@google/gemini-cli-core 0.30.0-preview.5 → 0.31.0-preview.0

package/dist/src/policy/policy-engine.test.js

@@ -297,6 +297,41 @@ describe('PolicyEngine', () => {
         });
     });
     describe('MCP server wildcard patterns', () => {
+        it('should match global wildcard (*)', async () => {
+            engine = new PolicyEngine({
+                rules: [
+                    { toolName: '*', decision: PolicyDecision.ALLOW, priority: 10 },
+                ],
+            });
+            expect((await engine.check({ name: 'read_file' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'my-server__tool' }, 'my-server')).decision).toBe(PolicyDecision.ALLOW);
+        });
+        it('should match any MCP tool when toolName is *__*', async () => {
+            engine = new PolicyEngine({
+                rules: [
+                    { toolName: '*__*', decision: PolicyDecision.ALLOW, priority: 10 },
+                ],
+                defaultDecision: PolicyDecision.DENY,
+            });
+            expect((await engine.check({ name: 'mcp__tool' }, 'mcp')).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'other__tool' }, 'other')).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'read_file' }, undefined)).decision).toBe(PolicyDecision.DENY);
+        });
+        it('should match specific tool across all servers when using *__tool', async () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolName: '*__search',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 10,
+                    },
+                ],
+                defaultDecision: PolicyDecision.DENY,
+            });
+            expect((await engine.check({ name: 'ws__search' }, 'ws')).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'gh__search' }, 'gh')).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'gh__list' }, 'gh')).decision).toBe(PolicyDecision.DENY);
+        });
         it('should match MCP server wildcard patterns', async () => {
             const rules = [
                 {
@@ -312,16 +347,15 @@ describe('PolicyEngine', () => {
             ];
             engine = new PolicyEngine({ rules });
             // Should match my-server tools
-            expect((await engine.check({ name: 'my-server__tool1' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
-            expect((await engine.check({ name: 'my-server__another_tool' }, undefined))
+            expect((await engine.check({ name: 'my-server__tool1' }, 'my-server'))
+                .decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'my-server__another_tool' }, 'my-server'))
                 .decision).toBe(PolicyDecision.ALLOW);
             // Should match blocked-server tools
-            expect((await engine.check({ name: 'blocked-server__tool1' }, undefined))
-                .decision).toBe(PolicyDecision.DENY);
-            expect((await engine.check({ name: 'blocked-server__dangerous' }, undefined))
-                .decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'blocked-server__tool1' }, 'blocked-server')).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'blocked-server__dangerous' }, 'blocked-server')).decision).toBe(PolicyDecision.DENY);
             // Should not match other patterns
-            expect((await engine.check({ name: 'other-server__tool' }, undefined))
+            expect((await engine.check({ name: 'other-server__tool' }, 'other-server'))
                 .decision).toBe(PolicyDecision.ASK_USER);
             expect((await engine.check({ name: 'my-server-tool' }, undefined)).decision).toBe(PolicyDecision.ASK_USER); // No __ separator
             expect((await engine.check({ name: 'my-server' }, undefined)).decision).toBe(PolicyDecision.ASK_USER); // No tool name
@@ -341,9 +375,9 @@ describe('PolicyEngine', () => {
             ];
             engine = new PolicyEngine({ rules });
             // Specific tool deny should override server allow
-            expect((await engine.check({ name: 'my-server__dangerous-tool' }, undefined))
+            expect((await engine.check({ name: 'my-server__dangerous-tool' }, 'my-server'))
                 .decision).toBe(PolicyDecision.DENY);
-            expect((await engine.check({ name: 'my-server__safe-tool' }, undefined))
+            expect((await engine.check({ name: 'my-server__safe-tool' }, 'my-server'))
                 .decision).toBe(PolicyDecision.ALLOW);
         });
         it('should NOT match spoofed server names when using wildcards', async () => {
@@ -1669,6 +1703,39 @@ describe('PolicyEngine', () => {
                 ],
                 expected: [],
             },
+            {
+                name: 'should handle global wildcard * in getExcludedTools',
+                rules: [
+                    {
+                        toolName: '*',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                    },
+                ],
+                expected: ['*'],
+            },
+            {
+                name: 'should handle MCP category wildcard *__* in getExcludedTools',
+                rules: [
+                    {
+                        toolName: '*__*',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                    },
+                ],
+                expected: ['*__*'],
+            },
+            {
+                name: 'should handle tool wildcard *__search in getExcludedTools',
+                rules: [
+                    {
+                        toolName: '*__search',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                    },
+                ],
+                expected: ['*__search'],
+            },
         ];
         it.each(testCases)('$name', ({ rules, approvalMode, nonInteractive, expected }) => {
             engine = new PolicyEngine({
@@ -1679,6 +1746,293 @@ describe('PolicyEngine', () => {
             const excluded = engine.getExcludedTools();
             expect(Array.from(excluded).sort()).toEqual(expected.sort());
         });
+        it('should skip annotation-based rules when no metadata is provided', () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolAnnotations: { destructiveHint: true },
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                    },
+                ],
+            });
+            const excluded = engine.getExcludedTools();
+            expect(Array.from(excluded)).toEqual([]);
+        });
