48 lines
1.5 KiB
Python
48 lines
1.5 KiB
Python
"""Product-semantics coverage for WebUI credential-masking guidance (#5871)."""
|
|
|
|
import re
|
|
|
|
from api.streaming import _WEBUI_PROGRESS_PROMPT, _webui_ephemeral_system_prompt
|
|
|
|
|
|
def _redaction_guidance() -> str:
|
|
return next(
|
|
line for line in _WEBUI_PROGRESS_PROMPT.splitlines()
|
|
if "automatically redacted" in line
|
|
)
|
|
|
|
|
|
def test_progress_prompt_explains_intentional_credential_redaction():
|
|
guidance = _redaction_guidance()
|
|
|
|
assert "Password, API-key, token, and secret fields" in guidance
|
|
assert "intentional redaction" in guidance
|
|
assert "not placeholder text or user input errors" in guidance
|
|
assert "do not tell the user a stored credential is wrong" in guidance
|
|
assert "masked value alone" in guidance
|
|
|
|
|
|
def test_redaction_guidance_flows_into_ephemeral_system_prompt():
|
|
prompt = _webui_ephemeral_system_prompt(
|
|
"Use a concise tone.",
|
|
surface_context={"source": "webui"},
|
|
)
|
|
|
|
assert _redaction_guidance() in prompt
|
|
|
|
|
|
def test_progress_prompt_retains_secret_leak_prevention_guidance():
|
|
assert (
|
|
"Do not reveal hidden reasoning, chain-of-thought, private scratchpads, "
|
|
"secrets, raw logs, or long tool output."
|
|
) in _WEBUI_PROGRESS_PROMPT
|
|
|
|
|
|
def test_redaction_guidance_does_not_teach_concrete_key_or_mask_formats():
|
|
guidance = _redaction_guidance()
|
|
|
|
assert "***" not in guidance
|
|
assert "..." not in guidance
|
|
assert not re.search(r"\b(?:sk-|ghp_|github_pat_|xox[baprs]-|AKIA)\S+", guidance)
|
|
assert not re.search(r"\b[A-Za-z0-9_-]{24,}\b", guidance)
|