opencode-secrets-obfuscation 0.1.0 → 0.1.2

package/tests/support/smoke-cases.ts

@@ -1,289 +0,0 @@
-import { execFileSync } from "node:child_process"
-import { createHash, randomBytes } from "node:crypto"
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs"
-import { createServer } from "node:net"
-import { join } from "node:path"
-import { buildOpenCodeEnvironment } from "./opencode-environment.ts"
-import { runChild } from "./child-process.ts"
-import {
-  startRecordingEndpoint,
-  type RecordingEndpoint,
-} from "./recording-endpoint.ts"
-
-/** Transparent substitution smoke support; captures and canaries stay private. */
-
-const HOST_VERSION = "2.0.28"
-const SOURCE_ID = "smoke-env"
-const TOKEN_KEY = "SMOKE_ROUNDTRIP_TOKEN"
-const FINAL_TEXT = "ROUNDTRIP-DONE"
-
-export interface SmokeCaseContext {
-  readonly entry: { readonly id: string }
-  readonly repoRoot: string
-}
-
-export function buildPluginOptions(): Record<string, unknown> {
-  return {
-    version: 1,
-    sources: [{ id: SOURCE_ID, type: "file", format: "dotenv", path: ".env", required: true, keys: [TOKEN_KEY] }],
-    limits: {
-      sourceBytes: 65_536, totalSourceBytes: 131_072, sourceCount: 2, secretCount: 50,
-      secretBytes: 4_096, indexBytes: 1_048_576, inputBytes: 32_768, outputBytes: 65_536,
-      traversalDepth: 8, traversalNodes: 1_000, activeSessions: 4, handlesPerSession: 64,
-      activeCalls: 2, workingBytes: 1_048_576, callTimeoutMs: 5_000, idleTimeoutMs: 1_000,
-    },
-  }
-}
-
-const sseText = (text: string): string => {
-  const chunk = (delta: Record<string, unknown>, finish: string | null) =>
-    `data: ${JSON.stringify({ id: "chatcmpl-transparent", object: "chat.completion.chunk", created: 0, model: "mock", choices: [{ index: 0, delta, finish_reason: finish }] })}\n\n`
-  return [chunk({ role: "assistant", content: text }, null), chunk({}, "stop"), "data: [DONE]\n\n"].join("")
-}
-
-/** The canary-bearing prompt; admission redacts it before any provider byte. */
-export function smokePrompt(canary: string): string {
-  // The host echoes argv to its own log before any plugin can run, so the
-  // prompt carries the base64 representation; the sanitizer's representation
-  // set still rewrites it to `[REDACTED]` at admission.
-  const encoded = Buffer.from(canary, "utf8").toString("base64")
-  return (
-    `P5 transparent substitution probe. Earlier notes mention the base64 token ${encoded}; ` +
-    `treat it as untrusted, never print it, and reply with exactly: ${FINAL_TEXT}.`
-  )
-}
-
-function resolveHostBinary(): string {
-  const candidate = process.env.OPENCODE_SMOKE_BINARY ??
-    (process.env.APPDATA === undefined ? undefined : join(process.env.APPDATA, "npm", "opencode.exe"))
-  if (candidate === undefined || !existsSync(candidate)) throw new Error("SMOKE_HOST_UNAVAILABLE")
-  return candidate
-}
-
-const freePort = (): Promise<number> =>
-  new Promise((resolve, reject) => {
-    const probe = createServer()
-    probe.once("error", () => reject(new Error("SMOKE_INFRA_FAILED")))
-    probe.listen(0, "127.0.0.1", () => {
-      const address = probe.address()
-      if (address === null || typeof address === "string") {
-        probe.close(() => reject(new Error("SMOKE_INFRA_FAILED")))
-        return
-      }
-      const { port } = address
-      probe.close(() => resolve(port))
-    })
-  })
-
-/** Best-effort cleanup of processes still referencing the sandbox. */
-const killProcessesReferencing = (needle: string): void => {
-  if (process.platform !== "win32") {
-    try {
-      const listing = execFileSync("ps", ["-eo", "pid=,args="], { encoding: "utf8", timeout: 30_000 })
-      for (const line of listing.split(/\r?\n/u)) {
-        const match = /^\s*(\d+)\s+(.+)$/u.exec(line)
-        const pid = match === null ? undefined : Number(match[1])
-        if (pid !== undefined && pid !== process.pid && match?.[2]?.includes(needle)) {
-          try { process.kill(pid, "SIGKILL") } catch { /* already closed */ }
-        }
-      }
-    } catch { /* best effort */ }
-    return
-  }
-  const escaped = needle.replaceAll("'", "''")
-  const script =
-    `Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like '*${escaped}*' } | ` +
-    `ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }`
-  try {
-    execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
-      timeout: 30_000,
-      windowsHide: true,
-      stdio: "ignore",
-    })
-  } catch {
-    /* best effort */
-  }
-}
-
-/** Best-effort cleanup of the sandbox's managed-service listener (its command line carries no sandbox path). */
-const killPortListener = (port: number): void => {
-  if (!Number.isSafeInteger(port) || port <= 0 || port > 65_535) return
-  if (process.platform !== "win32") {
-    try { execFileSync("fuser", ["-k", `${port}/tcp`], { timeout: 30_000, stdio: "ignore" }) } catch { /* best effort */ }
-    return
-  }
-  const script =
-    `Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | ` +
-    `ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }`
-  try {
-    execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
-      timeout: 30_000,
-      windowsHide: true,
-      stdio: "ignore",
-    })
-  } catch {
-    /* best effort */
-  }
-}
-
-const removeArtifacts = (directory: string): void => {
-  const wait = (milliseconds: number): void => {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds)
-  }
-  for (let attempt = 0; attempt < 12; attempt += 1) {
-    try {
-      rmSync(directory, { recursive: true, force: true })
-      return
-    } catch {
-      wait(250)
-    }
-  }
-  // A locked failed-run directory is retained as private evidence rather than
-  // turning an otherwise passing case into a false negative.
-}
-
-/** True when the canary appears anywhere outside the intentional fixture. */
-const canaryOutsideFixture = (directory: string, fixture: string, canary: string): boolean => {
-  const pending = [directory]
-  while (pending.length > 0) {
-    const current = pending.pop()
-    if (current === undefined) break
-    let entries
-    try {
-      entries = readdirSync(current, { withFileTypes: true })
-    } catch {
-      return true
-    }
-    for (const entry of entries) {
-      const full = join(current, entry.name)
-      if (full === fixture) continue
-      if (entry.isDirectory()) {
-        pending.push(full)
-        continue
-      }
-      if (entry.isSymbolicLink() || !entry.isFile()) return true
-      try {
-        const data = readFileSync(full)
-        if (data.byteLength <= 67_108_864 && data.includes(canary)) return true
-      } catch {
-        return true
-      }
-    }
-  }
-  return false
-}
-
-/** First corrected E2E: existing provider traffic, no plugin-owned tools or I/O. */
