README.md

@@ -45,7 +45,6 @@ Known secret response fields such as Dockhand's `hawserToken` and `webhookSecret
 | `/docker/inspect/{host}/{container}` | GET | Sanitized image, runtime, resources, mounts and state |
 | `/docker/restart/{host}/{container}` | POST | Restart container; supports `dry_run=true` |
 | `/config/reload` | POST | Reload YAML configuration and credential cache |
-| `/media/verify` | POST | ffprobe duration check on a NAS media file to catch truncated Sonarr/Radarr imports; flags `suspect` if deviation from `expected_minutes` exceeds `tolerance_pct` |
 
 ## VM lifecycle and inventory
 
@@ -98,14 +97,6 @@ Integration Compose definition: `tests/compose.integration.yaml` (binds only to
 
 ## Changelog
 
-### 2.4.8 — 17.09.2026
-
-- Fixed `POST /media/verify` false-positive rejection: filenames containing a legitimate apostrophe (e.g. "La'An" in a Star Trek episode title) were blocked as "unsafe characters". Replaced the naive single-quote wrapping + apostrophe blocklist with proper `shlex.quote()` escaping for the remote ffprobe command; only newline/NUL byte injection is still rejected.
-
-### 2.4.7 — 17.09.2026
-
-- Added `POST /media/verify`: probes a media file's real duration via `ffprobe` (running inside the existing `bazarrUHD` container on `arrapps`, which already mounts `/data` and ships ffmpeg — no new service needed) and flags it as `suspect` when it deviates from an `expected_minutes` value beyond `tolerance_pct`. Catches truncated Sonarr/Radarr imports (e.g. a re-grab that lands as 1.8 GB instead of the expected 8 GB for a UHD episode) after the file is already on the NAS.
-
 ### 2.3.2 — 22.07.2026
 
 - Make Vaultwarden refresh durable: persistent named cache volume, protected runtime credentials, automatic API-key re-login and atomic cache writes.

tests/test_app.py

@@ -1,7 +1,6 @@
 import os
 import asyncio
 import json
-import shlex
 import time
 from datetime import datetime, timedelta, timezone
 
@@ -44,207 +43,7 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.4.1"
+    assert response.json()["version"] == app.VERSION == "2.3.5"
-
-
-def test_media_handoff_proxies_strict_category_contract(monkeypatch):
-    captured = {}
-
-    class FakeResponse:
-        status_code = 200
-
-        def json(self):
-            return {"ok": True, "jobId": "test-job-1234", "state": "registered"}
-
-    class FakeClient:
-        def __init__(self, **kwargs):
-            captured["client"] = kwargs
-
-        async def __aenter__(self):
-            return self
-
-        async def __aexit__(self, *_args):
-            return None
-
-        async def post(self, url, json, headers):
-            captured.update(url=url, json=json, headers=headers)
-            return FakeResponse()
-
-    monkeypatch.setattr(app.httpx, "AsyncClient", FakeClient)
-    with TestClient(app.app) as client:
-        monkeypatch.setattr(app, "SERVICES", {"n8n": {"url": "http://n8n:5678", "auth": "n8n"}})
-        response = client.post(
-            "/media/handoff",
-            headers={"Authorization": "Bearer test-token"},
-            json={
-                "action": "start",
-                "category": "serien4k",
-                "directory": "/usenet/complete/serien4k/Show.S01E01",
-                "release": "Show.S01E01-GRP",
-                "cleanName": "Show S01E01",
-                "expectedFiles": 2,
-            },
-        )
-    assert response.status_code == 200
-    assert response.json()["state"] == "registered"
-    assert captured["url"] == "http://n8n:5678/webhook/media-handoff"
-    assert captured["json"]["category"] == "serien4k"
-    assert captured["json"]["expectedFiles"] == 2
-
-
-def test_media_handoff_rejects_untrusted_caller_before_proxy(monkeypatch):
-    monkeypatch.setattr(app.httpx, "AsyncClient", lambda **_kwargs: (_ for _ in ()).throw(AssertionError("must not proxy")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/handoff",
-            json={"action": "status", "jobId": "test-job-1234"},
-        )
-    assert response.status_code == 403
-
-
-def test_media_handoff_rejects_wrong_category_path(monkeypatch):
-    monkeypatch.setattr(app.httpx, "AsyncClient", lambda **_kwargs: (_ for _ in ()).throw(AssertionError("must not proxy")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/handoff",
-            headers={"Authorization": "Bearer test-token"},
-            json={
-                "action": "start",
-                "category": "video4k",
-                "directory": "/usenet/complete/serien4k/Wrong",
-                "release": "Wrong",
-            },
-        )
-    assert response.status_code == 422
-
-
-def test_media_handoff_accepts_english_arr_categories(monkeypatch):
-    """serienen/videoen muessen durchgehen (sonarrEN 8991 / radarrEN 7880).
-
-    16.09.2026: fehlten in allowed_categories -> HTTP 422 -> movetdarr.sh
-    brach mit "n8n-Handoff konnte nicht registriert werden" ab und liess
-    Mutiny.2026 x2 tagelang in /usenet/complete/videoen liegen.
-    """
-    seen = []
-
-    class FakeResponse:
-        status_code = 200
-
-        def json(self):
-            return {"ok": True, "jobId": "test-job-5678", "state": "registered"}
-
-    class FakeClient:
-        def __init__(self, **_kwargs):
-            pass
-
-        async def __aenter__(self):
-            return self
-
-        async def __aexit__(self, *_args):
-            return None
-
-        async def post(self, url, json, headers):
-            seen.append(json)
-            return FakeResponse()
-
-    monkeypatch.setattr(app.httpx, "AsyncClient", FakeClient)
-    with TestClient(app.app) as client:
