opencode-secrets-obfuscation 0.1.0 → 0.1.1

package/tests/unit/recording-endpoint.test.ts

@@ -1,188 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import { request } from "node:http"
-import { once } from "node:events"
-import { startRecordingEndpoint } from "../support/recording-endpoint.ts"
-
-test("recording fixture: actual loopback HTTP captures request bytes and returns scripted response", async () => {
-  const endpoint = await startRecordingEndpoint({ responses: [{ status: 200, body: "fixture-response" }] })
-  try {
-    const response = await fetch(`${endpoint.url}/v1/messages`, {
-      method: "POST",
-      headers: { "x-synthetic": "capture-me", authorization: "Bearer fixture" },
-      body: "synthetic-input",
-    })
-    assert.equal(response.status, 200)
-    assert.equal(await response.text(), "fixture-response")
-    const captures = endpoint.captures()
-    assert.equal(captures.length, 1)
-    assert.equal(captures[0]!.method, "POST")
-    assert.equal(captures[0]!.headers["x-synthetic"], "capture-me")
-    assert.equal(captures[0]!.headers.authorization, "Bearer fixture")
-    assert.equal(captures[0]!.body.equals(Buffer.from("synthetic-input")), true)
-    captures[0]!.body.fill(0)
-    assert.equal(captures[0]!.headers["x-synthetic"], "capture-me", "header capture is independent of body zeroing")
-    assert.equal(endpoint.captures()[0]!.body.equals(Buffer.from("synthetic-input")), true)
-  } finally { await endpoint.close() }
-})
-
-test("recording fixture: an oversized body is rejected without retaining partial bytes", async () => {
-  const endpoint = await startRecordingEndpoint({ responses: [{ status: 200, body: "ok" }], maxBodyBytes: 8 })
-  try {
-    const response = await fetch(endpoint.url, { method: "POST", body: "x".repeat(9) })
-    assert.equal(response.status, 413)
-    assert.equal(endpoint.captures().length, 0)
-    assert.equal(endpoint.counts().rejected, 1)
-  } finally { await endpoint.close() }
-})
-
-test("recording fixture: unscripted requests fail instead of silently succeeding", async () => {
-  const endpoint = await startRecordingEndpoint({ responses: [] })
-  try {
-    assert.equal((await fetch(endpoint.url)).status, 503)
-    assert.equal(endpoint.counts().attempted, 1)
-    assert.equal(endpoint.counts().rejected, 1)
-  } finally { await endpoint.close() }
-})
-
-test("recording fixture: request capacity is reserved before reading a body", async () => {
-  const endpoint = await startRecordingEndpoint({ responses: [{ status: 200, body: "ok" }], maxRequests: 1 })
-  try {
-    assert.equal((await fetch(endpoint.url, { method: "POST", body: "first" })).status, 200)
-    assert.equal((await fetch(endpoint.url, { method: "POST", body: "second" })).status, 503)
-    assert.equal(endpoint.counts().attempted, 2)
-    assert.equal(endpoint.captures().length, 1)
-  } finally { await endpoint.close() }
-})
-
-test("recording fixture: closing clears private captures and is idempotent", async () => {
-  const endpoint = await startRecordingEndpoint({ responses: [{ status: 200, body: "ok" }] })
-  await fetch(endpoint.url, { method: "POST", body: "synthetic-input" })
-  await endpoint.close()
-  await endpoint.close()
-  assert.equal(endpoint.captures().length, 0)
-  await assert.rejects(fetch(endpoint.url), () => true)
-})
-
-test("recording fixture: invalid budgets and response plans fail with fixed diagnostics", async () => {
-  for (const options of [
-    { responses: [], maxBodyBytes: 0 },
-    { responses: [], maxRequests: Infinity },
-    { responses: [], timeoutMs: -1 },
-    { responses: [{ status: 999, body: "unsafe-value-not-to-echo" }] },
-    { responses: [{ status: 200, body: "x".repeat(1_048_577) }] },
-  ]) {
-    await assert.rejects(startRecordingEndpoint(options), (error: unknown) =>
-      error instanceof Error && error.message === "FIXTURE_INVALID_OPTIONS")
-  }
-})
-
-test("recording fixture: incomplete request bodies terminate at a deadline without capture", async () => {
-  const endpoint = await startRecordingEndpoint({ responses: [{ status: 200, body: "ok" }], timeoutMs: 150 })
-  const child = request(endpoint.url, { method: "POST", headers: { "content-length": "100" } })
-  const outcome = new Promise<number>((resolve) => {
-    child.on("response", (response) => { response.resume(); resolve(response.statusCode ?? 0) })
-    child.on("error", () => resolve(0))
-  })
-  try {
-    child.write("partial")
-    const status = await outcome
-    assert.ok(status === 0 || status === 408)
-    assert.equal(endpoint.captures().length, 0)
-  } finally { child.destroy(); await endpoint.close() }
-})
-
-test("recording fixture: closing an active socket discards pending data", async () => {
-  const endpoint = await startRecordingEndpoint({ responses: [{ status: 200, body: "ok" }] })
-  const child = request(endpoint.url, { method: "POST", headers: { "content-length": "100" } })
-  child.on("error", () => {})
-  try {
-    const connected = once(child, "socket")
-    child.write("partial")
-    await connected
-    const closed = new Promise<void>((resolve) => child.once("close", resolve))
-    await endpoint.close()
-    await closed
-    assert.equal(endpoint.captures().length, 0)
-    assert.equal(endpoint.counts().openConnections, 0)
-    assert.equal(endpoint.counts().pendingRequests, 0)
-  } finally { child.destroy(); await endpoint.close() }
-})
-
-test("recording fixture: a resolver selects scripted responses from request bodies", async () => {
-  const endpoint = await startRecordingEndpoint({
-    responses: [
-      { status: 200, body: "title" },
-      { status: 200, body: "toolcall" },
-      { status: 200, body: "final" },
-    ],
-    resolve: ({ body }: { body: Buffer }) => {
-      const text = body.toString("utf8")
-      if (text.includes("tool-result")) return 2
-      if (text.includes("title-generator")) return 0
-      return 1
-    },
-  })
-  try {
-    const post = async (text: string) => {
-      const response = await fetch(endpoint.url, { method: "POST", body: text })
-      return { status: response.status, body: await response.text() }
-    }
-    assert.deepEqual(await post("title-generator prompt"), { status: 200, body: "title" })
-    assert.deepEqual(await post("main prompt"), { status: 200, body: "toolcall" })
-    assert.deepEqual(await post("main prompt with tool-result"), { status: 200, body: "final" })
-    assert.equal(endpoint.captures().length, 3)
-    assert.equal(endpoint.counts().rejected, 0)
-  } finally { await endpoint.close() }
-})
-
-test("recording fixture: resolver failures, wrong types and out-of-range indices fail closed", async () => {
-  for (const resolve of [
-    () => 99,
-    () => -1,
-    () => "0",
-    () => Number.NaN,
-    () => { throw new Error("private-resolver-value") },
-  ]) {
-    const endpoint = await startRecordingEndpoint({ responses: [{ status: 200, body: "ok" }], resolve: resolve as never })
-    try {
-      const response = await fetch(endpoint.url, { method: "POST", body: "x" })
-      assert.equal(response.status, 503)
-      assert.equal(endpoint.counts().rejected, 1)