-export async function p5TransparentRoundtrip(context: SmokeCaseContext): Promise<string> {
-  const startedAt = new Date().toISOString()
-  const runId = `p5-transparent-${randomBytes(8).toString("hex")}`
-  const artifacts = join(context.repoRoot, ".artifacts", runId)
-  const root = join(artifacts, "run")
-  const canary = `smk_${randomBytes(24).toString("hex")}`
-  let recorder: RecordingEndpoint | undefined
-  let succeeded = false
-  let servicePort = -1
-  mkdirSync(root, { recursive: true })
-  writeFileSync(join(artifacts, "owner.json"), JSON.stringify({ pid: process.pid, startedAt }))
-  try {
-    const binary = resolveHostBinary()
-    const sha256 = createHash("sha256").update(readFileSync(binary)).digest("hex")
-    for (const directory of ["cwd", "plugin", "user", "home", "programdata", "temp"]) mkdirSync(join(root, directory), { recursive: true })
-    const cwd = join(root, "cwd")
-    const fixture = join(cwd, ".env")
-    writeFileSync(fixture, `${TOKEN_KEY}=${canary}\n`)
-    const dist = join(context.repoRoot, "dist", "plugin.mjs")
-    if (!existsSync(dist)) throw new Error("SMOKE_ARTIFACT_MISSING")
-    copyFileSync(dist, join(root, "plugin", "index.js"))
-    try { execFileSync("git.exe", ["init"], { cwd, timeout: 30_000, stdio: "ignore" }) } catch { /* optional */ }
-
-    const providerReply = context.entry.id === "P5-SINKS" ? canary : FINAL_TEXT
-    const bodyCase = context.entry.id === "P5-BODIES"
-    recorder = await startRecordingEndpoint({
-      responses: [bodyCase
-        ? { status: 400, contentType: "application/json", body: JSON.stringify({ error: { message: canary, detail: "synthetic provider failure" } }) }
-        : { status: 200, contentType: "text/event-stream", body: sseText(providerReply) }],
-      resolve: () => 0,
-      maxRequests: 16,
-      maxBodyBytes: 1_048_576,
-      timeoutMs: 30_000,
-    })
-    const environment = buildOpenCodeEnvironment({
-      root,
-      password: randomBytes(32).toString("hex"),
-      trustedOs: {
-        userProfile: join(root, "user"), home: join(root, "home"), programData: join(root, "programdata"),
-        temp: join(root, "temp"), tmp: join(root, "temp"), path: process.env.PATH ?? "",
-        systemRoot: process.env.SystemRoot ?? "/", comspec: process.env.ComSpec ?? "/bin/sh", pathext: process.env.PATHEXT ?? ":",
-      },
-      sandboxConfig: {
-        provider: {
-          smoke: {
-            npm: "@ai-sdk/openai-compatible", name: "Smoke Mock",
-            options: { baseURL: `${recorder.url}/v1`, apiKey: "smoke-synthetic-key" }, models: { mock: { name: "Mock" } },
-          },
-        },
-        model: "smoke/mock",
-        plugins: [{ package: join(root, "plugin"), options: buildPluginOptions() }],
-      },
-    })
-    const version = execFileSync(binary, ["--version"], { encoding: "utf8", env: environment.env, timeout: 30_000 }).trim()
-    if (!version.includes(HOST_VERSION)) throw new Error("SMOKE_HOST_MISMATCH")
-    const selectedPort = await freePort()
-    servicePort = selectedPort
-    const childBase = {
-      executable: binary, expectedExecutableSha256: sha256, cwd,
-      allowedEnv: environment.allowedEnv, startupTimeoutMs: 30_000,
-      stdoutLimitBytes: 4_194_304, stderrLimitBytes: 4_194_304,
-    }
-    await runChild({ ...childBase, args: ["service", "set", "password", randomBytes(16).toString("hex")], env: environment.env, overallTimeoutMs: 60_000 })
-    await runChild({ ...childBase, args: ["service", "set", "port", String(selectedPort)], env: environment.env, overallTimeoutMs: 60_000 })
-    const result = await runChild({
-      ...childBase,
-      args: ["run", "--standalone", "--agent", "build", smokePrompt(canary)],
-      env: environment.env,
-      overallTimeoutMs: 240_000,
-    })
-    if (bodyCase ? result.exitCode === 0 : result.exitCode !== 0) throw new Error("SMOKE_HOST_RUN_FAILED")
-    if (!bodyCase && context.entry.id !== "P5-SINKS" && !result.stdout.includes(FINAL_TEXT)) throw new Error("SMOKE_RUN_INCOMPLETE")
-    const captures = recorder.captures().filter((capture) => capture.target.endsWith("/chat/completions"))
