flowproof 0.4.0__tar.gz → 0.5.0__tar.gz

{flowproof-0.4.0 → flowproof-0.5.0}/Cargo.lock

@@ -760,7 +760,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -779,7 +779,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -795,7 +795,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -816,7 +816,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "image",
  "postgres",
@@ -830,7 +830,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -842,7 +842,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -856,7 +856,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "jsonschema",
  "regex",

{flowproof-0.4.0 → flowproof-0.5.0}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproof-replay", "crates/flowproof-agent", "crates/flowproof-adapters", "crates/flowproof-cli", "crates/flowproof-python"]
 
 [workspace.package]
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.4.0 → flowproof-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.4.0
+Version: 0.5.0
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.4.0 → flowproof-0.5.0}/crates/flowproof-adapters/src/agent_runner.rs

@@ -391,7 +391,8 @@ pub fn run_against_contained(
         command: command.trim().to_string(),
         source,
     })?;
-    // Start the supervisor: receive the notify fd and service it for the run.
+    // Start the supervisor: collect the notify fd the handoff thread acquired
+    // out of the child while `spawn` ran, and service it for the run.
     let supervisor = prep
         .into_supervisor(spawned)
         .map_err(|source| RunError::Spawn {

{flowproof-0.4.0 → flowproof-0.5.0}/crates/flowproof-adapters/src/egress.rs

@@ -46,6 +46,16 @@ impl Containment {
         }
     }
 
+    /// The tier for a flow that does not ENGAGE egress: it declares no
+    /// `allow_egress` and asserts no egress, so no seccomp filter is installed
+    /// and there is nothing to contain. Containment is opt-in; an unengaged
+    /// flow claims no tier.
+    pub fn not_engaged() -> Self {
+        Containment::NotContained(
+            "flow does not engage egress (no allow_egress or assert_no_egress)".to_string(),
+        )
+    }
+
     /// The tier for a `url:` flow: a service flowproof did not start cannot
     /// be contained.
     pub fn url_flow() -> Self {

{flowproof-0.4.0 → flowproof-0.5.0}/crates/flowproof-adapters/src/egress_linux.rs

@@ -15,9 +15,22 @@
 //!   closing the two paths that reach the network under the notifier.
 //!
 //! The filter is installed with `SECCOMP_FILTER_FLAG_NEW_LISTENER`, whose
-//! return value is a notify fd. That fd lives in the child, so it is passed
-//! back to the parent over a pre-created `socketpair` using `SCM_RIGHTS`. A
-//! supervisor thread services it for the whole run.
+//! return value is a notify fd. That fd lives in the child, so it is handed to
+//! the parent - but NOT with `SCM_RIGHTS`/`sendmsg`, since `sendmsg` is one of
+//! the syscalls the filter traps, so using it here would suspend the child on
+//! the very notifier the parent has not started servicing yet (a deadlock).
+//! Instead the child WRITES its `(pid, notify-fd-number)` over a pre-created
+//! `socketpair` (`getpid`/`write` are not trapped), a PARENT HANDOFF THREAD
+//! acquires the actual fd with `pidfd_open`+`pidfd_getfd` (the same infra the
+//! supervisor uses to act on the child's sockets) and WRITES back a one-byte
+//! ack so the child may close its copy and proceed to exec. A supervisor
+//! thread then services the notify fd for the whole run.
+//!
+//! The handoff runs on its own thread, started BEFORE `Command::spawn`,
+//! because `spawn` blocks until the child execs and the child cannot exec
+//! until it gets the ack: the read+ack must happen concurrently with `spawn`,
+//! not after it. The child sends its own pid because `child.id()` is not yet
+//! available while `spawn` is still blocked.
 //!
 //! # The TOCTOU-safe pattern
 //!
@@ -233,24 +246,32 @@ pub fn probe_containment() -> Containment {
     Containment::Enforced
 }
 
