whale-code 6.5.11 → 6.6.0

package/dist/cli/services/tools/__tests__/shell-exec-allowed.part2.test.js

@@ -1,215 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-
-// Mock child_process.spawn so commands are NOT actually executed.
-vi.mock("child_process", async () => {
-  const actual = await vi.importActual("child_process");
-  return {
-    ...actual,
-    spawn: vi.fn(cmd => {
-      const {
-        EventEmitter
-      } = require("events");
-      const {
-        Readable
-      } = require("stream");
-      const child = new EventEmitter();
-      const echoMatch = typeof cmd === "string" ? cmd.match(/^echo\s+(.*)/) : null;
-      let pushed = false;
-      child.stdout = new Readable({
-        read() {
-          if (echoMatch && !pushed) {
-            pushed = true;
-            this.push(echoMatch[1] + "\n");
-          }
-          this.push(null);
-        }
-      });
-      child.stderr = new Readable({
-        read() {
-          this.push(null);
-        }
-      });
-      child.stdin = {
-        write: vi.fn(),
-        end: vi.fn()
-      };
-      child.pid = 99999;
-      child.kill = vi.fn();
-      setTimeout(() => child.emit("exit", 0), 5);
-      return child;
-    })
-  };
-});
-vi.mock("../../sandbox.js", () => ({
-  sandboxCommand: vi.fn((cmd, _cwd) => ({
-    wrapped: cmd,
-    profilePath: null
-  })),
-  cleanupSandbox: vi.fn()
-}));
-vi.mock("../../background-processes.js", () => ({
-  spawnBackground: vi.fn(async () => ({
-    status: "running",
-    message: "Process started"
-  })),
-  readProcessOutput: vi.fn(_id => ({
-    status: "completed",
-    exitCode: 0,
-    newOutput: "output data",
-    newErrors: ""
-  })),
-  killProcess: vi.fn(() => ({
-    success: true,
-    message: "Process killed"
-  })),
-  listProcesses: vi.fn(() => [])
-}));
-vi.mock("../../agent-events.js", () => ({
-  getGlobalEmitter: vi.fn(() => ({
-    emitToolOutput: vi.fn()
-  }))
-}));
-vi.mock("../../debug-log.js", () => ({
-  debugLog: vi.fn()
-}));
-import { runCommand } from "../shell-exec.js";
-async function isAllowed(command) {
-  const result = await runCommand({
-    command
-  });
-  return !result.output.includes("blocked for safety");
-}
-
-// ============================================================================
-// ALLOWED — git, docker, languages, network, system, cloud, regression
-// ============================================================================
-
-describe("ALLOWED — git, docker, system, cloud", () => {
-  describe("git", () => {
-    it("git status", async () => expect(await isAllowed("git status")).toBe(true));
-    it("git add .", async () => expect(await isAllowed("git add .")).toBe(true));
-    it("git commit -m 'msg'", async () => expect(await isAllowed("git commit -m 'test'")).toBe(true));
-    it("git push", async () => expect(await isAllowed("git push")).toBe(true));
-    it("git push --force", async () => expect(await isAllowed("git push --force")).toBe(true));
-    it("git pull", async () => expect(await isAllowed("git pull")).toBe(true));
-    it("git clone url", async () => expect(await isAllowed("git clone https://github.com/user/repo.git")).toBe(true));
-    it("git checkout -b new-branch", async () => expect(await isAllowed("git checkout -b new-branch")).toBe(true));
-    it("git reset --hard HEAD~1", async () => expect(await isAllowed("git reset --hard HEAD~1")).toBe(true));
-    it("git clean -fdx", async () => expect(await isAllowed("git clean -fdx")).toBe(true));
-    it("git stash", async () => expect(await isAllowed("git stash")).toBe(true));
-    it("git rebase main", async () => expect(await isAllowed("git rebase main")).toBe(true));
-    it("git log --oneline -20", async () => expect(await isAllowed("git log --oneline -20")).toBe(true));
-    it("git diff HEAD~3", async () => expect(await isAllowed("git diff HEAD~3")).toBe(true));
