fix(secrets): scan typed JSON collision values

2026-07-11 22:31:49 +05:30
parent 331e7bea65
commit 2e4e215da2
4 changed files with 73 additions and 6 deletions
@@ -402,6 +402,43 @@ describe("buildShareSnapshot", () => {
 		expect(flat).not.toContain(regexSecret);
 		expect(flat).toContain(`${friendlyName}_`);
 	});
+
+	test("collects regex values from tool arguments that resemble image blocks", () => {
+		const plainSecret = "OTHERSECRET";
+		const friendlyName = "TOKABC123";
+		const regexSecret = "tok_abc123";
+		const ts = "2026-06-12T00:00:00.000Z";
+		const entries: SessionEntry[] = [
+			{
+				type: "message",
+				id: "a1",
+				parentId: null,
+				timestamp: ts,
+				message: {
+					role: "assistant",
+					content: [
+						{ type: "toolCall", id: "call-1", name: "read", arguments: { type: "image", value: regexSecret } },
+					],
+					timestamp: 1,
+				},
+			} as unknown as SessionEntry,
+		];
+		const sm = {
+			getHeader: () => ({ ...sessionData([], "x").header, title: `remember ${plainSecret}` }),
+			getEntries: () => entries,
+			getLeafId: () => "a1",
+		} as unknown as SessionManager;
+		const obfuscator = new SecretObfuscator([
+			{ type: "plain", content: plainSecret, friendlyName },
+			{ type: "regex", content: "tok_[a-z0-9]+" },
+		]);
+
+		const flat = JSON.stringify(buildShareSnapshot(sm, { obfuscator }));
+
+		expect(flat).not.toContain(plainSecret);
+		expect(flat).not.toContain(regexSecret);
+		expect(flat).not.toContain(`${friendlyName}_`);
+	});
 });

 describe("normalizeShareServerUrl", () => {