Files
Privatae 4f8285ef18
ci / personal-data (push) Successful in 4s
ci / test (push) Successful in 3m36s
ci / fuzz (push) Successful in 3m35s
bastion 0.60.0
2026-11-02 00:10:58 +00:00

55 lines
1.7 KiB
Go

package main
import (
"bytes"
"net/url"
"strings"
"testing"
"time"
)
// Agent-written text cannot become Markdown in the report: no link, image,
// emphasis or HTML through a session title.
func TestReportTextCannotBecomeMarkdown(t *testing.T) {
got := mdText("[click](http://evil.example) <img src=x> **loud** `x` # h")
for _, bad := range []string{"[click](", "<img", "**loud**", "`x`"} {
if strings.Contains(got, bad) {
t.Errorf("%q survived in %q", bad, got)
}
}
}
func TestTheReportLeadsWithProblemsAndLeavesOutPrompts(t *testing.T) {
homeTestWorld(t, true)
now := time.Now()
var b bytes.Buffer
renderReportMarkdown(&b, buildReport(now, now.Add(-7*24*time.Hour)))
md := b.String()
for _, want := range []string{"# AI agents on ", "## Summary",
"1 AI agent session running: 1 not marked as yours, 1 with permission prompts off, 1 waiting for a person.",
"No baseline is recorded", "## Agents running now", "Claude Code background service",
"No AI model wrote any of this report."} {
if !strings.Contains(md, want) {
t.Errorf("the report does not say %q:\n%s", want, md)
}
}
if strings.Contains(md, "PRIVATE PROMPT TEXT") {
t.Error("a session's last prompt is in the report")
}
if strings.Contains(md, "<script>") {
t.Error("an agent's title went into the report as markup")
}
}
func TestTheConsoleHandsTheReportOverAsAFile(t *testing.T) {
homeTestWorld(t, true)
u := uiTestServer(t)
w := uiPost(t, u.handler(), "/machine/report", url.Values{}, uiSignedIn(t, u))
if cd := w.Header().Get("Content-Disposition"); !strings.HasPrefix(cd, "attachment;") {
t.Errorf("Content-Disposition %q", cd)
}
if !strings.Contains(w.Body.String(), "## Summary") {
t.Errorf("body %q", firstLines(w.Body.String()))
}
}