@google/gemini-cli-core 0.30.0-preview.6 → 0.31.0-preview.0

package/dist/src/policy/integrity.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export declare enum IntegrityStatus {
+    MATCH = "MATCH",
+    MISMATCH = "MISMATCH",
+    NEW = "NEW"
+}
+export interface IntegrityResult {
+    status: IntegrityStatus;
+    hash: string;
+    fileCount: number;
+}
+export declare class PolicyIntegrityManager {
+    /**
+     * Checks the integrity of policies in a given directory against the stored hash.
+     *
+     * @param scope The scope of the policy (e.g., 'project', 'user').
+     * @param identifier A unique identifier for the policy scope (e.g., project path).
+     * @param policyDir The directory containing the policy files.
+     * @returns IntegrityResult indicating if the current policies match the stored hash.
+     */
+    checkIntegrity(scope: string, identifier: string, policyDir: string): Promise<IntegrityResult>;
+    /**
+     * Accepts and persists the current integrity hash for a given policy scope.
+     *
+     * @param scope The scope of the policy.
+     * @param identifier A unique identifier for the policy scope (e.g., project path).
+     * @param hash The hash to persist.
+     */
+    acceptIntegrity(scope: string, identifier: string, hash: string): Promise<void>;
+    /**
+     * Calculates a SHA-256 hash of all policy files in the directory.
+     * The hash includes the relative file path and content to detect renames and modifications.
+     *
+     * @param policyDir The directory containing the policy files.
+     * @returns The calculated hash and file count
+     */
+    private static calculateIntegrityHash;
+    private getIntegrityKey;
+    private loadIntegrityData;
+    private saveIntegrityData;
+}

package/dist/src/policy/integrity.js

@@ -0,0 +1,121 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { Storage } from '../config/storage.js';
+import { readPolicyFiles } from './toml-loader.js';
+import { debugLogger } from '../utils/debugLogger.js';
+import { isNodeError } from '../utils/errors.js';
+export var IntegrityStatus;
+(function (IntegrityStatus) {
+    IntegrityStatus["MATCH"] = "MATCH";
+    IntegrityStatus["MISMATCH"] = "MISMATCH";
+    IntegrityStatus["NEW"] = "NEW";
+})(IntegrityStatus || (IntegrityStatus = {}));
+export class PolicyIntegrityManager {
+    /**
+     * Checks the integrity of policies in a given directory against the stored hash.
+     *
+     * @param scope The scope of the policy (e.g., 'project', 'user').
+     * @param identifier A unique identifier for the policy scope (e.g., project path).
+     * @param policyDir The directory containing the policy files.
+     * @returns IntegrityResult indicating if the current policies match the stored hash.
+     */
+    async checkIntegrity(scope, identifier, policyDir) {
+        const { hash: currentHash, fileCount } = await PolicyIntegrityManager.calculateIntegrityHash(policyDir);
+        const storedData = await this.loadIntegrityData();
+        const key = this.getIntegrityKey(scope, identifier);
+        const storedHash = storedData[key];
+        if (!storedHash) {
+            return { status: IntegrityStatus.NEW, hash: currentHash, fileCount };
+        }
+        if (storedHash === currentHash) {
+            return { status: IntegrityStatus.MATCH, hash: currentHash, fileCount };
+        }
+        return { status: IntegrityStatus.MISMATCH, hash: currentHash, fileCount };
+    }
+    /**
+     * Accepts and persists the current integrity hash for a given policy scope.
+     *
+     * @param scope The scope of the policy.
+     * @param identifier A unique identifier for the policy scope (e.g., project path).
+     * @param hash The hash to persist.
+     */
+    async acceptIntegrity(scope, identifier, hash) {
+        const storedData = await this.loadIntegrityData();
+        const key = this.getIntegrityKey(scope, identifier);
+        storedData[key] = hash;
+        await this.saveIntegrityData(storedData);
+    }
+    /**
+     * Calculates a SHA-256 hash of all policy files in the directory.
+     * The hash includes the relative file path and content to detect renames and modifications.
+     *
+     * @param policyDir The directory containing the policy files.
+     * @returns The calculated hash and file count
+     */
+    static async calculateIntegrityHash(policyDir) {
+        try {
+            const files = await readPolicyFiles(policyDir);
+            // Sort files by path to ensure deterministic hashing
+            files.sort((a, b) => a.path.localeCompare(b.path));
+            const hash = crypto.createHash('sha256');
+            for (const file of files) {
+                const relativePath = path.relative(policyDir, file.path);
+                // Include relative path and content in the hash
+                hash.update(relativePath);
+                hash.update('\0'); // Separator
+                hash.update(file.content);
+                hash.update('\0'); // Separator
+            }
+            return { hash: hash.digest('hex'), fileCount: files.length };
+        }
+        catch (error) {
+            debugLogger.error('Failed to calculate policy integrity hash', error);
+            // Return a unique hash (random) to force a mismatch if calculation fails?
+            // Or throw? Throwing is better so we don't accidentally accept/deny corrupted state.
+            throw error;
+        }
+    }
+    getIntegrityKey(scope, identifier) {
+        return `${scope}:${identifier}`;
+    }
+    async loadIntegrityData() {
+        const storagePath = Storage.getPolicyIntegrityStoragePath();
+        try {
+            const content = await fs.readFile(storagePath, 'utf-8');
+            const parsed = JSON.parse(content);
+            if (typeof parsed === 'object' &&
+                parsed !== null &&
+                Object.values(parsed).every((v) => typeof v === 'string')) {
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+                return parsed;
+            }
+            debugLogger.warn('Invalid policy integrity data format');
+            return {};
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === 'ENOENT') {
+                return {};
+            }
+            debugLogger.error('Failed to load policy integrity data', error);
+            return {};
+        }
+    }
+    async saveIntegrityData(data) {
+        const storagePath = Storage.getPolicyIntegrityStoragePath();
+        try {
+            await fs.mkdir(path.dirname(storagePath), { recursive: true });
+            await fs.writeFile(storagePath, JSON.stringify(data, null, 2), 'utf-8');
+        }
+        catch (error) {
+            debugLogger.error('Failed to save policy integrity data', error);
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=integrity.js.map

