v2.15.0 (#773)

Co-authored-by: Kim-Adeline Miguel <51720070+kimadeline@users.noreply.github.com>
Co-authored-by: Mathias Gesbert <mathias.gesbert@mistral.ai>
Co-authored-by: Maxime Dolores <maxime.dolores@ext.mistral.ai>
Co-authored-by: Nelson PROIA <144663685+Nelson-PROIA@users.noreply.github.com>
Co-authored-by: Paul VEZIA <166131032+le-codeur-rapide@users.noreply.github.com>
Co-authored-by: Pierre Rossinès <pierre.rossines@mistral.ai>
Co-authored-by: Quentin <quentin.torroba@mistral.ai>
Co-authored-by: Val <102326092+vdeva@users.noreply.github.com>
Co-authored-by: Vincent G <10739306+VinceOPS@users.noreply.github.com>
Co-authored-by: Mistral Vibe <vibe@mistral.ai>

tests/core/test_config_resolution.py

@@ -342,7 +342,10 @@ class TestMigrateLeavesFindInBashAllowlist:
     ) -> None:
         monkeypatch.setenv("VIBE_HOME", str(tmp_path))
         config_file = tmp_path / "config.toml"
-        data = {"tools": {"bash": {"allowlist": ["echo", "ls"]}}}
+        data = {
+            "applied_migrations": [VibeConfig._BASH_READ_ONLY_MIGRATION],
+            "tools": {"bash": {"allowlist": ["echo", "ls"]}},
+        }
         with config_file.open("wb") as f:
             tomli_w.dump(data, f)
 
@@ -359,7 +362,10 @@ class TestMigrateLeavesFindInBashAllowlist:
     ) -> None:
         monkeypatch.setenv("VIBE_HOME", str(tmp_path))
         config_file = tmp_path / "config.toml"
-        data = {"tools": {"bash": {"allowlist": ["echo", "find", "ls"]}}}
+        data = {
+            "applied_migrations": [VibeConfig._BASH_READ_ONLY_MIGRATION],
+            "tools": {"bash": {"allowlist": ["echo", "find", "ls"]}},
+        }
         with config_file.open("wb") as f:
             tomli_w.dump(data, f)
 
@@ -396,7 +402,8 @@ class TestMigrateStripsBashAllowlistWildcardSuffix:
         monkeypatch.setenv("VIBE_HOME", str(tmp_path))
         config_file = tmp_path / "config.toml"
         data = {
-            "tools": {"bash": {"allowlist": ["git commit *", "npm install *", "echo"]}}
+            "applied_migrations": [VibeConfig._BASH_READ_ONLY_MIGRATION],
+            "tools": {"bash": {"allowlist": ["git commit *", "npm install *", "echo"]}},
         }
         with config_file.open("wb") as f:
             tomli_w.dump(data, f)
@@ -420,7 +427,8 @@ class TestMigrateStripsBashAllowlistWildcardSuffix:
         monkeypatch.setenv("VIBE_HOME", str(tmp_path))
         config_file = tmp_path / "config.toml"
         data = {
-            "tools": {"bash": {"allowlist": ["git commit *", "git commit", "find"]}}
+            "applied_migrations": [VibeConfig._BASH_READ_ONLY_MIGRATION],
+            "tools": {"bash": {"allowlist": ["git commit *", "git commit", "find"]}},
         }
         with config_file.open("wb") as f:
             tomli_w.dump(data, f)
@@ -438,7 +446,10 @@ class TestMigrateStripsBashAllowlistWildcardSuffix:
     ) -> None:
         monkeypatch.setenv("VIBE_HOME", str(tmp_path))
         config_file = tmp_path / "config.toml"
-        data = {"tools": {"bash": {"allowlist": ["echo", "find", "ls"]}}}
+        data = {
+            "applied_migrations": [VibeConfig._BASH_READ_ONLY_MIGRATION],
+            "tools": {"bash": {"allowlist": ["echo", "find", "ls"]}},
+        }
         with config_file.open("wb") as f:
             tomli_w.dump(data, f)
 
@@ -451,6 +462,68 @@ class TestMigrateStripsBashAllowlistWildcardSuffix:
         assert result["tools"]["bash"]["allowlist"] == ["echo", "find", "ls"]
 
 
+class TestMigrateBashReadOnlyDefaults:
+    def test_merges_read_only_commands_into_existing_allowlist(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        from vibe.core.tools.builtins.bash import default_read_only_commands
+
+        monkeypatch.setenv("VIBE_HOME", str(tmp_path))
+        config_file = tmp_path / "config.toml"
+        data = {"tools": {"bash": {"allowlist": ["echo", "git commit"]}}}
+        with config_file.open("wb") as f:
+            tomli_w.dump(data, f)
+
+        reset_harness_files_manager()
+        init_harness_files_manager("user")
+        VibeConfig._migrate()
+
+        with config_file.open("rb") as f:
+            result = tomllib.load(f)
+        allowlist = result["tools"]["bash"]["allowlist"]
+        assert "git commit" in allowlist
+        for cmd in default_read_only_commands():
+            assert cmd in allowlist
+        assert VibeConfig._BASH_READ_ONLY_MIGRATION in result["applied_migrations"]
+
+    def test_does_not_readd_removed_command_after_migration(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("VIBE_HOME", str(tmp_path))
+        config_file = tmp_path / "config.toml"
+        data = {
+            "applied_migrations": [VibeConfig._BASH_READ_ONLY_MIGRATION],
+            "tools": {"bash": {"allowlist": ["echo", "find"]}},
+        }
+        with config_file.open("wb") as f:
+            tomli_w.dump(data, f)
+
+        reset_harness_files_manager()
+        init_harness_files_manager("user")
+        VibeConfig._migrate()
+
+        with config_file.open("rb") as f:
+            result = tomllib.load(f)
+        assert result["tools"]["bash"]["allowlist"] == ["echo", "find"]
+
+    def test_noop_when_no_bash_allowlist(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("VIBE_HOME", str(tmp_path))
+        config_file = tmp_path / "config.toml"
+        data = {"active_model": "test"}
+        with config_file.open("wb") as f:
+            tomli_w.dump(data, f)
+
+        reset_harness_files_manager()
+        init_harness_files_manager("user")
+        VibeConfig._migrate()
+
+        with config_file.open("rb") as f:
+            result = tomllib.load(f)
+        assert result == {"active_model": "test"}
+
+
 class TestMigrateMistralVibeCliLatestDefaults:
     def test_updates_alias_temperature_and_thinking_for_default_model(
         self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch