"""Tests for AI response guardrails."""

from tai.ai_guardrails import validate_ai_response


def test_validate_ai_response_flags_missing_evidence_and_quotes() -> None:
    warnings = validate_ai_response("Root cause only, no structure.")
    assert any("Evidence section" in item for item in warnings)
    assert any("quoted evidence" in item for item in warnings)


def test_validate_ai_response_flags_risky_actions() -> None:
    text = "Evidence: `PasswordAuthentication no`\nRun systemctl restart sshd now."
    warnings = validate_ai_response(text)
    assert any("modifying actions" in item for item in warnings)


def test_validate_ai_response_allows_grounded_read_only_answer() -> None:
    text = (
        "Evidence: `PasswordAuthentication no`\n"
        "Recommended Actions: run `journalctl -u sshd -n 200 --no-pager`"
    )
    warnings = validate_ai_response(text)
    assert not warnings