Files
clawhub/scripts/worker-console-guard.test.ts
Jesse Merhi 2deb1b75e9 Harden worker secret logging (#2784)
* fix: redact scan worker artifact errors

* fix: harden worker secret logging

* fix: keep worker claim failures failing

* fix: scan diagnostics as files

* fix: pin diagnostics scanner image

* fix: narrow worker redaction boundary

* fix: avoid custom worker secret patterns

* fix: centralize worker transport redaction

* fix: redact persisted worker failure secrets

* fix: fail security worker on claim outages

* fix: redact structured diagnostic secret fields

* fix: harden worker failure redaction boundaries

* fix: cover bracketed worker secret values

* test: enforce worker workflow secret references

* fix: redact quoted worker secret values

* fix: redact diagnostic artifact path labels

* test: cover claim failure redaction

* fix: simplify worker redaction boundary

* test: prove worker logger emits structured events
2026-06-25 11:47:39 +10:00

25 lines
800 B
TypeScript

/* @vitest-environment node */
import { readFile } from "node:fs/promises";
import { describe, expect, it } from "vitest";
const PRODUCTION_WORKER_SCRIPTS = [
"scripts/security/run-codex-scan-worker.ts",
"scripts/skill-cards/run-skill-card-worker.ts",
];
describe("production worker console guard", () => {
it("keeps raw console logging out of production worker scripts", async () => {
const violations: string[] = [];
for (const path of PRODUCTION_WORKER_SCRIPTS) {
const text = await readFile(path, "utf8");
for (const [index, line] of text.split(/\r?\n/).entries()) {
if (/\bconsole\.(?:log|warn|error)\s*\(/.test(line)) {
violations.push(`${path}:${index + 1}: ${line.trim()}`);
}
}
}
expect(violations).toEqual([]);
});
});