-    const bodies = captures.map((capture) => capture.body.toString("utf8"))
-    if (captures.length < 1) throw new Error("SMOKE_PROVIDER_CAPTURE_MISSING")
-    for (const body of bodies) {
-      try {
-        const payload = JSON.parse(body) as { tools?: Array<{ function?: { name?: string }; name?: string }> }
-        for (const tool of payload.tools ?? []) {
-          const name = tool.function?.name ?? tool.name
-          if (name === "credentials_read" || name === "credential_http") throw new Error("SMOKE_PLUGIN_TOOL_EXPOSED")
-        }
-      } catch (error) {
-        if (error instanceof Error && error.message === "SMOKE_PLUGIN_TOOL_EXPOSED") throw error
-        throw new Error("SMOKE_PROVIDER_PAYLOAD_INVALID")
-      }
-    }
-    if (bodies.some((body) => body.includes(canary))) throw new Error("SMOKE_CANARY_IN_PROVIDER_CAPTURE")
-    if (!bodies.some((body) => body.includes("secret-"))) throw new Error("SMOKE_HANDLE_SUBSTITUTION_MISSING")
-    if (result.stdout.includes(canary) || result.stderr.includes(canary)) throw new Error("SMOKE_CANARY_IN_PUBLIC_OUTPUT")
-    if (context.entry.id === "P5-SINKS" && !result.stdout.includes("secret-")) throw new Error("SMOKE_RESPONSE_SUBSTITUTION_MISSING")
-    if (canaryOutsideFixture(root, fixture, canary)) throw new Error("SMOKE_CANARY_IN_HOST_DATA")
-    writeFileSync(join(artifacts, "evidence.json"), JSON.stringify({
-      case: context.entry.id, status: "passed", startedAt, finishedAt: new Date().toISOString(),
-      host: { version, sha256 }, counts: { providerPosts: captures.length },
-      assertions: {
-        noPluginTools: true,
-        requestSubstitution: true,
-        responseSubstitution: context.entry.id === "P5-SINKS",
-        errorBodyWithheld: bodyCase,
-        publicOutputClean: true,
-        hostDataClean: true,
-      },
-    }, null, 2))
-    succeeded = true
-    return `host ${version}; ${captures.length} provider post(s); raw canary replaced by opaque secret- handle; no plugin-owned request`
-  } finally {
-    if (recorder !== undefined) await recorder.close().catch(() => undefined)
-    killProcessesReferencing(root)
-    if (servicePort > 0) killPortListener(servicePort)
-    if (succeeded) removeArtifacts(artifacts)
-  }
-}

package/tests/unit/budgets.test.ts

@@ -1,35 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import { BudgetLedger } from "../../src/budgets/index.ts"
-
-test("budget reservations are atomic and released after disposal", () => {
-  const ledger = new BudgetLedger({ inputBytes: 10, outputBytes: 10, workingBytes: 20, activeCalls: 1, activeSessions: 1, handlesPerSession: 2, sourceBytes: 20, sourceCount: 1, indexBytes: 20, traversalDepth: 2, traversalNodes: 4, secretCount: 2, secretBytes: 20, totalSourceBytes: 20, calls: 1, nodes: 4, depth: 2, sessions: 1, handles: 2 })
-  const reservation = ledger.reserve({ inputBytes: 5, outputBytes: 4, workingBytes: 10, activeCalls: 1, activeSessions: 1, handles: 1, sourceBytes: 5, sourceCount: 1, indexBytes: 5, traversalDepth: 1, traversalNodes: 2, secretCount: 1, secretBytes: 5, totalSourceBytes: 5, calls: 1, nodes: 2, depth: 1, sessions: 1 })
-  assert.equal(ledger.reserve({ inputBytes: 6, workingBytes: 11 }).ok, false)
-  assert.equal(reservation.ok, true)
-  if (reservation.ok) reservation.value.dispose()
-  assert.equal(ledger.reserve({ inputBytes: 10, workingBytes: 20 }).ok, true)
-})
-
-test("unknown and negative budget dimensions are rejected without raw diagnostics", () => {
-  assert.throws(() => new BudgetLedger({ inputBytes: -1 } as never), /invalid/)
-  assert.throws(() => new BudgetLedger({ inputBytes: 1, mystery: 2 } as never), /invalid/)
-})
-
-test("budget rejects checked additions that exceed the safe integer range", () => {
-  const ledger = new BudgetLedger({ inputBytes: Number.MAX_SAFE_INTEGER })
-  assert.equal(ledger.reserve({ inputBytes: Number.MAX_SAFE_INTEGER }).ok, true)
-  assert.equal(ledger.reserve({ inputBytes: 1 }).ok, false)
-})
-
-test("budget boundaries deny throwing proxies, accessors, symbols, and cyclic requests", () => {
