Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/test_live_system_guard.py

@@ -0,0 +1,39 @@
+"""Regression tests for the conftest live-system guard's argv handling.
+
+The guard must treat only argv[0] of a list/tuple command as the executable
+(arguments are data: a file named ``skill`` is not the ``skill`` binary),
+while still scanning every token of wrapper invocations like ``bash -c``.
+All blocked-case commands use patterns that match no real process, so a
+guard regression cannot kill anything.
+"""
+
+import subprocess
+
+import pytest
+
+
+def test_argv_arguments_are_not_treated_as_executables(tmp_path):
+    """A file argument whose basename is a killer name must not trip the
+    guard (the path contains "hermes" via the pytest tmp root)."""
+    target = tmp_path / "skill"
+    target.write_text("just a filename\n")
+    result = subprocess.run(["cat", str(target)], capture_output=True, text=True)
+    assert result.returncode == 0
+    assert "just a filename" in result.stdout
+
+
+def test_direct_killer_argv_is_still_blocked():
+    with pytest.raises(RuntimeError, match="live-system guard"):
+        subprocess.run(["pkill", "-f", "hermes-guard-regression-nomatch"])
+
+
+def test_wrapped_killer_command_is_still_blocked():
+    """argv[0]-only scanning must not exempt commands hidden behind a
+    shell wrapper."""
+    with pytest.raises(RuntimeError, match="live-system guard"):
+        subprocess.run(["bash", "-c", "pkill -f hermes-guard-regression-nomatch"])
+
+
+def test_env_wrapped_killer_command_is_still_blocked():
+    with pytest.raises(RuntimeError, match="live-system guard"):
+        subprocess.run(["env", "GUARD_TEST=1", "pkill", "-f", "hermes-guard-regression-nomatch"])