use std::fs;use assert_cmd::Command;use pretty_assertions::assert_eq;use serde_json::json;use tempfile::TempDir;#[test]fn execpolicy_check_matches_expected_json() -> Result<(), Box<dyn std::error::Error>> {    let codex_home = TempDir::new()?;    let policy_path = codex_home.path().join("rules").join("policy.rules");    fs::create_dir_all(        policy_path            .parent()            .expect("policy path should have a parent"),    )?;    fs::write(        &policy_path,        r#"prefix_rule(    pattern = ["git", "push"],    decision = "forbidden",)"#,    )?;    let output = Command::new(codex_utils_cargo_bin::cargo_bin("codex")?)        .env("CODEX_HOME", codex_home.path())        .args([            "execpolicy",            "check",            "--rules",            policy_path                .to_str()                .expect("policy path should be valid UTF-8"),            "git",            "push",            "origin",            "main",        ])        .output()?;    assert!(output.status.success());    let result: serde_json::Value = serde_json::from_slice(&output.stdout)?;    assert_eq!(        result,        json!({            "decision": "forbidden",            "matchedRules": [                {                    "prefixRuleMatch": {                        "matchedPrefix": ["git", "push"],                        "decision": "forbidden"                    }                }            ]        })    );    Ok(())}#[test]fn execpolicy_check_includes_justification_when_present() -> Result<(), Box<dyn std::error::Error>>{    let codex_home = TempDir::new()?;    let policy_path = codex_home.path().join("rules").join("policy.rules");    fs::create_dir_all(        policy_path            .parent()            .expect("policy path should have a parent"),    )?;    fs::write(        &policy_path,        r#"prefix_rule(    pattern = ["git", "push"],    decision = "forbidden",    justification = "pushing is blocked in this repo",)"#,    )?;    let output = Command::new(codex_utils_cargo_bin::cargo_bin("codex")?)        .env("CODEX_HOME", codex_home.path())        .args([            "execpolicy",            "check",            "--rules",            policy_path                .to_str()                .expect("policy path should be valid UTF-8"),            "git",            "push",            "origin",            "main",        ])        .output()?;    assert!(output.status.success());    let result: serde_json::Value = serde_json::from_slice(&output.stdout)?;    assert_eq!(        result,        json!({            "decision": "forbidden",            "matchedRules": [                {                    "prefixRuleMatch": {                        "matchedPrefix": ["git", "push"],                        "decision": "forbidden",                        "justification": "pushing is blocked in this repo"                    }                }            ]        })    );    Ok(())}