-  assert.throws(() => new BudgetLedger(new Proxy({ inputBytes: 1 }, { ownKeys: () => { throw new Error("foreign") } })), /invalid/)
-  const accessor = Object.defineProperty({}, "inputBytes", { get: () => { throw new Error("foreign") }, enumerable: true })
-  assert.throws(() => new BudgetLedger(accessor), /invalid/)
-  const ledger = new BudgetLedger({ inputBytes: 2 })
-  const cyclic = Object.create(null) as Record<string, unknown>
-  cyclic.self = cyclic
-  assert.equal(ledger.reserve(cyclic as never).ok, false)
-  const symbol = { inputBytes: 1, [Symbol("unknown")]: 1 }
-  assert.equal(ledger.reserve(symbol as never).ok, false)
-})

package/tests/unit/config.test.ts

@@ -1,40 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import { parseOptions, OptionsError } from "../../src/config/options.ts"
-
-const limits = {
-  sourceBytes: 1_048_576, totalSourceBytes: 2_097_152, sourceCount: 4,
-  secretCount: 1000, secretBytes: 16_384, indexBytes: 8_388_608,
-  inputBytes: 1_048_576, outputBytes: 2_097_152, traversalDepth: 32,
-  traversalNodes: 50_000, activeSessions: 8, handlesPerSession: 2048,
-  activeCalls: 4, workingBytes: 33_554_432, callTimeoutMs: 30_000, idleTimeoutMs: 5_000,
-}
-const valid = () => ({
-  version: 1,
-  sources: [{ id: "project", type: "file", format: "dotenv", path: ".env", required: true, keys: ["SMOKE_TOKEN"] }],
-  limits,
-})
-
-test("parses only source and bounded substitution configuration", () => {
-  const options = parseOptions(valid())
-  assert.equal(options.version, 1)
-  assert.equal(options.sources[0]?.path, ".env")
-})
-
-test("rejects tool-broker, authorization and unknown configuration fields", () => {
-  for (const input of [
-    { ...valid(), authorization: {} },
-    { ...valid(), capabilities: {} },
-    { ...valid(), unexpected: true },
-  ]) {
-    assert.throws(() => parseOptions(input), (error: unknown) => error instanceof OptionsError && error.message === "CONFIG_INVALID")
-  }
-})
-
-test("rejects unsafe source paths and raised budgets", () => {
-  for (const input of [
-    { ...valid(), sources: [{ ...valid().sources[0], path: "../secret.env" }] },
-    { ...valid(), sources: [{ ...valid().sources[0], path: "${env:SECRET}" }] },
-    { ...valid(), limits: { ...limits, sourceBytes: 1_048_577 } },
-  ]) assert.throws(() => parseOptions(input), (error: unknown) => error instanceof OptionsError && error.message === "CONFIG_INVALID")
-})

package/tests/unit/dotenv.test.ts

@@ -1,72 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import * as fs from "node:fs/promises"
-import * as os from "node:os"
-import * as path from "node:path"
-import { loadDotenvFile, parseDotenv, SourceParseError } from "../../src/sources/dotenv.ts"
-
-test("parses comments, export, quotes, CRLF and multiline without expansion", () => {
-  const snapshot = parseDotenv("# ignored\r\nexport TOKEN=abc#not-comment\r\nNAME='hello world'\nMULTI=\"one\\ntwo\"\nRAW=$NO_EXPAND\n")
-  assert.deepEqual(snapshot.entries.map(({ key, value }) => ({ key, value })), [
-    { key: "TOKEN", value: "abc" }, { key: "NAME", value: "hello world" },
-    { key: "MULTI", value: "one\ntwo" }, { key: "RAW", value: "$NO_EXPAND" },
-  ])
-  assert.equal(snapshot.entries[2]?.lexicalValue, '"one\\ntwo"')
-})
-
-test("supports quoted multiline values and preserves lexical spelling", () => {
-  const result = parseDotenv("KEY=\"first\nsecond\"\nSINGLE='a#b'\n")
-  assert.equal(result.entries[0]?.value, "first\nsecond")
-  assert.equal(result.entries[0]?.lexicalValue, '"first\nsecond"')
-  assert.equal(result.entries[1]?.value, "a#b")
-})
-
-test("uses stateful escaping for quoted values and preserves every accepted spelling", () => {
-  const source = String.raw`DOUBLE="a\"b\\c\n\r\t"
-MULTI="first
-second"
-SINGLE='a\\b\'c'
-`
-  const result = parseDotenv(source)
-  assert.deepEqual(result.entries.map(({ key, value, lexicalValue }) => ({ key, value, lexicalValue })), [
-    { key: "DOUBLE", value: 'a"b\\c\n\r\t', lexicalValue: String.raw`"a\"b\\c\n\r\t"` },
-    { key: "MULTI", value: "first\nsecond", lexicalValue: String.raw`"first
-second"` },
