* pre-existing-byte detection (e.g., LKG fingerprint verification)

* opt in via `acceptPreExistingSentinel: false`.

*/

import { describe, expect, it } from 'vitest';

import { setJsoncOcPath } from '../../jsonc/edit.js';

import { emitMd } from '../../emit.js';

import { emitJsonc } from '../../jsonc/emit.js';

import { parseJsonc } from '../../jsonc/parse.js';

import { emitJsonl } from '../../jsonl/emit.js';

import { parseJsonl } from '../../jsonl/parse.js';

import { parseOcPath } from '../../oc-path.js';

import { parseMd } from '../../parse.js';

import {

OcEmitSentinelError,

REDACTED_SENTINEL,

} from '../../sentinel.js';

import { describe, expect, it } from "vitest";

import { emitMd } from "../../emit.js";

import { setJsoncOcPath } from "../../jsonc/edit.js";

import { emitJsonc } from "../../jsonc/emit.js";

import { parseJsonc } from "../../jsonc/parse.js";

import { emitJsonl } from "../../jsonl/emit.js";

import { parseJsonl } from "../../jsonl/parse.js";

import { parseOcPath } from "../../oc-path.js";

import { parseMd } from "../../parse.js";

import { OcEmitSentinelError, REDACTED_SENTINEL } from "../../sentinel.js";

describe('wave-21 sentinel guard cross-kind', () => {

it('S-01 jsonc round-trip echoes safely when raw contains pre-existing sentinel', () => {

describe("wave-21 sentinel guard cross-kind", () => {

it("S-01 jsonc round-trip echoes safely when raw contains pre-existing sentinel", () => {

// Pre-existing sentinel bytes are trusted — see emit-policy comment

// in jsonc/emit.ts. The strict mode below is the opt-in path for

// callers who want LKG-style fingerprint verification.

expect(emitJsonc(ast)).toBe(raw);

// Strict mode still rejects pre-existing sentinel for callers who

// explicitly opt in.

expect(() => emitJsonc(ast, { acceptPreExistingSentinel: false })).toThrow(

OcEmitSentinelError,

);

expect(() => emitJsonc(ast, { acceptPreExistingSentinel: false })).toThrow(OcEmitSentinelError);

});

it('S-02 jsonl round-trip echoes safely; strict mode rejects', () => {

it("S-02 jsonl round-trip echoes safely; strict mode rejects", () => {

const raw = `{"x":"${REDACTED_SENTINEL}"}\n`;

const ast = parseJsonl(raw).ast;

expect(emitJsonl(ast)).toBe(raw);

expect(() => emitJsonl(ast, { acceptPreExistingSentinel: false })).toThrow(

OcEmitSentinelError,

);

expect(() => emitJsonl(ast, { acceptPreExistingSentinel: false })).toThrow(OcEmitSentinelError);

});

it('S-03 md round-trip echoes safely; strict mode rejects', () => {

it("S-03 md round-trip echoes safely; strict mode rejects", () => {

const raw = `## Body\n\n- ${REDACTED_SENTINEL}\n`;

const ast = parseMd(raw).ast;

expect(emitMd(ast)).toBe(raw);

expect(() => emitMd(ast, { acceptPreExistingSentinel: false })).toThrow(

OcEmitSentinelError,

);

expect(() => emitMd(ast, { acceptPreExistingSentinel: false })).toThrow(OcEmitSentinelError);

});

it('S-04 jsonc render mode walks every leaf for sentinel', () => {

it("S-04 jsonc render mode walks every leaf for sentinel", () => {

const ast = parseJsonc('{ "x": "ok" }').ast;

const tampered = {

...ast,

root: {

kind: 'object' as const,

kind: "object" as const,

entries: [

{

key: 'x',

key: "x",

line: 1,

value: { kind: 'string' as const, value: REDACTED_SENTINEL },

value: { kind: "string" as const, value: REDACTED_SENTINEL },

},

],

},

};

expect(() => emitJsonc(tampered, { mode: 'render' })).toThrow(

OcEmitSentinelError,

);

expect(() => emitJsonc(tampered, { mode: "render" })).toThrow(OcEmitSentinelError);

});

it('S-05 jsonl render mode walks every value-line leaf', () => {

it("S-05 jsonl render mode walks every value-line leaf", () => {

const ast = parseJsonl('{"a":"ok"}\n').ast;

const tampered = {

...ast,

lines: [

{

kind: 'value' as const,

kind: "value" as const,

line: 1,

raw: '{"a":"ok"}',

value: {

kind: 'object' as const,

kind: "object" as const,

entries: [

{

key: 'a',

key: "a",

line: 1,

value: { kind: 'string' as const, value: REDACTED_SENTINEL },

value: { kind: "string" as const, value: REDACTED_SENTINEL },

},

],

},

},

],

};

expect(() => emitJsonl(tampered, { mode: 'render' })).toThrow(

OcEmitSentinelError,

);

expect(() => emitJsonl(tampered, { mode: "render" })).toThrow(OcEmitSentinelError);

