V10.502 修正 AiderHeal 自動修復診斷

tests/test_aider_heal_executor.py

@@ -0,0 +1,45 @@
+def test_aider_heal_allowed_file_pattern_accepts_nested_service_modules():
+    from services import aider_heal_executor as svc
+
+    assert svc.ALLOWED_FILE_PATTERN.match("services/market_intel/phase.py")
+    assert svc.ALLOWED_FILE_PATTERN.match("routes/market_intel_mcp_run_routes.py")
+    assert svc.ALLOWED_FILE_PATTERN.match("database/ai_models.py")
+    assert not svc.ALLOWED_FILE_PATTERN.match("tests/test_market_intel_skeleton.py")
+    assert not svc.ALLOWED_FILE_PATTERN.match("config.py")
+
+
+def test_aider_heal_rejects_disallowed_file_before_ssh(monkeypatch):
+    from services import aider_heal_executor as svc
+
+    messages = []
+
+    def fail_if_called(*_args, **_kwargs):
+        raise AssertionError("SSH preflight should not run for disallowed files")
+
+    monkeypatch.setattr(svc, "_ssh_exec", fail_if_called)
+    monkeypatch.setattr(svc, "_notify_telegram", messages.append)
+
+    result = svc.execute_code_fix(
+        error_type="code_review_security",
+        error_message="疑似硬編碼敏感字串",
+        target_file="tests/test_market_intel_skeleton.py",
+    )
+
+    assert result["success"] is False
+    assert result["commit_sha"] is None
+    assert result["reverted"] is False
+    assert "不在 ADR-020 自動修復白名單" in result["message"]
+    assert messages
+    assert "已略過自動修復" in messages[0]
+
+
+def test_aider_heal_health_accepts_current_healthy_status(monkeypatch):
+    from services import aider_heal_executor as svc
+
+    monkeypatch.setattr(svc, "_http_get_json", lambda _url: {"status": "healthy"})
+
+    assert svc._wait_for_health(
+        "https://mo.wooo.work/health",
+        timeout_seconds=1,
+        interval_seconds=0,
+    ) is True

tests/test_code_review_pipeline_security.py

@@ -130,3 +130,43 @@ def test_guard_upgrades_llm_human_review_true_to_false(monkeypatch):
 
     assert guarded["auto_fix"] is True
     assert guarded["human_review_needed"] is False
+
+
+def test_complete_notification_marks_non_whitelisted_aider_files(monkeypatch):
+    """tests/docs/config 等 finding 不應在完成通知中宣稱 AiderHeal 會自動修復。"""
+    import services.telegram_templates as telegram_templates
+    import services.code_review_pipeline_service as module
+
+    messages = []
+    monkeypatch.setattr(telegram_templates, "_send_telegram_raw", messages.append)
+
+    pipeline = module.CodeReviewPipeline(
+        "abcdef123456",
+        ["tests/test_market_intel_skeleton.py"],
+    )
+    pipeline.state["severity_summary"] = {
+        "critical": 0,
+        "high": 1,
+        "medium": 0,
+        "low": 0,
+    }
+
+    pipeline._notify_complete(
+        [
+            {
+                "severity": "HIGH",
+                "description": "疑似硬編碼敏感字串",
+                "file": "tests/test_market_intel_skeleton.py",
+            }
+        ],
+        "",
+        {
+            "priority": "high",
+            "auto_fix": True,
+            "fix_files": ["tests/test_market_intel_skeleton.py"],
+        },
+    )
+
+    assert messages
+    assert "不在自動修復白名單" in messages[0]
+    assert "已觸發自動修復" not in messages[0]