readd tests, remove markdown files

src/tools/shell.rs

@@ -365,4 +365,62 @@ mod tests {
 
         let _ = std::fs::remove_file(std::env::temp_dir().join("zeroclaw_shell_approval_test"));
     }
+
+    // ── §5.2 Shell timeout enforcement tests ─────────────────
+
+    #[test]
+    fn shell_timeout_constant_is_reasonable() {
+        assert_eq!(SHELL_TIMEOUT_SECS, 60, "shell timeout must be 60 seconds");
+    }
+
+    #[test]
+    fn shell_output_limit_is_1mb() {
+        assert_eq!(
+            MAX_OUTPUT_BYTES, 1_048_576,
+            "max output must be 1 MB to prevent OOM"
+        );
+    }
+
+    // ── §5.3 Non-UTF8 binary output tests ────────────────────
+
+    #[test]
+    fn shell_safe_env_vars_excludes_secrets() {
+        for var in SAFE_ENV_VARS {
+            let lower = var.to_lowercase();
+            assert!(
+                !lower.contains("key") && !lower.contains("secret") && !lower.contains("token"),
+                "SAFE_ENV_VARS must not include sensitive variable: {var}"
+            );
+        }
+    }
+
+    #[test]
+    fn shell_safe_env_vars_includes_essentials() {
+        assert!(
+            SAFE_ENV_VARS.contains(&"PATH"),
+            "PATH must be in safe env vars"
+        );
+        assert!(
+            SAFE_ENV_VARS.contains(&"HOME"),
+            "HOME must be in safe env vars"
+        );
+        assert!(
+            SAFE_ENV_VARS.contains(&"TERM"),
+            "TERM must be in safe env vars"
+        );
+    }
+
+    #[tokio::test]
+    async fn shell_blocks_rate_limited() {
+        let security = Arc::new(SecurityPolicy {
+            autonomy: AutonomyLevel::Supervised,
+            max_actions_per_hour: 0,
+            workspace_dir: std::env::temp_dir(),
+            ..SecurityPolicy::default()
+        });
+        let tool = ShellTool::new(security, test_runtime());
+        let result = tool.execute(json!({"command": "echo test"})).await.unwrap();
+        assert!(!result.success);
+        assert!(result.error.as_deref().unwrap_or("").contains("Rate limit"));
+    }
 }