@google/gemini-cli-core 0.34.0-preview.2 → 0.35.0-nightly.20260313.bb060d7a9

package/dist/src/policy/config.test.js

@@ -5,29 +5,85 @@
  */
 import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
 import nodePath from 'node:path';
+import * as fs from 'node:fs/promises';
+import {} from 'node:fs';
 import { ApprovalMode, PolicyDecision, InProcessCheckerType, } from './types.js';
 import { isDirectorySecure } from '../utils/security.js';
+import { createPolicyEngineConfig, clearEmittedPolicyWarnings, getPolicyDirectories, } from './config.js';
+import { Storage } from '../config/storage.js';
+import * as tomlLoader from './toml-loader.js';
+import { coreEvents } from '../utils/events.js';
 vi.unmock('../config/storage.js');
 vi.mock('../utils/security.js', () => ({
     isDirectorySecure: vi.fn().mockResolvedValue({ secure: true }),
 }));
+vi.mock('node:fs/promises', async (importOriginal) => {
+    const actual = await importOriginal();
+    const mockFs = {
+        ...actual,
+        readdir: vi.fn(actual.readdir),
+        readFile: vi.fn(actual.readFile),
+        stat: vi.fn(actual.stat),
+        mkdir: vi.fn(actual.mkdir),
+        open: vi.fn(actual.open),
+        rename: vi.fn(actual.rename),
+    };
+    return {
+        ...mockFs,
+        default: mockFs,
+    };
+});
 afterEach(() => {
-    vi.clearAllMocks();
-    vi.restoreAllMocks();
-    vi.doUnmock('node:fs/promises');
+    vi.resetAllMocks();
 });
 describe('createPolicyEngineConfig', () => {
+    const MOCK_DEFAULT_DIR = '/tmp/mock/default/policies';
     beforeEach(async () => {
-        vi.resetModules();
-        const { Storage } = await import('../config/storage.js');
-        // Mock Storage to avoid picking up real user/system policies from the host environment
+        clearEmittedPolicyWarnings();
+        // Mock Storage to avoid host environment contamination
         vi.spyOn(Storage, 'getUserPoliciesDir').mockReturnValue('/non/existent/user/policies');
         vi.spyOn(Storage, 'getSystemPoliciesDir').mockReturnValue('/non/existent/system/policies');
-        // Reset security check to default secure
         vi.mocked(isDirectorySecure).mockResolvedValue({ secure: true });
     });
+    /**
+     * Helper to mock a policy file in the filesystem.
+     */
+    function mockPolicyFile(path, content) {
+        vi.mocked(fs.readdir).mockImplementation(async (p) => {
+            if (nodePath.resolve(p.toString()) === nodePath.dirname(path)) {
+                return [
+                    {
+                        name: nodePath.basename(path),
+                        isFile: () => true,
+                        isDirectory: () => false,
+                    },
+                ];
+            }
+            return (await vi.importActual('node:fs/promises')).readdir(p);
+        });
+        vi.mocked(fs.stat).mockImplementation(async (p) => {
+            if (nodePath.resolve(p.toString()) === nodePath.dirname(path)) {
+                return {
+                    isDirectory: () => true,
+                    isFile: () => false,
+                };
+            }
+            if (nodePath.resolve(p.toString()) === path) {
+                return {
+                    isDirectory: () => false,
+                    isFile: () => true,
+                };
+            }
+            return (await vi.importActual('node:fs/promises')).stat(p);
+        });
+        vi.mocked(fs.readFile).mockImplementation(async (p) => {
+            if (nodePath.resolve(p.toString()) === path) {
+                return content;
+            }
+            return (await vi.importActual('node:fs/promises')).readFile(p);
+        });
+    }
     it('should filter out insecure system policy directories', async () => {
-        const { Storage } = await import('../config/storage.js');
         const systemPolicyDir = '/insecure/system/policies';
         vi.spyOn(Storage, 'getSystemPoliciesDir').mockReturnValue(systemPolicyDir);
         vi.mocked(isDirectorySecure).mockImplementation(async (path) => {
@@ -36,125 +92,74 @@ describe('createPolicyEngineConfig', () => {
             }
             return { secure: true };
         });
-        // We need to spy on loadPoliciesFromToml to verify which directories were passed
-        // But it is not exported from config.js, it is imported.
-        // We can spy on the module it comes from.
