@cyanautomation/kaseki-agent 1.4.1

package/test/dry-run.test.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Integration-style tests for --dry-run behavior in run-kaseki.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+RUNNER="$REPO_ROOT/run-kaseki.sh"
+
+pass() { printf '✓ %s\n' "$1"; }
+fail() { printf '✗ %s\n' "$1" >&2; exit 1; }
+
+require_file() {
+  local file="$1"
+  [ -f "$file" ] || fail "Expected file to exist: $file"
+}
+
+json_field_equals() {
+  local file="$1" field="$2" expected="$3"
+  local actual
+  actual="$(node -e 'const fs=require("fs");const p=process.argv[1];const f=process.argv[2];const o=JSON.parse(fs.readFileSync(p,"utf8"));const v=o[f];process.stdout.write(v===undefined?"":String(v));' "$file" "$field")"
+  [ "$actual" = "$expected" ] || fail "Expected $file field '$field' to be '$expected' (got '$actual')"
+}
+
+assert_stage_detail() {
+  local stage_file="$1" stage_name="$2" detail_expected="$3"
+  awk -F '\t' -v stage="$stage_name" -v expected="$detail_expected" '
+    $1==stage { found=1; if ($4!=expected) { printf("detail mismatch for %s: expected %s got %s\n", stage, expected, $4) > "/dev/stderr"; exit 2 } }
+    END { if (!found) exit 3 }
+  ' "$stage_file" || fail "Expected stage '$stage_name' detail '$detail_expected' in $stage_file"
+}
+
+assert_file_empty() {
+  local file="$1"
+  [ -f "$file" ] || fail "Expected file to exist: $file"
+  [ ! -s "$file" ] || fail "Expected empty file: $file"
+}
+
+run_once() {
+  local root="$1" marker="$2"
+  local start end elapsed_ms code oldpwd
+  start="$(date +%s%3N)"
+  oldpwd="$(pwd)"
+  cd "$REPO_ROOT"
+  export KASEKI_ROOT="$root"
+  export KASEKI_LOG_DIR="$root/host-logs"
+  export OPENROUTER_API_KEY="dry-run-test-key"
+  export REPO_URL=""
+  export GIT_REF="main"
+  export KASEKI_VALIDATION_COMMANDS="printf SHOULD_NOT_RUN_${marker} > /tmp/kaseki-validation-$$-${marker}"
+  export TASK_PROMPT="dry-run behavior test"
+  export KASEKI_IMAGE="docker.io/cyanautomation/kaseki-agent:latest"
+
+  set +e
+  "$RUNNER" --dry-run >"$root/run-${marker}.stdout.log" 2>"$root/run-${marker}.stderr.log"
+  code=$?
+  set -e
+  cd "$oldpwd"
+  end="$(date +%s%3N)"
+  elapsed_ms=$((end-start))
+  echo "$code" > "$root/exit-${marker}.txt"
+  echo "$elapsed_ms" > "$root/runtime-${marker}.ms"
+}
+
+echo "=== Testing --dry-run runtime behavior ==="
+
+tmp_root="$(mktemp -d)"
+validation_marker_first="/tmp/kaseki-validation-$$-first"
+validation_marker_second="/tmp/kaseki-validation-$$-second"
+trap 'rm -rf "$tmp_root" "$validation_marker_first" "$validation_marker_second"' EXIT
+
+[ ! -e "$validation_marker_first" ] || fail "Pre-existing validation marker found: $validation_marker_first"
+[ ! -e "$validation_marker_second" ] || fail "Pre-existing validation marker found: $validation_marker_second"
+
+run_once "$tmp_root" first
+run1_exit="$(cat "$tmp_root/exit-first.txt")"
+
+if [ "$run1_exit" != "0" ] && grep -q "missing required host dependencies: docker" "$tmp_root/run-first.stderr.log"; then
+  echo "⚠ Docker unavailable; running fallback dry-run smoke checks"
+  awk '
+    /KASEKI_DRY_RUN/ { seen_dry_run=1 }
+    /record_stage_timing "validation" "0" .*"dry_run=true"/ { seen_validation=1 }
+    /record_stage_timing "pi coding agent" "0" .*"dry_run=true"/ { seen_agent=1 }
+    END { exit (seen_dry_run && seen_validation && seen_agent) ? 0 : 1 }
+  ' "$REPO_ROOT/run-kaseki.sh" "$REPO_ROOT/kaseki-agent.sh" || fail "Fallback smoke check failed: dry-run behavior wiring incomplete"
+  pass "fallback smoke checks passed under missing docker dependency"
+  echo ""
+  echo "✅ Dry-run fallback checks passed!"
+  exit 0
+fi
+
+[ "$run1_exit" = "0" ] || fail "First dry-run invocation should exit 0 (got $run1_exit)"
+pass "dry-run exits with expected code (0)"
+
+command -v node >/dev/null 2>&1 || fail "Node.js is required for JSON assertions in dry-run integration checks"
+
+result1="$tmp_root/kaseki-results/kaseki-1"
+require_file "$result1/host-start.json"
+require_file "$result1/metadata.json"
+json_field_equals "$result1/host-start.json" "dry_run" "1"
+json_field_equals "$result1/metadata.json" "dry_run" "1"
+pass "host-start.json and metadata.json include dry_run=1"
+
+require_file "$result1/stage-timings.tsv"
+assert_stage_detail "$result1/stage-timings.tsv" "pi coding agent" "dry_run=true"
+assert_stage_detail "$result1/stage-timings.tsv" "validation" "dry_run=true"
+assert_stage_detail "$result1/stage-timings.tsv" "secret scan" "dry_run=true"
+pass "stage timing details capture semantic dry-run skips"
+
+assert_file_empty "$result1/pi-events.jsonl"
+assert_file_empty "$result1/validation-timings.tsv"
+[ ! -f "/tmp/kaseki-validation-$$-first" ] || fail "Validation command should not execute during dry-run"
+pass "no external side effects (no real agent output / validation command execution)"
+
+run_once "$tmp_root" second
+run2_exit="$(cat "$tmp_root/exit-second.txt")"
+[ "$run2_exit" = "0" ] || fail "Second dry-run invocation should exit 0 (got $run2_exit)"
+
+result2="$tmp_root/kaseki-results/kaseki-2"
+require_file "$result2/host-start.json"
+require_file "$result2/metadata.json"
+[ -d "$tmp_root/kaseki-results/kaseki-1" ] || fail "First result directory missing after second run"
+[ -f "$tmp_root/kaseki-results/kaseki-1/host-start.json" ] || fail "First run outputs were overwritten"
+[ ! -f "/tmp/kaseki-validation-$$-second" ] || fail "Validation command should not execute on second dry-run"
+first_runtime_ms="$(cat "$tmp_root/runtime-first.ms")"
+second_runtime_ms="$(cat "$tmp_root/runtime-second.ms")"
+[ "$second_runtime_ms" -le $((first_runtime_ms + 1500)) ] || fail "Second run should stay within runtime guardrail (first=${first_runtime_ms}ms second=${second_runtime_ms}ms)"
+pass "runtime tracked (first=${first_runtime_ms}ms second=${second_runtime_ms}ms)"
+pass "second invocation creates kaseki-2 and preserves prior outputs"
+
+echo ""
+echo "✅ All --dry-run behavior tests passed!"