package/dist/src/policy/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../../src/policy/integrity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,kCAAe,CAAA;IACf,wCAAqB,CAAA;IACrB,8BAAW,CAAA;AACb,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAYD,MAAM,OAAO,sBAAsB;IACjC;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,UAAkB,EAClB,SAAiB;QAEjB,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GACpC,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,UAAkB,EAClB,IAAY;QAEZ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACvB,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,KAAK,CAAC,sBAAsB,CACzC,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAE/C,qDAAqD;YACrD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,gDAAgD;gBAChD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;gBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;YACjC,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YACtE,0EAA0E;YAC1E,qFAAqF;YACrF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,KAAa,EAAE,UAAkB;QACvD,OAAO,GAAG,KAAK,IAAI,UAAU,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EACzD,CAAC;gBACD,uEAAuE;gBACvE,OAAO,MAA6B,CAAC;YACvC,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,WAAW,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACjE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,IAAyB;QACvD,MAAM,WAAW,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACjE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/src/policy/integrity.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/policy/integrity.test.js

@@ -0,0 +1,132 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
+import { PolicyIntegrityManager, IntegrityStatus } from './integrity.js';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { Storage } from '../config/storage.js';
+describe('PolicyIntegrityManager', () => {
+    let integrityManager;
+    let tempDir;
+    let integrityStoragePath;
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'gemini-cli-test-'));
+        integrityStoragePath = path.join(tempDir, 'policy_integrity.json');
+        vi.spyOn(Storage, 'getPolicyIntegrityStoragePath').mockReturnValue(integrityStoragePath);
+        integrityManager = new PolicyIntegrityManager();
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+        vi.restoreAllMocks();
+    });
+    describe('checkIntegrity', () => {
+        it('should return NEW if no stored hash', async () => {
+            const policyDir = path.join(tempDir, 'policies');
+            await fs.mkdir(policyDir);
+            await fs.writeFile(path.join(policyDir, 'a.toml'), 'contentA');
+            const result = await integrityManager.checkIntegrity('workspace', 'id', policyDir);
+            expect(result.status).toBe(IntegrityStatus.NEW);
+            expect(result.hash).toBeDefined();
+            expect(result.hash).toHaveLength(64);
+            expect(result.fileCount).toBe(1);
+        });
+        it('should return MATCH if stored hash matches', async () => {
+            const policyDir = path.join(tempDir, 'policies');
+            await fs.mkdir(policyDir);
+            await fs.writeFile(path.join(policyDir, 'a.toml'), 'contentA');
+            // First run to get the hash
+            const resultNew = await integrityManager.checkIntegrity('workspace', 'id', policyDir);
+            const currentHash = resultNew.hash;
+            // Save the hash to mock storage
+            await fs.writeFile(integrityStoragePath, JSON.stringify({ 'workspace:id': currentHash }));
+            const result = await integrityManager.checkIntegrity('workspace', 'id', policyDir);
+            expect(result.status).toBe(IntegrityStatus.MATCH);
+            expect(result.hash).toBe(currentHash);
+        });
+        it('should return MISMATCH if stored hash differs', async () => {
+            const policyDir = path.join(tempDir, 'policies');
+            await fs.mkdir(policyDir);
+            await fs.writeFile(path.join(policyDir, 'a.toml'), 'contentA');
+            const resultNew = await integrityManager.checkIntegrity('workspace', 'id', policyDir);
+            const currentHash = resultNew.hash;
+            // Save a different hash
+            await fs.writeFile(integrityStoragePath, JSON.stringify({ 'workspace:id': 'different_hash' }));
+            const result = await integrityManager.checkIntegrity('workspace', 'id', policyDir);
