@gotgenes/pi-permission-system 10.0.0 → 10.1.0

package/test/permission-prompter.test.ts

@@ -1,17 +1,10 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-// ── Module mocks ────────────────────────────────────────────────────────────
+// ── Injected mock ───────────────────────────────────────────────────────────
 
-const { mockConfirmPermission } = vi.hoisted(() => ({
-  mockConfirmPermission: vi.fn(),
-}));
+const mockRequestApproval = vi.fn();
 
-vi.mock("../src/forwarded-permissions/polling", () => ({
-  confirmPermission: mockConfirmPermission,
-  processForwardedPermissionRequests: vi.fn().mockResolvedValue(undefined),
-}));
-
-// ── Imports (after mocks) ───────────────────────────────────────────────────
+// ── Imports ─────────────────────────────────────────────────────────────────
 
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { DEFAULT_EXTENSION_CONFIG } from "#src/extension-config";
@@ -51,12 +44,8 @@ function makeDeps(
   return {
     getConfig: () => ({ ...DEFAULT_EXTENSION_CONFIG, yoloMode: false }),
     writeReviewLog: vi.fn(),
-    subagentSessionsDir: "/sessions/subagents",
-    forwardingDir: "/sessions/permission-forwarding",
     events: { emit: vi.fn(), on: vi.fn().mockReturnValue(() => undefined) },
-    requestPermissionDecisionFromUi: vi
-      .fn()
-      .mockResolvedValue({ approved: true, state: "approved" }),
+    forwarder: { requestApproval: mockRequestApproval },
     ...overrides,
   };
 }
@@ -65,7 +54,11 @@ function makeDeps(
 
 describe("PermissionPrompter", () => {
   beforeEach(() => {
-    mockConfirmPermission.mockReset();
+    mockRequestApproval.mockReset();
+    mockRequestApproval.mockResolvedValue({
+      approved: true,
+      state: "approved",
+    });
   });
 
   // ── Yolo-mode auto-approve ───────────────────────────────────────────────
@@ -89,7 +82,7 @@ describe("PermissionPrompter", () => {
         state: "approved",
         autoApproved: true,
       });
-      expect(mockConfirmPermission).not.toHaveBeenCalled();
+      expect(mockRequestApproval).not.toHaveBeenCalled();
       expect(events.emit).not.toHaveBeenCalledWith(
         "permissions:ui_prompt",
         expect.anything(),
@@ -136,7 +129,7 @@ describe("PermissionPrompter", () => {
 
       await prompter.prompt(makeCtx(true), makeDetails());
 
-      expect(mockConfirmPermission).not.toHaveBeenCalled();
+      expect(mockRequestApproval).not.toHaveBeenCalled();
     });
   });
 
@@ -149,7 +142,7 @@ describe("PermissionPrompter", () => {
         approved: true,
         state: "approved",
       };
-      mockConfirmPermission.mockResolvedValue(approved);
+      mockRequestApproval.mockResolvedValue(approved);
       const deps = makeDeps({ writeReviewLog });
       const prompter = new PermissionPrompter(deps);
 
@@ -169,7 +162,7 @@ describe("PermissionPrompter", () => {
         emit: vi.fn(),
         on: vi.fn().mockReturnValue(() => undefined),
       };
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -201,7 +194,7 @@ describe("PermissionPrompter", () => {
         emit: vi.fn(),
         on: vi.fn().mockReturnValue(() => undefined),
       };
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -233,7 +226,7 @@ describe("PermissionPrompter", () => {
         emit: vi.fn(),
         on: vi.fn().mockReturnValue(() => undefined),
       };
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -250,7 +243,7 @@ describe("PermissionPrompter", () => {
 
     it("logs permission_request.approved when confirmPermission returns approved", async () => {
       const writeReviewLog = vi.fn();
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -270,7 +263,7 @@ describe("PermissionPrompter", () => {
 
     it("logs permission_request.denied when confirmPermission returns denied", async () => {
       const writeReviewLog = vi.fn();
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: false,
         state: "denied",
       });
@@ -290,7 +283,7 @@ describe("PermissionPrompter", () => {
 
     it("logs permission_request.denied with denialReason when present", async () => {
       const writeReviewLog = vi.fn();
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: false,
         state: "denied_with_reason",
         denialReason: "too sensitive",
@@ -314,7 +307,7 @@ describe("PermissionPrompter", () => {
         state: "denied_with_reason",
         denialReason: "sensitive",
       };
-      mockConfirmPermission.mockResolvedValue(decision);
+      mockRequestApproval.mockResolvedValue(decision);
       const deps = makeDeps();
       const prompter = new PermissionPrompter(deps);
 
