termaxa 0.18.6

//! `check`, `log`, `stats` and `rollback` as a user drives them.
//!
//! These subcommands filter, count, confirm and preview — all of it inside
//! `dispatch`, which reads the process cwd and stdin and prints. There is no
//! seam to call, so the binary is the unit under test.
//!
//! Everything is seeded through the CLI: `run` is the only path that records
//! an approval and an exit code, which is what the outcome column renders.

#![cfg(unix)]

use std::io::Write as _;
use std::path::{Path, PathBuf};
use std::process::{Command, Stdio};

struct Output {
    stdout: String,
    stderr: String,
    code: i32,
}

fn termaxa(home: &Path, cwd: &Path, args: &[&str], stdin: &str) -> Output {
    run_termaxa(home, cwd, args, stdin, None)
}

/// Like `termaxa`, but the answer arrives the way a person's does: through a
/// terminal. An ask is answered only from a tty since Sep 10, 2026 - under
/// `wrap`, a harness's pipe never closed and the prompt blocked for two
/// minutes, and the agent noted it could have piped `y` into the same
/// stdin. A pipe carrying `y` is refused; this helper hands the child a
/// pseudo-terminal and types into it, which is the one path that approves.
fn termaxa_tty(home: &Path, cwd: &Path, args: &[&str], answer: &str) -> Output {
    use std::os::unix::io::FromRawFd;
    let (mut master, mut slave) = (0i32, 0i32);
    let rc = unsafe {
        // Apple's binding declares the termios and winsize pointers `*mut`,
        // glibc's `*const`; a `*mut` null coerces to either.
        libc::openpty(
            &mut master,
            &mut slave,
            std::ptr::null_mut(),
            std::ptr::null_mut(),
            std::ptr::null_mut(),
        )
    };
    assert_eq!(rc, 0, "openpty must succeed on a unix test machine");
    // SAFETY: both fds were just created by openpty and are owned here.
    let slave_file = unsafe { std::fs::File::from_raw_fd(slave) };
    let mut master_file = unsafe { std::fs::File::from_raw_fd(master) };
    let mut cmd = Command::new(env!("CARGO_BIN_EXE_termaxa"));
    cmd.args(args)
        .current_dir(cwd)
        .env("TERMAXA_HOME", home)
        .env("NO_COLOR", "1")
        .stdin(Stdio::from(slave_file))
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    let child = cmd.spawn().expect("the binary must be runnable");
    drop(cmd); // the parent's copy of the slave closes here
    let _ = master_file.write_all(answer.as_bytes());
    let out = child.wait_with_output().expect("the child must exit");
    drop(master_file);
    Output {
        stdout: String::from_utf8_lossy(&out.stdout).into_owned(),
        stderr: String::from_utf8_lossy(&out.stderr).into_owned(),
        code: out.status.code().unwrap_or(-1),
    }
}

fn run_termaxa(
    home: &Path,
    cwd: &Path,
    args: &[&str],
    stdin: &str,
    extra_path: Option<&Path>,
) -> Output {
    let mut cmd = Command::new(env!("CARGO_BIN_EXE_termaxa"));
    cmd.args(args)
        .current_dir(cwd)
        .env("TERMAXA_HOME", home)
        .env("NO_COLOR", "1")
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    // Only the child's PATH is rewritten, so a stub binary cannot leak into
    // any other test in this process.
    if let Some(dir) = extra_path {
        let inherited = std::env::var("PATH").unwrap_or_default();
        cmd.env("PATH", format!("{}:{}", dir.display(), inherited));
    }
    let mut child = cmd.spawn().expect("the binary must be runnable");
    // A command may answer without reading stdin at all: `rollback` with an
    // unknown id refuses before it ever prompts. The child then exits while
    // this write is in flight and the pipe closes under it, which is the
    // child not needing what was offered rather than a failure of the test.
    // The assertions below carry the signal either way.
    let _ = child
        .stdin
        .take()
        .expect("stdin must be piped")
        .write_all(stdin.as_bytes());
    let out = child.wait_with_output().expect("the child must exit");
    Output {
        stdout: String::from_utf8_lossy(&out.stdout).into_owned(),
        stderr: String::from_utf8_lossy(&out.stderr).into_owned(),
        code: out.status.code().unwrap_or(-1),
    }
}

/// A scratch tree, cleared first so a crashed earlier run cannot leak in.
/// Like `termaxa`, but gives up after `secs` and kills the child: the
/// wrapper used to recurse without end (#65), and a hung test is worse
/// than a failed one.
fn termaxa_within(home: &Path, cwd: &Path, args: &[&str], stdin: &str, secs: u64) -> Output {
    let mut cmd = Command::new(env!("CARGO_BIN_EXE_termaxa"));
    cmd.args(args)
        .current_dir(cwd)
        .env("TERMAXA_HOME", home)
        .env("NO_COLOR", "1")
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    let mut child = cmd.spawn().expect("the binary must be runnable");
    {
        let mut pipe = child.stdin.take().expect("stdin must be piped");
        let _ = pipe.write_all(stdin.as_bytes());
    }
    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(secs);
    let mut timed_out = false;
    while child
        .try_wait()
        .expect("the child must be pollable")
        .is_none()
    {
        if std::time::Instant::now() > deadline {
            let _ = child.kill();
            timed_out = true;
            break;
        }
        std::thread::sleep(std::time::Duration::from_millis(50));
    }
    let out = child.wait_with_output().expect("the child must exit");
    assert!(
        !timed_out,
        "termaxa {args:?} did not finish within {secs}s — the wrapper is recursing again (#65)"
    );
    Output {
        stdout: String::from_utf8_lossy(&out.stdout).into_owned(),
        stderr: String::from_utf8_lossy(&out.stderr).into_owned(),
        code: out.status.code().unwrap_or(-1),
    }
}

fn scratch(tag: &str) -> PathBuf {
    let base = std::env::temp_dir().join(format!("termaxa-cli-{tag}-{}", std::process::id()));
    let _ = std::fs::remove_dir_all(&base);
    std::fs::create_dir_all(base.join("home")).expect("scratch root must be creatable");
    base
}

/// `sh` runs silently, `rm` is insurable, and everything else is asked about.
fn project(root: &Path) -> PathBuf {
    let proj = root.join("proj");
    std::fs::create_dir_all(proj.join(".termaxa")).expect("project dir must be creatable");
    std::fs::write(
        proj.join(".termaxa").join("policy.yaml"),
        "version: 1\ndefault: ask\nrules:\n  - match: \"rm -rf /*\"\n    action: deny\n  \
         - match: \"sh*\"\n    action: allow\n  - match: \"exit*\"\n    action: allow\n",
    )
    .expect("policy must be writable");
    proj
}

/// A project that denies `terraform destroy` and asks about everything else.
fn project_gating_terraform(root: &Path) -> PathBuf {
    let proj = root.join("proj");
    std::fs::create_dir_all(proj.join(".termaxa")).expect("project dir must be creatable");
    std::fs::write(
        proj.join(".termaxa").join("policy.yaml"),
        "version: 1\ndefault: ask\nrules:\n  - match: \"terraform destroy*\"\n    action: deny\n",
    )
    .expect("policy must be writable");
    proj
}

/// A stub `terraform` that leaves a marker behind, so "did the preview spawn
/// anything?" is answerable as a fact rather than inferred from output.
fn stub_terraform(bin_dir: &Path, marker: &Path) {
    std::fs::create_dir_all(bin_dir).expect("stub dir must be creatable");
    let path = bin_dir.join("terraform");
    std::fs::write(
        &path,
        format!(
            "#!/bin/sh\ntouch '{}'\necho 'Plan: 0 to add, 0 to change, 1 to destroy.'\n",
            marker.display()
        ),
    )
    .expect("stub must be writable");
    use std::os::unix::fs::PermissionsExt as _;
    std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o755))
        .expect("stub must be executable");
}

