mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
Renn F
236aab18f5
Renames the smoke-replay loop variable mypy 2.3's stricter narrowing rejects (the uv.lock bump made this the promotion blocker), renames _ReleaseContext.default_branch to prod_branch to match what it holds since the env ladder, extends the Makefile-gated guard to bare uv sync on both runtimes (shared-cache poisoning is the race the guard exists for), and lists ROBOCO_TELEGRAM_ENABLED in both compose files (byte-identical).
34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
"""Grok native --deny covers raw package-manager commands (Makefile guardrail).
|
|
|
|
Native ``--deny`` is graceful on grok (the model gets a permission error and
|
|
adapts to ``make``; the run continues — unlike a hook deny, which cancels the
|
|
whole run). So raw-PM commands are denied via ``_RAW_PM_DENY`` in
|
|
``_deny_rules()``, mirroring ``_GIT_MUTATE_DENY``. The bash-guard hook handles
|
|
only the compound-command case the globs miss, and there
|
|
``ROBOCO_GUARD_SKIP_PM=1`` nudges instead of canceling.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from roboco.llm.providers.grok_cli_config import _RAW_PM_DENY, _deny_rules
|
|
|
|
|
|
def test_raw_pm_deny_rules_present() -> None:
|
|
rules = _deny_rules("developer")
|
|
assert "Bash(uv run*)" in rules
|
|
assert "Bash(uv sync*)" in rules
|
|
assert "Bash(uv pip install*)" in rules
|
|
assert "Bash(pip install*)" in rules
|
|
assert "Bash(conda install*)" in rules
|
|
assert "Bash(poetry run*)" in rules
|
|
|
|
|
|
def test_raw_pm_deny_is_subset_of_deny_rules() -> None:
|
|
rules = set(_deny_rules("developer"))
|
|
assert set(_RAW_PM_DENY) <= rules
|
|
|
|
|
|
def test_raw_pm_deny_only_for_bash_roles() -> None:
|
|
"""Non-bash roles have bash removed entirely — no deny rules at all."""
|
|
assert _deny_rules("auditor") == []
|