package/test/fixtures/kaseki-report-exit-codes/metadata-exit-0.json

@@ -0,0 +1 @@
+{"instance":"fixture-exit-0","exit_code":0,"pi_exit_code":0,"validation_exit_code":0,"quality_exit_code":0,"secret_scan_exit_code":0}

package/test/fixtures/kaseki-report-exit-codes/metadata-exit-1.json

@@ -0,0 +1 @@
+{"instance":"fixture-exit-1","exit_code":1,"pi_exit_code":1,"validation_exit_code":1,"quality_exit_code":1,"secret_scan_exit_code":1}

package/test/fixtures/kaseki-report-exit-codes/metadata-exit-invalid.json

@@ -0,0 +1 @@
+{"instance":"fixture-exit-invalid","exit_code":"invalid","pi_exit_code":"invalid","validation_exit_code":"invalid","quality_exit_code":"invalid","secret_scan_exit_code":"invalid"}

package/test/fixtures/kaseki-report-exit-codes/metadata-exit-str-0.json

@@ -0,0 +1 @@
+{"instance":"fixture-exit-str-0","exit_code":"0","pi_exit_code":"0","validation_exit_code":"0","quality_exit_code":"0","secret_scan_exit_code":"0"}

package/test/fixtures/kaseki-report-exit-codes/metadata-exit-str-1.json

@@ -0,0 +1 @@
+{"instance":"fixture-exit-str-1","exit_code":"1","pi_exit_code":"1","validation_exit_code":"1","quality_exit_code":"1","secret_scan_exit_code":"1"}

