unbound-cli 1.16.21 → 1.16.23

package/test/policy-ai-assist.test.js

@@ -94,6 +94,20 @@ async function runCreate(argv) {
   await program.parseAsync(full);
 }
 
+// Answer every readline question (promptYesNo) with `answer`; records the
+// questions asked.
+function stubReadline(answer) {
+  const readline = require('readline');
+  const origCreate = readline.createInterface;
+  const questions = [];
+  readline.createInterface = () => ({
+    on() {},
+    question(q, cb) { questions.push(q); cb(answer); },
+    close() {},
+  });
+  return { questions, restore: () => { readline.createInterface = origCreate; } };
+}
+
 beforeEach(() => {
   process.exitCode = 0;
 });
@@ -470,6 +484,112 @@ test('happy path: builds policy body and POSTs to /command-policies/', async ()
   }
 });
 
+// --- Multi-condition replies (form_updates.conditions) ------------------------
+// The assist endpoint returns every AND condition in `conditions`; selected_field
+// and field_value only mirror conditions[0], which need not be the environment.
+
+const TERRAFORM_PROD_REPLY = {
+  success: true,
+  form_updates: {
+    command_family: 'cloud_destroy',
+    selected_field: 'provider',
+    field_value: '*terraform*',
+    conditions: [
+      { field: 'provider', value: '*terraform*' },
+      { field: 'environment', value: '*prod*' },
+    ],
+    action: 'block',
+    name: 'Block terraform destroy in production',
+  },
+  explanation: 'terraform destroy, production only',
+};
+
+test('conditions: every AND condition reaches the create body and the preview', async () => {
+  const h = buildHarness({ assistResponse: TERRAFORM_PROD_REPLY });
+  try {
+    await runCreate([
+      '--prompt', 'block terraform destroy in production',
+      '--custom-message', 'Not in prod.', '--yes',
+    ]);
+    const createCall = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+    assert.ok(createCall, 'create POST should have fired');
+    assert.deepEqual(createCall.body.config, { provider: '*terraform*', environment: '*prod*' });
+    const out = h.captured.stdout.join('\n');
+    const preview = out.slice(0, out.indexOf('AI assist explanation'));
+    for (const text of ['provider', '*terraform*', 'environment', '*prod*']) {
+      assert.ok(preview.includes(text), `preview missing ${text}: ${preview}`);
+    }
+    const andIdx = preview.indexOf('all must match (AND)');
+    assert.ok(andIdx !== -1 && andIdx < preview.indexOf('provider'), `AND line must precede the conditions: ${preview}`);
+    assert.deepEqual(h.captured.warn, [], 'environment is applied, so no environment warning');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+test('conditions: an empty conditions list falls back to selected_field / field_value', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'git', selected_field: 'command', field_value: 'git push*',
+        conditions: [], action: 'AUDIT', name: 'Audit pushes',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit git pushes', '--yes']);
+    const createCall = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+    assert.ok(createCall, 'create POST should have fired');
+    assert.deepEqual(createCall.body.config, { command: 'git push*' });
+  } finally {
+    h.restoreLog();
+  }
+});
+
+for (const [source, conditions] of [['conditions', [{ field: 'command', value: ' git push* ' }]], ['selected_field', undefined]]) {
+  test(`conditions: values from ${source} are trimmed, as the dashboard does`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'git', selected_field: 'command', field_value: ' git push* ',
+          conditions, action: 'AUDIT', name: 'Audit pushes',
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', 'audit git pushes', '--yes']);
+      const createCall = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(createCall, 'create POST should have fired');
+      assert.deepEqual(createCall.body.config, { command: 'git push*' });
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+// --field / --config stay mutually exclusive with --prompt: they never merge
+// into, or override, the AI's conditions.
+for (const [flag, value] of [['--field', 'environment=*staging*'], ['--config', '{"environment":"*staging*"}']]) {
+  test(`conditions: --prompt + ${flag} is still rejected before the assist call`, async () => {
+    const h = buildHarness({ assistResponse: TERRAFORM_PROD_REPLY });
+    try {
+      await runCreate(['--prompt', 'block terraform destroy in production', flag, value, '--yes']);
+      assert.equal(process.exitCode, 1);
+      assert.ok(
+        h.captured.error.includes('Pass --prompt for AI-assist or the field flags for explicit creation, not both.'),
+        `expected mutex error, got: ${JSON.stringify(h.captured.error)}`
+      );
+      assert.equal(h.calls.posts.length, 0, 'neither assist nor create should fire');
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
 // --- (b.1) Greptile follow-up regressions -------------------------------------
 
 test('AI returns BLOCK without --custom-message → exit 2 with guard message', async () => {
@@ -758,7 +878,7 @@ test('routing: assist succeeds but create POST 401 → exit 3 + admin-required w
 