-/// A prepared filter and its parent-side control socket, wired into a
-/// `Command`'s `pre_exec`. Created BEFORE spawn; turned into a live
-/// supervisor AFTER spawn.
+/// A prepared filter plus the in-flight parent-side handoff, wired into a
+/// `Command`'s `pre_exec`. Created BEFORE spawn; turned into a live supervisor
+/// AFTER spawn.
+///
+/// The handoff runs on its OWN thread, started here in [`install`] rather than
+/// after spawn, and this is load-bearing: `Command::spawn` BLOCKS until the
+/// child execs, and the child cannot exec until the parent acks its notify fd.
+/// If the parent tried to do the read+ack after `spawn` returned, it would
+/// deadlock - the parent waiting in `spawn` for an exec that waits on an ack
+/// the parent has not sent. So the ack must come from a concurrent thread.
 pub struct EgressPrep {
-    parent_sock: OwnedFd,
+    handoff: std::thread::JoinHandle<io::Result<OwnedFd>>,
     allow: AllowSet,
 }
 
 /// Install the egress filter into `cmd` via `pre_exec` and return the
 /// parent-side handle. The filter and the child socket are moved into the
-/// closure; the parent keeps its end of the socketpair to receive the notify
-/// fd once the child has installed the filter.
+/// `pre_exec` closure; a handoff thread owns the parent's socket end and
+/// acquires the notify fd out of the child while `spawn` runs.
 pub fn install(cmd: &mut Command, allow: &AllowSet) -> io::Result<EgressPrep> {
     let filter = build_filter();
 
-    // A stream socketpair carries the notify fd from child to parent via
-    // SCM_RIGHTS. Both ends are close-on-exec: the child sends before exec
-    // (pre_exec runs first), and the execed program must inherit neither.
+    // A stream socketpair carries the child's (pid, notify-fd-number) to the
+    // parent and the parent's ack back. Both ends are close-on-exec: the child
+    // sends before exec (pre_exec runs first), and the execed program must
+    // inherit neither.
     let mut fds = [0 as RawFd; 2];
     let rc = unsafe {
         libc::socketpair(
@@ -273,18 +294,28 @@ pub fn install(cmd: &mut Command, allow: &AllowSet) -> io::Result<EgressPrep> {
     unsafe {
         cmd.pre_exec(move || child_install(&filter, child_sock));
     }
+
+    // The handoff thread: it blocks reading the child's message, so it must run
+    // CONCURRENTLY with the caller's `cmd.spawn()` (see `EgressPrep`). It owns
+    // `parent_sock` and yields the acquired notify fd.
+    let handoff = std::thread::spawn(move || recv_notify_fd(parent_sock));
+
     Ok(EgressPrep {
-        parent_sock,
+        handoff,
         allow: allow.clone(),
     })
 }
 