+            expect(result.status).toBe(IntegrityStatus.MISMATCH);
+            expect(result.hash).toBe(currentHash);
+        });
+        it('should result in different hash if filename changes', async () => {
+            const policyDir1 = path.join(tempDir, 'policies1');
+            await fs.mkdir(policyDir1);
+            await fs.writeFile(path.join(policyDir1, 'a.toml'), 'contentA');
+            const result1 = await integrityManager.checkIntegrity('workspace', 'id', policyDir1);
+            const policyDir2 = path.join(tempDir, 'policies2');
+            await fs.mkdir(policyDir2);
+            await fs.writeFile(path.join(policyDir2, 'b.toml'), 'contentA');
+            const result2 = await integrityManager.checkIntegrity('workspace', 'id', policyDir2);
+            expect(result1.hash).not.toBe(result2.hash);
+        });
+        it('should result in different hash if content changes', async () => {
+            const policyDir = path.join(tempDir, 'policies');
+            await fs.mkdir(policyDir);
+            await fs.writeFile(path.join(policyDir, 'a.toml'), 'contentA');
+            const result1 = await integrityManager.checkIntegrity('workspace', 'id', policyDir);
+            await fs.writeFile(path.join(policyDir, 'a.toml'), 'contentB');
+            const result2 = await integrityManager.checkIntegrity('workspace', 'id', policyDir);
+            expect(result1.hash).not.toBe(result2.hash);
+        });
+        it('should be deterministic (sort order)', async () => {
+            const policyDir1 = path.join(tempDir, 'policies1');
+            await fs.mkdir(policyDir1);
+            await fs.writeFile(path.join(policyDir1, 'a.toml'), 'contentA');
+            await fs.writeFile(path.join(policyDir1, 'b.toml'), 'contentB');
+            const result1 = await integrityManager.checkIntegrity('workspace', 'id', policyDir1);
+            // Re-read with same files but they might be in different order in readdir
+            // PolicyIntegrityManager should sort them.
+            const result2 = await integrityManager.checkIntegrity('workspace', 'id', policyDir1);
+            expect(result1.hash).toBe(result2.hash);
+        });
+        it('should handle multiple projects correctly', async () => {
+            const dirA = path.join(tempDir, 'dirA');
+            await fs.mkdir(dirA);
+            await fs.writeFile(path.join(dirA, 'p.toml'), 'contentA');
+            const dirB = path.join(tempDir, 'dirB');
+            await fs.mkdir(dirB);
+            await fs.writeFile(path.join(dirB, 'p.toml'), 'contentB');
+            const { hash: hashA } = await integrityManager.checkIntegrity('workspace', 'idA', dirA);
+            const { hash: hashB } = await integrityManager.checkIntegrity('workspace', 'idB', dirB);
+            // Save to storage
+            await fs.writeFile(integrityStoragePath, JSON.stringify({
+                'workspace:idA': hashA,
+                'workspace:idB': 'oldHashB',
+            }));
+            // Project A should match
+            const resultA = await integrityManager.checkIntegrity('workspace', 'idA', dirA);
+            expect(resultA.status).toBe(IntegrityStatus.MATCH);
+            expect(resultA.hash).toBe(hashA);
+            // Project B should mismatch
+            const resultB = await integrityManager.checkIntegrity('workspace', 'idB', dirB);
+            expect(resultB.status).toBe(IntegrityStatus.MISMATCH);
+            expect(resultB.hash).toBe(hashB);
+        });
+    });
+    describe('acceptIntegrity', () => {
+        it('should save the hash to storage', async () => {
+            await integrityManager.acceptIntegrity('workspace', 'id', 'hash123');
+            const stored = JSON.parse(await fs.readFile(integrityStoragePath, 'utf-8'));
+            expect(stored['workspace:id']).toBe('hash123');
+        });
+        it('should update existing hash', async () => {
+            await fs.writeFile(integrityStoragePath, JSON.stringify({ 'other:id': 'otherhash' }));
+            await integrityManager.acceptIntegrity('workspace', 'id', 'hash123');
+            const stored = JSON.parse(await fs.readFile(integrityStoragePath, 'utf-8'));
+            expect(stored['other:id']).toBe('otherhash');
+            expect(stored['workspace:id']).toBe('hash123');
+        });
+    });
+});
+//# sourceMappingURL=integrity.test.js.map

