aaronrene / overseer-kit public
test_cli_least_privilege.py python
32 lines 1.1 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 3 days ago
1 """Security tests — CLI least privilege (read-only VCS)."""
2
3 from __future__ import annotations
4
5 from pathlib import Path
6
7 from tests.support import git_status_runner, muse_status_runner, run_cli
8
9 WRITE_VERBS = ("commit", "push", "checkout", "add", "mirror", "realign")
10
11
12 def test_init_sync_status_never_invoke_write_verbs(tmp_path: Path) -> None:
13 runner = git_status_runner()
14 run_cli(["init", "--regime", "git-only", "--non-interactive"], cwd=tmp_path, runner=runner)
15 run_cli(["sync", "-y"], cwd=tmp_path, runner=runner)
16 run_cli(["status"], cwd=tmp_path, runner=runner)
17 for command, _cwd in runner.calls:
18 for verb in WRITE_VERBS:
19 assert verb not in command.lower()
20
21
22 def test_muse_only_status_never_invokes_git(tmp_path: Path) -> None:
23 from tests.support import FIXTURES
24
25 runner = muse_status_runner(tmp_path)
26 run_cli(
27 ["init", "--from-config", str(FIXTURES / "config-muse-only.yaml"), "--non-interactive"],
28 cwd=tmp_path,
29 runner=runner,
30 )
31 run_cli(["status"], cwd=tmp_path, runner=runner)
32 assert all("git " not in call[0] for call in runner.calls)
File History 2 commits
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 3 days ago
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 55 days ago