 // --- (d) --yes + out-of-scope keyword: warns AND proceeds ---------------------
 
-test('out-of-scope: --yes + "staging" warns but still calls the assist endpoint', async () => {
+test('out-of-scope: --yes + "weekend" warns but still calls the assist endpoint', async () => {
   const h = buildHarness({
     assistResponse: {
       success: true,
@@ -770,10 +890,14 @@ test('out-of-scope: --yes + "staging" warns but still calls the assist endpoint'
     },
   });
   try {
-    await runCreate(['--prompt', 'block staging deploys', '--yes']);
+    await runCreate(['--prompt', 'block git pushes on weekends', '--yes']);
     assert.ok(
-      h.captured.warn.some((m) => m.includes('`staging`')),
-      `expected staging warning, got: ${JSON.stringify(h.captured.warn)}`
+      h.captured.warn.some((m) => m.includes('`weekend`')),
+      `expected weekend warning, got: ${JSON.stringify(h.captured.warn)}`
+    );
+    assert.ok(
+      !h.captured.warn.some((m) => m.includes('environment')),
+      `terminal warning must not claim environment is out of scope, got: ${JSON.stringify(h.captured.warn)}`
     );
     assert.ok(
       h.calls.posts.some((c) => c.path === '/api/v1/command-policies/assist/'),
@@ -784,6 +908,627 @@ test('out-of-scope: --yes + "staging" warns but still calls the assist endpoint'
   }
 });
 
+test('out-of-scope: without --yes, "except" asks to continue; "n" aborts before the assist call', async () => {
+  const h = buildHarness();
+  const rl = stubReadline('n');
+  try {
+    await runCreate(['--prompt', 'block git pushes except on main']);
+    assert.equal(process.exitCode, 0);
+    assert.ok(
+      h.captured.warn.some((m) => m.includes('`except`')),
+      `expected except warning, got: ${JSON.stringify(h.captured.warn)}`
+    );
+    assert.equal(rl.questions.length, 1);
+    assert.ok(rl.questions[0].includes('Continue anyway?'), `got: ${JSON.stringify(rl.questions)}`);
+    assert.equal(h.calls.posts.length, 0, 'assist must not be called after the user aborts');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// Terminal policies can scope by environment (cloud_*, database_* and
+// build_operation carry an `environment` field), so environment words are in
+// scope here.
+for (const [word, prompt, environment] of [
+  ['production', 'audit aws deletes in production', '*prod*'],
+  ['prod', 'block terraform destroy against prod', '*prod*'],
+  ['staging', 'audit database drops in staging', '*stg*'],
+]) {
+  test(`in-scope: "${word}" in a terminal prompt neither warns nor asks to continue`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'cloud_destroy', selected_field: 'environment',
+          field_value: environment, action: 'AUDIT', name: `Audit ${word} cloud deletes`,
+        },
+        explanation: 'ok',
+      },
+    });
+    const rl = stubReadline('y');
+    try {
+      await runCreate(['--prompt', prompt]);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+      assert.deepEqual(rl.questions, ['Create policy? [Y/n] '], 'only the create confirmation should be asked');
+      const assist = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/assist/');
+      assert.ok(assist, 'assist endpoint should be called');
+      assert.equal(assist.body.user_input, prompt);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should fire after confirmation');
+      assert.deepEqual(create.body.config, { environment });
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+// Only some families carry `environment`; when the resolved policy has none,
+// an environment named in the prompt was dropped. Warn and, interactively,
+// default the confirmation to No; never block --yes / --json.
+const GIT_PUSH_REPLY = {
+  success: true,
+  form_updates: {
+    command_family: 'git_action', selected_field: 'operation', field_value: 'push',
+    conditions: [{ field: 'operation', value: 'push' }],
+    action: 'block', name: 'Block git push',
+  },
+  explanation: 'ok',
+};
+
+for (const [mode, flags] of [['interactive', []], ['--yes', ['--yes']], ['--json', ['--json']]]) {
+  test(`environment (${mode}): an environment the resolved family cannot scope by warns; policy still created`, async () => {
+    const h = buildHarness({ assistResponse: GIT_PUSH_REPLY });
+    const rl = stubReadline('y');
+    try {
+      await runCreate(['--prompt', 'block git push to production', '--custom-message', 'No.', ...flags]);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        'Your prompt mentions `production`, but this git_action policy has no environment condition, so it applies in all environments.',
+      ]);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should still fire');
+      assert.deepEqual(create.body.config, { operation: 'push' });
+      assert.deepEqual(rl.questions, mode === 'interactive' ? ['Create policy anyway? [y/N] '] : []);
+      if (mode === '--json') {
+        assert.deepEqual(JSON.parse(h.captured.stdout.join('\n')), { id: 1, name: 'ok' }, 'stdout stays pure JSON');
+      }
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+test('environment (interactive): Enter on the warned confirmation aborts; no create POST', async () => {
+  const h = buildHarness({ assistResponse: GIT_PUSH_REPLY });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block git push to production', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(h.captured.warn.includes('Aborted.'), `expected Aborted., got: ${JSON.stringify(h.captured.warn)}`);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+test('environment: warns once for each prompt environment no condition applies', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'git_action', selected_field: 'operation', field_value: 'push',
+        conditions: [
+          { field: 'operation', value: 'push' },
+          { field: 'branch', value: '*dev*' },
+        ],
+        action: 'block', name: 'Block git push to dev',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate([
+      '--prompt', 'block git push to dev, staging and production; production especially',
+      '--custom-message', 'No.', '--yes',
+    ]);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `staging`, but this git_action policy has no environment condition, so it applies in all environments.',
+      'Your prompt mentions `production`, but this git_action policy has no environment condition, so it applies in all environments.',
+    ]);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+for (const [mode, flags] of [['--yes', ['--yes']], ['interactive', []]]) {
+  test(`environment (${mode}): an environment condition of qa warns that qa is not a recognised label`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+          conditions: [
+            { field: 'provider', value: '*terraform*' },
+            { field: 'environment', value: '*QA*' },
+          ],
+          action: 'audit', name: 'Audit terraform destroy in qa',
+        },
+        explanation: 'ok',
+      },
+    });
+    const rl = stubReadline('y');
+    try {
+      await runCreate(['--prompt', 'audit terraform destroy in qa', ...flags]);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        '`qa` is not a recognised environment label (recognised: production, staging, dev, test, local, and their aliases prod, prd, live, mainnet, stg, stage, uat, preprod, preproduction, development, sandbox, sbx, testing, tst, localhost, 127.0.0.1), so this policy may not match.',
+      ]);
+      assert.deepEqual(rl.questions, mode === 'interactive' ? ['Create policy anyway? [y/N] '] : []);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should still fire');
+      assert.equal(create.body.config.environment, '*QA*');
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+// An environment condition for a different environment than the prompt names.
+test('environment (interactive): a prompt environment the environment condition does not cover warns; Enter aborts', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+        conditions: [
+          { field: 'provider', value: '*terraform*' },
+          { field: 'environment', value: '*prod*' },
+        ],
+        action: 'block', name: 'Block terraform destroy in production',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block terraform destroy in staging and production', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      "Your prompt mentions `staging`, but this policy's environment condition is `*prod*`, so it does not apply in staging.",
+      'Aborted.',
+    ]);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// An environment condition decides scope by itself, so another field holding
+// the prompt's word must not count as evidence that the scope was applied.
+test('environment: another condition holding the word does not excuse a mismatched environment', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'service', field_value: '*prod-api*',
+        conditions: [
+          { field: 'service', value: '*prod-api*' },
+          { field: 'environment', value: '*staging*' },
+        ],
+        action: 'block', name: 'Block prod-api destroy',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block cloud destroy in prod', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      "Your prompt mentions `prod`, but this policy's environment condition is `*staging*`, so it does not apply in prod.",
+      'Aborted.',
+    ]);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// `pre-prod` is pre-production, which maps to staging, never to production.
+test('environment: pre-prod given a production condition warns', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+        conditions: [
+          { field: 'provider', value: '*terraform*' },
+          { field: 'environment', value: '*prod*' },
+        ],
+        action: 'block', name: 'Block terraform destroy',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block terraform destroy in pre-prod', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      "Your prompt mentions `pre-prod`, but this policy's environment condition is `*prod*`, so it does not apply in pre-prod.",
+      'Aborted.',
+    ]);
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// A separated pre-production condition does not cover production, however it is
+// spelled: the `prod` inside it must not read as the environment asked for.
+for (const value of ['*pre-prod*', '*pre_prod*', '*pre production*', '*pre-production*']) {
+  test(`environment: a production prompt given ${value} warns`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+          conditions: [
+            { field: 'provider', value: '*terraform*' },
+            { field: 'environment', value },
+          ],
+          action: 'block', name: 'Block terraform destroy',
+        },
+        explanation: 'ok',
+      },
+    });
+    const rl = stubReadline('');
+    try {
