| 1377 | |
| 1378 | #[test] |
| 1379 | fn test_builtin_agent_permissions_are_bounded() { |
| 1380 | let registry = AgentRegistry::new(); |
| 1381 | let explore = registry.get("explore").unwrap(); |
| 1382 | let general = registry.get("general-purpose").unwrap(); |
| 1383 | |
| 1384 | assert_eq!( |
| 1385 | explore |
| 1386 | .permissions |
| 1387 | .check("bash", &serde_json::json!({"command": "cargo test"})), |
| 1388 | PermissionDecision::Deny |
| 1389 | ); |
| 1390 | assert_eq!( |
| 1391 | explore |
| 1392 | .permissions |
| 1393 | .check("bash", &serde_json::json!({"command": "ls src"})), |
| 1394 | PermissionDecision::Allow |
| 1395 | ); |
| 1396 | assert_eq!( |
| 1397 | general |
| 1398 | .permissions |
| 1399 | .check("parallel_task", &serde_json::json!({})), |
| 1400 | PermissionDecision::Deny |
| 1401 | ); |
| 1402 | } |
| 1403 | |
| 1404 | #[test] |
| 1405 | fn test_parse_worker_agent_yaml_uses_cattle_defaults() { |