test_sentinel.py

"""Tests for sentinel.py — core evaluation loop, no Ollama required."""

import json
import os
import sys
import subprocess
import pytest
from unittest.mock import patch, MagicMock

# Import sentinel module
sys.path.insert(0, os.path.dirname(__file__))
import sentinel


def run_sentinel(event_json: str, config_dir: str = None, env_extra: dict = None) -> str:
    """Run sentinel.py with event on stdin, return stdout."""
    env = os.environ.copy()
    if config_dir:
        env["SENTINEL_CONFIG_DIR"] = config_dir
    if env_extra:
        env.update(env_extra)
    proc = subprocess.run(
        [sys.executable, "sentinel.py"],
        input=event_json, capture_output=True, text=True, env=env,
        cwd=os.path.dirname(os.path.abspath(__file__)),
    )
    return proc.stdout


def run_sentinel_post(event_json: str, config_dir: str = None, env_extra: dict = None) -> str:
    """Run sentinel.py --post with event on stdin, return stdout."""
    env = os.environ.copy()
    if config_dir:
        env["SENTINEL_CONFIG_DIR"] = config_dir
    if env_extra:
        env.update(env_extra)
    proc = subprocess.run(
        [sys.executable, "sentinel.py", "--post"],
        input=event_json, capture_output=True, text=True, env=env,
        cwd=os.path.dirname(os.path.abspath(__file__)),
    )
    return proc.stdout


# ── Fixtures ───────────────────────────────────────────────────────

@pytest.fixture
def default_config():
    return {
        **sentinel.DEFAULTS,
        "rules_dir": "/tmp/sentinel-test-rules",
        "model": "gemma3:4b",
        "ollama_url": "http://localhost:11434",
        "timeout_ms": 5000,
        "confidence_threshold": 0.7,
        "max_parallel": 4,
        "ollama_concurrency": 1,
        "fail_open": True,
        "content_max_chars": 800,
        "log_file": None,
    }


@pytest.fixture
def file_write_event():
    return {
        "tool_name": "Write",
        "tool_input": {
            "file_path": "/repo/src/core/billing/payment.ts",
            "content": "export function charge(amount: number) { return amount * 1.1; }",
        },
    }


@pytest.fixture
def bash_event():
    return {
        "tool_name": "Bash",
        "tool_input": {"command": "git push --force origin main"},
    }


@pytest.fixture
def mcp_event():
    return {
        "tool_name": "mcp__postgres-prod__sql_execute",
        "tool_input": {"query": "DROP TABLE users;"},
    }


@pytest.fixture
def block_rule():
    return {
        "id": "test-block",
        "trigger": "file_write",
        "severity": "block",
        "scope": ["src/core/billing/**"],
        "exclude": ["**/*.test.ts"],
        "prompt": "FILE: {{file_path}}\nCONTENT: {{content_snippet}}\nViolation?\n"
                  '{"violation": true/false, "confidence": 0.0-1.0, "reason": "one line"}',
    }


@pytest.fixture
def warn_rule():
    return {
        "id": "test-warn",
        "trigger": "file_write",
        "severity": "warn",
        "scope": ["**"],
        "exclude": [],
        "prompt": "FILE: {{file_path}}\nCheck.\n"
                  '{"violation": true/false, "confidence": 0.0-1.0, "reason": "one line"}',
    }


@pytest.fixture
def bash_rule():
    return {
        "id": "dangerous-commands",
        "trigger": "bash",
        "severity": "block",
        "scope": ["git push --force*", "*rm -rf*"],
        "exclude": ["*--dry-run*"],
        "prompt": "COMMAND: {{command}}\nDangerous?\n"
                  '{"violation": true/false, "confidence": 0.0-1.0, "reason": "one line"}',
    }


# ── 1. Event Parsing ──────────────────────────────────────────────


class TestParseEvent:
    def test_write_tool(self, file_write_event):
        ev = sentinel.parse_event(file_write_event)
        assert ev["trigger"] == "file_write"
        assert ev["template_vars"]["tool_name"] == "Write"
        assert "payment.ts" in ev["template_vars"]["file_path"]
        assert ev["template_vars"]["content_snippet"].startswith("export function")
        assert ev["template_vars"]["content_length"] == str(len(file_write_event["tool_input"]["content"]))

    def test_edit_tool(self):
        ev = sentinel.parse_event({
            "tool_name": "Edit",
            "tool_input": {"file_path": "/repo/app.py", "new_string": "x = 1"},
        })
        assert ev["trigger"] == "file_write"
        assert "app.py" in ev["template_vars"]["file_path"]
        # Edit uses new_string for content
        assert ev["template_vars"]["content_snippet"] == "x = 1"

