Execute WP7.1 hardening (@executor subagent)

<file>
00001| (** Tests for git integration module *)
00002| 
00003| open Toki_lib
00004| 
00005| (** Helper to check if string contains substring *)
00006| let contains_substring ~substring str =
00007|   let len_str = String.length str in
00008|   let len_sub = String.length substring in
00009|   if len_sub > len_str then false
00010|   else
00011|     let rec check i =
00012|       if i > len_str - len_sub then false
00013|       else if String.sub str i len_sub = substring then true
00014|       else check (i + 1)
00015|     in
00016|     check 0
00017| 
00018| let () =
00019|   Printf.printf "=== Git Integration Tests ===\n\n";
00020| 
00021|   (* Test 1: default_mode is None *)
00022|   Printf.printf "Test 1: default_mode is None...\n";
00023|   (match Git_integration.default_mode with
00024|    | Git_integration.None -> Printf.printf "  PASS\n\n"
00025|    | _ ->
00026|      Printf.printf "  FAIL: default_mode should be None\n";
00027|      exit 1);
00028| 
00029|   (* Test 2: validate_toki_path accepts .toki/... *)
00030|   Printf.printf "Test 2: validate_toki_path accepts .toki/... paths...\n";
00031|   let valid_paths = [
00032|     [".toki"];
00033|     [".toki"; "providers"];
00034|     [".toki"; "providers"; "openrouter"];
00035|     [".toki"; "providers"; "openrouter"; "default"];
00036|     [".toki"; "providers"; "openrouter"; "default"; "key.json"];
00037|   ] in
00038|   let all_valid = List.for_all
00039|     (fun path -> match Git_integration.validate_toki_path path with
00040|      | Ok () -> true
00041|      | Error _ -> false)
00042|     valid_paths
00043|   in
00044|   if all_valid then Printf.printf "  PASS\n\n"
00045|   else begin
00046|     Printf.printf "  FAIL: .toki paths should be valid\n";
00047|     exit 1
00048|   end;
00049| 
00050|   (* Test 3: validate_toki_path rejects non-.toki paths *)
00051|   Printf.printf "Test 3: validate_toki_path rejects non-.toki paths...\n";
00052|   let invalid_paths = [
00053|     ["api"; "openrouter"...

Edit applied successfully.