feat: 增加 AI Agent 自主诊断执行模式

tests/test_agent_tools.py

@@ -0,0 +1,38 @@
+import unittest
+
+from backend.agent_tools import classify_kubectl_command, parse_kubectl_command
+
+
+class KubectlCommandPolicyTest(unittest.TestCase):
+    def test_allows_read_only_kubectl_command_for_autonomous_execution(self):
+        decision = classify_kubectl_command("kubectl get pods -n production -o wide")
+
+        self.assertEqual(decision.mode, "read")
+        self.assertFalse(decision.requires_approval)
+
+    def test_requires_approval_for_mutating_kubectl_command(self):
+        decision = classify_kubectl_command("kubectl rollout restart deployment/api -n production")
+
+        self.assertEqual(decision.mode, "write")
+        self.assertTrue(decision.requires_approval)
+
+    def test_rejects_shell_operators_and_non_kubectl_commands(self):
+        for command in (
+            "kubectl get pods; rm -rf /",
+            "kubectl get pods | sh",
+            "bash -c kubectl get pods",
+            "sudo kubectl get pods",
+        ):
+            with self.subTest(command=command):
+                with self.assertRaises(ValueError):
+                    parse_kubectl_command(command)
+
+    def test_rejects_exec_even_when_command_looks_read_only(self):
+        decision = classify_kubectl_command("kubectl exec api-0 -- cat /etc/hosts")
+
+        self.assertEqual(decision.mode, "write")
+        self.assertTrue(decision.requires_approval)
+
+
+if __name__ == "__main__":
+    unittest.main()