package/dist/src/policy/integrity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.test.js","sourceRoot":"","sources":["../../../src/policy/integrity.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,gBAAwC,CAAC;IAC7C,IAAI,OAAe,CAAC;IACpB,IAAI,oBAA4B,CAAC;IAEjC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACvE,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QAEnE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC,eAAe,CAChE,oBAAoB,CACrB,CAAC;QAEF,gBAAgB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAClD,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAE/D,4BAA4B;YAC5B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACrD,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;YACF,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC;YAEnC,gCAAgC;YAChC,MAAM,EAAE,CAAC,SAAS,CAChB,oBAAoB,EACpB,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAChD,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAClD,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACrD,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;YACF,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC;YAEnC,wBAAwB;YACxB,MAAM,EAAE,CAAC,SAAS,CAChB,oBAAoB,EACpB,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CACrD,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAClD,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAEhE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,IAAI,EACJ,UAAU,CACX,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAEhE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,IAAI,EACJ,UAAU,CACX,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE1B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;YAEF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAEhE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,IAAI,EACJ,UAAU,CACX,CAAC;YAEF,0EAA0E;YAC1E,2CAA2C;YAC3C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,IAAI,EACJ,UAAU,CACX,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAE1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAE1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAC3D,WAAW,EACX,KAAK,EACL,IAAI,CACL,CAAC;YACF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAC3D,WAAW,EACX,KAAK,EACL,IAAI,CACL,CAAC;YAEF,kBAAkB;YAClB,MAAM,EAAE,CAAC,SAAS,CAChB,oBAAoB,EACpB,IAAI,CAAC,SAAS,CAAC;gBACb,eAAe,EAAE,KAAK;gBACtB,eAAe,EAAE,UAAU;aAC5B,CAAC,CACH,CAAC;YAEF,yBAAyB;YACzB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,KAAK,EACL,IAAI,CACL,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEjC,4BAA4B;YAC5B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACnD,WAAW,EACX,KAAK,EACL,IAAI,CACL,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,gBAAgB,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAErE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACjD,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,EAAE,CAAC,SAAS,CAChB,oBAAoB,EACpB,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAC5C,CAAC;YAEF,MAAM,gBAAgB,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAErE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACjD,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/policy/persistence.test.js

