@tdd_issue @tdd_issue_7503
Feature: TDD Issue #7503 — migration_runner _default_prompt_for_migration must reject on exception
  As a database administrator
  I want the migration runner to refuse migrations when the interactive prompt fails
  So that destructive schema migrations are never applied without explicit user consent

  The root cause is that `_default_prompt_for_migration` in migration_runner.py
  catches all exceptions with `except Exception` and returns `True` (auto-approve).
  This means any prompt failure (broken stdin, IOError, EOFError) silently applies
  destructive migrations to production databases without user confirmation.

  The fix narrows the exception handler to `(IOError, OSError, EOFError)`, logs at
  WARNING level, and returns `False` (reject) instead of `True` (auto-approve).
  `KeyboardInterrupt` is re-raised so Ctrl-C always works.

  Scenario: Prompt failure due to OSError rejects migration
    Given a migration runner configured for "sqlite:///:memory:"
    When the default migration prompt raises an IOError while prompting
    Then the default prompt should reject migration after the IO failure

  Scenario: Prompt failure due to EOFError rejects migration
    Given a migration runner configured for "sqlite:///:memory:"
    When the default migration prompt raises an EOFError while prompting
    Then the default prompt should reject migration after the EOF failure

  Scenario: Prompt failure due to unexpected exception rejects migration
    Given a migration runner configured for "sqlite:///:memory:"
    When the default migration prompt raises an unexpected exception while prompting
    Then the default prompt should reject migration after the unexpected failure

  Scenario: Non-interactive environment rejects migration by default
    Given a migration runner configured for "sqlite:///:memory:"
    When I evaluate the default migration prompt in a non-interactive environment
    Then the default prompt should reject without interaction

  Scenario: KeyboardInterrupt propagates from migration prompt
    Given a migration runner configured for "sqlite:///:memory:"
    When the default migration prompt receives a KeyboardInterrupt
    Then the KeyboardInterrupt should propagate from the migration prompt

  Scenario: Explicit auto-approve env var still approves migration
    Given a migration runner configured for "sqlite:///:memory:"
    When I evaluate the default migration prompt with CLEVERAGENTS_AUTO_APPLY_MIGRATIONS set to "true"
    Then the default prompt should auto approve without interaction
