From f1b9d98fa35b1cc721f01c7261d8291eece81239 Mon Sep 17 00:00:00 2001 From: "Xin.Zh" Date: Wed, 21 Oct 2026 20:31:03 +0800 Subject: [PATCH 1/3] fix(integrations): guard automatic prompt capture and preparation Apply a documented best-effort credential policy across seven prompt adapters. Skip recognized capture inputs as whole events and sanitize only the automatic read-only query. Preserve accepted Source identity and existing capture controls. Add shared synthetic fixtures, hook/HTTP regressions and bilingual guidance. Constraint: No stored evidence rewrite, Source classifier at the Server, event deduplication, or change to automatic Memory evolution. Scope-risk: Detection is best effort and can conservatively skip examples; real-host credential acceptance remains open in issue 2165. Tested: Linux Python plugin/install suites (457 passed, 4 skipped); Windows isolated hooks (42 passed); Kimi/ZCode hook HTTP (63 passed); Pi (121 passed); OpenCode (88 passed); TypeScript/build; manifest (50 passed); full Linux Ty; changed-file pre-commit/Ruff. --- docs/en/docs/integrations/claude-code.md | 4 + docs/en/docs/integrations/codex.md | 4 + docs/en/docs/integrations/index.md | 43 ++++++ docs/en/docs/integrations/kimi-code.md | 4 + docs/en/docs/integrations/opencode.md | 4 + docs/en/docs/integrations/pi.md | 4 + docs/en/docs/integrations/workbuddy.md | 4 + docs/en/docs/integrations/zcode.md | 4 + docs/zh/docs/integrations/claude-code.md | 4 + docs/zh/docs/integrations/codex.md | 4 + docs/zh/docs/integrations/index.md | 33 ++++ docs/zh/docs/integrations/kimi-code.md | 4 + docs/zh/docs/integrations/opencode.md | 4 + docs/zh/docs/integrations/pi.md | 4 + docs/zh/docs/integrations/workbuddy.md | 4 + docs/zh/docs/integrations/zcode.md | 4 + integrations/capabilities.toml | 10 +- .../powercontext/hooks/prompt_privacy.py | 40 +++++ .../powercontext/hooks/user_prompt_submit.py | 15 +- .../powercontext/hooks/prompt_privacy.py | 40 +++++ .../plugins/powercontext/hooks/recall.py | 35 +++-- .../powercontext/hooks/user_prompt_submit.mjs | 8 +- .../powercontext/shared/prompt-privacy.mjs | 34 +++++ .../powercontext/tests/plugin.test.mjs | 25 +++ .../plugins/powercontext/lib/index.js | 74 ++++++++- .../opencode/plugins/powercontext/lib/tui.js | 62 +++++++- .../plugins/powercontext/src/index.ts | 16 +- .../plugins/powercontext/src/secrets.ts | 10 +- .../plugins/powercontext/tests/plugin.spec.ts | 1 + .../powercontext/tests/prompt-privacy.spec.ts | 36 +++++ .../powercontext/extensions/powercontext.ts | 1 + .../pi/plugins/powercontext/src/capture.ts | 2 +- .../pi/plugins/powercontext/src/recall.ts | 13 +- .../pi/plugins/powercontext/src/secrets.ts | 10 +- .../powercontext/tests/extension.spec.ts | 1 + .../powercontext/tests/prompt-privacy.spec.ts | 36 +++++ .../powercontext/hooks/prompt_privacy.py | 40 +++++ .../hooks/workbuddy_powercontext_hook.py | 15 +- .../powercontext/hooks/user_prompt_submit.mjs | 7 +- .../powercontext/shared/prompt-privacy.mjs | 34 +++++ .../powercontext/tests/plugin.test.mjs | 26 ++++ src/powercontext/cli/workbuddy.py | 1 + tests/claude_code_plugin/conftest.py | 1 + tests/fixtures/automatic_prompt_privacy.json | 76 ++++++++++ tests/test_automatic_prompt_privacy.py | 142 ++++++++++++++++++ tests/test_cli_workbuddy.py | 1 + tests/workbuddy_plugin/conftest.py | 1 + 47 files changed, 884 insertions(+), 61 deletions(-) create mode 100644 integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py create mode 100644 integrations/codex/plugins/powercontext/hooks/prompt_privacy.py create mode 100644 integrations/kimi-code/plugins/powercontext/shared/prompt-privacy.mjs create mode 100644 integrations/opencode/plugins/powercontext/tests/prompt-privacy.spec.ts create mode 100644 integrations/pi/plugins/powercontext/tests/prompt-privacy.spec.ts create mode 100644 integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py create mode 100644 integrations/zcode/plugins/powercontext/shared/prompt-privacy.mjs create mode 100644 tests/fixtures/automatic_prompt_privacy.json create mode 100644 tests/test_automatic_prompt_privacy.py diff --git a/docs/en/docs/integrations/claude-code.md b/docs/en/docs/integrations/claude-code.md index d29f584e9a..2f409b49bd 100644 --- a/docs/en/docs/integrations/claude-code.md +++ b/docs/en/docs/integrations/claude-code.md @@ -274,3 +274,7 @@ Authorization is environment-only and must not be added to the Server URL or plu The outer `UserPromptSubmit` Hook timeout is ten seconds. Recall and capture use one shared wall-clock budget but fail independently. HTTPS certificate validation remains enabled when HTTP is explicitly permitted. Restart Claude Code after changing its environment. + +## Automatic input privacy + +See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten. diff --git a/docs/en/docs/integrations/codex.md b/docs/en/docs/integrations/codex.md index 44e788f392..382aa6c3a4 100644 --- a/docs/en/docs/integrations/codex.md +++ b/docs/en/docs/integrations/codex.md @@ -362,3 +362,7 @@ The outer Codex hook timeout is ten seconds. Recall, capture, and flush fail ind the Server is unavailable or rejects authentication. Without an explicit Scope, the plugin resolves the Session binding, workspace binding, then Server default. Process-level settings must be present in the environment that starts Codex. Windows setup writes authorization to the user environment, but Desktop must be restarted to inherit it. + +## Automatic input privacy + +See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten. diff --git a/docs/en/docs/integrations/index.md b/docs/en/docs/integrations/index.md index e529c6444f..bc46e2d88c 100644 --- a/docs/en/docs/integrations/index.md +++ b/docs/en/docs/integrations/index.md @@ -45,6 +45,49 @@ powercontext setup Use the same ref as the Server. `powercontext setup codex dsh` installs, configures, and diagnoses both agents. Use `powercontext config agent codex dsh` to update installed connections without reinstalling or enabling them; consult each Agent guide for native requirements. +## Automatic prompt privacy + +The following prompt adapters enable capture by default. Existing capture preferences remain effective +when updating a plugin; this policy adds credential checks without changing capture defaults. + +| Host | Automatic input boundary | Disable capture | +| --- | --- | --- | +| Claude Code | `UserPromptSubmit` text | `POWERCONTEXT_CLAUDE_CAPTURE_PROMPTS=false` or setup `--no-capture-prompts` | +| Codex | `UserPromptSubmit` text | `POWERCONTEXT_CODEX_CAPTURE_PROMPTS=false` | +| WorkBuddy | Submitted joined prompt text | `POWERCONTEXT_WORKBUDDY_CAPTURE_PROMPTS=false` | +| OpenCode | User text parts, excluding synthetic parts | `POWERCONTEXT_OPENCODE_CAPTURE_PROMPTS=false` | +| Pi | `before_agent_start` prompt | `POWERCONTEXT_PI_CAPTURE_PROMPTS=false` | +| ZCode | `UserPromptSubmit` text | `POWERCONTEXT_ZCODE_CAPTURE_PROMPTS=false` | +| Kimi Code (experimental) | Text parts of `UserPromptSubmit` | setup `--no-capture-prompts` | + +Before automatic capture, these adapters recognize conventional credential assignments (API/access keys +and tokens, client/private keys, secrets, passwords, passphrases, authorization and cookies), Bearer values +of at least eight token characters, common provider/GitHub/Slack token shapes, private-key blocks including +unfinished blocks, and exact occurrences of the configured Server credential. Recognition is best effort: +unknown formats, obfuscation and credentials without recognizable markers can pass. Conservative matching +also skips examples such as `password=example`. Ordinary words such as “token budgets” are not assignments. +The shared synthetic corpus is `tests/fixtures/automatic_prompt_privacy.json`; it defines tested examples, +not proof that arbitrary credentials are detected. + +A recognized input is skipped as a whole for capture. The adapter never redacts a Source body and then +attaches the original event's identity or receipt to it. Accepted events keep their existing host text +normalization and identity semantics; distinct events and retries follow the host's documented contract. +Local diagnostics or configured observations report a bounded skip reason (`sensitive_content`, or +Kimi's `sensitive`) without the rejected text. Pi reports this through its configured diagnostic sink; +`off` disables that output. + +Automatic read-only preparation remains independent: recognized fragments are replaced with `[REDACTED]` +before building the bounded query, even when capture is disabled. Preparation may therefore lose some +query specificity; a valid historical response can still be delivered. This changes only the automatic +query, not stored Source evidence or an explicit tool call. Authentication headers still carry the +configured credential to the selected Server as required by that connection. + +If prompts must not leave the host, disable automatic capture **and** the host's automatic preparation +hook/extension. Disabling capture alone still allows read-only requests, and detection is not a +confidentiality guarantee. Keep secrets out of prompts, configure trusted endpoints and review operational +access. This policy does not scan stored Sources, rewrite immutable revisions, prevent prompt injection, +or classify all explicit Source writes at the Server. + ## Python Agent frameworks All 3 adapters are `community`. Install them in the application environment; do not use diff --git a/docs/en/docs/integrations/kimi-code.md b/docs/en/docs/integrations/kimi-code.md index e7e26a1a8d..a8eb94ca8d 100644 --- a/docs/en/docs/integrations/kimi-code.md +++ b/docs/en/docs/integrations/kimi-code.md @@ -124,3 +124,7 @@ uv run pytest tests/test_cli_kimi_code.py Set KIMI_CLI_BIN to the installed real binary or built main.mjs, then run uv run pytest tests/e2e/test_kimi_code_host.py. This opt-in test uses disposable Kimi homes, workspaces, Server database and local inference; it needs no live model key and does not modify the user's Kimi profile. An unset variable skips host acceptance and is not a passing qualification. The [Kimi Code acceptance workflow](https://github.com/oceanbase/powercontext/actions/workflows/kimi-code-acceptance.yml) pins Kimi 2.1.1 and Node 24.21.0 and runs Hook tests plus real-host acceptance