Files
gbrain/test/config-ensure-gitignore.test.ts
T
e227965024 v0.36.5.0 feat: secure DATABASE_URL access for shell jobs (inherit: ["database_url"]) (#1192)
* v0.36.5.0 feat: secure DATABASE_URL access for shell jobs (inherit: ["database_url"])

Replaces PR #1137's plaintext-config / plaintext-env workarounds with code.
Shell-job params gain `inherit: ["database_url"]`, validated pre-enqueue in
both the CLI (`gbrain jobs submit`) and `submit_job` MCP op handler. Worker
resolves the value from its own loadConfig() at child-spawn time; the
persisted `minion_jobs.data` row stores only the name. Plain
`env: { GBRAIN_DATABASE_URL: ... }` / `env: { DATABASE_URL: ... }` /
`env: { GBRAIN_DIRECT_DATABASE_URL: ... }` are rejected pre-enqueue with a
paste-ready hint pointing at `inherit:`.

Codex pre-landing review caught two bypasses + one missing shadow name:
- H1: cmd/argv inline-secret regex scan (cmd:"GBRAIN_DATABASE_URL=... gbrain
  sync" was a clean bypass — fixed)
- H3: GBRAIN_DIRECT_DATABASE_URL added to shadowKeys
- H2: honest docs about output-side leakage (stdout_tail/stderr_tail can still
  carry the value if the script prints it; that's the script author's
  responsibility, not gbrain's)

Also: gbrain doctor learns home_dir_in_worktree (warns when ~/.gbrain lives
inside a git worktree); ~/.gbrain/.gitignore retroactive via saveConfig +
post-upgrade.

New canonical guide: docs/guides/agent-to-gbrain.md (two-domain framing for
downstream agent authors: MCP ops via OAuth vs localOnly admin ops via
shell-job inherit:).

Closes #1137. Tests: +53 new (21 validator + 12 inherit-record + 6
ensureGitignore + 5 doctor + 2 PGLite E2E + 7 codex-driven H1/H3 cases).

Credit: @wintermute filed PR #1137 which made the env-stripping gap visible
enough to fix in code. Thank you.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* v0.36.5.0 redesign: free-form inherit:, drop closed enum

User feedback: "agent spawning minions should have agency to do what it wants
with secrets and pass only the ones that it needs. don't be a security nazi
please."

Replaces the closed INHERITABLE enum (database_url only) with three small
helpers in shell-inherit.ts:

- INHERIT_NAME_RE: snake_case shape guard. Rejects __proto__, leading
  underscore, uppercase, path-traversal. Prototype-pollution defense.
- deriveEnvKey(name): config-key → child-env-key. Uppercase by default with
  one override: database_url → GBRAIN_DATABASE_URL.
- resolveInheritValue(cfg, name): value lookup with Object.hasOwn.

inherit: now accepts any snake_case config-key the worker has. Agent picks
what it needs per-job (database_url, anthropic_api_key, voyage_api_key, or
any custom field). Validator does NOT police WHICH keys — single-uid trust
model treats agent as peer of worker.

Drops the v0.36.5.0-RC rules that were paternalistic for the actual threat
model:
- closed-enum check
- env-shadow rejection
- cmd/argv inline-secret scan

Keeps the parts that defend real problems:
- pre-enqueue validation (closes the persistence-before-throw window)
- snake_case regex (prototype-pollution + audit-log readability)
- fail-fast on missing config value (UX guardrail, not security)

Tests: shell-validate (existing rules + new free-form + prototype-pollution
defense + T1 regression guard) and shell-inherit (regex matrix, deriveEnvKey
per-name, resolveInheritValue with hasOwn defense). E2E case now exercises
inherit:["anthropic_api_key"] to prove genuinely free-form.

Docs and CHANGELOG rewritten to reflect the open design + the design-arc
story (closed → cut → free-form). Migration file too.

7653 unit tests green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* v0.36.5.0 add: redact_secrets opt-in for stdout/stderr scrubbing

Honest defense for the documented output-side leakage. When a script prints
an inherited secret, the value lands plaintext in
result.stdout_tail / result.stderr_tail / error_text. v0.36.5.0 adds:

- `redact_secrets: true` ShellJobParams field
- `--redact-secrets` CLI convenience flag on `gbrain jobs submit shell`
- shell-redact.ts: pure `redactSecretsInText(text, secrets)` helper
  (string-mode replaceAll; regex metachars in values stay literal)
- Handler post-processes both tails before throw/return, so the persisted
  row carries `<REDACTED:name>` tokens instead of values

Only inherit-resolved values are scrubbed. env: values are not (those are
the agent's "fine in the row" channel by design). Heuristic — defeats
accidental `echo "$GBRAIN_DATABASE_URL"`, not adversarial encode-then-print.
Default false for back-compat.

