principles-disciple 1.126.0 → 1.128.0

package/tests/core/session-tracker.test.ts

@@ -1,191 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import {
-    trackToolRead,
-    trackLlmOutput,
-    getSession,
-    clearSession,
-    trackFriction,
-    resetFriction,
-    initPersistence,
-    trackBlock,
-    recordThinkingCheckpoint,
-} from '../../src/core/session-tracker.js';
-
-describe('Session Tracker', () => {
-    const sessionId = 'test-session-1';
-    let tempDir: string | null = null;
-
-    beforeEach(() => {
-        clearSession(sessionId);
-    });
-
-    afterEach(() => {
-        if (tempDir) {
-            fs.rmSync(tempDir, { recursive: true, force: true });
-            tempDir = null;
-        }
-        vi.useRealTimers();
-        clearSession('session-a');
-        clearSession('session-b');
-    });
-
-    it('should track tool reads per file', () => {
-        trackToolRead(sessionId, 'src/main.ts');
-        trackToolRead(sessionId, 'src/main.ts');
-        trackToolRead(sessionId, 'docs/README.md');
-
-        const state = getSession(sessionId);
-        expect(state).toBeDefined();
-        expect(state?.toolReadsByFile['src/main.ts']).toBe(2);
-        expect(state?.toolReadsByFile['docs/README.md']).toBe(1);
-    });
-
-    it('should detect stuck loops (paralysis) on high input / tiny output', () => {
-        // 1st turn
-        trackLlmOutput(sessionId, { input: 100, output: 500 });
-        // 2nd turn
-        trackLlmOutput(sessionId, { input: 8500, output: 20 });
-        // 3rd turn
-        trackLlmOutput(sessionId, { input: 8800, output: 15 });
-        // 4th turn
-        trackLlmOutput(sessionId, { input: 9000, output: 10 });
-        // 5th turn
-        trackLlmOutput(sessionId, { input: 9100, output: 8 });
-
-        let state = getSession(sessionId);
-        expect(state?.stuckLoops).toBe(0); // Needs > 5 turns total
-
-        // 6th turn (should trigger loop detection)
-        trackLlmOutput(sessionId, { input: 9200, output: 10 });
-        state = getSession(sessionId);
-        expect(state?.stuckLoops).toBe(1);
-
-        // 7th turn (continues loop)
-        trackLlmOutput(sessionId, { input: 9300, output: 5 });
-        state = getSession(sessionId);
-        expect(state?.stuckLoops).toBe(2);
-
-        // 8th turn (breaks out, high output)
-        trackLlmOutput(sessionId, { input: 9400, output: 300 });
-        state = getSession(sessionId);
-        expect(state?.stuckLoops).toBe(1); // decrements
-    });
-
-    it('should accumulate friction and reset on success', () => {
-        const errorHash = 'abc-123';
-        
-        // 1st error
-        trackFriction(sessionId, 30, errorHash);
-        let state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(30);
-        expect(state?.consecutiveErrors).toBe(1);
-
-        // 2nd identical error (multiplier 1.5^1 = 1.5)
-        trackFriction(sessionId, 30, errorHash);
-        state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(30 + (30 * 1.5)); // 75
-        expect(state?.consecutiveErrors).toBe(2);
-
-        // 3rd identical error (multiplier 1.5^2 = 2.25)
-        trackFriction(sessionId, 30, errorHash);
-        state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(75 + (30 * 2.25)); // 75 + 67.5 = 142.5
-        expect(state?.consecutiveErrors).toBe(3);
-
-        // Success should reset GFI
-        resetFriction(sessionId);
-        state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(0);
-        expect(state?.consecutiveErrors).toBe(0);
-        expect(state?.gfiBySource).toEqual({});
-    });
-
-    it('should reset multiplier on different error hash', () => {
-        trackFriction(sessionId, 30, 'hash-1');
-        trackFriction(sessionId, 30, 'hash-2');
-        
-        let state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(60); // 30 + 30
-        expect(state?.consecutiveErrors).toBe(1); // reset to 1 for new hash
-    });
-
-    it('should rollback only the empathy source slice instead of wiping total gfi', () => {
-        trackFriction(sessionId, 30, 'tool_failure_hash');
-        trackFriction(sessionId, 20, 'user_empathy_moderate', undefined, { source: 'user_empathy' });
-
-        let state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(50);
-        expect(state?.gfiBySource).toEqual({
-            'unattributed:tool_failure_hash': 30,
-            user_empathy: 20,
-        });
-
-        resetFriction(sessionId, undefined, { source: 'user_empathy', amount: 20 });
-
-        state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(30);
-        expect(state?.gfiBySource).toEqual({
-            'unattributed:tool_failure_hash': 30,
-        });
-        expect(state?.consecutiveErrors).toBe(0);
-        expect(state?.lastErrorHash).toBe('');
-        expect(state?.lastErrorSource).toBe('');
-    });
-
-    it('should clamp slice rollback amount and preserve other source ledger entries', () => {
-        trackFriction(sessionId, 10, 'tool_failure_hash');
-        trackFriction(sessionId, 15, 'user_empathy_mild', undefined, { source: 'user_empathy' });
-        trackFriction(sessionId, 5, 'system_empathy_warn', undefined, { source: 'system_infer' });
-
-        resetFriction(sessionId, undefined, { source: 'user_empathy', amount: 999 });
-
-        const state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(15);
-        expect(state?.gfiBySource).toEqual({
-            'unattributed:tool_failure_hash': 10,
-            system_infer: 5,
-        });
-    });
-
-    it('should ignore slice rollback for a source that does not exist', () => {
-        trackFriction(sessionId, 12, 'tool_failure_hash');
-
-        resetFriction(sessionId, undefined, { source: 'user_empathy', amount: 7 });
-
-        const state = getSession(sessionId);
-        expect(state?.currentGfi).toBe(12);
-        expect(state?.gfiBySource).toEqual({
-            'unattributed:tool_failure_hash': 12,
-        });
-        expect(state?.consecutiveErrors).toBe(1);
-        expect(state?.lastErrorHash).toBe('tool_failure_hash');
-    });
-
-    it('should persist multiple sessions independently instead of overwriting the previous debounce timer', () => {
-        vi.useFakeTimers();
-        tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-session-persist-'));
-        initPersistence(tempDir);
-
-        trackFriction('session-a', 10, 'hash-a', tempDir);
-        trackFriction('session-b', 15, 'hash-b', tempDir);
-
-        vi.advanceTimersByTime(1000);
-
-        expect(fs.existsSync(path.join(tempDir, 'sessions', 'session-a.json'))).toBe(true);
-        expect(fs.existsSync(path.join(tempDir, 'sessions', 'session-b.json'))).toBe(true);
-    });
-
-    it('should refresh control activity timestamps for block and thinking updates', () => {
-        trackBlock(sessionId);
-        let state = getSession(sessionId);
-        const blockTs = state?.lastControlActivityAt ?? 0;
-        expect(blockTs).toBeGreaterThan(0);
-
-        recordThinkingCheckpoint(sessionId);
-        state = getSession(sessionId);
-        expect((state?.lastControlActivityAt ?? 0) >= blockTs).toBe(true);
-    });
-});

package/tests/core/surface-guard.test.ts

@@ -1,338 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import {
-  checkSurfaceGuard,
-  isSurfaceEnabled,
-  guardHook,
-  guardService,
-  getSurfaceIdForHook,
-  getSurfaceIdForService,
-  __resetSurfaceGuardSkipLogStateForTests,
-} from '../../src/core/surface-guard.js';
-import { PLUGIN_SURFACE_REGISTRY } from '@principles/core/runtime-v2';
-import type { OpenClawPluginService } from '../../src/openclaw-sdk.js';
-
-describe('surface-guard', () => {
-  beforeEach(() => {
-    // Each test starts with a clean surface-guard skip log state so the
-    // first-fire assertions are deterministic (PRI-298).
