update

backend/pkg/agentcli/guardrail/sanitize_test.go

@@ -0,0 +1,31 @@
+package guardrail
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSanitizeTextMasksCommonSecrets(t *testing.T) {
+	input := "Authorization: Bearer abcdefghijklmnopqrstuvwxyz password=secret123 mysql://root:pass@db/prod"
+	got := SanitizeText(input)
+	for _, leak := range []string{"abcdefghijklmnopqrstuvwxyz", "secret123", "root:pass@db"} {
+		if strings.Contains(got, leak) {
+			t.Fatalf("敏感信息未脱敏: %s in %s", leak, got)
+		}
+	}
+	if !strings.Contains(got, "[REDACTED]") {
+		t.Fatalf("脱敏标记缺失: %s", got)
+	}
+}
+
+func TestSanitizeJSONMasksSensitiveKeys(t *testing.T) {
+	got := SanitizeJSON(`{"command":"echo ok","password":"p1","nested":{"api_key":"k1"}}`)
+	for _, leak := range []string{"p1", "k1"} {
+		if strings.Contains(got, leak) {
+			t.Fatalf("JSON 敏感字段未脱敏: %s in %s", leak, got)
+		}
+	}
+	if !strings.Contains(got, `"command":"echo ok"`) {
+		t.Fatalf("非敏感字段不应被改写: %s", got)
+	}
+}