-  });
-  describe("Docker", () => {
-    it("docker build", async () => expect(await isAllowed("docker build -t myapp .")).toBe(true));
-    it("docker run", async () => expect(await isAllowed("docker run -it ubuntu bash")).toBe(true));
-    it("docker compose up", async () => expect(await isAllowed("docker compose up -d")).toBe(true));
-    it("docker system prune -af", async () => expect(await isAllowed("docker system prune -af")).toBe(true));
-    it("docker kill container", async () => expect(await isAllowed("docker kill my-container")).toBe(true));
-    it("docker rm container", async () => expect(await isAllowed("docker rm my-container")).toBe(true));
-    it("docker rmi image", async () => expect(await isAllowed("docker rmi my-image:latest")).toBe(true));
-    it("docker exec", async () => expect(await isAllowed("docker exec -it container bash")).toBe(true));
-  });
-  describe("other languages and build tools", () => {
-    it("cargo build", async () => expect(await isAllowed("cargo build --release")).toBe(true));
-    it("cargo clean", async () => expect(await isAllowed("cargo clean")).toBe(true));
-    it("cargo test", async () => expect(await isAllowed("cargo test")).toBe(true));
-    it("go build", async () => expect(await isAllowed("go build ./...")).toBe(true));
-    it("go test", async () => expect(await isAllowed("go test ./...")).toBe(true));
-    it("go mod tidy", async () => expect(await isAllowed("go mod tidy")).toBe(true));
-    it("javac Main.java", async () => expect(await isAllowed("javac Main.java")).toBe(true));
-    it("mvn clean install", async () => expect(await isAllowed("mvn clean install")).toBe(true));
-    it("gradle build", async () => expect(await isAllowed("gradle build")).toBe(true));
-    it("ruby script.rb", async () => expect(await isAllowed("ruby script.rb")).toBe(true));
-    it("gem install bundler", async () => expect(await isAllowed("gem install bundler")).toBe(true));
-    it("bundle install", async () => expect(await isAllowed("bundle install")).toBe(true));
-    it("make clean", async () => expect(await isAllowed("make clean")).toBe(true));
-    it("make -j8", async () => expect(await isAllowed("make -j8")).toBe(true));
-    it("cmake ..", async () => expect(await isAllowed("cmake ..")).toBe(true));
-    it("swift build", async () => expect(await isAllowed("swift build")).toBe(true));
-    it("swift test", async () => expect(await isAllowed("swift test")).toBe(true));
-  });
-  describe("network commands", () => {
-    it("curl URL", async () => expect(await isAllowed("curl https://api.example.com/data")).toBe(true));
-    it("curl POST", async () => expect(await isAllowed("curl -X POST -d '{\"key\":\"val\"}' https://api.com")).toBe(true));
-    it("curl | jq", async () => expect(await isAllowed("curl https://api.com | jq .")).toBe(true));
-    it("curl -o file", async () => expect(await isAllowed("curl -o output.json https://api.com/data")).toBe(true));
-    it("wget file", async () => expect(await isAllowed("wget https://example.com/file.tar.gz")).toBe(true));
-    it("wget -O file", async () => expect(await isAllowed("wget -O output.zip https://example.com/release.zip")).toBe(true));
-    it("curl | bash (install script)", async () => expect(await isAllowed("curl -fsSL https://bun.sh/install | bash")).toBe(true));
-    it("ssh command", async () => expect(await isAllowed("ssh user@host 'uptime'")).toBe(true));
-    it("scp file", async () => expect(await isAllowed("scp ./file.txt user@host:/tmp/")).toBe(true));
-    it("rsync", async () => expect(await isAllowed("rsync -avz ./dist/ user@host:/var/www/")).toBe(true));
-  });
-  describe("system and dev tools", () => {
-    it("ls -la", async () => expect(await isAllowed("ls -la")).toBe(true));
-    it("cat file", async () => expect(await isAllowed("cat package.json")).toBe(true));
-    it("grep -r pattern", async () => expect(await isAllowed("grep -r 'TODO' src/")).toBe(true));
-    it("find . -name '*.ts'", async () => expect(await isAllowed("find . -name '*.ts'")).toBe(true));
-    it("tar czf", async () => expect(await isAllowed("tar czf archive.tar.gz ./dist")).toBe(true));
-    it("tar xzf", async () => expect(await isAllowed("tar xzf archive.tar.gz")).toBe(true));
-    it("cp -r", async () => expect(await isAllowed("cp -r src/ backup/")).toBe(true));
-    it("mv file", async () => expect(await isAllowed("mv old.txt new.txt")).toBe(true));
-    it("mkdir -p", async () => expect(await isAllowed("mkdir -p src/components/ui")).toBe(true));
-    it("touch file", async () => expect(await isAllowed("touch .env.local")).toBe(true));
-    it("ps aux", async () => expect(await isAllowed("ps aux")).toBe(true));
-    it("kill process", async () => expect(await isAllowed("kill -9 12345")).toBe(true));
-    it("env", async () => expect(await isAllowed("env")).toBe(true));
-    it("which node", async () => expect(await isAllowed("which node")).toBe(true));
-    it("whoami", async () => expect(await isAllowed("whoami")).toBe(true));
-    it("uname -a", async () => expect(await isAllowed("uname -a")).toBe(true));
-    it("df -h", async () => expect(await isAllowed("df -h")).toBe(true));
-    it("du -sh .", async () => expect(await isAllowed("du -sh .")).toBe(true));
-  });
-  describe("macOS / Homebrew", () => {
-    it("brew install", async () => expect(await isAllowed("brew install postgresql")).toBe(true));
-    it("brew upgrade", async () => expect(await isAllowed("brew upgrade")).toBe(true));
-    it("brew services start", async () => expect(await isAllowed("brew services start postgresql")).toBe(true));
-    it("xcode-select --install", async () => expect(await isAllowed("xcode-select --install")).toBe(true));
-    it("open .", async () => expect(await isAllowed("open .")).toBe(true));
-    it("pbcopy", async () => expect(await isAllowed("echo 'text' | pbcopy")).toBe(true));
-  });
-  describe("dd on regular files", () => {
-    it("dd to regular file", async () => expect(await isAllowed("dd if=/dev/urandom of=./random.bin bs=1024 count=1")).toBe(true));
-    it("dd between files", async () => expect(await isAllowed("dd if=input.bin of=output.bin")).toBe(true));
-    it("dd to /dev/null", async () => expect(await isAllowed("dd if=./bigfile of=/dev/null bs=1M")).toBe(true));
-    it("dd to /tmp", async () => expect(await isAllowed("dd if=/dev/zero of=/tmp/testfile bs=1M count=10")).toBe(true));
-  });
-  describe("piped and chained commands", () => {
-    it("pipe to grep", async () => expect(await isAllowed("cat file.txt | grep 'error'")).toBe(true));
-    it("pipe to wc", async () => expect(await isAllowed("find . -name '*.ts' | wc -l")).toBe(true));
-    it("&& chain", async () => expect(await isAllowed("npm install && npm run build && npm test")).toBe(true));
-    it("|| fallback", async () => expect(await isAllowed("which bun || npm install -g bun")).toBe(true));
-    it("subshell", async () => expect(await isAllowed("(cd /tmp && tar xzf archive.tar.gz)")).toBe(true));
-    it("base64 encode", async () => expect(await isAllowed("echo 'hello' | base64")).toBe(true));
-    it("base64 decode to file", async () => expect(await isAllowed("base64 -d encoded.txt > output.bin")).toBe(true));
-  });
-  describe("database tools", () => {
-    it("psql", async () => expect(await isAllowed("psql -h localhost -U user dbname")).toBe(true));
-    it("mysql", async () => expect(await isAllowed("mysql -u root -p dbname")).toBe(true));
-    it("redis-cli", async () => expect(await isAllowed("redis-cli PING")).toBe(true));
-    it("mongosh", async () => expect(await isAllowed("mongosh --eval 'db.getCollectionNames()'")).toBe(true));
-    it("sqlite3", async () => expect(await isAllowed("sqlite3 test.db '.tables'")).toBe(true));
-  });
-  describe("cloud and devops", () => {
-    it("aws s3 ls", async () => expect(await isAllowed("aws s3 ls s3://my-bucket/")).toBe(true));
-    it("gcloud", async () => expect(await isAllowed("gcloud app deploy")).toBe(true));
-    it("terraform apply", async () => expect(await isAllowed("terraform apply -auto-approve")).toBe(true));
-    it("kubectl", async () => expect(await isAllowed("kubectl get pods -A")).toBe(true));
-    it("flyctl deploy", async () => expect(await isAllowed("flyctl deploy")).toBe(true));
-    it("vercel deploy", async () => expect(await isAllowed("vercel --prod")).toBe(true));
-    it("gh pr create", async () => expect(await isAllowed("gh pr create --title 'fix' --body 'desc'")).toBe(true));
-  });
-  describe("previously blocked — now allowed (regression checks)", () => {
-    it("chown -R user ~/.npm", async () => expect(await isAllowed("chown -R whale ~/.npm")).toBe(true));
-    it("sudo chown -R $(whoami) /Users/whale/.npm-cache", async () => expect(await isAllowed("sudo chown -R $(whoami) /Users/whale/.npm-cache")).toBe(true));
-    it("chmod 777 /tmp/test", async () => expect(await isAllowed("chmod 777 /tmp/test")).toBe(true));
-    it("rm -rf /tmp/build-cache", async () => expect(await isAllowed("rm -rf /tmp/build-cache")).toBe(true));
-    it("rm -rf /Users/whale/project/node_modules", async () => expect(await isAllowed("rm -rf /Users/whale/project/node_modules")).toBe(true));
-    it("dd if=/dev/zero of=./testfile bs=1M count=1", async () => expect(await isAllowed("dd if=/dev/zero of=./testfile bs=1M count=1")).toBe(true));
-    it("curl install script | bash", async () => expect(await isAllowed("curl -fsSL https://bun.sh/install | bash")).toBe(true));
-    it("node -e with require", async () => expect(await isAllowed("node -e 'require(\"child_process\").execSync(\"ls\")'")).toBe(true));
-    it("python -e with os.system", async () => expect(await isAllowed("python -e 'import os; os.system(\"ls\")'")).toBe(true));
-  });
-});

package/dist/cli/services/tools/__tests__/shell-exec-allowed.test.js

@@ -1,154 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-
-// Mock child_process.spawn so commands are NOT actually executed.
-vi.mock("child_process", async () => {
-  const actual = await vi.importActual("child_process");
-  return {
-    ...actual,
-    spawn: vi.fn(cmd => {
-      const {
-        EventEmitter
-      } = require("events");
-      const {
-        Readable
-      } = require("stream");
-      const child = new EventEmitter();
-      const echoMatch = typeof cmd === "string" ? cmd.match(/^echo\s+(.*)/) : null;
-      let pushed = false;
-      child.stdout = new Readable({
-        read() {
-          if (echoMatch && !pushed) {
-            pushed = true;
-            this.push(echoMatch[1] + "\n");
-          }
-          this.push(null);
-        }
-      });
-      child.stderr = new Readable({
-        read() {
-          this.push(null);
-        }
-      });
-      child.stdin = {
-        write: vi.fn(),
-        end: vi.fn()
-      };
-      child.pid = 99999;
-      child.kill = vi.fn();
-      setTimeout(() => child.emit("exit", 0), 5);
-      return child;
-    })
-  };
-});
-vi.mock("../../sandbox.js", () => ({
-  sandboxCommand: vi.fn((cmd, _cwd) => ({
-    wrapped: cmd,
-    profilePath: null
-  })),
-  cleanupSandbox: vi.fn()
-}));
-vi.mock("../../background-processes.js", () => ({
-  spawnBackground: vi.fn(async () => ({
-    status: "running",
-    message: "Process started"
-  })),
-  readProcessOutput: vi.fn(_id => ({
-    status: "completed",
-    exitCode: 0,
-    newOutput: "output data",
-    newErrors: ""
-  })),
-  killProcess: vi.fn(() => ({
-    success: true,
-    message: "Process killed"
-  })),
-  listProcesses: vi.fn(() => [])
-}));
-vi.mock("../../agent-events.js", () => ({
-  getGlobalEmitter: vi.fn(() => ({