-        const tomlLoader = await import('./toml-loader.js');
-        const loadPoliciesSpy = vi.spyOn(tomlLoader, 'loadPoliciesFromToml');
-        loadPoliciesSpy.mockResolvedValue({
-            rules: [],
-            checkers: [],
-            errors: [],
-        });
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
-        // Verify loadPoliciesFromToml was called
+        const loadPoliciesSpy = vi
+            .spyOn(tomlLoader, 'loadPoliciesFromToml')
+            .mockResolvedValue({ rules: [], checkers: [], errors: [] });
+        await createPolicyEngineConfig({}, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
         expect(loadPoliciesSpy).toHaveBeenCalled();
         const calledDirs = loadPoliciesSpy.mock.calls[0][0];
-        // The system directory should NOT be in the list
         expect(calledDirs).not.toContain(systemPolicyDir);
-        // But other directories (user, default) should be there
         expect(calledDirs).toContain('/non/existent/user/policies');
         expect(calledDirs).toContain('/tmp/mock/default/policies');
     });
-    it('should return ASK_USER for write tools and ALLOW for read-only tools by default', async () => {
-        const actualFs = await vi.importActual('node:fs/promises');
-        const mockReaddir = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies'))) {
-                // Return empty array for user policies
-                return [];
+    it('should NOT filter out insecure supplemental admin policy directories', async () => {
+        const adminPolicyDir = '/insecure/admin/policies';
+        vi.mocked(isDirectorySecure).mockImplementation(async (path) => {
+            if (nodePath.resolve(path) === nodePath.resolve(adminPolicyDir)) {
+                return { secure: false, reason: 'Insecure directory' };
             }
-            return actualFs.readdir(path, options);
+            return { secure: true };
         });
-        vi.doMock('node:fs/promises', () => ({
-            ...actualFs,
-            default: { ...actualFs, readdir: mockReaddir },
-            readdir: mockReaddir,
-        }));
-        // Mock Storage to avoid actual filesystem access for policy dirs during tests if needed,
-        // but for now relying on the fs mock above might be enough if it catches the right paths.
-        // Let's see if we need to mock Storage.getUserPoliciesDir etc.
-        vi.resetModules();
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        // Pass a dummy default policies dir to avoid it trying to resolve __dirname relative to the test file in a weird way
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const loadPoliciesSpy = vi
+            .spyOn(tomlLoader, 'loadPoliciesFromToml')
+            .mockResolvedValue({ rules: [], checkers: [], errors: [] });
+        await createPolicyEngineConfig({ adminPolicyPaths: [adminPolicyDir] }, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const calledDirs = loadPoliciesSpy.mock.calls[0][0];
+        expect(calledDirs).toContain(adminPolicyDir);
+        expect(calledDirs).toContain('/non/existent/system/policies');
+        expect(calledDirs).toContain('/non/existent/user/policies');
+        expect(calledDirs).toContain('/tmp/mock/default/policies');
+    });
+    it('should return ASK_USER for write tools and ALLOW for read-only tools by default', async () => {
+        vi.mocked(fs.readdir).mockResolvedValue([]);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         expect(config.defaultDecision).toBe(PolicyDecision.ASK_USER);
-        // The order of the rules is not guaranteed, so we sort them by tool name.
-        config.rules?.sort((a, b) => (a.toolName ?? '').localeCompare(b.toolName ?? ''));
-        // Since we are mocking an empty policy directory, we expect NO rules from TOML.
-        // Wait, the CLI test expected a bunch of default rules. Those must have come from
-        // the actual default policies directory in the CLI package.
-        // In the core package, we don't necessarily have those default policy files yet
-        // or we need to point to them.
-        // For this unit test, if we mock the default dir as empty, we should get NO rules
-        // if no settings are provided.
-        // Actually, let's look at how CLI test gets them. It uses `__dirname` in `policy.ts`.
-        // If we want to test default rules, we need to provide them.
-        // For now, let's assert it's empty if we provide no TOML files, to ensure the *mechanism* works.
-        // Or better, mock one default rule to ensure it's loaded.