-    __resetSurfaceGuardSkipLogStateForTests();
-    vi.clearAllMocks();
-  });
-  describe('getSurfaceIdForHook', () => {
-    it('generates correct surface id without label', () => {
-      expect(getSurfaceIdForHook('before_tool_call')).toBe('hook:before_tool_call');
-    });
-
-    it('generates correct surface id with label', () => {
-      expect(getSurfaceIdForHook('after_tool_call', 'trajectory')).toBe('hook:after_tool_call.trajectory');
-    });
-  });
-
-  describe('getSurfaceIdForService', () => {
-    it('generates correct surface id for service', () => {
-      expect(getSurfaceIdForService('evolution-worker')).toBe('service:evolution-worker');
-    });
-  });
-
-  describe('checkSurfaceGuard', () => {
-    it('returns passed=true when registry is valid', () => {
-      const result = checkSurfaceGuard();
-      expect(result.passed).toBe(true);
-      expect(result.violations).toEqual([]);
-    });
-
-    it('includes enabled core surfaces', () => {
-      const result = checkSurfaceGuard();
-      expect(result.enabledCoreSurfaces.length).toBeGreaterThan(0);
-      for (const surfaceId of result.enabledCoreSurfaces) {
-        const entry = PLUGIN_SURFACE_REGISTRY.find(s => s.id === surfaceId);
-        expect(entry).toBeDefined();
-        expect(entry?.category).toBe('core');
-      }
-    });
-
-    it('includes disabled non-core surfaces', () => {
-      const result = checkSurfaceGuard();
-      expect(result.disabledNonCoreSurfaces.length).toBeGreaterThan(0);
-      for (const surfaceId of result.disabledNonCoreSurfaces) {
-        const entry = PLUGIN_SURFACE_REGISTRY.find(s => s.id === surfaceId);
-        expect(entry).toBeDefined();
-        expect(entry?.category).not.toBe('core');
-        expect(entry?.enabledByDefault).toBe(false);
-      }
-    });
-
-    it('returns violations when non-core surface is enabledByDefault', () => {
-      const result = checkSurfaceGuard();
-      const nonCoreEnabled = PLUGIN_SURFACE_REGISTRY.filter(
-        s => s.category !== 'core' && s.enabledByDefault,
-      );
-      if (nonCoreEnabled.length > 0) {
-        expect(result.violations.length).toBeGreaterThan(0);
-      }
-    });
-  });
-
-  describe('isSurfaceEnabled', () => {
-    it('returns enabled=true for core surface without override', () => {
-      const result = isSurfaceEnabled('hook:before_prompt_build');
-      expect(result.enabled).toBe(true);
-      expect(result.reason).toBeUndefined();
-    });
-
-    it('returns enabled=false for quiet surface without override', () => {
-      const result = isSurfaceEnabled('hook:after_tool_call.trajectory');
-      expect(result.enabled).toBe(false);
-      expect(result.reason).toBeDefined();
-    });
-
-    it('returns reason when surface not found', () => {
-      const result = isSurfaceEnabled('hook:nonexistent_hook');
-      expect(result.enabled).toBe(false);
-      expect(result.reason).toContain('not found in registry');
-    });
-
-    it('allows override for quiet surface', () => {
-      const result = isSurfaceEnabled('hook:subagent_spawning', {
-        'hook:subagent_spawning': true,
-      });
-      expect(result.enabled).toBe(true);
-    });
-
-    it('ignores non-boolean override', () => {
-      const result = isSurfaceEnabled('hook:before_prompt_build', {
-        'hook:before_prompt_build': 'yes' as unknown as boolean,
-      });
-      expect(result.enabled).toBe(true);
-    });
-
-    it('cannot disable core surface', () => {
-      const result = isSurfaceEnabled('hook:before_prompt_build', {
-        'hook:before_prompt_build': false,
-      });
-      expect(result.enabled).toBe(true);
-      expect(result.reason).toContain('core');
-    });
-
-    it('returns disabledReason for disabled surface', () => {
-      const result = isSurfaceEnabled('service:evolution-worker');
-      expect(result.enabled).toBe(false);
-      expect(result.reason).toContain('evolution_worker');
-    });
-  });
-
-  describe('guardHook', () => {
-    beforeEach(() => {
-      vi.clearAllMocks();
-    });
-
-    it('returns original handler for enabled surface', () => {
-      const mockHandler = vi.fn().mockReturnValue('result');
-      const guarded = guardHook('hook:before_prompt_build', undefined, mockHandler);
-      const result = guarded({}, {});
-      expect(mockHandler).toHaveBeenCalled();
-      expect(result).toBe('result');
-    });
-
-    it('returns no-op for disabled surface without logger', () => {
-      const mockHandler = vi.fn();
-      const guarded = guardHook('hook:after_tool_call.trajectory', undefined, mockHandler);
-      const result = guarded({}, {});
-      expect(mockHandler).not.toHaveBeenCalled();
-      expect(result).toBeUndefined();
-    });
-
-    it('logs when surface is disabled with logger', () => {
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const mockHandler = vi.fn();
-      const guarded = guardHook('hook:after_tool_call.trajectory', mockLogger, mockHandler);
-      guarded({}, {});
-      expect(mockLogger.info).toHaveBeenCalled();
-      expect(mockHandler).not.toHaveBeenCalled();
-    });
-
-    it('does not log at guardHook construction time (PRI-298 / chatgpt P2)', () => {
-      // Registering a guard for a quiet hook must not emit the SKIP line on
-      // its own; the log fires only when the returned no-op is actually
-      // invoked. Plugin startup that registers a dozen quiet hooks would
-      // otherwise log a dozen SKIP lines before any real traffic.