@@ -324,7 +317,7 @@ describe("PermissionPrompter", () => {
     });
 
     it("passes sessionLabel option to confirmPermission when present", async () => {
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -334,17 +327,16 @@ describe("PermissionPrompter", () => {
 
       await prompter.prompt(makeCtx(true), details);
 
-      expect(mockConfirmPermission).toHaveBeenCalledWith(
+      expect(mockRequestApproval).toHaveBeenCalledWith(
         expect.anything(),
         expect.any(String),
-        expect.anything(),
         { sessionLabel: "Yes, for 'read' tool" },
         { source: "tool_call", surface: "read", value: "read" },
       );
     });
 
     it("passes the display fields (source/surface/value) to confirmPermission", async () => {
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -357,17 +349,16 @@ describe("PermissionPrompter", () => {
 
       await prompter.prompt(makeCtx(false), details);
 
-      expect(mockConfirmPermission).toHaveBeenCalledWith(
+      expect(mockRequestApproval).toHaveBeenCalledWith(
         expect.anything(),
         expect.any(String),
-        expect.anything(),
         undefined,
         { source: "tool_call", surface: "bash", value: "git push" },
       );
     });
 
     it("passes undefined options to confirmPermission when sessionLabel is absent", async () => {
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -376,17 +367,16 @@ describe("PermissionPrompter", () => {
 
       await prompter.prompt(makeCtx(true), makeDetails());
 
-      expect(mockConfirmPermission).toHaveBeenCalledWith(
+      expect(mockRequestApproval).toHaveBeenCalledWith(
         expect.anything(),
         expect.any(String),
-        expect.anything(),
         undefined,
         { source: "tool_call", surface: "read", value: "read" },
       );
     });
 
     it("passes the message from details to confirmPermission", async () => {
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -396,10 +386,9 @@ describe("PermissionPrompter", () => {
 
       await prompter.prompt(makeCtx(true), details);
 
-      expect(mockConfirmPermission).toHaveBeenCalledWith(
+      expect(mockRequestApproval).toHaveBeenCalledWith(
         expect.anything(),
         "Allow bash: git status?",
-        expect.anything(),
         undefined,
         { source: "tool_call", surface: "read", value: "read" },
       );
@@ -411,7 +400,7 @@ describe("PermissionPrompter", () => {
   describe("review log fields", () => {
     it("includes all standard fields in the waiting log entry", async () => {
       const writeReviewLog = vi.fn();
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -448,7 +437,7 @@ describe("PermissionPrompter", () => {
 
     it("uses null for optional fields not present in details", async () => {
       const writeReviewLog = vi.fn();
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });
@@ -479,13 +468,13 @@ describe("PermissionPrompter", () => {
         approved: true,
         state: "approved",
       };
-      mockConfirmPermission.mockResolvedValue(forwarded);
+      mockRequestApproval.mockResolvedValue(forwarded);
       const deps = makeDeps();
       const prompter = new PermissionPrompter(deps);
 
       await prompter.prompt(makeCtx(false), makeDetails());
 
-      expect(mockConfirmPermission).toHaveBeenCalled();
+      expect(mockRequestApproval).toHaveBeenCalled();
     });
 
     it("returns the decision from confirmPermission in the subagent path", async () => {
@@ -493,7 +482,7 @@ describe("PermissionPrompter", () => {
         approved: false,
         state: "denied",
       };
-      mockConfirmPermission.mockResolvedValue(forwarded);
+      mockRequestApproval.mockResolvedValue(forwarded);
       const deps = makeDeps();
       const prompter = new PermissionPrompter(deps);
 
@@ -504,7 +493,7 @@ describe("PermissionPrompter", () => {
 
     it("logs the outcome when confirmPermission resolves via forwarding", async () => {
       const writeReviewLog = vi.fn();
-      mockConfirmPermission.mockResolvedValue({
+      mockRequestApproval.mockResolvedValue({
         approved: true,
         state: "approved",
       });

package/test/permission-session.test.ts

@@ -217,6 +217,79 @@ describe("PermissionSession", () => {
     });
   });
 
+  describe("resolve", () => {
+    it("forwards surface, input, and agentName, applying the empty session ruleset", () => {
+      const pm = makePermissionManager();
+      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
+      const { session } = createSession();
+
+      session.resolve("bash", { command: "ls" }, "agent-x");
+
+      expect(pm.checkPermission).toHaveBeenCalledWith(
+        "bash",
+        { command: "ls" },
+        "agent-x",
+        [],
+      );
+    });
+
+    it("defaults agentName to undefined when omitted", () => {
+      const pm = makePermissionManager();
+      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
+      const { session } = createSession();
+
+      session.resolve("read", { path: ".env" });
+
+      expect(pm.checkPermission).toHaveBeenCalledWith(
+        "read",
+        { path: ".env" },
+        undefined,
+        [],
+      );
+    });
+
+    it("applies a recorded session approval on the next resolve", () => {
+      const pm = makePermissionManager();
+      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
+      const { session } = createSession();
+
+      session.recordSessionApproval(SessionApproval.single("bash", "git *"));
+      session.resolve("bash", { command: "git status" });
+
+      const sessionRules = vi.mocked(pm.checkPermission).mock.calls[0][3];
+      expect(sessionRules).toHaveLength(1);
+      expect(sessionRules?.[0]).toMatchObject({
+        surface: "bash",
+        pattern: "git *",
+        action: "allow",
+      });
+    });
+
+    it("returns the PermissionManager's check result", () => {
+      const pm = makePermissionManager({
+        checkPermission: vi.fn().mockReturnValue({
+          state: "deny",
+          toolName: "bash",
+          source: "bash",
+          origin: "global",
+          matchedPattern: "rm *",
+        }),
+      });
+      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
+      const { session } = createSession();
+
+      const result = session.resolve("bash", { command: "rm -rf /" });
+
+      expect(result).toEqual({
+        state: "deny",
+        toolName: "bash",
+        source: "bash",
+        origin: "global",
+        matchedPattern: "rm *",
+      });
+    });
+  });
+
   describe("activate and deactivate", () => {
     it("stores the context on activate", () => {
       const { session, forwarding } = createSession();
@@ -432,26 +505,25 @@ describe("PermissionSession", () => {
   });
 
   describe("infrastructure paths", () => {
-    it("getInfrastructureDirs returns paths from ExtensionPaths", () => {
-      const { session } = createSession();
-      expect(session.getInfrastructureDirs()).toEqual([
-        "/test/agent",
-        "/test/agent/git",
-      ]);
-    });
-
-    it("getInfrastructureReadPaths returns config paths", () => {
+    it("getInfrastructureReadDirs combines piInfrastructureDirs and piInfrastructureReadPaths", () => {
       const runtimeDeps = makeRuntimeDeps();
       (runtimeDeps.getConfig as ReturnType<typeof vi.fn>).mockReturnValue({
         piInfrastructureReadPaths: ["/extra/path"],
       });
       const { session } = createSession({ runtimeDeps });
-      expect(session.getInfrastructureReadPaths()).toEqual(["/extra/path"]);
+      expect(session.getInfrastructureReadDirs()).toEqual([
+        "/test/agent",
+        "/test/agent/git",
+        "/extra/path",
+      ]);
     });
 
-    it("getInfrastructureReadPaths returns empty when config omits the field", () => {
+    it("getInfrastructureReadDirs returns only piInfrastructureDirs when config omits the field", () => {
       const { session } = createSession();
-      expect(session.getInfrastructureReadPaths()).toEqual([]);
+      expect(session.getInfrastructureReadDirs()).toEqual([
+        "/test/agent",
+        "/test/agent/git",
+      ]);
     });
   });
 
@@ -478,6 +550,26 @@ describe("PermissionSession", () => {
       const { session } = createSession({ runtimeDeps });
       expect(session.config).toBe(fakeConfig);
     });
+
+    it("getToolPreviewLimits returns resolved preview limits from config", () => {
+      const runtimeDeps = makeRuntimeDeps();
+      (runtimeDeps.getConfig as ReturnType<typeof vi.fn>).mockReturnValue({
+        toolInputPreviewMaxLength: 400,
+        toolTextSummaryMaxLength: 120,
+      });
+      const { session } = createSession({ runtimeDeps });
+      const limits = session.getToolPreviewLimits();
+      expect(limits.toolInputPreviewMaxLength).toBe(400);
+      expect(limits.toolTextSummaryMaxLength).toBe(120);
+    });
+
+    it("getToolPreviewLimits falls back to built-in defaults when config omits fields", () => {
+      const { session } = createSession();
+      const limits = session.getToolPreviewLimits();
+      expect(limits.toolInputPreviewMaxLength).toBeGreaterThan(0);
+      expect(limits.toolTextSummaryMaxLength).toBeGreaterThan(0);
+      expect(limits.toolInputLogPreviewMaxLength).toBeGreaterThan(0);
+    });
   });
 
   describe("reload", () => {
@@ -532,6 +624,62 @@ describe("PermissionSession", () => {
     });
   });
 
