mcp-rubber-duck 1.8.0 → 1.9.3

package/tests/guardrails/config.test.ts

@@ -0,0 +1,267 @@
+import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import { ConfigManager } from '../../src/config/config';
+
+// Mock logger to avoid console noise during tests
+jest.mock('../../src/utils/logger');
+
+describe('ConfigManager - Guardrails Config', () => {
+  let originalEnv: NodeJS.ProcessEnv;
+
+  beforeEach(() => {
+    originalEnv = { ...process.env };
+    // Clear guardrails env vars
+    Object.keys(process.env).forEach((key) => {
+      if (key.startsWith('GUARDRAILS_')) delete process.env[key];
+    });
+    // Ensure at least one provider exists
+    process.env.OPENAI_API_KEY = 'test-key';
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  describe('basic guardrails config', () => {
+    it('should not have guardrails by default', () => {
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails).toBeUndefined();
+    });
+
+    it('should enable guardrails when GUARDRAILS_ENABLED=true', () => {
+      process.env.GUARDRAILS_ENABLED = 'true';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.enabled).toBe(true);
+    });
+
+    it('should disable guardrails when GUARDRAILS_ENABLED=false', () => {
+      process.env.GUARDRAILS_ENABLED = 'false';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails).toBeUndefined();
+    });
+
+    it('should set log_violations from environment', () => {
+      process.env.GUARDRAILS_ENABLED = 'true';
+      process.env.GUARDRAILS_LOG_VIOLATIONS = 'false';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.log_violations).toBe(false);
+    });
+
+    it('should set log_modifications from environment', () => {
+      process.env.GUARDRAILS_ENABLED = 'true';
+      process.env.GUARDRAILS_LOG_MODIFICATIONS = 'true';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.log_modifications).toBe(true);
+    });
+
+    it('should set fail_open from environment', () => {
+      process.env.GUARDRAILS_ENABLED = 'true';
+      process.env.GUARDRAILS_FAIL_OPEN = 'true';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.fail_open).toBe(true);
+    });
+  });
+
+  describe('rate limiter config', () => {
+    it('should configure rate limiter from environment', () => {
+      process.env.GUARDRAILS_RATE_LIMITER_ENABLED = 'true';
+      process.env.GUARDRAILS_RATE_LIMITER_REQUESTS_PER_MINUTE = '30';
+      process.env.GUARDRAILS_RATE_LIMITER_REQUESTS_PER_HOUR = '500';
+
+      const configManager = new ConfigManager();
+      const config = configManager.getConfig();
+
+      expect(config.guardrails?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.rate_limiter?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.rate_limiter?.requests_per_minute).toBe(30);
+      expect(config.guardrails?.plugins?.rate_limiter?.requests_per_hour).toBe(500);
+    });
+
+    it('should configure per_provider setting', () => {
+      process.env.GUARDRAILS_RATE_LIMITER_ENABLED = 'true';
+      process.env.GUARDRAILS_RATE_LIMITER_PER_PROVIDER = 'true';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.rate_limiter?.per_provider).toBe(true);
+    });
+
+    it('should configure burst_allowance setting', () => {
+      process.env.GUARDRAILS_RATE_LIMITER_ENABLED = 'true';
+      process.env.GUARDRAILS_RATE_LIMITER_BURST_ALLOWANCE = '10';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.rate_limiter?.burst_allowance).toBe(10);
+    });
+  });
+
+  describe('token limiter config', () => {
+    it('should configure token limiter from environment', () => {
+      process.env.GUARDRAILS_TOKEN_LIMITER_ENABLED = 'true';
+      process.env.GUARDRAILS_TOKEN_LIMITER_MAX_INPUT_TOKENS = '4096';
+
+      const configManager = new ConfigManager();
+      const config = configManager.getConfig();
+
+      expect(config.guardrails?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.token_limiter?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.token_limiter?.max_input_tokens).toBe(4096);
+    });
+
+    it('should configure max_output_tokens setting', () => {
+      process.env.GUARDRAILS_TOKEN_LIMITER_ENABLED = 'true';
+      process.env.GUARDRAILS_TOKEN_LIMITER_MAX_OUTPUT_TOKENS = '2048';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.token_limiter?.max_output_tokens).toBe(2048);
+    });
+
+    it('should configure warn_at_percentage setting', () => {