@@ -6,17 +6,18 @@
 import { describe, it, expect, vi, beforeEach, afterEach, } from 'vitest';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
-import { createPolicyUpdater } from './config.js';
+import { createPolicyUpdater, ALWAYS_ALLOW_PRIORITY } from './config.js';
 import { PolicyEngine } from './policy-engine.js';
 import { MessageBus } from '../confirmation-bus/message-bus.js';
 import { MessageBusType } from '../confirmation-bus/types.js';
-import { Storage } from '../config/storage.js';
+import { Storage, AUTO_SAVED_POLICY_FILENAME } from '../config/storage.js';
 import { ApprovalMode } from './types.js';
 vi.mock('node:fs/promises');
 vi.mock('../config/storage.js');
 describe('createPolicyUpdater', () => {
     let policyEngine;
     let messageBus;
+    let mockStorage;
     beforeEach(() => {
         policyEngine = new PolicyEngine({
             rules: [],
@@ -24,15 +25,18 @@ describe('createPolicyUpdater', () => {
             approvalMode: ApprovalMode.DEFAULT,
         });
         messageBus = new MessageBus(policyEngine);
+        mockStorage = new Storage('/mock/project');
         vi.clearAllMocks();
     });
     afterEach(() => {
         vi.restoreAllMocks();
     });
     it('should persist policy when persist flag is true', async () => {
-        createPolicyUpdater(policyEngine, messageBus);
-        const userPoliciesDir = '/mock/user/policies';
-        vi.spyOn(Storage, 'getUserPoliciesDir').mockReturnValue(userPoliciesDir);
+        createPolicyUpdater(policyEngine, messageBus, mockStorage);
+        const workspacePoliciesDir = '/mock/project/.gemini/policies';
+        const policyFile = path.join(workspacePoliciesDir, AUTO_SAVED_POLICY_FILENAME);
+        vi.spyOn(mockStorage, 'getWorkspacePoliciesDir').mockReturnValue(workspacePoliciesDir);
+        vi.spyOn(mockStorage, 'getAutoSavedPolicyPath').mockReturnValue(policyFile);
         fs.mkdir.mockResolvedValue(undefined);
         fs.readFile.mockRejectedValue(new Error('File not found')); // Simulate new file
         const mockFileHandle = {
@@ -49,18 +53,18 @@ describe('createPolicyUpdater', () => {
         });
         // Wait for async operations (microtasks)
         await new Promise((resolve) => setTimeout(resolve, 0));
-        expect(Storage.getUserPoliciesDir).toHaveBeenCalled();
-        expect(fs.mkdir).toHaveBeenCalledWith(userPoliciesDir, {
+        expect(mockStorage.getWorkspacePoliciesDir).toHaveBeenCalled();
+        expect(fs.mkdir).toHaveBeenCalledWith(workspacePoliciesDir, {
             recursive: true,
         });
         expect(fs.open).toHaveBeenCalledWith(expect.stringMatching(/\.tmp$/), 'wx');
         // Check written content
         const expectedContent = expect.stringContaining(`toolName = "test_tool"`);
         expect(mockFileHandle.writeFile).toHaveBeenCalledWith(expectedContent, 'utf-8');
-        expect(fs.rename).toHaveBeenCalledWith(expect.stringMatching(/\.tmp$/), path.join(userPoliciesDir, 'auto-saved.toml'));
+        expect(fs.rename).toHaveBeenCalledWith(expect.stringMatching(/\.tmp$/), policyFile);
     });
     it('should not persist policy when persist flag is false or undefined', async () => {
-        createPolicyUpdater(policyEngine, messageBus);
+        createPolicyUpdater(policyEngine, messageBus, mockStorage);
         await messageBus.publish({
             type: MessageBusType.UPDATE_POLICY,
             toolName: 'test_tool',
@@ -70,9 +74,11 @@ describe('createPolicyUpdater', () => {
         expect(fs.rename).not.toHaveBeenCalled();
     });
     it('should persist policy with commandPrefix when provided', async () => {
-        createPolicyUpdater(policyEngine, messageBus);
-        const userPoliciesDir = '/mock/user/policies';
-        vi.spyOn(Storage, 'getUserPoliciesDir').mockReturnValue(userPoliciesDir);
+        createPolicyUpdater(policyEngine, messageBus, mockStorage);
+        const workspacePoliciesDir = '/mock/project/.gemini/policies';
+        const policyFile = path.join(workspacePoliciesDir, AUTO_SAVED_POLICY_FILENAME);
+        vi.spyOn(mockStorage, 'getWorkspacePoliciesDir').mockReturnValue(workspacePoliciesDir);
+        vi.spyOn(mockStorage, 'getAutoSavedPolicyPath').mockReturnValue(policyFile);
         fs.mkdir.mockResolvedValue(undefined);
         fs.readFile.mockRejectedValue(new Error('File not found'));
         const mockFileHandle = {
@@ -94,16 +100,18 @@ describe('createPolicyUpdater', () => {
         const rules = policyEngine.getRules();
         const addedRule = rules.find((r) => r.toolName === toolName);
         expect(addedRule).toBeDefined();
-        expect(addedRule?.priority).toBe(2.95);
+        expect(addedRule?.priority).toBe(ALWAYS_ALLOW_PRIORITY);
         expect(addedRule?.argsPattern).toEqual(new RegExp(`"command":"git\\ status(?:[\\s"]|\\\\")`));
         // Verify file written
         expect(fs.open).toHaveBeenCalledWith(expect.stringMatching(/\.tmp$/), 'wx');
         expect(mockFileHandle.writeFile).toHaveBeenCalledWith(expect.stringContaining(`commandPrefix = "git status"`), 'utf-8');
     });
     it('should persist policy with mcpName and toolName when provided', async () => {
-        createPolicyUpdater(policyEngine, messageBus);
-        const userPoliciesDir = '/mock/user/policies';
-        vi.spyOn(Storage, 'getUserPoliciesDir').mockReturnValue(userPoliciesDir);
+        createPolicyUpdater(policyEngine, messageBus, mockStorage);
+        const workspacePoliciesDir = '/mock/project/.gemini/policies';
+        const policyFile = path.join(workspacePoliciesDir, AUTO_SAVED_POLICY_FILENAME);
+        vi.spyOn(mockStorage, 'getWorkspacePoliciesDir').mockReturnValue(workspacePoliciesDir);
+        vi.spyOn(mockStorage, 'getAutoSavedPolicyPath').mockReturnValue(policyFile);
         fs.mkdir.mockResolvedValue(undefined);
         fs.readFile.mockRejectedValue(new Error('File not found'));
         const mockFileHandle = {
@@ -131,9 +139,11 @@ describe('createPolicyUpdater', () => {
         expect(writtenContent).toContain('priority = 200');
     });
     it('should escape special characters in toolName and mcpName', async () => {
-        createPolicyUpdater(policyEngine, messageBus);
-        const userPoliciesDir = '/mock/user/policies';
-        vi.spyOn(Storage, 'getUserPoliciesDir').mockReturnValue(userPoliciesDir);
+        createPolicyUpdater(policyEngine, messageBus, mockStorage);
+        const workspacePoliciesDir = '/mock/project/.gemini/policies';
+        const policyFile = path.join(workspacePoliciesDir, AUTO_SAVED_POLICY_FILENAME);
+        vi.spyOn(mockStorage, 'getWorkspacePoliciesDir').mockReturnValue(workspacePoliciesDir);
+        vi.spyOn(mockStorage, 'getAutoSavedPolicyPath').mockReturnValue(policyFile);
         fs.mkdir.mockResolvedValue(undefined);
         fs.readFile.mockRejectedValue(new Error('File not found'));
         const mockFileHandle = {

package/dist/src/policy/persistence.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.test.js","sourceRoot":"","sources":["../../../src/policy/persistence.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,QAAQ,EACR,EAAE,EACF,MAAM,EACN,EAAE,EACF,UAAU,EACV,SAAS,GAEV,MAAM,QAAQ,CAAC;AAChB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5B,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAEhC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,YAA0B,CAAC;IAC/B,IAAI,UAAsB,CAAC;IAE3B,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,GAAG,IAAI,YAAY,CAAC;YAC9B,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,YAAY,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,UAAU,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,mBAAmB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE9C,MAAM,eAAe,GAAG,qBAAqB,CAAC;QAC9C,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACxE,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC,CAAC,oBAAoB;QAEvB,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC7B,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,yCAAyC;QACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACtD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,eAAe,EAAE;YACrD,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAE5E,wBAAwB;QACxB,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QAC1E,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACnD,eAAe,EACf,OAAO,CACR,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACpC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAC/B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,mBAAmB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE9C,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,mBAAmB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE9C,MAAM,eAAe,GAAG,qBAAqB,CAAC;QAC9C,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACxE,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC;QAEF,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACrC,MAAM,aAAa,GAAG,YAAY,CAAC;QAEnC,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;YACb,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,mCAAmC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,OAAO,CACpC,IAAI,MAAM,CAAC,yCAAyC,CAAC,CACtD,CAAC;QAEF,sBAAsB;QACtB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACnD,MAAM,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EACvD,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,mBAAmB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE9C,MAAM,eAAe,GAAG,qBAAqB,CAAC;QAC9C,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACxE,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC;QAEF,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,cAAc,GAAG,QAAQ,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,cAAc,EAAE,CAAC;QAEjD,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,sBAAsB;QACtB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAW,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,cAAc,OAAO,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,eAAe,cAAc,GAAG,CAAC,CAAC;QACnE,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,mBAAmB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE9C,MAAM,eAAe,GAAG,qBAAqB,CAAC;QAC9C,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACxE,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC;QAEF,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAEhD,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAW,CAAC;QAE9C,yCAAyC;QACzC,iGAAiG;QACjG,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"persistence.test.js","sourceRoot":"","sources":["../../../src/policy/persistence.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,QAAQ,EACR,EAAE,EACF,MAAM,EACN,EAAE,EACF,UAAU,EACV,SAAS,GAEV,MAAM,QAAQ,CAAC;AAChB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5B,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAEhC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,YAA0B,CAAC;IAC/B,IAAI,UAAsB,CAAC;IAC3B,IAAI,WAAoB,CAAC;IAEzB,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,GAAG,IAAI,YAAY,CAAC;YAC9B,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,YAAY,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,UAAU,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1C,WAAW,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;QAC3C,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAE3D,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EACpB,0BAA0B,CAC3B,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,eAAe,CAC9D,oBAAoB,CACrB,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3E,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC,CAAC,oBAAoB;QAEvB,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC7B,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,yCAAyC;QACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC/D,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,EAAE;YAC1D,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAE5E,wBAAwB;QACxB,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QAC1E,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACnD,eAAe,EACf,OAAO,CACR,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACpC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAC/B,UAAU,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAE3D,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAE3D,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EACpB,0BAA0B,CAC3B,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,eAAe,CAC9D,oBAAoB,CACrB,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3E,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC;QAEF,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACrC,MAAM,aAAa,GAAG,YAAY,CAAC;QAEnC,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;YACb,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,mCAAmC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACxD,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,OAAO,CACpC,IAAI,MAAM,CAAC,yCAAyC,CAAC,CACtD,CAAC;QAEF,sBAAsB;QACtB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACnD,MAAM,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EACvD,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAE3D,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EACpB,0BAA0B,CAC3B,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,eAAe,CAC9D,oBAAoB,CACrB,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3E,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC;QAEF,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,cAAc,GAAG,QAAQ,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,cAAc,EAAE,CAAC;QAEjD,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,sBAAsB;QACtB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAW,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,cAAc,OAAO,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,eAAe,cAAc,GAAG,CAAC,CAAC;QACnE,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAE3D,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EACpB,0BAA0B,CAC3B,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,eAAe,CAC9D,oBAAoB,CACrB,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3E,EAAE,CAAC,KAAyB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,EAAE,CAAC,QAA4B,CAAC,iBAAiB,CAChD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC;QAEF,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SAC5C,CAAC;QACD,EAAE,CAAC,IAAwB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE,CAAC,MAA0B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAEhD,MAAM,UAAU,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,QAAQ;YACR,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAW,CAAC;QAE9C,yCAAyC;QACzC,iGAAiG;QACjG,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/policy/policies/conseca.toml