-        monkeypatch.setattr(app, "SERVICES", {"n8n": {"url": "http://n8n:5678", "auth": "n8n"}})
-        for category in ("serienen", "videoen"):
-            response = client.post(
-                "/media/handoff",
-                headers={"Authorization": "Bearer test-token"},
-                json={
-                    "action": "start",
-                    "category": category,
-                    "directory": f"/usenet/complete/{category}/Release.2026",
-                    "release": "Release.2026-GRP",
-                    "cleanName": "Release 2026",
-                    "expectedFiles": 1,
-                },
-            )
-            assert response.status_code == 200, (category, response.text)
-            assert response.json()["state"] == "registered", category
-
-    assert [item["category"] for item in seen] == ["serienen", "videoen"]
-
-
-def test_media_handoff_still_rejects_unknown_category(monkeypatch):
-    """Fail-closed bleibt: eine frei erfundene Kategorie wird nicht geproxyt."""
-    monkeypatch.setattr(
-        app.httpx,
-        "AsyncClient",
-        lambda **_kwargs: (_ for _ in ()).throw(AssertionError("must not proxy")),
-    )
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/handoff",
-            headers={"Authorization": "Bearer test-token"},
-            json={
-                "action": "start",
-                "category": "hoerbuecher",
-                "directory": "/usenet/complete/hoerbuecher/Buch",
-                "release": "Buch",
-            },
-        )
-    assert response.status_code == 422
-
-
-def test_media_handoff_english_category_path_must_match(monkeypatch):
-    """Pfadpruefung gilt auch fuer die neuen Kategorien."""
-    monkeypatch.setattr(
-        app.httpx,
-        "AsyncClient",
-        lambda **_kwargs: (_ for _ in ()).throw(AssertionError("must not proxy")),
-    )
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/handoff",
-            headers={"Authorization": "Bearer test-token"},
-            json={
-                "action": "start",
-                "category": "videoen",
-                "directory": "/usenet/complete/video4k/Wrong",
-                "release": "Wrong",
-            },
-        )
-    assert response.status_code == 422
-
-
-def test_paperless_import_queues_pdf_through_butler(monkeypatch):
-    captured = {}
-
-    def fake_upload(host, command, payload, timeout):
-        captured.update(host=host, command=command, payload=payload, timeout=timeout)
-        return 0, "", ""
-
-    monkeypatch.setattr(app, "_ssh_bytes", fake_upload)
-    pdf = b"%PDF-1.7\nvalid-test-payload"
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/paperless/import?filename=Hausordnung%20Stand%2009.05.2022.pdf",
-            content=pdf,
-            headers={"Authorization": "Bearer test-token", "Content-Type": "application/pdf"},
-        )
-    assert response.status_code == 200
-    body = response.json()
-    assert body["status"] == "queued"
-    assert body["filename"].startswith("Hausordnung_Stand_09.05.2022-")
-    assert captured["host"] == app.PAPERLESS_GATEWAY
-    assert app.PAPERLESS_SSH in captured["command"]
-    assert captured["payload"] == pdf
-    assert app.PAPERLESS_CONSUME_DIR in captured["command"]
-
-
-def test_paperless_import_rejects_non_pdf(monkeypatch):
-    monkeypatch.setattr(app, "_ssh_bytes", lambda *args: (_ for _ in ()).throw(AssertionError("must not upload")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/paperless/import?filename=bad.pdf",
-            content=b"not a pdf",
-            headers={"Authorization": "Bearer test-token"},
-        )
-    assert response.status_code == 400
 
