test_pilot_no_secret_leak.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security: pilot migrate/sync reports contain no secret leakage (§K6.10).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from pathlib import Path |
| 6 | |
| 7 | from tests.support import PILOT, git_status_runner, muse_mirror_status_runner, run_cli, seed_pilot_tree |
| 8 | |
| 9 | |
| 10 | SECRETISH = ( |
| 11 | "sk-live-", |
| 12 | "ghp_", |
| 13 | "xoxb-", |
| 14 | "BEGIN PRIVATE KEY", |
| 15 | "password=", |
| 16 | ) |
| 17 | |
| 18 | |
| 19 | def test_pilot_no_secret_leak_in_lock_or_status(tmp_path: Path, capsys) -> None: |
| 20 | seed_pilot_tree( |
| 21 | tmp_path, |
| 22 | handover_rel="docs/OVERSEER-HANDOVER.md", |
| 23 | handover_text="# H\n", |
| 24 | roadmap_rel="docs/ROADMAP.md", |
| 25 | roadmap_text="# R\n", |
| 26 | ) |
| 27 | assert ( |
| 28 | run_cli( |
| 29 | [ |
| 30 | "init", |
| 31 | "--migrate", |
| 32 | "--from-config", |
| 33 | str(PILOT / "config-scooling.yaml"), |
| 34 | "--non-interactive", |
| 35 | ], |
| 36 | cwd=tmp_path, |
| 37 | runner=muse_mirror_status_runner(tmp_path), |
| 38 | ) |
| 39 | == 0 |
| 40 | ) |
| 41 | lock_text = (tmp_path / ".overseer/version.lock").read_text(encoding="utf-8") |
| 42 | for needle in SECRETISH: |
| 43 | assert needle not in lock_text |
| 44 | run_cli( |
| 45 | ["status", "--check-footprint", "--json"], |
| 46 | cwd=tmp_path, |
| 47 | runner=muse_mirror_status_runner(tmp_path), |
| 48 | json_mode=True, |
| 49 | ) |
| 50 | out = capsys.readouterr().out + capsys.readouterr().err |
| 51 | for needle in SECRETISH: |
| 52 | assert needle not in out |
| 53 | assert "/Users/" not in out |