@principles/pd-cli 1.152.12 → 1.152.13

package/tests/resolve-workspace.test.ts

@@ -1,196 +0,0 @@
-/**
- * resolveWorkspaceDir tests.
- *
- * Tests the 4-step resolution chain by mocking the config loader's
- * discoverWorkspaceDefault function.
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-
-// ── Mock setup ──────────────────────────────────────────────────────────────
-
-// We must use vi.hoisted() so the mock factory can reference the spy.
-const { mockDiscover } = vi.hoisted(() => {
-  const mockDiscover = vi.fn<() => import('../src/services/pd-config-loader.js').WorkspaceDiscoveryResult | null>();
-  return { mockDiscover };
-});
-
-vi.mock('../src/services/pd-config-loader.js', () => ({
-  discoverWorkspaceDefault: mockDiscover,
-}));
-
-import { resolveWorkspaceDir, WORKSPACE_ENV } from '../src/resolve-workspace.js';
-
-// ── Helpers ─────────────────────────────────────────────────────────────────
-
-function captureStderr() {
-  const spy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
-  return spy;
-}
-
-function makeDiscovery(workspaceDefault: string): import('../src/services/pd-config-loader.js').WorkspaceDiscoveryResult {
-  return {
-    workspaceDefault,
-    configPath: `${workspaceDefault}/.pd/config.yaml`,
-    source: 'openclaw_default',
-  };
-}
-
-const ORIGINAL_ENV = process.env.PD_WORKSPACE_DIR;
-
-// ── Tests ───────────────────────────────────────────────────────────────────
-
-describe('resolveWorkspaceDir', () => {
-  beforeEach(() => {
-    mockDiscover.mockReset();
-    delete process.env.PD_WORKSPACE_DIR;
-  });
-
-  afterEach(() => {
-    if (ORIGINAL_ENV !== undefined) {
-      process.env.PD_WORKSPACE_DIR = ORIGINAL_ENV;
-    } else {
-      delete process.env.PD_WORKSPACE_DIR;
-    }
-  });
-
-  // 1. Returns explicit --workspace flag
-  it('returns explicit --workspace flag', () => {
-    mockDiscover.mockReturnValue(null);
-    const result = resolveWorkspaceDir('/explicit/path');
-    expect(result).toBe('/explicit/path');
-  });
-
-  // 2. Returns PD_WORKSPACE_DIR env var when no flag
-  it('returns PD_WORKSPACE_DIR env var when no flag', () => {
-    mockDiscover.mockReturnValue(null);
-    process.env.PD_WORKSPACE_DIR = '/env/workspace';
-    const result = resolveWorkspaceDir();
-    expect(result).toBe('/env/workspace');
-  });
-
-  // 3. Returns config default when no flag and no env var
-  it('returns config default when no flag and no env var', () => {
-    mockDiscover.mockReturnValue(makeDiscovery('/config/workspace'));
-    const result = resolveWorkspaceDir();
-    expect(result).toBe('/config/workspace');
-  });
-
-  // 4. Throws when no flag, no env var, and no config found
-  it('throws when no flag, no env var, and no config found', () => {
-    mockDiscover.mockReturnValue(null);
-    expect(() => resolveWorkspaceDir()).toThrow('No workspace directory configured');
-  });
-
-  // 5. Emits warning when --workspace differs from config default
-  it('emits warning when --workspace differs from config default', () => {
-    mockDiscover.mockReturnValue(makeDiscovery('/config/default'));
-    const stderrSpy = captureStderr();
-
-    const result = resolveWorkspaceDir('/different/path');
-
-    expect(result).toBe('/different/path');
-    expect(stderrSpy).toHaveBeenCalledWith(
-      expect.stringContaining('[PD:workspace] WARNING'),
-    );
-    expect(stderrSpy).toHaveBeenCalledWith(
-      expect.stringContaining('differs from config default'),