 
 def test_ui_serves_self_contained_operator_console():
@@ -486,9 +285,6 @@ def test_capabilities_is_live_machine_readable_safety_map():
     assert removal["mode"] == "mutation"
     assert removal["dry_run"] is True
     assert removal["critical"] is True
-    tunnel = by_operation[("POST", "/network/media-tunnel/sascha")]
-    assert tunnel["dry_run"] is True
-    assert tunnel["critical"] is True
     assert by_operation[("DELETE", "/vm/destroy/{vmid}")]["dry_run"] is True
     assert all(item["path"] != "/{service}/{path}" for item in payload["operations"])
     assert payload["model_contract"]["instruction"].startswith("Prefer read_only")
@@ -902,115 +698,6 @@ def test_uptime_monitor_remove_rejects_invalid_expected_name_before_ssh(monkeypa
     assert response.status_code == 400
 
 
-def test_media_verify_returns_duration_and_not_suspect_when_within_tolerance(monkeypatch):
-    monkeypatch.setattr(app, "_find_inventory_host", lambda host: {"user": "sascha", "ip": "10.2.1.100"})
-    calls = []
-
-    def fake_ssh(host, command, timeout=30):
-        calls.append((host, command, timeout))
-        return 0, "2967.355000\n", ""
-
-    monkeypatch.setattr(app, "_ssh", fake_ssh)
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/verify",
-            headers={"Authorization": "Bearer test-token"},
-            json={"host": "arrapps", "path": "/data/UHD/serien/Show/ep.mkv", "expected_minutes": 49.5},
-        )
-    assert response.status_code == 200
-    body = response.json()
-    assert body["duration_minutes"] == 49.46
-    assert body["suspect"] is False
-    assert calls[0][0] == "sascha@10.2.1.100"
-    assert "bazarrUHD" in calls[0][1]
-    assert "ffprobe" in calls[0][1]
-
-
-def test_media_verify_flags_truncated_file_as_suspect(monkeypatch):
-    monkeypatch.setattr(app, "_find_inventory_host", lambda host: {"user": "sascha", "ip": "10.2.1.100"})
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (0, "1836.0\n", ""))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/verify",
-            headers={"Authorization": "Bearer test-token"},
-            json={"host": "arrapps", "path": "/data/UHD/serien/Show/ep.mkv", "expected_minutes": 49.5},
-        )
-    assert response.status_code == 200
-    body = response.json()
-    assert body["suspect"] is True
-    assert body["deviation_pct"] > 20
-
-
-def test_media_verify_rejects_path_outside_data_before_ssh(monkeypatch):
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/verify",
-            headers={"Authorization": "Bearer test-token"},
-            json={"host": "arrapps", "path": "/etc/passwd"},
-        )
-    assert response.status_code == 400
-
-
-def test_media_verify_allows_apostrophe_in_filename_and_quotes_it_safely(monkeypatch):
-    monkeypatch.setattr(app, "_find_inventory_host", lambda host: {"user": "sascha", "ip": "10.2.1.100"})
-    calls = []
-
-    def fake_ssh(host, command, timeout=30):
-        calls.append((host, command, timeout))
-        return 0, "2967.0\n", ""
-
-    monkeypatch.setattr(app, "_ssh", fake_ssh)
-    path = "/data/FHD/serien/Star Trek - Strange New Worlds (2022)/Season 04/Once La'An a Time.mkv"
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/verify",
-            headers={"Authorization": "Bearer test-token"},
-            json={"host": "arrapps", "path": path, "expected_minutes": 49.5},
-        )
-    assert response.status_code == 200
-    # shlex.quote must produce a command the remote shell parses as ONE argument,
-    # i.e. no unescaped apostrophe breaks out of quoting.
-    executed_cmd = calls[0][1]
-    quoted = shlex.quote(path)
-    assert quoted in executed_cmd
-    assert shlex.split(executed_cmd)[-1] == path
-
-
-def test_media_verify_rejects_shell_metacharacters_before_ssh(monkeypatch):
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/verify",
-            headers={"Authorization": "Bearer test-token"},
-            json={"host": "arrapps", "path": "/data/UHD/serien/a\x00.mkv"},
-        )
-    assert response.status_code == 400
-
-
-def test_media_verify_rejects_unknown_host_before_ssh(monkeypatch):
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/verify",
-            headers={"Authorization": "Bearer test-token"},
-            json={"host": "unknown-host", "path": "/data/UHD/serien/ep.mkv"},
-        )
-    assert response.status_code == 400
-
-
-def test_media_verify_returns_502_on_unparsable_ffprobe_output(monkeypatch):
-    monkeypatch.setattr(app, "_find_inventory_host", lambda host: {"user": "sascha", "ip": "10.2.1.100"})
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (0, "N/A\n", ""))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/verify",
-            headers={"Authorization": "Bearer test-token"},
-            json={"host": "arrapps", "path": "/data/UHD/serien/ep.mkv", "expected_minutes": 49.5},
-        )
-    assert response.status_code == 502
-
-
 def test_invalid_log_target_is_rejected_before_ssh():
     with TestClient(app.app) as client:
         response = client.get(
@@ -1480,124 +1167,3 @@ def test_speedtest_deploy_requires_strong_secrets_and_uses_full_git_app(monkeypa
     assert deploy[1]["compose.yaml"] == "content:compose.yaml"
     assert deploy[2] == "correct-horse-battery-staple"
     assert deploy[3] == "streamscope-session-secret-with-entropy"
-
-
-def test_sascha_media_edge_audit_uses_fixed_hetzner_host(monkeypatch):
-    payload = {
-        "hostname": "pfannkuchen",
-        "caddy": {"container_running": True, "protocols": ["h1", "h2", "h3"], "upstreams": ["10.6.1.103:8096"]},
-        "network": {"wg_media": False, "udp_51821": False},
-    }
-    calls = []
-    monkeypatch.setattr(app, "_find_inventory_host", lambda name: {"name": name, "user": "root", "ip": "46.225.230.72"})
-    monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=30: (calls.append((host, command, timeout)) or (0, json.dumps(payload), "")))
-    with TestClient(app.app) as client:
-        response = client.get("/media/edge/sascha", headers={"Authorization": "Bearer test-token"})
-    assert response.status_code == 200
-    assert response.json()["caddy"]["upstreams"] == ["10.6.1.103:8096"]
-    assert calls[0][0] == "root@46.225.230.72"
-    assert "PrivateKey" not in response.text
-
-
-def test_sascha_media_tunnel_defaults_to_side_effect_free_dry_run(monkeypatch):
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("dry-run must not SSH")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/network/media-tunnel/sascha",
-            headers={"Authorization": "Bearer test-token"},
-            json={},
-        )
-    assert response.status_code == 200
-    body = response.json()
-    assert body["status"] == "would_deploy"
-    assert body["vps_address"] == "10.11.13.1/32"
-    assert body["emby_address"] == "10.11.13.3/32"
-    assert body["listen_port"] == 51821
-
-
-def test_sascha_media_tunnel_requires_explicit_confirmation(monkeypatch):
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("unconfirmed request must not SSH")))
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/network/media-tunnel/sascha",
-            headers={"Authorization": "Bearer test-token"},
-            json={"dry_run": False},
-        )
-    assert response.status_code == 400
-
-
-def test_sascha_media_tunnel_apply_returns_redacted_result(monkeypatch):
-    result = {
-        "status": "deployed",
-        "interface": "wg-media",
-        "vps_address": "10.11.13.1/32",
-        "emby_address": "10.11.13.3/32",
-        "listen_port": 51821,
-        "handshake": True,
-        "ping_vps_to_emby": True,
-        "ping_emby_to_vps": True,
-    }
-    monkeypatch.setattr(app, "_deploy_sascha_media_tunnel", lambda: result)
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/network/media-tunnel/sascha",
-            headers={"Authorization": "Bearer test-token"},
-            json={"dry_run": False, "confirmation": "DEPLOY_DIRECT_SASCHA_MEDIA_TUNNEL"},
-        )
-    assert response.status_code == 200
-    assert response.json()["handshake"] is True
-    assert "private" not in response.text.lower()
-
-
-def test_sascha_media_tunnel_candidate_uses_valid_wireguard_interface_name():
-    import base64
-    import re
-
-    command = app._media_tunnel_install_command("vps", "A" * 43 + "=")
-    encoded = re.search(r"b64decode\('([^']+)'\)", command).group(1)
-    script = base64.b64decode(encoded).decode()
-    assert 'root / "wgmtest.conf"' in script
-    assert len("wgmtest") <= 15
-
-
-def test_sascha_media_path_benchmark_returns_both_fixed_routes(monkeypatch):
-    monkeypatch.setattr(app, "_benchmark_sascha_media_paths", lambda: {
-        "legacy_node6": {"bytes": 268435456, "seconds": 4.0, "mbit_s": 536.9},
-        "direct_wg_media": {"bytes": 268435456, "seconds": 3.0, "mbit_s": 715.8},
-    })
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/network/media-tunnel/sascha/benchmark",
-            headers={"Authorization": "Bearer test-token"},
-        )
-    assert response.status_code == 200
-    assert response.json()["direction"] == "emby-sascha_to_hetzner"
-    assert set(response.json()["results"]) == {"legacy_node6", "direct_wg_media"}
-
-
-def test_sascha_media_edge_optimize_is_dry_run_by_default(monkeypatch):
-    monkeypatch.setattr(app, "_optimize_sascha_media_edge", lambda: (_ for _ in ()).throw(AssertionError("dry-run must not mutate")))
-    with TestClient(app.app) as client:
-        response = client.post("/media/edge/sascha/optimize", headers={"Authorization": "Bearer test-token"}, json={})
-    assert response.status_code == 200
-    assert response.json()["protocols"] == ["h1", "h2"]
-    assert response.json()["upstream"] == "10.11.13.3:8096"
-
-
-def test_sascha_media_edge_optimize_requires_confirmation(monkeypatch):
-    monkeypatch.setattr(app, "_optimize_sascha_media_edge", lambda: (_ for _ in ()).throw(AssertionError("must not mutate")))
-    with TestClient(app.app) as client:
-        response = client.post("/media/edge/sascha/optimize", headers={"Authorization": "Bearer test-token"}, json={"dry_run": False})
-    assert response.status_code == 400
-
-
-def test_sascha_media_edge_optimize_applies_fixed_safe_result(monkeypatch):
-    monkeypatch.setattr(app, "_optimize_sascha_media_edge", lambda: {"status": "optimized", "upstream": "10.11.13.3:8096", "protocols": ["h1", "h2"], "backup": "/app-config/caddy/backup", "sha256": "a" * 64})
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/media/edge/sascha/optimize",
-            headers={"Authorization": "Bearer test-token"},
-            json={"dry_run": False, "confirmation": "OPTIMIZE_TV_SASCHA_LUTZ_DE"},
-        )
-    assert response.status_code == 200
-    assert response.json()["status"] == "optimized"