#[test]
fn a_denied_command_never_causes_the_preview_to_run_anything() {
    // v0.14.2, reported by Tim Schipper: `check` builds the preview before it
    // reports the decision, so DENYING a `terraform destroy` was the thing
    // that ran `terraform plan -destroy` in the working directory. The more
    // correctly the gate behaved, the more confidently it ran the plan.
    let tmp = scratch("deny-inert");
    let (home, proj) = (tmp.join("home"), project_gating_terraform(&tmp));
    let bin_dir = tmp.join("bin");
    let marker = tmp.join("plan-was-run");
    stub_terraform(&bin_dir, &marker);

    let denied = run_termaxa(
        &home,
        &proj,
        &["check", "terraform destroy -auto-approve"],
        "",
        Some(&bin_dir),
    );
    assert!(
        denied.stdout.contains("deny"),
        "the fixture must actually deny: {:?}",
        denied.stdout
    );
    assert!(
        !marker.exists(),
        "a denied command must not cause a subprocess"
    );

    // The other half: liveness is decided by the verdict, not switched off
    // altogether. A command that was not denied still gets a live preview.
    run_termaxa(
        &home,
        &proj,
        &["check", "terraform apply"],
        "",
        Some(&bin_dir),
    );
    assert!(
        marker.exists(),
        "an undenied command should still be previewed live"
    );
}

#[test]
fn log_filters_by_decision_and_by_source() {
    let tmp = scratch("log-filter");
    let (home, proj) = (tmp.join("home"), project(&tmp));

    termaxa(
        &home,
        &proj,
        &["check", "rm -rf /nonexistent-tmx-fixture"],
        "",
    );
    termaxa(&home, &proj, &["check", "cat notes.txt"], "");
    termaxa(&home, &proj, &["run", "--", "sh", "-c", "exit 0"], "");

    // The control leg: unfiltered, BOTH commands are there. Without it, a
    // filter test proves nothing when the seeding silently failed, because an
    // empty log excludes everything perfectly.
    let all = termaxa(&home, &proj, &["log", "-n", "50"], "").stdout;
    assert!(all.contains("rm -rf /"), "{all:?}");
    assert!(all.contains("cat notes.txt"), "{all:?}");

    let denied = termaxa(&home, &proj, &["log", "--decision", "deny"], "").stdout;
    assert!(denied.contains("rm -rf /"), "{denied:?}");
    assert!(
        !denied.contains("cat notes.txt"),
        "a filter that keeps everything is not a filter: {denied:?}"
    );

    let from_run = termaxa(&home, &proj, &["log", "--source", "run"], "").stdout;
    assert!(from_run.contains("exit 0"), "{from_run:?}");
    assert!(
        !from_run.contains("cat notes.txt"),
        "`check` entries are not `run` entries: {from_run:?}"
    );
}

#[test]
fn the_log_says_what_became_of_each_command() {
    let tmp = scratch("log-outcome");
    let (home, proj) = (tmp.join("home"), project(&tmp));

    // Allowed and executed: an exit code, but no approval to report.
    termaxa(&home, &proj, &["run", "--", "sh", "-c", "exit 3"], "");
    // Asked, and approved: both.
    termaxa_tty(&home, &proj, &["run", "--", "echo", "yes-please"], "y\n");
    // Asked, and declined: nothing ran.
    termaxa(&home, &proj, &["run", "--", "echo", "no-thanks"], "n\n");

    let log = termaxa(&home, &proj, &["log", "-n", "50"], "").stdout;
    assert!(log.contains("→ exit 3"), "{log:?}");
    assert!(log.contains("→ approved, exit 0"), "{log:?}");
    assert!(log.contains("→ not run"), "{log:?}");
}

#[test]
fn stats_ranks_the_commands_that_were_denied() {
    let tmp = scratch("stats");
    let (home, proj) = (tmp.join("home"), project(&tmp));

    termaxa(
        &home,
        &proj,
        &["check", "rm -rf /nonexistent-tmx-fixture"],
        "",
    );
    termaxa(
        &home,
        &proj,
        &["check", "rm -rf /nonexistent-tmx-fixture"],
        "",
    );
    termaxa(
        &home,
        &proj,
        &["check", "rm -rf /nonexistent-tmx-other"],
        "",
    );
    termaxa(&home, &proj, &["check", "cat notes.txt"], "");