on Linux and Windows for pull requests and master updates. Both inference services are controlled; no live provider key is required. A skipped host test fails CI. Artifacts contain CLI provenance, JUnit results and acceptance summaries, excluding Kimi profiles and databases. + +## Automatic input privacy + +See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten. diff --git a/docs/en/docs/integrations/opencode.md b/docs/en/docs/integrations/opencode.md index c2ece3b005..2affac27fa 100644 --- a/docs/en/docs/integrations/opencode.md +++ b/docs/en/docs/integrations/opencode.md @@ -83,3 +83,7 @@ powercontext doctor opencode The integration-specific doctor checks the OpenCode version, resolved plugin configuration, and the owned Skill. An unavailable Server does not block OpenCode and is checked separately by the default doctor command. + +## Automatic input privacy + +See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten. diff --git a/docs/en/docs/integrations/pi.md b/docs/en/docs/integrations/pi.md index eae7dc496a..c67f5a7191 100644 --- a/docs/en/docs/integrations/pi.md +++ b/docs/en/docs/integrations/pi.md @@ -149,3 +149,7 @@ changing these variables. Failure diagnostics are silent by default because Pi's TUI renders on stdout with cursor positioning, so anything written to stderr lands inside the input bar; set `POWERCONTEXT_PI_DIAGNOSTICS` to see them. + +## Automatic input privacy + +See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten. diff --git a/docs/en/docs/integrations/workbuddy.md b/docs/en/docs/integrations/workbuddy.md index 125d5ec338..ce64d4e85c 100644 --- a/docs/en/docs/integrations/workbuddy.md +++ b/docs/en/docs/integrations/workbuddy.md @@ -311,3 +311,7 @@ message. Verify the whole installation with `powercontext doctor`. 3. Remove the hook files and the scope resolver from ``. 4. Remove `~/.workbuddy/skills/powercontext-project-context`. 5. Optionally stop the Server and delete its local data directory. + +## Automatic input privacy + +See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten. diff --git a/docs/en/docs/integrations/zcode.md b/docs/en/docs/integrations/zcode.md index 4c85379c96..ab1cbfe193 100644 --- a/docs/en/docs/integrations/zcode.md +++ b/docs/en/docs/integrations/zcode.md @@ -463,3 +463,7 @@ Server URL was saved; it cannot change the MCP endpoint in a normal installation Remove only the PowerContext path from `plugins.dirs` in `~/.zcode/cli/config.json`. Delete `~/.zcode/cli/plugins/powercontext` only after confirming it contains `.powercontext-owned`. Fully quit and reopen ZCode. Uninstalling the plugin does not remove Server data or ZCode model configuration. + +## Automatic input privacy + +See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten. diff --git a/docs/zh/docs/integrations/claude-code.md b/docs/zh/docs/integrations/claude-code.md index 141c52e529..508dc6205e 100644 --- a/docs/zh/docs/integrations/claude-code.md +++ b/docs/zh/docs/integrations/claude-code.md @@ -254,3 +254,7 @@ Authorization 只能来自环境变量，不能加入 Server URL 或插件选项 `UserPromptSubmit` Hook 的外层超时为十秒。召回与采集共用一个 wall-clock 时间预算，但会独立降级。 显式允许 HTTP 不会关闭 HTTPS 证书校验。修改环境变量后需要重启 Claude Code。 + +## 自动输入隐私 + +本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。 diff --git a/docs/zh/docs/integrations/codex.md b/docs/zh/docs/integrations/codex.md index 7387426392..446e52e3a5 100644 --- a/docs/zh/docs/integrations/codex.md +++ b/docs/zh/docs/integrations/codex.md @@ -322,3 +322,7 @@ Hook 默认允许环回 HTTP，远程 HTTP 需要显式同意，HTTPS 证书校 Codex Hook 外层超时为十秒。Server 不可用或拒绝鉴权时，恢复、采集和 flush 独立降级，不会阻塞 Codex。未显式指定 Scope 时，插件依次解析 Session binding、workspace binding 和 Server 默认 Scope。进程级配置必须存在于启动 Codex 的环境中；Windows setup 会把鉴权写入用户环境，但 Desktop 仍需重启才能继承。 + +## 自动输入隐私 + +本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。 diff --git a/docs/zh/docs/integrations/index.md b/docs/zh/docs/integrations/index.md index a8275cef8c..3fd9bc3c98 100644 --- a/docs/zh/docs/integrations/index.md +++ b/docs/zh/docs/integrations/index.md @@ -42,6 +42,39 @@ powercontext setup 使用与 Server 相同的 ref。`powercontext setup codex dsh` 会安装、配置并诊断两个 Agent。更新已安装连接时使用 `powercontext config agent codex dsh`，不会重新安装或启用插件；原生要求见各 Agent 文档。 +## 自动 prompt 隐私策略 + +以下 prompt 适配器默认开启捕获。更新插件时保留已有捕获偏好；本策略增加凭据检查，不改变捕获默认值。 + +| 宿主 | 自动输入边界 | 关闭捕获 | +| --- | --- | --- | +| Claude Code | `UserPromptSubmit` 文本 | `POWERCONTEXT_CLAUDE_CAPTURE_PROMPTS=false` 或 setup `--no-capture-prompts` | +| Codex | `UserPromptSubmit` 文本 | `POWERCONTEXT_CODEX_CAPTURE_PROMPTS=false` | +| WorkBuddy | 宿主提交的拼接 prompt 文本 | `POWERCONTEXT_WORKBUDDY_CAPTURE_PROMPTS=false` | +| OpenCode | 用户文本部分，排除 synthetic 部分 | `POWERCONTEXT_OPENCODE_CAPTURE_PROMPTS=false` | +| Pi | `before_agent_start` prompt | `POWERCONTEXT_PI_CAPTURE_PROMPTS=false` | +| ZCode | `UserPromptSubmit` 文本 | `POWERCONTEXT_ZCODE_CAPTURE_PROMPTS=false` | +| Kimi Code（实验性） | `UserPromptSubmit` 中的文本部分 | setup `--no-capture-prompts` | + +自动捕获前，适配器识别常见凭据赋值（API/access key 和 token、client/private key、secret、password、 +passphrase、authorization、cookie）、至少八个 token 字符的 Bearer 值、常见服务商/GitHub/Slack token +形状、包含未闭合情况的私钥块，以及当前 Server 凭据在输入中的精确出现。这是尽力识别：未知格式、混淆或 +没有可识别标记的秘密仍可能通过。保守匹配也会跳过 `password=example` 之类示例；“token budgets”这样的 +普通词语不属于赋值。共享合成用例位于 `tests/fixtures/automatic_prompt_privacy.json`，它定义已测试示例， +不能证明任意凭据都能被识别。 + +识别到凭据时整条跳过捕获，不会修改 Source 正文后继续沿用原事件身份或回执。接受的事件保留既有宿主文本 +规范化和身份语义，不同事件与重试继续遵守各自宿主契约。本地诊断或已配置的观测只报告有界原因 +`sensitive_content`（Kimi 为 `sensitive`），不包含拒绝的文本。Pi 通过配置的诊断输出报告，`off` 表示关闭输出。 + +自动只读准备与捕获独立：构建有界查询前，识别到的片段会替换为 `[REDACTED]`，关闭捕获时也如此。查询可能 +因此降低针对性，但仍可返回并交付有效历史上下文。变化仅作用于自动查询，不改写存储证据或显式工具调用。 +鉴权请求头仍按连接要求，将配置的凭据发送给所选 Server。 + +如果 prompt 不允许离开宿主，需要同时关闭自动捕获和宿主的自动准备 hook/extension。仅关闭捕获仍允许只读 +请求，检测器也不是保密保证。不要在 prompt 中放秘密，应配置可信端点并审查运维访问权限。本策略不扫描 +存量 Source、不改写不可变 revision、不防御 prompt injection，也不在 Server 上对全部显式 Source 写入分类。 + ## Python Agent 框架 这 3 个适配器均为 `community`，安装到应用环境中，不使用 `powercontext setup `： diff --git a/docs/zh/docs/integrations/kimi-code.md b/docs/zh/docs/integrations/kimi-code.md index 9fe49ba9e9..487524f7a2 100644 --- a/docs/zh/docs/integrations/kimi-code.md +++ b/docs/zh/docs/integrations/kimi-code.md @@ -124,3 +124,7 @@ uv run pytest tests/test_cli_kimi_code.py 设置 KIMI_CLI_BIN 指向真实二进制或构建后的 main.mjs，再运行 uv run pytest tests/e2e/test_kimi_code_host.py。该 opt-in 验收使用隔离 Kimi home、workspace、Server 数据库与本地推理，不需要线上模型 key，也不修改用户宿主配置。未设置变量时跳过宿主验收，跳过不代表通过。 [Kimi Code acceptance 工作流](https://github.com/oceanbase/powercontext/actions/workflows/kimi-code-acceptance.yml) 固定 Kimi 2.1.1 和 Node 24.21.0，在 PR 和 master 更新时于 Linux、Windows 执行 Hook 测试与真实宿主验收。两处推理服务均受控，不需要线上模型 Key；宿主测试被跳过时 CI 失败。产物仅保留 CLI 版本来源、JUnit 结果和验收摘要，不上传 Kimi profile 或数据库。 + +## 自动输入隐私 + +本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。 diff --git a/docs/zh/docs/integrations/opencode.md b/docs/zh/docs/integrations/opencode.md index b2fb2e45a4..3650c4630e 100644 --- a/docs/zh/docs/integrations/opencode.md +++ b/docs/zh/docs/integrations/opencode.md @@ -78,3 +78,7 @@ powercontext doctor opencode 集成专用 doctor 会检查 OpenCode 版本、解析后的插件配置和 PowerContext 所有的 Skill。Server 状态由默认 doctor 单独检查；Server 不可用不会阻止 OpenCode 正常工作。 + +## 自动输入隐私 + +本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。 diff --git a/docs/zh/docs/integrations/pi.md b/docs/zh/docs/integrations/pi.md index 543d554794..cb5605f3c6 100644 --- a/docs/zh/docs/integrations/pi.md +++ b/docs/zh/docs/integrations/pi.md @@ -145,3 +145,7 @@ Pi 会拒绝包含凭据、query 或 fragment 的 base URL。召回、采集和 失败诊断默认不输出：Pi 的 TUI 通过光标定位在 stdout 上渲染，写到 stderr 的内容会落在输入栏里；需要查看时请设置 `POWERCONTEXT_PI_DIAGNOSTICS`。 + +## 自动输入隐私 + +本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。 diff --git a/docs/zh/docs/integrations/workbuddy.md b/docs/zh/docs/integrations/workbuddy.md index 95e6f3a60c..d61731a4b0 100644 --- a/docs/zh/docs/integrations/workbuddy.md +++ b/docs/zh/docs/integrations/workbuddy.md @@ -273,3 +273,7 @@ query、scope、prepared content、citation、response body 或 authorization va 3. 从 `` 删除 hook 文件和 scope resolver。 4. 删除 `~/.workbuddy/skills/powercontext-project-context`。 5. 可选：停止 Server 并删除其本地数据目录。 + +## 自动输入隐私 + +本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。 diff --git a/docs/zh/docs/integrations/zcode.md b/docs/zh/docs/integrations/zcode.md index 4c8694c66d..e6e99ce489 100644 --- a/docs/zh/docs/integrations/zcode.md +++ b/docs/zh/docs/integrations/zcode.md @@ -409,3 +409,7 @@ Server URL 时作为 Hook 的回退值，不能用于修改正常安装的 MCP 从 `~/.zcode/cli/config.json` 的 `plugins.dirs` 中只移除 PowerContext 路径；确认 `~/.zcode/cli/plugins/powercontext` 中存在 `.powercontext-owned` 后，再删除该受管理目录。 最后完全退出并重启 ZCode。卸载插件不会删除 Server 数据或 ZCode 模型配置。 + +## 自动输入隐私 + +本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。 diff --git a/integrations/capabilities.toml b/integrations/capabilities.toml index 03b284ab23..fc9b572995 100644 --- a/integrations/capabilities.toml +++ b/integrations/capabilities.toml @@ -905,7 +905,7 @@ toolsets = ["server-mcp", "prompt-hooks"] [integrations.evidence] implementation = ["integrations/codex/plugins/powercontext/.mcp.json", "integrations/codex/plugins/powercontext/hooks/session_binding.py", "integrations/codex/plugins/powercontext/hooks/recall.py"] documentation = ["docs/en/docs/integrations/codex.md", "docs/zh/docs/integrations/codex.md"] -tests = ["tests/codex_plugin/test_bootstrap.py", "tests/codex_plugin/test_contract.py", "tests/e2e/test_bootstrap_host_service_chain.py", "tests/e2e/test_codex_service_chain.py", "tests/e2e/test_mcp_full_profile.py"] +tests = ["tests/codex_plugin/test_bootstrap.py", "tests/codex_plugin/test_contract.py", "tests/e2e/test_bootstrap_host_service_chain.py", "tests/e2e/test_codex_service_chain.py", "tests/e2e/test_mcp_full_profile.py", "tests/test_automatic_prompt_privacy.py"] [[integrations]] id = "claude-code" @@ -917,7 +917,7 @@ toolsets = ["server-mcp", "prompt-hooks"] [integrations.evidence] implementation = ["integrations/claude-code/plugins/powercontext/.mcp.json", "integrations/claude-code/plugins/powercontext/hooks/session_start.py", "integrations/claude-code/plugins/powercontext/hooks/user_prompt_submit.py"] documentation = ["docs/en/docs/integrations/claude-code.md", "docs/zh/docs/integrations/claude-code.md"] -tests = ["tests/claude_code_plugin/test_bootstrap.py", "tests/claude_code_plugin/test_contract.py", "tests/e2e/test_bootstrap_host_service_chain.py", "tests/e2e/test_claude_code_service_chain.py"] +tests = ["tests/claude_code_plugin/test_bootstrap.py", "tests/claude_code_plugin/test_contract.py", "tests/e2e/test_bootstrap_host_service_chain.py", "tests/e2e/test_claude_code_service_chain.py", "tests/test_automatic_prompt_privacy.py"] [[integrations]] id = "dsh" @@ -965,7 +965,7 @@ toolsets = ["opencode-tools"] [integrations.evidence] implementation = ["integrations/opencode/plugins/powercontext/src/index.ts"] documentation = ["docs/en/docs/integrations/opencode.md", "docs/zh/docs/integrations/opencode.md"] -tests = ["integrations/opencode/plugins/powercontext/tests/plugin.spec.ts"] +tests = ["integrations/opencode/plugins/powercontext/tests/plugin.spec.ts", "integrations/opencode/plugins/powercontext/tests/prompt-privacy.spec.ts"] [[integrations]] id = "pi" @@ -977,7 +977,7 @@ toolsets = ["pi-tools", "pi-command", "pi-lifecycle"] [integrations.evidence] implementation = ["integrations/pi/plugins/powercontext/src/tools.ts", "integrations/pi/plugins/powercontext/extensions/powercontext.ts"] documentation = ["docs/en/docs/integrations/pi.md", "docs/zh/docs/integrations/pi.md"] -tests = ["integrations/pi/plugins/powercontext/tests/extension.spec.ts", "integrations/pi/plugins/powercontext/tests/tools.spec.ts"] +tests = ["integrations/pi/plugins/powercontext/tests/extension.spec.ts", "integrations/pi/plugins/powercontext/tests/tools.spec.ts", "integrations/pi/plugins/powercontext/tests/prompt-privacy.spec.ts"] [[integrations]] id = "workbuddy" @@ -989,7 +989,7 @@ toolsets = ["server-mcp", "prompt-hooks"] [integrations.evidence] implementation = ["integrations/workbuddy/plugins/powercontext/.mcp.json", "integrations/workbuddy/plugins/powercontext/hooks/workbuddy_powercontext_hook.py"] documentation = ["docs/en/docs/integrations/workbuddy.md", "docs/zh/docs/integrations/workbuddy.md"] -tests = ["tests/test_cli_workbuddy.py"] +tests = ["tests/test_cli_workbuddy.py", "tests/test_automatic_prompt_privacy.py"] [[integrations]] id = "zcode" diff --git a/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py b/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py new file mode 100644 index 0000000000..333f322ca5 --- /dev/null +++ b/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py @@ -0,0 +1,40 @@ +# Copyright (c) 2026 OceanBase. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Best-effort credential recognition for automatic host inputs.""" + +from __future__ import annotations + +import re + +_PATTERN = re.compile( + r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)" + r"""|(? str: + """Replace recognized values in a read-only query; never use this to rewrite a captured event.""" + + if authorization: + _, _, credential = authorization.partition(" ") + if credential: + text = text.replace(credential, "[REDACTED]") + return _PATTERN.sub("[REDACTED]", text) diff --git a/integrations/claude-code/plugins/powercontext/hooks/user_prompt_submit.py b/integrations/claude-code/plugins/powercontext/hooks/user_prompt_submit.py index 18723b54f3..3bbabd47f4 100644 --- a/integrations/claude-code/plugins/powercontext/hooks/user_prompt_submit.py +++ b/integrations/claude-code/plugins/powercontext/hooks/user_prompt_submit.py @@ -37,6 +37,7 @@ from claude_code_settings import ClaudeCodePluginSettings # noqa: E402 from hooks import prepared_context as _prepared_context # noqa: E402 from hooks.diagnostics import should_emit as _should_emit_diagnostic # noqa: E402 +from hooks.prompt_privacy import scrub_secrets # noqa: E402 from workspace_scope import bind_response_deadline, open_bounded, resolve_scope_id # noqa: E402 _MAX_CONTEXT_BYTES = _prepared_context.MAX_CONTEXT_BYTES @@ -118,7 +119,7 @@ def _decode_error_code(raw: bytes) -> str | None: return code if isinstance(code, str) else None -def main(settings: ClaudeCodePluginSettings | None = None) -> int: +def main(settings: ClaudeCodePluginSettings | None = None) -> int: # noqa: C901 - One fail-open hook lifecycle. """Process one Claude Code hook payload and fail open.""" try: @@ -149,7 +150,8 @@ def main(settings: ClaudeCodePluginSettings | None = None) -> int: ) bootstrap_receipt_id = load_receipt(session_id, scope_id) clear_receipt(session_id) - query = _bounded_recall_query(prompt) + safe_prompt = scrub_secrets(prompt, settings.authorization) + query = _bounded_recall_query(safe_prompt) context = None with suppress(Exception): context = _recall_context( @@ -162,7 +164,10 @@ def main(settings: ClaudeCodePluginSettings | None = None) -> int: diagnostic_events=diagnostic_events, ) - if settings.capture_prompts and len(prompt) <= _MAX_SOURCE_LENGTH: + if safe_prompt != prompt: + with suppress(Exception): + _emit_context_event("skipped", event_name="capture_source", reason="sensitive_content") + elif settings.capture_prompts and len(prompt) <= _MAX_SOURCE_LENGTH: try: captured = _capture_prompt( payload, @@ -469,6 +474,7 @@ def _emit_context_event( context_status: str | None = None, content_bytes: int | None = None, recovery: str | None = None, + reason: str | None = None, emitted_diagnostics: set[str] | None = None, diagnostic_events: list[dict[str, object]] | None = None, ) -> None: @@ -492,8 +498,7 @@ def _emit_context_event( event["context_status"] = context_status if content_bytes is not None: event["content_bytes"] = content_bytes - if recovery is not None: - event["recovery"] = recovery + event.update({key: value for key, value in (("recovery", recovery), ("reason", reason)) if value is not None}) if diagnostic_events is None or outcome not in _FAILURE_OUTCOMES: sys.stderr.write(json.dumps(event, separators=(",", ":")) + "\n") else: diff --git a/integrations/codex/plugins/powercontext/hooks/prompt_privacy.py b/integrations/codex/plugins/powercontext/hooks/prompt_privacy.py new file mode 100644 index 0000000000..333f322ca5 --- /dev/null +++ b/integrations/codex/plugins/powercontext/hooks/prompt_privacy.py @@ -0,0 +1,40 @@ +# Copyright (c) 2026 OceanBase. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Best-effort credential recognition for automatic host inputs.""" + +from __future__ import annotations + +import re + +_PATTERN = re.compile( + r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)" + r"""|(? str: + """Replace recognized values in a read-only query; never use this to rewrite a captured event.""" + + if authorization: + _, _, credential = authorization.partition(" ") + if credential: + text = text.replace(credential, "[REDACTED]") + return _PATTERN.sub("[REDACTED]", text) diff --git a/integrations/codex/plugins/powercontext/hooks/recall.py b/integrations/codex/plugins/powercontext/hooks/recall.py index 68b9d6115d..1d8c33baef 100644 --- a/integrations/codex/plugins/powercontext/hooks/recall.py +++ b/integrations/codex/plugins/powercontext/hooks/recall.py @@ -38,6 +38,7 @@ from bootstrap_state import clear_receipt, load_receipt # noqa: E402 from hooks import prepared_context as _prepared_context # noqa: E402 from hooks.diagnostics import should_emit as _should_emit_diagnostic # noqa: E402 +from hooks.prompt_privacy import scrub_secrets # noqa: E402 from plugin_version import PLUGIN_VERSION # noqa: E402 from scope_binding import bind_response_deadline, open_bounded, resolve_scope_id # noqa: E402 from settings import CodexPluginSettings # noqa: E402 @@ -151,7 +152,9 @@ def main(settings: CodexPluginSettings | None = None) -> int: ) bootstrap_receipt_id = load_receipt(session_id, scope_id) clear_receipt(session_id) - query = _bounded_recall_query(prompt) + authorization = settings.authorization.get_secret_value() if settings.authorization is not None else None + safe_prompt = scrub_secrets(prompt, authorization) + query = _bounded_recall_query(safe_prompt) context = _recall_context( query, scope_id, @@ -161,21 +164,25 @@ def main(settings: CodexPluginSettings | None = None) -> int: emitted_diagnostics=emitted_diagnostics, diagnostic_events=diagnostic_events, ) - _capture_and_flush( - payload, - prompt=prompt, - cwd=cwd, - scope_id=scope_id, - settings=settings, - deadline=http_deadline, - emitted_diagnostics=emitted_diagnostics, - diagnostic_events=diagnostic_events, - ) + if safe_prompt != prompt: + with suppress(Exception): + _emit_context_event("skipped", event_name="capture_source", reason="sensitive_content") + else: + _capture_and_flush( + payload, + prompt=prompt, + cwd=cwd, + scope_id=scope_id, + settings=settings, + deadline=http_deadline, + emitted_diagnostics=emitted_diagnostics, + diagnostic_events=diagnostic_events, + ) if context: with suppress(Exception): _record_evaluation_trace( payload, - query=prompt, + query=safe_prompt, injected_text=context, scope_id=scope_id, ) @@ -538,6 +545,7 @@ def _emit_context_event( context_status: str | None = None, content_bytes: int | None = None, recovery: str | None = None, + reason: str | None = None, emitted_diagnostics: set[str] | None = None, diagnostic_events: list[dict[str, object]] | None = None, ) -> None: @@ -561,8 +569,7 @@ def _emit_context_event( event["context_status"] = context_status if content_bytes is not None: event["content_bytes"] = content_bytes - if recovery is not None: - event["recovery"] = recovery + event.update({key: value for key, value in (("recovery", recovery), ("reason", reason)) if value is not None}) if diagnostic_events is None or outcome not in _FAILURE_OUTCOMES: sys.stderr.write(json.dumps(event, separators=(",", ":")) + "\n") else: diff --git a/integrations/kimi-code/plugins/powercontext/hooks/user_prompt_submit.mjs b/integrations/kimi-code/plugins/powercontext/hooks/user_prompt_submit.mjs index 4f9707aed5..0012068290 100644 --- a/integrations/kimi-code/plugins/powercontext/hooks/user_prompt_submit.mjs +++ b/integrations/kimi-code/plugins/powercontext/hooks/user_prompt_submit.mjs @@ -18,9 +18,9 @@ import { randomUUID } from 'node:crypto' import { fileURLToPath } from 'node:url' import { authorization, diagnostic, Failure, loadSettings, MAX_CONTEXT_BYTES, preparedText, request, resolveScope } from '../shared/runtime.mjs' import { startObservation } from '../shared/observations.mjs' +import { scrubSecrets } from '../shared/prompt-privacy.mjs' const MAX_SOURCE_CHARACTERS = 200000 -const SECRET_PATTERN = /(?:\b(?:api[_-]?key|access[_-]?token|token|authorization|password|secret|private[_-]?key)["']?