tests:
  # ============================================================
  # SAFE find: bare and basic predicates (allow)
  # ============================================================
  - id: find-bare
    command: "find"
    expected:
      decision: allow

  - id: find-dot
    command: "find ."
    expected:
      decision: allow

  - id: find-absolute-path
    command: "find /tmp"
    expected:
      decision: allow

  - id: find-home-path
    command: "find ~"
    expected:
      decision: allow

  - id: find-multiple-paths
    command: "find /tmp /var/log"
    expected:
      decision: allow

  - id: find-name-glob
    command: "find . -name '*.rs'"
    expected:
      decision: allow

  - id: find-name-exact
    command: "find . -name Cargo.toml"
    expected:
      decision: allow

  - id: find-iname
    command: "find . -iname '*.RS'"
    expected:
      decision: allow

  - id: find-type-f
    command: "find . -type f"
    expected:
      decision: allow

  - id: find-type-d
    command: "find . -type d"
    expected:
      decision: allow

  - id: find-type-l
    command: "find . -type l"
    expected:
      decision: allow

  - id: find-path-predicate
    command: "find . -path '*/src/*.rs'"
    expected:
      decision: allow

  - id: find-regex
    command: "find . -regex '.*\\.rs$'"
    expected:
      decision: allow

  - id: find-iregex
    command: "find . -iregex '.*\\.yaml$'"
    expected:
      decision: allow

  - id: find-size
    command: "find . -size +1M"
    expected:
      decision: allow

  - id: find-mtime
    command: "find . -mtime -7"
    expected:
      decision: allow

  - id: find-atime
    command: "find . -atime +30"
    expected:
      decision: allow

  - id: find-ctime
    command: "find . -ctime -1"
    expected:
      decision: allow

  - id: find-newer
    command: "find . -newer reference.txt"
    expected:
      decision: allow

  - id: find-perm
    command: "find . -perm 644"
    expected:
      decision: allow

  - id: find-perm-mode
    command: "find . -perm -u+x"
    expected:
      decision: allow

  - id: find-user
    command: "find /tmp -user root"
    expected:
      decision: allow

  - id: find-group
    command: "find /tmp -group staff"
    expected:
      decision: allow

  - id: find-empty
    command: "find . -empty"
    expected:
      decision: allow

  - id: find-maxdepth
    command: "find . -maxdepth 2 -name '*.rs'"
    expected:
      decision: allow

  - id: find-mindepth
    command: "find . -mindepth 1 -maxdepth 3"
    expected:
      decision: allow

  # ============================================================
  # SAFE find: output and control actions (allow)
  # ============================================================
  - id: find-print
    command: "find . -name '*.rs' -print"
    expected:
      decision: allow

  - id: find-print0
    command: "find . -name '*.rs' -print0"
    expected:
      decision: allow

  - id: find-ls
    command: "find . -name '*.log' -ls"
    expected:
      decision: allow

  - id: find-prune
    command: "find . -name node_modules -prune -o -name '*.js' -print"
    expected:
      decision: allow

  # ============================================================
  # SAFE find: compound predicates and logical operators (allow)
  # ============================================================
  - id: find-and-implicit
    command: "find . -type f -name '*.rs'"
    expected:
      decision: allow

  - id: find-or-operator
    command: "find . -name '*.rs' -o -name '*.toml'"
    expected:
      decision: allow

  - id: find-not-operator
    command: "find . -not -name '*.log'"
    expected:
      decision: allow

  - id: find-negation-bang
    command: "find . ! -name '*.tmp'"
    expected:
      decision: allow

  - id: find-grouped
    command: "find . \\( -name '*.rs' -o -name '*.toml' \\) -type f"
    expected:
      decision: allow

  - id: find-complex-predicates
    command: "find /tmp -type f -name '*.log' -mtime +30 -size +1M"
    expected:
      decision: allow

  - id: find-multiple-name-or
    command: "find . \\( -name '*.log' -o -name '*.jsonl' \\)"
    expected:
      decision: allow

  - id: find-type-and-name-absolute
    command: "find /tmp/project -type f -name '*.yaml'"
    expected:
      decision: allow

  - id: find-stderr-suppress
    command: "find /var -type f -name '*.conf' 2>/dev/null"
    expected:
      decision: allow

  # ============================================================
  # SAFE find: -exec with non-destructive commands (allow)
  # ============================================================
  - id: find-exec-echo
    command: "find . -name '*.rs' -exec echo {} \\;"
    expected:
      decision: allow

  - id: find-exec-ls
    command: "find . -type f -exec ls -la {} \\;"
    expected:
      decision: allow