         expect(config.rules).toEqual([]);
-        vi.doUnmock('node:fs/promises');
-    }, 30000);
+    });
     it('should allow tools in tools.allowed', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
-            tools: { allowed: ['run_shell_command'] },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        vi.mocked(fs.readdir).mockResolvedValue([]);
+        const config = await createPolicyEngineConfig({ tools: { allowed: ['run_shell_command'] } }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const rule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
             r.decision === PolicyDecision.ALLOW);
         expect(rule).toBeDefined();
         expect(rule?.priority).toBeCloseTo(4.3, 5); // Command line allow
     });
     it('should deny tools in tools.exclude', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
-            tools: { exclude: ['run_shell_command'] },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const config = await createPolicyEngineConfig({ tools: { exclude: ['run_shell_command'] } }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const rule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
             r.decision === PolicyDecision.DENY);
         expect(rule).toBeDefined();
         expect(rule?.priority).toBeCloseTo(4.4, 5); // Command line exclude
     });
     it('should allow tools from allowed MCP servers', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
-            mcp: { allowed: ['my-server'] },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const config = await createPolicyEngineConfig({ mcp: { allowed: ['my-server'] } }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const rule = config.rules?.find((r) => r.mcpName === 'my-server' && r.decision === PolicyDecision.ALLOW);
         expect(rule).toBeDefined();
         expect(rule?.priority).toBe(4.1); // MCP allowed server
     });
     it('should deny tools from excluded MCP servers', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
-            mcp: { excluded: ['my-server'] },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const config = await createPolicyEngineConfig({ mcp: { excluded: ['my-server'] } }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const rule = config.rules?.find((r) => r.mcpName === 'my-server' && r.decision === PolicyDecision.DENY);
         expect(rule).toBeDefined();
         expect(rule?.priority).toBe(4.9); // MCP excluded server
     });
     it('should allow tools from trusted MCP servers', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
+        const config = await createPolicyEngineConfig({
             mcpServers: {
-                'trusted-server': {
-                    trust: true,
-                },
-                'untrusted-server': {
-                    trust: false,
-                },
+                'trusted-server': { trust: true },
+                'untrusted-server': { trust: false },
             },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const trustedRule = config.rules?.find((r) => r.mcpName === 'trusted-server' && r.decision === PolicyDecision.ALLOW);
         expect(trustedRule).toBeDefined();
         expect(trustedRule?.priority).toBe(4.2); // MCP trusted server
@@ -163,19 +168,10 @@ describe('createPolicyEngineConfig', () => {
         expect(untrustedRule).toBeUndefined();
     });
     it('should handle multiple MCP server configurations together', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
-            mcp: {
-                allowed: ['allowed-server'],
-                excluded: ['excluded-server'],
-            },
-            mcpServers: {
-                'trusted-server': {
-                    trust: true,
-                },
-            },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const config = await createPolicyEngineConfig({
+            mcp: { allowed: ['allowed-server'], excluded: ['excluded-server'] },
+            mcpServers: { 'trusted-server': { trust: true } },
+        }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         // Check allowed server
         const allowedRule = config.rules?.find((r) => r.mcpName === 'allowed-server' && r.decision === PolicyDecision.ALLOW);
         expect(allowedRule).toBeDefined();
@@ -190,46 +186,38 @@ describe('createPolicyEngineConfig', () => {
         expect(excludedRule?.priority).toBe(4.9); // MCP excluded server
     });
     it('should allow all tools in YOLO mode', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.YOLO);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.YOLO);
         const rule = config.rules?.find((r) => r.decision === PolicyDecision.ALLOW && !r.toolName);
         expect(rule).toBeDefined();
-        // Priority 998 in default tier → 1.998 (999 reserved for ask_user exception)
         expect(rule?.priority).toBeCloseTo(1.998, 5);
     });
     it('should allow edit tool in AUTO_EDIT mode', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.AUTO_EDIT);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.AUTO_EDIT);
         const rule = config.rules?.find((r) => r.toolName === 'replace' &&
             r.decision === PolicyDecision.ALLOW &&
             r.modes?.includes(ApprovalMode.AUTO_EDIT));
         expect(rule).toBeDefined();
-        // Priority 15 in default tier → 1.015
         expect(rule?.priority).toBeCloseTo(1.015, 5);
     });
     it('should prioritize exclude over allow', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
-            tools: { allowed: ['run_shell_command'], exclude: ['run_shell_command'] },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const config = await createPolicyEngineConfig({
+            tools: {
+                allowed: ['run_shell_command'],
+                exclude: ['run_shell_command'],
+            },
+        }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const denyRule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
             r.decision === PolicyDecision.DENY);
         const allowRule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
             r.decision === PolicyDecision.ALLOW);
-        expect(denyRule).toBeDefined();
-        expect(allowRule).toBeDefined();
         expect(denyRule.priority).toBeGreaterThan(allowRule.priority);
     });
     it('should prioritize specific tool allows over MCP server excludes', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
         const settings = {
             mcp: { excluded: ['my-server'] },
             tools: { allowed: ['mcp_my-server_specific-tool'] },
         };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const serverDenyRule = config.rules?.find((r) => r.mcpName === 'my-server' && r.decision === PolicyDecision.DENY);
         const toolAllowRule = config.rules?.find((r) => r.toolName === 'mcp_my-server_specific-tool' &&
             r.decision === PolicyDecision.ALLOW);
@@ -262,6 +250,7 @@ describe('createPolicyEngineConfig', () => {
         expect(toolDenyRule.priority).toBeGreaterThan(serverAllowRule.priority);
     });
     it('should handle complex priority scenarios correctly', async () => {
+        mockPolicyFile(nodePath.join(MOCK_DEFAULT_DIR, 'default.toml'), '[[rule]]\ntoolName = "glob"\ndecision = "allow"\npriority = 50\n');
         const settings = {
             tools: {
                 allowed: ['mcp_trusted-server_tool1', 'other-tool'], // Priority 4.3
@@ -277,57 +266,7 @@ describe('createPolicyEngineConfig', () => {
                 },
             },
         };
-        // Mock a default policy for 'glob' to test priority override
-        const actualFs = await vi.importActual('node:fs/promises');
-        const mockReaddir = vi.fn(async (p, _o) => {
-            if (typeof p === 'string' && p.includes('/tmp/mock/default/policies')) {
-                return [
-                    {
-                        name: 'default.toml',
-                        isFile: () => true,
-                        isDirectory: () => false,
-                    },
-                ];
-            }
-            return [];
-        });
-        const mockStat = vi.fn(async (p) => {
-            if (typeof p === 'string' && p.includes('/tmp/mock/default/policies')) {
-                return {
-                    isDirectory: () => true,
-                    isFile: () => false,
-                };
-            }
-            if (typeof p === 'string' && p.includes('default.toml')) {
-                return {
-                    isDirectory: () => false,
-                    isFile: () => true,
-                };
-            }
-            return actualFs.stat(p);
-        });
-        const mockReadFile = vi.fn(async (p, _o) => {
-            if (typeof p === 'string' && p.includes('default.toml')) {
-                return '[[rule]]\ntoolName = "glob"\ndecision = "allow"\npriority = 50\n';
-            }
-            return '';
-        });
-        vi.doMock('node:fs/promises', () => ({
-            ...actualFs,
-            default: {
-                ...actualFs,
-                readdir: mockReaddir,
-                readFile: mockReadFile,
-                stat: mockStat,
-            },
-            readdir: mockReaddir,
-            readFile: mockReadFile,
-            stat: mockStat,
-        }));
-        vi.resetModules();
-        const { createPolicyEngineConfig: createConfig } = await import('./config.js');
-        const config = await createConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
-        // Verify glob is denied even though default would allow it
+        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const globDenyRule = config.rules?.find((r) => r.toolName === 'glob' && r.decision === PolicyDecision.DENY);
         const globAllowRule = config.rules?.find((r) => r.toolName === 'glob' && r.decision === PolicyDecision.ALLOW);
         expect(globDenyRule).toBeDefined();
@@ -348,21 +287,14 @@ describe('createPolicyEngineConfig', () => {
         const highestPriorityExcludes = priorities?.filter((p) => Math.abs(p.priority - 4.4) < 0.01 ||
             Math.abs(p.priority - 4.9) < 0.01);
         expect(highestPriorityExcludes?.every((p) => p.decision === PolicyDecision.DENY)).toBe(true);
-        vi.doUnmock('node:fs/promises');
     });
     it('should handle MCP servers with undefined trust property', async () => {
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
+        const config = await createPolicyEngineConfig({
             mcpServers: {
-                'no-trust-property': {
-                // trust property is undefined/missing
-                },
-                'explicit-false': {
-                    trust: false,
-                },
+                'no-trust-property': {},
+                'explicit-false': { trust: false },
             },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         // Neither server should have an allow rule
         const noTrustRule = config.rules?.find((r) => r.mcpName === 'no-trust-property' &&
             r.decision === PolicyDecision.ALLOW);
@@ -371,29 +303,11 @@ describe('createPolicyEngineConfig', () => {
         expect(explicitFalseRule).toBeUndefined();
     });
     it('should have YOLO allow-all rule beat write tool rules in YOLO mode', async () => {
-        vi.resetModules();
-        vi.doUnmock('node:fs/promises');
-        const { createPolicyEngineConfig: createConfig } = await import('./config.js');
-        // Re-mock Storage after resetModules because it was reloaded
-        const { Storage: FreshStorage } = await import('../config/storage.js');
-        vi.spyOn(FreshStorage, 'getUserPoliciesDir').mockReturnValue('/non/existent/user/policies');
-        vi.spyOn(FreshStorage, 'getSystemPoliciesDir').mockReturnValue('/non/existent/system/policies');
-        const settings = {
-            tools: { exclude: ['dangerous-tool'] },
-        };
-        // Use default policy dir (no third arg) to load real yolo.toml and write.toml
-        const config = await createConfig(settings, ApprovalMode.YOLO);
-        // Should have the wildcard allow rule
+        const config = await createPolicyEngineConfig({ tools: { exclude: ['dangerous-tool'] } }, ApprovalMode.YOLO);
         const wildcardRule = config.rules?.find((r) => !r.toolName && r.decision === PolicyDecision.ALLOW);
-        expect(wildcardRule).toBeDefined();
-        // Priority 998 in default tier → 1.998 (999 reserved for ask_user exception)
-        expect(wildcardRule?.priority).toBeCloseTo(1.998, 5);
-        // Write tool ASK_USER rules are present (from write.toml)
         const writeToolRules = config.rules?.filter((r) => ['run_shell_command'].includes(r.toolName || '') &&
             r.decision === PolicyDecision.ASK_USER);
-        expect(writeToolRules).toBeDefined();
-        expect(writeToolRules?.length).toBeGreaterThan(0);
-        // But YOLO allow-all rule has higher priority than all write tool rules
+        expect(wildcardRule).toBeDefined();
         writeToolRules?.forEach((writeRule) => {
             expect(wildcardRule.priority).toBeGreaterThan(writeRule.priority);
         });
@@ -403,106 +317,25 @@ describe('createPolicyEngineConfig', () => {
         expect(excludeRule?.priority).toBeCloseTo(4.4, 5); // Command line exclude
     });
     it('should support argsPattern in policy rules', async () => {
-        const actualFs = await vi.importActual('node:fs/promises');
-        const mockReaddir = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies'))) {
-                return [
-                    {
-                        name: 'write.toml',
-                        isFile: () => true,
-                        isDirectory: () => false,
-                    },
-                ];
-            }
-            return actualFs.readdir(path, options);
-        });
-        const mockReadFile = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies/write.toml'))) {
-                return `
-[[rule]]
-toolName = "run_shell_command"
-argsPattern = "\\"command\\":\\"git (status|diff|log)\\""
-decision = "allow"
-priority = 150
-`;
-            }
-            return actualFs.readFile(path, options);
-        });
-        const mockStat = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies'))) {
-                return {
-                    isDirectory: () => true,
-                    isFile: () => false,
-                };
-            }
-            return actualFs.stat(path, options);
-        });
-        vi.doMock('node:fs/promises', () => ({
-            ...actualFs,
-            default: {
-                ...actualFs,
-                readFile: mockReadFile,
-                readdir: mockReaddir,
-                stat: mockStat,
-            },
-            readFile: mockReadFile,
-            readdir: mockReaddir,
-            stat: mockStat,
-        }));
-        vi.resetModules();
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        mockPolicyFile(nodePath.join(MOCK_DEFAULT_DIR, 'write.toml'), `
+  [[rule]]
+  toolName = "run_shell_command"
+  argsPattern = "\\"command\\":\\"git (status|diff|log)\\""
+  decision = "allow"
+  priority = 150
+  `);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const rule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
             r.decision === PolicyDecision.ALLOW);
         expect(rule).toBeDefined();
-        // Priority 150 in user tier → 4.150
-        expect(rule?.priority).toBeCloseTo(4.15, 5);
+        // Priority 150 in default tier → 1.150
+        expect(rule?.priority).toBeCloseTo(1.15, 5);
         expect(rule?.argsPattern).toBeInstanceOf(RegExp);
         expect(rule?.argsPattern?.test('{"command":"git status"}')).toBe(true);
-        expect(rule?.argsPattern?.test('{"command":"git diff"}')).toBe(true);
-        expect(rule?.argsPattern?.test('{"command":"git log"}')).toBe(true);
         expect(rule?.argsPattern?.test('{"command":"git commit"}')).toBe(false);
-        expect(rule?.argsPattern?.test('{"command":"git push"}')).toBe(false);
-        vi.doUnmock('node:fs/promises');
     });
     it('should load safety_checker configuration from TOML', async () => {
-        const actualFs = await vi.importActual('node:fs/promises');
-        const mockReaddir = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies'))) {
-                return [
-                    {
-                        name: 'safety.toml',
-                        isFile: () => true,
-                        isDirectory: () => false,
-                    },
-                ];
-            }
-            return actualFs.readdir(path, options);
-        });
-        const mockReadFile = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies/safety.toml'))) {
-                return `
-[[rule]]
-toolName = "write_file"
-decision = "allow"
-priority = 10
-
+        mockPolicyFile(nodePath.join(MOCK_DEFAULT_DIR, 'safety.toml'), `
 [[rule]]
 toolName = "write_file"
 decision = "allow"
@@ -515,71 +348,14 @@ priority = 10
 type = "in-process"
 name = "allowed-path"
 required_context = ["environment"]
-[safety_checker.checker.config]
-`;
-            }
-            return actualFs.readFile(path, options);
-        });
-        const mockStat = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies'))) {
-                return {
-                    isDirectory: () => true,
-                    isFile: () => false,
-                };
-            }
-            return actualFs.stat(path, options);
-        });
-        vi.doMock('node:fs/promises', () => ({
-            ...actualFs,
-            default: {
-                ...actualFs,
-                readFile: mockReadFile,
-                readdir: mockReaddir,
-                stat: mockStat,
-            },
-            readFile: mockReadFile,
-            readdir: mockReaddir,
-            stat: mockStat,
-        }));
-        vi.resetModules();
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
-        const rule = config.rules?.find((r) => r.toolName === 'write_file' && r.decision === PolicyDecision.ALLOW);
-        expect(rule).toBeDefined();
+`);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
+        expect(config.rules?.some((r) => r.toolName === 'write_file' && r.decision === PolicyDecision.ALLOW)).toBe(true);
         const checker = config.checkers?.find((c) => c.toolName === 'write_file' && c.checker.type === 'in-process');
-        expect(checker).toBeDefined();
-        expect(checker?.checker.type).toBe('in-process');
         expect(checker?.checker.name).toBe(InProcessCheckerType.ALLOWED_PATH);
-        expect(checker?.checker.required_context).toEqual(['environment']);
-        vi.doUnmock('node:fs/promises');
     });
     it('should reject invalid in-process checker names', async () => {
-        const actualFs = await vi.importActual('node:fs/promises');
-        const mockReaddir = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies'))) {
-                return [
-                    {
-                        name: 'invalid_safety.toml',
-                        isFile: () => true,
-                        isDirectory: () => false,
-                    },
-                ];
-            }
-            return actualFs.readdir(path, options);
-        });
-        const mockReadFile = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies/invalid_safety.toml'))) {
-                return `
+        mockPolicyFile(nodePath.join(MOCK_DEFAULT_DIR, 'invalid_safety.toml'), `
 [[rule]]
 toolName = "write_file"
 decision = "allow"
@@ -591,75 +367,20 @@ priority = 10
 [safety_checker.checker]
 type = "in-process"
 name = "invalid-name"
-`;
-            }
-            return actualFs.readFile(path, options);
-        });
-        const mockStat = vi.fn(async (path, options) => {
-            if (typeof path === 'string' &&
-                nodePath
-                    .normalize(path)
-                    .includes(nodePath.normalize('.gemini/policies'))) {
-                return {
-                    isDirectory: () => true,
-                    isFile: () => false,
-                };
-            }
-            return actualFs.stat(path, options);
-        });
-        vi.doMock('node:fs/promises', () => ({
-            ...actualFs,
-            default: {
-                ...actualFs,
-                readFile: mockReadFile,
-                readdir: mockReaddir,
-                stat: mockStat,
-            },
-            readFile: mockReadFile,
-            readdir: mockReaddir,
-            stat: mockStat,
-        }));
-        vi.resetModules();