    // Same control: the allowed command is in the log, so its absence from the
    // denial ranking below is the ranking working rather than the log being
    // empty.
    let all = termaxa(&home, &proj, &["log", "-n", "50"], "").stdout;
    assert!(all.contains("cat notes.txt"), "{all:?}");

    let stats = termaxa(&home, &proj, &["stats"], "").stdout;
    assert!(stats.contains("top denied"), "{stats:?}");
    assert!(
        stats.contains("2× rm -rf /"),
        "the same denial twice is a count of two: {stats:?}"
    );
    assert!(
        !stats.contains("cat notes.txt"),
        "what was allowed is not a denial: {stats:?}"
    );
}

#[test]
fn stats_stays_quiet_about_denials_when_there_are_none() {
    let tmp = scratch("stats-quiet");
    let (home, proj) = (tmp.join("home"), project(&tmp));

    termaxa(&home, &proj, &["check", "cat notes.txt"], "");

    let stats = termaxa(&home, &proj, &["stats"], "").stdout;
    assert!(
        !stats.contains("top denied"),
        "an empty ranking is a heading with nothing under it: {stats:?}"
    );
}

/// Delete an insurable file through the gate and return the backup's id.
///
/// Insurance is best effort in production — `runner` prints "backup failed
/// (…); proceeding" and carries on — so a failure here must report what the
/// gate actually said, or the test just says "no backup" and leaves the cause
/// to guesswork.
fn take_a_backup(home: &Path, proj: &Path) -> String {
    std::fs::write(proj.join("doomed.txt"), "precious\n").expect("file must be writable");
    let deleted = termaxa_tty(home, proj, &["run", "--", "rm", "doomed.txt"], "y\n");
    assert_eq!(
        deleted.code, 0,
        "the delete itself must succeed.\nstdout: {}\nstderr: {}",
        deleted.stdout, deleted.stderr
    );

    let listed = termaxa(home, proj, &["backups"], "").stdout;
    let id = listed
        .lines()
        .next()
        .unwrap_or_default()
        .split_whitespace()
        .next()
        .unwrap_or_default()
        .to_string();
    assert!(
        !id.is_empty() && !listed.contains("no backups yet"),
        "the delete should have been insured.\nbackups: {listed:?}\n\
         run stdout: {}\nrun stderr: {}",
        deleted.stdout,
        deleted.stderr
    );
    id
}

#[test]
fn rollback_refuses_an_id_it_does_not_have() {
    let tmp = scratch("rollback-unknown");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    take_a_backup(&home, &proj);

    // A backup exists, so "not found" cannot be reached by having none.
    let out = termaxa(&home, &proj, &["rollback", "definitely-not-an-id"], "y\n");
    assert_eq!(
        out.code,
        2,
        "an unknown id is an error: {out:?}",
        out = out.stderr
    );
    assert!(
        out.stderr.contains("no backup with id"),
        "and says so: {:?}",
        out.stderr
    );
}

#[test]
fn rollback_restores_nothing_unless_it_is_confirmed() {
    let tmp = scratch("rollback-declined");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    let id = take_a_backup(&home, &proj);

    let out = termaxa(&home, &proj, &["rollback", &id], "n\n");
    assert_eq!(out.code, 1, "a decline is not a success");
    assert!(out.stderr.contains("rollback declined"), "{:?}", out.stderr);
    assert!(
        !proj.join("doomed.txt").exists(),
        "declining must leave the file deleted, not restore it"
    );

    // And confirming does restore it, so the guard is a gate rather than a wall.
    let out = termaxa(&home, &proj, &["rollback", &id], "y\n");
    assert_eq!(
        out.code, 0,
        "a confirmed rollback succeeds: {:?}",
        out.stderr
    );
    assert!(
        proj.join("doomed.txt").exists(),
        "the insured file must come back"
    );
    // The mark is part of the assertion on purpose: "1 path(s) restored" is
    // also a substring of "-1 path(s) restored", so a count that went the
    // wrong way would read as correct.
    assert!(
        out.stdout.contains("✓ 1 path(s) restored"),
        "the count is the report of what happened: {:?}",
        out.stdout
    );
}