  - id: find-exec-grep
    command: "find . -name '*.rs' -exec grep -l 'TODO' {} \\;"
    expected:
      decision: allow

  - id: find-exec-cat
    command: "find . -name '*.md' -exec cat {} \\;"
    expected:
      decision: allow

  - id: find-exec-chmod
    command: "find . -type f -exec chmod 644 {} \\;"
    expected:
      decision: ask

  - id: find-exec-wc
    command: "find . -name '*.rs' -exec wc -l {} +"
    expected:
      decision: allow

  - id: find-exec-file
    command: "find . -type f -exec file {} +"
    expected:
      decision: allow

  - id: find-exec-head
    command: "find . -name '*.log' -exec head -5 {} \\;"
    expected:
      decision: allow

  - id: find-execdir-echo
    command: "find . -name '*.rs' -execdir echo {} \\;"
    expected:
      decision: allow

  - id: find-execdir-ls
    command: "find . -type f -execdir ls -la {} \\;"
    expected:
      decision: allow

  # ============================================================
  # DANGEROUS find: -delete flag (ask, rule: find-delete)
  # ============================================================
  - id: find-delete-root
    command: "find / -delete"
    expected:
      decision: ask
      rule_id: find-delete

  - id: find-delete-dot
    command: "find . -delete"
    expected:
      decision: ask
      rule_id: find-delete

  - id: find-delete-tmp
    command: "find /tmp -delete"
    expected:
      decision: ask
      rule_id: find-delete

  - id: find-delete-with-name
    command: "find . -name '*.tmp' -delete"
    expected:
      decision: ask
      rule_id: find-delete

  - id: find-delete-with-type
    command: "find . -type f -name '*.bak' -delete"
    expected:
      decision: ask
      rule_id: find-delete

  - id: find-delete-with-mtime
    command: "find /home -name '*.log' -mtime +30 -delete"
    expected:
      decision: ask
      rule_id: find-delete

  - id: find-delete-empty
    command: "find . -empty -delete"
    expected:
      decision: ask
      rule_id: find-delete

  - id: find-delete-with-maxdepth
    command: "find . -maxdepth 1 -name '*.tmp' -delete"
    expected:
      decision: ask
      rule_id: find-delete

  # ============================================================
  # DANGEROUS find: -exec rm (ask, rule: find-exec-rm)
  # ============================================================
  - id: find-exec-rm-minimal
    command: "find . -exec rm {} \\;"
    expected:
      decision: ask
      rule_id: find-exec-rm

  - id: find-exec-rm-semicolon
    command: "find . -name '*.bak' -exec rm {} \\;"
    expected:
      decision: ask
      rule_id: find-exec-rm

  - id: find-exec-rm-plus
    command: "find . -name '*.tmp' -exec rm {} +"
    expected:
      decision: ask
      rule_id: find-exec-rm

  - id: find-exec-rm-rf-plus
    command: "find / -exec rm -rf {} +"
    expected:
      decision: ask
      rule_id: find-exec-rm

  - id: find-exec-rm-f
    command: "find . -name '*.o' -exec rm -f {} \\;"
    expected:
      decision: ask
      rule_id: find-exec-rm

  - id: find-exec-rm-with-predicates
    command: "find /tmp -type f -name '*.cache' -mtime +7 -exec rm {} \\;"
    expected:
      decision: ask
      rule_id: find-exec-rm

  # ============================================================
  # SAFE xargs: with non-destructive commands (allow)
  # ============================================================
  - id: xargs-echo
    command: "xargs echo"
    expected:
      decision: allow

  - id: xargs-ls
    command: "xargs ls -la"
    expected:
      decision: allow

  - id: xargs-cat
    command: "xargs cat"
    expected:
      decision: allow

  - id: xargs-grep
    command: "xargs grep pattern"
    expected:
      decision: allow

  - id: xargs-grep-l
    command: "xargs grep -l 'TODO'"
    expected:
      decision: allow

  - id: xargs-wc
    command: "xargs wc -l"
    expected:
      decision: allow

  - id: xargs-head
    command: "xargs head -5"
    expected:
      decision: allow

  - id: xargs-file
    command: "xargs file"
    expected:
      decision: allow

  - id: xargs-stat
    command: "xargs stat"
    expected:
      decision: allow

  - id: xargs-0-ls
    command: "xargs -0 ls -la"
    expected:
      decision: allow

  - id: xargs-0-grep
    command: "xargs -0 grep pattern"
    expected:
      decision: allow