+      await runCreate(['--prompt', 'block terraform destroy in production', '--custom-message', 'No.']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        `Your prompt mentions \`production\`, but this policy's environment condition is \`${value}\`, so it does not apply in production.`,
+        'Aborted.',
+      ]);
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+// A separator inside an alias survives, so these spellings are already scoped.
+for (const [prompt, field, value] of [
+  ['block terraform destroy in pre-prod', 'environment', '*preprod*'],
+  ['block terraform destroy in pre-prod', 'environment', '*pre-prod*'],
+  ['block terraform destroy in pre-prod', 'environment', '*staging*'],
+  ['block terraform destroy in staging', 'environment', '*pre-prod*'],
+  ['block db writes in local', 'host', '127.0.0.1'],
+  ['block db writes in localhost', 'host', '127.0.0.1'],
+  ['block terraform destroy in production', 'environment', '*'],
+]) {
+  test(`environment: "${prompt}" with ${field} ${value} does not warn`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'database_write', selected_field: field, field_value: value,
+          conditions: [{ field, value }],
+          action: 'block', name: 'Block it',
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', prompt, '--custom-message', 'No.', '--yes']);
+      assert.deepEqual(h.captured.warn, []);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+// A missed warning is the dangerous direction: both of these name an
+// environment the resolved policy does not scope to.
+for (const [label, prompt, conditions, word] of [
+  ['an underscore-separated name', 'block schema drops on prod_db', [{ field: 'command', value: 'drop table' }], 'prod'],
+  [
+    'a blank environment condition no other field can vouch for',
+    'block schema drops in production',
+    [{ field: 'environment', value: '' }, { field: 'command', value: '*prod*' }],
+    'production',
+  ],
+]) {
+  test(`environment: ${label} warns`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'database_write',
+          selected_field: conditions[0].field, field_value: conditions[0].value,
+          conditions,
+          action: 'block', name: 'Block it',
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', prompt, '--custom-message', 'No.', '--yes']);
+      assert.deepEqual(h.captured.warn, [
+        `Your prompt mentions \`${word}\`, but this database_write policy has no environment condition, so it applies in all environments.`,
+      ]);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+test('environment: a blank environment condition counts as none; warns', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+        conditions: [
+          { field: 'provider', value: '*terraform*' },
+          { field: 'environment', value: '  ' },
+        ],
+        action: 'audit', name: 'Audit terraform destroy',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit terraform destroy in production', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `production`, but this cloud_destroy policy has no environment condition, so it applies in all environments.',
+    ]);
+  } finally {
+    h.restoreLog();
+  }
+});
+
+// Condition values are matched by whole token, so a value that merely contains
+// the word ('product-catalog', 'device') does not count as applying it.
+test('environment (interactive): "prod" is not applied by a *product-catalog* path; warns and Enter aborts', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'write_file', selected_field: 'path', field_value: '*product-catalog*',
+        action: 'block', name: 'Block product-catalog writes',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block filesystem writes to product-catalog in prod', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `prod`, but this write_file policy has no environment condition, so it applies in all environments.',
+      'Aborted.',
+    ]);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+test('environment: "dev" is not applied by a *device* path; warns', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'write_file', selected_field: 'path', field_value: '*device*',
+        action: 'audit', name: 'Audit device writes',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit writes to device files in dev', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `dev`, but this write_file policy has no environment condition, so it applies in all environments.',
+    ]);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+test('environment: "prod" applied by a custom make release-prod pattern does not warn', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'custom', selected_field: 'command', field_value: 'make release-prod',
+        action: 'audit', name: 'Audit prod releases',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit make release-prod', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, []);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+test('environment: an environment word another condition matches on (namespace *prod*) does not warn', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'container', selected_field: 'operation', field_value: 'exec',
+        conditions: [
+          { field: 'operation', value: 'exec' },
+          { field: 'namespace', value: '*prod*' },
+        ],
+        action: 'audit', name: 'Audit kubectl exec in prod namespaces',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit kubectl exec in the prod namespace', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, []);
+    const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+    assert.ok(create, 'create POST should fire');
+    assert.deepEqual(create.body.config, { operation: 'exec', namespace: '*prod*' });
+  } finally {
+    h.restoreLog();
+  }
+});
+
+for (const [word, namespace] of [['production', '*prod*'], ['production', 'prod-*'], ['staging', '*stg*'], ['staging', '*stage*']]) {
+  test(`environment: "${word}" with a namespace alias of the same environment (${namespace}) does not warn`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'container', selected_field: 'operation', field_value: 'exec',
+          conditions: [
+            { field: 'operation', value: 'exec' },
+            { field: 'namespace', value: namespace },
+          ],
+          action: 'audit', name: `Audit kubectl exec in ${word} namespaces`,
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', `audit kubectl exec in ${word} namespaces`, '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should fire');
+      assert.deepEqual(create.body.config, { operation: 'exec', namespace });
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+// The condition-value side of this is covered above; this pins the prompt scan.
+test('environment: "product-catalog" in the prompt is not the word prod; does not warn', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'filesystem', selected_field: 'command', field_value: '*product-catalog*',
+        action: 'audit', name: 'Audit product-catalog writes',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit product-catalog writes', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, []);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+// Environment words that are also everyday English (test, live, stage, local,
+// ...) count only in an environment context; the others count anywhere.
+function auditPushReply(conditions) {
+  return {
+    success: true,
+    form_updates: {
+      command_family: 'git_action', selected_field: 'operation', field_value: 'push',
+      conditions, action: 'audit', name: 'Audit git push',
+    },
+    explanation: 'ok',
+  };
+}
+
+for (const [prompt, word] of [
+  ['audit git push to mainnet', 'mainnet'],
+  ['audit git push to the stg branch', 'stg'],
+  ['audit git push in the test environment', 'test'],
+  ['audit git push to live', 'live'],
+  ['audit git push in the local cluster', 'local'],
+]) {
+  test(`environment: "${prompt}" warns about ${word}`, async () => {
+    const h = buildHarness({ assistResponse: auditPushReply([{ field: 'operation', value: 'push' }]) });
+    try {
+      await runCreate(['--prompt', prompt, '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        `Your prompt mentions \`${word}\`, but this git_action policy has no environment condition, so it applies in all environments.`,
+      ]);
+      assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+for (const prompt of ['audit npm test runs', 'audit git stage files', 'audit live reload', 'audit scripts that run tests locally']) {
+  test(`environment: "${prompt}" does not warn (everyday word, no environment context)`, async () => {
+    const h = buildHarness({ assistResponse: auditPushReply([{ field: 'operation', value: 'push' }]) });
+    try {
+      await runCreate(['--prompt', prompt, '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+for (const branch of ['*tst*', 'test-*']) {
+  test(`environment: "in the test environment" applied by branch ${branch} does not warn`, async () => {
+    const h = buildHarness({
+      assistResponse: auditPushReply([{ field: 'operation', value: 'push' }, { field: 'branch', value: branch }]),
+    });
+    try {
+      await runCreate(['--prompt', 'audit git push in the test environment', '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+test('environment (interactive): "in the test environment" warns and Enter aborts', async () => {
+  const h = buildHarness({ assistResponse: auditPushReply([{ field: 'operation', value: 'push' }]) });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'audit git push in the test environment']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
 // --- Preview rendering (Acceptance #6 and #7) ---------------------------------
 