+        it('should exclude tools matching annotation-based DENY rule when metadata is provided', () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolAnnotations: { destructiveHint: true },
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                    },
+                ],
+            });
+            const metadata = new Map([
+                ['dangerous_tool', { destructiveHint: true }],
+                ['safe_tool', { readOnlyHint: true }],
+            ]);
+            const excluded = engine.getExcludedTools(metadata);
+            expect(Array.from(excluded)).toEqual(['dangerous_tool']);
+        });
+        it('should NOT exclude tools whose annotations do not match', () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolAnnotations: { destructiveHint: true },
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                    },
+                ],
+            });
+            const metadata = new Map([
+                ['safe_tool', { readOnlyHint: true }],
+            ]);
+            const excluded = engine.getExcludedTools(metadata);
+            expect(Array.from(excluded)).toEqual([]);
+        });
+        it('should exclude tools matching both toolName pattern AND annotations', () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolName: 'server__*',
+                        toolAnnotations: { destructiveHint: true },
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                    },
+                ],
+            });
+            const metadata = new Map([
+                ['server__dangerous_tool', { destructiveHint: true }],
+                ['other__dangerous_tool', { destructiveHint: true }],
+                ['server__safe_tool', { readOnlyHint: true }],
+            ]);
+            const excluded = engine.getExcludedTools(metadata);
+            expect(Array.from(excluded)).toEqual(['server__dangerous_tool']);
+        });
+        it('should exclude unprocessed tools from allToolNames when global DENY is active', () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolName: 'glob',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                    },
+                    {
+                        toolName: 'read_file',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                    },
+                    {
+                        // Simulates plan.toml: mcpName="*" → toolName="*__*"
+                        toolName: '*__*',
+                        toolAnnotations: { readOnlyHint: true },
+                        decision: PolicyDecision.ASK_USER,
+                        priority: 70,
+                    },
+                    {
+                        decision: PolicyDecision.DENY,
+                        priority: 60,
+                    },
+                ],
+            });
+            // MCP tools are registered with unqualified names in ToolRegistry
+            const allToolNames = new Set([
+                'glob',
+                'read_file',
+                'shell',
+                'web_fetch',
+                'read_mcp_tool',
+                'write_mcp_tool',
+            ]);
+            // buildToolMetadata() includes _serverName for MCP tools
+            const toolMetadata = new Map([
+                ['read_mcp_tool', { readOnlyHint: true, _serverName: 'my-server' }],
+                ['write_mcp_tool', { readOnlyHint: false, _serverName: 'my-server' }],
+            ]);
+            const excluded = engine.getExcludedTools(toolMetadata, allToolNames);
+            expect(excluded.has('shell')).toBe(true);
+            expect(excluded.has('web_fetch')).toBe(true);
+            // Non-read-only MCP tool excluded by catch-all DENY
+            expect(excluded.has('write_mcp_tool')).toBe(true);
+            expect(excluded.has('glob')).toBe(false);
+            expect(excluded.has('read_file')).toBe(false);
+            // Read-only MCP tool allowed by annotation rule
+            expect(excluded.has('read_mcp_tool')).toBe(false);
+        });
+        it('should match already-qualified MCP tool names without _serverName', () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolName: '*__*',
+                        toolAnnotations: { readOnlyHint: true },
+                        decision: PolicyDecision.ASK_USER,
+                        priority: 70,
+                    },
+                    {
+                        decision: PolicyDecision.DENY,
+                        priority: 60,
+                    },
+                ],
+            });
+            // Tool registered with qualified name (collision case)
+            const allToolNames = new Set([
+                'myserver__read_tool',
+                'myserver__write_tool',
+            ]);
+            const toolMetadata = new Map([
+                ['myserver__read_tool', { readOnlyHint: true }],
+                ['myserver__write_tool', { readOnlyHint: false }],
+            ]);
+            const excluded = engine.getExcludedTools(toolMetadata, allToolNames);
+            // Qualified name already contains __, matched directly without _serverName
+            expect(excluded.has('myserver__read_tool')).toBe(false);
+            expect(excluded.has('myserver__write_tool')).toBe(true);
+        });
+        it('should not exclude unprocessed tools when allToolNames is not provided (backward compat)', () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolName: 'glob',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                    },
+                    {
+                        toolName: 'read_file',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                    },
+                    {
+                        decision: PolicyDecision.DENY,
+                        priority: 60,
+                    },
+                ],
+            });
+            const excluded = engine.getExcludedTools();
+            // Without allToolNames, only explicitly named DENY tools are excluded
+            expect(excluded.has('shell')).toBe(false);
+            expect(excluded.has('web_fetch')).toBe(false);
+            expect(excluded.has('glob')).toBe(false);
+            expect(excluded.has('read_file')).toBe(false);
+        });
+        it('should correctly simulate plan.toml rules with allToolNames including MCP tools', () => {
+            // Simulate plan.toml: catch-all DENY at priority 60, explicit ALLOWs at 70,
+            // annotation-based ASK_USER for read-only MCP tools at priority 70.
