@gotgenes/pi-permission-system 10.0.0 → 10.2.0

package/test/permission-session.test.ts

@@ -3,42 +3,32 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 // ── Module mocks (hoisted) ─────────────────────────────────────────────────
 
-const {
-  mockGetActiveAgentName,
-  mockGetActiveAgentNameFromSystemPrompt,
-  mockCreatePermissionManagerForCwd,
-} = vi.hoisted(() => ({
-  mockGetActiveAgentName: vi.fn<(ctx: ExtensionContext) => string | null>(),
-  mockGetActiveAgentNameFromSystemPrompt:
-    vi.fn<(systemPrompt?: string) => string | null>(),
-  mockCreatePermissionManagerForCwd: vi.fn(),
-}));
+const { mockGetActiveAgentName, mockGetActiveAgentNameFromSystemPrompt } =
+  vi.hoisted(() => ({
+    mockGetActiveAgentName: vi.fn<(ctx: ExtensionContext) => string | null>(),
+    mockGetActiveAgentNameFromSystemPrompt:
+      vi.fn<(systemPrompt?: string) => string | null>(),
+  }));
 
 vi.mock("../src/active-agent", () => ({
   getActiveAgentName: mockGetActiveAgentName,
   getActiveAgentNameFromSystemPrompt: mockGetActiveAgentNameFromSystemPrompt,
 }));
 
-vi.mock("../src/runtime", async (importOriginal) => {
-  const original = await importOriginal<typeof import("../src/runtime")>();
-  return {
-    ...original,
-    createPermissionManagerForCwd: mockCreatePermissionManagerForCwd,
-  };
-});
-
 // ── Test helpers ───────────────────────────────────────────────────────────
 
 import type { ExtensionPaths } from "#src/extension-paths";
 import type { ForwardingController } from "#src/forwarding-manager";
-import type { PermissionManager } from "#src/permission-manager";
+import type { ScopedPermissionManager } from "#src/permission-manager";
 import {
   PermissionSession,
   type PermissionSessionRuntimeDeps,
 } from "#src/permission-session";
+import type { Ruleset } from "#src/rule";
 import { SessionApproval } from "#src/session-approval";
 import type { SessionLogger } from "#src/session-logger";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
 import { makeCtx } from "#test/helpers/handler-fixtures";
 
 function makeSkillEntry(
@@ -95,29 +85,37 @@ function makeForwarding(): ForwardingController {
   };
 }
 
-function makePermissionManager(
-  overrides: Partial<PermissionManager> = {},
-): PermissionManager {
+function makePermissionManager() {
   return {
-    checkPermission: vi.fn().mockReturnValue({
-      state: "allow",
-      toolName: "read",
-      source: "tool",
-      origin: "builtin",
-    }),
-    getToolPermission: vi.fn().mockReturnValue("allow"),
-    getConfigIssues: vi.fn().mockReturnValue([]),
-    getPolicyCacheStamp: vi.fn().mockReturnValue("stamp-1"),
-    getComposedConfigRules: vi.fn().mockReturnValue([]),
-    getResolvedPolicyPaths: vi.fn().mockReturnValue({}),
-    ...overrides,
-  } as unknown as PermissionManager;
+    configureForCwd: vi.fn<(cwd: string | undefined | null) => void>(),
+    checkPermission: vi
+      .fn<
+        (
+          toolName: string,
+          input: unknown,
+          agentName?: string,
+          sessionRules?: Ruleset,
+        ) => PermissionCheckResult
+      >()
+      .mockReturnValue({
+        state: "allow",
+        toolName: "read",
+        source: "tool",
+        origin: "builtin",
+      }),
+    getToolPermission: vi
+      .fn<(toolName: string, agentName?: string) => PermissionState>()
+      .mockReturnValue("allow"),
+    getConfigIssues: vi.fn((): string[] => []),
+    getPolicyCacheStamp: vi.fn((): string => "stamp-1"),
+  };
 }
 