 test('--yes prints the preview AND skips confirmation AND issues create POST', async () => {
@@ -807,6 +1552,7 @@ test('--yes prints the preview AND skips confirmation AND issues create POST', a
     assert.ok(out.includes('Audit pushes'), `name row missing: ${out}`);
     assert.ok(out.includes('TERMINAL_COMMAND'), `type row missing: ${out}`);
     assert.ok(out.includes('git push*'), `pattern row missing: ${out}`);
+    assert.ok(!out.includes('all must match'), `single condition needs no AND line: ${out}`);
     assert.ok(out.includes('AUDIT'), `action row missing: ${out}`);
     assert.ok(out.includes('AI assist explanation'), `explanation line missing: ${out}`);
     assert.ok(out.includes('audit git activity'), `explanation body missing: ${out}`);
@@ -836,13 +1582,7 @@ test('without --yes: preview prints; "n" declines; no create POST fires', async
       explanation: 'ok',
     },
   });
-  // Stub readline.createInterface — the lib's confirmCreate uses it.
-  const readline = require('readline');
-  const origCreate = readline.createInterface;
-  readline.createInterface = () => ({
-    question(_q, cb) { cb('n'); },
-    close() {},
-  });
+  const rl = stubReadline('n');
   try {
     await runCreate(['--prompt', 'audit git pushes']);
     // Preview header (stdout) must have printed BEFORE the prompt. And the
@@ -855,7 +1595,7 @@ test('without --yes: preview prints; "n" declines; no create POST fires', async
       'no create POST should fire when user declines'
     );
   } finally {
-    readline.createInterface = origCreate;
+    rl.restore();
     h.restoreLog();
   }
 });