-    );
-
-    stderrSpy.mockRestore();
-  });
-
-  // 6. Does NOT warn when --workspace matches config default (normalized)
-  it('does NOT warn when --workspace matches config default', () => {
-    mockDiscover.mockReturnValue(makeDiscovery('/same/path'));
-    const stderrSpy = captureStderr();
-
-    const result = resolveWorkspaceDir('/same/path');
-
-    expect(result).toBe('/same/path');
-    // No warning should be emitted since paths match
-    const warningCalls = stderrSpy.mock.calls.filter(
-      call => typeof call[0] === 'string' && call[0].includes('WARNING'),
-    );
-    expect(warningCalls).toHaveLength(0);
-
-    stderrSpy.mockRestore();
-  });
-
-  // 7. Emits warning when env var differs from config default
-  it('emits warning when env var differs from config default', () => {
-    mockDiscover.mockReturnValue(makeDiscovery('/config/default'));
-    process.env.PD_WORKSPACE_DIR = '/different/env/path';
-    const stderrSpy = captureStderr();
-
-    const result = resolveWorkspaceDir();
-
-    expect(result).toBe('/different/env/path');
-    expect(stderrSpy).toHaveBeenCalledWith(
-      expect.stringContaining('[PD:workspace] WARNING'),
-    );
-
-    stderrSpy.mockRestore();
-  });
-
-  // 8. Does NOT warn when env var matches config default
-  it('does NOT warn when env var matches config default', () => {
-    mockDiscover.mockReturnValue(makeDiscovery('/same/path'));
-    process.env.PD_WORKSPACE_DIR = '/same/path';
-    const stderrSpy = captureStderr();
-
-    const result = resolveWorkspaceDir();
-
-    expect(result).toBe('/same/path');
-    const warningCalls = stderrSpy.mock.calls.filter(
-      call => typeof call[0] === 'string' && call[0].includes('WARNING'),
-    );
-    expect(warningCalls).toHaveLength(0);
-
-    stderrSpy.mockRestore();
-  });
-
-  // 9. Does NOT warn when --workspace provided and no config found
-  it('does NOT warn when --workspace provided and no config found', () => {
-    mockDiscover.mockReturnValue(null);
-    const stderrSpy = captureStderr();
-
-    const result = resolveWorkspaceDir('/some/path');
-
-    expect(result).toBe('/some/path');
-    expect(stderrSpy).not.toHaveBeenCalled();
-
-    stderrSpy.mockRestore();
-  });
-
-  // 10. Exports correct WORKSPACE_ENV constant
-  it('exports correct WORKSPACE_ENV constant', () => {
-    expect(WORKSPACE_ENV).toBe('PD_WORKSPACE_DIR');
-  });
-
-  // 11. Error message mentions workspace.default option
-  it('error message mentions workspace.default option', () => {
-    mockDiscover.mockReturnValue(null);
-    expect(() => resolveWorkspaceDir()).toThrow('workspace.default');
-  });
-
-  // 12. CWE-22 boundary guard: parent traversal is rejected
-  it('rejects parent-traversal workspace paths', () => {
-    mockDiscover.mockReturnValue(null);
-    expect(() => resolveWorkspaceDir('../evil')).toThrow('parent traversal');
-    expect(() => resolveWorkspaceDir('a/../../b')).toThrow('parent traversal');
-  });
-
-  // 13. CWE-22 boundary guard: filesystem root is rejected
-  it('rejects filesystem-root workspace paths', () => {
-    mockDiscover.mockReturnValue(null);
-    expect(() => resolveWorkspaceDir('/')).toThrow('filesystem root');
-  });
-
-  // 14. Platform-agnostic: a Windows-style path is accepted everywhere.
-  // On POSIX runners "Z:\\work" is not absolute; the boundary guard must
-  // NOT treat that as invalid (regression for CI failure on Linux).