@@ -0,0 +1,6 @@
+[[safety_checker]]
+toolName = "*"
+priority = 100
+[safety_checker.checker]
+type = "in-process"
+name = "conseca"

package/dist/src/policy/policies/plan.toml

@@ -5,19 +5,20 @@
 #
 # Priority bands (tiers):
 # - Default policies (TOML): 1 + priority/1000 (e.g., priority 100 → 1.100)
-# - User policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
-# - Admin policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+# - Workspace policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
+# - User policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+# - Admin policies (TOML): 4 + priority/1000 (e.g., priority 100 → 4.100)
 #
-# This ensures Admin > User > Default hierarchy is always preserved,
+# This ensures Admin > User > Workspace > Default hierarchy is always preserved,
 # while allowing user-specified priorities to work within each tier.
 #
-# Settings-based and dynamic rules (all in user tier 2.x):
-#   2.95: Tools that the user has selected as "Always Allow" in the interactive UI
-#   2.9:  MCP servers excluded list (security: persistent server blocks)
-#   2.4:  Command line flag --exclude-tools (explicit temporary blocks)
-#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
-#   2.2:  MCP servers with trust=true (persistent trusted servers)
-#   2.1:  MCP servers allowed list (persistent general server allows)
+# Settings-based and dynamic rules (all in user tier 3.x):
+#   3.95: Tools that the user has selected as "Always Allow" in the interactive UI
+#   3.9:  MCP servers excluded list (security: persistent server blocks)
+#   3.4:  Command line flag --exclude-tools (explicit temporary blocks)
+#   3.3:  Command line flag --allowed-tools (explicit temporary allows)
+#   3.2:  MCP servers with trust=true (persistent trusted servers)
+#   3.1:  MCP servers allowed list (persistent general server allows)
 #
 # TOML policy priorities (before transformation):
 #   10: Write tools default to ASK_USER (becomes 1.010 in default tier)
@@ -35,6 +36,13 @@ deny_message = "You are in Plan Mode with access to read-only tools. Execution o
 
 # Explicitly Allow Read-Only Tools in Plan mode.
 
+[[rule]]
+mcpName = "*"
+toolAnnotations = { readOnlyHint = true }
+decision = "ask_user"
+priority = 70
+modes = ["plan"]
+
 [[rule]]
 toolName = ["glob", "grep_search", "list_directory", "read_file", "google_web_search", "activate_skill"]
 decision = "allow"
@@ -47,10 +55,18 @@ decision = "ask_user"
 priority = 70
 modes = ["plan"]
 
-# Allow write_file and replace for .md files in plans directory
+# Allow write_file and replace for .md files in the plans directory (cross-platform)
 [[rule]]
 toolName = ["write_file", "replace"]
 decision = "allow"
 priority = 70
 modes = ["plan"]
-argsPattern = "\"file_path\":\"[^\"]+/\\.gemini/tmp/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+/plans/[a-zA-Z0-9_-]+\\.md\""
+argsPattern = "\"file_path\":\"[^\"]+[\\\\/]+\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\""
+
+# Explicitly Deny other write operations in Plan mode with a clear message.
+[[rule]]
+toolName = ["write_file", "replace"]
+decision = "deny"
+priority = 65
+modes = ["plan"]
+deny_message = "You are in Plan Mode and cannot modify source code. You may ONLY use write_file or replace to save plans to the designated plans directory as .md files."

package/dist/src/policy/policies/read-only.toml

@@ -5,19 +5,20 @@
 #
 # Priority bands (tiers):
 # - Default policies (TOML): 1 + priority/1000 (e.g., priority 100 → 1.100)
-# - User policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
-# - Admin policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+# - Workspace policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
+# - User policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+# - Admin policies (TOML): 4 + priority/1000 (e.g., priority 100 → 4.100)
 #
-# This ensures Admin > User > Default hierarchy is always preserved,
+# This ensures Admin > User > Workspace > Default hierarchy is always preserved,
 # while allowing user-specified priorities to work within each tier.
 #
-# Settings-based and dynamic rules (all in user tier 2.x):
-#   2.95: Tools that the user has selected as "Always Allow" in the interactive UI
-#   2.9:  MCP servers excluded list (security: persistent server blocks)
-#   2.4:  Command line flag --exclude-tools (explicit temporary blocks)
-#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
-#   2.2:  MCP servers with trust=true (persistent trusted servers)
-#   2.1:  MCP servers allowed list (persistent general server allows)
+# Settings-based and dynamic rules (all in user tier 3.x):
+#   3.95: Tools that the user has selected as "Always Allow" in the interactive UI
+#   3.9:  MCP servers excluded list (security: persistent server blocks)
+#   3.4:  Command line flag --exclude-tools (explicit temporary blocks)
+#   3.3:  Command line flag --allowed-tools (explicit temporary allows)
+#   3.2:  MCP servers with trust=true (persistent trusted servers)
+#   3.1:  MCP servers allowed list (persistent general server allows)
 #
 # TOML policy priorities (before transformation):
 #   10: Write tools default to ASK_USER (becomes 1.010 in default tier)

package/dist/src/policy/policies/write.toml

@@ -5,19 +5,20 @@
 #
 # Priority bands (tiers):
 # - Default policies (TOML): 1 + priority/1000 (e.g., priority 100 → 1.100)
-# - User policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
-# - Admin policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+# - Workspace policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
+# - User policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+# - Admin policies (TOML): 4 + priority/1000 (e.g., priority 100 → 4.100)
 #
-# This ensures Admin > User > Default hierarchy is always preserved,
+# This ensures Admin > User > Workspace > Default hierarchy is always preserved,
 # while allowing user-specified priorities to work within each tier.
 #
-# Settings-based and dynamic rules (all in user tier 2.x):
-#   2.95: Tools that the user has selected as "Always Allow" in the interactive UI
-#   2.9:  MCP servers excluded list (security: persistent server blocks)
-#   2.4:  Command line flag --exclude-tools (explicit temporary blocks)
-#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
-#   2.2:  MCP servers with trust=true (persistent trusted servers)
-#   2.1:  MCP servers allowed list (persistent general server allows)
+# Settings-based and dynamic rules (all in user tier 3.x):
+#   3.95: Tools that the user has selected as "Always Allow" in the interactive UI
+#   3.9:  MCP servers excluded list (security: persistent server blocks)
+#   3.4:  Command line flag --exclude-tools (explicit temporary blocks)
+#   3.3:  Command line flag --allowed-tools (explicit temporary allows)
+#   3.2:  MCP servers with trust=true (persistent trusted servers)
+#   3.1:  MCP servers allowed list (persistent general server allows)
 #
 # TOML policy priorities (before transformation):
 #   10: Write tools default to ASK_USER (becomes 1.010 in default tier)