whale-code 6.5.10 → 6.6.0

package/dist/cli/services/tools/__tests__/search-tools.test.js

@@ -1,227 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-// ============================================================================
-// Mocks
-// ============================================================================
-
-vi.mock("fs", () => ({
-  existsSync: vi.fn(path => {
-    if (path === "/nonexistent") return false;
-    return true;
-  })
-}));
-vi.mock("child_process", () => ({
-  execSync: vi.fn(cmd => {
-    // Simulate find results for globSearch fallback
-    if (cmd.includes("find") && cmd.includes("-name '*.ts'")) {
-      return "/project/src/index.ts\n/project/src/utils.ts\n";
-    }
-    if (cmd.includes("find") && cmd.includes("-name '*.{ts,tsx}'")) {
-      return ""; // brace expansion handled differently
-    }
-    if (cmd.includes("find") && cmd.includes("No files found")) {
-      return "";
-    }
-    // Simulate grep results
-    if (cmd.includes("grep") && cmd.includes("-l")) {
-      return "/project/src/index.ts\n/project/src/utils.ts\n";
-    }
-    if (cmd.includes("grep") && cmd.includes("-c")) {
-      return "/project/src/index.ts:5\n/project/src/utils.ts:0\n";
-    }
-    if (cmd.includes("grep") && cmd.includes("-n")) {
-      return "/project/src/index.ts:10:  const x = 1;\n/project/src/index.ts:20:  const y = 2;\n";
-    }
-    if (cmd.includes("grep")) {
-      return "/project/src/index.ts\n";
-    }
-    return "";
-  })
-}));
-const mockRgAvailable = vi.fn(() => false);
-const mockRgGlob = vi.fn(() => null);
-const mockRgGrep = vi.fn(() => null);
-vi.mock("../../ripgrep.js", () => ({
-  isRgAvailable: () => mockRgAvailable(),
-  rgGlob: opts => mockRgGlob(opts),
-  rgGrep: opts => mockRgGrep(opts)
-}));
-import { globSearch, grepSearch } from "../search-tools.js";
-import { execSync } from "child_process";
-beforeEach(() => {
-  vi.clearAllMocks();
-  mockRgAvailable.mockReturnValue(false);
-  mockRgGlob.mockReturnValue(null);
-  mockRgGrep.mockReturnValue(null);
-});
-
-// ============================================================================
-// globSearch
-// ============================================================================
-
-describe("globSearch", () => {
-  it("returns error for nonexistent directory", () => {
-    const result = globSearch({
-      pattern: "*.ts",
-      path: "/nonexistent"
-    });
-    expect(result.success).toBe(false);
-    expect(result.output).toContain("Directory not found");
-  });
-  it("uses ripgrep when available", () => {
-    mockRgAvailable.mockReturnValue(true);
-    mockRgGlob.mockReturnValue("/project/src/index.ts\n/project/src/utils.ts");
-    const result = globSearch({
-      pattern: "*.ts",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toContain("2 files");
-    expect(mockRgGlob).toHaveBeenCalledWith(expect.objectContaining({
-      pattern: "*.ts",
-      path: "/project",
-      headLimit: 200
-    }));
-  });
-  it("returns 'No files found' when rg returns null", () => {
-    mockRgAvailable.mockReturnValue(true);
-    mockRgGlob.mockReturnValue(null);
-    const result = globSearch({
-      pattern: "*.xyz",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toBe("No files found");
-  });
-  it("falls back to find when rg is unavailable", () => {
-    mockRgAvailable.mockReturnValue(false);
-    const result = globSearch({
-      pattern: "*.ts",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toContain("files");
-    expect(execSync).toHaveBeenCalled();
-  });
-  it("falls back to find when rg throws", () => {
-    mockRgAvailable.mockReturnValue(true);
-    mockRgGlob.mockImplementation(() => {
-      throw new Error("rg failed");
-    });
-    const result = globSearch({
-      pattern: "*.ts",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    // Should have fallen through to find
