| 1 | package planmode |
| 2 | |
| 3 | import ( |
| 4 | "strings" |
| 5 | "testing" |
| 6 | ) |
| 7 | |
| 8 | func TestMarkerStatesWorkflowAndPermissionBoundariesSeparately(t *testing.T) { |
| 9 | for _, want := range []string{ |
| 10 | "planning workflow", |
| 11 | "Do not begin implementation", |
| 12 | "not a permission boundary", |
| 13 | "Permissions and Sandbox", |
| 14 | "approve the plan before the workflow switches to implementation", |
| 15 | } { |
| 16 | if !strings.Contains(Marker, want) { |
| 17 | t.Fatalf("Marker missing %q: %s", want, Marker) |
| 18 | } |
| 19 | } |
| 20 | |
| 21 | for _, call := range []Call{ |
| 22 | {Name: "write_file"}, |
| 23 | {Name: "bash"}, |
| 24 | {Name: "task"}, |
| 25 | } { |
| 26 | if got := (Policy{}).Decide(call); got.Blocked { |
| 27 | t.Fatalf("Marker guidance must not become a security gate for %q: %+v", call.Name, got) |
| 28 | } |
| 29 | } |
| 30 | } |
| 31 | |
| 32 | func TestMarkerPhaseOptOutMatchesPolicy(t *testing.T) { |
| 33 | if got := (Policy{}).Decide(Call{Name: "complete_step", Safety: PlanSafetyUnsafe}); !got.Blocked { |
| 34 | t.Fatal("complete_step phase opt-out must remain enforced") |
| 35 | } |
| 36 | } |
| 37 |