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      guardHook('hook:after_tool_call.trajectory', mockLogger, vi.fn());
-      expect(mockLogger.info).not.toHaveBeenCalled();
-    });
-
-    it('logger undefined on first fire does not consume the one-shot slot (PRI-298 / coderabbit Major)', () => {
-      // First call has no logger — the no-op still suppresses the handler,
-      // and the once-only slot is preserved for a later call that does
-      // have a logger.
-      const handler1 = guardHook('hook:after_tool_call.trajectory', undefined, vi.fn());
-      handler1({}, {});
-
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const handler2 = guardHook('hook:after_tool_call.trajectory', mockLogger, vi.fn());
-      handler2({}, {});
-
-      // Only the second call (which had a logger) should have emitted a log.
-      expect(mockLogger.info).toHaveBeenCalledTimes(1);
-      expect(mockLogger.info).toHaveBeenCalledWith(
-        expect.stringContaining('[PD:surface-guard] SKIP hook:after_tool_call.trajectory'),
-      );
-
-      // A third call should now be silent (slot consumed by the second call).
-      const handler3 = guardHook('hook:after_tool_call.trajectory', mockLogger, vi.fn());
-      handler3({}, {});
-      expect(mockLogger.info).toHaveBeenCalledTimes(1);
-    });
-
-    it('does not log for enabled surface', () => {
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const mockHandler = vi.fn();
-      const guarded = guardHook('hook:before_prompt_build', mockLogger, mockHandler);
-      guarded({}, {});
-      expect(mockLogger.info).not.toHaveBeenCalled();
-    });
-
-    it('guards unknown surface with not-found reason', () => {
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const guarded = guardHook('hook:unknown_hook', mockLogger, vi.fn());
-      guarded({}, {});
-      expect(mockLogger.info).toHaveBeenCalledWith(
-        expect.stringContaining('not found in registry'),
-      );
-    });
-
-    it('logs once on first fire and stays silent on subsequent fires (PRI-298 rate-limit)', () => {
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const mockHandler = vi.fn();
-      const guarded = guardHook('hook:after_tool_call.trajectory', mockLogger, mockHandler);
-
-      // First fire: log is emitted once with the disabled reason.
-      guarded({}, {});
-      expect(mockLogger.info).toHaveBeenCalledTimes(1);
-      expect(mockLogger.info).toHaveBeenCalledWith(
-        expect.stringContaining('[PD:surface-guard] SKIP hook:after_tool_call.trajectory'),
-      );
-
-      // Subsequent fires on the same surfaceId: no further log noise, but the
-      // handler is still suppressed (observability remains: the no-op returns
-      // undefined; the surface is still classified as disabled).