-    expect(execSync).toHaveBeenCalled();
-  });
-  it("uses cwd as default path", () => {
-    mockRgAvailable.mockReturnValue(false);
-    const result = globSearch({
-      pattern: "*.ts"
-    });
-    expect(result.success).toBe(true);
-  });
-  it("extracts directory part from pattern with slashes", () => {
-    mockRgAvailable.mockReturnValue(false);
-    globSearch({
-      pattern: "src/**/*.ts",
-      path: "/project"
-    });
-    // Should have called execSync with a find command
-    expect(execSync).toHaveBeenCalled();
-    const cmd = vi.mocked(execSync).mock.calls[0][0];
-    expect(cmd).toContain("find");
-  });
-  it("handles brace expansion patterns in fallback mode", () => {
-    mockRgAvailable.mockReturnValue(false);
-    vi.mocked(execSync).mockReturnValueOnce("/project/a.ts\n/project/b.tsx\n");
-    const result = globSearch({
-      pattern: "*.{ts,tsx}",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    // The find command should have OR conditions for brace expansion
-    const cmd = vi.mocked(execSync).mock.calls[0][0];
-    expect(cmd).toContain("-o");
-  });
-  it("returns no files for empty find result", () => {
-    mockRgAvailable.mockReturnValue(false);
-    vi.mocked(execSync).mockReturnValueOnce("");
-    const result = globSearch({
-      pattern: "*.xyz",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toContain("No files found");
-  });
-});
-
-// ============================================================================
-// grepSearch
-// ============================================================================
-
-describe("grepSearch", () => {
-  it("uses ripgrep when available", () => {
-    mockRgAvailable.mockReturnValue(true);
-    mockRgGrep.mockReturnValue("/project/src/index.ts\n/project/src/utils.ts");
-    const result = grepSearch({
-      pattern: "import",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toContain("index.ts");
-    expect(mockRgGrep).toHaveBeenCalledWith(expect.objectContaining({
-      pattern: "import",
-      path: "/project"
-    }));
-  });
-  it("returns 'No matches found' when rg returns null", () => {
-    mockRgAvailable.mockReturnValue(true);
-    mockRgGrep.mockReturnValue(null);
-    const result = grepSearch({
-      pattern: "nonexistent_symbol",
-      path: "/project"
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toBe("No matches found");
-  });
-  it("filters zero-count entries in count mode", () => {
-    mockRgAvailable.mockReturnValue(true);
-    mockRgGrep.mockReturnValue("/project/a.ts:5\n/project/b.ts:0\n/project/c.ts:3");
-    const result = grepSearch({
-      pattern: "test",
-      path: "/project",
-      output_mode: "count"
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toContain("/project/a.ts:5");
-    expect(result.output).toContain("/project/c.ts:3");
-    expect(result.output).not.toContain(":0");
-  });
-  it("applies offset to results", () => {
-    mockRgAvailable.mockReturnValue(true);
-    mockRgGrep.mockReturnValue("line1\nline2\nline3\nline4\nline5");
-    const result = grepSearch({
-      pattern: "test",
-      path: "/project",
-      offset: 2
-    });
-    expect(result.success).toBe(true);
-    expect(result.output).toBe("line3\nline4\nline5");
-  });
-  it("falls back to system grep when rg unavailable", () => {
-    mockRgAvailable.mockReturnValue(false);
-    const result = grepSearch({
-      pattern: "import",
-      path: "/project",
-      output_mode: "files_with_matches"
-    });
-    expect(result.success).toBe(true);
-    expect(execSync).toHaveBeenCalled();
-    const cmd = vi.mocked(execSync).mock.calls[0][0];
-    expect(cmd).toContain("grep");
-    expect(cmd).toContain("-l");
-  });
-});

package/dist/cli/services/tools/__tests__/shell-exec-allowed-core.test.js

@@ -1,163 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-
-// Mock child_process.spawn so commands are NOT actually executed.
