mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-11 23:40:28 -10:00
* Tools: arg-tolerance, ask_user, secret scrubbing, structured results, hardening First module of the tools->agent->tui chain that leads to the TUI shell (off main). Scope: internal/tools (+ a 1-line specialist vocabulary update). 3-way merged onto main's specialist drift (RunOptions tool-context fields, Safety.AdvertiseInAuto, optionsAwareTool dispatch, PropertySchema, base structured Result) and grafted the runtime-core additions: - Shared arg-tolerance layer (argtolerance.go: alias-aware/type-strict arg resolution + slice coercion) adopted across all tools so weak models' non-canonical arg shapes are accepted; bool/int coercion in args.go. - ask_user tool (interactive clarifying questions) wired into CoreReadOnlyTools; nested PropertySchema (Properties/Required) for its object questions + update_plan. - Secret scrubbing at the registry boundary (scrubResultSecrets via internal/redaction) applied to every tool-execution path, incl. the optionsAwareTool dispatch; structured Result (Display/Redacted/ChangedFiles). - mutation_targets (paths a mutating tool will write, for session checkpointing) + hardened grep (symlink confinement), apply_patch, bash, edit/write. EXCLUDED per the module split: the blueprint task tool (subagents — another dev's area; the merged specialist Task is separate) and the skill tool (ships with the later skills module); plus their subagent-only registry helpers (Without/isolateForChild). ask_user is now a core tool, so internal/specialist knownToolNames adds "ask_user" to keep the TestKnownToolNamesMatchCoreRegistry cross-package invariant. No new deps; build/vet/-race/windows/full-suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * Address #119 review (CodeRabbit): scrub Display, validate apply_patch mutation paths, narrow test skips - registry.go: scrubResultSecrets now redacts Result.Display.Summary too (not just Output), so a caller preferring Display can't bypass the boundary redaction. - mutation_targets.go: apply_patch targets now run through validatePatchPaths(applyRoot, ...) before being returned, so a traversal patch (../x) can't yield an out-of-workspace checkpoint target. Regression case added to TestMutationTargetsRejectsEscapingPaths. - argtolerance_test/write_tools_test: the apply_patch tests no longer Skipf on ANY non-OK result (which masked real diff/apply regressions); they skip ONLY when the git binary is unavailable (gitApplyUnavailable helper checks exec's 'executable file not found') and otherwise Fatalf. build/vet/-race/full-suite + GOOS=windows build green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * Address #119 re-review (CodeRabbit): best-effort multiSelect + Display.Summary scrub coverage - ask_user: an uncoercible multiSelect no longer fails the whole call — it's a UI hint, so it defaults to false (best-effort, mirroring the lenient options path). Test: TestParseAskUserQuestionsLenientOptions extended. - registry_test: TestRunWithOptionsScrubsSecretsForAllCallers now also leaks a secret via Result.Display.Summary and asserts it is redacted, locking in the boundary scrub for the structured-result path (secretTool gained a display field). build/vet/-race/full-suite + GOOS=windows build green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * Address #119 review (@Vasanthdev2004): scrub ALL registry return paths + harden intArg [blocker] RunWithOptions now scrubs every return path, not just tool-execution: a named return + a single 'defer scrubResultSecrets(result)' covers the unknown-tool, sandbox-deny, sandbox-approval-required, permission-required and permission-denied early returns too. Previously a sandbox denial that echoed a secret-bearing path/arg returned it raw with Redacted=false. Regression: TestRunWithOptionsScrubsSecretsOnDenialPaths (permission-denied reason carrying a token -> scrubbed + Redacted). [non-blocking] intArg fails closed on NaN/Inf/out-of-range floats (and their string forms) via a floatToInt helper, before any implementation-defined cast. Tests added for NaN/Inf/NaN-string/non-integral. build/vet/-race/full-suite + GOOS=windows build green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * Address #119 review (CodeRabbit grep TOCTOU + anandh8x dependency blockers) - grep: close the confinement TOCTOU — confineGrepFile now returns the symlink-RESOLVED path and collectGrepMatches reads THAT (not the raw candidate), so a symlink swapped in between check and read can't escape the workspace. - ask_user: removed from CoreReadOnlyTools. It needs the agent loop's interactive intercept (OnAskUser), which is in the (unmerged) agent module; without it the tool only returns the non-interactive fallback. The tool still ships (NewAskUserTool); the agent module registers it in core + wires the intercept together. Reverted the specialist knownToolNames 'ask_user' entry + the ask_user-in-core test accordingly. - update_plan: reverted the plan schema to a flat array (item structure documented in the description). The structured nested-object Items schema depends on the agent's PropertySchema serializer (propertyToRuntimeMap) passing nested Properties/Required through to providers, which is in the agent module; a nested schema here would be silently dropped. PropertySchema.Properties/Required fields are kept (used by ask_user.go's own schema + the later MCP module). build/vet/-race/full-suite + GOOS=windows build green; no new deps. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * Harden #119 from adversarial self-review: sandbox alias-gate, Meta scrub, intArg 2^63 A multi-dimension adversarial review of the tools diff surfaced 3 real issues beyond the reviewer rounds: - [major/security] write_file/edit_file path aliases file_path/filename/filepath bypassed the sandbox workspace+symlink gate: sandbox.requestPaths only inspected path/cwd/file/dir, so an aliased target skipped enforcement (same class as audit H4). Aligned requestPaths with the tools' path-alias lists (internal/sandbox/risk.go). The tools' own resolveWorkspaceTargetPath still confined, but the sandbox LAYER/audit/symlink-check was silently skipped. Regression: TestRegistrySandboxGatesPathAliasKeys. - [minor] scrubResultSecrets skipped Result.Meta, which is forwarded to the transcript and carries model-controlled strings (glob pattern, bash cwd). Now scrubs Meta values too. Covered in TestRunWithOptionsScrubsSecretsForAllCallers. - [minor] floatToInt used f > float64(MaxInt); that constant rounds up to 2^63 so exactly 2^63 slipped to an out-of-range cast. Changed to >=. Test added for 2^63 float+string. build/vet/-race/full-suite + GOOS=windows build green; no new deps. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: KRATOS <[email protected]> Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
108 lines
4.1 KiB
Go
108 lines
4.1 KiB
Go
package tools
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"reflect"
|
|
"testing"
|
|
)
|
|
|
|
func TestMutationTargets(t *testing.T) {
|
|
root := t.TempDir()
|
|
cases := []struct {
|
|
tool string
|
|
args map[string]any
|
|
want []string
|
|
}{
|
|
{"write_file", map[string]any{"path": "a/b.txt", "content": "x"}, []string{"a/b.txt"}},
|
|
{"edit_file", map[string]any{"path": "c.txt", "old_string": "x", "new_string": "y"}, []string{"c.txt"}},
|
|
{"apply_patch", map[string]any{"patch": "--- a/d.txt\n+++ b/d.txt\n@@ -1 +1 @@\n-x\n+y\n"}, []string{"d.txt"}},
|
|
{"bash", map[string]any{"command": "echo hi"}, nil},
|
|
{"read_file", map[string]any{"path": "e.txt"}, nil},
|
|