package/test/kaseki-api.integration.test.sh

@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TEST_NAME="kaseki-api.integration.test"
+API_KEY="sk-test-integration-key"
+PORT="${KASEKI_TEST_API_PORT:-18080}"
+BASE_URL="http://127.0.0.1:${PORT}/api"
+
+TMP_ROOT="$(mktemp -d)"
+if [[ -z "$TMP_ROOT" || ! -d "$TMP_ROOT" ]]; then
+  echo "[$TEST_NAME] ERROR: Failed to create temporary directory"
+  exit 1
+fi
+RESULTS_DIR="${TMP_ROOT}/results"
+API_LOG_DIR="${TMP_ROOT}/api-logs"
+FAKE_REPO_ROOT="${TMP_ROOT}/fake-repo"
+FAKE_SCRIPT="${FAKE_REPO_ROOT}/scripts/kaseki-activate.sh"
+SERVER_LOG="${TMP_ROOT}/server.log"
+
+mkdir -p "$RESULTS_DIR" "$API_LOG_DIR" "${FAKE_REPO_ROOT}/scripts"
+
+cleanup() {
+  local ec=$?
+  if [[ -n "${SERVER_PID:-}" ]] && kill -0 "$SERVER_PID" 2>/dev/null; then
+    kill "$SERVER_PID" 2>/dev/null || true
+    wait "$SERVER_PID" 2>/dev/null || true
+  fi
+
+  if [[ $ec -ne 0 ]]; then
+    echo "[$TEST_NAME] FAILED (exit=$ec)"
+    echo "[$TEST_NAME] Diagnostics:"
+    [[ -f "$SERVER_LOG" ]] && tail -n 120 "$SERVER_LOG" | sed 's/^/[server] /'
+    [[ -d "$RESULTS_DIR" ]] && find "$RESULTS_DIR" -maxdepth 3 -type f | sed 's/^/[artifact] /' || true
+  fi
+
+  rm -rf "$TMP_ROOT"
+}
+trap cleanup EXIT
+
+cat > "$FAKE_SCRIPT" <<'SCRIPT'
+#!/usr/bin/env bash
+set -euo pipefail
+log_dir="${KASEKI_LOG_DIR:?missing KASEKI_LOG_DIR}"
+mkdir -p "$log_dir"
+printf '{"event":"start","stage":"bootstrap","detail":"boot"}\n' > "$log_dir/progress.jsonl"
+printf 'fake stdout\n' > "$log_dir/stdout.log"
+printf 'fake stderr\n' > "$log_dir/stderr.log"
+printf '{"failure":null}\n' > "$log_dir/metadata.json"
+sleep 0.2
+printf '{"event":"done","stage":"complete","detail":"done"}\n' >> "$log_dir/progress.jsonl"
+SCRIPT
+chmod +x "$FAKE_SCRIPT"
+
+echo "[$TEST_NAME] starting api server on :$PORT"
+KASEKI_API_KEYS="$API_KEY" \
+KASEKI_API_PORT="$PORT" \
+KASEKI_RESULTS_DIR="$RESULTS_DIR" \
+KASEKI_API_LOG_DIR="$API_LOG_DIR" \
+KASEKI_API_MAX_CONCURRENT_RUNS=1 \
+KASEKI_AGENT_TIMEOUT_SECONDS=30 \
+PWD="$FAKE_REPO_ROOT" \
+node dist/kaseki-api-service.js >"$SERVER_LOG" 2>&1 &
+SERVER_PID=$!
+
+health_ready=false
+for _ in $(seq 1 80); do
+  code="$(curl -s -o /dev/null -w '%{http_code}' "$BASE_URL/health" || true)"
+  if [[ "$code" == "200" ]]; then
+    health_ready=true
+    break
+  fi
+  sleep 0.1
+done
+
+if [[ "$health_ready" != "true" ]]; then
+  echo "[$TEST_NAME] health endpoint did not become ready"
+  exit 1
+fi
+
+RUN_PAYLOAD='{"repoUrl":"https://github.com/example/repo"}'
+RUN_RESP="$(curl -sS -X POST "$BASE_URL/runs" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H 'Content-Type: application/json' \