-    emitToolOutput: vi.fn()
-  }))
-}));
-vi.mock("../../debug-log.js", () => ({
-  debugLog: vi.fn()
-}));
-import { runCommand } from "../shell-exec.js";
-async function isAllowed(command) {
-  const result = await runCommand({
-    command
-  });
-  return !result.output.includes("blocked for safety");
-}
-
-// ============================================================================
-// ALLOWED — everything a developer needs
-// ============================================================================
-
-describe("ALLOWED — normal developer commands", () => {
-  // ── File operations ──
-  describe("rm on specific paths (NOT root/home)", () => {
-    it("rm -rf node_modules", async () => expect(await isAllowed("rm -rf node_modules")).toBe(true));
-    it("rm -rf ./dist", async () => expect(await isAllowed("rm -rf ./dist")).toBe(true));
-    it("rm -rf /tmp/build", async () => expect(await isAllowed("rm -rf /tmp/build")).toBe(true));
-    it("rm -rf /Users/whale/project/node_modules", async () => expect(await isAllowed("rm -rf /Users/whale/project/node_modules")).toBe(true));
-    it("rm -rf ~/project/dist", async () => expect(await isAllowed("rm -rf ~/project/dist")).toBe(true));
-    it("rm -rf ~/Downloads/old-stuff", async () => expect(await isAllowed("rm -rf ~/Downloads/old-stuff")).toBe(true));
-    it("rm -rf ~/.npm-cache", async () => expect(await isAllowed("rm -rf ~/.npm-cache")).toBe(true));
-    it("rm -rf /var/tmp/cache", async () => expect(await isAllowed("rm -rf /var/tmp/cache")).toBe(true));
-    it("rm -f /tmp/lockfile", async () => expect(await isAllowed("rm -f /tmp/lockfile")).toBe(true));
-    it("rm file.txt", async () => expect(await isAllowed("rm file.txt")).toBe(true));
-    it("rm -r build/", async () => expect(await isAllowed("rm -r build/")).toBe(true));
-    it("rm -rf .next .turbo dist", async () => expect(await isAllowed("rm -rf .next .turbo dist")).toBe(true));
-  });
-
-  // ── chmod / chown (sandbox blocks writes outside cwd) ──
-  describe("chmod and chown", () => {
-    it("chmod 755 ./scripts/deploy.sh", async () => expect(await isAllowed("chmod 755 ./scripts/deploy.sh")).toBe(true));
-    it("chmod +x ./run.sh", async () => expect(await isAllowed("chmod +x ./run.sh")).toBe(true));
-    it("chmod -R 755 ./scripts", async () => expect(await isAllowed("chmod -R 755 ./scripts")).toBe(true));
-    it("chmod 777 /tmp/test", async () => expect(await isAllowed("chmod 777 /tmp/test")).toBe(true));
-    it("chmod -R 777 /tmp/test", async () => expect(await isAllowed("chmod -R 777 /tmp/test")).toBe(true));
-    it("chown -R $(whoami) ~/.npm", async () => expect(await isAllowed("chown -R $(whoami) ~/.npm")).toBe(true));
-    it("chown -R whale /Users/whale/.npm-cache", async () => expect(await isAllowed("chown -R whale /Users/whale/.npm-cache")).toBe(true));
-    it("chown -R whale:staff ./build", async () => expect(await isAllowed("chown -R whale:staff ./build")).toBe(true));
-    it("sudo chown -R $(whoami) ~/.npm", async () => expect(await isAllowed("sudo chown -R $(whoami) ~/.npm")).toBe(true));
-  });
-
-  // ── npm / Node.js ──
-  describe("npm and Node.js", () => {
-    it("npm install", async () => expect(await isAllowed("npm install")).toBe(true));
-    it("npm install --force", async () => expect(await isAllowed("npm install --force")).toBe(true));
-    it("npm ci", async () => expect(await isAllowed("npm ci")).toBe(true));
-    it("npm run build", async () => expect(await isAllowed("npm run build")).toBe(true));
-    it("npm run dev", async () => expect(await isAllowed("npm run dev")).toBe(true));
-    it("npm test", async () => expect(await isAllowed("npm test")).toBe(true));
-    it("npm cache clean --force", async () => expect(await isAllowed("npm cache clean --force")).toBe(true));
-    it("npm rebuild", async () => expect(await isAllowed("npm rebuild")).toBe(true));