tests/test_bw_manager_deploy.py

@@ -18,8 +18,6 @@ def load_app(monkeypatch):
 
 def test_bw_manager_deploy_rejects_bundle_without_and_gate(monkeypatch):
     app = load_app(monkeypatch)
-    if not hasattr(app, "BW_MANAGER_REPO_FILES"):
-        pytest.skip("BW-Manager was intentionally retired on 13.08.2026")
     files = {path: "placeholder" for path in app.BW_MANAGER_REPO_FILES}
     files["compose.yaml"] = "services:\n  bw-manager:\n    build: ./src\n"
     files["src/app.py"] = "def old_policy(): pass\n"

tests/test_guck_admin_deploy.py

@@ -1,54 +0,0 @@
-import app
-import pytest
-from fastapi.testclient import TestClient
-
-
-def valid_bundle():
-    files={path:'placeholder' for path in app.GUCK_ADMIN_REPO_FILES}
-    files['guck-admin/compose.yaml']='''services:\n  guck-admin:\n    build: .\n    network_mode: host\n    cap_add: [NET_ADMIN]\n    environment:\n      GUCK_LIMIT: /host/guck-limit.sh\n    volumes:\n      - /app-config/guck-admin/data:/data\n  control-monitor:\n    build: .\n    network_mode: host\n    cap_add: [NET_ADMIN]\n'''
-    files['guck-admin/src/control.py']='''CREATE TABLE IF NOT EXISTS custom_networks\n2a00:8c40:f000::/36\n45.58.235.0/24\ndef sync_custom_networks(): pass\n'''
-    return files
-
-
-def test_guck_admin_bundle_requires_persistent_custom_network_policy():
-    files=valid_bundle()
-    files['guck-admin/src/control.py']='def old_control(): pass\n'
-    with pytest.raises(ValueError,match='custom VPN'):
-        app._validate_guck_admin_bundle(files)
-
-
-def test_guck_admin_deploy_dry_run_has_no_remote_side_effect(monkeypatch):
-    calls=[]
-    monkeypatch.setattr(app,'_find_inventory_host',lambda host:{'user':'debian','ip':'141.94.237.199'})
-    monkeypatch.setattr(app,'_ssh',lambda *args,**kwargs:calls.append(args))
-    result=app._deploy_guck_admin_compose(valid_bundle(),dry_run=True)
-    assert result['status']=='validated'
-    assert result['host']=='guck-vps'
-    assert calls==[]
-
-
-def test_guck_admin_deploy_uses_inventory_target_and_verifies_policy(monkeypatch):
-    calls=[]
-    monkeypatch.setattr(app,'_find_inventory_host',lambda host:{'user':'debian','ip':'141.94.237.199'})
-    def fake_ssh(host,command,timeout=600):
-        calls.append((host,command,timeout))
-        if 'ipset test vpn-v6' in command:
-            return 0,'policy ok',''
-        return 0,'ok',''
-    monkeypatch.setattr(app,'_ssh',fake_ssh)
-    result=app._deploy_guck_admin_compose(valid_bundle(),dry_run=False)
-    assert result['status']=='deployed'
-    assert result['policy']=='verified'
-    assert all(host=='debian@141.94.237.199' for host,_,_ in calls)
-    commands='\n'.join(command for _,command,_ in calls)
-    assert 'docker compose build' in commands
-    assert '127.0.0.1:9090/health' in commands
-    assert '/actions/limiter/refresh' in commands
-    assert 'ipset test vpn-v6 2a00:8c40:f02d:a34c::1' in commands
-    assert 'ipset test vpn-v4 45.58.235.7' in commands
-
-
-def test_guck_admin_deploy_endpoint_requires_auth(monkeypatch):
-    monkeypatch.setattr(app,'BUTLER_TOKEN','test-token')
-    response=TestClient(app.app).post('/vps/guck-admin/deploy',json={'dry_run':True})
-    assert response.status_code in (401,403)