    def test_notebook_edit_tool(self):
        ev = sentinel.parse_event({
            "tool_name": "NotebookEdit",
            "tool_input": {"file_path": "/repo/nb.ipynb", "content": "print('hi')"},
        })
        assert ev["trigger"] == "file_write"

    def test_bash_tool(self, bash_event):
        ev = sentinel.parse_event(bash_event)
        assert ev["trigger"] == "bash"
        assert ev["template_vars"]["command"] == "git push --force origin main"
        assert "Execute:" in ev["template_vars"]["action_summary"]

    def test_mcp_tool(self, mcp_event):
        ev = sentinel.parse_event(mcp_event)
        assert ev["trigger"] == "mcp"
        assert ev["template_vars"]["server_name"] == "postgres-prod"
        assert ev["template_vars"]["mcp_tool"] == "sql_execute"
        assert "postgres-prod:sql_execute" in ev["match_targets"]
        assert "sql_execute" in ev["match_targets"]
        assert "postgres-prod" in ev["match_targets"]

    def test_unknown_tool(self):
        ev = sentinel.parse_event({"tool_name": "SomeFutureTool", "tool_input": {}})
        assert ev["trigger"] == "unknown"
        assert ev["template_vars"]["tool_name"] == "SomeFutureTool"

    def test_path_relativization(self):
        with patch("os.getcwd", return_value="/repo"):
            ev = sentinel.parse_event({
                "tool_name": "Write",
                "tool_input": {"file_path": "/repo/src/main.ts", "content": "x"},
            })
            assert ev["template_vars"]["file_path"] == "src/main.ts"
            assert ev["match_targets"] == ["src/main.ts"]

    def test_empty_tool_input(self):
        ev = sentinel.parse_event({"tool_name": "Write", "tool_input": {}})
        assert ev["trigger"] == "file_write"
        assert ev["template_vars"]["file_path"] == ""


class TestNormalizeInput:
    """Test input normalization across agent formats."""

    def test_claude_code_format(self):
        data = {"tool_name": "Write", "tool_input": {"file_path": "/x", "content": "y"}}
        normalized, fmt = sentinel.normalize_input(data)
        assert fmt == "claude_code"
        assert normalized["tool_name"] == "Write"
        assert normalized["tool_input"]["file_path"] == "/x"

    def test_copilot_format_string_args(self):
        data = {"toolName": "bash", "toolArgs": '{"command": "ls -la"}'}
        normalized, fmt = sentinel.normalize_input(data)
        assert fmt == "copilot"
        assert normalized["tool_name"] == "bash"
        assert normalized["tool_input"]["command"] == "ls -la"

    def test_copilot_format_empty_args(self):
        data = {"toolName": "create_file", "toolArgs": "{}"}
        normalized, fmt = sentinel.normalize_input(data)
        assert fmt == "copilot"
        assert normalized["tool_input"] == {}

    def test_copilot_format_invalid_json_args(self):
        data = {"toolName": "bash", "toolArgs": "not json"}
        normalized, fmt = sentinel.normalize_input(data)
        assert fmt == "copilot"
        assert normalized["tool_input"] == {}

    def test_copilot_format_object_args(self):
        """toolArgs might already be an object in some versions."""
        data = {"toolName": "bash", "toolArgs": {"command": "echo hi"}}
        normalized, fmt = sentinel.normalize_input(data)
        assert fmt == "copilot"
        assert normalized["tool_input"]["command"] == "echo hi"

    def test_unknown_format(self):
        data = {"action": "something", "params": {}}
        normalized, fmt = sentinel.normalize_input(data)
        assert fmt == "unknown"

    def test_copilot_end_to_end(self):
        """Full flow: Copilot input → normalize → parse_event."""
        data = {"toolName": "run_in_terminal", "toolArgs": '{"command": "npm test"}'}
        normalized, fmt = sentinel.normalize_input(data)
        ev = sentinel.parse_event(normalized)
        assert ev["trigger"] == "bash"
        assert ev["template_vars"]["command"] == "npm test"


class TestFormatDecision:
    """Test output formatting for different agent formats."""

