返回 DeepSeek-Reasonix
write_claims_adversarial_test.go
根目录 / internal / agent / write_claims_adversarial_test.go
1 package agent
2
3 import (
4 "context"
5 "encoding/json"
6 "os"
7 "path/filepath"
8 "strings"
9 "testing"
10
11 "reasonix/internal/evidence"
12 "reasonix/internal/tool"
13 )
14
15 // boundWriterFixture builds a workspace with an in-claim directory and an
16 // out-of-claim file at the root, plus a write_file bound to the claim.
17 func boundWriterFixture(t *testing.T) (root string, writer tool.Tool, inner *recordingWriter) {
18 t.Helper()
19 root = t.TempDir()
20 if err := os.MkdirAll(filepath.Join(root, "auth"), 0o755); err != nil {
21 t.Fatal(err)
22 }
23 if err := os.WriteFile(filepath.Join(root, "package.json"), []byte("{}"), 0o644); err != nil {
24 t.Fatal(err)
25 }
26 claim, err := NormalizeWritePaths(root, []string{"auth"})
27 if err != nil {
28 t.Fatal(err)
29 }
30 inner = &recordingWriter{name: "write_file"}
31 reg := tool.NewRegistry()
32 reg.Add(inner)
33 bound, _ := BindWritePaths(reg, claim, root, false)
34 return root, mustGet(t, bound, "write_file"), inner
35 }
36
37 func mustRejectWrite(t *testing.T, writer tool.Tool, inner *recordingWriter, args string) {
38 t.Helper()
39 out, err := writer.Execute(context.Background(), json.RawMessage(args))
40 if err == nil {
41 t.Fatalf("write %s was allowed (result %q); it escapes the declared write_paths", args, out)
42 }
43 if !strings.Contains(err.Error(), "outside this subagent's declared write_paths") {
44 t.Fatalf("unexpected rejection reason: %v", err)
45 }
46 if inner.calls != 0 {
47 t.Fatalf("inner writer ran %d times; the boundary must reject before execution", inner.calls)
48 }
49 }
50
51 // A symlink inside the claim that points out of it must not launder a write.
52 func TestWriteClaimBlocksSymlinkEscape(t *testing.T) {
53 root, writer, inner := boundWriterFixture(t)
54 link := filepath.Join(root, "auth", "link.json")
55 if err := os.Symlink(filepath.Join(root, "package.json"), link); err != nil {
56 t.Skipf("symlinks unavailable: %v", err)
57 }
58 mustRejectWrite(t, writer, inner, `{"path":`+jsonPath(link)+`,"content":"x"}`)
59 }
60
61 func TestWriteClaimBlocksParentTraversal(t *testing.T) {
62 root, writer, inner := boundWriterFixture(t)
63 escape := filepath.Join(root, "auth", "..", "package.json")
64 mustRejectWrite(t, writer, inner, `{"path":`+jsonPath(escape)+`,"content":"x"}`)
65 }
66
67 // move_file has two path arguments; a destination outside the claim is still an
68 // escape even when the source is legitimately inside it.
69 func TestWriteClaimChecksMoveDestination(t *testing.T) {
70 root := t.TempDir()
71 if err := os.MkdirAll(filepath.Join(root, "auth"), 0o755); err != nil {
72 t.Fatal(err)
73 }
74 claim, err := NormalizeWritePaths(root, []string{"auth"})
75 if err != nil {
76 t.Fatal(err)
77 }
78 inner := &recordingWriter{name: "move_file"}
79 reg := tool.NewRegistry()
80 reg.Add(inner)
81 bound, _ := BindWritePaths(reg, claim, root, false)
82 mover := mustGet(t, bound, "move_file")
83
84 args := `{"source_path":` + jsonPath(filepath.Join(root, "auth", "a.go")) +
85 `,"destination_path":` + jsonPath(filepath.Join(root, "escaped.go")) + `}`
86 if _, err := mover.Execute(context.Background(), json.RawMessage(args)); err == nil {
87 t.Fatal("move_file out of the claim was allowed")
88 }
89 if inner.calls != 0 {
90 t.Fatalf("move_file ran %d times despite an out-of-claim destination", inner.calls)
91 }
92 }
93
94 // A writer the host cannot path-scope is dropped, never silently trusted.