 impl EgressPrep {
-    /// After spawn: receive the notify fd the child sent, and start the
-    /// supervisor thread that services it for the run. `spawn` is the instant
-    /// the child was launched, the zero for every event's monotonic `at_ms`.
+    /// After spawn: collect the notify fd the handoff thread acquired from the
+    /// child, and start the supervisor thread that services it for the run.
+    /// `spawn` is the instant the child was launched, the zero for every
+    /// event's monotonic `at_ms`.
     pub fn into_supervisor(self, spawn: Instant) -> io::Result<Supervisor> {
-        let notify_fd = recv_fd(self.parent_sock.as_raw_fd())?;
+        let notify_fd = self
+            .handoff
+            .join()
+            .map_err(|_| io::Error::other("egress handoff thread panicked"))??;
         Ok(Supervisor::start(notify_fd, self.allow, spawn))
     }
 }
@@ -302,7 +333,10 @@ fn child_install(filter: &[libc::sock_filter], child_sock: RawFd) -> io::Result<
         filter: filter.as_ptr() as *mut libc::sock_filter,
     };
     // 2. Install the filter with NEW_LISTENER; the return value is the notify
-    //    fd, which the parent will service.
+    //    fd, which the parent will service. The filter is active IMMEDIATELY,
+    //    so from here on the trapped syscalls (connect/send*/listen) would
+    //    suspend us on the notifier - hence the handoff below uses only
+    //    `write`/`read`, which the filter does NOT trap.
     let notify_fd = unsafe {
         libc::syscall(
             libc::SYS_seccomp,
@@ -314,91 +348,147 @@ fn child_install(filter: &[libc::sock_filter], child_sock: RawFd) -> io::Result<
     if notify_fd < 0 {
         return Err(io::Error::last_os_error());
     }
-    // 3. Hand the notify fd to the parent over the socketpair.
-    send_fd(child_sock, notify_fd as RawFd)?;
-    // The child no longer needs either fd; the filter stays installed.
+    let notify_fd = notify_fd as RawFd;
+    // 3. Hand the notify fd to the parent WITHOUT a trapped syscall: write our
+    //    PID and the notify fd's NUMBER, then block on the parent's one-byte
+    //    ack. The pid lets the handoff thread `pidfd_open`+`pidfd_getfd` the fd
+    //    (it cannot use `child.id()` - `spawn` has not returned yet, since it
+    //    blocks until we exec). We must NOT close `notify_fd` until the parent
+    //    has acquired its own reference to the same open file description;
+    //    closing early would tear down the listener. `getpid`/`write`/`read`
+    //    are not in the filter, so none traps and the child never blocks on the
+    //    un-serviced notifier.
+    let pid = unsafe { libc::getpid() };
+    let handoff = write_handoff(child_sock, pid, notify_fd).and_then(|()| wait_ack(child_sock));
+    // 4. Whether the handoff succeeded or failed, drop both fds before exec so
+    //    the child's real program (python) inherits NEITHER the notify fd nor
+    //    the socketpair. The socketpair is already CLOEXEC, but the notify fd
+    //    is not, so this explicit close is what keeps it out of the exec.
     unsafe {
-        libc::close(notify_fd as RawFd);
+        libc::close(notify_fd);
         libc::close(child_sock);
     }
-    Ok(())
+    handoff
 }
 