-    } finally { await endpoint.close() }
-  }
-  await assert.rejects(startRecordingEndpoint({ responses: [], resolve: 5 as never }), (error: unknown) =>
-    error instanceof Error && error.message === "FIXTURE_INVALID_OPTIONS")
-  let invoked = false
-  await assert.rejects(startRecordingEndpoint({
-    responses: [],
-    get resolve() { invoked = true; throw new Error("private-value") },
-  }), (error: unknown) => error instanceof Error && error.message === "FIXTURE_INVALID_OPTIONS")
-  assert.equal(invoked, false)
-})
-
-test("recording fixture: malformed runtime options fail without leaking input or invoking accessors", async () => {
-  let invoked = false
-  for (const options of [
-    null, { responses: null }, { responses: [null] }, { responses: [{ status: 200, body: {} }] },
-    { get responses() { invoked = true; throw new Error("private-value") } },
-  ]) {
-    await assert.rejects(startRecordingEndpoint(options), (error: unknown) =>
-      error instanceof Error && error.message === "FIXTURE_INVALID_OPTIONS")
-  }
-  assert.equal(invoked, false)
-})
-
-test("recording fixture: resolvers receive captured headers for selection", async () => {
-  const endpoint = await startRecordingEndpoint({
-    responses: [{ status: 200, body: "scripted" }, { status: 200, body: "authorized" }],
-    resolve: ({ headers }: { headers: Record<string, string> }) => headers.authorization === "Bearer fixture" ? 1 : 0,
-  })
-  try {
-    const plain = await fetch(endpoint.url, { method: "POST", body: "x" })
-    assert.equal(await plain.text(), "scripted")
-    const authorized = await fetch(endpoint.url, { method: "POST", headers: { authorization: "Bearer fixture" }, body: "y" })
-    assert.equal(await authorized.text(), "authorized")
-    assert.equal(endpoint.counts().rejected, 0)
-  } finally { await endpoint.close() }
-})

package/tests/unit/sanitize.test.ts

@@ -1,159 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import {
-  admitPatterns,
-  canonicalTextSink,
-  collectIntervals,
-  projectPlain,
-  sanitizeText,
-  scanForSecrets,
-  verifyCeilingBytes,
-  type Pattern,
-  representationsFor,
-} from "../../src/sanitize/index.ts"
-
-test("interval collection merges transitive overlaps independently of replacement", () => {
-  const intervals = collectIntervals("abcdef", ["abc", "bcdef"])
-  assert.deepEqual(intervals, [{ start: 0, end: 6, patterns: ["abc", "bcdef"] }])
-})
-
-test("sanitization replaces an overlap once and is idempotent", () => {
-  const patterns: Pattern[] = [
-    { text: "abc", replacement: "secret-11111111-1111-4111-8111-111111111111", entry: "a" },
-    { text: "bcdef", replacement: "secret-22222222-2222-4222-8222-222222222222", entry: "b" },
-  ]
-  assert.equal(sanitizeText("abcdef", patterns), "[REDACTED]")
-  assert.equal(sanitizeText("safe [REDACTED]", patterns), "safe [REDACTED]")
-})
-
-test("admission rejects UUID-language and reserved inventory conflicts as a whole", () => {
-  assert.equal(admitPatterns([{ text: "e" }, { text: "safe-value" }]).ok, false)
-  assert.equal(admitPatterns([{ text: "true" }]).ok, false)
-  assert.equal(admitPatterns([{ text: "!" }]).ok, true)
-})
-
-test("canonical sink joins parts before matching and emits one text part", () => {
-  const result = canonicalTextSink(["alpha", "beta"], [{ text: "alpha\nbeta", replacement: "!" }])
-  assert.deepEqual(result, { content: [{ type: "text", text: "!" }] })
-})
-
-test("plain projection handles scalars and keys with bounds, without invoking user serialization", () => {
