hermes-agent/tests/hermes_cli/test_approvals_suggest.py

"""Tests for ``hermes approvals suggest`` (hermes_cli/approvals_suggest.py).

Approval history in Hermes is implied, not ledgered: the session DB
(state.db) stores every assistant ``terminal`` tool call plus its paired
``role='tool'`` result. A dangerous-classified command whose result is not a
BLOCKED/denied/pending marker ran with user consent. These tests build
synthetic state.db fixtures and verify scanning, ranking, safety exclusions,
and the --apply merge path.
"""

from __future__ import annotations

import json
import sqlite3
import time
from argparse import Namespace

import pytest

import tools.approval as approval_module
from hermes_cli.approvals_suggest import (
    Proposal,
    apply_proposals,
    build_proposals,
    derive_glob,
    is_unsafe_class,
    normalize_command,
    parse_apply_indices,
    scan_approval_history,
    suggest_command,
)


# ---------------------------------------------------------------------------
# Fixture helpers: synthetic session DB
# ---------------------------------------------------------------------------

def _make_db(path):
    con = sqlite3.connect(path)
    con.executescript(
        """
        CREATE TABLE messages (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            session_id TEXT NOT NULL,
            role TEXT NOT NULL,
            content TEXT,
            tool_call_id TEXT,
            tool_calls TEXT,
            timestamp REAL NOT NULL
        );
        """
    )
    con.commit()
    return con


_ID_COUNTER = [0]


def _add_terminal_call(con, command, result="ok: done", ts=None):
    """Insert an assistant terminal tool call + its paired tool result."""
    _ID_COUNTER[0] += 1
    call_id = f"call_{_ID_COUNTER[0]}"
    ts = ts if ts is not None else time.time()
    tool_calls = json.dumps(
        [
            {
                "id": call_id,
                "type": "function",
                "function": {
                    "name": "terminal",
                    "arguments": json.dumps({"command": command}),
                },
            }
        ]
    )
    con.execute(
        "INSERT INTO messages (session_id, role, content, tool_calls, timestamp) "
        "VALUES ('s1', 'assistant', '', ?, ?)",
        (tool_calls, ts),
    )
    con.execute(
        "INSERT INTO messages (session_id, role, content, tool_call_id, timestamp) "
        "VALUES ('s1', 'tool', ?, ?, ?)",
        (result, call_id, ts + 1),
    )
    con.commit()


@pytest.fixture
def db_path(tmp_path):
    path = tmp_path / "state.db"
    con = _make_db(path)
    yield path, con
    con.close()


@pytest.fixture
def isolated_allowlist(monkeypatch):
    """Fake config-backed allowlist store so no real config.yaml is touched."""
    store = {"patterns": set(), "saves": 0}

    def fake_load():
        return set(store["patterns"])

    def fake_save(patterns):
        store["patterns"] = set(patterns)
        store["saves"] += 1

    monkeypatch.setattr(approval_module, "load_permanent_allowlist", fake_load)
    monkeypatch.setattr(approval_module, "save_permanent_allowlist", fake_save)
    # apply_proposals also syncs into the in-process set; keep it isolated.
    saved = approval_module._permanent_approved.copy()
    approval_module._permanent_approved.clear()
    yield store
    approval_module._permanent_approved.clear()
    approval_module._permanent_approved.update(saved)


# ---------------------------------------------------------------------------
# Scan
# ---------------------------------------------------------------------------

class TestScan:
    def test_scan_finds_approved_dangerous_commands(self, db_path):
        path, con = db_path
        for _ in range(3):
            _add_terminal_call(con, "git push --force origin main")
        # A benign command never enters approval history.
        _add_terminal_call(con, "ls -la")
        records = scan_approval_history(path, days=0)
        commands = [c for c, _ in records]
        assert len(commands) == 3
        assert all("git push" in c for c in commands)

    def test_blocked_and_denied_results_are_not_approvals(self, db_path):
        path, con = db_path
        _add_terminal_call(
            con,
            "git push --force origin main",
            result="BLOCKED: User denied this potentially dangerous action",
        )
        _add_terminal_call(
            con,
            "docker restart web",
            result=(
                "⚠️ This action is potentially dangerous. "
                "Asking the user for approval."
            ),
        )
        assert scan_approval_history(path, days=0) == []

    def test_days_window_filters_old_history(self, db_path):
        path, con = db_path
        old_ts = time.time() - 200 * 86400
        _add_terminal_call(con, "git push --force origin main", ts=old_ts)
        _add_terminal_call(con, "git push --force origin main")
        assert len(scan_approval_history(path, days=90)) == 1
        assert len(scan_approval_history(path, days=0)) == 2

    def test_missing_db_returns_empty(self, tmp_path):
        assert scan_approval_history(tmp_path / "nope.db", days=0) == []


# ---------------------------------------------------------------------------
# Normalize / glob derivation
# ---------------------------------------------------------------------------

class TestNormalizeAndGlob:
    def test_normalize_folds_home_prefix(self):
        import os

        home = os.path.expanduser("~")
        normalized = normalize_command(f"git checkout -- {home}/project/file.txt")
        assert "~/project/file.txt" in normalized
        assert home not in normalized

    def test_derive_glob_uses_first_two_tokens(self):
        assert derive_glob("git push --force origin main") == "git push *"
        assert derive_glob("docker restart web") == "docker restart *"

    def test_derive_glob_flag_second_token_falls_back_to_root(self):
        assert derive_glob("hermes --yolo update") == "hermes --yolo".split()[0] + " *"

    def test_derive_glob_rejects_compound_commands(self):
        assert derive_glob("git push --force && rm -rf /tmp/x") is None
        assert derive_glob("echo hi; docker restart web") is None

    def test_derive_glob_never_anchors_unsafe_binaries(self):
        assert derive_glob("rm -rf ./build") is None
        assert derive_glob("sudo apt install foo") is None
        assert derive_glob("/bin/rm -rf ./build") is None
        assert derive_glob("mkfs.ext4 /dev/sdb1") is None


# ---------------------------------------------------------------------------
# Ranking + safety exclusion
# ---------------------------------------------------------------------------

class TestRankingAndSafety:
    def test_ranking_orders_by_frequency(self, db_path):
        path, con = db_path
        for _ in range(5):
            _add_terminal_call(con, "docker restart web")
        for _ in range(2):
            _add_terminal_call(con, "git push --force origin main")
        records = scan_approval_history(path, days=0)
        proposals = build_proposals(records, min_count=2)
        assert [p.pattern for p in proposals] == ["docker restart *", "git push *"]
        assert proposals[0].count == 5
        assert proposals[1].count == 2

    def test_min_count_threshold(self, db_path):
        path, con = db_path
        _add_terminal_call(con, "git push --force origin main")
        records = scan_approval_history(path, days=0)
        assert build_proposals(records, min_count=2) == []
        assert len(build_proposals(records, min_count=1)) == 1

    def test_rm_rf_never_proposed_even_after_100_approvals(self, db_path):
        path, con = db_path
        for _ in range(100):
            _add_terminal_call(con, "rm -rf ./build")
        records = scan_approval_history(path, days=0)
        # The commands ARE mined (they ran with approval) ...
        assert len(records) == 100
        # ... but the destructive class is unconditionally excluded.
        proposals = build_proposals(records, min_count=1)
        assert proposals == []

    def test_unsafe_classes_are_excluded(self):
        for desc in (
            "recursive delete",
            "git reset --hard (destroys uncommitted changes)",
            "sudo with privilege flag (stdin/askpass/shell/list)",
            "pipe remote content to shell",
            "overwrite system config",
            "SQL DROP",
            "in-place edit of sensitive credential/SSH/shell-rc path",
            "format filesystem",
            "kill all processes",
            "write to block device",
        ):
            assert is_unsafe_class(desc), desc

    def test_benign_classes_are_not_excluded(self):
        for desc in (
            "git force push (rewrites remote history)",
            "docker restart/stop/kill (container lifecycle)",
            "hermes update (restarts gateway, kills running agents)",
            "stop/restart system service",
        ):
            assert not is_unsafe_class(desc), desc

    def test_existing_allowlist_entries_are_skipped(self, db_path):
        path, con = db_path
        for _ in range(3):
            _add_terminal_call(con, "git push --force origin main")
        records = scan_approval_history(path, days=0)
        proposals = build_proposals(records, existing={"git push *"}, min_count=1)
        assert proposals == []

    def test_hardline_commands_never_mined(self, db_path):
        path, con = db_path
        # Even if a hardline command somehow shows an executed result in the
        # DB, the miner refuses it (defense in depth).
        for _ in range(5):
            _add_terminal_call(con, "rm -rf /")
        assert scan_approval_history(path, days=0) == []


# ---------------------------------------------------------------------------
# --apply / dry-run
# ---------------------------------------------------------------------------

def _args(db, **kw):
    base = dict(
        db=str(db), days=0, min_count=1, limit=20,
        apply_indices=None, json=False,
    )
    base.update(kw)
    return Namespace(**base)


class TestApply:
    def test_parse_apply_indices(self):
        assert parse_apply_indices("1,3", 5) == [0, 2]
        assert parse_apply_indices(" 2 ", 2) == [1]
        with pytest.raises(ValueError):
            parse_apply_indices("0", 3)
        with pytest.raises(ValueError):
            parse_apply_indices("4", 3)
        with pytest.raises(ValueError):
            parse_apply_indices("a,b", 3)
        with pytest.raises(ValueError):
            parse_apply_indices("", 3)

    def test_apply_merges_and_persists(self, isolated_allowlist):
        isolated_allowlist["patterns"] = {"podman *"}
        proposals = [
            Proposal(pattern="git push *", kind="glob", count=5),
            Proposal(pattern="docker restart *", kind="glob", count=3),
        ]
        merged = apply_proposals(proposals, [0])
        assert merged == {"podman *", "git push *"}
        assert isolated_allowlist["patterns"] == {"podman *", "git push *"}
        assert isolated_allowlist["saves"] == 1
        # In-process allowlist synced too (long-lived process consistency).
        assert "git push *" in approval_module._permanent_approved

    def test_suggest_apply_end_to_end(self, db_path, isolated_allowlist, capsys):
        path, con = db_path
        for _ in range(4):
            _add_terminal_call(con, "git push --force origin main")
        for _ in range(3):
            _add_terminal_call(con, "docker restart web")
        rc = suggest_command(_args(path, apply_indices="1,2"))
        assert rc == 0
        assert isolated_allowlist["patterns"] == {"git push *", "docker restart *"}
        out = capsys.readouterr().out
        assert "git push *" in out and "docker restart *" in out

    def test_dry_default_writes_nothing(self, db_path, isolated_allowlist, capsys):
        path, con = db_path
        for _ in range(4):
            _add_terminal_call(con, "git push --force origin main")
        rc = suggest_command(_args(path))
        assert rc == 0
        assert isolated_allowlist["saves"] == 0
        assert isolated_allowlist["patterns"] == set()
        out = capsys.readouterr().out
        assert "git push *" in out
        assert "Nothing has been changed" in out

    def test_apply_out_of_range_errors_without_writing(
        self, db_path, isolated_allowlist, capsys
    ):
        path, con = db_path
        for _ in range(4):
            _add_terminal_call(con, "git push --force origin main")
        rc = suggest_command(_args(path, apply_indices="7"))
        assert rc == 1
        assert isolated_allowlist["saves"] == 0


class TestJsonOutput:
    def test_json_proposal_output(self, db_path, isolated_allowlist, capsys):
        path, con = db_path
        for _ in range(4):
            _add_terminal_call(con, "git push --force origin main")
        rc = suggest_command(_args(path, json=True))
        assert rc == 0
        payload = json.loads(capsys.readouterr().out)
        assert payload["proposals"][0]["pattern"] == "git push *"
        assert payload["proposals"][0]["count"] == 4
        assert payload["proposals"][0]["n"] == 1
        assert isolated_allowlist["saves"] == 0

    def test_json_apply_output(self, db_path, isolated_allowlist, capsys):
        path, con = db_path
        for _ in range(4):
            _add_terminal_call(con, "git push --force origin main")
        rc = suggest_command(_args(path, apply_indices="1", json=True))
        assert rc == 0
        payload = json.loads(capsys.readouterr().out)
        assert payload["applied"] == ["git push *"]
        assert isolated_allowlist["patterns"] == {"git push *"}


# ---------------------------------------------------------------------------
# Parser wiring
# ---------------------------------------------------------------------------

class TestParserWiring:
    def test_build_approvals_parser_wires_suggest(self):
        import argparse

        from hermes_cli.subcommands.approvals import build_approvals_parser

        sentinel = object()
        parser = argparse.ArgumentParser()
        subparsers = parser.add_subparsers(dest="command")
        build_approvals_parser(subparsers, cmd_approvals=lambda a: sentinel)

        args = parser.parse_args(
            ["approvals", "suggest", "--apply", "1,3", "--json",
             "--days", "30", "--min-count", "5", "--limit", "10"]
        )
        assert args.approvals_command == "suggest"
        assert args.apply_indices == "1,3"
        assert args.json is True
        assert args.days == 30
        assert args.min_count == 5
        assert args.limit == 10
        assert args.func(args) is sentinel

    def test_suggest_defaults_are_dry_and_bounded(self):
        import argparse

        from hermes_cli.subcommands.approvals import build_approvals_parser

        parser = argparse.ArgumentParser()
        subparsers = parser.add_subparsers(dest="command")
        build_approvals_parser(subparsers, cmd_approvals=lambda a: None)
        args = parser.parse_args(["approvals", "suggest"])
        assert args.apply_indices is None
        assert args.json is False
        assert args.days == 90
        assert args.min_count == 2