/// #65. Through the wrapper, an allowed command was never executed: the
/// runner's `sh` resolved to the shim again and the wrapper recursed until
/// killed. The residue test pinned a deny and a bypass; nothing pinned an
/// execution. The fixture allows `sh*` and `exit*`, so `sh -c "exit 3"` is
/// allowed at both levels, and its exit code must come back through the
/// wrapper and the shim.
#[test]
fn wrap_executes_what_it_allows() {
    let tmp = scratch("wrap-allow");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    let out = termaxa_within(&home, &proj, &["wrap", "--", "sh", "-c", "exit 3"], "", 30);
    assert_eq!(
        out.code, 3,
        "stdout: {}\nstderr: {}",
        out.stdout, out.stderr
    );
    assert!(
        !out.stderr.contains("not interactive"),
        "the gate must not ask twice: {}",
        out.stderr
    );
    // A shell nested inside the approved command is the real one, not the
    // shim: one gate, and the inner exit code comes back.
    let out = termaxa_within(
        &home,
        &proj,
        &["wrap", "--", "sh", "-c", "sh -c 'exit 5'"],
        "",
        30,
    );
    assert_eq!(
        out.code, 5,
        "stdout: {}\nstderr: {}",
        out.stdout, out.stderr
    );
}

/// #65, the asked half: through the wrapper an approved delete asked twice
/// and then refused for lack of stdin, leaving the file in place and no
/// backup. Then (Sep 10, 2026, the first real agent under `wrap`) the ask
/// blocked for two minutes on a harness pipe that never closed, and the
/// agent itself pointed out that piping `y` into the same stdin would have
/// cleared its own gate. So: an ask is answered only from a terminal. Through
/// the wrapper with a pipe for stdin, an asked delete is refused at once,
/// with the reason, the file untouched, and nothing hangs. A person at a
/// terminal is exercised by the `run` tests through a pseudo-terminal.
#[test]
fn wrap_refuses_an_ask_when_nobody_is_at_a_terminal() {
    let tmp = scratch("wrap-unattended");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    std::fs::write(proj.join("doomed.txt"), "precious").unwrap();

    let started = std::time::Instant::now();
    let out = termaxa_within(
        &home,
        &proj,
        &["wrap", "--", "sh", "-c", "rm -rf ./doomed.txt"],
        "y\n",
        30,
    );
    assert!(
        started.elapsed() < std::time::Duration::from_secs(10),
        "an unanswerable ask must not wait for an answer"
    );
    assert!(
        proj.join("doomed.txt").exists(),
        "a `y` on a pipe is not a person: the delete must not have run\nstdout: {}\nstderr: {}",
        out.stdout,
        out.stderr
    );
    assert!(
        out.stderr.contains("needs a human at a terminal"),
        "the refusal says why: {}",
        out.stderr
    );
    assert!(
        !out.stdout.contains("Proceed?") && !out.stderr.contains("Proceed?"),
        "no prompt is printed where nobody can answer it"
    );
}

/// #69. The shim forwarded only a leading, bare `-c`; `bash -lc` (Codex's
/// spelling), `bash -e -c`, `bash --norc -c` and `bash -o pipefail -c` ran
/// through the real shell ungated. Now every spelling is gated exactly once
/// and the shell's own options reach execution, while a script file and a
/// bare `-c` still pass through untouched.
#[test]
fn wrap_reads_a_c_wherever_the_shell_would() {
    let tmp = scratch("wrap-cluster");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    for spelling in [
        vec!["-c"],
        vec!["-lc"],
        vec!["-e", "-c"],
        vec!["--norc", "-c"],
        vec!["-o", "pipefail", "-c"],
    ] {
        let mut args = vec!["wrap", "--", "bash"];
        args.extend(spelling.iter().copied());
        args.push("exit 3");
        let out = termaxa_within(&home, &proj, &args, "", 30);
        let asks = out.stdout.matches("decision").count() + out.stderr.matches("decision").count();
        assert_eq!(
            out.code, 3,
            "{spelling:?}: stdout {}\nstderr {}",
            out.stdout, out.stderr
        );
        assert_eq!(
            asks, 1,
            "{spelling:?}: gated exactly once\n{}{}",
            out.stdout, out.stderr
        );
    }
    std::fs::write(proj.join("s.sh"), "exit 7\n").unwrap();
    let out = termaxa_within(&home, &proj, &["wrap", "--", "sh", "s.sh"], "", 30);
    assert_eq!(
        out.code, 7,
        "a script file is not read: {}{}",
        out.stdout, out.stderr
    );
    assert!(
        !out.stdout.contains("decision") && !out.stderr.contains("decision"),
        "no gate for a script file: {}{}",
        out.stdout,
        out.stderr
    );
}