+  --data "$RUN_PAYLOAD")"
+
+JOB_ID="$(python3 - "$RUN_RESP" <<'PY'
+import json, re, sys
+try:
+    obj=json.loads(sys.argv[1])
+except (json.JSONDecodeError, ValueError) as e:
+    raise SystemExit(f"API returned invalid JSON: {e}; response: {sys.argv[1][:200]}")
+if obj.get('status') not in {'queued','running'}:
+    raise SystemExit(f"expected status queued|running, got {obj.get('status')}")
+idv=obj.get('id','')
+if not re.fullmatch(r'kaseki-[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}', idv):
+    raise SystemExit(f"invalid job id format: {idv}")
+print(idv)
+PY
+)"
+
+LIST_RESP="$(curl -sS -H "Authorization: Bearer $API_KEY" "$BASE_URL/runs")"
+python3 - "$LIST_RESP" "$JOB_ID" <<'PY'
+import json, sys
+try:
+    obj=json.loads(sys.argv[1])
+except (json.JSONDecodeError, ValueError) as e:
+    raise SystemExit(f"API returned invalid JSON: {e}; response: {sys.argv[1][:200]}")
+job_id=sys.argv[2]
+if obj.get('total',0) < 1:
+    raise SystemExit('runs total is < 1')
+runs=obj.get('runs',[])
+match=[r for r in runs if r.get('id')==job_id]
+if not match:
+    raise SystemExit('submitted run missing from list response')
+PY
+
+history=""
+final=""
+for _ in $(seq 1 120); do
+  STATUS_RESP="$(curl -sS -H "Authorization: Bearer $API_KEY" "$BASE_URL/runs/$JOB_ID/status")"
+  cur="$(python3 - "$STATUS_RESP" <<'PY'
+import json, sys
+try:
+    print(json.loads(sys.argv[1]).get('status',''))
+except (json.JSONDecodeError, ValueError) as e:
+    raise SystemExit(f"API returned invalid JSON: {e}; response: {sys.argv[1][:200]}")
+PY
+)"
+  [[ -n "$history" ]] && history+=" "
+  history+="$cur"
+  if [[ "$cur" == "completed" || "$cur" == "failed" ]]; then
+    final="$cur"
+    break
+  fi
+  sleep 0.1
+done
+
+if [[ -z "$final" ]]; then
+  echo "[$TEST_NAME] job did not reach terminal state; history=$history"
+  exit 1
+fi
+
+python3 - "$history" <<'PY'
+import sys
+states=sys.argv[1].split()
+allowed={
+    'queued': {'queued','running','completed','failed'},
+    'running': {'running','completed','failed'},
+    'completed': {'completed'},
+    'failed': {'failed'},
+}
+for a,b in zip(states, states[1:]):
+    if b not in allowed.get(a,set()):
+        raise SystemExit(f'invalid state transition: {a} -> {b}; full={states}')
+PY
+
+ART_DIR="$RESULTS_DIR/$JOB_ID"
+for f in progress.jsonl metadata.json stdout.log stderr.log; do
+  if [[ ! -f "$ART_DIR/$f" ]]; then
+    echo "[$TEST_NAME] missing artifact file: $ART_DIR/$f"
+    exit 1
+  fi
+done
+
+echo "[$TEST_NAME] PASS job_id=$JOB_ID final=$final"

package/test/pi-event-filter-failure.test.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TEST_NAME="pi-event-filter-failure.test"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+TMP_ROOT="$(mktemp -d)"
+FAKE_BIN="$TMP_ROOT/bin"
+mkdir -p "$FAKE_BIN" /results
+
+cleanup() {
+  rm -rf "$TMP_ROOT"
+}
+trap cleanup EXIT
+
+cat > "$FAKE_BIN/pi" <<'PI'
+#!/usr/bin/env bash
+if [[ "${1:-}" == "--version" ]]; then
+  echo "pi 0.0.0-test"
+  exit 0
+fi
+printf '{"type":"message","model":"fake-model"}\n'
+exit 0
+PI
+
+cat > "$FAKE_BIN/kaseki-pi-progress-stream" <<'PS'
+#!/usr/bin/env bash
+cat
+PS
+
+cat > "$FAKE_BIN/kaseki-pi-event-filter" <<'EF'
+#!/usr/bin/env bash
+exit 7
+EF
+
+cat > "$FAKE_BIN/timeout" <<'TO'
+#!/usr/bin/env bash
+shift 2
+"$@"
+TO
+
+cat > "$FAKE_BIN/npm" <<'NPM'
+#!/usr/bin/env bash
+exit 0
+NPM
+
+cat > "$FAKE_BIN/git" <<'GIT'
+#!/usr/bin/env bash
+case "${1:-}" in
+  clone) mkdir -p /workspace/repo; exit 0 ;;
+  checkout|config|add|commit) exit 0 ;;
+  status) exit 0 ;;
+  diff) exit 0 ;;
+  rev-parse) echo "abc123"; exit 0 ;;
+  *) exit 0 ;;
+esac
+GIT
+
+chmod +x "$FAKE_BIN"/*
+
+export PATH="$FAKE_BIN:$PATH"
+export OPENROUTER_API_KEY="test"
+export REPO_URL="https://example.com/repo.git"
+export GIT_REF="main"
+export TASK_PROMPT="test"
+export KASEKI_VALIDATION_COMMANDS=":"
+export KASEKI_ALLOW_EMPTY_DIFF=1
+
+set +e
+bash "$REPO_ROOT/kaseki-agent.sh" >"$TMP_ROOT/stdout.log" 2>"$TMP_ROOT/stderr.log"
+code=$?
+set -e
+
+if [[ "$code" -eq 0 ]]; then
+  echo "[$TEST_NAME] expected non-zero exit when event filter fails"
+  exit 1
+fi
+
+grep -q 'pi_event_filter_failed' /results/progress.jsonl
+grep -q 'kaseki-pi-event-filter' /results/metadata.json
+grep -q 'ERROR: kaseki-pi-event-filter failed' /results/pi-stderr.log
+
+echo "[$TEST_NAME] PASS"