+      process.env.GUARDRAILS_TOKEN_LIMITER_ENABLED = 'true';
+      process.env.GUARDRAILS_TOKEN_LIMITER_WARN_AT_PERCENTAGE = '90';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.token_limiter?.warn_at_percentage).toBe(90);
+    });
+  });
+
+  describe('pattern blocker config', () => {
+    it('should configure pattern blocker from environment', () => {
+      process.env.GUARDRAILS_PATTERN_BLOCKER_ENABLED = 'true';
+      process.env.GUARDRAILS_PATTERN_BLOCKER_PATTERNS = 'password,secret,api_key';
+
+      const configManager = new ConfigManager();
+      const config = configManager.getConfig();
+
+      expect(config.guardrails?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.pattern_blocker?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.pattern_blocker?.blocked_patterns).toEqual([
+        'password',
+        'secret',
+        'api_key',
+      ]);
+    });
+
+    it('should configure regex patterns', () => {
+      process.env.GUARDRAILS_PATTERN_BLOCKER_ENABLED = 'true';
+      process.env.GUARDRAILS_PATTERN_BLOCKER_PATTERNS_REGEX = 'pass.*word,secret\\d+';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.pattern_blocker?.blocked_patterns_regex).toEqual([
+        'pass.*word',
+        'secret\\d+',
+      ]);
+    });
+
+    it('should configure case_sensitive setting', () => {
+      process.env.GUARDRAILS_PATTERN_BLOCKER_ENABLED = 'true';
+      process.env.GUARDRAILS_PATTERN_BLOCKER_CASE_SENSITIVE = 'true';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.pattern_blocker?.case_sensitive).toBe(true);
+    });
+
+    it('should configure action_on_match setting', () => {
+      process.env.GUARDRAILS_PATTERN_BLOCKER_ENABLED = 'true';
+      process.env.GUARDRAILS_PATTERN_BLOCKER_ACTION = 'redact';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.pattern_blocker?.action_on_match).toBe('redact');
+    });
+  });
+
+  describe('PII redactor config', () => {
+    it('should configure PII redactor from environment', () => {
+      process.env.GUARDRAILS_PII_REDACTOR_ENABLED = 'true';
+
+      const configManager = new ConfigManager();
+      const config = configManager.getConfig();
+
+      expect(config.guardrails?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.pii_redactor?.enabled).toBe(true);
+    });
+
+    it('should configure detection types', () => {
+      process.env.GUARDRAILS_PII_REDACTOR_ENABLED = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_DETECT_EMAILS = 'false';
+      process.env.GUARDRAILS_PII_REDACTOR_DETECT_PHONES = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_DETECT_SSN = 'false';
+      process.env.GUARDRAILS_PII_REDACTOR_DETECT_API_KEYS = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_DETECT_CREDIT_CARDS = 'false';
+      process.env.GUARDRAILS_PII_REDACTOR_DETECT_IP_ADDRESSES = 'true';
+
+      const configManager = new ConfigManager();
+      const piiConfig = configManager.getConfig().guardrails?.plugins?.pii_redactor;
+
+      expect(piiConfig?.detect_emails).toBe(false);
+      expect(piiConfig?.detect_phones).toBe(true);
+      expect(piiConfig?.detect_ssn).toBe(false);
+      expect(piiConfig?.detect_api_keys).toBe(true);
+      expect(piiConfig?.detect_credit_cards).toBe(false);
+      expect(piiConfig?.detect_ip_addresses).toBe(true);
+    });
+
+    it('should configure allowlist', () => {
+      process.env.GUARDRAILS_PII_REDACTOR_ENABLED = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_ALLOWLIST = 'test@example.com,support@company.com';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.pii_redactor?.allowlist).toEqual([
+        'test@example.com',
+        'support@company.com',
+      ]);
+    });
+
+    it('should configure allowlist_domains', () => {
+      process.env.GUARDRAILS_PII_REDACTOR_ENABLED = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_ALLOWLIST_DOMAINS = 'company.com,internal.org';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.pii_redactor?.allowlist_domains).toEqual([
+        'company.com',
+        'internal.org',
+      ]);
+    });
+
+    it('should configure restore_on_response', () => {
+      process.env.GUARDRAILS_PII_REDACTOR_ENABLED = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_RESTORE_ON_RESPONSE = 'true';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.pii_redactor?.restore_on_response).toBe(true);
+    });
+
+    it('should configure log_detections', () => {