/// Sep 10, 2026, under strace: Claude Code probes zsh at four absolute
/// paths and then runs `/bin/bash` by absolute path, so the shim on `PATH`
/// saw nothing and an unattended `rm -rf ./scratch` ran with no audit
/// entry. It honours `CLAUDE_CODE_SHELL` and reads `$SHELL` only when that
/// names bash or zsh. So the wrapped agent is handed, in both, the shim for
/// the shell it would have chosen itself - zsh when the machine has one,
/// else bash (Sep 11: v0.18.5 handed a zsh machine the bash shim and moved
/// the agent to `bash -l`). An operator value naming one of the shims is
/// kept; one pointing elsewhere is overridden and said.
#[test]
fn wrap_hands_the_agent_the_shim_for_its_own_shell_by_name() {
    let tmp = scratch("wrap-agent-shell");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    std::fs::write(
        proj.join(".termaxa").join("policy.yaml"),
        "version: 1\ndefault: ask\nrules:\n  - match: \"sh*\"\n    action: allow\n  \
         - match: \"echo*\"\n    action: allow\n",
    )
    .unwrap();
    let out = termaxa_within(
        &home,
        &proj,
        &[
            "wrap",
            "--",
            "sh",
            "-c",
            "echo shell=$SHELL claude=$CLAUDE_CODE_SHELL",
        ],
        "",
        30,
    );
    let shims = home.join("shims");
    let shim = if shims.join("zsh").is_file() {
        shims.join("zsh")
    } else {
        shims.join("bash")
    };
    let want = format!("shell={} claude={}", shim.display(), shim.display());
    assert!(
        out.stdout.contains(&want),
        "want `{want}`\nstdout: {}\nstderr: {}",
        out.stdout,
        out.stderr
    );
    assert!(
        !out.stderr.contains("CLAUDE_CODE_SHELL was"),
        "nothing to override, nothing said: {}",
        out.stderr
    );

    let run = |value: &str| {
        let mut cmd = Command::new(env!("CARGO_BIN_EXE_termaxa"));
        let out = cmd
            .args(["wrap", "--", "sh", "-c", "echo claude=$CLAUDE_CODE_SHELL"])
            .current_dir(&proj)
            .env("TERMAXA_HOME", &home)
            .env("NO_COLOR", "1")
            .env("CLAUDE_CODE_SHELL", value)
            .stdin(Stdio::null())
            .output()
            .expect("the binary must be runnable");
        (
            String::from_utf8_lossy(&out.stdout).to_string(),
            String::from_utf8_lossy(&out.stderr).to_string(),
        )
    };

    let (stdout, stderr) = run("/opt/homebrew/bin/bash");
    assert!(
        stdout.contains(&format!("claude={}", shim.display())),
        "an outside value is overridden: {stdout}"
    );
    assert!(
        stderr.contains("CLAUDE_CODE_SHELL was /opt/homebrew/bin/bash; set to"),
        "and the override is said: {stderr}"
    );

    // The operator pointing at one of the shims is choosing a shell inside
    // the gate, and is kept - the sh shim exists on every machine.
    let own = shims.join("sh");
    let (stdout, stderr) = run(&own.display().to_string());
    assert!(
        stdout.contains(&format!("claude={}", own.display())),
        "the operator's own shim is kept: {stdout}"
    );
    assert!(
        !stderr.contains("CLAUDE_CODE_SHELL was"),
        "and nothing is said: {stderr}"
    );
}

/// The fail-mode knob. A payload that looks like a shell tool call but that
/// the reader cannot parse passes through by default (exit 0, no decision),
/// exactly as it always did; under `unrecognised: deny` it is refused with a
/// reason and exit 2. An unrelated payload is never refused, and a payload
/// the reader does understand is judged as before.
#[test]
fn an_unrecognised_shell_event_passes_through_by_default_and_is_refused_by_policy() {
    let tmp = scratch("unrecognised");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    let renamed = format!(
        r#"{{"cwd": {}, "event": "beforeShellRun", "tool": {{"name": "shell", "args": {{"command": "rm -rf /"}}}}}}"#,
        serde_json::to_string(&proj.display().to_string()).unwrap()
    );
    let unrelated = format!(
        r#"{{"cwd": {}, "event": "fileRead", "path": "src/main.rs"}}"#,
        serde_json::to_string(&proj.display().to_string()).unwrap()
    );
    let readable = format!(
        r#"{{"cwd": {}, "hook_event_name": "PreToolUse", "tool_name": "Bash", "tool_input": {{"command": "exit 3"}}}}"#,
        serde_json::to_string(&proj.display().to_string()).unwrap()
    );

