test_no_secret_leak.py
python
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
1 day ago
| 1 | """Security tests — no secrets or absolute paths in output.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import re |
| 6 | from io import StringIO |
| 7 | from pathlib import Path |
| 8 | from unittest.mock import patch |
| 9 | |
| 10 | from cli.context import CliContext |
| 11 | from cli.main import main |
| 12 | from cli.output import OutputContext |
| 13 | from tests.support import git_status_runner |
| 14 | |
| 15 | |
| 16 | ABS_PATH_RE = re.compile(r"/(?:Users|home|tmp|var)/") |
| 17 | |
| 18 | |
| 19 | def test_no_absolute_paths_in_status_json(tmp_path: Path) -> None: |
| 20 | from tests.support import run_cli |
| 21 | |
| 22 | run_cli(["init", "--regime", "git-only", "--non-interactive"], cwd=tmp_path) |
| 23 | out = StringIO() |
| 24 | with patch("sys.stdout", out): |
| 25 | main( |
| 26 | ["status", "--json"], |
| 27 | ctx=CliContext.create( |
| 28 | cwd=tmp_path, |
| 29 | runner=git_status_runner(), |
| 30 | output=OutputContext(json_mode=True), |
| 31 | ), |
| 32 | ) |
| 33 | text = out.getvalue() |
| 34 | assert not ABS_PATH_RE.search(text) |
| 35 | assert "token" not in text.lower() |
File History
2 commits
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
1 day ago
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439
feat: K1-P1 complete — agent provenance, build-verification…
Sonnet 4.6
patch
52 days ago