package/test/printf-safety-focused.test.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# Focused test: Verify the printf safety fix prevents "invalid option" error
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+echo "=== Testing Printf Safety Fix ==="
+echo ""
+
+# Extract and test the validate_numeric function
+source <(sed -n '/^# Validate that a variable/,/^}/p' "$SCRIPT_DIR/kaseki-agent.sh")
+
+echo "Test 1: validate_numeric rejects '-' (the bug trigger)"
+if validate_numeric "test_var" "-" 2>/dev/null; then
+  echo "  ✗ FAIL: validate_numeric should reject '-' but didn't"
+  exit 1
+else
+  echo "  ✓ PASS: validate_numeric correctly rejected '-'"
+fi
+
+echo ""
+echo "Test 2: validate_numeric accepts valid numeric values"
+if validate_numeric "test_var" "42" 2>/dev/null; then
+  echo "  ✓ PASS: validate_numeric accepted '42'"
+else
+  echo "  ✗ FAIL: validate_numeric should accept '42' but didn't"
+  exit 1
+fi
+
+echo ""
+echo "Test 3: Arithmetic with validated numeric values works"
+restored_count=5
+kept_count=3
+if validate_numeric "restored_count" "$restored_count" 2>/dev/null && \
+   validate_numeric "kept_count" "$kept_count" 2>/dev/null; then
+  total_count=$((restored_count + kept_count))
+  echo "  ✓ PASS: Arithmetic succeeded (5 + 3 = $total_count)"
+else
+  echo "  ✗ FAIL: Validation should have passed"
+  exit 1
+fi
+
+echo ""
+echo "Test 4: Printf with validated numeric values doesn't fail"
+if printf -- '- **Test:** %%d = %d\n' "$total_count" > /dev/null 2>&1; then
+  echo "  ✓ PASS: Printf with %d format string succeeded with value $total_count"
+else
+  echo "  ✗ FAIL: Printf should have succeeded"
+  exit 1
+fi
+
+echo ""
+echo "Test 5: Simulate the bug - unvalidated '-' would cause printf to fail"
+# This would have been the original bug
+unvalidated_count="-"
+if printf 'test: %d\n' "$unvalidated_count" > /dev/null 2>&1; then
+  # This might succeed due to bash interpolation, but with real code it would fail
+  echo "  ⓘ INFO: Bash accepted unquoted '-', but with proper quoting it would fail"
+else
+  echo "  ✓ PASS: Unvalidated '-' causes printf to fail"
+fi
+
+echo ""
+echo "Test 6: Verify grep count fallback never returns '-'"
+test_file=$(mktemp)
+trap "rm -f '$test_file'" EXIT
+
+# Empty file
+count=$(grep -c 'pattern' "$test_file" 2>/dev/null || echo 0)
+if [ "$count" = "-" ]; then
+  echo "  ✗ FAIL: grep -c fallback returned '-'"
+  exit 1
+else
+  echo "  ✓ PASS: grep -c fallback returned '$count' (not '-')"
+fi
+
+echo ""
+echo "Test 7: json_encode availability"
+source <(sed -n '/^# Safely encode value/,/^}/p' "$SCRIPT_DIR/kaseki-agent.sh" | head -20)
+
+output=$(printf 'test' | json_encode 2>/dev/null || true)
+if [ -n "$output" ]; then
+  echo "  ✓ PASS: json_encode produced output: $output"
+else
+  echo "  ⓘ INFO: json_encode fallback returned empty (expected if node unavailable)"
+fi
+
+echo ""
+echo "=== All Critical Tests Passed ==="
+echo ""
+echo "Summary of fixes:"
+echo "  1. ✓ validate_numeric() prevents dash/non-numeric values"
+echo "  2. ✓ Arithmetic only happens after validation"
+echo "  3. ✓ Printf calls use validated numeric arguments"
+echo "  4. ✓ grep count fallback prevents dash values"
+echo "  5. ✓ json_encode has error handling and fallback"
+echo ""
+echo "The 'printf: - : invalid option' error is now prevented."

package/test/printf-safety-results/results/restoration.jsonl

@@ -0,0 +1,10 @@
+{"timestamp":"2026-05-07T10:00:00Z","event":"file_evaluated","file":"src/test.ts","status":"kept","reason":"matched_allowlist"}
+{"timestamp":"2026-05-07T10:00:01","event":"file_restored","file":"file1.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:02","event":"file_restored","file":"file2.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:03","event":"file_restored","file":"file3.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:04","event":"file_restored","file":"file4.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:05","event":"file_restored","file":"file5.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:06","event":"file_restored","file":"file6.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:07","event":"file_restored","file":"file7.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:08","event":"file_restored","file":"file8.txt","status":"restored","reason":"not_in_allowlist"}
+{"timestamp":"2026-05-07T10:00:09","event":"file_restored","file":"file9.txt","status":"restored","reason":"not_in_allowlist"}