  - id: xargs-null-cat
    command: "xargs --null cat"
    expected:
      decision: allow

  - id: xargs-I-placeholder-ls
    command: "xargs -I{} ls {}"
    expected:
      decision: allow

  - id: xargs-n1-grep
    command: "xargs -n1 grep pattern"
    expected:
      decision: allow

  - id: xargs-P4-wc
    command: "xargs -P4 wc -l"
    expected:
      decision: allow

  - id: xargs-max-args-echo
    command: "xargs --max-args=10 echo"
    expected:
      decision: allow

  # ============================================================
  # DANGEROUS xargs: with rm (ask, rule: xargs-rm)
  # ============================================================
  - id: xargs-rm
    command: "xargs rm"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-rm-f
    command: "xargs rm -f"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-rm-rf
    command: "xargs rm -rf"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-rm-r
    command: "xargs rm -r"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-0-rm
    command: "xargs -0 rm"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-I-rm
    command: "xargs -I{} rm {}"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-I-rm-rf
    command: "xargs -I{} rm -rf {}"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-n1-rm
    command: "xargs -n1 rm"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-P4-n1-rm
    command: "xargs -P4 -n1 rm"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: xargs-rm-redirect-input
    command: "xargs rm -rf < /tmp/files.txt"
    expected:
      decision: ask
      rule_id: xargs-rm

  # ============================================================
  # SAFE pipelines: find piped to non-destructive commands (allow)
  # ============================================================
  - id: find-pipe-head
    command: "find . -name '*.rs' | head -10"
    expected:
      decision: allow

  - id: find-pipe-tail
    command: "find . -name '*.rs' | tail -5"
    expected:
      decision: allow

  - id: find-pipe-sort
    command: "find . -name '*.rs' | sort"
    expected:
      decision: allow

  - id: find-pipe-wc
    command: "find . -type f | wc -l"
    expected:
      decision: allow

  - id: find-pipe-grep
    command: "find . -type f | grep '*.rs'"
    expected:
      decision: allow

  - id: find-pipe-sort-head
    command: "find . -name '*.rs' | sort | head"
    expected:
      decision: allow

  - id: find-pipe-xargs-echo
    command: "find . -name '*.rs' | xargs echo"
    expected:
      decision: allow

  - id: find-pipe-xargs-grep
    command: "find . -name '*.rs' | xargs grep pattern"
    expected:
      decision: allow

  - id: find-pipe-xargs-wc
    command: "find . -name '*.rs' | xargs wc -l"
    expected:
      decision: allow

  - id: find-pipe-xargs-ls
    command: "find . -type f | xargs ls -la"
    expected:
      decision: allow

  - id: find-pipe-xargs-cat
    command: "find . -name '*.md' | xargs cat"
    expected:
      decision: allow

  - id: find-pipe-xargs-file
    command: "find . -type f | xargs file"
    expected:
      decision: allow

  - id: find-print0-pipe-xargs-0-ls
    command: "find . -type f -print0 | xargs -0 ls"
    expected:
      decision: allow

  - id: find-print0-pipe-xargs-0-grep
    command: "find . -name '*.rs' -print0 | xargs -0 grep 'fn main'"
    expected:
      decision: allow

  - id: find-print0-pipe-xargs-0-wc
    command: "find . -name '*.rs' -print0 | xargs -0 wc -l"
    expected:
      decision: allow

  # ============================================================
  # DANGEROUS pipelines: find piped to xargs rm (ask)
  # ============================================================
  - id: find-pipe-xargs-rm
    command: "find . -name '*.tmp' | xargs rm"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: find-pipe-xargs-rm-rf
    command: "find . -name '*.bak' | xargs rm -rf"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: find-pipe-xargs-rm-f
    command: "find . -name '*.o' | xargs rm -f"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: find-print0-pipe-xargs-0-rm
    command: "find . -type f -print0 | xargs -0 rm"
    expected:
      decision: ask
      rule_id: xargs-rm

  - id: find-pipe-xargs-I-rm
    command: "find . -name '*.tmp' | xargs -I{} rm {}"
    expected:
      decision: ask
      rule_id: xargs-rm

  # ============================================================
  # REGRESSION: exact commands from hooks log that were blocked
  # ============================================================
  - id: regression-find-grouped-or-stderr
    command: "find /tmp/project -type f \\( -name \"*.log\" -o -name \"*.jsonl\" \\) 2>/dev/null"
    expected:
      decision: allow

  - id: regression-find-tilde-or-stderr
    command: "find ~/.claude -type f -name \"*.jsonl\" -o -name \"*.log\" 2>/dev/null"
    expected:
      decision: allow