-/// Send a single fd over a unix socket with SCM_RIGHTS (one filler data byte,
-/// as the kernel requires a non-empty payload).
-fn send_fd(sock: RawFd, fd: RawFd) -> io::Result<()> {
-    let mut byte = [0u8; 1];
-    let mut iov = libc::iovec {
-        iov_base: byte.as_mut_ptr() as *mut libc::c_void,
-        iov_len: 1,
-    };
-    let mut cmsg_buf = [0u8; unsafe_cmsg_space()];
-    let mut msg: libc::msghdr = unsafe { std::mem::zeroed() };
-    msg.msg_iov = &mut iov;
-    msg.msg_iovlen = 1;
-    msg.msg_control = cmsg_buf.as_mut_ptr() as *mut libc::c_void;
-    msg.msg_controllen = cmsg_buf.len() as _;
-    unsafe {
-        let cmsg = libc::CMSG_FIRSTHDR(&msg);
-        (*cmsg).cmsg_level = libc::SOL_SOCKET;
-        (*cmsg).cmsg_type = libc::SCM_RIGHTS;
-        (*cmsg).cmsg_len = libc::CMSG_LEN(std::mem::size_of::<RawFd>() as u32) as _;
-        std::ptr::copy_nonoverlapping(
-            &fd as *const RawFd as *const u8,
-            libc::CMSG_DATA(cmsg),
-            std::mem::size_of::<RawFd>(),
-        );
-        let n = libc::sendmsg(sock, &msg, 0);
-        if n < 0 {
-            return Err(io::Error::last_os_error());
+/// Write the child's `(pid, notify-fd-number)` as two native-endian `i32`s to
+/// the socketpair. Used in place of an `SCM_RIGHTS`/`sendmsg` fd passage,
+/// because `sendmsg` is trapped by the filter that is already installed;
+/// `write` is not.
+fn write_handoff(sock: RawFd, pid: libc::pid_t, fd: RawFd) -> io::Result<()> {
+    // RawFd and pid_t are both i32 on Linux: a fixed 8-byte message the parent
+    // reads back with `i32::from_ne_bytes`.
+    let mut msg = [0u8; 8];
+    msg[0..4].copy_from_slice(&pid.to_ne_bytes());
+    msg[4..8].copy_from_slice(&fd.to_ne_bytes());
+    write_all(sock, &msg)
+}
+
+/// Block until the parent writes its one-byte ack, meaning it has acquired the
+/// notify fd and the child may close its copy and proceed to exec. `read` is
+/// not trapped by the filter.
+fn wait_ack(sock: RawFd) -> io::Result<()> {
+    let mut ack = [0u8; 1];
+    read_exact(sock, &mut ack)
+}
+
+/// Parent side of the handoff, run on its own thread (see [`install`]): read
+/// the child's `(pid, notify-fd-number)`, acquire the actual fd out of the
+/// child with `pidfd_open`+`pidfd_getfd` (the same mechanism [`dup_child_fd`]
+/// uses for the child's sockets), then write the one-byte ack so the child can
+/// close its copy and exec. Owns `sock` and drops it on return.
+fn recv_notify_fd(sock: OwnedFd) -> io::Result<OwnedFd> {
+    let raw = sock.as_raw_fd();
+    // Bound the wait for the child's message. On the happy path the child
+    // writes within milliseconds; a bound means that if `cmd.spawn` FAILS (the
+    // child never runs) this thread errors out instead of blocking forever on a
+    // socketpair whose peer never speaks.
+    if !poll_readable(raw, HANDOFF_TIMEOUT_MS)? {
+        return Err(io::Error::new(
+            io::ErrorKind::TimedOut,
+            "egress handoff: child never sent its notify fd",
+        ));
+    }
+    let mut msg = [0u8; 8];
+    read_exact(raw, &mut msg)?;
+    let child_pid = i32::from_ne_bytes([msg[0], msg[1], msg[2], msg[3]]) as u32;
+    let fd_number = i32::from_ne_bytes([msg[4], msg[5], msg[6], msg[7]]) as RawFd;
+    // Acquire OUR OWN reference to the child's notify file description. Once we
+    // hold it, the child closing its copy does not tear down the listener.
+    // pidfd_getfd sets CLOEXEC on the returned fd, so flowproof's own future
+    // execs do not leak it.
+    let notify_fd = dup_child_fd(child_pid, fd_number)?;
+    // Ack: the child is blocked on this one byte before it closes and execs.
+    write_all(raw, &[1u8])?;
+    Ok(notify_fd)
+}
+
+/// How long the parent handoff thread waits for the child's message before
+/// giving up. Generous: the child writes within milliseconds on success, so
+/// this only fires when the child never ran (a failed `cmd.spawn`).
+const HANDOFF_TIMEOUT_MS: libc::c_int = 30_000;
+
+/// `poll` a fd for readability with a millisecond timeout. `Ok(true)` means
+/// readable (or an error condition the following read will surface),
+/// `Ok(false)` means the timeout elapsed with nothing to read.
+fn poll_readable(sock: RawFd, timeout_ms: libc::c_int) -> io::Result<bool> {
+    loop {
+        let mut pfd = libc::pollfd {
+            fd: sock,
+            events: libc::POLLIN,
+            revents: 0,
+        };
+        let rc = unsafe { libc::poll(&mut pfd, 1, timeout_ms) };
+        if rc < 0 {
+            let e = io::Error::last_os_error();
+            if e.raw_os_error() == Some(libc::EINTR) {
+                continue;
+            }
+            return Err(e);
         }
+        return Ok(rc > 0);
     }
-    Ok(())
 }
 
-/// Receive a single fd sent with SCM_RIGHTS.
-fn recv_fd(sock: RawFd) -> io::Result<OwnedFd> {
-    let mut byte = [0u8; 1];
-    let mut iov = libc::iovec {
-        iov_base: byte.as_mut_ptr() as *mut libc::c_void,
-        iov_len: 1,
-    };
-    let mut cmsg_buf = [0u8; unsafe_cmsg_space()];
-    let mut msg: libc::msghdr = unsafe { std::mem::zeroed() };
-    msg.msg_iov = &mut iov;
-    msg.msg_iovlen = 1;
-    msg.msg_control = cmsg_buf.as_mut_ptr() as *mut libc::c_void;
-    msg.msg_controllen = cmsg_buf.len() as _;
-    unsafe {
-        let n = libc::recvmsg(sock, &mut msg, 0);
+/// `write` the whole buffer, retrying short writes and EINTR. Async-signal-safe
+/// (used in the child): no allocation, so failures carry a bare errno rather
+/// than a formatted message.
+fn write_all(sock: RawFd, mut buf: &[u8]) -> io::Result<()> {
+    while !buf.is_empty() {
+        let n = unsafe { libc::write(sock, buf.as_ptr() as *const libc::c_void, buf.len()) };
         if n < 0 {
-            return Err(io::Error::last_os_error());
+            let e = io::Error::last_os_error();
+            if e.raw_os_error() == Some(libc::EINTR) {
+                continue;
+            }
+            return Err(e);
         }
-        let cmsg = libc::CMSG_FIRSTHDR(&msg);
-        if cmsg.is_null()
-            || (*cmsg).cmsg_level != libc::SOL_SOCKET
-            || (*cmsg).cmsg_type != libc::SCM_RIGHTS
-        {
-            return Err(io::Error::other(
-                "no notify fd in the child's SCM_RIGHTS message",
-            ));
+        if n == 0 {
+            return Err(io::Error::from_raw_os_error(libc::EPIPE));
         }
-        let mut fd: RawFd = -1;
-        std::ptr::copy_nonoverlapping(
-            libc::CMSG_DATA(cmsg),
-            &mut fd as *mut RawFd as *mut u8,
-            std::mem::size_of::<RawFd>(),
-        );
-        Ok(OwnedFd::from_raw_fd(fd))
+        buf = &buf[n as usize..];
     }
+    Ok(())
 }
 
-/// Room for one fd's control message. `CMSG_SPACE` is not const, so this
-/// mirrors its arithmetic for the fixed single-fd case.
-const fn unsafe_cmsg_space() -> usize {
-    // CMSG_SPACE(sizeof(int)) == align(sizeof(cmsghdr)) + align(sizeof(int)).
-    // 64 bytes is a safe over-allocation on every Linux ABI.
-    64
+/// `read` exactly `buf.len()` bytes, retrying short reads and EINTR. A closed
+/// peer (0 bytes) before the buffer is filled is an error. Async-signal-safe.
+fn read_exact(sock: RawFd, mut buf: &mut [u8]) -> io::Result<()> {
+    while !buf.is_empty() {
+        let n = unsafe { libc::read(sock, buf.as_mut_ptr() as *mut libc::c_void, buf.len()) };
+        if n < 0 {
+            let e = io::Error::last_os_error();
+            if e.raw_os_error() == Some(libc::EINTR) {
+                continue;
+            }
+            return Err(e);
+        }
+        if n == 0 {
+            return Err(io::Error::from_raw_os_error(libc::ECONNRESET));
+        }
+        buf = &mut buf[n as usize..];
+    }
+    Ok(())
 }
 
 /// The live supervisor: a thread servicing the notify fd, plus the shared log

{flowproof-0.4.0 → flowproof-0.5.0}/crates/flowproof-agent/src/lib.rs

@@ -19,7 +19,7 @@ pub use llm::{HttpModelClient, ModelClient};
 pub use recorder::{
     record, record_incremental, record_with_author, Author, RecordError, RecordSummary,
 };
-pub use spec::{FlowSpec, McpServerSpec, SpecStep, SuiteManifest};
+pub use spec::{check_control_ids, FlowSpec, McpServerSpec, SessionRef, SpecStep, SuiteManifest};
 
 use std::env;
 