-      for (let i = 0; i < 5; i += 1) {
-        guarded({}, {});
-      }
-      expect(mockLogger.info).toHaveBeenCalledTimes(1);
-      expect(mockHandler).not.toHaveBeenCalled();
-    });
-
-    it('logs first fire per surfaceId independently (one log per quiet surface)', () => {
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const handler1 = guardHook('hook:after_tool_call.trajectory', mockLogger, vi.fn());
-      const handler2 = guardHook('hook:llm_output.trajectory', mockLogger, vi.fn());
-      const handler3 = guardHook('hook:subagent_spawning', mockLogger, vi.fn());
-
-      handler1({}, {});
-      handler2({}, {});
-      handler3({}, {});
-
-      expect(mockLogger.info).toHaveBeenCalledTimes(3);
-      const calls = mockLogger.info.mock.calls.map(c => String(c[0]));
-      expect(calls.some(c => c.includes('hook:after_tool_call.trajectory'))).toBe(true);
-      expect(calls.some(c => c.includes('hook:llm_output.trajectory'))).toBe(true);
-      expect(calls.some(c => c.includes('hook:subagent_spawning'))).toBe(true);
-    });
-  });
-
-  describe('guardService', () => {
-    beforeEach(() => {
-      vi.clearAllMocks();
-    });
-
-    it('returns original service for enabled surface', () => {
-      const mockService: OpenClawPluginService = { id: 'test-service' };
-      const result = guardService('hook:before_prompt_build', mockService);
-      expect(result).toBe(mockService);
-    });
-
-    it('returns null for disabled surface without logger', () => {
-      const mockService: OpenClawPluginService = { id: 'test-service' };
-      const result = guardService('hook:after_tool_call.trajectory', mockService);
-      expect(result).toBeNull();
-    });
-
-    it('logs when surface is disabled with logger', () => {
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const mockService: OpenClawPluginService = { id: 'test-service' };
-      const result = guardService('hook:after_tool_call.trajectory', mockService, mockLogger);
-      expect(result).toBeNull();
-      expect(mockLogger.info).toHaveBeenCalledWith(
-        expect.stringContaining('SKIP service'),
-      );
-    });
-
-    it('returns null for unknown surface', () => {
-      const mockService: OpenClawPluginService = { id: 'test-service' };
-      const result = guardService('service:nonexistent', mockService);
-      expect(result).toBeNull();
-    });
-
-    it('logs once per service surface on first registration (PRI-298 rate-limit)', () => {
-      const mockLogger = { info: vi.fn(), debug: vi.fn() };
-      const service: OpenClawPluginService = { id: 'test-service' };
-
-      // service:evolution-worker is quiet/disabled — use it for the rate-limit test.
-      const first = guardService('service:evolution-worker', service, mockLogger);
-      expect(first).toBeNull();
-      expect(mockLogger.info).toHaveBeenCalledTimes(1);
-      expect(mockLogger.info).toHaveBeenCalledWith(
-        expect.stringContaining('SKIP service service:evolution-worker'),
-      );
-
-      // Subsequent guardService calls for the same surfaceId stay silent.
-      guardService('service:evolution-worker', service, mockLogger);
-      guardService('service:evolution-worker', service, mockLogger);
-      expect(mockLogger.info).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  describe('PRI-298 disabledReason copy', () => {
-    it('no quiet surface disabledReason references "Story A" or "Story A\'"', () => {
-      const quietOrNonCore = PLUGIN_SURFACE_REGISTRY.filter(
-        s => s.category === 'quiet' || s.category === 'gone' || s.category === 'legacy_retire',
-      );
-      expect(quietOrNonCore.length).toBeGreaterThan(0);
-      for (const surface of quietOrNonCore) {
-        expect(surface.disabledReason).toBeDefined();
-        // MVP residue that should not appear in production log copy.
-        expect(surface.disabledReason).not.toMatch(/Story A/);
-        expect(surface.disabledReason).not.toMatch(/MVP\s*验收/);
-        expect(surface.disabledReason).not.toMatch(/测试任务/);
-      }
-    });
-
-    it('subagent hook disabledReason is opt-in and ADR-anchored (PRI-298)', () => {
-      const subagent = PLUGIN_SURFACE_REGISTRY.find(
-        s => s.id === 'hook:subagent_spawning',
-      );
-      expect(subagent?.disabledReason).toBeDefined();
-      const reason = subagent!.disabledReason!.toLowerCase();
-      // Quiet hook copy is opt-in / opt-out anchored on a real ADR section
-      expect(reason).toContain('opt-in');
-      expect(reason).toContain('default off');
-      expect(reason).toMatch(/adr-?0014/);
-    });
-
-    it('no quiet surface disabledReason promises a feature flag override (PRI-298 / chatgpt P2)', () => {
-      // The runtime guard path (`isSurfaceEnabled(surfaceId)` with no
-      // overrides argument) does not consume `.pd/config.yaml`, so
-      // telling operators to "enable via feature flag override" would be
-      // an impossible next action. Quiet copy must describe the surface
-      // honestly without pointing to a non-existent override path.