-  const result = projectPlain({ token: "alpha", count: 123456, enabled: true }, [{ text: "alpha", replacement: "!" }])
-  assert.equal(result, '{"count":123456,"enabled":true,"token":"!"}')
-  assert.equal(projectPlain({ alpha: "value" }, [{ text: "alpha", replacement: "!" }]), null)
-  assert.equal(projectPlain({ deep: { x: 1 } }, [], { maxDepth: 0 }), null)
-})
-
-test("construction budgets reject without returning a partial output", () => {
-  assert.equal(sanitizeText("abcdef", [{ text: "abc", replacement: "!" }], { maxOutputBytes: 1 }), null)
-  assert.equal(projectPlain({ x: "long" }, [], { maxOutputBytes: 3 }), null)
-})
-
-test("caller metadata cannot add representations outside the derived inventory", () => {
-  const pattern: Pattern = { text: "token", representations: ["attacker-spelling"] }
-  assert.equal(sanitizeText("attacker-spelling", [pattern]), "attacker-spelling")
-  assert.equal(sanitizeText("token", [pattern]), "[REDACTED]")
-})
-
-test("dotenv inventory matches quoted, escaped, and multiline parser forms", () => {
-  const value = 'a\\b"c\n\r\tline'
-  const result = representationsFor(value)
-  assert.ok(result)
-  if (!result) throw new Error("expected representations")
-  const inventory = result.dotenv
-  assert.deepEqual(inventory, [
-    `"a\\\\b\\"c\\n\\r\\tline"`,
-    `'a\\b"c\n\r\tline'`,
-  ])
-})
-
-test("active object identity is rejected instead of recursing forever", () => {
-  const cyclic: { self?: unknown } = {}
-  cyclic.self = cyclic
-  assert.equal(projectPlain(cyclic, []), null)
-})
-
-test("default bounds reject excessive matches and output without partial results", () => {
-  assert.equal(sanitizeText("x".repeat(200_000), [{ text: "x" }]), null)
-  assert.equal(sanitizeText("safe".repeat(600_000), []), null)
-})
-
-test("sanitizer boundaries fail closed for throwing proxies and accessors", () => {
-  const throwingObject = new Proxy({}, { getPrototypeOf: () => { throw new Error("x") } })
-  const throwingKeys = new Proxy({}, { ownKeys: () => { throw new Error("x") } })
-  const throwingPattern = Object.defineProperty({}, "text", { get: () => { throw new Error("x") } })
-  const throwingBudget = Object.defineProperty({}, "maxNodes", { get: () => { throw new Error("x") } })
-  assert.deepEqual(admitPatterns([throwingPattern as Pattern]), { ok: false, code: "SANITIZATION_UNAVAILABLE" })
-  assert.equal(sanitizeText("x", [throwingPattern as Pattern]), null)
-  assert.equal(projectPlain(throwingObject, []), null)
-  assert.equal(projectPlain(throwingKeys, []), null)
-  assert.equal(sanitizeText("x", [], throwingBudget), null)
-})
-
-test("sanitizer rejects oversized pattern inventories before expansion", () => {
-  assert.deepEqual(admitPatterns(Array.from({ length: 10_000 }, () => ({ text: "safe" }))), {
-    ok: false,
-    code: "SANITIZATION_UNAVAILABLE",
-  })
-  assert.equal(sanitizeText("safe", [{ text: "x".repeat(100_000) }]), null)
-  assert.equal(projectPlain({ value: "safe" }, [{ text: "x".repeat(100_000) }]), null)
-})
-
-test("sanitizer applies aggregate limits to every transform and releases reservations", () => {
-  const many = Array.from({ length: 4_097 }, (_, index) => ({ text: `pattern-${index}` }))
-  assert.deepEqual(collectIntervals("safe", many), [])
-  assert.equal(sanitizeText("safe", many), null)
-  assert.equal(canonicalTextSink(["safe"], many), null)
-  assert.equal(projectPlain({ value: "safe" }, many), null)
-  assert.equal(admitPatterns(many).ok, false)
-  assert.equal(sanitizeText("safe", [{ text: "safe", replacement: "!" }]), "!")