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
-        // The rule should be rejected because 'invalid-name' is not in the enum
-        const rule = config.rules?.find((r) => r.toolName === 'write_file');
-        expect(rule).toBeUndefined();
-        vi.doUnmock('node:fs/promises');
+`);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
+        expect(config.rules?.find((r) => r.toolName === 'write_file')).toBeUndefined();
     });
     it('should have default ASK_USER rule for discovered tools', async () => {
-        vi.resetModules();
-        vi.doUnmock('node:fs/promises');
-        const { createPolicyEngineConfig: createConfig } = await import('./config.js');
-        // Re-mock Storage after resetModules because it was reloaded
-        const { Storage: FreshStorage } = await import('../config/storage.js');
-        vi.spyOn(FreshStorage, 'getUserPoliciesDir').mockReturnValue('/non/existent/user/policies');
-        vi.spyOn(FreshStorage, 'getSystemPoliciesDir').mockReturnValue('/non/existent/system/policies');
-        const settings = {};
-        // Use default policy dir to load real discovered.toml
-        const config = await createConfig(settings, ApprovalMode.DEFAULT);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.DEFAULT);
         const discoveredRule = config.rules?.find((r) => r.toolName === 'discovered_tool_*' &&
             r.decision === PolicyDecision.ASK_USER);
         expect(discoveredRule).toBeDefined();
-        // Priority 10 in default tier → 1.010
         expect(discoveredRule?.priority).toBeCloseTo(1.01, 5);
     });
     it('should normalize legacy "ShellTool" alias to "run_shell_command"', async () => {
-        vi.resetModules();
-        // Mock fs to return empty for policies
-        const actualFs = await vi.importActual('node:fs/promises');
-        const mockReaddir = vi.fn(async () => []);
-        vi.doMock('node:fs/promises', () => ({
-            ...actualFs,
-            default: { ...actualFs, readdir: mockReaddir },
-            readdir: mockReaddir,
-        }));
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {
-            tools: { allowed: ['ShellTool'] },
-        };
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT, '/tmp/mock/default/policies');
+        vi.mocked(fs.readdir).mockResolvedValue([]);
+        const config = await createPolicyEngineConfig({ tools: { allowed: ['ShellTool'] } }, ApprovalMode.DEFAULT, MOCK_DEFAULT_DIR);
         const rule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
             r.decision === PolicyDecision.ALLOW);
         expect(rule).toBeDefined();
@@ -667,34 +388,9 @@ name = "invalid-name"
         vi.doUnmock('node:fs/promises');
     });
     it('should allow overriding Plan Mode deny with user policy', async () => {
-        const actualFs = await vi.importActual('node:fs/promises');
-        const mockReaddir = vi.fn(async (path, options) => {
-            const normalizedPath = nodePath.normalize(path.toString());
-            if (normalizedPath.includes('gemini-cli-test/user/policies')) {
-                return [
-                    {
-                        name: 'user-plan.toml',
-                        isFile: () => true,
-                        isDirectory: () => false,
-                    },
-                ];
-            }
-            return actualFs.readdir(path, options);
-        });
-        const mockStat = vi.fn(async (path, options) => {
-            const normalizedPath = nodePath.normalize(path.toString());
-            if (normalizedPath.includes('gemini-cli-test/user/policies')) {
-                return {
-                    isDirectory: () => true,
-                    isFile: () => false,
-                };
-            }
-            return actualFs.stat(path, options);
-        });
-        const mockReadFile = vi.fn(async (path, options) => {
-            const normalizedPath = nodePath.normalize(path.toString());
-            if (normalizedPath.includes('user-plan.toml')) {
-                return `
+        const userPolicyDir = '/tmp/gemini-cli-test/user/policies';
+        vi.spyOn(Storage, 'getUserPoliciesDir').mockReturnValue(userPolicyDir);
+        mockPolicyFile(nodePath.join(userPolicyDir, 'user-plan.toml'), `
 [[rule]]
 toolName = "run_shell_command"
 commandPrefix = ["git status", "git diff"]
@@ -707,53 +403,77 @@ toolName = "codebase_investigator"
 decision = "allow"
 priority = 100
 modes = ["plan"]
-`;
-            }
-            return actualFs.readFile(path, options);
-        });
-        vi.doMock('node:fs/promises', () => ({
-            ...actualFs,
-            default: {
-                ...actualFs,
-                readFile: mockReadFile,
-                readdir: mockReaddir,
-                stat: mockStat,
-            },
-            readFile: mockReadFile,
-            readdir: mockReaddir,
-            stat: mockStat,
-        }));
-        vi.resetModules();
-        // Robustly mock Storage using doMock to ensure it persists through imports in config.js
-        vi.doMock('../config/storage.js', async () => {
-            const actual = await vi.importActual('../config/storage.js');
