archetech / archon
93%
main: 94%

LAST BUILD BRANCH: ci/gatekeeper-parity
DEFAULT BRANCH: main
Repo Added
Token VKRdMqMwqPTOZprp4p5Cb3v3uLt6LWUtk regen
Build 1946 Last
Files 88
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH test/mcp-redact-branches
branch: test/mcp-redact-branches
CHANGE BRANCH
x
Sync Branches

coverage: 93.016% (+0.07%) from 92.944%
30766014489

Pull #828

github

macterra 
test(mcp-server): cover the secret redactor

redact.ts had no dedicated test file — it was exercised only incidentally,
through the plain-string path, leaving 65.2% branch coverage on the code
that decides whether a secret reaches a log. 24 tests take it to 95.7%
branches, 96.4% lines.

Two choices specific to testing a redactor:

- Every assertion checks the secret is ABSENT from the output, not merely
  that "<redacted>" appears. A redactor that emits the placeholder while
  still leaking the value elsewhere in the string would pass a naive
  toContain check.
- The provider-host matching is tested for bypass, not just for function:
  TOKEN_PATH_HOSTS anchors on `(^|\.)alchemy\.com$`, so
  https://alchemy.com.evil.test/v2/KEY must NOT be treated as a provider
  host. It isn't — the anchoring is correct — but nothing asserted it.

Covered: basic-auth credentials with username-only, password-only and
both; all seven secret query parameters, case-insensitively; provider API
keys carried in the URL path (alchemy/infura/quicknode, bare and
subdomain); quoted, unquoted and multi-word passphrases including where
the unquoted match terminates; Error, plain object, null, undefined,
number, boolean and empty-string inputs; and errorMessage's three shapes,
including a non-string `error` property falling through to `message`.

The one remaining branch is the `?? ['/']` fallback at redact.ts:30,
which the outer regex makes unreachable — the replace callback only fires
on a match of /\/v\d+\/[^/?#]+/, so the inner /\/v\d+\//  match cannot
fail.

Repo branch coverage 84.44% -> 84.66%.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Pull Request #828: test(mcp-server): cover the secret redactor

3528 of 4060 branches covered (86.9%)

Branch coverage included in aggregate %.

8165 of 8511 relevant lines covered (95.93%)

673.88 hits per line

Relevant lines Covered
8511 RELEVANT LINES 8165 COVERED LINES
673.88 HITS PER LINE
Source Files on test/mcp-redact-branches

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
30766014489 test/mcp-redact-branches test(mcp-server): cover the secret redactor redact.ts had no dedicated test file — it was exercised only incidentally, through the plain-string path, leaving 65.2% branch coverage on the code that decides whether a secret reaches a log. 24 tests ... Pull #828 macterra github
93.02
See All Builds (1939)