 function createSession(overrides?: {
   paths?: Partial<ExtensionPaths>;
   logger?: SessionLogger;
   forwarding?: ForwardingController;
+  permissionManager?: ScopedPermissionManager;
   runtimeDeps?: PermissionSessionRuntimeDeps;
 }): {
   session: PermissionSession;
@@ -129,8 +127,16 @@ function createSession(overrides?: {
   const paths = makePaths(overrides?.paths);
   const logger = overrides?.logger ?? makeLogger();
   const forwarding = overrides?.forwarding ?? makeForwarding();
+  const permissionManager =
+    overrides?.permissionManager ?? makePermissionManager();
   const runtimeDeps = overrides?.runtimeDeps ?? makeRuntimeDeps();
-  const session = new PermissionSession(paths, logger, forwarding, runtimeDeps);
+  const session = new PermissionSession(
+    paths,
+    logger,
+    forwarding,
+    permissionManager,
+    runtimeDeps,
+  );
   return { session, paths, logger, forwarding, runtimeDeps };
 }
 
@@ -139,10 +145,6 @@ function createSession(overrides?: {
 beforeEach(() => {
   mockGetActiveAgentName.mockReset();
   mockGetActiveAgentNameFromSystemPrompt.mockReset();
-  mockCreatePermissionManagerForCwd.mockReset();
-
-  // Default: createPermissionManagerForCwd returns a fresh mock PM
-  mockCreatePermissionManagerForCwd.mockReturnValue(makePermissionManager());
   mockGetActiveAgentName.mockReturnValue(null);
   mockGetActiveAgentNameFromSystemPrompt.mockReturnValue(null);
 });
@@ -151,8 +153,7 @@ describe("PermissionSession", () => {
   describe("constructor and delegation", () => {
     it("delegates checkPermission to internal PermissionManager", () => {
       const pm = makePermissionManager();
-      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
-      const { session } = createSession();
+      const { session } = createSession({ permissionManager: pm });
 
       const result = session.checkPermission("bash", { command: "ls" });
 
@@ -167,8 +168,7 @@ describe("PermissionSession", () => {
 
     it("delegates getToolPermission to internal PermissionManager", () => {
       const pm = makePermissionManager();
-      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
-      const { session } = createSession();
+      const { session } = createSession({ permissionManager: pm });
 
       const result = session.getToolPermission("read");
 
@@ -177,11 +177,9 @@ describe("PermissionSession", () => {
     });
 
     it("delegates getConfigIssues to internal PermissionManager", () => {
-      const pm = makePermissionManager({
-        getConfigIssues: vi.fn().mockReturnValue(["issue1"]),
-      });
-      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
-      const { session } = createSession();
+      const pm = makePermissionManager();
+      vi.mocked(pm.getConfigIssues).mockReturnValue(["issue1"]);
+      const { session } = createSession({ permissionManager: pm });
 
       expect(session.getConfigIssues("agent1")).toEqual(["issue1"]);
       expect(pm.getConfigIssues).toHaveBeenCalledWith("agent1");
@@ -189,8 +187,7 @@ describe("PermissionSession", () => {
 
     it("delegates getPolicyCacheStamp to internal PermissionManager", () => {
       const pm = makePermissionManager();
-      mockCreatePermissionManagerForCwd.mockReturnValue(pm);
-      const { session } = createSession();
+      const { session } = createSession({ permissionManager: pm });
 
       expect(session.getPolicyCacheStamp("agent1")).toBe("stamp-1");
       expect(pm.getPolicyCacheStamp).toHaveBeenCalledWith("agent1");
@@ -217,6 +214,74 @@ describe("PermissionSession", () => {
     });
   });
 
