flowproof 0.4.1__tar.gz → 0.5.0__tar.gz

{flowproof-0.4.1 → flowproof-0.5.0}/Cargo.lock

@@ -760,7 +760,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -779,7 +779,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -795,7 +795,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -816,7 +816,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "image",
  "postgres",
@@ -830,7 +830,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -842,7 +842,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -856,7 +856,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "jsonschema",
  "regex",

{flowproof-0.4.1 → flowproof-0.5.0}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproof-replay", "crates/flowproof-agent", "crates/flowproof-adapters", "crates/flowproof-cli", "crates/flowproof-python"]
 
 [workspace.package]
-version = "0.4.1"
+version = "0.5.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.4.1 → flowproof-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.4.1
+Version: 0.5.0
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.4.1 → flowproof-0.5.0}/crates/flowproof-agent/src/recorder.rs

@@ -63,6 +63,11 @@ pub enum RecordError {
     Driver(#[from] flowproof_driver::DriverError),
     #[error(transparent)]
     Secret(#[from] flowproof_trace::secret::MissingSecret),
+    /// A declared secret leaked into the run's observable corpus, or the
+    /// corpus could not be scanned (a too-short secret, a corpus-less flow
+    /// kind). Names variables and the corpus element, never the value.
+    #[error("{0}")]
+    SecretLeak(String),
     #[error("cannot write trace {path}: {source}")]
     Io {
         path: String,
@@ -1225,15 +1230,18 @@ fn web_browser_from_setup(
 /// Poll an out-of-band probe until it holds or the bound elapses — the row
 /// may still be committing, the API still converging. Configuration errors
 /// (missing connection env) fail immediately.
+/// Returns the probe's response body (an `Api` probe's response text, the
+/// corpus a secret-leak scan reads; `None` for `Sql`) once the expectation
+/// holds.
 fn poll_oob(
     probe: &flowproof_driver::oob::OobProbe,
     timeout_ms: u64,
     intent: &str,
-) -> Result<(), RecordError> {
+) -> Result<Option<String>, RecordError> {
     let deadline = std::time::Instant::now() + Duration::from_millis(timeout_ms);
     loop {
         match flowproof_driver::oob::check(probe)? {
-            Ok(()) => return Ok(()),
+            Ok(body) => return Ok(body),
             Err(reason) => {
                 if std::time::Instant::now() >= deadline {
                     return Err(RecordError::AssertMismatch {
@@ -1518,6 +1526,22 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
     old_steps: Option<&[Step]>,
 ) -> Result<RecordSummary, RecordError> {
     let mut reuse = old_steps.map(ReuseCursor::new);
+    // `assert_no_secret_leak` selectors, grouped by asserting step. The scan
+    // is a whole-run store-guard: it runs on the in-memory corpus BEFORE the
+    // trace is minted, so a leak fails the run and NO trace is written. A flow
+    // that never uses the feature builds no corpus and behaves byte-for-byte
+    // as before.
+    let leak_assertions = spec.secret_leak_assertions();
+    let scan_secrets = !leak_assertions.is_empty();
+    // Honesty, not a vacuous pass: a flow kind with no readable corpus is
+    // refused at execution (the same rule `assert_no_egress` follows), before
+    // launching anything, so nothing is minted for a control that cannot be
+    // checked. web and api are covered; agent never reaches this recorder.
+    if scan_secrets && !flowproof_trace::secret_scan::has_readable_corpus(spec.app.id()) {
+        return Err(RecordError::SecretLeak(
+            flowproof_trace::secret_scan::capability_error(spec.app.id()),
+        ));
+    }
     let target = launch_target(spec)?;
     // The session is an inline mapping by now: a `session: <name>` ref is
     // dereferenced to its identity's inline setup at flow load, so record
@@ -1581,6 +1605,12 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
     let mut captures: std::collections::HashMap<String, String> = std::collections::HashMap::new();
     let mut prior_intents: Vec<String> = Vec::new();
     let mut llm_used = false;
+    // The secret-leak corpus, held in memory for this run only, exactly like a
+    // resolved `${VAR}` value: (a) the web surface text read at each step
+    // boundary (the same text `page shows` reads, not the page source) and
+    // (b) every `assert_api` response body probed. Populated only when the
+    // flow asserts `assert_no_secret_leak`.
+    let mut secret_corpus: Vec<(String, String)> = Vec::new();
     for spec_step in &spec.steps {
         let intent = spec_step.intent().to_string();
         let actions = author_actions(
@@ -1714,7 +1744,7 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
                             None => None,
                         },
                     };
-                    poll_oob(&probe, *timeout_ms, &spec_step.intent())?
+                    poll_oob(&probe, *timeout_ms, &spec_step.intent())?;
                 }
                 ResolvedAction::AssertApi {
                     method,
@@ -1747,7 +1777,14 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
                             None => None,
                         },
                     };
-                    poll_oob(&probe, *timeout_ms, &spec_step.intent())?
+                    let body = poll_oob(&probe, *timeout_ms, &spec_step.intent())?;
+                    // The response body joins the corpus a secret-leak scan
+                    // reads. Held in memory, never written to the trace.
+                    if scan_secrets {
+                        if let Some(text) = body {
+                            secret_corpus.push(("an assert_api response body".to_string(), text));
+                        }
+                    }
                 }
                 ResolvedAction::PressKey { key, modifiers } => {
                     let mods: Vec<flowproof_driver::KeyMod> =
@@ -2063,6 +2100,25 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
                 }
             }
         }
+        // Step boundary: sample the web surface text (the same text `page
+        // shows` reads, not the page source). Per-step, not continuous: a
+        // secret that flashes into the DOM between boundaries is invisible to
+        // this control, an exclusion the audit output echoes.
+        if scan_secrets && spec.app.id() == "web" {
+            secret_corpus.push((
+                "the surface text at a step boundary".to_string(),
+                driver.surface_text()?,
+            ));
+        }
+    }
+
+    // STORE-GUARD: scan the in-memory corpus BEFORE any trace is minted, by
+    // the SAME mechanism replay uses. A leak (or a too-short secret, or a
+    // corpus-less kind) fails the run here, so the leaked value never reaches
+    // disk and no trace is written.
+    if scan_secrets {
+        flowproof_trace::secret_scan::scan_corpus(&leak_assertions, &secret_corpus)
+            .map_err(RecordError::SecretLeak)?;
     }
 