Tests:
- test/minions-shell-redact.test.ts (9 cases): pure-function behavior,
  regex-metachar safety, multi-secret independent redaction, substring
  overlap, empty-input/map edge cases
- test/minions-shell-validate.test.ts: +4 cases for redact_secrets shape
- test/e2e/minions-shell-pglite.test.ts: +2 cases proving redact_secrets:
  true scrubs persisted row AND redact_secrets:false preserves plaintext
  (back-compat regression guard)

Docs + CHANGELOG + migration file + CLAUDE.md updated.

7667 unit tests green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-19 13:12:40 -07:00

94 lines
3.5 KiB
TypeScript

/**
* Tests for `ensureGitignore()` in `src/core/config.ts` (v0.35.8.0).
*
* Idempotent retroactive coverage: every config-writing path (saveConfig +
* post-upgrade) lays down `~/.gbrain/.gitignore` containing the single line
* `*`. The helper MUST NOT clobber a `.gitignore` whose content the user
* has customized.
*/
import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'fs';
import { join } from 'path';
import { tmpdir } from 'os';
import { withEnv } from './helpers/with-env.ts';
import { ensureGitignore, configDir } from '../src/core/config.ts';
let testHome: string;
beforeEach(() => {
testHome = join(tmpdir(), `gbrain-eg-${Date.now()}-${Math.random().toString(36).slice(2)}`);
mkdirSync(testHome, { recursive: true });
});
afterEach(() => {
try { rmSync(testHome, { recursive: true, force: true }); } catch { /* best-effort */ }
});
describe('ensureGitignore', () => {
test('creates ~/.gbrain/.gitignore with single * when missing', async () => {
await withEnv({ GBRAIN_HOME: testHome }, async () => {
ensureGitignore();
const file = join(configDir(), '.gitignore');
expect(existsSync(file)).toBe(true);
expect(readFileSync(file, 'utf-8')).toBe('*\n');
});
});
test('no-op when .gitignore already exists with non-empty content (user customization preserved)', async () => {
await withEnv({ GBRAIN_HOME: testHome }, async () => {
// Prime: user wrote their own .gitignore first.
const dir = configDir();
mkdirSync(dir, { recursive: true });
const file = join(dir, '.gitignore');
const userContent = '*.tmp\n# my custom gitignore\nlogs/\n';
writeFileSync(file, userContent);
// Now call ensureGitignore.
ensureGitignore();
// Assert: untouched.
expect(readFileSync(file, 'utf-8')).toBe(userContent);
});
});
test('writes default when .gitignore exists but is empty', async () => {
await withEnv({ GBRAIN_HOME: testHome }, async () => {
const dir = configDir();
mkdirSync(dir, { recursive: true });
const file = join(dir, '.gitignore');
writeFileSync(file, '');
ensureGitignore();
expect(readFileSync(file, 'utf-8')).toBe('*\n');
});
});
test('idempotent: second call is a no-op', async () => {
await withEnv({ GBRAIN_HOME: testHome }, async () => {
ensureGitignore();
const file = join(configDir(), '.gitignore');
const first = readFileSync(file, 'utf-8');
ensureGitignore();
const second = readFileSync(file, 'utf-8');
expect(second).toBe(first);
});
});
test('honors GBRAIN_HOME: writes under $GBRAIN_HOME/.gbrain/, not $HOME', async () => {
await withEnv({ GBRAIN_HOME: testHome }, async () => {
ensureGitignore();
const expected = join(testHome, '.gbrain', '.gitignore');
expect(existsSync(expected)).toBe(true);
});
});
test('does not throw on read failure of existing file (best-effort)', async () => {
// Hard to simulate cleanly cross-platform; the contract is that ANY
// unexpected fs error is logged to stderr and the function returns
// normally without throwing. Tested indirectly by the idempotency case
// above and by the surface-level "function returns void, never throws"
// contract (no expect.toThrow on any call).
await withEnv({ GBRAIN_HOME: testHome }, async () => {
expect(() => ensureGitignore()).not.toThrow();
});
});
});