test(agent): collect tests/verify_*.py so CI runs the VULN regression suite

vulnhunter-agent/pyproject.toml

@@ -32,7 +32,7 @@ version = { attr = "vulnhunter.__version__" }
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
-python_files = ["test_*.py"]
+python_files = ["test_*.py", "verify_*.py"]
 asyncio_mode = "auto"
 filterwarnings = [
     "error",

vulnhunter-agent/tests/verify_012_audit_redaction.py

@@ -5,8 +5,6 @@
 headers, access_token query params, and raw token prefixes.
 """
 
-import pytest
-
 from agent._url import redact
 
 
@@ -16,14 +14,16 @@ def test_basic_auth_still_redacted():
     )
 
 
+# The bearer and query-param cases use opaque tokens with no known prefix, so
+# the raw-prefix pass can't mask them and each test exercises only its own pass.
 def test_bearer_header_redacted():
-    out = redact("Authorization: Bearer ghp_AAAA1111BBBB2222CCCC3333")
+    out = redact("Authorization: Bearer AAAA1111BBBB2222CCCC3333")
     assert "AAAA1111BBBB2222" not in out
     assert "***" in out
 
 
 def test_access_token_query_redacted():
-    out = redact("https://api.github.com/x?access_token=ghp_SECRET1234ABCD&y=1")
+    out = redact("https://api.github.com/x?access_token=SECRET1234ABCD&y=1")
     assert "SECRET1234ABCD" not in out
     assert "y=1" in out  # non-secret query params preserved
 

vulnhunter-agent/tests/verify_013_audit_umask.py

@@ -8,9 +8,21 @@
 import os
 import stat
 
+import pytest
+
 from agent.audit import _open_append
 
 
+@pytest.fixture(autouse=True)
+def _restore_umask():
+    # The tests below force umask 022; restore the caller's umask so it doesn't
+    # leak into whatever test runs next in the same process.
+    old = os.umask(0o022)
+    os.umask(old)
+    yield
+    os.umask(old)
+
+
 def test_audit_file_is_owner_only(tmp_path):
     os.umask(0o022)  # the umask that would otherwise leak 0o644
     path = tmp_path / "sub" / "audit_events.jsonl"