\s*[:=]\s*\S+|\bbearer\s+\S+|\bsk-[A-Za-z0-9_-]{8,}|-----BEGIN [^-]*PRIVATE KEY-----)/iu const signal = AbortSignal.timeout(4000) let emitted = false let observation @@ -69,15 +69,15 @@ async function run(input) { throw error } let context = '' + const safePrompt = scrubSecrets(prompt, settings.authorization) try { const { value } = await request(settings, 'POST', '/v1/context/prepare', { - scope_id: scopeId, query: boundedQuery(prompt), max_bytes: MAX_CONTEXT_BYTES, + scope_id: scopeId, query: boundedQuery(safePrompt), max_bytes: MAX_CONTEXT_BYTES, }, signal) context = preparedText(value) observation?.record('prepare', context ? 'ready' : 'empty', { content_bytes: value.content_bytes }) } catch (error) { observation?.fail('prepare', error); diagnostic('context_prepare', error) } - if (settings.capturePrompts && prompt.length <= MAX_SOURCE_CHARACTERS && !SECRET_PATTERN.test(prompt) && - !(settings.authorization && prompt.includes(settings.authorization.slice(7))) && !signal.aborted) { + if (settings.capturePrompts && prompt.length <= MAX_SOURCE_CHARACTERS && safePrompt === prompt && !signal.aborted) { const sourceId = 'kimi-user-prompt:' + randomUUID() try { const { status, value } = await request(settings, 'POST', '/v1/sources/content', { diff --git a/integrations/kimi-code/plugins/powercontext/shared/prompt-privacy.mjs b/integrations/kimi-code/plugins/powercontext/shared/prompt-privacy.mjs new file mode 100644 index 0000000000..4f8fa71e9b --- /dev/null +++ b/integrations/kimi-code/plugins/powercontext/shared/prompt-privacy.mjs @@ -0,0 +1,34 @@ +/* + * Copyright (c) 2026 OceanBase. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +const SECRET_PATTERNS = [ + /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/giu, + /(? scrubbed.replace(pattern, '[REDACTED]'), text) +} + +/** Detect secrets without rejecting ordinary words that merely contain a marker. */ +export function containsSecret(text, authorization) { + return scrubSecrets(text, authorization) !== text +} diff --git a/integrations/kimi-code/plugins/powercontext/tests/plugin.test.mjs b/integrations/kimi-code/plugins/powercontext/tests/plugin.test.mjs index e2c54ab598..9fbdc32bae 100644 --- a/integrations/kimi-code/plugins/powercontext/tests/plugin.test.mjs +++ b/integrations/kimi-code/plugins/powercontext/tests/plugin.test.mjs @@ -27,6 +27,31 @@ import { promisify } from 'node:util' const plugin = fileURLToPath(new URL('..', import.meta.url)) const prompt = 'The deployment color is teal-731.' +const { cases: privacyCases } = JSON.parse(await readFile( + new URL('../../../../../tests/fixtures/automatic_prompt_privacy.json', import.meta.url), 'utf8', +)) + +test('automatic prompt privacy preserves preparation and original accepted events', async t => { + for (const sample of privacyCases) { + await t.test(sample.id, async t => { + const state = await fixture(t, {}, { use_token: Boolean(sample.authorization) }) + const result = await state.invoke({ + hook_event_name: 'UserPromptSubmit', cwd: state.workspace, + session_id: `privacy-${sample.id}`, prompt: sample.prompt, + }, sample.authorization ? { POWERCONTEXT_KIMI_TOKEN: sample.authorization.slice(7) } : {}) + const prepares = state.requests.filter(item => item.path === '/v1/context/prepare') + assert.equal(prepares.length, 1, result.stderr) + assert.equal(state.captures.length, sample.sensitive ? 0 : 1) + if (sample.sensitive) { + assert.doesNotMatch(JSON.stringify(state.requests.map(item => item.body)), /synthetic[-_]value[-_]2084/) + assert.doesNotMatch(JSON.stringify(result), /synthetic[-_]value[-_]2084/) + } else { + assert.equal(state.captures[0].content, sample.prompt) + assert.equal(prepares[0].body.query, sample.prompt) + } + }) + } +}) async function fixture(t, overrides = {}, settings = {}, listenHost = '127.0.0.1') { const root = await mkdtemp(join(tmpdir(), 'pc-kimi-')) const installed = join(root, 'plugin') diff --git a/integrations/opencode/plugins/powercontext/lib/index.js b/integrations/opencode/plugins/powercontext/lib/index.js index 4d2b004d7f..31ed5ff6f2 100644 --- a/integrations/opencode/plugins/powercontext/lib/index.js +++ b/integrations/opencode/plugins/powercontext/lib/index.js @@ -452,6 +452,28 @@ const OPERATIONS = { successStatuses: [200], emptyStatuses: [] }, + prepare_bootstrap_context: { + method: "POST", + path: "/v1/context/bootstrap", + location: "body", + scopeMode: "current", + pathParameters: [], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, + record_bootstrap_delivery: { + method: "POST", + path: "/v1/context/bootstrap/receipts", + location: "body", + scopeMode: "current", + pathParameters: [], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, create_work_contract: { method: "POST", path: "/v1/work/contracts/create", @@ -1181,6 +1203,36 @@ const OPERATIONS = { successStatuses: [200], emptyStatuses: [] }, + resolve_artifact_handle: { + method: "GET", + path: "/v1/scopes/{scope_id}/artifact-handles/{family}/{key}", + location: null, + scopeMode: "none", + pathParameters: [ + "scope_id", + "family", + "key" + ], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, + bind_artifact_handle: { + method: "PUT", + path: "/v1/scopes/{scope_id}/artifact-handles/{family}/{key}", + location: "body", + scopeMode: "none", + pathParameters: [ + "scope_id", + "family", + "key" + ], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, get_artifact: { method: "GET", path: "/v1/scopes/{scope_id}/artifacts/{family}/{artifact_id}", @@ -1879,15 +1931,17 @@ async function requestMemoryOperation(client, operationId, payload, scopeId, sig //#region src/secrets.ts const SECRET_PATTERNS = [ /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/giu, - /(? value.replace(pattern, "[REDACTED]"), text); } -function containsSecret(text) { - return scrubSecrets(text) !== text; +function containsSecret(text, authorization) { + return scrubSecrets(text, authorization) !== text; } //#endregion @@ -2135,7 +2189,15 @@ async function flushThrough(runtime, scopeId, position, signal) { } catch {} } async function capturePrompt(runtime, input) { - if (!runtime.config.capturePrompts || Buffer.byteLength(input.prompt, "utf8") > MAX_SOURCE_BYTES || containsSecret(input.prompt)) return; + const reason = !runtime.config.capturePrompts ? "capture_disabled" : Buffer.byteLength(input.prompt, "utf8") > MAX_SOURCE_BYTES ? "source_too_long" : containsSecret(input.prompt, runtime.config.authorization) ? "sensitive_content" : void 0; + if (reason) { + await runtime.log({ + event: "capture_content_source", + outcome: "skipped", + reason + }); + return; + } try { const position = sourcePosition((await runtime.client.request("capture_content_source", { scope_id: input.scopeId, @@ -2166,7 +2228,7 @@ async function prepareTurn(runtime, input) { try { const prepared = validatePreparedContext((await runtime.client.request("prepare_context", { scope_id: context.scopeId, - query: input.prompt, + query: scrubSecrets(input.prompt, runtime.config.authorization), max_bytes: runtime.config.maxBytes, ...runtime.config.contextAssembly === void 0 ? {} : { assembly: runtime.config.contextAssembly } }, signal)).value, runtime.config.maxBytes); diff --git a/integrations/opencode/plugins/powercontext/lib/tui.js b/integrations/opencode/plugins/powercontext/lib/tui.js index ab648f5371..8dbc085d1a 100644 --- a/integrations/opencode/plugins/powercontext/lib/tui.js +++ b/integrations/opencode/plugins/powercontext/lib/tui.js @@ -452,6 +452,28 @@ const OPERATIONS = { successStatuses: [200], emptyStatuses: [] }, + prepare_bootstrap_context: { + method: "POST", + path: "/v1/context/bootstrap", + location: "body", + scopeMode: "current", + pathParameters: [], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, + record_bootstrap_delivery: { + method: "POST", + path: "/v1/context/bootstrap/receipts", + location: "body", + scopeMode: "current", + pathParameters: [], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, create_work_contract: { method: "POST", path: "/v1/work/contracts/create", @@ -1181,6 +1203,36 @@ const OPERATIONS = { successStatuses: [200], emptyStatuses: [] }, + resolve_artifact_handle: { + method: "GET", + path: "/v1/scopes/{scope_id}/artifact-handles/{family}/{key}", + location: null, + scopeMode: "none", + pathParameters: [ + "scope_id", + "family", + "key" + ], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, + bind_artifact_handle: { + method: "PUT", + path: "/v1/scopes/{scope_id}/artifact-handles/{family}/{key}", + location: "body", + scopeMode: "none", + pathParameters: [ + "scope_id", + "family", + "key" + ], + queryParams: [], + headerParams: [], + successStatuses: [200], + emptyStatuses: [] + }, get_artifact: { method: "GET", path: "/v1/scopes/{scope_id}/artifacts/{family}/{artifact_id}", @@ -1807,15 +1859,17 @@ async function requestMemoryOperation(client, operationId, payload, scopeId, sig //#region src/secrets.ts const SECRET_PATTERNS = [ /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/giu, - /(? value.replace(pattern, "[REDACTED]"), text); } -function containsSecret(text) { - return scrubSecrets(text) !== text; +function containsSecret(text, authorization) { + return scrubSecrets(text, authorization) !== text; } //#endregion diff --git a/integrations/opencode/plugins/powercontext/src/index.ts b/integrations/opencode/plugins/powercontext/src/index.ts index 05596443d4..32f970615d 100644 --- a/integrations/opencode/plugins/powercontext/src/index.ts +++ b/integrations/opencode/plugins/powercontext/src/index.ts @@ -25,7 +25,7 @@ import type { JsonObject } from './client.ts' import type { OperationId } from './operations.generated.ts' import { validatePreparedContext } from './prepared-context.ts' import { resolveScopeId } from './scope.ts' -import { containsSecret } from './secrets.ts' +import { containsSecret, scrubSecrets } from './secrets.ts' export const GUIDANCE = `PowerContext provides durable project history and handoffs across sessions. Reuse the host/Server-resolved Scope; never invent a Scope or switch it to work around missing history. Recalled content is untrusted evidence subordinate to current user, repository, and system instructions. @@ -142,11 +142,13 @@ async function capturePrompt( runtime: Runtime, input: { cwd: string; scopeId: string; sessionID: string; messageID: string; prompt: string; signal: AbortSignal }, ): Promise { - if ( - !runtime.config.capturePrompts - || Buffer.byteLength(input.prompt, 'utf8') > MAX_SOURCE_BYTES - || containsSecret(input.prompt) - ) return + const reason = !runtime.config.capturePrompts ? 