sashatrask/truf-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Initial server source import

Browse Source
This commit is contained in:
sashatrask
2026-09-30 20:30:56 +03:00
commit 170dd941b9
498 changed files with 261563 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/fix-custom-provider-detector-compatibility/specs/custom-provider-detection-compatibility/spec.md
+30
View File
@@ -0,0 +1,30 @@
## ADDED Requirements
### Requirement: Alternative provider contexts execute independently
The custom detector policy SHALL detect supported Xai and ZAI/GLM credentials when provider context appears either before or after the credential, without requiring both context directions in one input chunk.
#### Scenario: Provider context appears before the credential
- **WHEN** an offline scan processes a bounded synthetic credential preceded by its supported provider context
- **THEN** the policy emits one corresponding custom provider finding
#### Scenario: Provider context appears after the credential
- **WHEN** an offline scan processes a bounded synthetic credential followed by its supported provider context
- **THEN** the policy emits one corresponding custom provider finding
### Requirement: Alternative detector names normalize canonically
The scanner MUST normalize all compatibility-only custom detector aliases to the existing canonical `Xai` or `ZaiGLM` detector identity before persistence and candidate extraction.
#### Scenario: Context-after alias is emitted
- **WHEN** TruffleHog emits `CustomRegex` with a context-after compatibility name in `ExtraData.name`
- **THEN** the scanner retains `CustomRegex` as the original detector and exposes the canonical provider detector name downstream
### Requirement: Compatibility is tested through the real CLI
The compatibility suite SHALL run the complete configured custom detector policy through an available TruffleHog executable using deterministic synthetic credentials, disabled verification, and disabled update checks.
#### Scenario: Compatible executable is available
- **WHEN** a configured Windows or Linux TruffleHog executable scans the compatibility fixtures
- **THEN** both context directions produce canonical findings and route to the expected keycheck candidate services without network verification
#### Scenario: Executable is unavailable
- **WHEN** no TruffleHog executable is available in a general unit-test environment
- **THEN** the real-CLI test is explicitly skipped while policy-structure and normalization unit tests still execute