+      process.env.GUARDRAILS_PII_REDACTOR_ENABLED = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_LOG_DETECTIONS = 'false';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.plugins?.pii_redactor?.log_detections).toBe(false);
+    });
+  });
+
+  describe('auto-enable behavior', () => {
+    it('should auto-enable guardrails when a plugin is enabled', () => {
+      // Don't set GUARDRAILS_ENABLED, but enable a plugin
+      process.env.GUARDRAILS_RATE_LIMITER_ENABLED = 'true';
+
+      const configManager = new ConfigManager();
+      expect(configManager.getConfig().guardrails?.enabled).toBe(true);
+    });
+
+    it('should auto-enable with multiple plugins', () => {
+      process.env.GUARDRAILS_RATE_LIMITER_ENABLED = 'true';
+      process.env.GUARDRAILS_PII_REDACTOR_ENABLED = 'true';
+
+      const configManager = new ConfigManager();
+      const config = configManager.getConfig();
+
+      expect(config.guardrails?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.rate_limiter?.enabled).toBe(true);
+      expect(config.guardrails?.plugins?.pii_redactor?.enabled).toBe(true);
+    });
+  });
+});

package/tests/guardrails/errors.test.ts

@@ -0,0 +1,109 @@
+import { describe, it, expect } from '@jest/globals';
+import {
+  GuardrailBlockError,
+  GuardrailInitError,
+  GuardrailExecutionError,
+} from '../../src/guardrails/errors.js';
+
+describe('GuardrailBlockError', () => {
+  it('should create error with plugin name and reason', () => {
+    const error = new GuardrailBlockError('rate_limiter', 'Too many requests');
+
+    expect(error.pluginName).toBe('rate_limiter');
+    expect(error.reason).toBe('Too many requests');
+  });
+
+  it('should format message correctly', () => {
+    const error = new GuardrailBlockError('pii_redactor', 'Sensitive data detected');
+
+    expect(error.message).toBe(
+      "Request blocked by guardrail 'pii_redactor': Sensitive data detected"
+    );
+  });
+
+  it('should have correct error name', () => {
+    const error = new GuardrailBlockError('test', 'reason');
+
+    expect(error.name).toBe('GuardrailBlockError');
+  });
+
+  it('should be instanceof Error', () => {
+    const error = new GuardrailBlockError('test', 'reason');
+
+    expect(error).toBeInstanceOf(Error);
+  });
+});
+
+describe('GuardrailInitError', () => {
+  it('should create error with plugin name and message', () => {
+    const error = new GuardrailInitError('token_limiter', 'Invalid configuration');
+
+    expect(error.pluginName).toBe('token_limiter');
+    expect(error.cause).toBeUndefined();
+  });
+
+  it('should format message correctly', () => {
+    const error = new GuardrailInitError('pattern_blocker', 'Missing required field');
+
+    expect(error.message).toBe(
+      "Failed to initialize guardrail plugin 'pattern_blocker': Missing required field"
+    );
+  });
+
+  it('should store cause error when provided', () => {
+    const cause = new Error('Original error');
+    const error = new GuardrailInitError('test_plugin', 'Init failed', cause);
+
+    expect(error.cause).toBe(cause);
+  });
+
+  it('should have correct error name', () => {
+    const error = new GuardrailInitError('test', 'message');
+
+    expect(error.name).toBe('GuardrailInitError');
+  });
+});
+
+describe('GuardrailExecutionError', () => {
+  it('should create error with plugin name, phase, and message', () => {
+    const error = new GuardrailExecutionError(
+      'rate_limiter',
+      'pre_request',
+      'Execution failed'
+    );
+
+    expect(error.pluginName).toBe('rate_limiter');
+    expect(error.phase).toBe('pre_request');
+    expect(error.cause).toBeUndefined();
+  });
+
+  it('should format message correctly', () => {
+    const error = new GuardrailExecutionError(
+      'pii_redactor',
+      'post_response',
+      'Pattern matching failed'
+    );
+
+    expect(error.message).toBe(
+      "Guardrail plugin 'pii_redactor' failed during 'post_response': Pattern matching failed"
+    );
+  });
+
+  it('should store cause error when provided', () => {
+    const cause = new TypeError('Cannot read property');
+    const error = new GuardrailExecutionError(
+      'test_plugin',
+      'pre_tool_input',
+      'Unexpected error',
+      cause
+    );
+
+    expect(error.cause).toBe(cause);
+  });
+
+  it('should have correct error name', () => {