  - id: regression-find-tests-yaml
    command: "find /tmp/project/tests -name \"*.yaml\" -type f"
    expected:
      decision: allow

  # ============================================================
  # REAL-WORLD: common Claude Code find patterns (allow)
  # ============================================================
  - id: realworld-find-exclude-path
    command: "find . -name '*.ts' -not -path '*/node_modules/*'"
    expected:
      decision: allow

  - id: realworld-find-exclude-vendor
    command: "find . -name '*.go' -not -path './vendor/*'"
    expected:
      decision: allow

  - id: realworld-find-exclude-dotgit
    command: "find . -type f -not -path './.git/*'"
    expected:
      decision: allow

  - id: realworld-find-or-pipe-xargs-grep
    command: "find . -name '*.ts' -o -name '*.tsx' | xargs grep -l 'import'"
    expected:
      decision: allow

  - id: realworld-find-pipe-xargs-grep-pub
    command: "find . -type f -name '*.rs' | xargs grep -l 'pub fn'"
    expected:
      decision: allow

  - id: realworld-find-multiple-or
    command: "find . -name 'Makefile' -o -name 'makefile' -o -name 'GNUmakefile'"
    expected:
      decision: allow

  - id: realworld-find-wholename
    command: "find . -wholename '*/migrations/*.py'"
    expected:
      decision: allow

  - id: realworld-find-maxdepth-name
    command: "find . -maxdepth 3 -name 'package.json'"
    expected:
      decision: allow

  - id: realworld-find-type-d
    command: "find . -type d -name 'node_modules'"
    expected:
      decision: allow

  - id: realworld-find-pyc
    command: "find . -name '*.pyc' -type f"
    expected:
      decision: allow

  - id: realworld-find-newer-pipe-wc
    command: "find . -type f -newer reference | wc -l"
    expected:
      decision: allow

  - id: realworld-find-pipe-head-20
    command: "find . -type f -name '*.py' | head -20"
    expected:
      decision: allow

  - id: realworld-find-pipe-xargs-stat
    command: "find . -name '*.rs' | xargs stat"
    expected:
      decision: allow

  - id: realworld-find-depth-name
    command: "find . -depth -name '*.tmp'"
    expected:
      decision: allow

  - id: realworld-find-follow-symlinks
    command: "find -L . -name '*.so'"
    expected:
      decision: allow

  - id: realworld-find-readable
    command: "find . -readable -name '*.conf'"
    expected:
      decision: allow

  - id: realworld-find-size-range
    command: "find . -size +100k -size -10M -type f"
    expected:
      decision: allow

  - id: realworld-xargs-sort-uniq
    command: "find . -name '*.rs' | xargs grep 'use ' | sort | uniq"
    expected:
      decision: allow

  # ════════════════════════════════════════════════════════════
  # find -exec / xargs with TRANSPARENT WRAPPERS
  # Extracted inner commands must be unwrapped through
  # command/builtin/timeout/nice before evaluation.
  # ════════════════════════════════════════════════════════════

  # ── Passing contract: find -exec without wrappers (existing behavior) ──
  - id: find-exec-cat-env-deny
    command: "find . -exec cat .env ;"
    expected:
      decision: deny
      rule_id: cat-env-file
    note: "Baseline: find -exec cat .env correctly denied"
  - id: find-exec-echo-safe-allow
    command: "find . -exec echo {} ;"
    expected:
      decision: allow
    note: "Baseline: find -exec echo correctly allowed"

  # ── FAILING: find -exec with command wrapper ──────────────
  - id: find-exec-command-cat-env-deny
    command: "find . -exec command cat .env ;"
    expected:
      decision: deny
      rule_id: cat-env-file
    note: "command wrapper must be unwrapped to evaluate inner cat .env"
  - id: find-exec-command-rm-deny
    command: "find . -exec command rm -rf / ;"
    expected:
      decision: deny
      rule_id: rm-recursive-root
  - id: find-exec-sh-c-rm-root-deny
    command: "find . -exec sh -c 'rm -rf /' sh {} ;"
    expected:
      decision: deny
      rule_id: rm-recursive-root
    note: "find -exec sh -c must expose the inner rm command to the existing deny rule"
  - id: timeout-find-exec-sh-c-rm-root-deny
    command: "timeout 1 find . -exec sh -c 'rm -rf /' sh {} ;"
    expected:
      decision: deny
      rule_id: rm-recursive-root
    note: "transparent wrappers around find must still expose find -exec sh -c"
  - id: command-find-exec-sh-c-rm-root-deny
    command: "command find . -exec sh -c 'rm -rf /' sh {} ;"
    expected:
      decision: deny
      rule_id: rm-recursive-root
    note: "command wrapper around find must still expose find -exec sh -c"
  - id: find-exec-command-ls-allow
    command: "find . -exec command ls ;"
    expected:
      decision: allow
    note: "command + safe inner = allow after unwrapping"