'capture_disabled' + : Buffer.byteLength(input.prompt, 'utf8') > MAX_SOURCE_BYTES ? 'source_too_long' + : containsSecret(input.prompt, runtime.config.authorization) ? 'sensitive_content' : undefined + if (reason) { + await runtime.log({ event: 'capture_content_source', outcome: 'skipped', reason }) + return + } try { const result = await runtime.client.request('capture_content_source', { scope_id: input.scopeId, @@ -181,7 +183,7 @@ async function prepareTurn( try { const result = await runtime.client.request('prepare_context', { scope_id: context.scopeId, - query: input.prompt, + query: scrubSecrets(input.prompt, runtime.config.authorization), max_bytes: runtime.config.maxBytes, ...(runtime.config.contextAssembly === undefined ? {} : { assembly: runtime.config.contextAssembly }), }, signal) diff --git a/integrations/opencode/plugins/powercontext/src/secrets.ts b/integrations/opencode/plugins/powercontext/src/secrets.ts index 0e815de38c..9470cb6ea6 100644 --- a/integrations/opencode/plugins/powercontext/src/secrets.ts +++ b/integrations/opencode/plugins/powercontext/src/secrets.ts @@ -16,15 +16,17 @@ const SECRET_PATTERNS = [ /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/giu, - /(? value.replace(pattern, '[REDACTED]'), text) } -export function containsSecret(text: string): boolean { - return scrubSecrets(text) !== text +export function containsSecret(text: string, authorization?: string): boolean { + return scrubSecrets(text, authorization) !== text } diff --git a/integrations/opencode/plugins/powercontext/tests/plugin.spec.ts b/integrations/opencode/plugins/powercontext/tests/plugin.spec.ts index b3c4fc1d96..6f8d4c4b29 100644 --- a/integrations/opencode/plugins/powercontext/tests/plugin.spec.ts +++ b/integrations/opencode/plugins/powercontext/tests/plugin.spec.ts @@ -331,6 +331,7 @@ describe('PowerContextPlugin', () => { { message: incoming.info, parts: incoming.parts } as any, ) expect(fetchMock).toHaveBeenCalledTimes(1) + expect(JSON.stringify(fetchMock.mock.calls)).not.toContain('sk-1234567890') }) it('resolves automatic scope and capture cwd per OpenCode session', async () => { diff --git a/integrations/opencode/plugins/powercontext/tests/prompt-privacy.spec.ts b/integrations/opencode/plugins/powercontext/tests/prompt-privacy.spec.ts new file mode 100644 index 0000000000..6bf3ca2024 --- /dev/null +++ b/integrations/opencode/plugins/powercontext/tests/prompt-privacy.spec.ts @@ -0,0 +1,36 @@ +/* + * Copyright (c) 2026 OceanBase. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import { readFileSync } from 'node:fs' +import { describe, expect, it } from 'vitest' +import { containsSecret, scrubSecrets } from '../src/secrets.ts' + +const { cases } = JSON.parse(readFileSync( + new URL('../../../../../tests/fixtures/automatic_prompt_privacy.json', import.meta.url), 'utf8', +)) as { cases: { id: string; prompt: string; sensitive: boolean; authorization?: string }[] } + +describe('shared automatic prompt privacy policy', () => { + it.each(cases)('$id', ({ prompt, sensitive, authorization }) => { + expect(containsSecret(prompt, authorization)).toBe(sensitive) + const query = scrubSecrets(prompt, authorization) + if (sensitive) { + expect(query).not.toContain('synthetic-value-2084') + expect(query).not.toContain('synthetic_value_2084') + } else { + expect(query).toBe(prompt) + } + }) +}) diff --git a/integrations/pi/plugins/powercontext/extensions/powercontext.ts b/integrations/pi/plugins/powercontext/extensions/powercontext.ts index a70e9931fe..12d6be22a3 100644 --- a/integrations/pi/plugins/powercontext/extensions/powercontext.ts +++ b/integrations/pi/plugins/powercontext/extensions/powercontext.ts @@ -48,6 +48,7 @@ function createRuntime(): PluginRuntime { recordCapture: (scopeId, position) => flusher.record(scopeId, position), flushPending: (signal) => flusher.flush(signal), diagnostic, + observe: emitDiagnostic, } } diff --git a/integrations/pi/plugins/powercontext/src/capture.ts b/integrations/pi/plugins/powercontext/src/capture.ts index 888028aa80..d75d1be66e 100644 --- a/integrations/pi/plugins/powercontext/src/capture.ts +++ b/integrations/pi/plugins/powercontext/src/capture.ts @@ -72,7 +72,7 @@ export async function captureUserPrompt(input: CaptureInput): Promise MAX_SOURCE_BYTES - || containsSecret(input.prompt) + || containsSecret(input.prompt, input.config.authorization) ) { return undefined } diff --git a/integrations/pi/plugins/powercontext/src/recall.ts b/integrations/pi/plugins/powercontext/src/recall.ts index c9aa07288f..9177fded7d 100644 --- a/integrations/pi/plugins/powercontext/src/recall.ts +++ b/integrations/pi/plugins/powercontext/src/recall.ts @@ -18,6 +18,8 @@ import { captureUserPrompt } from './capture.ts' import { combineSignals, createTimeoutSignal, type PowerContextClient } from './client.ts' import type { ResolvedConfig } from './config.ts' import { validatePreparedContext } from './prepared-context.ts' +import { scrubSecrets } from './secrets.ts' +import type { DiagnosticEvent } from './diagnostics.ts' export interface PluginRuntime { client: PowerContextClient @@ -26,6 +28,7 @@ export interface PluginRuntime { recordCapture?: (scopeId: string, position: number) => void flushPending?: (signal?: AbortSignal) => Promise diagnostic?: (event: string, error: unknown) => void + observe?: (event: DiagnosticEvent) => void } export interface BeforeAgentStartInput { @@ -76,11 +79,19 @@ export async function recallBeforeAgentStart(input: BeforeAgentStartInput): Prom const signals = [createTimeoutSignal(input.runtime.config.httpBudgetMs)] if (input.signal) signals.push(input.signal) const signal = combineSignals(signals) + const safePrompt = scrubSecrets(prompt, input.runtime.config.authorization) + if (safePrompt !== prompt) { + try { + input.runtime.observe?.({ event: 'capture_source', outcome: 'skipped', reason: 'sensitive_content' }) + } catch { + // Diagnostic delivery must not change preparation or capture behavior. + } + } let content: string | undefined try { const response = await input.runtime.client.request('prepare_context', { scope_id: scopeId, - query: prompt, + query: safePrompt, max_bytes: input.runtime.config.maxBytes, ...(input.runtime.config.contextAssembly === undefined ? {} : { assembly: input.runtime.config.contextAssembly }), }, signal) diff --git a/integrations/pi/plugins/powercontext/src/secrets.ts b/integrations/pi/plugins/powercontext/src/secrets.ts index c8abdb5aa1..0ce9f0ee7e 100644 --- a/integrations/pi/plugins/powercontext/src/secrets.ts +++ b/integrations/pi/plugins/powercontext/src/secrets.ts @@ -16,17 +16,19 @@ const SECRET_PATTERNS = [ /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/giu, - /(? scrubbed.replace(pattern, '[REDACTED]'), text) } /** Detect secrets without rejecting ordinary words that merely contain a marker. */ -export function containsSecret(text: string): boolean { - return scrubSecrets(text) !== text +export function containsSecret(text: string, authorization?: string): boolean { + return scrubSecrets(text, authorization) !== text } diff --git a/integrations/pi/plugins/powercontext/tests/extension.spec.ts b/integrations/pi/plugins/powercontext/tests/extension.spec.ts index 77da804e58..317591a1e0 100644 --- a/integrations/pi/plugins/powercontext/tests/extension.spec.ts +++ b/integrations/pi/plugins/powercontext/tests/extension.spec.ts @@ -438,6 +438,7 @@ describe('PowerContext Pi extension', () => { })).resolves.toEqual({ systemPrompt: `Base instructions\n\n${GUIDANCE}` }) expect(fetch.mock.calls.some(([url]) => url === 'http://127.0.0.1:8000/v1/sources/content')).toBe(false) + expect(JSON.stringify(fetch.mock.calls)).not.toContain('sk-live-secret') }) it('does not persist a prompt containing a conventional password assignment', async () => { diff --git a/integrations/pi/plugins/powercontext/tests/prompt-privacy.spec.ts b/integrations/pi/plugins/powercontext/tests/prompt-privacy.spec.ts new file mode 100644 index 0000000000..6bf3ca2024 --- /dev/null +++ b/integrations/pi/plugins/powercontext/tests/prompt-privacy.spec.ts @@ -0,0 +1,36 @@ +/* + * Copyright (c) 2026 OceanBase. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import { readFileSync } from 'node:fs' +import { describe, expect, it } from 'vitest' +import { containsSecret, scrubSecrets } from '../src/secrets.ts' + +const { cases } = JSON.parse(readFileSync( + new URL('../../../../../tests/fixtures/automatic_prompt_privacy.json', import.meta.url), 'utf8', +)) as { cases: { id: string; prompt: string; sensitive: boolean; authorization?: string }[] } + +describe('shared automatic prompt privacy policy', () => { + it.each(cases)('$id', ({ prompt, sensitive, authorization }) => { + expect(containsSecret(prompt, authorization)).toBe(sensitive) + const query = scrubSecrets(prompt, authorization) + if (sensitive) { + expect(query).not.toContain('synthetic-value-2084') + expect(query).not.toContain('synthetic_value_2084') + } else { + expect(query).toBe(prompt) + } + }) +}) diff --git a/integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py b/integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py new file mode 100644 index 0000000000..333f322ca5 --- /dev/null +++ b/integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py @@ -0,0 +1,40 @@ +# Copyright (c) 2026 OceanBase. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Best-effort credential recognition for automatic host inputs.""" + +from __future__ import annotations + +import re + +_PATTERN = re.compile( + r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)" + r"""|(? str: + """Replace recognized values in a read-only query; never use this to rewrite a captured event.""" + + if authorization: + _, _, credential = authorization.partition(" ") + if credential: + text = text.replace(credential, "[REDACTED]") + return _PATTERN.sub("[REDACTED]", text) diff --git a/integrations/workbuddy/plugins/powercontext/hooks/workbuddy_powercontext_hook.py b/integrations/workbuddy/plugins/powercontext/hooks/workbuddy_powercontext_hook.py index 7123e3b80b..3727ad15eb 100644 --- a/integrations/workbuddy/plugins/powercontext/hooks/workbuddy_powercontext_hook.py +++ b/integrations/workbuddy/plugins/powercontext/hooks/workbuddy_powercontext_hook.py @@ -39,6 +39,7 @@ sys.path.insert(0, str(_SCRIPTS_ROOT)) import prepared_context as _prepared_context # noqa: E402 +from prompt_privacy import scrub_secrets # noqa: E402 from workbuddy_settings import WorkBuddyPluginSettings # noqa: E402 if (_HOOKS_ROOT / "powercontext_scope_binding.py").is_file(): @@ -106,7 +107,8 @@ def main(settings: WorkBuddyPluginSettings | None = None) -> int: cwd = payload.get("cwd") context = None if prompt is not None and prompt.strip() and isinstance(cwd, str): - query = _recall_query(prompt) + safe_prompt = scrub_secrets(prompt, settings.authorization) + query = _recall_query(safe_prompt) http_deadline = monotonic() + settings.http_budget_seconds try: scope_id = resolve_scope_id( @@ -131,7 +133,10 @@ def main(settings: WorkBuddyPluginSettings | None = None) -> int: deadline=http_deadline, ) - if settings.capture_prompts and len(prompt) <= _MAX_SOURCE_LENGTH: + if safe_prompt != prompt: + with suppress(Exception): + _emit_context_event("skipped", event_name="capture_source", reason="sensitive_content") + elif settings.capture_prompts and len(prompt) <= _MAX_SOURCE_LENGTH: with suppress(Exception): captured = _capture_prompt( payload, @@ -549,13 +554,15 @@ def _recall_context( def _emit_context_event( outcome: str, *, + event_name: str = "context_prepare", + reason: str | None = None, http_status: int | None = None, context_status: str | None = None, content_bytes: int | None = None, ) -> None: event: dict[str, object] = { "component": "powercontext.workbuddy.recall", - "event": "context_prepare", + "event": event_name, "outcome": outcome, } if http_status is not None: @@ -564,6 +571,8 @@ def _emit_context_event( event["context_status"] = context_status if content_bytes is not None: event["content_bytes"] = content_bytes + if reason is not None: + event["reason"] = reason sys.stderr.write(json.dumps(event, separators=(",", ":")) + "\n") diff --git a/integrations/zcode/plugins/powercontext/hooks/user_prompt_submit.mjs b/integrations/zcode/plugins/powercontext/hooks/user_prompt_submit.mjs index 2f8b9407c0..1e895cb45b 100644 --- a/integrations/zcode/plugins/powercontext/hooks/user_prompt_submit.mjs +++ b/integrations/zcode/plugins/powercontext/hooks/user_prompt_submit.mjs @@ -20,11 +20,11 @@ import { bindingKeys, resolveScope, sessionIdentity, sha256 } from '../shared/sc import { failureResult, stageResult, startObservation } from '../shared/observations.mjs' import { beginCaptureTracking } from '../shared/pending.mjs' import { failureCode, HOOK_BUDGET_MS, request } from '../shared/transport.mjs' +import { scrubSecrets } from '../shared/prompt-privacy.mjs' const SETTINGS = loadSettings() const MAX_QUERY_CHARACTERS = 8_192 const MAX_SOURCE_CHARACTERS = 200_000 -const SECRET_PATTERN = /(?:\b(?:api[_-]?key|access[_-]?token|token|authorization|password|secret|private[_-]?key)["']?\s*[:=]\s*\S+|\bbearer\s+\S+|\bsk-[A-Za-z0-9_-]{8,}|-----BEGIN [^-]*PRIVATE KEY-----)/iu function diagnostic(stage, code) { process.stderr.write(`${JSON.stringify({ component: 'powercontext.zcode', stage, code })}\n`) @@ -87,7 +87,8 @@ async function run(input) { // binding separate from recalled history so explicit MCP calls can reuse the exact identity. const binding = bindingContext(scopeId, keys) let context = '' - const query = boundedQuery(input.prompt) + const safePrompt = scrubSecrets(input.prompt, SETTINGS.authorization) + const query = boundedQuery(safePrompt) if (query) { try { await observe('prepare', stageResult('running')) @@ -105,7 +106,7 @@ async function run(input) { } if (SETTINGS.capturePrompts && input.prompt.length <= MAX_SOURCE_CHARACTERS && - !SECRET_PATTERN.test(input.prompt)) { + safePrompt === input.prompt) { let tracking, trackingIncomplete = false try { await observe('capture', stageResult('running')) diff --git a/integrations/zcode/plugins/powercontext/shared/prompt-privacy.mjs b/integrations/zcode/plugins/powercontext/shared/prompt-privacy.mjs new file mode 100644 index 0000000000..4f8fa71e9b --- /dev/null +++ b/integrations/zcode/plugins/powercontext/shared/prompt-privacy.mjs @@ -0,0 +1,34 @@ +/* + * Copyright (c) 2026 OceanBase. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +const SECRET_PATTERNS = [ + /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/giu, + /(? scrubbed.replace(pattern, '[REDACTED]'), text) +} + +/** Detect secrets without rejecting ordinary words that merely contain a marker. */ +export function containsSecret(text, authorization) { + return scrubSecrets(text, authorization) !== text +} diff --git a/integrations/zcode/plugins/powercontext/tests/plugin.test.mjs b/integrations/zcode/plugins/powercontext/tests/plugin.test.mjs index 8df0055891..35c3eb93ea 100644 --- a/integrations/zcode/plugins/powercontext/tests/plugin.test.mjs +++ b/integrations/zcode/plugins/powercontext/tests/plugin.test.mjs @@ -25,12 +25,38 @@ import { after, before, beforeEach, test } from 'node:test' const pluginRoot = dirname(dirname(fileURLToPath(import.meta.url))) const hookPath = join(pluginRoot, 'hooks', 'user_prompt_submit.mjs') +const { cases: privacyCases } = JSON.parse(await readFile( + new URL('../../../../../tests/fixtures/automatic_prompt_privacy.json', import.meta.url), 'utf8', +)) let server let serverUrl const requests = [] let override = {} let dataDir +test('automatic prompt privacy preserves preparation and original accepted events', async t => { + for (const sample of privacyCases) { + await t.test(sample.id, async () => { + requests.length = 0 + const result = await invoke({ + hookEventName: 'UserPromptSubmit', cwd: dataDir, sessionId: `privacy-${sample.id}`, + turnId: '1', prompt: sample.prompt, + }, { POWERCONTEXT_ZCODE_AUTHORIZATION: sample.authorization ?? '' }) + const prepares = requests.filter(item => item.path === '/v1/context/prepare') + const captures = requests.filter(item => item.path === '/v1/sources/content') + assert.equal(prepares.length, 1, result.stderr) + assert.equal(captures.length, sample.sensitive ? 0 : 1) + if (sample.sensitive) { + assert.doesNotMatch(JSON.stringify(requests), /synthetic[-_]value[-_]2084/) + assert.doesNotMatch(JSON.stringify(result), /synthetic[-_]value[-_]2084/) + } else { + assert.equal(captures[0].body.content, sample.prompt) + assert.equal(prepares[0].body.query, sample.prompt) + } + }) + } +}) + beforeEach(() => { requests.length = 0 override = {} diff --git a/src/powercontext/cli/workbuddy.py b/src/powercontext/cli/workbuddy.py index 3ecd8cf900..b15f1f29e9 100644 --- a/src/powercontext/cli/workbuddy.py +++ b/src/powercontext/cli/workbuddy.py @@ -56,6 +56,7 @@ "workbuddy_settings.py", "powercontext_client_config.py", "prepared_context.py", + "prompt_privacy.py", ) WORKBUDDY_SCRIPT_MODULES = ("__init__.py", "workspace_scope.py") WORKBUDDY_SERVER_URL_ENV = "POWERCONTEXT_WORKBUDDY_SERVER_URL" diff --git a/tests/claude_code_plugin/conftest.py b/tests/claude_code_plugin/conftest.py index b3bea7bbfa..0b918468d7 100644 --- a/tests/claude_code_plugin/conftest.py +++ b/tests/claude_code_plugin/conftest.py @@ -31,6 +31,7 @@ "hooks", "hooks.bootstrap_context", "hooks.prepared_context", + "hooks.prompt_privacy", "scripts", "scripts.workspace_scope", "workspace_scope", diff --git a/tests/fixtures/automatic_prompt_privacy.json b/tests/fixtures/automatic_prompt_privacy.json new file mode 100644 index 0000000000..05d57451b9 --- /dev/null +++ b/tests/fixtures/automatic_prompt_privacy.json @@ -0,0 +1,76 @@ +{ + "schema": "powercontext.automatic-prompt-privacy.v1", + "cases": [ + { + "id": "ordinary", + "prompt": "Use immutable citations and keep the current Scope.", + "sensitive": false + }, + { + "id": "ordinary-marker-words", + "prompt": "Explain token budgets, password hashing, and secret rotation.", + "sensitive": false + }, + { + "id": "identifier-substrings", + "prompt": "The tokenizer and my_secret_helper need a regression test.", + "sensitive": false + }, + { + "id": "assignment", + "prompt": "Configure api_key=synthetic-value-2084 for this test.", + "sensitive": true + }, + { + "id": "quoted-json", + "prompt": "Use {\"password\":\"synthetic-value-2084\"} for the test.", + "sensitive": true + }, + { + "id": "access-token", + "prompt": "Configure access_token=synthetic-value-2084 for this test.", + "sensitive": true + }, + { + "id": "cookie", + "prompt": "Cookie: synthetic-value-2084", + "sensitive": true + }, + { + "id": "bearer", + "prompt": "Use Bearer synthetic-value-2084 for the request.", + "sensitive": true + }, + { + "id": "provider-token", + "prompt": "Use sk-synthetic-value-2084 for the request.", + "sensitive": true + }, + { + "id": "github-token", + "prompt": "Use github_pat_synthetic_value_2084 for the request.", + "sensitive": true + }, + { + "id": "private-key", + "prompt": "Inspect this:\n-----BEGIN PRIVATE KEY-----\nsynthetic-value-2084\n-----END PRIVATE KEY-----", + "sensitive": true + }, + { + "id": "unfinished-private-key", + "prompt": "Inspect this:\n-----BEGIN PRIVATE KEY-----\nsynthetic-value-2084", + "sensitive": true + }, + { + "id": "known-server-token", + "prompt": "Use this opaque synthetic-value-2084 in the request.", + "authorization": "Bearer synthetic-value-2084", + "sensitive": true + }, + { + "id": "conservative-placeholder", + "prompt": "Example password=synthetic-value-2084 is deliberately skipped.", + "sensitive": true + } + ] +} diff --git a/tests/test_automatic_prompt_privacy.py b/tests/test_automatic_prompt_privacy.py new file mode 100644 index 0000000000..90e786a1e9 --- /dev/null +++ b/tests/test_automatic_prompt_privacy.py @@ -0,0 +1,142 @@ +# Copyright (c) 2026 OceanBase. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Automatic hooks must not capture recognized credentials or forward them as queries.""" + +from __future__ import annotations + +import json +import os +import shutil +import subprocess +import sys +from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer +from pathlib import Path +from threading import Thread + +import pytest + +ROOT = Path(__file__).resolve().parents[1] +CASES = json.loads((ROOT / "tests/fixtures/automatic_prompt_privacy.json").read_text(encoding="utf-8"))["cases"] +HOOKS = { + "claude": "claude-code/plugins/powercontext/hooks/user_prompt_submit.py", + "codex": "codex/plugins/powercontext/hooks/recall.py", + "workbuddy": "workbuddy/plugins/powercontext/hooks/workbuddy_powercontext_hook.py", +} + + +@pytest.mark.parametrize("host", HOOKS) +@pytest.mark.parametrize("case", CASES, ids=lambda case: case["id"]) +def test_automatic_hook_skips_credentials_without_disabling_preparation(tmp_path, host, case): + requests: list[tuple[str, dict[str, object]]] = [] + + class Handler(BaseHTTPRequestHandler): + def do_POST(self): + value = json.loads(self.rfile.read(int(self.headers["Content-Length"]))) + requests.append((self.path, value)) + status = 200 + if self.path == "/v1/scope-bindings/resolve": + result = {"scope_id": "scope-privacy"} + elif self.path == "/v1/context/prepare": + result = { + "schema": "powercontext.prepared-context.v1", + "status": "ready", + "content": "safe historical context", + "content_bytes": len("safe historical context"), + } + elif self.path == "/v1/sources/content": + status = 202 + result = { + "status": "accepted", + "source": {"name": "content", "source_id": value["source_id"]}, + "position": 1, + } + else: + self.send_error(404) + return + body = json.dumps(result).encode() + self.send_response(status) + self.send_header("Content-Type", "application/json") + self.send_header("Content-Length", str(len(body))) + self.end_headers() + self.wfile.write(body) + + def log_message(self, format, *_args): # noqa: A002 - BaseHTTPRequestHandler override. + pass + + server = ThreadingHTTPServer(("127.0.0.1", 0), Handler) + thread = Thread(target=server.serve_forever, daemon=True) + thread.start() + environment = { + key: value + for key, value in os.environ.items() + if not key.startswith(("POWERCONTEXT_", "CLAUDE_PLUGIN_OPTION_")) + } + prefix = f"POWERCONTEXT_{host.upper()}_" + environment.update({ + f"{prefix}SERVER_URL": f"http://127.0.0.1:{server.server_port}", + f"{prefix}CAPTURE_PROMPTS": "true", + f"{prefix}FLUSH_ON_CAPTURE": "false", + "POWERCONTEXT_DIAGNOSTIC_STATE_FILE": str(tmp_path / "diagnostics.json"), + "POWERCONTEXT_BOOTSTRAP_STATE_DIR": str(tmp_path / "bootstrap"), + "POWERCONTEXT_CLAUDE_BOOTSTRAP_STATE_DIR": str(tmp_path / "bootstrap"), + "CODEX_HOME": str(tmp_path / "codex"), + }) + if "authorization" in case: + environment[f"{prefix}AUTHORIZATION"] = case["authorization"] + hook = ROOT / "integrations" / HOOKS[host] + if host == "codex": + # Codex's installed MCP configuration intentionally outranks environment URLs. + plugin = tmp_path / "plugin" + shutil.copytree(hook.parents[1], plugin, ignore=shutil.ignore_patterns("__pycache__", ".venv")) + configuration = plugin / ".mcp.json" + value = json.loads(configuration.read_text(encoding="utf-8")) + value["mcpServers"]["powercontext"]["url"] = f"http://127.0.0.1:{server.server_port}/mcp/" + configuration.write_text(json.dumps(value), encoding="utf-8") + hook = plugin / "hooks/recall.py" + try: + completed = subprocess.run( + [sys.executable, str(hook)], + input=json.dumps({ + "hook_event_name": "UserPromptSubmit", + "prompt": case["prompt"], + "cwd": str(tmp_path), + }), + capture_output=True, + text=True, + env=environment, + timeout=15, + check=True, + ) + finally: + server.shutdown() + thread.join() + server.server_close() + + prepares = [value for path, value in requests if path == "/v1/context/prepare"] + captures = [value for path, value in requests if path == "/v1/sources/content"] + assert prepares, completed.stderr + output = json.loads(completed.stdout) + assert "safe historical context" in output["hookSpecificOutput"]["additionalContext"] + if case["sensitive"]: + assert captures == [] + assert "synthetic-value-2084" not in json.dumps(requests) + assert "synthetic_value_2084" not in json.dumps(requests) + assert "synthetic-value-2084" not in completed.stdout + completed.stderr + assert "synthetic_value_2084" not in completed.stdout + completed.stderr + assert "sensitive_content" in completed.stderr + else: + assert len(captures) == 1 + assert captures[0]["content"] == case["prompt"] + assert prepares[0]["query"] == case["prompt"] diff --git a/tests/test_cli_workbuddy.py b/tests/test_cli_workbuddy.py index 853147886a..0093b607bc 100644 --- a/tests/test_cli_workbuddy.py +++ b/tests/test_cli_workbuddy.py @@ -37,6 +37,7 @@ "workbuddy_settings.py", "powercontext_client_config.py", "prepared_context.py", + "prompt_privacy.py", ) diff --git a/tests/workbuddy_plugin/conftest.py b/tests/workbuddy_plugin/conftest.py index 2db964ed2d..00643d20e3 100644 --- a/tests/workbuddy_plugin/conftest.py +++ b/tests/workbuddy_plugin/conftest.py @@ -30,6 +30,7 @@ "powercontext_client_config", "powercontext_scope_binding", "prepared_context", + "prompt_privacy", "workbuddy_settings", "workspace_scope", ) From b7d3c7b9a2e603242da2c95e111be177f079ba79 Mon Sep 17 00:00:00 2001 From: "Xin.Zh" Date: Wed, 21 Oct 2026 21:55:59 +0800 Subject: [PATCH 2/3] fix(integrations): redact complete credential header values Consume Authorization and Cookie headers before single-token assignments, including proxy/set-cookie variants and folded continuations. Add shared header cases and hook/HTTP regressions with capture both enabled and disabled. Constraint: keep automatic capture whole-event skipping and preserve accepted Source identity and contents. Scope-risk: conservative header recognition removes remaining prose on the same line only from automatic read-only queries. Tested: 30 header regressions fail before the fix; Linux hook/usage suite 104 passed; Pi 126 passed; OpenCode 93 passed; Kimi/ZCode 83 passed; both TypeScript checks, OpenCode build, full Linux Ty and changed-file pre-commit checks pass. --- docs/en/docs/integrations/index.md | 4 +++ docs/zh/docs/integrations/index.md | 3 +++ .../powercontext/hooks/prompt_privacy.py | 3 +++ .../powercontext/hooks/prompt_privacy.py | 3 +++ .../powercontext/shared/prompt-privacy.mjs | 2 ++ .../powercontext/tests/plugin.test.mjs | 12 ++++++--- .../plugins/powercontext/lib/index.js | 1 + .../opencode/plugins/powercontext/lib/tui.js | 1 + .../plugins/powercontext/src/secrets.ts | 2 ++ .../pi/plugins/powercontext/src/secrets.ts | 2 ++ .../powercontext/hooks/prompt_privacy.py | 3 +++ .../powercontext/shared/prompt-privacy.mjs | 2 ++ .../powercontext/tests/plugin.test.mjs | 15 ++++++++--- tests/fixtures/automatic_prompt_privacy.json | 25 +++++++++++++++++++ tests/test_automatic_prompt_privacy.py | 11 +++++--- 15 files changed, 78 insertions(+), 11 deletions(-) diff --git a/docs/en/docs/integrations/index.md b/docs/en/docs/integrations/index.md index bc46e2d88c..2c90f25849 100644 --- a/docs/en/docs/integrations/index.md +++ b/docs/en/docs/integrations/index.md @@ -69,6 +69,10 @@ also skips examples such as `password=example`. Ordinary words such as “token The shared synthetic corpus is `tests/fixtures/automatic_prompt_privacy.json`; it defines tested examples, not proof that arbitrary credentials are detected. +Authorization, Proxy-Authorization, Cookie and Set-Cookie assignments consume the complete header value, +including schemes, cookie attributes and folded continuation lines, before ordinary assignments are matched. +This conservatively removes any other prose on the same header line from the automatic query. + A recognized input is skipped as a whole for capture. The adapter never redacts a Source body and then attaches the original event's identity or receipt to it. Accepted events keep their existing host text normalization and identity semantics; distinct events and retries follow the host's documented contract. diff --git a/docs/zh/docs/integrations/index.md b/docs/zh/docs/integrations/index.md index 3fd9bc3c98..3ce4b71eb8 100644 --- a/docs/zh/docs/integrations/index.md +++ b/docs/zh/docs/integrations/index.md @@ -63,6 +63,9 @@ passphrase、authorization、cookie）、至少八个 token 字符的 Bearer 值 普通词语不属于赋值。共享合成用例位于 `tests/fixtures/automatic_prompt_privacy.json`，它定义已测试示例， 不能证明任意凭据都能被识别。 +Authorization、Proxy-Authorization、Cookie 和 Set-Cookie 赋值会先匹配完整的 header 值，包含鉴权方案、 +Cookie 属性和折行续接内容，再匹配普通赋值。这种保守处理也会从自动查询中移除同一 header 行的其他说明文字。 + 识别到凭据时整条跳过捕获，不会修改 Source 正文后继续沿用原事件身份或回执。接受的事件保留既有宿主文本 规范化和身份语义，不同事件与重试继续遵守各自宿主契约。本地诊断或已配置的观测只报告有界原因 `sensitive_content`（Kimi 为 `sensitive`），不包含拒绝的文本。Pi 通过配置的诊断输出报告，`off` 表示关闭输出。 diff --git a/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py b/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py index 333f322ca5..275a972668 100644 --- a/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py +++ b/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py @@ -20,6 +20,9 @@ _PATTERN = re.compile( r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)" + # Headers can contain schemes, multiple cookies, and folded continuation lines. + r"""|(? { - for (const sample of privacyCases) { - await t.test(sample.id, async t => { - const state = await fixture(t, {}, { use_token: Boolean(sample.authorization) }) + const scenarios = [ + ...privacyCases.map(sample => ({ sample, capture: true })), + ...privacyCases.filter(sample => sample.id.endsWith('-header')).map(sample => ({ sample, capture: false })), + ] + for (const { sample, capture } of scenarios) { + await t.test(`${sample.id}-capture-${capture}`, async t => { + const state = await fixture(t, {}, { use_token: Boolean(sample.authorization), capture_prompts: capture }) const result = await state.invoke({ hook_event_name: 'UserPromptSubmit', cwd: state.workspace, session_id: `privacy-${sample.id}`, prompt: sample.prompt, }, sample.authorization ? { POWERCONTEXT_KIMI_TOKEN: sample.authorization.slice(7) } : {}) const prepares = state.requests.filter(item => item.path === '/v1/context/prepare') assert.equal(prepares.length, 1, result.stderr) - assert.equal(state.captures.length, sample.sensitive ? 0 : 1) + assert.equal(state.captures.length, sample.sensitive || !capture ? 