+  describe("canConfirm", () => {
+    it("returns true when context is active and canPrompt returns true", () => {
+      const { session } = createSession();
+      session.activate(makeCtx());
+      expect(session.canConfirm()).toBe(true);
+    });
+
+    it("returns false when no context is active", () => {
+      const { session } = createSession();
+      expect(session.canConfirm()).toBe(false);
+    });
+
+    it("returns false when canPrompt returns false", () => {
+      const runtimeDeps = makeRuntimeDeps();
+      (
+        runtimeDeps.canRequestPermissionConfirmation as ReturnType<typeof vi.fn>
+      ).mockReturnValue(false);
+      const { session } = createSession({ runtimeDeps });
+      session.activate(makeCtx());
+      expect(session.canConfirm()).toBe(false);
+    });
+  });
+
+  describe("promptPermission", () => {
+    it("delegates to prompt with stored context", async () => {
+      const { session, runtimeDeps } = createSession();
+      const ctx = makeCtx();
+      session.activate(ctx);
+      const details = {
+        requestId: "req-1",
+        source: "tool_call" as const,
+        agentName: null,
+        message: "Allow?",
+      };
+
+      const result = await session.promptPermission(details);
+
+      expect(runtimeDeps.promptPermission).toHaveBeenCalledWith(ctx, details);
+      expect(result).toEqual({ approved: true, state: "approved" });
+    });
+
+    it("throws when no context is active", async () => {
+      const { session } = createSession();
+      const details = {
+        requestId: "req-1",
+        source: "tool_call" as const,
+        agentName: null,
+        message: "Allow?",
+      };
+
+      await expect(session.promptPermission(details)).rejects.toThrow(
+        "promptPermission called before the session was activated",
+      );
+    });
+  });
+
   describe("canPrompt", () => {
     it("delegates to runtimeDeps.canRequestPermissionConfirmation", () => {
       const { session, runtimeDeps } = createSession();
@@ -573,19 +721,4 @@ describe("PermissionSession", () => {
       expect(result).toEqual({ approved: true, state: "approved" });
     });
   });
-
-  describe("createPermissionRequestId", () => {
-    it("starts with the given prefix", () => {
-      const { session } = createSession();
-      const id = session.createPermissionRequestId("skill-input");
-      expect(id.startsWith("skill-input-")).toBe(true);
-    });
-
-    it("generates unique IDs on repeated calls", () => {
-      const { session } = createSession();
-      const id1 = session.createPermissionRequestId("test");
-      const id2 = session.createPermissionRequestId("test");
-      expect(id1).not.toBe(id2);
-    });
-  });
 });