     let recording = recorder.and_then(flowproof_driver::RunRecorder::finish);

{flowproof-0.4.1 → flowproof-0.5.0}/crates/flowproof-agent/src/rules.rs

@@ -471,6 +471,11 @@ fn resolve_step_inner(app: &str, step: &SpecStep) -> Result<Vec<ResolvedAction>,
                     .map_or(ASSERT_TIMEOUT_MS, |s| s * 1000),
             }]);
         }
+        // A whole-run control assertion, not a per-step driver action: the
+        // record-time store-guard and the replay scan enforce it out of band
+        // against the captured corpus. It performs nothing on the UI, so it
+        // resolves to zero actions on every app kind.
+        SpecStep::AssertNoSecretLeak { .. } => return Ok(Vec::new()),
         SpecStep::AssertScreenshot { assert_screenshot } => {
             if assert_screenshot.name.trim().is_empty()
                 || assert_screenshot.name.contains(['/', '\\'])

{flowproof-0.4.1 → flowproof-0.5.0}/crates/flowproof-agent/src/spec.rs

@@ -406,6 +406,11 @@ impl FlowSpec {
         let bad = |m: String| Err(SpecError::Agent(m));
         let is_agent = self.app.id() == "agent";
 
+        // `assert_no_secret_leak` is deliberately NOT here: v1 extends it to
+        // web and api flows, and any flow kind still without a readable corpus
+        // is refused at execution as a CAPABILITY error (never a vacuous
+        // parse-time rejection), the same honesty rule `assert_no_egress`
+        // follows at execution.
         let agent_only_step = self.steps.iter().find(|step| {
             matches!(
                 step,
@@ -413,7 +418,6 @@ impl FlowSpec {
                     | SpecStep::AssertToolCall { .. }
                     | SpecStep::AssertNoToolCall { .. }
                     | SpecStep::AssertNoEgress
-                    | SpecStep::AssertNoSecretLeak { .. }
             )
         });
 
