testronaut 1.2.0 → 1.2.1

package/core/redaction.js

@@ -1,78 +1,206 @@
-// core/redaction.js
+/**
+ * redaction.js
+ * -------------
+ * Purpose:
+ *   Centralized redaction utilities for Testronaut logs and plans.
+ *   - Single source of truth for sensitive keywords
+ *   - Masks tool args when targeting sensitive fields (e.g., #access, password inputs)
+ *   - Masks free-form instructions that reveal credentials
+ *
+ * Design goals:
+ *   - No side effects (pure functions)
+ *   - Easy to extend by editing one keyword list
+ *   - Unit testable via Vitest
+ *
+ * Related tests:
+ *   See `tests/core/redaction.test.js`
+ *
+ * Used by:
+ *   - CLI log/plan renderers
+ *   - Tool call serializers (type/fill)
+ *
+ * Example usage:
+ *   const safeArgs = redactArgs('fill', { selector: '#access', text: 'P@ssw0rd' });
+ *   const safePlan = redactPasswordInText(`Type "P@ssw0rd" into #access`);
+ */
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Sensitive Keywords (Single Source of Truth)
+// Add/remove terms here and every consumer updates automatically.
+// Hyphenated forms are expanded to also match `_` and spaces (api-key/api_key/api key).
+// ─────────────────────────────────────────────────────────────────────────────
+
+export const SENSITIVE_KEYWORDS = [
+  'pass',
+  'password',
+  'pwd',
+  'passwd',
+  'access',
+  'secret',
+  'token',
+  'api-key',
+  'apikey',
+  'bearer',
+  'auth',
+  'pin',
+  'otp',
+];
+
+/**
+ * Builds a single RegExp that treats hyphens as `[-_\s]?` to catch variants.
+ * @returns {RegExp}
+ */
+function buildSensitiveRegex() {
+  // Expand hyphen variants: "api-key" -> "api[-_\s]?key"
+  const parts = SENSITIVE_KEYWORDS.map(k => k.replace(/-/g, '[-_\\s]?'));
+  return new RegExp(`\\b(${parts.join('|')})\\b`, 'i');
+}
 
+const SENSITIVE_RE = buildSensitiveRegex();
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Core helpers
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Safe clone: prefer structuredClone, fallback to JSON.
+ * @template T
+ * @param {T} obj
+ * @returns {T}
+ */
 function clone(obj) {
   try { return structuredClone(obj); } catch { return JSON.parse(JSON.stringify(obj ?? {})); }
 }
 
+/**
+ * Returns a masked preview. If showLength is true, includes length for debugging.
+ * @param {unknown} val
+ * @param {boolean} [showLength=true]
+ * @returns {string}
+ */
 export function maskPreview(val, showLength = true) {
   const s = String(val ?? '');
   if (!s) return '••••••';
-  // Show length for debugging without leaking the value
   return showLength ? `•••••• (${s.length})` : '••••••';
 }
 
-function hasPasswordHint(str = '') {
-  return /\b(pass(word)?|pwd|passwd)\b/i.test(String(str || ''));
+/**
+ * True if the provided string contains sensitive hints (password, token, access, etc.).
+ * @param {string} [str='']
+ * @returns {boolean}
+ */
+function hasSensitiveHint(str = '') {
+  return SENSITIVE_RE.test(String(str || ''));
 }
 
-function isPasswordCall(fnName, args = {}) {
+/**
+ * True if an HTML input type itself is sensitive.
+ * @param {string} [t='']
+ * @returns {boolean}
+ */
+function isSensitiveInputType(t = '') {
+  return String(t || '').toLowerCase() === 'password';
+}
+
+/**
+ * Returns true if a tool call (type/fill) looks like it targets a sensitive field.
+ * We check selector/label/placeholder/name/role/testId OR inputType=password.
+ *
+ * @param {'type'|'fill'|string} fnName
+ * @param {object} [args={}]
+ * @returns {boolean}
+ */
+function isSensitiveCall(fnName, args = {}) {
   if (!(fnName === 'type' || fnName === 'fill')) return false;
-  const { selector, label, placeholder, name, inputType, role, testId } = args;
+  const { selector, label, placeholder, name, inputType, role, testId } = args || {};
   return (
-    hasPasswordHint(selector) ||
-    hasPasswordHint(label) ||
-    hasPasswordHint(placeholder) ||
-    hasPasswordHint(name) ||
-    String(inputType || '').toLowerCase() === 'password' ||
-    hasPasswordHint(role) ||
-    hasPasswordHint(testId)
+    hasSensitiveHint(selector) ||
+    hasSensitiveHint(label) ||
+    hasSensitiveHint(placeholder) ||
+    hasSensitiveHint(name) ||
+    isSensitiveInputType(inputType) ||
+    hasSensitiveHint(role) ||
+    hasSensitiveHint(testId)
   );
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Public API
+// ─────────────────────────────────────────────────────────────────────────────
+
 /**
- * Redact ONLY password values in tool args:
- * - Applies to type/fill on password-looking fields
- * - Also masks any arg property explicitly named password/pwd/passwd (shallow)
+ * Redact ONLY secret-like values in tool args (shallow).
+ * - Masks any property whose *key* name looks sensitive (e.g., apiKey, token)
+ * - If the call targets a sensitive field, masks common value props (text/value/input/keys)
+ *
+ * @param {'type'|'fill'|string} fnName
+ * @param {Record<string, unknown>} [args={}]
+ * @param {{ showLength?: boolean }} [opts]
+ * @returns {Record<string, unknown>}
  */
 export function redactArgs(fnName, args = {}, { showLength = true } = {}) {
   const out = clone(args);
 
-  // Mask direct props named password/pwd/passwd if present
+  // Mask direct props with sensitive-looking keys
   for (const k of Object.keys(out || {})) {
-    if (hasPasswordHint(k)) {
+    if (hasSensitiveHint(k)) {
       out[k] = maskPreview(out[k], showLength);
     }
   }
 
-  // For typing into a password field, mask the value
-  if (isPasswordCall(fnName, args)) {
-    if ('text'  in out) out.text  = maskPreview(out.text, showLength);
-    if ('value' in out) out.value = maskPreview(out.value, showLength);
-    if ('input' in out) out.input = maskPreview(out.input, showLength);
-    if ('keys'  in out) out.keys  = maskPreview(out.keys, showLength);
+  // Mask value-like props when the call targets a sensitive field
+  if (isSensitiveCall(fnName, args)) {
+    for (const key of ['text', 'value', 'input', 'keys']) {
+      if (key in out) out[key] = maskPreview(out[key], showLength);
+    }
   }
 
   return out;
 }
 
 /**
- * Redact password literals in freeform mission text.
- * Heuristic: look for the word "password" then the next quoted string OR
- * a token after "with|as|to|=" within ~80 chars.
+ * Redact sensitive literals in freeform mission text.
+ *
+ * Cases:
+ * 1) Sensitive-word ... "VALUE"
+ *    e.g., `password is "hunter2"`
+ *
+ * 2) Sensitive-word ... (with|as|to|=) VALUE
+ *    e.g., `token=abcd1234`, `auth with xyz`
+ *
+ * 3) "VALUE" ... into/in/on/to TARGET  (TARGET contains a sensitive hint)
+ *    e.g., `Type "Imp0st3r123!" into #access`
+ *
+ * @param {string} [text='']
+ * @param {{ showLength?: boolean }} [opts]
+ * @returns {string}
  */
 export function redactPasswordInText(text = '', { showLength = true } = {}) {
   let s = String(text ?? '');
 
-  // Case 1: password ... "VALUE"
+  // Build a reusable source pattern for SENSITIVE_KEYWORDS with hyphen expansion
+  const kwParts = SENSITIVE_KEYWORDS.map(k => k.replace(/-/g, '[-_\\s]?'));
+  const kwGroup = `(${kwParts.join('|')})`;
+
+  // Case 1: keyword ... "VALUE"
   s = s.replace(
-    /(\bpassword\b[^"'\\\n]{0,80}["'])([^"']+)(["'])/gi,
-    (_m, pre, pwd, post) => pre + maskPreview(pwd, showLength) + post
+    new RegExp(`(\\b${kwGroup}\\b[^"'\\\\\\n]{0,80}["'])([^"']+)(["'])`, 'gi'),
+    (_m, pre, _kw, secret, post) => pre + maskPreview(secret, showLength) + post
   );
 
-  // Case 2: password ... (with|as|to|=) VALUE
+  // Case 2: keyword ... (with|as|to|=) VALUE
   s = s.replace(
-    /(\bpassword\b[^.\n]{0,80}?\b(with|as|to|=)\s*)([^\s"'`]+)/gi,
-    (_m, pre, _kw, pwd) => pre + maskPreview(pwd, showLength)
+    new RegExp(`(\\b${kwGroup}\\b[^.\\n]{0,80}?\\b(with|as|to|=)\\s*)([^\\s"'\\\`]+)`, 'gi'),
+    (_m, pre, _kw1, _kw2, secret) => pre + maskPreview(secret, showLength)
+  );
+
+  // Case 3: "VALUE" ... into/in/on/to TARGET (TARGET looks sensitive)
+  s = s.replace(
+    /(["'`])([^"'`]+)\1\s+(?:into|in|on|to)\s+([^\s,.;:]+)/gi,
+    (_m, q, val, target) => {
+      if (hasSensitiveHint(target)) return q + maskPreview(val, showLength) + q + ' into ' + target;
+      return _m;
+    }
   );
 
