popagent

Latest change 1ce5ab5f17eefb3cef070f9d98b28f2bb1e5c879 - Secure agent secrets behind origin-bound browser use by AkurAI Build

import { beforeAll, describe, expect, test } from "bun:test";
import { SessionStore } from "./sessions";

const store = new SessionStore();

beforeAll(() => store.init());

describe("SessionStore", () => {
  test("creates, lists, updates, and reloads sessions", async () => {
    const created = await store.create("cx/gpt-5.6-sol");
    try {
      expect(await store.list()).toContainEqual(
        expect.objectContaining({ id: created.id, title: "New chat", model: "cx/gpt-5.6-sol" }),
      );

      const messages = [
        { id: "user-1", role: "user", parts: [{ type: "text", text: "Plan a trip to Oslo" }] },
        { id: "assistant-1", role: "assistant", parts: [{ type: "text", text: "Sure." }] },
      ];
      await store.save(created.id, { model: "cx/gpt-5.6-sol", messages, expectedRevision: created.revision });

      expect(await store.get(created.id)).toEqual(
        expect.objectContaining({ id: created.id, title: "Plan a trip to Oslo", messages }),
      );
    } finally {
      await store.delete(created.id);
    }
  });

  test("redacts retired secret tool payloads before session persistence", async () => {
    const created = await store.create("cx/gpt-5.6-sol");
    const marker = `credential-${crypto.randomUUID()}`;
    try {
      const saved = await store.save(created.id, {
        model: created.model,
        expectedRevision: created.revision,
        messages: [{
          id: "assistant-secret",
          role: "assistant",
          parts: [{
            type: "tool-recallSecret",
            toolCallId: "tool-secret",
            state: "output-available",
            input: { name: "login/password" },
            output: { name: "login/password", value: marker },
          }],
        }],
      });

      expect(JSON.stringify(saved)).not.toContain(marker);
      expect(JSON.stringify(await store.get(created.id))).not.toContain(marker);
    } finally {
      await store.delete(created.id);
    }
  });

  test("returns undefined for an unknown session", async () => {
    expect(await store.get("missing")).toBeUndefined();
  });
});