expect(second.allowlistSatisfied).toBe(false);

});

it("prevents allow-always bypass for script wrapper chains", () => {

it("keeps policy-blocked script wrapper chains out of allow-always", () => {

if (process.platform !== "darwin" && process.platform !== "freebsd") {

return;

}

const dir = makeTempDir();

makeExecutable(dir, "echo");

makeExecutable(dir, "id");

const env = makePathEnv(dir);

const safeBins = resolveSafeBins(undefined);

const { persisted } = resolvePersistedPatterns({

command: "/usr/bin/script -q /dev/null /bin/sh -c 'echo warmup-ok'",

dir,

platform: process.platform,

});

expect(second.allowlistSatisfied).toBe(false);

expect(

requiresExecApproval({

ask: "on-miss",

security: "allowlist",

analysisOk: second.analysisOk,

allowlistSatisfied: second.allowlistSatisfied,

}),

).toBe(true);

});

it("does not persist comment-tailed payload paths that never execute", () => {