bugfix

internal/config/config_test.go

@@ -3,6 +3,7 @@ package config
 import (
 	"encoding/json"
 	"fmt"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -65,6 +66,31 @@ func TestLoad_WorkspaceDefaults(t *testing.T) {
 	require.Equal(t, "git", cfg.Git.Binary)
 }
 
+func TestLoad_RunExecAllowedCommandsDefaultIsRestricted(t *testing.T) {
+	t.Setenv("APP_DB_DSN", "postgres://x")
+	t.Setenv("APP_MASTER_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	cfg, err := Load("")
+	require.NoError(t, err)
+	require.NotEmpty(t, cfg.Run.Exec.AllowedCommands)
+	require.Contains(t, cfg.Run.Exec.AllowedCommands, "go")
+	require.NotContains(t, cfg.Run.Exec.AllowedCommands, "sh")
+	require.NotContains(t, cfg.Run.Exec.AllowedCommands, "powershell")
+}
+
+func TestLoad_ConfigExample(t *testing.T) {
+	t.Setenv("APP_DB_DSN", "postgres://override")
+	t.Setenv("APP_MASTER_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	cfg, err := Load(filepath.Join("..", "..", "config.example.yaml"))
+	require.NoError(t, err)
+	require.Equal(t, "postgres://override", cfg.DB.DSN)
+	require.Equal(t, 15*time.Minute, cfg.Jobs.JobReaper.LeaseTimeout)
+	require.Equal(t, 10*time.Minute, cfg.Orchestrator.TurnTimeout)
+	require.NotEmpty(t, cfg.Run.Exec.AllowedCommands)
+	require.True(t, cfg.HTTP.Security.Enabled)
+}
+
 func TestMasterKey_Redaction(t *testing.T) {
 	k := MasterKey([]byte{0x01, 0x02, 0x03})
 	require.Equal(t, "[REDACTED 32B]", k.String())