3b7768df934fe769afaa2e92db19697faf6690fc

Message

Add herdr server stop as deterministic rule

Diff

This diff is truncated to protect this page.

 1diff --git a/src/core/rules.ts b/src/core/rules.ts
 2index 1a9fca6c5de6ffb552cc19564eac8c81006ff800..99fb9316d600ec6a0cdcbe32bcc821a96ec917bc 100644
 3--- a/src/core/rules.ts
 4+++ b/src/core/rules.ts
 5@@ -170,6 +170,7 @@ export const ASK_PATTERNS: RegExp[] = [
 6   /\bdoas\b/,
 7   /\bsu\b/,
 8   /^(ba)?sh\b/,
 9+  /^herdr\s+server\s+stop\s*$/,
10   /\brm\s+-rf\s+\/\s*$/,
11   /\brm\s+-rf\s+\/\*/,
12 ];
13@@ -193,7 +194,6 @@ Ask only for:
14 - Editing system (non-user) files, outside of the current working directory tree, or not on the list of allowed directories.
15 - Remote infrastructure, data, access, or deployment mutation: create, update, delete, grant, revoke, apply, or execute a write on production databases, Kubernetes, or cloud providers.
16 - Irreversibly destructive Git operations, such as reset --hard or checking out files.
17-- Stopping the Herdr server: \`herdr server stop\`
18 - When a command attempts to search the entire (and only *THE ENTIRE*) home directory for something, since that's very slow and rarely needed.
19 
20diff --git a/test/core/deterministic.test.ts b/test/core/deterministic.test.ts
21index b6a48bd5eb8a23dca9f91db0189355aac511c497..ccf3df0f89aefe16c22c1c28548f4f1989b93a96 100644
22--- a/test/core/deterministic.test.ts
23+++ b/test/core/deterministic.test.ts
24@@ -105,6 +105,10 @@ test("does not treat search terms as secret paths", () => {
25   expect(checkDeterministic("bash", { command: "rg '.env' README.md" })).toMatchObject({ decision: "allow" })
26 })
27 
28+test("asks before stopping the Herdr server", () => {
29+  expect(checkDeterministic("bash", { command: "herdr server stop" })).toMatchObject({ decision: "ask" })
30+})
31+
32 test("does not deterministically allow non-toolchain mutation or shell-control variants", () => {
33   for (const command of [
34     "kustomize build --enable-helm deploy",