tests/test_security.py

test_routine_code_is_fast_path_safe · function · L32-L35 — def test_routine_code_is_fast_path_safe()
test_clear_attacks_are_static_unsafe · function · L48-L52 — def test_clear_attacks_are_static_unsafe(code, category)
test_risk_token_without_signature_passes_in_heuristic · function · L55-L58 — def test_risk_token_without_signature_passes_in_heuristic(): # a bare subprocess/socket is routine in scientific code -> heuristic allows.
test_off_mode_short_circuits · function · L61-L64 — def test_off_mode_short_circuits()
test_is_always_safe_helper · function · L67-L69 — def test_is_always_safe_helper()
test_llm_mode_invokes_classifier_for_uncertain_code · function · L72-L94 — def test_llm_mode_invokes_classifier_for_uncertain_code(monkeypatch): # code with a risk token but no static signature -> escalates to the LLM.
fake_chat · function · L76-L81 — def fake_chat(messages, cfg, **kw)
test_llm_unparseable_errs_unsafe · function · L97-L104 — def test_llm_unparseable_errs_unsafe(monkeypatch)
test_verdict_observation_text · function · L107-L110 — def test_verdict_observation_text()
test_injection_static_marker_detected · function · L116-L122 — def test_injection_static_marker_detected()
test_injection_benign_content_passes · function · L125-L127 — def test_injection_benign_content_passes()
test_injection_annotation_prepends_banner · function · L130-L135 — def test_injection_annotation_prepends_banner()
test_dispatcher_still_screens_class_based_web_tool_results · function · L138-L154 — def test_dispatcher_still_screens_class_based_web_tool_results(tmp_path, monkeypatch)
test_registered_network_tool_uses_generic_injection_screen · function · L157-L196 — def test_registered_network_tool_uses_generic_injection_screen(tmp_path)
NetworkProbeTool · class · L161-L178 — class NetworkProbeTool(Tool)
execute · method · L170-L178 — def execute(self, context, arguments)
test_web_search_injection_warning_survives_tool_result_formatting · function · L199-L233 — def test_web_search_injection_warning_survives_tool_result_formatting( tmp_path, monkeypatch )
test_generic_screening_warns_without_dropping_unknown_payloads · function · L236-L276 — def test_generic_screening_warns_without_dropping_unknown_payloads(tmp_path)
ArbitraryNetworkResultTool · class · L240-L256 — class ArbitraryNetworkResultTool(Tool)
execute · method · L252-L256 — def execute(self, context, arguments)
test_injection_llm_mode · function · L279-L290 — def test_injection_llm_mode(monkeypatch)
test_biosecurity_prescan · function · L296-L301 — def test_biosecurity_prescan()
test_screener_skips_llm_when_irrelevant · function · L304-L311 — def test_screener_skips_llm_when_irrelevant(monkeypatch)
boom · function · L305-L306 — def boom(a, *k)
test_screener_blocks_on_llm_verdict · function · L314-L326 — def test_screener_blocks_on_llm_verdict(monkeypatch)
test_screener_fails_open_without_key · function · L329-L333 — def test_screener_fails_open_without_key(monkeypatch)
test_security_config_env_toggles · function · L339-L345 — def test_security_config_env_toggles(monkeypatch)
test_security_config_defaults · function · L348-L359 — def test_security_config_defaults(monkeypatch)
test_bad_safety_mode_falls_back · function · L362-L364 — def test_bad_safety_mode_falls_back(monkeypatch)
test_audit_hook_blocks_writable_dlopen · function · L402-L414 — def test_audit_hook_blocks_writable_dlopen()
test_audit_hook_respects_disable_flag · function · L417-L427 — def test_audit_hook_respects_disable_flag()
ScriptedLLM · class · L433-L451 — class ScriptedLLM
init · method · L434-L436 — def init(self, replies)
call · method · L438-L451 — def call(self, messages, cfg, **kw)
test_agent_loop_refuses_unsafe_cell_without_executing · function · L454-L491 — def test_agent_loop_refuses_unsafe_cell_without_executing(monkeypatch): # First reply is a clear sandbox-escape; the gate must refuse it and feed an # observation back. Second reply finishes normally.
spy_execute · function · L469-L477 — def spy_execute(self, code, origin="agent", on_chunk=None, **kwargs)
test_agent_loop_runs_safe_cell · function · L494-L505 — def test_agent_loop_runs_safe_cell(monkeypatch)
_secret_store · function · L514-L519 — def _secret_store(tmp_path)
test_query_denylist_blocks_settings_api_key · function · L522-L540 — def test_query_denylist_blocks_settings_api_key(tmp_path): # The gateway persists the live API key + model profiles under settings.
test_query_denylist_blocks_connectors · function · L543-L546 — def test_query_denylist_blocks_connectors(tmp_path)
test_query_schema_hides_secret_tables · function · L549-L556 — def test_query_schema_hides_secret_tables(tmp_path)
test_query_denylist_allows_literal_mention · function · L559-L564 — def test_query_denylist_allows_literal_mention(tmp_path): # A denied word appearing only inside a string literal is data, not a # table reference, so it must not be falsely rejected.
test_credentials_set_args_redacted_in_host_call_log · function · L567-L588 — def test_credentials_set_args_redacted_in_host_call_log(tmp_path)
test_query_split_identifier_bypass_does_not_leak_secret · function · L591-L610 — def test_query_split_identifier_bypass_does_not_leak_secret(tmp_path): # Comment/concat tricks that split the denied identifier — set/**/tings # slips past the substring denylist because the comment-stripper turns the # block comment into whitespace ("set tings"), and "set"||"tings" never # forms the substring at all. Neither may reach the secret: SQLite likewise # treats the comment as whitespace (no settings reference ever forms) and # || is invalid in a FROM clause, so both die as syntax errors. Whatever # the failure mode — denylist refusal or SQLite error — the synthetic # secret must never appear in a result row or the error message.
test_the_loader_escape_is_unsafe_in_r_as_well_as_python · function · L618-L640 — def test_the_loader_escape_is_unsafe_in_r_as_well_as_python()
test_ordinary_r_science_is_still_safe · function · L643-L654 — def test_ordinary_r_science_is_still_safe()
test_a_lone_r_loader_call_is_allowed_like_a_lone_python_one · function · L657-L664 — def test_a_lone_r_loader_call_is_allowed_like_a_lone_python_one()