-vi.mock("child_process", async () => {
-  const actual = await vi.importActual("child_process");
-  return {
-    ...actual,
-    spawn: vi.fn(cmd => {
-      const {
-        EventEmitter
-      } = require("events");
-      const {
-        Readable
-      } = require("stream");
-      const child = new EventEmitter();
-      const echoMatch = typeof cmd === "string" ? cmd.match(/^echo\s+(.*)/) : null;
-      let pushed = false;
-      child.stdout = new Readable({
-        read() {
-          if (echoMatch && !pushed) {
-            pushed = true;
-            this.push(echoMatch[1] + "\n");
-          }
-          this.push(null);
-        }
-      });
-      child.stderr = new Readable({
-        read() {
-          this.push(null);
-        }
-      });
-      child.stdin = {
-        write: vi.fn(),
-        end: vi.fn()
-      };
-      child.pid = 99999;
-      child.kill = vi.fn();
-      setTimeout(() => child.emit("exit", 0), 5);
-      return child;
-    })
-  };
-});
-vi.mock("../../sandbox.js", () => ({
-  sandboxCommand: vi.fn((cmd, _cwd) => ({
-    wrapped: cmd,
-    profilePath: null
-  })),
-  cleanupSandbox: vi.fn()
-}));
-vi.mock("../../background-processes.js", () => ({
-  spawnBackground: vi.fn(async () => ({
-    status: "running",
-    message: "Process started"
-  })),
-  readProcessOutput: vi.fn(_id => ({
-    status: "completed",
-    exitCode: 0,
-    newOutput: "output data",
-    newErrors: ""
-  })),
-  killProcess: vi.fn(() => ({
-    success: true,
-    message: "Process killed"
-  })),
-  listProcesses: vi.fn(() => [])
-}));
-vi.mock("../../agent-events.js", () => ({
-  getGlobalEmitter: vi.fn(() => ({
-    emitToolOutput: vi.fn()
-  }))
-}));
-vi.mock("../../debug-log.js", () => ({
-  debugLog: vi.fn()
-}));
-import { runCommand } from "../shell-exec.js";
-async function isAllowed(command) {
-  const result = await runCommand({
-    command
-  });
-  return !result.output.includes("blocked for safety");
-}
-
-// ============================================================================
-// ALLOWED — file ops, chmod/chown, npm/Node, Python, git
-// ============================================================================
-
-describe("ALLOWED — core developer commands", () => {
-  describe("rm on specific paths (NOT root/home)", () => {
-    it("rm -rf node_modules", async () => expect(await isAllowed("rm -rf node_modules")).toBe(true));
-    it("rm -rf ./dist", async () => expect(await isAllowed("rm -rf ./dist")).toBe(true));
-    it("rm -rf /tmp/build", async () => expect(await isAllowed("rm -rf /tmp/build")).toBe(true));
-    it("rm -rf /Users/whale/project/node_modules", async () => expect(await isAllowed("rm -rf /Users/whale/project/node_modules")).toBe(true));
-    it("rm -rf ~/project/dist", async () => expect(await isAllowed("rm -rf ~/project/dist")).toBe(true));
-    it("rm -rf ~/Downloads/old-stuff", async () => expect(await isAllowed("rm -rf ~/Downloads/old-stuff")).toBe(true));
-    it("rm -rf ~/.npm-cache", async () => expect(await isAllowed("rm -rf ~/.npm-cache")).toBe(true));
-    it("rm -rf /var/tmp/cache", async () => expect(await isAllowed("rm -rf /var/tmp/cache")).toBe(true));
-    it("rm -f /tmp/lockfile", async () => expect(await isAllowed("rm -f /tmp/lockfile")).toBe(true));
-    it("rm file.txt", async () => expect(await isAllowed("rm file.txt")).toBe(true));
-    it("rm -r build/", async () => expect(await isAllowed("rm -r build/")).toBe(true));
-    it("rm -rf .next .turbo dist", async () => expect(await isAllowed("rm -rf .next .turbo dist")).toBe(true));
-  });
-  describe("chmod and chown", () => {
-    it("chmod 755 ./scripts/deploy.sh", async () => expect(await isAllowed("chmod 755 ./scripts/deploy.sh")).toBe(true));
-    it("chmod +x ./run.sh", async () => expect(await isAllowed("chmod +x ./run.sh")).toBe(true));
-    it("chmod -R 755 ./scripts", async () => expect(await isAllowed("chmod -R 755 ./scripts")).toBe(true));
