Feat: more unit tests for tool output cap, guardrail and terminal exec tool

[Harrio-6]

Created more unit tests, added them to CI worklow

Summary by CodeRabbit

• Tests

  • Added comprehensive test coverage for chat tool output management, including error handling and fallback scenarios.
  • Added security validation tests for input filtering, access control mechanisms, and compatibility features.
  • Added terminal execution command safety validation tests.

• Chores

  • Updated CI workflow with new dependencies and expanded automated test coverage.

[coderabbitai]

Warning

Rate limit exceeded

@Harrio-6 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 44 minutes and 39 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 43aa5f00-f6c1-4e2b-8de2-74b83ba768a6

📥 Commits

Reviewing files that changed from the base of the PR and between 5ecf2ec and 7c2e0cd.

📒 Files selected for processing (4)

• .github/workflows/linters.yml
• server/tests/conftest.py
• server/tests/security/test_input_rail.py
• server/tests/security/test_terminal_exec_tool.py

Walkthrough

This PR adds comprehensive test coverage for chat tool output capping, security input rail verification, and terminal execution tool routing, along with CI configuration to install langchain-core and run these new test suites.

Changes

Test Coverage & CI Configuration

Layer / File(s)	Summary
CI Workflow Setup .github/workflows/linters.yml	Installs langchain-core dependency and registers new test modules (tests/chat/test_tool_output_cap.py, tests/security/test_input_rail.py, tests/security/test_terminal_exec_tool.py) in the test suite runner.
Tool Output Truncation & Summarization Tests server/tests/chat/test_tool_output_cap.py	Tests cap_tool_output pass-through, summarization invocation, pre-summarization truncation, failure fallback with hard-truncation, and threshold invariants to ensure outputs are correctly capped, summarized when needed, and degrade gracefully on errors.
Input Rail Security Tests server/tests/security/test_input_rail.py	Tests check_input fail-closed behavior across disabled config, rail fetch errors (generic/auth/connectivity), generation failures, and rail decision logic; also covers _GeminiMaxTokensCompat shim for max-tokens aliasing, structured-to-string flattening, binding, and model method proxying.
Terminal Exec Tool Routing Tests server/tests/security/test_terminal_exec_tool.py	Tests _has_shell_metacharacters detection, _transform_ssh_jump_to_proxy rewrite logic for identity files and port handling, and terminal_exec entrypoint wiring to verify command gate invocation, SSH-specific rewriting, and denial blocking via AST extraction and stubbed dependencies.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Arvo-AI/aurora#156: Introduces cap_tool_output truncation and summarization logic that is directly tested and validated by the new test_tool_output_cap.py suite in this PR.

Suggested reviewers

• Zarlanx
• beng360

Poem

🐰 Hop along the test-covered trail,
Where tool outputs and rails never fail,
SSH rewrites and guards standing tall,
These tests catch the bugs before they sprawl!
Security shines, from chat to the core,
More confidence now than we had before! 🧪✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 31.07% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main changes: it highlights the addition of multiple new unit test suites for tool output cap, guardrail (input_rail), and terminal exec tool, which are the primary deliverables across all changed files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch harryyang2005/dev-1095-unit-tests-design-doc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@server/tests/security/test_input_rail.py`:
- Around line 36-37: The helper _run creates a new asyncio event loop but never
closes it, causing ResourceWarning leaks; modify the _run(coro) implementation
to create the loop (e.g., loop = asyncio.new_event_loop()), run the coroutine
with loop.run_until_complete(coro) inside a try block, and always call
loop.close() in a finally block (or replace with asyncio.run(coro) if
compatible) so the event loop is properly closed after execution.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fe6d7892-35ca-4daa-aff9-ffc938127f5c

📥 Commits

Reviewing files that changed from the base of the PR and between 82855c9 and e470990.

📒 Files selected for processing (6)

• .github/workflows/linters.yml
• server/tests/chat/__init__.py
• server/tests/chat/test_tool_output_cap.py
• server/tests/security/__init__.py
• server/tests/security/test_input_rail.py
• server/tests/security/test_terminal_exec_tool.py

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@server/tests/security/test_terminal_exec_tool.py`:
- Line 40: The exec call using compile — specifically the expression
exec(compile(module, str(_SOURCE_FILE), "exec"), namespace) — needs an inline
linter suppression so Ruff/flake8-bandit doesn't flag S102; update that
statement to append an inline noqa for S102 (e.g., add "  # noqa: S102") to
explicitly suppress the rule for this test-only exec usage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 48290bbe-0f68-4ff1-8d2d-71563bfb9143

📥 Commits

Reviewing files that changed from the base of the PR and between a023611 and 5ecf2ec.

📒 Files selected for processing (3)

• server/tests/chat/test_tool_output_cap.py
• server/tests/security/test_input_rail.py
• server/tests/security/test_terminal_exec_tool.py

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud