fix: address 5 issues from 9-model code review

1. Fix yolo deny config path — write to altimate-code/ subdir under
   XDG_CONFIG_HOME so the app actually loads the deny rules
2. Rewrite deny test to use observable side-effect (touch marker file)
   instead of LLM output parsing — test now has a real fail path
3. Fix `altimate check --file` → positional arg (check.ts uses [files..])
4. Isolate test_dbt_discover in its own tmpdir to prevent race
   conditions with parallel smoke tests sharing $WORKDIR
5. Fix generate.sh regex: `cli/cmd/tui` was literal string, now
   `cli/|cmd/tui` to properly match CLI and TUI file changes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: kulvirgit

test/sanity/phases/resilience.sh

@@ -127,33 +127,38 @@ fi
 echo "  [8/10] Yolo deny enforcement..."
 if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
   # Create a config with an explicit deny rule
+  # App reads from $XDG_CONFIG_HOME/altimate-code/opencode.jsonc
   DENY_CONFIG_DIR=$(mktemp -d /tmp/sanity-deny-config-XXXXXX)
-  mkdir -p "$DENY_CONFIG_DIR"
-  cat > "$DENY_CONFIG_DIR/opencode.jsonc" <<'DENYEOF'
+  mkdir -p "$DENY_CONFIG_DIR/altimate-code"
+  cat > "$DENY_CONFIG_DIR/altimate-code/opencode.jsonc" <<DENYEOF
 {
   "permission": {
     "bash": {
       "*": "allow",
-      "DROP DATABASE *": "deny",
-      "drop database *": "deny"
+      "touch ${DENY_MARKER}": "deny",
+      "touch /tmp/sanity-deny-*": "deny"
     }
   }
 }
 DENYEOF
-  # Run with yolo and ask it to execute a denied command
+  # Use an observable side-effect: deny "touch" on a marker file.
+  # If deny enforcement works, the marker file will NOT be created.
+  DENY_MARKER="$DENY_CONFIG_DIR/deny-marker"
   DENY_OUTPUT=$(XDG_CONFIG_HOME="$DENY_CONFIG_DIR" timeout 30 altimate run --max-turns 2 --yolo --format json \
-    "run the bash command: DROP DATABASE production" 2>&1 || true)
-  # The output should NOT contain "DROP DATABASE production" as a successfully executed command
-  # It SHOULD contain "denied" or refuse the command
-  if echo "$DENY_OUTPUT" | grep -qi "denied\|blocked\|not allowed\|permission.*deny"; then
-    echo "  PASS: yolo deny rule blocked dangerous command"
+    "run this exact bash command: touch $DENY_MARKER" 2>&1 || true)
+  # Primary check: the marker file must not exist (deny blocked execution)
+  if [ -f "$DENY_MARKER" ]; then
+    echo "  FAIL: yolo mode bypassed deny rule — denied command was executed"
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+  elif echo "$DENY_OUTPUT" | grep -qi "denied\|blocked\|BLOCKED by deny rule\|not allowed"; then
+    echo "  PASS: yolo deny rule explicitly blocked command"
     PASS_COUNT=$((PASS_COUNT + 1))
-  elif echo "$DENY_OUTPUT" | grep -qi "DROP DATABASE production.*success\|executed.*DROP DATABASE"; then
-    echo "  FAIL: yolo mode bypassed deny rule — dangerous command executed"
+  elif [ -z "$DENY_OUTPUT" ]; then
+    echo "  FAIL: no output from deny enforcement test"
     FAIL_COUNT=$((FAIL_COUNT + 1))
   else
-    # The model may have refused on its own or rephrased — that's acceptable
-    echo "  PASS: yolo deny rule (command not executed)"
+    # Model may have refused on its own — marker absent so still safe
+    echo "  PASS: yolo deny rule (command not executed, marker absent)"
     PASS_COUNT=$((PASS_COUNT + 1))
   fi
   rm -rf "$DENY_CONFIG_DIR"

test/sanity/phases/smoke-tests.sh

@@ -153,9 +153,14 @@ test_discover() {
 }
 
 test_dbt_discover() {
-  cd "$WORKDIR"
-  # Create a minimal dbt project so auto-discover has something to find (#448, #270)
-  mkdir -p dbt_project models
+  # Use isolated workdir to avoid race conditions with parallel tests (#448, #270)
+  local dbt_dir=$(mktemp -d /tmp/sanity-dbt-XXXXXX)
+  cd "$dbt_dir"
+  git init -q
+  git config user.name "sanity-test"
+  git config user.email "sanity@test.local"
+  echo '{}' > package.json
+  mkdir -p models
   cat > dbt_project.yml <<'DBTEOF'
 name: sanity_test
 version: '1.0.0'
@@ -173,13 +178,14 @@ SQLEOF
   else
     echo "PASS" > "$RESULTS_DIR/dbt-discover"
   fi
+  rm -rf "$dbt_dir"
 }
 
 test_check_command() {
   cd "$WORKDIR"
   # altimate-code check should run deterministic SQL checks without LLM (#453)
   echo "SELECT * FROM users WHERE 1=1;" > check_target.sql
-  local output=$(timeout 30 altimate check --file check_target.sql 2>&1 || true)
+  local output=$(timeout 30 altimate check check_target.sql 2>&1 || true)
   if echo "$output" | grep -qi "TypeError\|unhandled\|Cannot read properties"; then
     echo "FAIL" > "$RESULTS_DIR/check-cmd"
   else

test/sanity/pr-tests/generate.sh

@@ -81,7 +81,7 @@ if echo "$changed" | grep -qE "permission|yolo|flag"; then
 fi
 
 # branding/welcome/help changed → check for opencode leaks
-if echo "$changed" | grep -qE "welcome|help|hints|cli/cmd/tui"; then
+if echo "$changed" | grep -qE "welcome|help|hints|cli/|cmd/tui"; then
   emit_test "branding-check" "$SCRIPT_DIR/phases/verify-install.sh"
 fi