-    it("npm link", async () => expect(await isAllowed("npm link")).toBe(true));
-    it("npm pack", async () => expect(await isAllowed("npm pack")).toBe(true));
-    it("npm publish", async () => expect(await isAllowed("npm publish")).toBe(true));
-    it("npx create-react-app my-app", async () => expect(await isAllowed("npx create-react-app my-app")).toBe(true));
-    it("npx tsc --noEmit", async () => expect(await isAllowed("npx tsc --noEmit")).toBe(true));
-    it("node server.js", async () => expect(await isAllowed("node server.js")).toBe(true));
-    it("node -e 'console.log(1)'", async () => expect(await isAllowed("node -e 'console.log(1)'")).toBe(true));
-    it("node -e with require", async () => expect(await isAllowed("node -e 'require(\"fs\").readFileSync(\"x\")'")).toBe(true));
-    it("bun install", async () => expect(await isAllowed("bun install")).toBe(true));
-    it("bun run dev", async () => expect(await isAllowed("bun run dev")).toBe(true));
-    it("pnpm install", async () => expect(await isAllowed("pnpm install")).toBe(true));
-    it("yarn install", async () => expect(await isAllowed("yarn install")).toBe(true));
-    it("deno run script.ts", async () => expect(await isAllowed("deno run script.ts")).toBe(true));
-  });
-
-  // ── Python ──
-  describe("Python", () => {
-    it("pip install package", async () => expect(await isAllowed("pip install flask")).toBe(true));
-    it("pip install -r requirements.txt", async () => expect(await isAllowed("pip install -r requirements.txt")).toBe(true));
-    it("pip install --force-reinstall", async () => expect(await isAllowed("pip install --force-reinstall package")).toBe(true));
-    it("python script.py", async () => expect(await isAllowed("python script.py")).toBe(true));
-    it("python -m venv .venv", async () => expect(await isAllowed("python -m venv .venv")).toBe(true));
-    it("python -e 'print(1)'", async () => expect(await isAllowed("python -e 'print(1)'")).toBe(true));
-    it("python -c 'import os; print(os.getcwd())'", async () => expect(await isAllowed("python -c 'import os; print(os.getcwd())'")).toBe(true));
-    it("pytest", async () => expect(await isAllowed("pytest -xvs tests/")).toBe(true));
-    it("uv pip install", async () => expect(await isAllowed("uv pip install flask")).toBe(true));
-  });
-});

package/dist/cli/services/tools/__tests__/shell-exec-blocked.test.js

@@ -1,132 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-
-// Mock child_process.spawn so commands are NOT actually executed.
-vi.mock("child_process", async () => {
-  const actual = await vi.importActual("child_process");
-  return {
-    ...actual,
-    spawn: vi.fn(cmd => {
-      const {
-        EventEmitter
-      } = require("events");
-      const {
-        Readable
-      } = require("stream");
-      const child = new EventEmitter();
-      const echoMatch = typeof cmd === "string" ? cmd.match(/^echo\s+(.*)/) : null;
-      let pushed = false;
-      child.stdout = new Readable({
-        read() {
-          if (echoMatch && !pushed) {
-            pushed = true;
-            this.push(echoMatch[1] + "\n");
-          }
-          this.push(null);
-        }
-      });
-      child.stderr = new Readable({
-        read() {
-          this.push(null);
-        }
-      });
-      child.stdin = {
-        write: vi.fn(),
-        end: vi.fn()
-      };
-      child.pid = 99999;
-      child.kill = vi.fn();
-      setTimeout(() => child.emit("exit", 0), 5);
-      return child;
-    })
-  };
-});
-vi.mock("../../sandbox.js", () => ({
-  sandboxCommand: vi.fn((cmd, _cwd) => ({
-    wrapped: cmd,
-    profilePath: null
-  })),
-  cleanupSandbox: vi.fn()
-}));
-vi.mock("../../background-processes.js", () => ({
-  spawnBackground: vi.fn(async () => ({
-    status: "running",
-    message: "Process started"
-  })),
-  readProcessOutput: vi.fn(_id => ({