-    it("chmod 777 /tmp/test", async () => expect(await isAllowed("chmod 777 /tmp/test")).toBe(true));
-    it("chmod -R 777 /tmp/test", async () => expect(await isAllowed("chmod -R 777 /tmp/test")).toBe(true));
-    it("chown -R $(whoami) ~/.npm", async () => expect(await isAllowed("chown -R $(whoami) ~/.npm")).toBe(true));
-    it("chown -R whale /Users/whale/.npm-cache", async () => expect(await isAllowed("chown -R whale /Users/whale/.npm-cache")).toBe(true));
-    it("chown -R whale:staff ./build", async () => expect(await isAllowed("chown -R whale:staff ./build")).toBe(true));
-    it("sudo chown -R $(whoami) ~/.npm", async () => expect(await isAllowed("sudo chown -R $(whoami) ~/.npm")).toBe(true));
-  });
-  describe("npm and Node.js", () => {
-    it("npm install", async () => expect(await isAllowed("npm install")).toBe(true));
-    it("npm install --force", async () => expect(await isAllowed("npm install --force")).toBe(true));
-    it("npm ci", async () => expect(await isAllowed("npm ci")).toBe(true));
-    it("npm run build", async () => expect(await isAllowed("npm run build")).toBe(true));
-    it("npm run dev", async () => expect(await isAllowed("npm run dev")).toBe(true));
-    it("npm test", async () => expect(await isAllowed("npm test")).toBe(true));
-    it("npm cache clean --force", async () => expect(await isAllowed("npm cache clean --force")).toBe(true));
-    it("npm rebuild", async () => expect(await isAllowed("npm rebuild")).toBe(true));
-    it("npm link", async () => expect(await isAllowed("npm link")).toBe(true));
-    it("npm pack", async () => expect(await isAllowed("npm pack")).toBe(true));
-    it("npm publish", async () => expect(await isAllowed("npm publish")).toBe(true));
-    it("npx create-react-app my-app", async () => expect(await isAllowed("npx create-react-app my-app")).toBe(true));
-    it("npx tsc --noEmit", async () => expect(await isAllowed("npx tsc --noEmit")).toBe(true));
-    it("node server.js", async () => expect(await isAllowed("node server.js")).toBe(true));
-    it("node -e 'console.log(1)'", async () => expect(await isAllowed("node -e 'console.log(1)'")).toBe(true));
-    it("node -e with require", async () => expect(await isAllowed("node -e 'require(\"fs\").readFileSync(\"x\")'")).toBe(true));
-    it("bun install", async () => expect(await isAllowed("bun install")).toBe(true));
-    it("bun run dev", async () => expect(await isAllowed("bun run dev")).toBe(true));
-    it("pnpm install", async () => expect(await isAllowed("pnpm install")).toBe(true));
-    it("yarn install", async () => expect(await isAllowed("yarn install")).toBe(true));
-    it("deno run script.ts", async () => expect(await isAllowed("deno run script.ts")).toBe(true));
-  });
-  describe("Python", () => {
-    it("pip install package", async () => expect(await isAllowed("pip install flask")).toBe(true));
-    it("pip install -r requirements.txt", async () => expect(await isAllowed("pip install -r requirements.txt")).toBe(true));
-    it("pip install --force-reinstall", async () => expect(await isAllowed("pip install --force-reinstall package")).toBe(true));
-    it("python script.py", async () => expect(await isAllowed("python script.py")).toBe(true));
-    it("python -m venv .venv", async () => expect(await isAllowed("python -m venv .venv")).toBe(true));
-    it("python -e 'print(1)'", async () => expect(await isAllowed("python -e 'print(1)'")).toBe(true));
-    it("python -c 'import os; print(os.getcwd())'", async () => expect(await isAllowed("python -c 'import os; print(os.getcwd())'")).toBe(true));
-    it("pytest", async () => expect(await isAllowed("pytest -xvs tests/")).toBe(true));
-    it("uv pip install", async () => expect(await isAllowed("uv pip install flask")).toBe(true));
-  });
-  describe("git", () => {
-    it("git status", async () => expect(await isAllowed("git status")).toBe(true));