  # ── FAILING: find -exec with builtin wrapper ─────────────
  - id: find-exec-builtin-cat-env-deny
    command: "find . -exec builtin cat .env ;"
    expected:
      decision: deny
      rule_id: cat-env-file

  # ── FAILING: find -exec with timeout wrapper ─────────────
  - id: find-exec-timeout-cat-env-deny
    command: "find . -exec timeout 30 cat .env ;"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: find-exec-timeout-rm-deny
    command: "find . -exec timeout 30 rm -rf / ;"
    expected:
      decision: deny
      rule_id: rm-recursive-root
  - id: find-exec-timeout-ls-allow
    command: "find . -exec timeout 30 ls ;"
    expected:
      decision: allow

  # ── FAILING: find -exec with nice wrapper ────────────────
  - id: find-exec-nice-cat-env-deny
    command: "find . -exec nice cat .env ;"
    expected:
      decision: deny
      rule_id: cat-env-file

  # ── FAILING: find -execdir with wrappers ─────────────────
  - id: find-execdir-command-cat-env-deny
    command: "find . -execdir command cat .env ;"
    expected:
      decision: deny
      rule_id: cat-env-file

  # ── Passing contract: xargs without wrappers (existing behavior) ──
  - id: xargs-cat-env-deny
    command: "echo foo | xargs cat .env"
    expected:
      decision: deny
      rule_id: cat-env-file
    note: "Baseline: xargs cat .env correctly denied"

  # ── FAILING: xargs with command wrapper ──────────────────
  - id: xargs-command-cat-env-deny
    command: "echo foo | xargs command cat .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: xargs-command-rm-deny
    command: "echo foo | xargs command rm -rf /"
    expected:
      decision: deny
      rule_id: rm-recursive-root
  - id: xargs-sh-c-rm-root-deny
    command: "echo foo | xargs sh -c 'rm -rf /'"
    expected:
      decision: deny
      rule_id: rm-recursive-root
    note: "xargs sh -c must expose the inner rm command to the existing deny rule"
  - id: timeout-xargs-sh-c-rm-root-deny
    command: "echo foo | timeout 1 xargs sh -c 'rm -rf /'"
    expected:
      decision: deny
      rule_id: rm-recursive-root
    note: "transparent wrappers around xargs must still expose xargs sh -c"
  - id: command-xargs-sh-c-rm-root-deny
    command: "echo foo | command xargs sh -c 'rm -rf /'"
    expected:
      decision: deny
      rule_id: rm-recursive-root
    note: "command wrapper around xargs must still expose xargs sh -c"
  - id: xargs-command-ls-allow
    command: "echo foo | xargs command ls"
    expected:
      decision: allow

  # ── FAILING: xargs with builtin wrapper ──────────────────
  - id: xargs-builtin-cat-env-deny
    command: "echo foo | xargs builtin cat .env"
    expected:
      decision: deny
      rule_id: cat-env-file

  # ── FAILING: xargs with timeout wrapper ──────────────────
  - id: xargs-timeout-cat-env-deny
    command: "echo foo | xargs timeout 30 cat .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: xargs-timeout-rm-deny
    command: "echo foo | xargs timeout 30 rm -rf /"
    expected:
      decision: deny
      rule_id: rm-recursive-root

  # ── FAILING: xargs with flags + wrapper ──────────────────
  - id: xargs-flags-command-cat-env-deny
    command: "echo foo | xargs -I{} command cat .env"
    expected:
      decision: deny
      rule_id: cat-env-file

  # ── Pipeline: find | xargs with wrappers ─────────────────
  - id: find-pipe-xargs-command-cat-env-allow
    command: "find . -name '*.env' | xargs command cat"
    expected:
      decision: allow
    note: "xargs extracts 'command cat' → unwraps to 'cat' (no .env arg visible statically)"
  - id: find-pipe-xargs-command-rm-deny
    command: "find . -name '*.tmp' | xargs command rm -rf"
    expected:
      decision: ask
      rule_id: xargs-rm
    note: "xargs extracts 'command rm -rf' → unwraps to 'rm -rf' → matches xargs-rm rule"