@@ -816,6 +820,28 @@ impl FlowSpec {
         out
     }
 
+    /// The `assert_no_secret_leak` steps as corpus-scan assertions: each
+    /// step's `${VAR}` selectors paired with its 1-based position in `steps:`,
+    /// for the failure message. The single source both the record store-guard
+    /// and every replay build their scan from, so a web/api flow scans the
+    /// same names at both phases exactly as an agent flow does.
+    pub fn secret_leak_assertions(&self) -> Vec<flowproof_trace::secret_scan::LeakAssertion> {
+        self.steps
+            .iter()
+            .enumerate()
+            .filter_map(|(i, step)| match step {
+                SpecStep::AssertNoSecretLeak {
+                    assert_no_secret_leak,
+                } => Some(flowproof_trace::secret_scan::LeakAssertion {
+                    // 1-based, so the message reads as an author counts steps.
+                    step_index: i + 1,
+                    selectors: assert_no_secret_leak.clone(),
+                }),
+                _ => None,
+            })
+            .collect()
+    }
+
     /// Dereference a `session: <name>` ref against a suite's `identities:`
     /// map, replacing it with the named identity's inline setup - a
     /// LOAD-TIME COPY, so the trace stays self-contained (it carries the
@@ -2571,16 +2597,25 @@ mod security_spine_tests {
         }
     }
 
-    /// Agent-only in v1, exactly like `assert_no_egress`: the corpus this
-    /// lane scans is only wired for the model boundary today.
+    /// Web and api flows now carry `assert_no_secret_leak`: v1 extends the
+    /// corpus scan to their surface text and `assert_api` bodies, so the parse
+    /// gate that once made it agent-only is gone. The honesty for corpus-less
+    /// kinds moved to execution (a capability error), not parse.
     #[test]
-    fn assert_no_secret_leak_is_rejected_off_agent_flows() {
-        let err = spec(
+    fn assert_no_secret_leak_parses_on_web_and_api_flows() {
+        let web = spec(
             "name: n\napp: web\nurl: http://x\nsteps:\n  - assert_no_secret_leak: ${DB_PASSWORD}\n",
         )
-        .expect_err("secret-leak on web");
-        assert!(err.to_string().contains("agent step"), "{err}");
-        assert!(err.to_string().contains("assert_no_secret_leak"), "{err}");
+        .expect("secret-leak on web now parses");
+        assert_eq!(
+            web.secret_leak_assertions(),
+            vec![flowproof_trace::secret_scan::LeakAssertion {
+                step_index: 1,
+                selectors: vec!["${DB_PASSWORD}".into()],
+            }]
+        );
+        spec("name: n\napp: api\nsteps:\n  - assert_no_secret_leak: ${API_TOKEN}\n")
+            .expect("secret-leak on api now parses");
     }
 
     /// It round-trips through serialize/reparse: one selector as a string,

{flowproof-0.4.1 → flowproof-0.5.0}/crates/flowproof-cli/src/agent_flow.rs

@@ -556,23 +556,10 @@ struct Plan {
     /// The `assert_no_secret_leak` steps, each naming one or more `${VAR}`
     /// selectors and its 1-based position in the flow's `steps:` (for the
     /// failure message). Only the variable NAMES travel here - never a value.
-    secret_leaks: Vec<SecretLeakStep>,
+    /// The shared type web and api flows also build their scan from.
+    secret_leaks: Vec<flowproof_trace::secret_scan::LeakAssertion>,
 }
 
-/// One `assert_no_secret_leak` step: the `${VAR}` selectors it declares and
-/// its 1-based step position (named in the failure message).
-struct SecretLeakStep {
-    step_index: usize,
-    selectors: Vec<String>,
-}
-
-/// The smallest resolved secret length the corpus scan will accept.
-/// Scanning for a one- or two-character value would fire on almost any
-/// output (the doc's `"1"` example), so a secret shorter than this is
-/// REFUSED at execution rather than asserted imprecisely - a control that
-/// cannot be checked precisely is refused, not weakened.
-const MIN_SECRET_LEN: usize = 4;
-
 impl Plan {
     /// The port the proxy binds: the fixed `proxy_port` for an http driver,
     /// ephemeral (`0`) for a process.
@@ -691,21 +678,14 @@ fn plan(spec: &FlowSpec) -> Result<Plan, String> {
     let mut tool_calls = Vec::new();
     let mut forbidden = Vec::new();
     let mut reply_contains = Vec::new();
-    let mut secret_leaks = Vec::new();
-    for (i, step) in spec.steps.iter().enumerate() {
+    // The secret-leak assertions come from the shared spec accessor, the same
+    // source web and api flows build their scan from.
+    let secret_leaks = spec.secret_leak_assertions();
+    for step in spec.steps.iter() {
         match step {
             SpecStep::AssertToolCall { assert_tool_call } => {
                 tool_calls.push(parse_expectation(assert_tool_call)?);
             }
-            SpecStep::AssertNoSecretLeak {
-                assert_no_secret_leak,
-            } => {
-                secret_leaks.push(SecretLeakStep {
-                    // 1-based, so the message reads as an author counts steps.
-                    step_index: i + 1,
-                    selectors: assert_no_secret_leak.clone(),
-                });
-            }
             SpecStep::AssertNoToolCall {
                 assert_no_tool_call,
             } => {
@@ -767,6 +747,29 @@ pub fn engages_egress(spec: &FlowSpec) -> bool {
     declares_allow || asserts_no_egress
 }
 
+/// The egress destinations containment DENIED during the recorded run, read
+/// from the trace's egress lane as value-free `destination (protocol)`
+/// descriptors. Empty for a flow with no egress lane, an unreadable trace, or
+/// a run that attempted no undeclared egress - so it is safe to call on any
+/// agent trace. Feeds the run record's `evidence.blocked`.
+pub fn egress_blocked(trace_path: &Path) -> Vec<String> {
+    let Ok(raw) = std::fs::read_to_string(trace_path) else {
+        return Vec::new();
+    };
+    let Ok(trace) = serde_json::from_str::<AgentTrace>(&raw) else {
+        return Vec::new();
+    };
+    trace
+        .egress
+        .map(|e| {
+            e.blocked
+                .iter()
+                .map(|ev| format!("{} ({})", ev.destination, ev.protocol))
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
 /// The containment tier a flow's run achieves, on this platform. Pure and
 /// cheap (a kernel probe on Linux); computed both here, to print the report's
 /// tier line, and inside record/replay, to gate `assert_no_egress` and build
@@ -878,14 +881,12 @@ fn secret_corpus(
     corpus
 }
 
-/// Scan the run's captured corpus for any declared secret, by the SAME
-/// mechanism at record and replay, so an unchanged system yields the same
-/// verdict. Resolves each asserted `${VAR}` through the shared resolve-refs
-/// machinery and substring-scans the in-memory corpus; only variable NAMES
-/// are ever stored or printed. A leak names ALL matching variables in a
-/// stable order, the corpus element, and the step index - never the value.
-/// A resolved secret under the minimum length is refused (both phases), in
-/// the same shape as the shipped `MissingSecret` error.
+/// Scan the run's captured corpus for any declared secret, by the SAME shared
+/// mechanism web, api, and replay use, so an unchanged system yields the same
+/// verdict. Builds the agent corpus (model-boundary trajectory + MCP lanes)
+/// and delegates the resolve/refuse/substring-scan to
+/// [`flowproof_trace::secret_scan::scan_corpus`]; only variable NAMES are ever
+/// stored or printed.
 fn check_secret_leak(
     plan: &Plan,
     cassette: &Cassette,
@@ -895,42 +896,7 @@ fn check_secret_leak(
         return Ok(());
     }
     let corpus = secret_corpus(cassette, mcp);
-    for leak in &plan.secret_leaks {
-        // (selector, corpus element) for every variable that appeared,
-        // collected then sorted so two leaks report in a stable order.
-        let mut hits: Vec<(String, String)> = Vec::new();
-        for selector in &leak.selectors {
-            let value =
-                flowproof_trace::secret::resolve_refs(selector).map_err(|e| e.to_string())?;
-            if value.chars().count() < MIN_SECRET_LEN {
-                // Named like MissingSecret: the variable and the minimum,
-                // never the value.
-                return Err(format!(
-                    "assert_no_secret_leak (step {}): {selector} resolves to a value shorter \
-                     than the {MIN_SECRET_LEN}-character minimum needed to scan for it \
-                     precisely; a secret that short cannot be asserted without false positives",
-                    leak.step_index
-                ));
-            }
-            if let Some((element, _)) = corpus.iter().find(|(_, text)| text.contains(&value)) {
-                hits.push((selector.clone(), element.clone()));
-            }
-        }
-        if !hits.is_empty() {
-            hits.sort();
-            let list = hits
-                .iter()
-                .map(|(selector, element)| format!("{selector} in {element}"))
-                .collect::<Vec<_>>()
-                .join("; ");
-            return Err(format!(
-                "assert_no_secret_leak (step {}): a declared secret appeared in the run \
-                 output: {list}",
-                leak.step_index
-            ));
-        }
-    }
-    Ok(())
+    flowproof_trace::secret_scan::scan_corpus(&plan.secret_leaks, &corpus)
 }
 
 fn parse_expectation(text: &str) -> Result<ToolCallExpectation, String> {