{flowproof-0.4.0 → flowproof-0.5.0}/crates/flowproof-agent/src/recorder.rs

@@ -63,6 +63,11 @@ pub enum RecordError {
     Driver(#[from] flowproof_driver::DriverError),
     #[error(transparent)]
     Secret(#[from] flowproof_trace::secret::MissingSecret),
+    /// A declared secret leaked into the run's observable corpus, or the
+    /// corpus could not be scanned (a too-short secret, a corpus-less flow
+    /// kind). Names variables and the corpus element, never the value.
+    #[error("{0}")]
+    SecretLeak(String),
     #[error("cannot write trace {path}: {source}")]
     Io {
         path: String,
@@ -1225,15 +1230,18 @@ fn web_browser_from_setup(
 /// Poll an out-of-band probe until it holds or the bound elapses — the row
 /// may still be committing, the API still converging. Configuration errors
 /// (missing connection env) fail immediately.
+/// Returns the probe's response body (an `Api` probe's response text, the
+/// corpus a secret-leak scan reads; `None` for `Sql`) once the expectation
+/// holds.
 fn poll_oob(
     probe: &flowproof_driver::oob::OobProbe,
     timeout_ms: u64,
     intent: &str,
-) -> Result<(), RecordError> {
+) -> Result<Option<String>, RecordError> {
     let deadline = std::time::Instant::now() + Duration::from_millis(timeout_ms);
     loop {
         match flowproof_driver::oob::check(probe)? {
-            Ok(()) => return Ok(()),
+            Ok(body) => return Ok(body),
             Err(reason) => {
                 if std::time::Instant::now() >= deadline {
                     return Err(RecordError::AssertMismatch {
@@ -1518,8 +1526,27 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
     old_steps: Option<&[Step]>,
 ) -> Result<RecordSummary, RecordError> {
     let mut reuse = old_steps.map(ReuseCursor::new);
+    // `assert_no_secret_leak` selectors, grouped by asserting step. The scan
+    // is a whole-run store-guard: it runs on the in-memory corpus BEFORE the
+    // trace is minted, so a leak fails the run and NO trace is written. A flow
+    // that never uses the feature builds no corpus and behaves byte-for-byte
+    // as before.
+    let leak_assertions = spec.secret_leak_assertions();
+    let scan_secrets = !leak_assertions.is_empty();
+    // Honesty, not a vacuous pass: a flow kind with no readable corpus is
+    // refused at execution (the same rule `assert_no_egress` follows), before
+    // launching anything, so nothing is minted for a control that cannot be
+    // checked. web and api are covered; agent never reaches this recorder.
+    if scan_secrets && !flowproof_trace::secret_scan::has_readable_corpus(spec.app.id()) {
+        return Err(RecordError::SecretLeak(
+            flowproof_trace::secret_scan::capability_error(spec.app.id()),
+        ));
+    }
     let target = launch_target(spec)?;
-    if let Some(setup) = &spec.session {
+    // The session is an inline mapping by now: a `session: <name>` ref is
+    // dereferenced to its identity's inline setup at flow load, so record
+    // never sees an unresolved name.
+    if let Some(setup) = spec.session.as_ref().and_then(|s| s.inline()) {
         let (cookies, local_storage) = setup.resolved()?;
         driver.stage_session(flowproof_driver::WebSession {
             cookies,
@@ -1578,6 +1605,12 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
     let mut captures: std::collections::HashMap<String, String> = std::collections::HashMap::new();
     let mut prior_intents: Vec<String> = Vec::new();
     let mut llm_used = false;
+    // The secret-leak corpus, held in memory for this run only, exactly like a
+    // resolved `${VAR}` value: (a) the web surface text read at each step
+    // boundary (the same text `page shows` reads, not the page source) and
+    // (b) every `assert_api` response body probed. Populated only when the
+    // flow asserts `assert_no_secret_leak`.
+    let mut secret_corpus: Vec<(String, String)> = Vec::new();
     for spec_step in &spec.steps {
         let intent = spec_step.intent().to_string();
         let actions = author_actions(
@@ -1711,7 +1744,7 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
                             None => None,
                         },
                     };
-                    poll_oob(&probe, *timeout_ms, &spec_step.intent())?
+                    poll_oob(&probe, *timeout_ms, &spec_step.intent())?;
                 }
                 ResolvedAction::AssertApi {
                     method,
@@ -1744,7 +1777,14 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
                             None => None,
                         },
                     };
-                    poll_oob(&probe, *timeout_ms, &spec_step.intent())?
+                    let body = poll_oob(&probe, *timeout_ms, &spec_step.intent())?;
+                    // The response body joins the corpus a secret-leak scan
+                    // reads. Held in memory, never written to the trace.
+                    if scan_secrets {
+                        if let Some(text) = body {
+                            secret_corpus.push(("an assert_api response body".to_string(), text));
+                        }
+                    }
                 }
                 ResolvedAction::PressKey { key, modifiers } => {
                     let mods: Vec<flowproof_driver::KeyMod> =
@@ -2060,6 +2100,25 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
                 }
             }
         }
+        // Step boundary: sample the web surface text (the same text `page
+        // shows` reads, not the page source). Per-step, not continuous: a
+        // secret that flashes into the DOM between boundaries is invisible to
+        // this control, an exclusion the audit output echoes.
+        if scan_secrets && spec.app.id() == "web" {
+            secret_corpus.push((
+                "the surface text at a step boundary".to_string(),
+                driver.surface_text()?,
+            ));
+        }
+    }
+
+    // STORE-GUARD: scan the in-memory corpus BEFORE any trace is minted, by
+    // the SAME mechanism replay uses. A leak (or a too-short secret, or a
+    // corpus-less kind) fails the run here, so the leaked value never reaches
+    // disk and no trace is written.
+    if scan_secrets {
+        flowproof_trace::secret_scan::scan_corpus(&leak_assertions, &secret_corpus)
+            .map_err(RecordError::SecretLeak)?;
     }
 