-})
-
-test("sanitizer rejects explicit budgets above every hard ceiling", () => {
-  assert.deepEqual(collectIntervals("x", ["x"], { maxMatches: 50_001 }), [])
-  assert.equal(projectPlain({ value: "safe" }, [], { maxNodes: 50_001 }), null)
-  assert.equal(projectPlain({ value: "safe" }, [], { maxDepth: 33 }), null)
-  assert.equal(sanitizeText("safe", [], { maxOutputBytes: 2 * 1024 * 1024 + 1 }), null)
-})
-
-test("repeated matches are denied before materialization and reservations are released", () => {
-  assert.deepEqual(collectIntervals("x".repeat(50_001), ["x"], { maxMatches: Number.MAX_SAFE_INTEGER }), [])
-  assert.deepEqual(collectIntervals("x", ["x"]), [{ start: 0, end: 1, patterns: ["x"] }])
-})
-
-test("canonical sink contains throwing array proxies and releases reservations", () => {
-  const throwingParts = new Proxy(["safe"], { get: () => { throw new Error("foreign") } })
-  assert.equal(canonicalTextSink(throwingParts, []), null)
-  assert.deepEqual(canonicalTextSink(["safe"], []), { content: [{ type: "text", text: "safe" }] })
-})
-
-test("plain projection bounds key enumeration before sorting under low node budgets", () => {
-  const large = Object.fromEntries(Array.from({ length: 100_000 }, (_, index) => [`key-${index}`, "safe"]))
-  assert.equal(projectPlain(large, [], { maxNodes: 1 }), null)
-})
-
-test("containment scan detects every representation class and verifies clean input", () => {
-  const value = "Zebra_9x_canary"
-  const patterns: Pattern[] = [{ text: value }]
-  assert.equal(admitPatterns(patterns).ok, true)
-  const derived = representationsFor(value)
-  assert.ok(derived !== null)
-  for (const spelling of [value, derived.dotenv[0] as string, derived.json, derived.percent[1] as string, derived.base64[0] as string]) {
-    assert.equal(scanForSecrets(`prefix ${spelling} suffix`, patterns), "match")
-  }
-  assert.equal(scanForSecrets("verified clean payload", patterns), "clean")
-})
-
-test("containment scan fails closed as unverifiable instead of guessing", () => {
-  const patterns: Pattern[] = [{ text: "Zebra_9x_canary" }]
-  assert.equal(scanForSecrets("a".repeat(9 * 1024 * 1024), patterns), "unverifiable")
-  assert.equal(scanForSecrets("safe", patterns, { maxMatches: -1 }), "unverifiable")
-  assert.equal(scanForSecrets("safe", ["not-a-pattern" as unknown as Pattern]), "unverifiable")
-})
-
-test("verify ceiling is the operation ceiling minus admitted pattern bytes", () => {
-  assert.equal(verifyCeilingBytes([]), 8 * 1024 * 1024)
-  assert.equal(verifyCeilingBytes([{ text: "abcd" }]), 8 * 1024 * 1024 - 4)
-  assert.equal(verifyCeilingBytes([null as unknown as Pattern]), 0)
-  assert.equal(verifyCeilingBytes([{ text: "a".repeat(100_000) }, null as unknown as Pattern]), 0)
-})

package/tests/unit/smoke-cases.test.ts

@@ -1,20 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import { parseOptions } from "../../src/config/options.ts"
-import { buildPluginOptions, smokePrompt } from "../support/smoke-cases.ts"
-
-test("smoke options describe only transparent source substitution", () => {
-  const parsed = parseOptions(buildPluginOptions())
-  assert.equal(parsed.version, 1)
-  assert.deepEqual(parsed.sources.map((source) => source.id), ["smoke-env"])
-  assert.deepEqual(parsed.sources[0]?.keys, ["SMOKE_ROUNDTRIP_TOKEN"])
-})
-
-test("smoke prompt carries only a base64 canary representation", () => {
-  const canary = "smk_0123456789abcdef"
-  const prompt = smokePrompt(canary)
-  assert.ok(!prompt.includes(canary))
-  assert.equal(prompt.split(Buffer.from(canary).toString("base64")).length, 2)
-  assert.ok(!prompt.includes("credentials_read"))
-  assert.ok(!prompt.includes("credential_http"))
-})

package/tsconfig.json

@@ -1,20 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2023",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "noEmit": true,
-    "allowImportingTsExtensions": true,
-    "verbatimModuleSyntax": true,
-    "erasableSyntaxOnly": true,
-    "isolatedModules": true,
-    "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": true,
-    "forceConsistentCasingInFileNames": true,
-    "skipLibCheck": true,
-    "types": ["node"]
-  },
-  "include": ["src/**/*.ts", "tests/**/*.ts"],
-  "exclude": ["node_modules", "dist", ".artifacts"]
-}