+    const error = new GuardrailExecutionError('test', 'phase', 'message');
+
+    expect(error.name).toBe('GuardrailExecutionError');
+  });
+});

package/tests/guardrails/plugins/pattern-blocker.test.ts

@@ -0,0 +1,309 @@
+import { describe, it, expect, beforeEach, jest } from '@jest/globals';
+import { PatternBlockerPlugin } from '../../../src/guardrails/plugins/pattern-blocker';
+import { createGuardrailContext } from '../../../src/guardrails/context';
+
+// Mock logger to avoid console noise during tests
+jest.mock('../../../src/utils/logger');
+
+describe('PatternBlockerPlugin', () => {
+  let plugin: PatternBlockerPlugin;
+
+  beforeEach(async () => {
+    plugin = new PatternBlockerPlugin();
+  });
+
+  describe('initialization', () => {
+    it('should initialize with default values', async () => {
+      await plugin.initialize({ enabled: true });
+
+      expect(plugin.enabled).toBe(true);
+      expect(plugin.name).toBe('pattern_blocker');
+      expect(plugin.phases).toContain('pre_request');
+      expect(plugin.phases).toContain('pre_tool_input');
+    });
+
+    it('should initialize with custom patterns', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password', 'secret'],
+        blocked_patterns_regex: ['api[_-]?key'],
+      });
+
+      const patterns = plugin.getPatterns();
+      expect(patterns.simple).toEqual(['password', 'secret']);
+      expect(patterns.regex).toEqual(['api[_-]?key']);
+    });
+  });
+
+  describe('simple pattern matching', () => {
+    it('should block prompts containing blocked patterns', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password', 'secret'],
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'My password is hunter2',
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('block');
+      expect(result.blockedBy).toBe('pattern_blocker');
+    });
+
+    it('should allow prompts without blocked patterns', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password', 'secret'],
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'Hello world, how are you?',
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('allow');
+    });
+
+    it('should be case insensitive by default', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password'],
+        case_sensitive: false,
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'My PASSWORD is hunter2',
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('block');
+    });
+
+    it('should respect case sensitivity when configured', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password'],
+        case_sensitive: true,
+        action_on_match: 'block',
+      });
+
+      // Lowercase should match
+      const context1 = createGuardrailContext({
+        prompt: 'My password is hunter2',
+      });
+      const result1 = await plugin.execute('pre_request', context1);
+      expect(result1.action).toBe('block');
+
+      // Uppercase should NOT match
+      const context2 = createGuardrailContext({
+        prompt: 'My PASSWORD is hunter2',
+      });
+      const result2 = await plugin.execute('pre_request', context2);
+      expect(result2.action).toBe('allow');
+    });
+  });
+
+  describe('regex pattern matching', () => {
+    it('should match regex patterns', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns_regex: ['api[_-]?key[_-]?[a-z0-9]{8,}'],
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'My api_key_abc12345678 is sensitive',
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('block');
+    });
+
+    it('should handle invalid regex gracefully', async () => {
+      // Invalid regex should be skipped during initialization
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns_regex: ['[invalid(regex'],
+        action_on_match: 'block',
+      });
+
+      const patterns = plugin.getPatterns();
+      expect(patterns.regex).toEqual([]); // Invalid regex should be skipped
+
+      const context = createGuardrailContext({
+        prompt: 'This should be allowed',
+      });
+      const result = await plugin.execute('pre_request', context);
+      expect(result.action).toBe('allow');
+    });
+  });
+
+  describe('action modes', () => {
+    it('should block when action is block', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['secret'],
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'This is a secret message',