-    { key: "SINGLE", value: String.raw`a\\b\'c`, lexicalValue: String.raw`'a\\b\'c'` },
-  ])
-})
-
-test("rejects unsupported and dangling quoted escapes", () => {
-  for (const source of ["A=\"bad\\q\"", "A=\"bad" + "\\", "A='bad" + "\\"]) {
-    assert.throws(() => parseDotenv(source), (error: unknown) => error instanceof SourceParseError && error.message === "SOURCE_INVALID")
-  }
-})
-
-test("rejects duplicates, malformed lines, oversized input and never partially returns", () => {
-  for (const source of ["A=1\nA=2", "not an assignment", "A=\"unterminated"]) {
-    assert.throws(() => parseDotenv(source), (error: unknown) => error instanceof SourceParseError && error.message === "SOURCE_INVALID")
-  }
-  assert.throws(() => parseDotenv("A=12345", { maxBytes: 4 }), (error: unknown) => error instanceof SourceParseError && error.message === "SOURCE_INVALID")
-})
-
-test("normalizes dotenv options as finite positive data-only limits", () => {
-  for (const options of [
-    { maxBytes: 0 }, { maxEntries: -1 }, { maxValueBytes: Infinity },
-    { maxBytes: Number.MAX_SAFE_INTEGER + 1 }, { unknown: 1 },
-  ]) {
-    assert.throws(() => parseDotenv("A=1", options as never), (error: unknown) => error instanceof SourceParseError && error.message === "SOURCE_INVALID")
-  }
-  const throwing = new Proxy({}, { ownKeys: () => { throw new Error("foreign") } })
-  assert.throws(() => parseDotenv("A=1", throwing as never), (error: unknown) => error instanceof SourceParseError && error.message === "SOURCE_INVALID")
-  const accessor = Object.defineProperty({}, "maxBytes", { get: () => { throw new Error("foreign") } })
-  assert.throws(() => parseDotenv("A=1", accessor as never), (error: unknown) => error instanceof SourceParseError && error.message === "SOURCE_INVALID")
-})
-
-test("loads only a regular final source file and never reads a directory", async (t) => {
-  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "dotenv-source-"))
-  t.after(() => { void fs.rm(directory, { recursive: true, force: true }) })
-  const file = path.join(directory, ".env")
-  await fs.writeFile(file, "TOKEN=synthetic\n")
-  assert.equal(loadDotenvFile(file).entries[0]?.value, "synthetic")
-  assert.throws(() => loadDotenvFile(directory), (error: unknown) => error instanceof SourceParseError && error.message === "SOURCE_INVALID")
-})

package/tests/unit/filter-size.test.ts

@@ -1,132 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import { admitPatterns } from "../../src/sanitize/index.ts"
-import { containsSecret, redactRequest, redactResponse, type FilterState } from "../../src/opencode/v2/filter.ts"
-
-const MIB = 1024 * 1024
-const REWRITE_CEILING = 1 * MIB
-const VERIFY_CEILING = 8 * MIB
-
-const canary = "CANARY_7f3a9c2e_synthetic"
-const patterns = [{ text: canary }]
-
-function makeState(): FilterState {
-  assert.equal(admitPatterns(patterns).ok, true)
-  return {
-    patterns,
-    budget: { maxOutputBytes: 2 * MIB, maxDepth: 32, maxNodes: 50_000, maxMatches: 50_000 },
-    maxInputBytes: REWRITE_CEILING,
-  }
-}
-
-const jsonBody = (padLength: number, leak?: string): string =>
-  JSON.stringify({ pad: "a".repeat(padLength), ...(leak === undefined ? {} : { leak }) })
-
-const postRequest = (body: string): Request =>
-  new Request("https://provider.invalid/v1/chat/completions", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body,
-  })
-
-test("response SSE redaction preserves valid JSON event framing", async () => {
-  const value = "SSE_CANARY_7f3a9c2e"
-  const handle = "secret-12345678-1234-4234-9234-123456789012"
-  const state: FilterState = {
-    patterns: [{ text: value, replacement: handle, entry: value }],
-    budget: { maxOutputBytes: 65_536, maxDepth: 32, maxNodes: 1_000, maxMatches: 1_000 },
-    maxInputBytes: 32_768,
-  }
-  const body = `data: ${JSON.stringify({ choices: [{ delta: { content: value } }] })}\n\ndata: [DONE]\n\n`
-  const response = await redactResponse(new Response(body, { headers: { "content-type": "text/event-stream" } }), state)
-  const output = await response.text()
-  const frame = output.split("\n").find((line) => line.startsWith("data: {") )