-  it('accepts Windows-style workspace paths (platform-agnostic)', () => {
-    mockDiscover.mockReturnValue(null);
-    expect(resolveWorkspaceDir('Z:\\pd-nonexistent-workspace-12345')).toBe('Z:\\pd-nonexistent-workspace-12345');
-  });
-});

package/tests/services/config-doctor-signal-health.test.ts

@@ -1,109 +0,0 @@
-/**
- * PRI-788 G4 — pd config doctor 的 signalHealth 分级测试。
- */
-import { afterEach, describe, expect, it } from 'vitest';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-
-import { buildSignalHealthEntry } from '../../src/services/config-doctor.js';
-
-const tempDirs: string[] = [];
-
-afterEach(() => {
-  for (const dir of tempDirs.splice(0)) {
-    fs.rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-function makeStateDir(): string {
-  const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-doctor-signal-'));
-  const stateDir = path.join(workspace, '.state');
-  fs.mkdirSync(stateDir, { recursive: true });
-  tempDirs.push(workspace);
-  return stateDir;
-}
-
-function writeHealth(stateDir: string, state: Record<string, unknown>): void {
-  fs.writeFileSync(path.join(stateDir, 'signal-health.json'), JSON.stringify({
-    stage1Strong: 0,
-    stage2Confirmed: 0,
-    stage2Queued: 0,
-    stage2Dropped: 0,
-    pendingCount: 0,
-    lastStage2SuccessAt: null,
-    observerLastSuccessAt: null,
-    observerConsecutiveFailures: 0,
-    day: new Date().toISOString().slice(0, 10),
-    updatedAt: new Date().toISOString(),
-    ...state,
-  }));
-}
-
-describe('buildSignalHealthEntry (PRI-788 G4)', () => {
-  it('missing file → unknown with nextAction, never throws (rc-1)', () => {
-    const entry = buildSignalHealthEntry(makeStateDir());
-    expect(entry.status).toBe('unknown');
-    expect(entry.counts).toBeNull();
-    expect(entry.nextAction).toMatch(/signal_collector/);
-  });
-
-  it('corrupt file → unknown', () => {
-    const stateDir = makeStateDir();
-    fs.writeFileSync(path.join(stateDir, 'signal-health.json'), '{not-json');
-    expect(buildSignalHealthEntry(stateDir).status).toBe('unknown');
-  });
-
-  it('fresh healthy file → ok with counts', () => {
-    const stateDir = makeStateDir();
-    writeHealth(stateDir, { stage1Strong: 3, pendingCount: 2 });
-    const entry = buildSignalHealthEntry(stateDir);
-    expect(entry.status).toBe('ok');
-    expect(entry.counts).toMatchObject({ stage1Strong: 3, pendingCount: 2 });
-    expect(entry.observerConsecutiveFailures).toBe(0);
-  });
-
-  it('observerConsecutiveFailures > 4 → degraded with probe nextAction', () => {
-    const stateDir = makeStateDir();
-    writeHealth(stateDir, { observerConsecutiveFailures: 40 });
-    const entry = buildSignalHealthEntry(stateDir);
-    expect(entry.status).toBe('degraded');
-    expect(entry.reason).toContain('40 cycles');
-    expect(entry.nextAction).toContain('pd runtime probe');
-  });
-
-  it('stale updatedAt (>24h) → degraded', () => {
-    const stateDir = makeStateDir();
-    const stale = new Date(Date.now() - 30 * 60 * 60 * 1000).toISOString();
-    writeHealth(stateDir, { updatedAt: stale });
-    const entry = buildSignalHealthEntry(stateDir);
-    expect(entry.status).toBe('degraded');
-    expect(entry.reason).toContain('>24h');
-  });
-
-  it('恰好超过 24h（24.5h）即 degraded — 常量必须与「>24h」契约一致', () => {
-    const stateDir = makeStateDir();
-    const stale = new Date(Date.now() - 24.5 * 60 * 60 * 1000).toISOString();
-    writeHealth(stateDir, { updatedAt: stale });
-    expect(buildSignalHealthEntry(stateDir).status).toBe('degraded');
-  });
-
-  it('23h 未更新仍是 ok（不误报 degraded）', () => {
-    const stateDir = makeStateDir();
-    const fresh = new Date(Date.now() - 23 * 60 * 60 * 1000).toISOString();
-    writeHealth(stateDir, { updatedAt: fresh });
-    expect(buildSignalHealthEntry(stateDir).status).toBe('ok');
-  });
-
-  it('non-finite garbage fields degrade gracefully without throwing (rc-2)', () => {
-    const stateDir = makeStateDir();
-    writeHealth(stateDir, {
-      stage1Strong: 'lots',
-      observerConsecutiveFailures: 'many',
-      updatedAt: 12345,
-    });
-    const entry = buildSignalHealthEntry(stateDir);
-    expect(entry.status).toBe('degraded'); // updatedAt 非法 → stale 分支
-    expect(entry.counts?.stage1Strong).toBe(0);
-  });
-});

package/tests/services/console-launcher.test.ts

@@ -1,114 +0,0 @@
-/**
- * Tests for console-launcher openBrowser command-injection hardening (PRI-547).
- *
- * The win32 opener must never route the URL through a shell
- * (`cmd.exe /c start "" <url>`). It must use a parameterized spawn of
- * `explorer.exe` with an argument array, and the URL must be validated as
- * http(s) before any spawn.