-            class MockStorage extends actual.Storage {
-                static getUserPoliciesDir() {
-                    return '/tmp/gemini-cli-test/user/policies';
-                }
-                static getSystemPoliciesDir() {
-                    return '/tmp/gemini-cli-test/system/policies';
-                }
-            }
-            return { ...actual, Storage: MockStorage };
-        });
-        const { createPolicyEngineConfig } = await import('./config.js');
-        const settings = {};
-        const config = await createPolicyEngineConfig(settings, ApprovalMode.PLAN, nodePath.join(__dirname, 'policies'));
+`);
+        const config = await createPolicyEngineConfig({}, ApprovalMode.PLAN, nodePath.join(__dirname, 'policies'));
         const shellRules = config.rules?.filter((r) => r.toolName === 'run_shell_command' &&
-            r.decision === PolicyDecision.ALLOW &&
-            r.modes?.includes(ApprovalMode.PLAN) &&
-            r.argsPattern);
-        expect(shellRules).toHaveLength(2);
-        expect(shellRules?.some((r) => r.argsPattern?.test('{"command":"git status"}'))).toBe(true);
-        expect(shellRules?.some((r) => r.argsPattern?.test('{"command":"git diff"}'))).toBe(true);
-        expect(shellRules?.every((r) => !r.argsPattern?.test('{"command":"git commit"}'))).toBe(true);
-        const subagentRule = config.rules?.find((r) => r.toolName === 'codebase_investigator' &&
             r.decision === PolicyDecision.ALLOW &&
             r.modes?.includes(ApprovalMode.PLAN));
+        expect(shellRules?.length).toBeGreaterThan(0);
+        shellRules?.forEach((r) => expect(r.priority).toBeCloseTo(4.1, 5));
+        const subagentRule = config.rules?.find((r) => r.toolName === 'codebase_investigator' &&
+            r.decision === PolicyDecision.ALLOW);
         expect(subagentRule).toBeDefined();
         expect(subagentRule?.priority).toBeCloseTo(4.1, 5);
-        vi.doUnmock('node:fs/promises');
+    });
+    it('should deduplicate security warnings when called multiple times', async () => {
+        const systemPoliciesDir = '/tmp/gemini-cli-test/system/policies';
+        vi.spyOn(Storage, 'getSystemPoliciesDir').mockReturnValue(systemPoliciesDir);
+        vi.mocked(fs.readdir).mockImplementation(async (path) => {
+            if (nodePath.resolve(path.toString()) === systemPoliciesDir) {
+                return ['policy.toml'];
+            }
+            return [];
+        });
+        const feedbackSpy = vi
+            .spyOn(coreEvents, 'emitFeedback')
+            .mockImplementation(() => { });
+        // First call
+        await createPolicyEngineConfig({ adminPolicyPaths: ['/tmp/other/admin/policies'] }, ApprovalMode.DEFAULT);
+        expect(feedbackSpy).toHaveBeenCalledWith('warning', expect.stringContaining('Ignoring --admin-policy'));
+        const count = feedbackSpy.mock.calls.length;
+        // Second call
+        await createPolicyEngineConfig({ adminPolicyPaths: ['/tmp/other/admin/policies'] }, ApprovalMode.DEFAULT);
+        expect(feedbackSpy.mock.calls.length).toBe(count);
+        feedbackSpy.mockRestore();
+    });
+});
+describe('getPolicyDirectories', () => {
+    const USER_POLICIES_DIR = '/mock/user/policies';
+    const SYSTEM_POLICIES_DIR = '/mock/system/policies';
+    beforeEach(() => {
+        vi.spyOn(Storage, 'getUserPoliciesDir').mockReturnValue(USER_POLICIES_DIR);
+        vi.spyOn(Storage, 'getSystemPoliciesDir').mockReturnValue(SYSTEM_POLICIES_DIR);
+    });
+    it('should include default user policies directory when policyPaths is undefined', () => {
+        const dirs = getPolicyDirectories();
+        expect(dirs).toContain(USER_POLICIES_DIR);
+    });
+    it('should include default user policies directory when policyPaths is an empty array', () => {
+        // This is the specific case that regressed
+        const dirs = getPolicyDirectories(undefined, []);
+        expect(dirs).toContain(USER_POLICIES_DIR);
+    });
+    it('should replace default user policies directory when policyPaths has entries', () => {
+        const customPath = '/custom/policies';
+        const dirs = getPolicyDirectories(undefined, [customPath]);
+        expect(dirs).toContain(customPath);
+        expect(dirs).not.toContain(USER_POLICIES_DIR);
+    });
+    it('should include all tiers in correct order', () => {
+        const defaultDir = '/default/policies';
+        const workspaceDir = '/workspace/policies';
+        const adminPath = '/admin/extra/policies';
+        const userPath = '/user/custom/policies';
+        const dirs = getPolicyDirectories(defaultDir, [userPath], workspaceDir, [
+            adminPath,
+        ]);
+        // Order should be Admin -> User -> Workspace -> Default
+        // getPolicyDirectories returns them in that order (which is then reversed by the loader)
+        expect(dirs[0]).toBe(SYSTEM_POLICIES_DIR);
+        expect(dirs[1]).toBe(adminPath);
+        expect(dirs[2]).toBe(userPath);
+        expect(dirs[3]).toBe(workspaceDir);
+        expect(dirs[4]).toBe(defaultDir);
     });
 });
 //# sourceMappingURL=config.test.js.map