-    it("git add .", async () => expect(await isAllowed("git add .")).toBe(true));
-    it("git commit -m 'msg'", async () => expect(await isAllowed("git commit -m 'test'")).toBe(true));
-    it("git push", async () => expect(await isAllowed("git push")).toBe(true));
-    it("git push --force", async () => expect(await isAllowed("git push --force")).toBe(true));
-    it("git pull", async () => expect(await isAllowed("git pull")).toBe(true));
-    it("git clone url", async () => expect(await isAllowed("git clone https://github.com/user/repo.git")).toBe(true));
-    it("git checkout -b new-branch", async () => expect(await isAllowed("git checkout -b new-branch")).toBe(true));
-    it("git reset --hard HEAD~1", async () => expect(await isAllowed("git reset --hard HEAD~1")).toBe(true));
-    it("git clean -fdx", async () => expect(await isAllowed("git clean -fdx")).toBe(true));
-    it("git stash", async () => expect(await isAllowed("git stash")).toBe(true));
-    it("git rebase main", async () => expect(await isAllowed("git rebase main")).toBe(true));
-    it("git log --oneline -20", async () => expect(await isAllowed("git log --oneline -20")).toBe(true));
-    it("git diff HEAD~3", async () => expect(await isAllowed("git diff HEAD~3")).toBe(true));
-  });
-});

package/dist/cli/services/tools/__tests__/shell-exec-allowed-extended.test.js

@@ -1,220 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-
-// Mock child_process.spawn so commands are NOT actually executed.
-vi.mock("child_process", async () => {
-  const actual = await vi.importActual("child_process");
-  return {
-    ...actual,
-    spawn: vi.fn(cmd => {
-      const {
-        EventEmitter
-      } = require("events");
-      const {
-        Readable
-      } = require("stream");
-      const child = new EventEmitter();
-      const echoMatch = typeof cmd === "string" ? cmd.match(/^echo\s+(.*)/) : null;
-      let pushed = false;
-      child.stdout = new Readable({
-        read() {
-          if (echoMatch && !pushed) {
-            pushed = true;
-            this.push(echoMatch[1] + "\n");
-          }
-          this.push(null);
-        }
-      });
-      child.stderr = new Readable({
-        read() {
-          this.push(null);
-        }
-      });
-      child.stdin = {
-        write: vi.fn(),
-        end: vi.fn()
-      };
-      child.pid = 99999;
-      child.kill = vi.fn();
-      setTimeout(() => child.emit("exit", 0), 5);
-      return child;
-    })
-  };
-});
-vi.mock("../../sandbox.js", () => ({
-  sandboxCommand: vi.fn((cmd, _cwd) => ({
-    wrapped: cmd,
-    profilePath: null
-  })),
-  cleanupSandbox: vi.fn()
-}));
-vi.mock("../../background-processes.js", () => ({
-  spawnBackground: vi.fn(async () => ({
-    status: "running",
-    message: "Process started"
-  })),
-  readProcessOutput: vi.fn(_id => ({
-    status: "completed",
-    exitCode: 0,
-    newOutput: "output data",
-    newErrors: ""
-  })),
-  killProcess: vi.fn(() => ({
-    success: true,
-    message: "Process killed"
-  })),
-  listProcesses: vi.fn(() => [])
-}));
-vi.mock("../../agent-events.js", () => ({
-  getGlobalEmitter: vi.fn(() => ({
-    emitToolOutput: vi.fn()
-  }))
-}));
-vi.mock("../../debug-log.js", () => ({
-  debugLog: vi.fn()
-}));
-import { runCommand } from "../shell-exec.js";
-async function isAllowed(command) {
-  const result = await runCommand({
-    command
-  });
-  return !result.output.includes("blocked for safety");
-}
-
-// ============================================================================
-// ALLOWED — Docker, other languages, network, system, macOS, dd, piped,
-//           database, cloud/devops, and regression checks
-// ============================================================================
-
-describe("ALLOWED — extended developer commands", () => {
-  describe("Docker", () => {
-    it("docker build", async () => expect(await isAllowed("docker build -t myapp .")).toBe(true));