{"grep", map[string]any{"pattern": "x"}, nil},
|
|
}
|
|
for _, tc := range cases {
|
|
got := MutationTargets(root, tc.tool, tc.args)
|
|
if !reflect.DeepEqual(got, tc.want) {
|
|
t.Errorf("%s: got %v, want %v", tc.tool, got, tc.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestMutationTargetsResolvesAliasKeys(t *testing.T) {
|
|
root := t.TempDir()
|
|
cases := []struct {
|
|
name string
|
|
tool string
|
|
args map[string]any
|
|
want []string
|
|
}{
|
|
{"write_file file alias", "write_file", map[string]any{"file": "x.go", "content": "x"}, []string{"x.go"}},
|
|
{"write_file file_path alias", "write_file", map[string]any{"file_path": "y.go", "content": "x"}, []string{"y.go"}},
|
|
{"write_file filename alias", "write_file", map[string]any{"filename": "z.go", "content": "x"}, []string{"z.go"}},
|
|
{"edit_file file alias", "edit_file", map[string]any{"file": "e.go", "old_string": "a", "new_string": "b"}, []string{"e.go"}},
|
|
{"apply_patch diff alias", "apply_patch", map[string]any{"diff": "--- a/d.txt\n+++ b/d.txt\n@@ -1 +1 @@\n-x\n+y\n"}, []string{"d.txt"}},
|
|
}
|
|
for _, tc := range cases {
|
|
got := MutationTargets(root, tc.tool, tc.args)
|
|
if !reflect.DeepEqual(got, tc.want) {
|
|
t.Errorf("%s: got %v, want %v", tc.name, got, tc.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestMutationTargetsRejectsEscapingPaths(t *testing.T) {
|
|
root := t.TempDir()
|
|
if got := MutationTargets(root, "write_file", map[string]any{"path": "../escape.txt", "content": "x"}); len(got) != 0 {
|
|
t.Errorf("expected no targets for escaping path, got %v", got)
|
|
}
|
|
// apply_patch must also reject a patch whose paths escape the workspace, so it
|
|
// never returns an out-of-workspace checkpoint target.
|
|
escapePatch := "--- a/../escape.txt\n+++ b/../escape.txt\n@@ -1 +1 @@\n-one\n+two\n"
|
|
if got := MutationTargets(root, "apply_patch", map[string]any{"patch": escapePatch}); len(got) != 0 {
|
|
t.Errorf("expected no targets for escaping apply_patch, got %v", got)
|
|
}
|
|
}
|
|
|
|
// Finding 3: with cwd != ".", apply_patch's MutationTargets must return
|
|
// WORKSPACE-relative paths (cwd-prefixed), not paths relative to the patch cwd —
|
|
// otherwise /rewind snapshots the wrong (workspace-root-relative) path.
|
|
func TestMutationTargetsApplyPatchPrefixesCwd(t *testing.T) {
|
|
root := t.TempDir()
|
|
// cwd must exist for the patch to be applicable; MutationTargets resolves it
|
|
// the same way apply_patch does (resolveWorkspacePath -> EvalSymlinks).
|
|
if err := os.MkdirAll(filepath.Join(root, "sub", "dir"), 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
patch := "--- a/d.txt\n+++ b/d.txt\n@@ -1 +1 @@\n-x\n+y\n"
|
|
|
|
got := MutationTargets(root, "apply_patch", map[string]any{"patch": patch, "cwd": "sub/dir"})
|
|
want := []string{"sub/dir/d.txt"}
|
|
if !reflect.DeepEqual(got, want) {
|
|
t.Fatalf("got %v, want %v", got, want)
|
|
}
|
|
|
|
// cwd "." (the default) must keep paths unprefixed.
|
|
got = MutationTargets(root, "apply_patch", map[string]any{"patch": patch, "cwd": "."})
|
|
if !reflect.DeepEqual(got, []string{"d.txt"}) {
|
|
t.Fatalf("cwd=.: got %v, want [d.txt]", got)
|
|
}
|
|
|
|
// Absent cwd behaves like ".".
|
|
got = MutationTargets(root, "apply_patch", map[string]any{"patch": patch})
|
|
if !reflect.DeepEqual(got, []string{"d.txt"}) {
|
|
t.Fatalf("no cwd: got %v, want [d.txt]", got)
|
|
}
|
|
}
|
|
|
|
func TestStripPatchPrefixStripsOnlyOne(t *testing.T) {
|
|
root := t.TempDir()
|
|
// A workspace file under a directory literally named "b".
|
|
got := MutationTargets(root, "apply_patch", map[string]any{
|
|
"patch": "--- a/b/foo.txt\n+++ b/b/foo.txt\n@@ -1 +1 @@\n-x\n+y\n",
|
|
})
|
|
if len(got) != 1 || got[0] != "b/foo.txt" {
|
|
t.Fatalf("expected [b/foo.txt], got %v", got)
|
|
}
|
|
}
|