     let recording = recorder.and_then(flowproof_driver::RunRecorder::finish);
@@ -2092,7 +2151,10 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
             .filter_map(|rule| serde_json::to_value(rule).ok())
             .collect(),
         // The RAW session setup — cookie values keep their `${VAR}` refs.
-        session: spec.session.clone(),
+        // A `session: <name>` ref has been dereferenced to its identity's
+        // inline setup at flow load, so the header carries the setup itself,
+        // never a pointer to the suite. The trace stays self-contained.
+        session: spec.session.as_ref().and_then(|s| s.inline()).cloned(),
         // Mock rules travel with the trace: what was mocked at record MUST
         // be mocked at replay, or the two executions test different things.
         mock: spec.mock.clone(),
@@ -2167,6 +2229,10 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
             dpi_scale: None,
             locale: None,
         },
+        // The control this flow validates, copied so the evidence is
+        // self-describing. Additive/optional: absent for flows with no
+        // `control:` block, which serialize byte-identical to before.
+        control: spec.control.clone(),
     };
 
     let io_err = |source: std::io::Error| RecordError::Io {

{flowproof-0.4.0 → flowproof-0.5.0}/crates/flowproof-agent/src/rules.rs

@@ -471,6 +471,11 @@ fn resolve_step_inner(app: &str, step: &SpecStep) -> Result<Vec<ResolvedAction>,
                     .map_or(ASSERT_TIMEOUT_MS, |s| s * 1000),
             }]);
         }
+        // A whole-run control assertion, not a per-step driver action: the
+        // record-time store-guard and the replay scan enforce it out of band
+        // against the captured corpus. It performs nothing on the UI, so it
+        // resolves to zero actions on every app kind.
+        SpecStep::AssertNoSecretLeak { .. } => return Ok(Vec::new()),
         SpecStep::AssertScreenshot { assert_screenshot } => {
             if assert_screenshot.name.trim().is_empty()
                 || assert_screenshot.name.contains(['/', '\\'])