0 : 1) if (sample.sensitive) { assert.doesNotMatch(JSON.stringify(state.requests.map(item => item.body)), /synthetic[-_]value[-_]2084/) assert.doesNotMatch(JSON.stringify(result), /synthetic[-_]value[-_]2084/) diff --git a/integrations/opencode/plugins/powercontext/lib/index.js b/integrations/opencode/plugins/powercontext/lib/index.js index 31ed5ff6f2..e67f84c1a0 100644 --- a/integrations/opencode/plugins/powercontext/lib/index.js +++ b/integrations/opencode/plugins/powercontext/lib/index.js @@ -1931,6 +1931,7 @@ async function requestMemoryOperation(client, operationId, payload, scopeId, sig //#region src/secrets.ts const SECRET_PATTERNS = [ /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/giu, + /(? { - for (const sample of privacyCases) { - await t.test(sample.id, async () => { + const scenarios = [ + ...privacyCases.map(sample => ({ sample, capture: true })), + ...privacyCases.filter(sample => sample.id.endsWith('-header')).map(sample => ({ sample, capture: false })), + ] + for (const { sample, capture } of scenarios) { + await t.test(`${sample.id}-capture-${capture}`, async () => { requests.length = 0 const result = await invoke({ hookEventName: 'UserPromptSubmit', cwd: dataDir, sessionId: `privacy-${sample.id}`, turnId: '1', prompt: sample.prompt, - }, { POWERCONTEXT_ZCODE_AUTHORIZATION: sample.authorization ?? '' }) + }, { + POWERCONTEXT_ZCODE_AUTHORIZATION: sample.authorization ?? '', + POWERCONTEXT_ZCODE_CAPTURE_PROMPTS: String(capture), + }) const prepares = requests.filter(item => item.path === '/v1/context/prepare') const captures = requests.filter(item => item.path === '/v1/sources/content') assert.equal(prepares.length, 1, result.stderr) - assert.equal(captures.length, sample.sensitive ? 0 : 1) + assert.equal(captures.length, sample.sensitive || !capture ? 0 : 1) if (sample.sensitive) { assert.doesNotMatch(JSON.stringify(requests), /synthetic[-_]value[-_]2084/) assert.doesNotMatch(JSON.stringify(result), /synthetic[-_]value[-_]2084/) diff --git a/tests/fixtures/automatic_prompt_privacy.json b/tests/fixtures/automatic_prompt_privacy.json index 05d57451b9..98fd5e1469 100644 --- a/tests/fixtures/automatic_prompt_privacy.json +++ b/tests/fixtures/automatic_prompt_privacy.json @@ -36,6 +36,31 @@ "prompt": "Cookie: synthetic-value-2084", "sensitive": true }, + { + "id": "authorization-header", + "prompt": "Authorization: Bearer synthetic-value-2084", + "sensitive": true + }, + { + "id": "cookie-header", + "prompt": "Cookie: theme=light; session=synthetic-value-2084", + "sensitive": true + }, + { + "id": "proxy-authorization-header", + "prompt": "Proxy-Authorization: Basic synthetic-value-2084", + "sensitive": true + }, + { + "id": "set-cookie-header", + "prompt": "Set-Cookie: session=synthetic-value-2084; Secure; HttpOnly", + "sensitive": true + }, + { + "id": "folded-authorization-header", + "prompt": "Authorization: Bearer\r\n synthetic-value-2084\r\nAccept: application/json", + "sensitive": true + }, { "id": "bearer", "prompt": "Use Bearer synthetic-value-2084 for the request.", diff --git a/tests/test_automatic_prompt_privacy.py b/tests/test_automatic_prompt_privacy.py index 90e786a1e9..933c965cdc 100644 --- a/tests/test_automatic_prompt_privacy.py +++ b/tests/test_automatic_prompt_privacy.py @@ -37,8 +37,13 @@ @pytest.mark.parametrize("host", HOOKS) -@pytest.mark.parametrize("case", CASES, ids=lambda case: case["id"]) -def test_automatic_hook_skips_credentials_without_disabling_preparation(tmp_path, host, case): +@pytest.mark.parametrize( + ("case", "capture_enabled"), + [(case, True) for case in CASES] + [(case, False) for case in CASES if case["id"].endswith("-header")], + ids=[case["id"] for case in CASES] + + [f"{case['id']}-capture-disabled" for case in CASES if case["id"].endswith("-header")], +) +def test_automatic_hook_skips_credentials_without_disabling_preparation(tmp_path, host, case, capture_enabled): requests: list[tuple[str, dict[str, object]]] = [] class Handler(BaseHTTPRequestHandler): @@ -86,7 +91,7 @@ def log_message(self, format, *_args): # noqa: A002 - BaseHTTPRequestHandler ov prefix = f"POWERCONTEXT_{host.upper()}_" environment.update({ f"{prefix}SERVER_URL": f"http://127.0.0.1:{server.server_port}", - f"{prefix}CAPTURE_PROMPTS": "true", + f"{prefix}CAPTURE_PROMPTS": str(capture_enabled).lower(), f"{prefix}FLUSH_ON_CAPTURE": "false", "POWERCONTEXT_DIAGNOSTIC_STATE_FILE": str(tmp_path / "diagnostics.json"), "POWERCONTEXT_BOOTSTRAP_STATE_DIR": str(tmp_path / "bootstrap"), From 238127c9066a82f477546488323241b8dd76ad51 Mon Sep 17 00:00:00 2001 From: "Xin.Zh" Date: Thu, 22 Oct 2026 17:27:59 +0800 Subject: [PATCH 3/3] fix(privacy): redact PEM blocks before credential assignments Remove complete or unfinished PEM blocks before assignment and header matching can consume their BEGIN markers. Apply the same sequence to Claude Code, Codex and WorkBuddy and extend the shared corpus. Constraint: retain whole-event capture skipping and normal read-only preparation. Scope-risk: only recognized private-key queries change; accepted Source content and identity remain unchanged. Tested: 18 subprocess/HTTP regressions fail before the fix; Linux Python suites 128 passed; Pi 129, OpenCode 96, Kimi/ZCode 91 passed; TypeScript and changed-file pre-commit hooks including full Python 3.11 Ty passed. --- .../plugins/powercontext/hooks/prompt_privacy.py | 10 +++++++--- .../plugins/powercontext/hooks/prompt_privacy.py | 10 +++++++--- .../plugins/powercontext/hooks/prompt_privacy.py | 10 +++++++--- tests/fixtures/automatic_prompt_privacy.json | 15 +++++++++++++++ tests/test_automatic_prompt_privacy.py | 6 +++--- 5 files changed, 39 insertions(+), 12 deletions(-) diff --git a/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py b/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py index 275a972668..3dd6bf4ed8 100644 --- a/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py +++ b/integrations/claude-code/plugins/powercontext/hooks/prompt_privacy.py @@ -18,10 +18,13 @@ import re +_PRIVATE_KEY = re.compile( + r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)", + re.IGNORECASE | re.ASCII, +) _PATTERN = re.compile( - r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)" # Headers can contain schemes, multiple cookies, and folded continuation lines. - r"""|(? str: _, _, credential = authorization.partition(" ") if credential: text = text.replace(credential, "[REDACTED]") - return _PATTERN.sub("[REDACTED]", text) + # Remove whole PEM blocks before an earlier assignment/header can consume their BEGIN marker. + return _PATTERN.sub("[REDACTED]", _PRIVATE_KEY.sub("[REDACTED]", text)) diff --git a/integrations/codex/plugins/powercontext/hooks/prompt_privacy.py b/integrations/codex/plugins/powercontext/hooks/prompt_privacy.py index 275a972668..3dd6bf4ed8 100644 --- a/integrations/codex/plugins/powercontext/hooks/prompt_privacy.py +++ b/integrations/codex/plugins/powercontext/hooks/prompt_privacy.py @@ -18,10 +18,13 @@ import re +_PRIVATE_KEY = re.compile( + r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)", + re.IGNORECASE | re.ASCII, +) _PATTERN = re.compile( - r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)" # Headers can contain schemes, multiple cookies, and folded continuation lines. - r"""|(? str: _, _, credential = authorization.partition(" ") if credential: text = text.replace(credential, "[REDACTED]") - return _PATTERN.sub("[REDACTED]", text) + # Remove whole PEM blocks before an earlier assignment/header can consume their BEGIN marker. + return _PATTERN.sub("[REDACTED]", _PRIVATE_KEY.sub("[REDACTED]", text)) diff --git a/integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py b/integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py index 275a972668..3dd6bf4ed8 100644 --- a/integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py +++ b/integrations/workbuddy/plugins/powercontext/hooks/prompt_privacy.py @@ -18,10 +18,13 @@ import re +_PRIVATE_KEY = re.compile( + r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)", + re.IGNORECASE | re.ASCII, +) _PATTERN = re.compile( - r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)" # Headers can contain schemes, multiple cookies, and folded continuation lines. - r"""|(? str: _, _, credential = authorization.partition(" ") if credential: text = text.replace(credential, "[REDACTED]") - return _PATTERN.sub("[REDACTED]", text) + # Remove whole PEM blocks before an earlier assignment/header can consume their BEGIN marker. + return _PATTERN.sub("[REDACTED]", _PRIVATE_KEY.sub("[REDACTED]", text)) diff --git a/tests/fixtures/automatic_prompt_privacy.json b/tests/fixtures/automatic_prompt_privacy.json index 98fd5e1469..3bfaba707d 100644 --- a/tests/fixtures/automatic_prompt_privacy.json +++ b/tests/fixtures/automatic_prompt_privacy.json @@ -86,6 +86,21 @@ "prompt": "Inspect this:\n-----BEGIN PRIVATE KEY-----\nsynthetic-value-2084", "sensitive": true }, + { + "id": "assigned-private-key", + "prompt": "private_key=\"-----BEGIN PRIVATE KEY-----\nsynthetic-value-2084\n-----END PRIVATE KEY-----\"", + "sensitive": true + }, + { + "id": "unfinished-assigned-private-key", + "prompt": "private_key='-----BEGIN RSA PRIVATE KEY-----\r\nsynthetic-value-2084", + "sensitive": true + }, + { + "id": "pem-authorization-header", + "prompt": "Authorization: -----BEGIN PRIVATE KEY-----\nsynthetic-value-2084\n-----END PRIVATE KEY-----", + "sensitive": true + }, { "id": "known-server-token", "prompt": "Use this opaque synthetic-value-2084 in the request.", diff --git a/tests/test_automatic_prompt_privacy.py b/tests/test_automatic_prompt_privacy.py index 933c965cdc..c2eb4d7995 100644 --- a/tests/test_automatic_prompt_privacy.py +++ b/tests/test_automatic_prompt_privacy.py @@ -34,14 +34,14 @@ "codex": "codex/plugins/powercontext/hooks/recall.py", "workbuddy": "workbuddy/plugins/powercontext/hooks/workbuddy_powercontext_hook.py", } +DISABLED_CASES = [case for case in CASES if case["id"].endswith("-header") or "private-key" in case["id"]] @pytest.mark.parametrize("host", HOOKS) @pytest.mark.parametrize( ("case", "capture_enabled"), - [(case, True) for case in CASES] + [(case, False) for case in CASES if case["id"].endswith("-header")], - ids=[case["id"] for case in CASES] - + [f"{case['id']}-capture-disabled" for case in CASES if case["id"].endswith("-header")], + [(case, True) for case in CASES] + [(case, False) for case in DISABLED_CASES], + ids=[case["id"] for case in CASES] + [f"{case['id']}-capture-disabled" for case in DISABLED_CASES], ) def test_automatic_hook_skips_credentials_without_disabling_preparation(tmp_path, host, case, capture_enabled): requests: list[tuple[str, dict[str, object]]] = []