tests/test_no_leaks.py

#!/usr/bin/env python3 """ test_no_leaks.py - the two leaks that were real, kept closed. Both were found on 2026-08-20 by another crew auditing this code, and both had shipped. Neither was theoretical: each is reproduced here against a transcript carrying planted values, and each FAILED before the fix. 1. TRUNCATE-BEFORE-SCRUB. Titles are cut to 120 characters. Redaction ran after the cut, so a cut landing inside a token left a fragment too short to match its own rule - it survived the scrub and was stored. A 40-character 'ghp_...' was stored as 'ghp_AAAAAAAAAAAAAA'. 2. SECRETS IN FILE PATHS. files_read / files_modified went into the row raw. A path like /tmp/AKIAIOSFODNN7EXAMPLE/out.txt stored a complete, working credential. The fix redacts once at the parse boundary, so nothing raw reaches a truncation and no column can leak what never entered. THE TEST ASSERTS ITS OWN VECTORS FIRST. Both planted values are checked against the redactor before use: a test whose secret is not detectable in the first place would pass whatever the code did, and prove nothing. That mistake was made twice while writing this file. python3 tests/test_no_leaks.py """ from __future__ import annotations import json import os import sys import tempfile from pathlib import Path BIN = Path(__file__).resolve().parent.parent / "bin" sys.path.insert(0, str(BIN)) TOKEN = "ghp_" + "A" * 36 AKIA = "AKIA" + "IOSFODNN7EXAMPLE" # Sized so the 120-char title cut lands INSIDE the token, leaving fewer characters # than the github-token rule requires. Get this wrong and the fragment still # matches, the scrub still fires, and the test passes for the wrong reason. PREFIX = ("deploy the service and mind the ordering of every single step in the " "runbook here, then use the token ") def main() -> int: import redact problems: list[str] = [] if "github-token" not in redact.scrub(TOKEN)[2]: problems.append("TOKEN vector is not detectable by the redactor - test is void") if "aws-akid" not in redact.scrub(AKIA)[2]: problems.append("AKIA vector is not detectable by the redactor - test is void") if not (100 <= len(PREFIX) < 120): problems.append(f"PREFIX is {len(PREFIX)} chars; the 120 cut must land inside the token") if problems: for p in problems: print(" SETUP: " + p, file=sys.stderr) return 2 root = tempfile.mkdtemp() os.environ["FRIDAY_RECALL_ROOT"] = root os.environ["FRIDAY_RECALL_DB"] = os.path.join(root, "r.db") t = Path(root) / "t.jsonl" ts = "2026-08-20T23:00:00Z" t.write_text( json.dumps({"type": "user", "timestamp": ts, "message": {"content": PREFIX + TOKEN + " to authenticate"}}) + "\n" + json.dumps({"type": "assistant", "timestamp": ts, "message": {"content": [ {"type": "tool_use", "name": "Edit", "input": {"file_path": f"/tmp/{AKIA}/out.txt"}}]}}) + "\n", encoding="utf-8") import store, capture store.connect().close() capture.ingest(t, "leaktest") con = store.connect(readonly=True) blob = "" for table, cols in (("observations", "title,subtitle,body,facts,files_read,files_modified"), ("prompts", "body"), ("sessions", "title,opening_prompt")): for row in con.execute(f"SELECT {cols} FROM {table}"): blob += " ".join(str(x) for x in row if x) fails = [] if TOKEN[:12] in blob: fails.append("LEAK 1: a truncated token fragment reached the store") if AKIA in blob: fails.append("LEAK 2: a credential inside a file path reached the store") for f in fails: print(" FAIL " + f, file=sys.stderr) if fails: print("\nNO-LEAK TEST FAILED", file=sys.stderr) return 1 print("no-leak test OK - truncated tokens and path-embedded credentials both blocked") return 0 if __name__ == "__main__": sys.exit(main())