package/test/permissions-service.test.ts

@@ -0,0 +1,151 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { PermissionManager } from "#src/permission-manager";
+import { LocalPermissionsService } from "#src/permissions-service";
+import type { Ruleset } from "#src/rule";
+import type { SessionRules } from "#src/session-rules";
+import type {
+  ToolInputFormatter,
+  ToolInputFormatterRegistry,
+} from "#src/tool-input-formatter-registry";
+
+import { makeCheckResult } from "#test/helpers/handler-fixtures";
+
+// ── input-normalizer stub ──────────────────────────────────────────────────
+
+const mockBuildInputForSurface = vi.hoisted(() =>
+  vi.fn<(surface: string, value?: string) => unknown>(),
+);
+
+vi.mock("#src/input-normalizer", () => ({
+  buildInputForSurface: mockBuildInputForSurface,
+}));
+
+// ── helpers ────────────────────────────────────────────────────────────────
+
+function makePermissionManager(): PermissionManager {
+  return {
+    checkPermission: vi
+      .fn<PermissionManager["checkPermission"]>()
+      .mockReturnValue(makeCheckResult()),
+    getToolPermission: vi
+      .fn<PermissionManager["getToolPermission"]>()
+      .mockReturnValue("allow"),
+  } as unknown as PermissionManager;
+}
+
+function makeSessionRules(rules: Ruleset = []): SessionRules {
+  return {
+    getRuleset: vi.fn<SessionRules["getRuleset"]>().mockReturnValue(rules),
+  } as unknown as SessionRules;
+}
+
+function makeFormatterRegistry(): ToolInputFormatterRegistry {
+  return {
+    register: vi
+      .fn<ToolInputFormatterRegistry["register"]>()
+      .mockReturnValue(vi.fn()),
+  } as unknown as ToolInputFormatterRegistry;
+}
+
+function makeService(overrides?: {
+  permissionManager?: PermissionManager;
+  sessionRules?: SessionRules;
+  formatterRegistry?: ToolInputFormatterRegistry;
+}) {
+  const permissionManager =
+    overrides?.permissionManager ?? makePermissionManager();
+  const sessionRules = overrides?.sessionRules ?? makeSessionRules();
+  const formatterRegistry =
+    overrides?.formatterRegistry ?? makeFormatterRegistry();
+  const service = new LocalPermissionsService(
+    permissionManager,
+    sessionRules,
+    formatterRegistry,
+  );
+  return { service, permissionManager, sessionRules, formatterRegistry };
+}
+
+// ── tests ──────────────────────────────────────────────────────────────────
+
+beforeEach(() => {
+  mockBuildInputForSurface.mockReset();
+  mockBuildInputForSurface.mockReturnValue({ type: "tool-input" });
+});
+
+describe("checkPermission", () => {
+  it("builds the surface input from surface and value", () => {
+    const { service } = makeService();
+    service.checkPermission("bash", "echo hi");
+    expect(mockBuildInputForSurface).toHaveBeenCalledWith("bash", "echo hi");
+  });
+
+  it("builds the surface input with undefined value when value is omitted", () => {
+    const { service } = makeService();
+    service.checkPermission("read");
+    expect(mockBuildInputForSurface).toHaveBeenCalledWith("read", undefined);
+  });
+
+  it("calls permissionManager.checkPermission with surface, built input, agentName, and current ruleset", () => {
+    const ruleset: Ruleset = [
+      { surface: "bash", pattern: "*", action: "allow", origin: "global" },
+    ];
+    const builtInput = { type: "bash-input" };
+    mockBuildInputForSurface.mockReturnValue(builtInput);
+    const { service, permissionManager, sessionRules } = makeService({
+      sessionRules: makeSessionRules(ruleset),
+    });
+    service.checkPermission("bash", "echo hi", "my-agent");
+    expect(permissionManager.checkPermission).toHaveBeenCalledWith(
+      "bash",
+      builtInput,
+      "my-agent",
+      ruleset,
+    );
+    void sessionRules; // used indirectly
+  });
+
+  it("returns the result from permissionManager.checkPermission", () => {
+    const expected = makeCheckResult({ state: "deny", toolName: "bash" });
+    const { service, permissionManager } = makeService();
+    vi.mocked(permissionManager.checkPermission).mockReturnValue(expected);
+    const result = service.checkPermission("bash", "rm -rf /");
+    expect(result).toBe(expected);
+  });
+});
+
+describe("getToolPermission", () => {
+  it("delegates to permissionManager.getToolPermission", () => {
+    const { service, permissionManager } = makeService();
+    vi.mocked(permissionManager.getToolPermission).mockReturnValue("deny");
+    const result = service.getToolPermission("write", "my-agent");
+    expect(permissionManager.getToolPermission).toHaveBeenCalledWith(
+      "write",
+      "my-agent",
+    );
+    expect(result).toBe("deny");
+  });
+
+  it("omits agentName when not provided", () => {
+    const { service, permissionManager } = makeService();
+    service.getToolPermission("read");
+    expect(permissionManager.getToolPermission).toHaveBeenCalledWith(
+      "read",
+      undefined,
+    );
+  });
+});
+
+describe("registerToolInputFormatter", () => {
+  it("delegates to formatterRegistry.register and returns the unsubscribe function", () => {
+    const unsub = vi.fn();
+    const { service, formatterRegistry } = makeService();
+    vi.mocked(formatterRegistry.register).mockReturnValue(unsub);
+    const formatter: ToolInputFormatter = vi.fn();
+    const result = service.registerToolInputFormatter("my-tool", formatter);
+    expect(formatterRegistry.register).toHaveBeenCalledWith(
+      "my-tool",
+      formatter,
+    );
+    expect(result).toBe(unsub);
+  });
+});

package/test/runtime.test.ts

@@ -49,10 +49,6 @@ vi.mock("../src/config-reporter", () => ({
   buildResolvedConfigLogEntry: mockBuildResolvedConfigLogEntry,
 }));
 
-vi.mock("../src/forwarded-permissions/polling", () => ({
-  processForwardedPermissionRequests: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("../src/subagent-context", () => ({
   isSubagentExecutionContext: vi.fn().mockReturnValue(false),
 }));