def test_deploy_webhook_rejects_raw_shell():
    import pytest
    import deploy_webhook

    with pytest.raises(ValueError):
        deploy_webhook.command_for({"action": "run_shell", "target": "rm -rf /"})


def test_deploy_webhook_allows_known_action():
    import deploy_webhook

    cmd = deploy_webhook.command_for({"action": "restart_container", "target": "hermes"})
    assert cmd == "docker restart hermes"


def test_deploy_webhook_rejects_path_traversal_target():
    import pytest
    import deploy_webhook

    with pytest.raises(ValueError):
        deploy_webhook.command_for({"action": "run_skill_tests", "target": ".."})