-    status: "completed",
-    exitCode: 0,
-    newOutput: "output data",
-    newErrors: ""
-  })),
-  killProcess: vi.fn(() => ({
-    success: true,
-    message: "Process killed"
-  })),
-  listProcesses: vi.fn(() => [])
-}));
-vi.mock("../../agent-events.js", () => ({
-  getGlobalEmitter: vi.fn(() => ({
-    emitToolOutput: vi.fn()
-  }))
-}));
-vi.mock("../../debug-log.js", () => ({
-  debugLog: vi.fn()
-}));
-import { runCommand } from "../shell-exec.js";
-async function isBlocked(command) {
-  const result = await runCommand({
-    command
-  });
-  return result.output.includes("blocked for safety");
-}
-
-// ============================================================================
-// BLOCKED — truly catastrophic commands
-// ============================================================================
-
-describe("BLOCKED — catastrophic commands", () => {
-  describe("rm on literal root", () => {
-    it("blocks rm -rf /", async () => expect(await isBlocked("rm -rf /")).toBe(true));
-    it("blocks rm -rf /*", async () => expect(await isBlocked("rm -rf /*")).toBe(true));
-    it("blocks rm -fr /", async () => expect(await isBlocked("rm -fr /")).toBe(true));
-    it("blocks rm -r -f /", async () => expect(await isBlocked("rm -r -f /")).toBe(true));
-    it("blocks rm -rf / in chain", async () => expect(await isBlocked("rm -rf / && echo done")).toBe(true));
-    it("blocks rm -rf / ; cmd", async () => expect(await isBlocked("rm -rf / ; echo hi")).toBe(true));
-    it("blocks rm -rf /  (trailing space)", async () => expect(await isBlocked("rm -rf /  ")).toBe(true));
-  });
-  describe("rm on literal home", () => {
-    it("blocks rm -rf ~", async () => expect(await isBlocked("rm -rf ~")).toBe(true));
-    it("blocks rm -rf ~/", async () => expect(await isBlocked("rm -rf ~/")).toBe(true));
-    it("blocks rm -rf ~/*", async () => expect(await isBlocked("rm -rf ~/*")).toBe(true));
-    it("blocks rm -rf ~ in chain", async () => expect(await isBlocked("rm -rf ~ && echo done")).toBe(true));
-  });
-  describe("mkfs — format filesystem", () => {
-    it("blocks mkfs", async () => expect(await isBlocked("mkfs /dev/sda1")).toBe(true));
-    it("blocks mkfs.ext4", async () => expect(await isBlocked("mkfs.ext4 /dev/sda1")).toBe(true));
-    it("blocks MKFS (case-insensitive)", async () => expect(await isBlocked("MKFS /dev/sda")).toBe(true));
-  });
-  describe("dd to block devices", () => {
-    it("blocks dd to /dev/sda", async () => expect(await isBlocked("dd if=/dev/zero of=/dev/sda")).toBe(true));
-    it("blocks dd to /dev/disk0", async () => expect(await isBlocked("dd if=backup.img of=/dev/disk0")).toBe(true));
-    it("blocks dd to /dev/rdisk0", async () => expect(await isBlocked("dd if=backup.img of=/dev/rdisk0")).toBe(true));
-    it("blocks dd to /dev/nvme0n1", async () => expect(await isBlocked("dd if=/dev/zero of=/dev/nvme0n1")).toBe(true));
-    it("blocks dd to /dev/hda", async () => expect(await isBlocked("dd if=/dev/zero of=/dev/hda")).toBe(true));
-    it("blocks dd to /dev/vda", async () => expect(await isBlocked("dd if=/dev/zero of=/dev/vda")).toBe(true));
-  });
-  describe("redirect to block devices", () => {
-    it("blocks > /dev/sda", async () => expect(await isBlocked("echo 'data' > /dev/sda")).toBe(true));
-    it("blocks > /dev/disk0", async () => expect(await isBlocked("echo 'data' > /dev/disk0")).toBe(true));
-  });
-  describe("fork bomb", () => {
-    it("blocks :(){ :|:& };:", async () => expect(await isBlocked(":(){ :|:& };:")).toBe(true));
-  });
-  describe("command length limit", () => {
-    it("blocks commands exceeding 10000 characters", async () => {
-      const result = await runCommand({
-        command: "x".repeat(10001)
-      });
-      expect(result.success).toBe(false);
-      expect(result.output).toContain("Command too long");
-    });
-  });
-});