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('block');
+      expect(context.violations.some((v) => v.severity === 'error')).toBe(true);
+    });
+
+    it('should warn but allow when action is warn', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['secret'],
+        action_on_match: 'warn',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'This is a secret message',
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('allow');
+      expect(context.violations.some((v) => v.severity === 'warning')).toBe(true);
+    });
+
+    it('should redact when action is redact', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['secret'],
+        action_on_match: 'redact',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'This is a secret message',
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('modify');
+      expect(context.prompt).toContain('[REDACTED]');
+      expect(context.prompt).not.toContain('secret');
+    });
+  });
+
+  describe('tool input checking', () => {
+    it('should check tool arguments', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password'],
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        toolName: 'some_tool',
+        toolArgs: { user: 'admin', password: 'hunter2' },
+      });
+      const result = await plugin.execute('pre_tool_input', context);
+
+      expect(result.action).toBe('block');
+    });
+  });
+
+  describe('phase handling', () => {
+    it('should skip phases not in its list (post_response)', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['secret'],
+        action_on_match: 'block',
+      });
+
+      // post_response is not in pattern_blocker's phases
+      const context = createGuardrailContext({
+        response: 'This is a secret response',
+      });
+      const result = await plugin.execute('post_response', context);
+
+      // Should allow since phase is not handled
+      expect(result.action).toBe('allow');
+    });
+
+    it('should skip post_tool_output phase', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['secret'],
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        toolResult: { data: 'secret data' },
+      });
+      const result = await plugin.execute('post_tool_output', context);
+
+      expect(result.action).toBe('allow');
+    });
+  });
+
+  describe('redact mode with messages', () => {
+    it('should update last message when redacting in pre_request phase', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['secret'],
+        action_on_match: 'redact',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'Tell me the secret code',
+        messages: [
+          { role: 'user', content: 'Tell me the secret code', timestamp: new Date() },
+        ],
+      });
+      const result = await plugin.execute('pre_request', context);
+
+      expect(result.action).toBe('modify');
+      expect(context.prompt).toContain('[REDACTED]');
+      // Last message should also be updated
+      expect(context.messages[0].content).toContain('[REDACTED]');
+      expect(context.messages[0].content).not.toContain('secret');
+    });
+
+    it('should redact in tool args during pre_tool_input phase', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password'],
+        action_on_match: 'redact',
+      });
+
+      const context = createGuardrailContext({
+        toolName: 'login',
+        toolArgs: { user: 'admin', pass: 'password123' },
+      });
+      const result = await plugin.execute('pre_tool_input', context);
+
+      expect(result.action).toBe('modify');
+      // toolArgs should be updated (as string since JSON parse might fail)
+      const toolArgsStr = JSON.stringify(context.toolArgs);
+      expect(toolArgsStr).toContain('[REDACTED]');
+    });
+  });
+
+  describe('violations', () => {
+    it('should add violation with pattern details', async () => {
+      await plugin.initialize({
+        enabled: true,
+        blocked_patterns: ['password'],
+        action_on_match: 'block',
+      });
+
+      const context = createGuardrailContext({
+        prompt: 'My password is secret',
+      });
+      await plugin.execute('pre_request', context);
+
+      expect(context.violations.length).toBeGreaterThan(0);
+      expect(context.violations[0].rule).toBe('blocked_pattern');
+      expect(context.violations[0].details?.matches).toBeDefined();
+    });
+  });
+});