-      const quiet = PLUGIN_SURFACE_REGISTRY.filter(s => s.category === 'quiet');
-      expect(quiet.length).toBeGreaterThan(0);
-      for (const surface of quiet) {
-        const reason = surface.disabledReason!.toLowerCase();
-        expect(reason).not.toContain('enable via feature flag');
-        expect(reason).not.toMatch(/enable via .* override/);
-      }
-    });
-  });
-});

package/tests/core/template-generator.test.ts

@@ -1,101 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { generateFromTemplate, PainPattern } from '../../src/core/principle-compiler/template-generator';
-
-describe('generateFromTemplate', () => {
-  it('should generate code for a single tool with path pattern', () => {
-    const patterns: PainPattern[] = [
-      { toolName: 'write', pathRegex: 'secrets/.*\\.env' },
-    ];
-
-    const result = generateFromTemplate('P_066', 'Writing to secrets directory', patterns);
-
-    expect(result).not.toBeNull();
-    expect(result).toContain("export const meta");
-    expect(result).toContain("export function evaluate(input)");
-    expect(result).toContain('name: "Auto_P_066"');
-    expect(result).toContain('ruleId: "R_P_066_auto"');
-    expect(result).toContain('sourcePrincipleId: "P_066"');
-    expect(result).toContain('coversCondition: "Writing to secrets directory"');
-    expect(result).toContain('input.action.toolName === "write"');
-    expect(result).toContain("secrets/.*\\\\.env");
-    expect(result).toContain("input.action.normalizedPath");
-    expect(result).toContain("decision: 'block'");
-    expect(result).toContain("matched: true");
-    expect(result).toContain("[P_066]");
-  });
-
-  it('should generate code for write tool with content pattern', () => {
-    const patterns: PainPattern[] = [
-      { toolName: 'write', contentRegex: 'BEGIN RSA PRIVATE KEY' },
-    ];
-
-    const result = generateFromTemplate('P_007', 'Writing private keys', patterns);
-
-    expect(result).not.toBeNull();
-    expect(result).toContain('input.action.toolName === "write"');
-    expect(result).toContain("BEGIN RSA PRIVATE KEY");
-    expect(result).toContain("paramsSummary.content");
-  });
-
-  it('should generate code for multiple tool patterns', () => {
-    const patterns: PainPattern[] = [
-      { toolName: 'bash', commandRegex: 'rm\\s+-rf\\s+/' },
-      { toolName: 'write', pathRegex: 'secrets/', contentRegex: 'password' },
-    ];
-
-    const result = generateFromTemplate('P_010', 'Destructive operations', patterns);
-
-    expect(result).not.toBeNull();
-    expect(result).toContain('input.action.toolName === "bash"');
-    expect(result).toContain("rm\\\\s+-rf\\\\s+/");
-    expect(result).toContain("paramsSummary.command");
-    expect(result).toContain('input.action.toolName === "write"');
-    expect(result).toContain("secrets/");
-    expect(result).toContain("password");
-  });
-
-  it('should return null when patterns array is empty', () => {
-    const result = generateFromTemplate('P_066', 'some condition', []);
-    expect(result).toBeNull();
-  });
-
-  it('should not contain forbidden patterns (require, import, fetch)', () => {
-    const patterns: PainPattern[] = [
-      { toolName: 'bash', commandRegex: 'dangerous' },
-    ];
-
-    const result = generateFromTemplate('P_099', 'Dangerous commands', patterns);
-
-    expect(result).not.toBeNull();
-    expect(result).not.toContain('require(');
-    expect(result).not.toContain('import ');
-    expect(result).not.toContain('fetch(');
-  });
-
-  it('should have proper structure with meta and evaluate function', () => {
-    const patterns: PainPattern[] = [
-      { toolName: 'edit', pathRegex: '\\.json$', contentRegex: 'admin.*true' },
-    ];
-
-    const result = generateFromTemplate('P_050', 'Modifying admin config', patterns);
-
-    expect(result).not.toBeNull();
-
-    // Check meta structure
-    expect(result).toMatch(/export const meta = \{/);
-    expect(result).toMatch(/name: "Auto_P_050"/);
-    expect(result).toMatch(/version: '1\.0\.0'/);
-    expect(result).toMatch(/ruleId: "R_P_050_auto"/);
-    expect(result).toMatch(/sourcePrincipleId: "P_050"/);
-    expect(result).toMatch(/compiledAt: "\d{4}-\d{2}-\d{2}T/);
-
-    // Check evaluate function structure
-    expect(result).toMatch(/export function evaluate\(input\)/);
-    expect(result).toMatch(/decision: 'block'/);
-    expect(result).toMatch(/matched: true/);
-    expect(result).toMatch(/return \{ matched: false \}/);
-
-    // Check edit tool uses new_string fallback
-    expect(result).toContain("input.action.paramsSummary.content || input.action.paramsSummary.new_string");
-  });
-});