Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/tools/test_terminal_tool_exception_redaction.py

@@ -0,0 +1,44 @@
+"""Terminal-tool exception paths must redact secrets before returning to the model.
+
+The logger copy of the traceback already goes through RedactingFormatter, but
+the JSON result returned to the model previously carried raw ``str(e)`` and
+``traceback.format_exc()`` — exception text can embed the failing command line
+(and any secrets inline in it). See issue #77484.
+"""
+
+import json
+
+import tools.terminal_tool as terminal_tool
+
+SECRET = "sk-proj-AbCdEf1234567890SecretValue999"
+
+
+def _force_exception(monkeypatch, exc):
+    def boom():
+        raise exc
+    monkeypatch.setattr(terminal_tool, "_get_env_config", boom)
+
+
+def test_generic_exception_result_redacts_error_and_traceback(monkeypatch):
+    _force_exception(monkeypatch, RuntimeError(f"connect failed OPENAI_API_KEY={SECRET}"))
+    result = json.loads(terminal_tool.terminal_tool("echo hi"))
+    assert result["status"] == "error"
+    assert SECRET not in result["error"]
+    assert SECRET not in result["traceback"]
+    # The redaction must mask the value, not drop the message entirely.
+    assert "OPENAI_API_KEY=" in result["error"]
+    assert "Failed to execute command" in result["error"]
+
+
+def test_degraded_fail_mode_result_redacts_error_and_traceback(monkeypatch):
+    from tools.environments.base import EnvironmentConnectionError
+
+    monkeypatch.setenv("TERMINAL_DEGRADED_MODE", "fail")
+    exc = EnvironmentConnectionError(
+        f"ssh auth failed TOKEN={SECRET}", retry_hint="retry later"
+    )
+    _force_exception(monkeypatch, exc)
+    result = json.loads(terminal_tool.terminal_tool("echo hi"))
+    assert result["status"] == "error"
+    assert SECRET not in result["error"]
+    assert SECRET not in result["traceback"]