    def test_claude_code_block(self):
        output = json.loads(sentinel.format_decision("blocked", blockers=True, agent_format="claude_code"))
        assert output["hookSpecificOutput"]["permissionDecision"] == "deny"
        assert output["hookSpecificOutput"]["hookEventName"] == "PreToolUse"
        assert output["hookSpecificOutput"]["permissionDecisionReason"] == "blocked"

    def test_claude_code_warn(self):
        output = json.loads(sentinel.format_decision("warning", blockers=False, agent_format="claude_code"))
        assert "additionalContext" in output["hookSpecificOutput"]
        assert "permissionDecision" not in output["hookSpecificOutput"]

    def test_copilot_block(self):
        output = json.loads(sentinel.format_decision("blocked", blockers=True, agent_format="copilot"))
        assert output["permissionDecision"] == "deny"
        assert output["permissionDecisionReason"] == "blocked"
        assert "hookSpecificOutput" not in output

    def test_copilot_warn(self):
        output = json.loads(sentinel.format_decision("warning", blockers=False, agent_format="copilot"))
        assert output["permissionDecision"] == "allow"
        assert output["permissionDecisionReason"] == "warning"

    def test_unknown_format_defaults_to_claude_code(self):
        output = json.loads(sentinel.format_decision("err", blockers=True, agent_format="unknown"))
        assert "hookSpecificOutput" in output


class TestParseEventMultiAgent:
    """Test configurable tool_map for non-Claude Code agents."""

    def test_cursor_edit_file(self):
        ev = sentinel.parse_event(
            {"tool_name": "edit_file", "tool_input": {"file_path": "/repo/app.ts", "content": "x"}},
        )
        assert ev["trigger"] == "file_write"

    def test_cursor_terminal(self):
        ev = sentinel.parse_event(
            {"tool_name": "run_terminal_cmd", "tool_input": {"command": "npm test"}},
        )
        assert ev["trigger"] == "bash"

    def test_windsurf_write(self):
        ev = sentinel.parse_event(
            {"tool_name": "write_to_file", "tool_input": {"file_path": "/repo/x.py", "content": "y"}},
        )
        assert ev["trigger"] == "file_write"

    def test_windsurf_command(self):
        ev = sentinel.parse_event(
            {"tool_name": "run_command", "tool_input": {"command": "ls"}},
        )
        assert ev["trigger"] == "bash"

    def test_cline_replace(self):
        ev = sentinel.parse_event(
            {"tool_name": "replace_in_file", "tool_input": {"file_path": "/repo/a.js", "content": "z"}},
        )
        assert ev["trigger"] == "file_write"

    def test_cline_execute(self):
        ev = sentinel.parse_event(
            {"tool_name": "execute_command", "tool_input": {"command": "git status"}},
        )
        assert ev["trigger"] == "bash"

    def test_copilot_create_file(self):
        ev = sentinel.parse_event(
            {"tool_name": "create_file", "tool_input": {"file_path": "/repo/new.ts", "content": "hi"}},
        )
        assert ev["trigger"] == "file_write"

    def test_copilot_terminal(self):
        ev = sentinel.parse_event(
            {"tool_name": "run_in_terminal", "tool_input": {"command": "make build"}},
        )
        assert ev["trigger"] == "bash"

    def test_amazon_q_fs_write(self):
        ev = sentinel.parse_event(
            {"tool_name": "fs_write", "tool_input": {"file_path": "/repo/f.py", "content": "x"}},
        )
        assert ev["trigger"] == "file_write"

    def test_amazon_q_execute_bash(self):
        ev = sentinel.parse_event(
            {"tool_name": "execute_bash", "tool_input": {"command": "echo hi"}},
        )
        assert ev["trigger"] == "bash"

    def test_cursor_mcp_prefix(self):
        """Cursor uses mcp_ prefix with single underscore separator."""
        config = dict(sentinel.DEFAULTS)
        config["mcp_prefix"] = "mcp_"
        config["mcp_separator"] = "_"
        ev = sentinel.parse_event(
            {"tool_name": "mcp_github_create_issue", "tool_input": {"title": "bug"}},
            config=config,
        )
        assert ev["trigger"] == "mcp"
        assert ev["template_vars"]["server_name"] == "github"
        assert ev["template_vars"]["mcp_tool"] == "create_issue"

    def test_custom_tool_map_override(self):
        """User can add custom tool names via config."""
        config = dict(sentinel.DEFAULTS)
        config["tool_map"] = {"my_custom_write": "file_write", "my_shell": "bash"}
        ev = sentinel.parse_event(
            {"tool_name": "my_custom_write", "tool_input": {"file_path": "/x", "content": "y"}},
            config=config,
        )
        assert ev["trigger"] == "file_write"


# ── 2. Rule Matching ──────────────────────────────────────────────


class TestRuleMatching:
    def test_trigger_filter_match(self, block_rule):
        event = {"trigger": "file_write", "match_targets": ["src/core/billing/pay.ts"]}
        assert sentinel.rule_matches(block_rule, event) is True

    def test_trigger_filter_mismatch(self, block_rule):
        event = {"trigger": "bash", "match_targets": ["src/core/billing/pay.ts"]}
        assert sentinel.rule_matches(block_rule, event) is False

    def test_trigger_any_matches_all(self):
        rule = {"trigger": "any", "scope": ["**"], "exclude": []}
        assert sentinel.rule_matches(rule, {"trigger": "file_write", "match_targets": ["x"]}) is True
        assert sentinel.rule_matches(rule, {"trigger": "bash", "match_targets": ["x"]}) is True
        assert sentinel.rule_matches(rule, {"trigger": "mcp", "match_targets": ["x"]}) is True

    def test_scope_glob_match(self, block_rule):
        event = {"trigger": "file_write", "match_targets": ["src/core/billing/invoice.ts"]}
        assert sentinel.rule_matches(block_rule, event) is True

    def test_scope_glob_no_match(self, block_rule):
        event = {"trigger": "file_write", "match_targets": ["src/core/auth/login.ts"]}
        assert sentinel.rule_matches(block_rule, event) is False

    def test_exclude_overrides_scope(self, block_rule):
        event = {"trigger": "file_write", "match_targets": ["src/core/billing/pay.test.ts"]}
        assert sentinel.rule_matches(block_rule, event) is False

    def test_default_scope_matches_everything(self):
        rule = {"trigger": "any", "scope": ["**"], "exclude": []}
        assert sentinel.rule_matches(rule, {"trigger": "bash", "match_targets": ["anything"]}) is True

    def test_no_targets_no_match(self, block_rule):
        event = {"trigger": "file_write", "match_targets": []}
        assert sentinel.rule_matches(block_rule, event) is False


class TestGlobMatch:
    def test_exact_match(self):
        assert sentinel._glob_match("src/main.ts", "src/main.ts") is True

    def test_wildcard(self):
        assert sentinel._glob_match("src/main.ts", "src/*.ts") is True

    def test_double_star_prefix(self):
        assert sentinel._glob_match("src/core/billing/pay.ts", "**/*.ts") is True

    def test_double_star_strips_prefix(self):
        assert sentinel._glob_match("pay.ts", "**/*.ts") is True

    def test_no_match(self):
        assert sentinel._glob_match("src/main.py", "**/*.ts") is False

    def test_bash_scope_pattern(self):
        assert sentinel._glob_match("git push --force origin main", "git push --force*") is True

    def test_bash_scope_no_match(self):
        assert sentinel._glob_match("git status", "git push --force*") is False


# ── 3. Prompt Rendering ──────────────────────────────────────────


class TestRenderPrompt:
    def test_variable_substitution(self, block_rule, default_config):
        event = {
            "template_vars": {
                "file_path": "src/billing/pay.ts",
                "content_snippet": "const x = 1;",
            }
        }
        result = sentinel.render_prompt(block_rule, event, default_config)
        assert "src/billing/pay.ts" in result
        assert "const x = 1;" in result
        assert "{{file_path}}" not in result

    def test_missing_variable_left_as_is(self, default_config):
        rule = {"prompt": "Value: {{nonexistent}}"}
        event = {"template_vars": {}}
        result = sentinel.render_prompt(rule, event, default_config)
        assert "{{nonexistent}}" in result

    def test_content_truncation(self, default_config):
        default_config["content_max_chars"] = 10
        rule = {"prompt": "CONTENT: {{content_snippet}}"}
        event = {"template_vars": {"content_snippet": "a" * 100}}
        result = sentinel.render_prompt(rule, event, default_config)
        # The first substitution uses the full snippet, but the truncation
        # logic in render_prompt re-truncates if {{content_snippet}} was in template
        assert len(result) < 200


# ── 4. Output Formatting ─────────────────────────────────────────


class TestFormatReport:
    def test_single_blocker(self):
        violations = [{"rule_id": "r1", "severity": "block", "confidence": 0.92, "reason": "bad"}]
        report = sentinel.format_report(violations)
        assert "SENTINEL: action blocked" in report
        assert "[r1]" in report
        assert "92%" in report

    def test_single_warning(self):
        violations = [{"rule_id": "r1", "severity": "warn", "confidence": 0.75, "reason": "meh"}]
        report = sentinel.format_report(violations)
        assert "SENTINEL: warnings" in report
        assert "[r1]" in report
        assert "75%" in report

    def test_mixed_block_and_warn(self):
        violations = [
            {"rule_id": "r1", "severity": "block", "confidence": 0.9, "reason": "blocked"},
            {"rule_id": "r2", "severity": "warn", "confidence": 0.7, "reason": "warned"},
        ]
        report = sentinel.format_report(violations)
        assert "SENTINEL: action blocked" in report
        assert "SENTINEL: warnings" in report
        assert "[r1]" in report
        assert "[r2]" in report

    def test_empty_violations(self):
        report = sentinel.format_report([])
        assert report == ""

    def test_confidence_formatting(self):
        violations = [{"rule_id": "r1", "severity": "block", "confidence": 1.0, "reason": "sure"}]
        report = sentinel.format_report(violations)
        assert "100%" in report


# ── 5. LLM Evaluation (mocked via sentinel_backends) ───────────


class TestEvaluateRule:
    def _llm_response(self, violation, confidence, reason):
        return json.dumps({"violation": violation, "confidence": confidence, "reason": reason})

    def test_violation_above_threshold(self, block_rule, default_config):
        with patch("sentinel.call_llm", return_value=self._llm_response(True, 0.9, "secret detected")):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        assert result is not None
        assert result["rule_id"] == "test-block"
        assert result["severity"] == "block"
        assert result["confidence"] == 0.9
        assert result["reason"] == "secret detected"

    def test_violation_below_threshold(self, block_rule, default_config):
        with patch("sentinel.call_llm", return_value=self._llm_response(True, 0.3, "maybe")):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        assert result is None

    def test_no_violation(self, block_rule, default_config):
        with patch("sentinel.call_llm", return_value=self._llm_response(False, 0.95, "looks clean")):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        assert result is None

    def test_timeout_fail_open(self, block_rule, default_config):
        default_config["fail_open"] = True
        with patch("sentinel.call_llm", side_effect=ConnectionError("timed out")):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        assert result is None

    def test_timeout_fail_closed(self, block_rule, default_config):
        default_config["fail_open"] = False
        with patch("sentinel.call_llm", side_effect=ConnectionError("timed out")):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        assert result is not None
        assert result["severity"] == "block"
        assert result.get("error") is True

    def test_offline_fail_open(self, block_rule, default_config):
        default_config["fail_open"] = True
        from urllib.error import URLError
        with patch("sentinel.call_llm", side_effect=URLError("connection refused")):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        assert result is None

    def test_offline_fail_closed(self, block_rule, default_config):
        default_config["fail_open"] = False
        from urllib.error import URLError
        with patch("sentinel.call_llm", side_effect=URLError("connection refused")):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        assert result is not None
        assert result.get("error") is True

    def test_malformed_json_response(self, block_rule, default_config):
        with patch("sentinel.call_llm", return_value="not json at all"):
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            result = sentinel.evaluate_rule(block_rule, event, default_config)
        # fail_open=True by default → None
        assert result is None

    def test_per_rule_model_override(self, block_rule, default_config):
        block_rule["model"] = "llama3:8b"
        with patch("sentinel.call_llm", return_value=self._llm_response(False, 0.9, "ok")) as mock_llm:
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            sentinel.evaluate_rule(block_rule, event, default_config)
            # call_llm(prompt, system_prompt, model, backend, config, ...)
            assert mock_llm.call_args[0][2] == "llama3:8b"

    def test_per_rule_backend_override(self, block_rule, default_config):
        block_rule["backend"] = "claude"
        block_rule["model"] = "haiku"
        with patch("sentinel.call_llm", return_value=self._llm_response(False, 0.9, "ok")) as mock_llm:
            event = {"trigger": "file_write", "template_vars": {"file_path": "x", "content_snippet": "y"}}
            sentinel.evaluate_rule(block_rule, event, default_config)
            # call_llm(prompt, system_prompt, model, backend, config, ...)
            assert mock_llm.call_args[0][2] == "haiku"
            assert mock_llm.call_args[0][3] == "claude"


# ── 6. Config and Rule Loading ────────────────────────────────────


class TestLoadConfig:
    def test_defaults_applied(self, tmp_path):
        config_dir = str(tmp_path)
        config = sentinel.load_config(config_dir)
        assert config["model"] == "gemma3:4b"
        assert config["fail_open"] is True
        assert config["confidence_threshold"] == 0.7

    def test_config_file_overrides(self, tmp_path):
        cfg_file = tmp_path / "config.yaml"
        cfg_file.write_text("model: llama3:8b\nfail_open: false\n")
        config = sentinel.load_config(str(tmp_path))
        assert config["model"] == "llama3:8b"
        assert config["fail_open"] is False

    def test_rules_dir_resolved(self, tmp_path):
        config = sentinel.load_config(str(tmp_path))
        assert config["rules_dir"] == os.path.join(str(tmp_path), "rules")


class TestLoadRules:
    def test_loads_valid_rule(self, tmp_path):
        rules_dir = tmp_path / "rules"
        rules_dir.mkdir()
        (rules_dir / "test.yaml").write_text(
            "id: test-rule\ntrigger: bash\nseverity: block\nprompt: check\n"
        )
        rules = sentinel.load_rules(str(rules_dir))
        assert len(rules) == 1
        assert rules[0]["id"] == "test-rule"
        assert rules[0]["trigger"] == "bash"

    def test_applies_defaults(self, tmp_path):
        rules_dir = tmp_path / "rules"
        rules_dir.mkdir()
        (rules_dir / "minimal.yaml").write_text("prompt: check this\n")
        rules = sentinel.load_rules(str(rules_dir))
        assert len(rules) == 1
        assert rules[0]["id"] == "minimal"
        assert rules[0]["trigger"] == "any"
        assert rules[0]["severity"] == "block"
        assert rules[0]["scope"] == ["**"]

    def test_skips_malformed_files(self, tmp_path):
        rules_dir = tmp_path / "rules"
        rules_dir.mkdir()
        (rules_dir / "bad.yaml").write_text(": : : invalid yaml [[[")
        (rules_dir / "good.yaml").write_text("prompt: check\n")
        rules = sentinel.load_rules(str(rules_dir))
        assert len(rules) == 1
        assert rules[0]["id"] == "good"

    def test_ignores_non_yaml_files(self, tmp_path):
        rules_dir = tmp_path / "rules"
        rules_dir.mkdir()
        (rules_dir / "readme.md").write_text("# not a rule")
        (rules_dir / ".gitkeep").write_text("")
        rules = sentinel.load_rules(str(rules_dir))
        assert len(rules) == 0

    def test_empty_dir(self, tmp_path):
        rules_dir = tmp_path / "rules"
        rules_dir.mkdir()
        assert sentinel.load_rules(str(rules_dir)) == []

    def test_missing_dir(self):
        assert sentinel.load_rules("/nonexistent/path") == []


# ── 7. Rule Validation ───────────────────────────────────────────


class TestValidateRule:
    def test_valid_rule_no_warnings(self):
        rule = {
            "id": "good-rule",
            "trigger": "bash",
            "severity": "block",
            "scope": ["*rm*"],
            "prompt": "COMMAND: {{command}}\nDangerous?",
        }
        assert sentinel.validate_rule(rule, "good-rule.yaml") == []

    def test_missing_prompt(self):
        warnings = sentinel.validate_rule({"trigger": "bash"}, "bad.yaml")
        assert any("prompt" in w for w in warnings)

    def test_unknown_trigger(self):
        warnings = sentinel.validate_rule({"trigger": "http", "prompt": "x"}, "bad.yaml")
        assert any("trigger" in w and "http" in w for w in warnings)

    def test_unknown_severity(self):
        warnings = sentinel.validate_rule({"severity": "error", "prompt": "x"}, "bad.yaml")
        assert any("severity" in w and "error" in w for w in warnings)

    def test_scope_not_a_list(self):
        warnings = sentinel.validate_rule({"scope": "*.ts", "prompt": "x"}, "bad.yaml")
        assert any("scope" in w and "list" in w for w in warnings)

    def test_exclude_not_a_list(self):
        warnings = sentinel.validate_rule({"exclude": "*.test.ts", "prompt": "x"}, "bad.yaml")
        assert any("exclude" in w and "list" in w for w in warnings)

    def test_unknown_template_variable(self):
        rule = {"trigger": "bash", "prompt": "{{command}} {{typo_var}}"}
        warnings = sentinel.validate_rule(rule, "bad.yaml")
        assert any("typo_var" in w for w in warnings)

    def test_valid_template_vars_for_trigger(self):
        rule = {"trigger": "file_write", "prompt": "{{file_path}} {{content_snippet}}"}
        assert sentinel.validate_rule(rule, "good.yaml") == []

    def test_any_trigger_accepts_all_vars(self):
        rule = {"trigger": "any", "prompt": "{{command}} {{file_path}} {{mcp_tool}}"}
        assert sentinel.validate_rule(rule, "good.yaml") == []

    def test_non_kebab_case_id(self):
        warnings = sentinel.validate_rule({"id": "Bad Rule", "prompt": "x"}, "bad.yaml")
        assert any("kebab-case" in w for w in warnings)

    def test_info_severity_is_valid(self):
        """severity: info should be accepted without validation warnings."""
        rule = {
            "prompt": "test prompt",
            "trigger": "file_write",
            "severity": "info",
            "scope": ["src/**"],
        }
        warnings = sentinel.validate_rule(rule, "test.yaml")
        assert not any("severity" in w for w in warnings)

    def test_info_post_field_accepted(self):
        """post: true should not produce validation warnings."""
        rule = {
            "prompt": "test prompt",
            "trigger": "file_write",
            "severity": "info",
            "post": True,
            "scope": ["src/**"],
        }
        warnings = sentinel.validate_rule(rule, "test.yaml")
        assert not warnings