- *
- * Covers:
- * - http(s) URLs accepted
- * - non-http(s) schemes rejected before spawn (no child process created)
- * - shell metacharacters cannot reach a shell (spawn called with arg array)
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import * as path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const launcherPath = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '..',
-  '..',
-  'src',
-  'services',
-  'console-launcher.js',
-);
-
-describe('openBrowser URL validation and no-shell spawn', () => {
-  let spawnMock: ReturnType<typeof vi.fn>;
-  let platformSpy: ReturnType<typeof vi.spyOn>;
-
-  const fakeChild = () => {
-    const child: any = { on: vi.fn(), unref: vi.fn() };
-    return child;
-  };
-
-  beforeEach(() => {
-    spawnMock = vi.fn(() => fakeChild());
-    vi.doMock('child_process', () => ({ spawn: spawnMock, execFile: vi.fn(), execFileSync: vi.fn() }));
-    platformSpy = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32' as any);
-  });
-
-  afterEach(() => {
-    vi.doUnmock('child_process');
-    platformSpy.mockRestore();
-    vi.resetModules();
-  });
-
-  async function loadOpenBrowser() {
-    const mod = await import(launcherPath);
-    return mod.openBrowser as (url: string) => Promise<{ opened: boolean; reason?: string; nextAction?: string }>;
-  }
-
-  it('opens an https URL via parameterized explorer.exe spawn (no shell)', async () => {
-    const openBrowser = await loadOpenBrowser();
-    const result = await openBrowser('https://localhost:8123');
-
-    expect(result.opened).toBe(true);
-    expect(spawnMock).toHaveBeenCalledTimes(1);
-    const [cmd, args, opts] = spawnMock.mock.calls[0];
-    expect(cmd).toBe('explorer.exe');
-    // Argument array — never a shell command string
-    expect(Array.isArray(args)).toBe(true);
-    expect(args).toEqual(['https://localhost:8123/']);
-    // No shell option
-    expect(opts.shell).not.toBeDefined();
-  });
-
-  it('accepts http URL on localhost (legitimate local console)', async () => {
-    const openBrowser = await loadOpenBrowser();
-    const result = await openBrowser('http://127.0.0.1:8123');
-
-    expect(result.opened).toBe(true);
-    expect(spawnMock.mock.calls[0][1]).toEqual(['http://127.0.0.1:8123/']);
-  });
-
-  it('rejects javascript: scheme without spawning', async () => {
-    const openBrowser = await loadOpenBrowser();
-    const result = await openBrowser('javascript:alert(1)');
-
-    expect(result.opened).toBe(false);
-    expect(result.reason).toContain('protocol');
-    expect(spawnMock).not.toHaveBeenCalled();
-  });
-
-  it('rejects file: scheme without spawning', async () => {
-    const openBrowser = await loadOpenBrowser();
-    const result = await openBrowser('file:///etc/passwd');
-
-    expect(result.opened).toBe(false);
-    expect(spawnMock).not.toHaveBeenCalled();
-  });
-
-  it('rejects empty URL without spawning', async () => {
-    const openBrowser = await loadOpenBrowser();
-    const result = await openBrowser('');
-
-    expect(result.opened).toBe(false);
-    expect(result.reason).toContain('empty');
-    expect(spawnMock).not.toHaveBeenCalled();
-  });
-
-  it('shell metacharacters in a valid http URL stay as data (arg array, not shell)', async () => {
-    const openBrowser = await loadOpenBrowser();
-    const sneaky = 'http://localhost:8123/path?a=1&b=2;calc.exe';
-    const result = await openBrowser(sneaky);
-
-    expect(result.opened).toBe(true);
-    const args = spawnMock.mock.calls[0][1] as string[];
-    expect(args.length).toBe(1);
-    // The whole URL is a single argument — the spawn call has no shell so
-    // metacharacters cannot be interpreted as commands.
-    expect(args[0]).toContain(';calc.exe');
-  });
-});

package/tests/services/demo-rule-compiler.test.ts

@@ -1,242 +0,0 @@
-/**
- * compileDemoRule unit tests (PRI-429).
- *
- * The demo rule compiler is the sandbox adapter for run-rulehost's
- * adversarial loop. It parses TypeScript rule implementations, extracts
- * evaluate(), and validates the returned rule host result shape.
- *
- * Missing coverage would allow silent regression in the
- * RefinerSandbox contract (evaluate output shape, invalid rule bodies,
- * meta export shapes, polluted globals, etc.).