-    it("docker run", async () => expect(await isAllowed("docker run -it ubuntu bash")).toBe(true));
-    it("docker compose up", async () => expect(await isAllowed("docker compose up -d")).toBe(true));
-    it("docker system prune -af", async () => expect(await isAllowed("docker system prune -af")).toBe(true));
-    it("docker kill container", async () => expect(await isAllowed("docker kill my-container")).toBe(true));
-    it("docker rm container", async () => expect(await isAllowed("docker rm my-container")).toBe(true));
-    it("docker rmi image", async () => expect(await isAllowed("docker rmi my-image:latest")).toBe(true));
-    it("docker exec", async () => expect(await isAllowed("docker exec -it container bash")).toBe(true));
-  });
-  describe("other languages and build tools", () => {
-    it("cargo build", async () => expect(await isAllowed("cargo build --release")).toBe(true));
-    it("cargo clean", async () => expect(await isAllowed("cargo clean")).toBe(true));
-    it("cargo test", async () => expect(await isAllowed("cargo test")).toBe(true));
-    it("go build", async () => expect(await isAllowed("go build ./...")).toBe(true));
-    it("go test", async () => expect(await isAllowed("go test ./...")).toBe(true));
-    it("go mod tidy", async () => expect(await isAllowed("go mod tidy")).toBe(true));
-    it("javac Main.java", async () => expect(await isAllowed("javac Main.java")).toBe(true));
-    it("mvn clean install", async () => expect(await isAllowed("mvn clean install")).toBe(true));
-    it("gradle build", async () => expect(await isAllowed("gradle build")).toBe(true));
-    it("ruby script.rb", async () => expect(await isAllowed("ruby script.rb")).toBe(true));
-    it("gem install bundler", async () => expect(await isAllowed("gem install bundler")).toBe(true));
-    it("bundle install", async () => expect(await isAllowed("bundle install")).toBe(true));
-    it("make clean", async () => expect(await isAllowed("make clean")).toBe(true));
-    it("make -j8", async () => expect(await isAllowed("make -j8")).toBe(true));
-    it("cmake ..", async () => expect(await isAllowed("cmake ..")).toBe(true));
-    it("swift build", async () => expect(await isAllowed("swift build")).toBe(true));
-    it("swift test", async () => expect(await isAllowed("swift test")).toBe(true));
-  });
-  describe("network commands", () => {
-    it("curl URL", async () => expect(await isAllowed("curl https://api.example.com/data")).toBe(true));
-    it("curl POST", async () => expect(await isAllowed("curl -X POST -d '{\"key\":\"val\"}' https://api.com")).toBe(true));
-    it("curl | jq", async () => expect(await isAllowed("curl https://api.com | jq .")).toBe(true));
-    it("curl -o file", async () => expect(await isAllowed("curl -o output.json https://api.com/data")).toBe(true));
-    it("wget file", async () => expect(await isAllowed("wget https://example.com/file.tar.gz")).toBe(true));
-    it("wget -O file", async () => expect(await isAllowed("wget -O output.zip https://example.com/release.zip")).toBe(true));
-    it("curl | bash (install script)", async () => expect(await isAllowed("curl -fsSL https://bun.sh/install | bash")).toBe(true));
-    it("wget | bash", async () => expect(await isAllowed("wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash")).toBe(true));
-    it("ssh command", async () => expect(await isAllowed("ssh user@host 'uptime'")).toBe(true));
-    it("scp file", async () => expect(await isAllowed("scp ./file.txt user@host:/tmp/")).toBe(true));
-    it("rsync", async () => expect(await isAllowed("rsync -avz ./dist/ user@host:/var/www/")).toBe(true));
-  });
-  describe("system and dev tools", () => {
-    it("ls -la", async () => expect(await isAllowed("ls -la")).toBe(true));
-    it("cat file", async () => expect(await isAllowed("cat package.json")).toBe(true));
-    it("grep -r pattern", async () => expect(await isAllowed("grep -r 'TODO' src/")).toBe(true));
-    it("find . -name '*.ts'", async () => expect(await isAllowed("find . -name '*.ts'")).toBe(true));
-    it("find . -delete", async () => expect(await isAllowed("find . -name '*.pyc' -delete")).toBe(true));
-    it("tar czf", async () => expect(await isAllowed("tar czf archive.tar.gz ./dist")).toBe(true));
-    it("tar xzf", async () => expect(await isAllowed("tar xzf archive.tar.gz")).toBe(true));
-    it("unzip file", async () => expect(await isAllowed("unzip release.zip -d ./out")).toBe(true));
-    it("cp -r", async () => expect(await isAllowed("cp -r src/ backup/")).toBe(true));
-    it("mv file", async () => expect(await isAllowed("mv old.txt new.txt")).toBe(true));
-    it("mkdir -p", async () => expect(await isAllowed("mkdir -p src/components/ui")).toBe(true));
-    it("touch file", async () => expect(await isAllowed("touch .env.local")).toBe(true));
-    it("ln -s", async () => expect(await isAllowed("ln -s ../config.json ./config.json")).toBe(true));
-    it("wc -l", async () => expect(await isAllowed("wc -l src/**/*.ts")).toBe(true));
-    it("sort file", async () => expect(await isAllowed("sort -u names.txt")).toBe(true));
-    it("head / tail", async () => expect(await isAllowed("tail -100 /var/log/system.log")).toBe(true));
-    it("ps aux", async () => expect(await isAllowed("ps aux")).toBe(true));
-    it("kill process", async () => expect(await isAllowed("kill -9 12345")).toBe(true));
-    it("pkill process", async () => expect(await isAllowed("pkill -f 'node server'")).toBe(true));
-    it("lsof -i :3000", async () => expect(await isAllowed("lsof -i :3000")).toBe(true));
-    it("env", async () => expect(await isAllowed("env")).toBe(true));
-    it("which node", async () => expect(await isAllowed("which node")).toBe(true));
-    it("whoami", async () => expect(await isAllowed("whoami")).toBe(true));
-    it("uname -a", async () => expect(await isAllowed("uname -a")).toBe(true));
-    it("df -h", async () => expect(await isAllowed("df -h")).toBe(true));
-    it("du -sh .", async () => expect(await isAllowed("du -sh .")).toBe(true));
-    it("xargs", async () => expect(await isAllowed("find . -name '*.log' | xargs rm")).toBe(true));
-  });
-  describe("macOS / Homebrew", () => {
-    it("brew install", async () => expect(await isAllowed("brew install postgresql")).toBe(true));
-    it("brew upgrade", async () => expect(await isAllowed("brew upgrade")).toBe(true));
-    it("brew services start", async () => expect(await isAllowed("brew services start postgresql")).toBe(true));
-    it("xcode-select --install", async () => expect(await isAllowed("xcode-select --install")).toBe(true));
-    it("open .", async () => expect(await isAllowed("open .")).toBe(true));
-    it("pbcopy", async () => expect(await isAllowed("echo 'text' | pbcopy")).toBe(true));
-    it("defaults write", async () => expect(await isAllowed("defaults write com.apple.finder AppleShowAllFiles YES")).toBe(true));
-  });
-  describe("dd on regular files (NOT block devices)", () => {
-    it("dd to regular file", async () => expect(await isAllowed("dd if=/dev/urandom of=./random.bin bs=1024 count=1")).toBe(true));
-    it("dd between files", async () => expect(await isAllowed("dd if=input.bin of=output.bin")).toBe(true));
-    it("dd to /dev/null", async () => expect(await isAllowed("dd if=./bigfile of=/dev/null bs=1M")).toBe(true));
-    it("dd to /tmp", async () => expect(await isAllowed("dd if=/dev/zero of=/tmp/testfile bs=1M count=10")).toBe(true));
-  });
-  describe("piped and chained commands", () => {
-    it("pipe to grep", async () => expect(await isAllowed("cat file.txt | grep 'error'")).toBe(true));
-    it("pipe to wc", async () => expect(await isAllowed("find . -name '*.ts' | wc -l")).toBe(true));
-    it("pipe to sort | uniq", async () => expect(await isAllowed("cat log.txt | sort | uniq -c | sort -rn")).toBe(true));
-    it("&& chain", async () => expect(await isAllowed("npm install && npm run build && npm test")).toBe(true));
-    it("|| fallback", async () => expect(await isAllowed("which bun || npm install -g bun")).toBe(true));
-    it("subshell", async () => expect(await isAllowed("(cd /tmp && tar xzf archive.tar.gz)")).toBe(true));
-    it("command substitution", async () => expect(await isAllowed("echo $(node -e 'console.log(1+1)')")).toBe(true));
-    it("base64 encode", async () => expect(await isAllowed("echo 'hello' | base64")).toBe(true));
-    it("base64 decode to file", async () => expect(await isAllowed("base64 -d encoded.txt > output.bin")).toBe(true));
-    it("base64 decode pipe to cat", async () => expect(await isAllowed("echo 'aGVsbG8=' | base64 -d | cat")).toBe(true));
-  });
-  describe("database tools", () => {
-    it("psql", async () => expect(await isAllowed("psql -h localhost -U user dbname")).toBe(true));
-    it("mysql", async () => expect(await isAllowed("mysql -u root -p dbname")).toBe(true));
-    it("redis-cli", async () => expect(await isAllowed("redis-cli PING")).toBe(true));
-    it("mongosh", async () => expect(await isAllowed("mongosh --eval 'db.getCollectionNames()'")).toBe(true));
-    it("sqlite3", async () => expect(await isAllowed("sqlite3 test.db '.tables'")).toBe(true));
-  });
-  describe("cloud and devops", () => {
-    it("aws s3 ls", async () => expect(await isAllowed("aws s3 ls s3://my-bucket/")).toBe(true));
-    it("aws deploy", async () => expect(await isAllowed("aws ecs update-service --force-new-deployment")).toBe(true));
-    it("gcloud", async () => expect(await isAllowed("gcloud app deploy")).toBe(true));
-    it("terraform apply", async () => expect(await isAllowed("terraform apply -auto-approve")).toBe(true));
-    it("kubectl", async () => expect(await isAllowed("kubectl get pods -A")).toBe(true));
-    it("helm install", async () => expect(await isAllowed("helm install myrelease mychart/")).toBe(true));
-    it("flyctl deploy", async () => expect(await isAllowed("flyctl deploy")).toBe(true));
-    it("vercel deploy", async () => expect(await isAllowed("vercel --prod")).toBe(true));
-    it("gh pr create", async () => expect(await isAllowed("gh pr create --title 'fix' --body 'desc'")).toBe(true));
-    it("gh run view", async () => expect(await isAllowed("gh run view 12345")).toBe(true));
-  });
-  describe("previously blocked — now allowed (regression checks)", () => {
-    it("chown -R user ~/.npm", async () => expect(await isAllowed("chown -R whale ~/.npm")).toBe(true));
-    it("chown -R user ~/.npm-cache", async () => expect(await isAllowed("chown -R whale ~/.npm-cache")).toBe(true));
-    it("sudo chown -R $(whoami) /Users/whale/.npm-cache", async () => expect(await isAllowed("sudo chown -R $(whoami) /Users/whale/.npm-cache")).toBe(true));
-    it("chmod 777 /tmp/test", async () => expect(await isAllowed("chmod 777 /tmp/test")).toBe(true));
-    it("chmod -R 777 /tmp/test", async () => expect(await isAllowed("chmod -R 777 /tmp/test")).toBe(true));
-    it("rm -rf /tmp/build-cache", async () => expect(await isAllowed("rm -rf /tmp/build-cache")).toBe(true));
-    it("rm -rf /Users/whale/project/node_modules", async () => expect(await isAllowed("rm -rf /Users/whale/project/node_modules")).toBe(true));
-    it("rm -f /var/tmp/lockfile", async () => expect(await isAllowed("rm -f /var/tmp/lockfile")).toBe(true));
-    it("dd if=/dev/zero of=./testfile bs=1M count=1", async () => expect(await isAllowed("dd if=/dev/zero of=./testfile bs=1M count=1")).toBe(true));
-    it("curl install script | bash", async () => expect(await isAllowed("curl -fsSL https://bun.sh/install | bash")).toBe(true));
-    it("node -e with require", async () => expect(await isAllowed("node -e 'require(\"child_process\").execSync(\"ls\")'")).toBe(true));
-    it("python -e with os.system", async () => expect(await isAllowed("python -e 'import os; os.system(\"ls\")'")).toBe(true));
-  });
-});