Security / abuse-case tests (T8)

Run on 2026-10-12T23:08Z at commit f77a3b8.

uv run pytest tests/security -v -p no:warnings

tests/security/test_complete_roles.py::test_a_stranger_cannot_complete_or_cancel PASSED [ 27%]
tests/security/test_complete_roles.py::test_a_watcher_cannot_complete_or_cancel_an_idle_task PASSED [ 29%]
tests/security/test_complete_roles.py::test_a_watcher_cannot_complete_by_naming_the_reporter_in_the_message PASSED [ 30%]
tests/security/test_complete_roles.py::test_a_watchers_completion_does_not_interrupt_a_running_turn PASSED [ 31%]
tests/security/test_home_paths.py::test_a_symlinked_home_is_refused_and_nothing_is_written PASSED [ 32%]
tests/security/test_home_paths.py::test_a_symlinked_file_is_refused_and_its_target_untouched PASSED [ 34%]
tests/security/test_home_paths.py::test_a_dangling_symlinked_file_is_refused_and_not_created PASSED [ 35%]
tests/security/test_home_paths.py::test_a_home_that_is_not_a_directory_is_refused PASSED [ 36%]
tests/security/test_home_paths.py::test_a_config_that_is_not_a_regular_file_is_refused PASSED [ 37%]
tests/security/test_home_paths.py::test_a_home_owned_by_another_user_is_refused PASSED [ 39%]
tests/security/test_home_paths.py::test_a_config_owned_by_another_user_is_refused PASSED [ 40%]
tests/security/test_home_paths.py::test_created_modes_are_owner_only_whatever_the_umask PASSED [ 41%]
tests/security/test_home_paths.py::test_a_home_swapped_for_a_symlink_after_mkdir_changes_no_other_directory PASSED [ 43%]
tests/security/test_home_paths.py::test_the_file_appears_only_once_written PASSED [ 44%]
tests/security/test_ingress.py::test_ingress_redacted_before_history PASSED [ 45%]
tests/security/test_oversized_request.py::test_oversized_request_not_persisted PASSED [ 46%]
tests/security/test_oversized_request.py::test_flooding_peer_is_rate_limited_before_the_route PASSED [ 48%]
tests/security/test_plugin_paths.py::test_plugin_path_escape_rejected PASSED [ 49%]
tests/security/test_plugin_paths.py::test_command_with_expansion_rejected PASSED [ 50%]
tests/security/test_plugin_paths.py::test_only_the_two_variables_expand_and_only_in_args_env_cwd PASSED [ 51%]
tests/security/test_plugin_paths.py::test_contained_rejects_symlink_and_dotdot_escapes PASSED [ 53%]
tests/security/test_plugin_paths.py::test_skill_and_prompt_paths_outside_the_root_are_skipped PASSED [ 54%]
tests/security/test_push_token.py::test_push_credentials_are_stored_as_supplied PASSED [ 55%]
tests/security/test_push_token.py::test_push_credentials_are_masked_when_printed PASSED [ 56%]
tests/security/test_push_token.py::test_a_row_stored_encrypted_by_an_earlier_version_is_legacy PASSED [ 58%]
tests/security/test_push_token.py::test_a_new_sqlite_store_is_readable_by_its_owner_only PASSED [ 59%]
tests/security/test_push_token.py::test_an_existing_sqlite_store_keeps_its_mode PASSED [ 60%]
tests/security/test_redactor.py::test_redactor_masks_tokens PASSED       [ 62%]
tests/security/test_redactor.py::test_configured_secret_values_are_masked_whatever_their_shape PASSED [ 63%]
tests/security/test_redactor.py::test_short_or_ordinary_text_is_untouched PASSED [ 64%]
tests/security/test_redactor.py::test_scrub_model_recurses_and_keeps_non_strings PASSED [ 65%]
tests/security/test_redactor.py::test_scrub_returns_the_same_instance_when_nothing_changes PASSED [ 67%]
tests/security/test_redactor.py::test_enum_fields_keep_their_type PASSED [ 68%]
tests/security/test_remote_card.py::test_remote_card_with_unknown_required_ext_refused PASSED [ 69%]
tests/security/test_remote_card.py::test_remote_card_with_security_scheme_refused PASSED [ 70%]
tests/security/test_remote_command_executor.py::test_a_remote_command_executor_sees_only_its_own_command_scrubbed PASSED [ 72%]
tests/security/test_remote_command_executor.py::test_a_command_owned_hook_with_extra_points_is_skipped PASSED [ 73%]
tests/security/test_remote_push.py::test_unverifiable_pushes_are_refused_alike_and_change_nothing PASSED [ 74%]
tests/security/test_remote_push.py::test_a_forged_terminal_push_is_not_applied PASSED [ 75%]
tests/security/test_remote_push.py::test_oversized_and_malformed_pushes_are_refused PASSED [ 77%]
tests/security/test_remote_push.py::test_a_push_to_an_ended_stand_in_is_refused PASSED [ 78%]
tests/security/test_remote_push.py::test_the_validator_compares_digests_in_constant_time PASSED [ 79%]
tests/security/test_remote_push.py::test_a_stand_in_without_a_push_watch_accepts_no_push[None] PASSED [ 81%]
tests/security/test_remote_push.py::test_a_stand_in_without_a_push_watch_accepts_no_push[watch1] PASSED [ 82%]
tests/security/test_remote_push.py::test_a_stand_in_without_a_push_watch_accepts_no_push[watch2] PASSED [ 83%]
tests/security/test_role_change.py::test_role_change_requires_admin PASSED [ 84%]
tests/security/test_schema_drift.py::test_schema_drift_refuses_invoke PASSED [ 86%]
tests/security/test_server_controlled_fields.py::test_the_server_controlled_fields_are_exactly_three PASSED [ 87%]
tests/security/test_server_controlled_fields.py::test_a_first_message_envelope_setting_one_is_refused[extra0] PASSED [ 88%]
tests/security/test_server_controlled_fields.py::test_a_first_message_envelope_setting_one_is_refused[extra1] PASSED [ 89%]
tests/security/test_server_controlled_fields.py::test_a_first_message_envelope_setting_one_is_refused[extra2] PASSED [ 91%]
tests/security/test_server_controlled_fields.py::test_an_envelope_on_an_existing_task_setting_one_is_refused_even_from_an_admin[extra0] PASSED [ 92%]
tests/security/test_server_controlled_fields.py::test_an_envelope_on_an_existing_task_setting_one_is_refused_even_from_an_admin[extra1] PASSED [ 93%]
tests/security/test_server_controlled_fields.py::test_an_envelope_on_an_existing_task_setting_one_is_refused_even_from_an_admin[extra2] PASSED [ 94%]
tests/security/test_sub_task_flood.py::test_a_sub_task_flood_is_rate_limited_before_temporal PASSED [ 96%]
tests/security/test_sub_task_flood.py::test_a_strangers_command_is_answered_as_if_the_task_did_not_exist PASSED [ 97%]
tests/security/test_tool_boundary.py::test_injected_tool_call_not_executed PASSED [ 98%]
tests/security/test_tool_boundary.py::test_unknown_tool_rejected PASSED  [100%]

============================= 79 passed in 17.39s ==============================