+            // mcpName="*" in TOML becomes toolName="*__*" after loading.
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolName: 'glob',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: 'grep_search',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: 'read_file',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: 'list_directory',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: 'google_web_search',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: 'activate_skill',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: 'ask_user',
+                        decision: PolicyDecision.ASK_USER,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: 'exit_plan_mode',
+                        decision: PolicyDecision.ASK_USER,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        toolName: '*__*',
+                        toolAnnotations: { readOnlyHint: true },
+                        decision: PolicyDecision.ASK_USER,
+                        priority: 70,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        decision: PolicyDecision.DENY,
+                        priority: 60,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                ],
+                approvalMode: ApprovalMode.PLAN,
+            });
+            // MCP tools are registered with unqualified names in ToolRegistry
+            const allToolNames = new Set([
+                'glob',
+                'grep_search',
+                'read_file',
+                'list_directory',
+                'google_web_search',
+                'activate_skill',
+                'ask_user',
+                'exit_plan_mode',
+                'shell',
+                'write_file',
+                'replace',
+                'web_fetch',
+                'write_todos',
+                'memory',
+                'read_tool',
+                'write_tool',
+            ]);
+            // buildToolMetadata() includes _serverName for MCP tools
+            const toolMetadata = new Map([
+                ['read_tool', { readOnlyHint: true, _serverName: 'mcp-server' }],
+                ['write_tool', { readOnlyHint: false, _serverName: 'mcp-server' }],
+            ]);
+            const excluded = engine.getExcludedTools(toolMetadata, allToolNames);
+            // These should be excluded (caught by catch-all DENY)
+            expect(excluded.has('shell')).toBe(true);
+            expect(excluded.has('web_fetch')).toBe(true);
+            expect(excluded.has('write_todos')).toBe(true);
+            expect(excluded.has('memory')).toBe(true);
+            // write_file and replace are excluded unless they have argsPattern rules
+            // (argsPattern rules don't exclude, but don't explicitly allow either)
+            expect(excluded.has('write_file')).toBe(true);
+            expect(excluded.has('replace')).toBe(true);
+            // Non-read-only MCP tool excluded by catch-all DENY
+            expect(excluded.has('write_tool')).toBe(true);
+            // These should NOT be excluded (explicitly allowed)
+            expect(excluded.has('glob')).toBe(false);
+            expect(excluded.has('grep_search')).toBe(false);
+            expect(excluded.has('read_file')).toBe(false);
+            expect(excluded.has('list_directory')).toBe(false);
+            expect(excluded.has('google_web_search')).toBe(false);
+            expect(excluded.has('activate_skill')).toBe(false);
+            expect(excluded.has('ask_user')).toBe(false);
+            expect(excluded.has('exit_plan_mode')).toBe(false);
+            // Read-only MCP tool allowed by annotation rule (matched via _serverName)
+            expect(excluded.has('read_tool')).toBe(false);
+        });
     });
     describe('YOLO mode with ask_user tool', () => {
         it('should return ASK_USER for ask_user tool even in YOLO mode', async () => {
@@ -1751,5 +2105,122 @@ describe('PolicyEngine', () => {
             expect(shellResult.rule?.denyMessage).toContain('Execution of scripts (including those from skills) is blocked');
         });
     });
+    describe('removeRulesByTier', () => {
+        it('should remove rules matching a specific tier', () => {
+            engine.addRule({
+                toolName: 'rule1',
+                decision: PolicyDecision.ALLOW,
+                priority: 1.1,
+            });
+            engine.addRule({
+                toolName: 'rule2',
+                decision: PolicyDecision.ALLOW,
+                priority: 1.5,
+            });