    let out = termaxa(&home, &proj, &["hook"], &renamed);
    assert_eq!(
        out.code, 0,
        "default: pass through\nstdout {}\nstderr {}",
        out.stdout, out.stderr
    );
    assert!(
        out.stdout.trim().is_empty(),
        "default: no decision rendered: {}",
        out.stdout
    );

    let policy = proj.join(".termaxa").join("policy.yaml");
    let mut text = std::fs::read_to_string(&policy).unwrap();
    text.push_str("unrecognised: deny\n");
    std::fs::write(&policy, text).unwrap();

    let out = termaxa(&home, &proj, &["hook"], &renamed);
    assert_eq!(
        out.code, 2,
        "deny: refused\nstdout {}\nstderr {}",
        out.stdout, out.stderr
    );
    assert!(
        out.stdout.contains("\"deny\""),
        "deny rendered: {}",
        out.stdout
    );
    assert!(
        out.stdout.contains("not recognised"),
        "the reason says why: {}",
        out.stdout
    );

    let out = termaxa(&home, &proj, &["hook"], &unrelated);
    assert_eq!(
        out.code, 0,
        "an unrelated event is not a shell call: {}",
        out.stdout
    );
    assert!(out.stdout.trim().is_empty(), "{}", out.stdout);

    let out = termaxa(&home, &proj, &["hook"], &readable);
    assert_eq!(
        out.code, 0,
        "a readable payload is judged as before: {}{}",
        out.stdout, out.stderr
    );
    assert!(
        out.stdout.contains("\"allow\""),
        "exit* is allowed by the fixture: {}",
        out.stdout
    );
}

/// The insurance knob. A backup that cannot be taken proceeds with a warning
/// by default - the approved command runs uninsured; under `backup_failure:
/// deny` the command is refused and the target survives. A socket inside
/// the target is a copy that fails the way `/dev/null` did in #61.
#[cfg(unix)]
#[test]
fn a_failed_backup_proceeds_by_default_and_is_refused_by_policy() {
    let tmp = scratch("backup-failure");
    let (home, proj) = (tmp.join("home"), project(&tmp));
    let make_target = || {
        let junk = proj.join("junk");
        let _ = std::fs::remove_dir_all(&junk);
        std::fs::create_dir_all(&junk).unwrap();
        std::fs::write(junk.join("keep.txt"), "x").unwrap();
        // A socket: `fs::copy` cannot open it, so the copy fails at once.
        let sock = std::os::unix::net::UnixListener::bind(junk.join("sock"))
            .expect("the fixture needs a socket");
        std::mem::forget(sock);
        junk
    };

    let junk = make_target();
    let out = termaxa_tty(&home, &proj, &["run", "--", "rm", "-rf", "./junk"], "y\n");
    assert!(
        !junk.exists(),
        "default: the approved delete ran uninsured\n{}{}",
        out.stdout,
        out.stderr
    );
    assert!(
        out.stderr.contains("proceeding"),
        "default: the failure is reported: {}",
        out.stderr
    );

    let policy = proj.join(".termaxa").join("policy.yaml");
    let mut text = std::fs::read_to_string(&policy).unwrap();
    text.push_str("backup_failure: deny\n");
    std::fs::write(&policy, text).unwrap();

    let junk = make_target();
    let out = termaxa_tty(&home, &proj, &["run", "--", "rm", "-rf", "./junk"], "y\n");
    assert!(
        junk.exists(),
        "deny: the uninsured delete did not run\n{}{}",
        out.stdout,
        out.stderr
    );
    assert!(
        out.stderr.contains("backup_failure: deny"),
        "the refusal names the knob: {}",
        out.stderr
    );
}