dir, env, nil, stdout, args...)
-	return err
-}
-
 func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, args ...string) ([]byte, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), gitCommandTimeout)
 	defer cancel()
@@ -81,9 +72,8 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 	}
 	if env == nil {
 		env = os.Environ()
-	} else {
-		env = append([]string{}, env...)
 	}
+	env = gitenv.Sanitize(env)
 	cmd.Env = append(
 		env,
 		"GIT_TERMINAL_PROMPT=0",
@@ -123,37 +113,6 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 	}
 }
 
-func gitErrorExitCode(err error) (int, bool) {
-	var commandErr *gitCommandError
-	if !errors.As(err, &commandErr) {
-		return 0, false
-	}
-	return commandErr.exitCode, commandErr.exitCode >= 0
-}
-
-// gitToplevel returns the absolute path of the Git working tree containing dir.
-// Repository absence is distinct from Git execution failure so integrity gates
-// can fail closed on a missing binary, corrupt repository, or poisoned runtime.
-func gitToplevel(dir string) (string, error) {
-	out, err := runGitCommand(dir, nil, "rev-parse", "--show-toplevel")
-	if err != nil {
-		var commandErr *gitCommandError
-		if errors.As(err, &commandErr) {
-			detail := strings.ToLower(commandErr.output)
-			if strings.Contains(detail, "not a git repository") ||
-				strings.Contains(detail, "not a git work tree") {
-				return "", errNotGitRepository
-			}
-		}
-		return "", err
-	}
-	root := strings.TrimSpace(string(out))
-	if root == "" {
-		return "", fmt.Errorf("git rev-parse returned an empty top-level path")
-	}
-	return filepath.Clean(root), nil
-}
-
 // gitDiffNames lists the paths that differ, relative to gitRoot. With one ref it
 // diffs the working tree against that ref; with two it diffs the two tree objects.
 func gitDiffNames(gitRoot string, refs ...string) ([]string, error) {
@@ -165,30 +124,30 @@ func gitDiffNames(gitRoot string, refs ...string) ([]string, error) {
 	return splitLinesNoTrailing(out), nil
 }
 
-// isAllDigits reports whether s is a non-empty run of ASCII digits.
-func isAllDigits(s string) bool {
-	if s == "" {
-		return false
+// argAt returns args[i] or "": the Go analogue of bash's ${N:-} positional reads.
+func argAt(args []string, i int) string {
+	if i < len(args) {
+		return args[i]
 	}
-	for _, r := range s {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return true
+	return ""
+}
+
+func featureDir(root, slug string) string {
+	return devritespaths.FeatureDir(root, slug)
 }
 
-// featureFile is the path to a leaf file inside a feature's directory:
-// <root>/features/<slug>/<name>.
-func featureFile(root, slug, name string) string {
-	return filepath.Join(featureDir(root, slug), name)
+func activeSlug(root string) string {
+	slug, err := devritespaths.ActiveSlug(root)
+	if err != nil {
+		return ""
+	}
+	return slug
 }
 
-// slugOrActive returns the slug named in args[0], falling back to the active
-// feature when none is given.
-func slugOrActive(root string, args []string) string {
-	if slug := argAt(args, 0); slug != "" {
-		return slug
+func splitLinesNoTrailing(data []byte) []string {
+	value := strings.TrimSuffix(string(data), "\n")
+	if value == "" {
+		return nil
 	}
-	return activeSlug(root)
+	return strings.Split(value, "\n")
 }