+            engine.addRule({
+                toolName: 'rule3',
+                decision: PolicyDecision.ALLOW,
+                priority: 2.1,
+            });
+            engine.addRule({
+                toolName: 'rule4',
+                decision: PolicyDecision.ALLOW,
+                priority: 0.5,
+            });
+            engine.addRule({ toolName: 'rule5', decision: PolicyDecision.ALLOW }); // priority undefined -> 0
+            expect(engine.getRules()).toHaveLength(5);
+            engine.removeRulesByTier(1);
+            const rules = engine.getRules();
+            expect(rules).toHaveLength(3);
+            expect(rules.some((r) => r.toolName === 'rule1')).toBe(false);
+            expect(rules.some((r) => r.toolName === 'rule2')).toBe(false);
+            expect(rules.some((r) => r.toolName === 'rule3')).toBe(true);
+            expect(rules.some((r) => r.toolName === 'rule4')).toBe(true);
+            expect(rules.some((r) => r.toolName === 'rule5')).toBe(true);
+        });
+        it('should handle removing tier 0 rules (including undefined priority)', () => {
+            engine.addRule({
+                toolName: 'rule1',
+                decision: PolicyDecision.ALLOW,
+                priority: 0.5,
+            });
+            engine.addRule({ toolName: 'rule2', decision: PolicyDecision.ALLOW }); // defaults to 0
+            engine.addRule({
+                toolName: 'rule3',
+                decision: PolicyDecision.ALLOW,
+                priority: 1.5,
+            });
+            expect(engine.getRules()).toHaveLength(3);
+            engine.removeRulesByTier(0);
+            const rules = engine.getRules();
+            expect(rules).toHaveLength(1);
+            expect(rules[0].toolName).toBe('rule3');
+        });
+    });
+    describe('removeCheckersByTier', () => {
+        it('should remove checkers matching a specific tier', () => {
+            engine.addChecker({
+                checker: { type: 'external', name: 'c1' },
+                priority: 1.1,
+            });
+            engine.addChecker({
+                checker: { type: 'external', name: 'c2' },
+                priority: 1.9,
+            });
+            engine.addChecker({
+                checker: { type: 'external', name: 'c3' },
+                priority: 2.5,
+            });
+            expect(engine.getCheckers()).toHaveLength(3);
+            engine.removeCheckersByTier(1);
+            const checkers = engine.getCheckers();
+            expect(checkers).toHaveLength(1);
+            expect(checkers[0].priority).toBe(2.5);
+        });
+    });
+    describe('Tool Annotations', () => {
+        it('should match tools by semantic annotations', async () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolAnnotations: { readOnlyHint: true },
+                        decision: PolicyDecision.ALLOW,
+                        priority: 10,
+                    },
+                ],
+                defaultDecision: PolicyDecision.DENY,
+            });
+            const readOnlyTool = { name: 'read', args: {} };
+            const readOnlyMeta = { readOnlyHint: true, extra: 'info' };
+            const writeTool = { name: 'write', args: {} };
+            const writeMeta = { readOnlyHint: false };
+            expect((await engine.check(readOnlyTool, undefined, readOnlyMeta)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check(writeTool, undefined, writeMeta)).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check(writeTool, undefined, {})).decision).toBe(PolicyDecision.DENY);
+        });
+        it('should support scoped annotation rules', async () => {
+            engine = new PolicyEngine({
+                rules: [
+                    {
+                        toolName: '*__*',
+                        toolAnnotations: { experimental: true },
+                        decision: PolicyDecision.DENY,
+                        priority: 20,
+                    },
+                    {
+                        toolName: '*__*',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 10,
+                    },
+                ],
+            });
+            expect((await engine.check({ name: 'mcp__test' }, 'mcp', {
+                experimental: true,
+            })).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'mcp__stable' }, 'mcp', {
+                experimental: false,
+            })).decision).toBe(PolicyDecision.ALLOW);
+        });
+    });
 });
 //# sourceMappingURL=policy-engine.test.js.map