95 func TestWriteClaimDropsUnbindableWriters(t *testing.T) {
96 root := t.TempDir()
97 claim, err := NormalizeWritePaths(root, []string{"."})
98 if err != nil {
99 t.Fatal(err)
100 }
101 reg := tool.NewRegistry()
102 reg.Add(&recordingWriter{name: "deploy_release"})
103 reg.Add(&recordingWriter{name: "read_notes", readOnly: true})
104 bound, removed := BindWritePaths(reg, claim, root, false)
105 if _, ok := bound.Get("deploy_release"); ok {
106 t.Fatal("an unbindable writer survived the write_paths boundary")
107 }
108 if len(removed) != 1 || removed[0] != "deploy_release" {
109 t.Fatalf("removed = %v, want [deploy_release]", removed)
110 }
111 if _, ok := bound.Get("read_notes"); !ok {
112 t.Fatal("read-only tools must survive the boundary")
113 }
114 }
115
116 // Layer 5: even if a write reaches the workspace through a surface the claim
117 // could not bind, the host reports it to the parent rather than staying silent.
118 func TestClaimViolationsSurfaceOutOfClaimMutations(t *testing.T) {
119 root := t.TempDir()
120 claim, err := NormalizeWritePaths(root, []string{"auth"})
121 if err != nil {
122 t.Fatal(err)
123 }
124 summary := evidence.ChildEvidenceSummary{Receipts: []evidence.Receipt{
125 {ToolName: "write_file", Success: true, Mutation: true, Paths: []string{filepath.Join(root, "auth", "token.go")}},
126 {ToolName: "write_file", Success: true, Mutation: true, Paths: []string{filepath.Join(root, "package.json")}},
127 }}
128 got := claimViolations(summary, claim)
129 if len(got) != 1 || !strings.HasSuffix(got[0], "package.json") {
130 t.Fatalf("violations = %v, want just the out-of-claim package.json", got)
131 }
132 block := formatHostReceipts(summary, claim)
133 if !strings.Contains(block, "OUTSIDE DECLARED write_paths") {
134 t.Fatalf("receipts block hides the violation: %q", block)
135 }
136 }
137
138 // A writer that declared nothing is scheduled as whole-workspace, and the host
139 // deliberately enforces nothing inside the workspace for it. This test pins the
140 // real semantics so the SPEC claim stays honest.
141 func TestUndeclaredWriterHasNoIntraWorkspaceEnforcement(t *testing.T) {
142 root := t.TempDir()
143 whole, err := WholeWorkspaceWriteClaim(root)
144 if err != nil {
145 t.Fatal(err)
146 }
147 if !whole.AllowsPath(filepath.Join(root, "any", "file.go")) {
148 t.Fatal("a whole-workspace claim must allow every in-workspace path")
149 }
150 summary := evidence.ChildEvidenceSummary{Receipts: []evidence.Receipt{
151 {ToolName: "write_file", Success: true, Mutation: true, Paths: []string{filepath.Join(root, "package.json")}},
152 }}
153 if got := claimViolations(summary, whole); len(got) != 0 {
154 t.Fatalf("violations = %v, want none: a whole-workspace claim cannot distinguish in-workspace writes", got)
155 }
156 // It still catches an escape out of the workspace entirely.
157 outside := evidence.ChildEvidenceSummary{Receipts: []evidence.Receipt{
158 {ToolName: "write_file", Success: true, Mutation: true, Paths: []string{filepath.Join(t.TempDir(), "elsewhere.go")}},
159 }}
160 if got := claimViolations(outside, whole); len(got) != 1 {
161 t.Fatalf("violations = %v, want the out-of-workspace write flagged", got)
162 }
163 }
164
165 func jsonPath(path string) string {
166 b, _ := json.Marshal(path)
167 return string(b)
168 }
169
169 lines GO