aaronrene / overseer-kit public
test_pilot_no_secret_leak.py python
53 lines 1.4 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 2 days ago
1 """Security: pilot migrate/sync reports contain no secret leakage (§K6.10)."""
2
3 from __future__ import annotations
4
5 from pathlib import Path
6
7 from tests.support import PILOT, git_status_runner, muse_mirror_status_runner, run_cli, seed_pilot_tree
8
9
10 SECRETISH = (
11 "sk-live-",
12 "ghp_",
13 "xoxb-",
14 "BEGIN PRIVATE KEY",
15 "password=",
16 )
17
18
19 def test_pilot_no_secret_leak_in_lock_or_status(tmp_path: Path, capsys) -> None:
20 seed_pilot_tree(
21 tmp_path,
22 handover_rel="docs/OVERSEER-HANDOVER.md",
23 handover_text="# H\n",
24 roadmap_rel="docs/ROADMAP.md",
25 roadmap_text="# R\n",
26 )
27 assert (
28 run_cli(
29 [
30 "init",
31 "--migrate",
32 "--from-config",
33 str(PILOT / "config-scooling.yaml"),
34 "--non-interactive",
35 ],
36 cwd=tmp_path,
37 runner=muse_mirror_status_runner(tmp_path),
38 )
39 == 0
40 )
41 lock_text = (tmp_path / ".overseer/version.lock").read_text(encoding="utf-8")
42 for needle in SECRETISH:
43 assert needle not in lock_text
44 run_cli(
45 ["status", "--check-footprint", "--json"],
46 cwd=tmp_path,
47 runner=muse_mirror_status_runner(tmp_path),
48 json_mode=True,
49 )
50 out = capsys.readouterr().out + capsys.readouterr().err
51 for needle in SECRETISH:
52 assert needle not in out
53 assert "/Users/" not in out
File History 2 commits
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 2 days ago
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 54 days ago