- *
- * ERR refs:
- *   - ERR-021: vm.Script runInContext must not leak globals
- *   - ERR-025: Object.hasOwn for untrusted output shape validation
- *   - ERR-037: non-object evaluate() return must throw loudly
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { compileDemoRule } from '../../src/services/demo-rule-compiler.js';
-import { createRuleHostHelpers } from '@principles/core/runtime-v2';
-import type { ReplayEvaluateFn, RuleHostInput, RuleHostResult } from '@principles/core/runtime-v2';
-
-const VALID_RULE = `
-export const meta = {
-  id: 'r1',
-  version: '1.0.0',
-  purpose: 'unit test',
-};
-export function evaluate(input, helpers) {
-  return { decision: 'allow', matched: false, reason: 'ok' };
-}
-`;
-
-const NO_EVALUATE = `
-export const meta = { id: 'r1' };
-`;
-
-const THROWING_EVALUATE = `
-export function evaluate(input, helpers) {
-  throw new Error('boom');
-}
-`;
-
-const INVALID_RETURN_WRONG_DECISION = `
-export function evaluate() {
-  return { decision: 'accepted', matched: false, reason: 'wrong decision enum' };
-}
-`;
-
-const INVALID_RETURN_NO_MATCHED = `
-export function evaluate() {
-  return { decision: 'allow', reason: 'missing matched' };
-}
-`;
-
-const INVALID_RETURN_NO_DECISION = `
-export function evaluate(input, helpers) {
-  return { reason: 'no-decision-field' };
-}
-`;
-
-const INVALID_RETURN_PRIMITIVE = `
-export function evaluate(input, helpers) {
-  return 42;
-}
-`;
-
-const INVALID_RETURN_NULL = `
-export function evaluate(input, helpers) {
-  return null;
-}
-`;
-
-const INVALID_RETURN_UNDEF = `
-export function evaluate(input, helpers) {
-  return undefined;
-}
-`;
-
-const INVALID_RETURN_STRING = `
-export function evaluate(input, helpers) {
-  return 'accepted';
-}
-`;
-
-const RULE_WITH_EVIDENCE = `
-export const meta = { id: 'r-evidence' };
-export function evaluate(input, helpers) {
-  const count = input.derived.estimatedLineChanges;
-  const matched = count > 0;
-  return { decision: matched ? 'block' : 'allow', matched, reason: 'based on changes', diagnostics: { count } };
-}
-`;
-
-const RULE_WITH_HASOWN_POISON_PAYLOAD = `
-export function evaluate(input, helpers) {
-  const poisoned = Object.create(null);
-  poisoned.decision = 'allow';
-  poisoned.matched = false;
-  poisoned.reason = 'ok';
-  return poisoned;
-}
-`;
-
-function makeRuleHostInput(estimatedLineChanges = 0): RuleHostInput {
-  return {
-    action: {
-      toolName: 'write_file',
-      normalizedPath: '/workspace/a.ts',
-      paramsSummary: {},
-    },
-    workspace: { isRiskPath: false },
-    session: { currentGfi: 0 },
-    evolution: { epTier: 0 },
-    derived: { estimatedLineChanges, bashRisk: 'safe' },
-  };
-}
-
-function evaluateRule(evaluate: ReplayEvaluateFn, input: RuleHostInput = makeRuleHostInput()): RuleHostResult {
-  return evaluate(input, createRuleHostHelpers(input));
-}
-
-describe('compileDemoRule', () => {
-  describe('source normalization', () => {
-    it('compiles a syntactically valid rule module', () => {
-      const fn = compileDemoRule(VALID_RULE, 'valid-rule.ts');
-      expect(typeof fn).toBe('function');
-    });
-
-    it('throws on code missing evaluate function', () => {
-      expect(() => compileDemoRule(NO_EVALUATE, 'no-evaluate.ts')).toThrow(/evaluate/);
-    });
-
-    it('propagates syntax errors from vm.Script', () => {
-      expect(() => compileDemoRule('this is not valid {{{', 'bad.ts')).toThrow();
-    });
-  });
-
-  describe('evaluate output shape validation', () => {
-    it('returns a fully validated RuleHostResult', () => {
-      const fn = compileDemoRule(VALID_RULE, 'valid-rule.ts');
-      const result = evaluateRule(fn);
-      expect(result).toEqual({
-        decision: 'allow',
-        matched: false,
-        reason: 'ok',
-      });
-    });
-
-    it('throws when evaluate returns an object without a decision field (ERR-037)', () => {
-      const fn = compileDemoRule(INVALID_RETURN_NO_DECISION, 'no-decision.ts');