   return s;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testronaut",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "main": "./runner/testronaut.js",
   "bin": {
     "testronaut": "./bin/cli.js"

package/tests/coreTests/redation.test.js

@@ -0,0 +1,118 @@
+/**
+ * redaction.test.js
+ * -----------------
+ * Purpose:
+ *   Vitest unit tests for redaction utilities:
+ *   - Centralized keyword usage
+ *   - Tool arg masking (selector & key-name based)
+ *   - Free-text masking for plans/instructions
+ *
+ * Test runner:
+ *   Vitest (https://vitest.dev/)
+ *
+ * Location:
+ *   tests/core/redaction.test.js
+ */
+
+import { describe, it, expect } from 'vitest';
+import {
+  SENSITIVE_KEYWORDS,
+  maskPreview,
+  redactArgs,
+  redactPasswordInText,
+} from '../../core/redaction.js';
+
+describe('redaction utilities', () => {
+  describe('SENSITIVE_KEYWORDS (centralized list)', () => {
+    it('contains expected baseline keywords', () => {
+      const expected = ['password', 'token', 'access', 'api-key', 'auth'];
+      for (const k of expected) {
+        expect(SENSITIVE_KEYWORDS).toContain(k);
+      }
+    });
+  });
+
+  describe('maskPreview', () => {
+    it('masks and includes length by default', () => {
+      expect(maskPreview('hunter2')).toBe('•••••• (7)');
+    });
+
+    it('masks empty-ish values without length', () => {
+      expect(maskPreview('')).toBe('••••••');
+      expect(maskPreview(null)).toBe('••••••');
+      expect(maskPreview(undefined)).toBe('••••••');
+    });
+
+    it('respects showLength=false', () => {
+      expect(maskPreview('abcdef', false)).toBe('••••••');
+    });
+  });
+
+  describe('redactArgs', () => {
+    it('masks when selector contains #access', () => {
+      const args = { selector: '#access', text: 'Imp0st3r123!' };
+      const redacted = redactArgs('fill', args);
+      expect(redacted.text).toMatch(/^•••••• \(\d+\)$/);
+      expect(redacted.selector).toBe('#access'); // selector remains visible
+    });
+
+    it('masks when inputType is password', () => {
+      const args = { selector: '#login', inputType: 'password', value: 'superSecret' };
+      const redacted = redactArgs('type', args);
+      expect(redacted.value).toBe('•••••• (11)');
+    });
+
+    it('masks values by sensitive arg key names (e.g., apiKey, token)', () => {
+      const args = { apiKey: 'sk-live-abc', token: 'abcd1234', other: 'notSecret' };
+      const redacted = redactArgs('noop', args); // fnName not type/fill still masks by key name
+      expect(redacted.apiKey).toBe('•••••• (11)');
+      expect(redacted.token).toBe('•••••• (8)');
+      expect(redacted.other).toBe('notSecret');
+    });
+
+    it('does not mask non-sensitive calls', () => {
+      const args = { selector: '#search', text: 'hello world' };
+      const redacted = redactArgs('fill', args);
+      expect(redacted.text).toBe('hello world');
+    });
+  });
+
+  describe('redactPasswordInText', () => {
+    it('Case 1: keyword ... "VALUE"', () => {
+      const input = `My password is "hunter2".`;
+      const out = redactPasswordInText(input);
+      expect(out).toContain(`password is "•••••• (7)"`);
+    });
+
+    it('Case 2: keyword ... (with|as|to|=) VALUE', () => {
+      const input = `token=abcd1234 and auth with xyz`;
+      const out = redactPasswordInText(input);
+      expect(out).toContain(`token=•••••• (8)`);
+      expect(out).toContain(`auth with •••••• (3)`);
+    });
+
+    it('Case 3: "VALUE" into sensitive target (#access)', () => {
+      const input = `Type "Imp0st3r123!" into #access`;
+      const out = redactPasswordInText(input);
+      expect(out).toBe(`Type "•••••• (12)" into #access`);
+    });
+
+    it('non-sensitive text is unchanged', () => {
+      const input = `Click the button and type "hello" into #search`;
+      const out = redactPasswordInText(input);
+      expect(out).toBe(input);
+    });
+
+    it('handles api key forms with spaces/underscores/hyphens', () => {
+      const cases = [
+        `api-key "abcDEF123"`,
+        `api key "abcDEF123"`,
+        `api_key "abcDEF123"`,
+      ];
+      for (const text of cases) {
+        const out = redactPasswordInText(text);
+        expect(out).toContain(`"•••••• (9)"`);
+      }
+    });
+  });
+});