});

it('S-06 setJsoncOcPath itself throws when the new value contains the sentinel', () => {

it("S-06 setJsoncOcPath itself throws when the new value contains the sentinel", () => {

// The substrate guard fires at write-time: setJsoncOcPath rebuilds

// raw via render mode emit, which scans every leaf. Defense-in-depth

// — even if a caller forgets to call emit afterward, the sentinel

// can't make it into an in-memory AST that pretends to be valid.

const ast = parseJsonc('{ "x": "ok" }').ast;

expect(() =>

setJsoncOcPath(ast, parseOcPath('oc://config/x'), {

kind: 'string',

setJsoncOcPath(ast, parseOcPath("oc://config/x"), {

kind: "string",

value: REDACTED_SENTINEL,

}),

).toThrow(OcEmitSentinelError);

});

it('S-07 sentinel embedded in deep nesting — render mode catches the leaf', () => {

it("S-07 sentinel embedded in deep nesting — render mode catches the leaf", () => {

// Round-trip echoes the pre-existing bytes (the workspace contract:

// a parsed file containing the sentinel as data is not "writing" it

// on emit). Render mode walks every leaf and rejects this caller-

// injected pattern — and a `setOcPath` followed by emit lands here.

const raw = JSON.stringify({ a: { b: { c: REDACTED_SENTINEL } } });

const ast = parseJsonc(raw).ast;

expect(emitJsonc(ast)).toBe(raw); // round-trip echo

expect(() => emitJsonc(ast, { mode: 'render' })).toThrow(OcEmitSentinelError);

expect(() => emitJsonc(ast, { mode: "render" })).toThrow(OcEmitSentinelError);

});

it('S-08 sentinel inside an array element triggers guard in render mode', () => {

const raw = JSON.stringify({ arr: ['ok', REDACTED_SENTINEL, 'ok'] });

it("S-08 sentinel inside an array element triggers guard in render mode", () => {

const raw = JSON.stringify({ arr: ["ok", REDACTED_SENTINEL, "ok"] });

const ast = parseJsonc(raw).ast;

expect(() => emitJsonc(ast, { mode: 'render' })).toThrow(OcEmitSentinelError);

expect(() => emitJsonc(ast, { mode: "render" })).toThrow(OcEmitSentinelError);

});

it('S-09 sentinel as object key in raw — strict mode catches it', () => {

it("S-09 sentinel as object key in raw — strict mode catches it", () => {

const raw = `{ "${REDACTED_SENTINEL}": 1 }`;

const ast = parseJsonc(raw).ast;

expect(emitJsonc(ast)).toBe(raw); // default-mode echo

expect(() => emitJsonc(ast, { acceptPreExistingSentinel: false })).toThrow(

OcEmitSentinelError,

);

expect(() => emitJsonc(ast, { acceptPreExistingSentinel: false })).toThrow(OcEmitSentinelError);

});

it('S-10 sentinel in jsonl malformed line — strict mode catches it', () => {

it("S-10 sentinel in jsonl malformed line — strict mode catches it", () => {

const raw = `${REDACTED_SENTINEL}\n`;

const ast = parseJsonl(raw).ast;

expect(emitJsonl(ast)).toBe(raw); // round-trip echoes verbatim

expect(() => emitJsonl(ast, { acceptPreExistingSentinel: false })).toThrow(

OcEmitSentinelError,

);

expect(() => emitJsonl(ast, { acceptPreExistingSentinel: false })).toThrow(OcEmitSentinelError);

});

it('S-11 partial sentinel substring does NOT trigger guard', () => {

it("S-11 partial sentinel substring does NOT trigger guard", () => {

const raw = '{ "x": "OPENCLAW_REDACTED" }';

const ast = parseJsonc(raw).ast;

expect(() => emitJsonc(ast)).not.toThrow();

expect(emitJsonc(ast)).toBe(raw);

});

it('S-12 sentinel guard error message includes the OcPath context (render mode)', () => {

it("S-12 sentinel guard error message includes the OcPath context (render mode)", () => {

// Render mode is the path that actually rejects caller-injected

// sentinel — round-trip just echoes, so the error context surfaces

// when render walks the offending leaf and constructs the path.

const raw = `{ "secret": "${REDACTED_SENTINEL}" }`;

const ast = parseJsonc(raw).ast;

try {

emitJsonc(ast, { mode: 'render', fileNameForGuard: 'config' });

expect.fail('should have thrown');

emitJsonc(ast, { mode: "render", fileNameForGuard: "config" });

expect.fail("should have thrown");

} catch (e) {

expect(e).toBeInstanceOf(OcEmitSentinelError);

expect(String(e)).toContain('oc://');

expect(String(e)).toContain('config');

expect(String(e)).toContain("oc://");

expect(String(e)).toContain("config");

}

});

});