-      expect(() => evaluateRule(fn)).toThrow(/invalid RuleHostResult/);
-    });
-
-    it('rejects objects using a non-RuleHost decision enum', () => {
-      const fn = compileDemoRule(INVALID_RETURN_WRONG_DECISION, 'wrong-decision.ts');
-      expect(() => evaluateRule(fn)).toThrow(/invalid RuleHostResult/);
-    });
-
-    it('rejects objects missing the required matched flag', () => {
-      const fn = compileDemoRule(INVALID_RETURN_NO_MATCHED, 'missing-matched.ts');
-      expect(() => evaluateRule(fn)).toThrow(/invalid RuleHostResult/);
-    });
-
-    it('throws when evaluate returns a number (non-object)', () => {
-      const fn = compileDemoRule(INVALID_RETURN_PRIMITIVE, 'primitive.ts');
-      expect(() => evaluateRule(fn)).toThrow(/invalid RuleHostResult/);
-    });
-
-    it('throws when evaluate returns null', () => {
-      const fn = compileDemoRule(INVALID_RETURN_NULL, 'null-return.ts');
-      expect(() => evaluateRule(fn)).toThrow(/invalid RuleHostResult/);
-    });
-
-    it('throws when evaluate returns undefined', () => {
-      const fn = compileDemoRule(INVALID_RETURN_UNDEF, 'undef-return.ts');
-      expect(() => evaluateRule(fn)).toThrow(/invalid RuleHostResult/);
-    });
-
-    it('throws when evaluate returns a string', () => {
-      const fn = compileDemoRule(INVALID_RETURN_STRING, 'string-return.ts');
-      expect(() => evaluateRule(fn)).toThrow(/invalid RuleHostResult/);
-    });
-
-    it('handles Object.create(null) output (no prototype) via Object.hasOwn (ERR-025)', () => {
-      const fn = compileDemoRule(RULE_WITH_HASOWN_POISON_PAYLOAD, 'hasown-poison.ts');
-      const result = evaluateRule(fn);
-      expect(result.decision).toBe('allow');
-    });
-  });
-
-  describe('evaluate behaviour', () => {
-    it('propagates evaluate() exceptions to the caller (fail loud)', () => {
-      const fn = compileDemoRule(THROWING_EVALUATE, 'throwing.ts');
-      expect(() => evaluateRule(fn)).toThrow(/boom/);
-    });
-
-    it('reads real RuleHostInput fields and returns different decisions', () => {
-      const fn = compileDemoRule(RULE_WITH_EVIDENCE, 'evidence-rule.ts');
-      const withChanges = evaluateRule(fn, makeRuleHostInput(3));
-      const withoutChanges = evaluateRule(fn);
-      expect(withChanges.decision).toBe('block');
-      expect(withoutChanges.decision).toBe('allow');
-    });
-  });
-
-  describe('vm sandbox isolation', () => {
-    it('does not pollute Node.js globalThis between invocations (ERR-021)', () => {
-      const polluter = `
-      export function evaluate() {
-        globalThis.__pd_leaked_test = 1;
-        return { decision: 'block', matched: true, reason: 'polluting' };
-      }
-      `;
-      expect(Reflect.get(globalThis, '__pd_leaked_test')).toBeUndefined();
-      const fn = compileDemoRule(polluter, 'polluter.ts');
-      evaluateRule(fn);
-      const leakedValue = Reflect.get(globalThis, '__pd_leaked_test');
-      // The sandboxed __pdRuleModule temporary assignment must not leak
-      // arbitrary user-defined globals.
-      expect(leakedValue).toBeUndefined();
-    });
-
-    it('removes the __pdRuleModule helper from the sandbox after compilation', () => {
-      // This indirectly asserts the cleanup path — a second compilation
-      // that does not export evaluate still throws rather than returning
-      // a stale value from the first run.
-      compileDemoRule(VALID_RULE, 'first.ts');
-      expect(() => compileDemoRule(NO_EVALUATE, 'second.ts')).toThrow(/evaluate/);
-    });
-  });
-
-  describe('sourceLabel is threaded into error messages', () => {
-    it('includes sourceLabel when evaluate() returns invalid output', () => {
-      const fn = compileDemoRule(INVALID_RETURN_PRIMITIVE, 'labeled-42.ts');
-      expect(() => evaluateRule(fn)).toThrow(/labeled-42\.ts/);
-    });
-
-    it('includes sourceLabel when evaluate export is missing', () => {
-      expect(() => compileDemoRule(NO_EVALUATE, 'no-eval-source-label.ts')).toThrow(/no-eval-source-label\.ts/);
-    });
-  });
-});