tests:
  # ════════════════════════════════════════════════════════════════
  # uv: additional safe operations
  # ════════════════════════════════════════════════════════════════
  # Positive tests (should allow)
  - id: uv-sync-safe
    command: "uv sync"
    expected:
      decision: allow
  - id: uv-sync-frozen-safe
    command: "uv sync --frozen"
    expected:
      decision: allow
  - id: uv-lock-safe
    command: "uv lock"
    expected:
      decision: allow
  - id: uv-lock-upgrade-safe
    command: "uv lock --upgrade"
    expected:
      decision: allow
  - id: uv-venv-safe
    command: "uv venv"
    expected:
      decision: allow
  - id: uv-venv-path-safe
    command: "uv venv .venv"
    expected:
      decision: allow
  - id: uv-pip-safe
    command: "uv pip"
    expected:
      decision: allow
  - id: uv-pip-list-safe
    command: "uv pip list"
    expected:
      decision: allow
  - id: uv-cache-dir-safe
    command: "uv cache dir"
    expected:
      decision: ask
    note: "uv cache not explicitly allowlisted"
  - id: uv-pip-install-safe
    command: "uv pip install requests"
    expected:
      decision: ask
      rule_id: uv-pip-install
  - id: uv-run-precommit-safe
    command: "uv run pre-commit"
    expected:
      decision: allow
  - id: uv-run-precommit-all-safe
    command: "uv run pre-commit run --all-files"
    expected:
      decision: allow
  - id: uv-run-precommit-install-safe
    command: "uv run pre-commit install"
    expected:
      decision: allow
  - id: uv-version-safe
    command: "uv --version"
    expected:
      decision: allow
  - id: uv-version-short-safe
    command: "uv -V"
    expected:
      decision: allow
  - id: uv-help-safe
    command: "uv --help"
    expected:
      decision: allow

  # ════════════════════════════════════════════════════════════════
  # python: pytest as module
  # ════════════════════════════════════════════════════════════════
  # Positive tests (should allow)
  - id: python-m-pytest-safe
    command: "python -m pytest"
    expected:
      decision: allow
  - id: python-m-pytest-verbose-safe
    command: "python -m pytest -v"
    expected:
      decision: allow
  - id: python-m-pytest-path-safe
    command: "python -m pytest tests/"
    expected:
      decision: allow
  - id: python3-m-pytest-safe
    command: "python3 -m pytest"
    expected:
      decision: allow
  - id: python3-m-pytest-verbose-safe
    command: "python3 -m pytest -v"
    expected:
      decision: allow
  - id: python3-m-pytest-path-safe
    command: "python3 -m pytest tests/unit/"
    expected:
      decision: allow

  # ════════════════════════════════════════════════════════════════
  # uv run python -m pytest: wrapped pytest invocations
  # ════════════════════════════════════════════════════════════════
  - id: uv-run-python-m-pytest-safe
    command: "uv run python -m pytest"
    expected:
      decision: allow
  - id: uv-run-python-m-pytest-verbose-safe
    command: "uv run python -m pytest -v --tb=short"
    expected:
      decision: allow
  - id: uv-run-python-m-pytest-path-safe
    command: "uv run python -m pytest flows/tests/ -v --tb=short"
    expected:
      decision: allow
  - id: uv-run-python-m-pytest-redirect-safe
    command: "uv run python -m pytest tests/ -v 2>&1"
    expected:
      decision: allow
  - id: uv-run-python3-m-pytest-safe
    command: "uv run python3 -m pytest tests/"
    expected:
      decision: allow
  - id: uv-run-python3-m-pytest-verbose-safe
    command: "uv run python3 -m pytest tests/ -v --tb=short 2>&1"
    expected:
      decision: allow

  # uv run value-flag forms: space-separated values (--project /path, -p /path,
  # --directory /path, --python VER) must match "uv run X" allowlist entries.
  # The equals form and bool flags also must keep working.
  - id: uv-run-project-space-ruff-safe
    command: "uv run --project /tmp ruff check ."
    expected:
      decision: allow
  - id: uv-run-project-space-pytest-safe
    command: "uv run --project /tmp pytest"
    expected:
      decision: allow
  - id: uv-run-short-p-space-ruff-safe
    command: "uv run -p /tmp ruff --version"
    expected:
      decision: allow
  - id: uv-run-directory-space-mypy-safe
    command: "uv run --directory /tmp mypy src/"
    expected:
      decision: allow
  - id: uv-run-python-version-space-ruff-safe
    command: "uv run --python 3.12 ruff check ."
    expected:
      decision: allow
  - id: uv-run-project-equals-ruff-safe
    command: "uv run --project=/tmp ruff check ."
    expected:
      decision: allow
  - id: uv-run-isolated-ruff-safe
    command: "uv run --isolated ruff --version"
    expected:
      decision: allow
  - id: uv-run-project-original-report-safe
    command: 'uv run --project /Users/a/proj ruff --version 2>/dev/null || echo "cannot run ruff"'
    expected:
      decision: allow