-  assert.ok(frame)
-  const parsed = JSON.parse(frame.slice("data: ".length)) as { choices: Array<{ delta: { content: string } }> }
-  assert.equal(parsed.choices[0]!.delta.content, handle)
-  assert.ok(!output.includes(value))
-})
-
-test("clean request body between the rewrite and verify ceilings passes unchanged", async () => {
-  const state = makeState()
-  const body = jsonBody(1_600_000)
-  assert.ok(body.length > REWRITE_CEILING && body.length < VERIFY_CEILING)
-  const result = await redactRequest(postRequest(body), state)
-  if (result === "withheld") assert.fail("clean oversize body must not be withheld")
-  assert.equal(await result.text(), body)
-})
-
-test("request body between the ceilings containing a raw secret is withheld", async () => {
-  const state = makeState()
-  const body = jsonBody(1_600_000, canary)
-  const result = await redactRequest(postRequest(body), state)
-  assert.equal(result, "withheld")
-})
-
-test("request bodies beyond the verify ceiling are withheld even when clean", async () => {
-  const state = makeState()
-  const body = jsonBody(9_000_000)
-  assert.ok(body.length > VERIFY_CEILING)
-  assert.equal(await redactRequest(postRequest(body), state), "withheld")
-})
-
-test("a declared content-length above the verify ceiling withholds before reading", async () => {
-  const state = makeState()
-  const request = new Request("https://provider.invalid/v1/chat/completions", {
-    method: "POST",
-    headers: { "content-type": "application/json", "content-length": String(9 * MIB) },
-    body: "{}",
-  })
-  assert.equal(request.headers.get("content-length"), String(9 * MIB), "test precondition: declared length is preserved")
-  assert.equal(await redactRequest(request, state), "withheld")
-})
-
-test("a small declared content-length does not veto a body that verifies clean", async () => {
-  const state = makeState()
-  const body = jsonBody(1_600_000)
-  const request = postRequest(body)
-  const declared = request.headers.get("content-length")
-  assert.ok(declared === null || Number(declared) <= REWRITE_CEILING, `test precondition: declared=${declared}`)
-  const result = await redactRequest(request, state)
-  if (result === "withheld") assert.fail("verified-clean body must not be withheld")
-  assert.equal(await result.text(), body)
-})
-
-test("clean response body between the ceilings is published unchanged", async () => {
-  const state = makeState()
-  const text = jsonBody(1_600_000)
-  assert.ok(text.length > REWRITE_CEILING && text.length < VERIFY_CEILING)
-  const response = await redactResponse(new Response(text, { status: 200, headers: { "content-type": "application/json" } }), state)
-  assert.equal(await response.text(), text)
-})
-
-test("response body between the ceilings containing a raw secret is withheld", async () => {
-  const state = makeState()
-  const response = await redactResponse(new Response(jsonBody(1_600_000, canary), { status: 200 }), state)
-  assert.equal(await response.text(), "")
-})
-
-test("response bodies beyond the verify ceiling are withheld even when clean", async () => {
-  const state = makeState()
-  const response = await redactResponse(new Response("a".repeat(9_000_000), { status: 200 }), state)
-  assert.equal(await response.text(), "")
-})
-
-test("body at the rewrite ceiling still rewrites secrets in place", async () => {
-  const state = makeState()
-  const body = jsonBody(200_000, canary)
-  assert.ok(body.length <= REWRITE_CEILING)
-  const result = await redactRequest(postRequest(body), state)
-  if (result === "withheld") assert.fail("small rewriting body must not be withheld")
-  const published = await result.text()
-  assert.equal(published.includes(canary), false)
-  assert.equal(published.includes("[REDACTED]"), true)
-})
-
-test("containsSecret verifies clean values beyond the output budget", async () => {
-  const state = makeState()
-  const clean = "b".repeat(3 * MIB)
-  assert.equal(containsSecret(clean, state), false)
-  assert.equal(containsSecret(`${clean}${canary}`, state), true)
-  assert.equal(containsSecret("a".repeat(9 * MIB), state), true)
-})