    def test_info_post_requires_info_severity(self):
        """post: true on a block/warn rule should produce a warning."""
        rule = {
            "prompt": "test prompt",
            "trigger": "file_write",
            "severity": "block",
            "post": True,
            "scope": ["src/**"],
        }
        warnings = sentinel.validate_rule(rule, "test.yaml")
        assert any("post" in w for w in warnings)

    def test_info_post_template_vars_accepted(self):
        """{{tool_output}} and {{session_context}} should be valid for info post rules."""
        rule = {
            "prompt": "{{tool_output}} {{session_context}} check this",
            "trigger": "file_write",
            "severity": "info",
            "post": True,
            "scope": ["src/**"],
        }
        warnings = sentinel.validate_rule(rule, "test.yaml")
        assert not any("template variable" in w for w in warnings)

    def test_kebab_case_id_ok(self):
        warnings = sentinel.validate_rule({"id": "good-rule", "prompt": "x"}, "ok.yaml")
        assert not any("kebab-case" in w for w in warnings)


# ── 8. Main Decision Logic (integration) ─────────────────────────


class TestMainDecision:
    """Test the decision output format using format_report + JSON wrapping."""

    def test_no_violations_silent(self):
        """No violations → no output."""
        report = sentinel.format_report([])
        assert report == ""

    def test_block_violation_deny_output(self):
        violations = [{"rule_id": "r1", "severity": "block", "confidence": 0.95, "reason": "danger"}]
        report = sentinel.format_report(violations)
        output = json.dumps({
            "hookSpecificOutput": {
                "hookEventName": "PreToolUse",
                "permissionDecision": "deny",
                "permissionDecisionReason": report,
            }
        })
        parsed = json.loads(output)
        assert parsed["hookSpecificOutput"]["permissionDecision"] == "deny"
        assert "SENTINEL: action blocked" in parsed["hookSpecificOutput"]["permissionDecisionReason"]

    def test_warn_only_context_output(self):
        violations = [{"rule_id": "r1", "severity": "warn", "confidence": 0.8, "reason": "check this"}]
        report = sentinel.format_report(violations)
        output = json.dumps({
            "hookSpecificOutput": {
                "hookEventName": "PreToolUse",
                "additionalContext": report,
            }
        })
        parsed = json.loads(output)
        assert "additionalContext" in parsed["hookSpecificOutput"]
        assert "permissionDecision" not in parsed["hookSpecificOutput"]

    def test_mixed_blockers_take_precedence(self):
        violations = [
            {"rule_id": "r1", "severity": "block", "confidence": 0.9, "reason": "blocked"},
            {"rule_id": "r2", "severity": "warn", "confidence": 0.7, "reason": "warned"},
        ]
        blockers = any(v["severity"] == "block" for v in violations)
        assert blockers is True


# ── 9. _fail (unified error path) ───────────────────────────────


class TestFail:
    def test_fail_open_returns_none(self):
        rule = {"id": "r1"}
        config = {"fail_open": True}
        assert sentinel._fail(rule, "err", config) is None

    def test_fail_closed_returns_block(self):
        rule = {"id": "r1"}
        config = {"fail_open": False}
        result = sentinel._fail(rule, "err msg", config)
        assert result is not None
        assert result["rule_id"] == "r1"
        assert result["severity"] == "block"
        assert result["error"] is True

    def test_fail_with_event_logs(self):
        rule = {"id": "r1"}
        config = {"fail_open": True, "model": "test", "log_file": None}
        event = {"trigger": "bash", "template_vars": {}, "match_targets": []}
        assert sentinel._fail(rule, "offline", config, event, elapsed_ms=42) is None

    def test_fail_closed_preserves_reason(self):
        rule = {"id": "r1"}
        config = {"fail_open": False}
        result = sentinel._fail(rule, "Sentinel timeout: timed out", config)
        assert "timeout" in result["reason"]


class TestInfoRules:
    def test_info_rule_returns_additional_context(self, tmp_path):
        """Info rules on PreToolUse return additionalContext with rendered prompt, no LLM."""
        config_dir = tmp_path / ".claude" / "sentinel"
        rules_dir = config_dir / "rules"
        rules_dir.mkdir(parents=True)
        (config_dir / "config.yaml").write_text("model: gemma3:4b\n")
        (rules_dir / "ownership.yaml").write_text(
            'id: ownership\ntrigger: file_write\nseverity: info\nscope:\n  - "src/payments/**"\nprompt: |\n  Owned by Payments team. Contact: @payments-team\n'
        )
        event_json = json.dumps({
            "tool_name": "Write",
            "tool_input": {"file_path": "src/payments/charge.py", "content": "def charge(): pass"}
        })
        result = run_sentinel(event_json, config_dir=str(config_dir))
        output = json.loads(result)
        assert "hookSpecificOutput" in output
        assert "additionalContext" in output["hookSpecificOutput"]
        assert "Payments team" in output["hookSpecificOutput"]["additionalContext"]
        assert "permissionDecision" not in output["hookSpecificOutput"]

    def test_post_mode_filters_info_post_rules(self, tmp_path):
        """--post mode only evaluates rules with severity: info and post: true."""
        config_dir = tmp_path / ".claude" / "sentinel"
        rules_dir = config_dir / "rules"
        rules_dir.mkdir(parents=True)
        (config_dir / "config.yaml").write_text("model: gemma3:4b\n")

        # A block rule — should be ignored in --post mode
        (rules_dir / "block-rule.yaml").write_text(
            'id: block-rule\ntrigger: file_write\nseverity: block\nscope:\n  - "**"\nprompt: "Check this"\n')

        # An info rule without post — should be ignored in --post mode
        (rules_dir / "info-static.yaml").write_text(
            'id: info-static\ntrigger: file_write\nseverity: info\nscope:\n  - "**"\nprompt: "Static info"\n')

        # An info post rule — should be evaluated in --post mode
        (rules_dir / "info-post.yaml").write_text(
            'id: info-post\ntrigger: file_write\nseverity: info\npost: true\nscope:\n  - "**"\nprompt: "Domain knowledge: {{tool_output}} {{session_context}}"\n')

        event_json = json.dumps({
            "hook_event_name": "PostToolUse",
            "session_id": "test-session",
            "tool_name": "Write",
            "tool_input": {"file_path": "test.py", "content": "x = 1"},
            "tool_response": {"success": True}
        })

        # This test verifies filtering — block and info-static rules should be skipped.
        # Since Ollama may not be running, --post mode should exit silently (no output).
        # The important thing is it doesn't error or produce block/warn output.
        result = run_sentinel_post(event_json, config_dir=str(config_dir))
        # If Ollama is not running, result will be empty (fail-open for info)
        # If Ollama IS running, result should be additionalContext, never permissionDecision: deny
        if result.strip():
            output = json.loads(result)
            assert "permissionDecision" not in output.get("hookSpecificOutput", {}) or \
                   output["hookSpecificOutput"].get("permissionDecision") != "deny"

    def test_info_dedup_suppresses_repeat(self, tmp_path):
        """Same info rule + same target within TTL should be suppressed."""
        config_dir = tmp_path / ".claude" / "sentinel"
        rules_dir = config_dir / "rules"
        rules_dir.mkdir(parents=True)
        (config_dir / "config.yaml").write_text("model: gemma3:4b\n")
        (rules_dir / "ownership.yaml").write_text(
            'id: ownership\ntrigger: file_write\nseverity: info\nscope:\n  - "src/payments/**"\nprompt: |\n  Owned by Payments team.\n'
        )
        event_json = json.dumps({
            "session_id": "dedup-test",
            "tool_name": "Write",
            "tool_input": {"file_path": "src/payments/charge.py", "content": "x = 1"}
        })

        # First call — should produce output
        result1 = run_sentinel(event_json, config_dir=str(config_dir))
        assert result1.strip(), "First call should produce info output"

        # Second call with same rule + same target — should be suppressed
        result2 = run_sentinel(event_json, config_dir=str(config_dir))
        assert not result2.strip(), "Duplicate call should be suppressed"

    def test_info_dedup_allows_different_target(self, tmp_path):
        """Same info rule but different target should NOT be suppressed."""
        config_dir = tmp_path / ".claude" / "sentinel"
        rules_dir = config_dir / "rules"
        rules_dir.mkdir(parents=True)
        (config_dir / "config.yaml").write_text("model: gemma3:4b\n")
        (rules_dir / "ownership.yaml").write_text(
            'id: ownership\ntrigger: file_write\nseverity: info\nscope:\n  - "src/payments/**"\nprompt: |\n  Owned by Payments team.\n'
        )

        event1 = json.dumps({
            "session_id": "dedup-test-2",
            "tool_name": "Write",
            "tool_input": {"file_path": "src/payments/charge.py", "content": "x = 1"}
        })
        event2 = json.dumps({
            "session_id": "dedup-test-2",
            "tool_name": "Write",
            "tool_input": {"file_path": "src/payments/refund.py", "content": "y = 2"}
        })

        result1 = run_sentinel(event1, config_dir=str(config_dir))
        assert result1.strip(), "First target should produce output"

        result2 = run_sentinel(event2, config_dir=str(config_dir))
        assert result2.strip(), "Different target should also produce output"