+  describe("resolve", () => {
+    it("forwards surface, input, and agentName, applying the empty session ruleset", () => {
+      const pm = makePermissionManager();
+      const { session } = createSession({ permissionManager: pm });
+
+      session.resolve("bash", { command: "ls" }, "agent-x");
+
+      expect(pm.checkPermission).toHaveBeenCalledWith(
+        "bash",
+        { command: "ls" },
+        "agent-x",
+        [],
+      );
+    });
+
+    it("defaults agentName to undefined when omitted", () => {
+      const pm = makePermissionManager();
+      const { session } = createSession({ permissionManager: pm });
+
+      session.resolve("read", { path: ".env" });
+
+      expect(pm.checkPermission).toHaveBeenCalledWith(
+        "read",
+        { path: ".env" },
+        undefined,
+        [],
+      );
+    });
+
+    it("applies a recorded session approval on the next resolve", () => {
+      const pm = makePermissionManager();
+      const { session } = createSession({ permissionManager: pm });
+
+      session.recordSessionApproval(SessionApproval.single("bash", "git *"));
+      session.resolve("bash", { command: "git status" });
+
+      const sessionRules = vi.mocked(pm.checkPermission).mock.calls[0][3];
+      expect(sessionRules).toHaveLength(1);
+      expect(sessionRules?.[0]).toMatchObject({
+        surface: "bash",
+        pattern: "git *",
+        action: "allow",
+      });
+    });
+
+    it("returns the PermissionManager's check result", () => {
+      const pm = makePermissionManager();
+      vi.mocked(pm.checkPermission).mockReturnValue({
+        state: "deny",
+        toolName: "bash",
+        source: "bash",
+        origin: "global",
+        matchedPattern: "rm *",
+      });
+      const { session } = createSession({ permissionManager: pm });
+
+      const result = session.resolve("bash", { command: "rm -rf /" });
+
+      expect(result).toEqual({
+        state: "deny",
+        toolName: "bash",
+        source: "bash",
+        origin: "global",
+        matchedPattern: "rm *",
+      });
+    });
+  });
+
   describe("activate and deactivate", () => {
     it("stores the context on activate", () => {
       const { session, forwarding } = createSession();
@@ -237,28 +302,14 @@ describe("PermissionSession", () => {
   });
 
   describe("resetForNewSession", () => {
-    it("creates a new PermissionManager for the context cwd", () => {
-      const pm2 = makePermissionManager({
-        checkPermission: vi.fn().mockReturnValue({
-          state: "deny",
-          toolName: "bash",
-          source: "bash",
-          origin: "global",
-        }),
-      });
-      mockCreatePermissionManagerForCwd.mockReturnValue(pm2);
-      const { session } = createSession();
+    it("configures the injected PermissionManager for the context cwd", () => {
+      const pm = makePermissionManager();
+      const { session } = createSession({ permissionManager: pm });
       const ctx = makeCtx({ cwd: "/new/project" });
 
       session.resetForNewSession(ctx);
 
-      expect(mockCreatePermissionManagerForCwd).toHaveBeenCalledWith(
-        "/test/agent",
-        "/new/project",
-      );
-      // Verify the new PM is used for subsequent calls
-      const result = session.checkPermission("bash", { command: "rm" });
-      expect(result.state).toBe("deny");
+      expect(pm.configureForCwd).toHaveBeenCalledWith("/new/project");
     });
 
     it("clears cache keys", () => {
@@ -432,26 +483,25 @@ describe("PermissionSession", () => {
   });
 
   describe("infrastructure paths", () => {
-    it("getInfrastructureDirs returns paths from ExtensionPaths", () => {
-      const { session } = createSession();
-      expect(session.getInfrastructureDirs()).toEqual([
-        "/test/agent",
-        "/test/agent/git",
-      ]);
-    });
-
-    it("getInfrastructureReadPaths returns config paths", () => {
+    it("getInfrastructureReadDirs combines piInfrastructureDirs and piInfrastructureReadPaths", () => {
       const runtimeDeps = makeRuntimeDeps();
       (runtimeDeps.getConfig as ReturnType<typeof vi.fn>).mockReturnValue({
         piInfrastructureReadPaths: ["/extra/path"],
       });
       const { session } = createSession({ runtimeDeps });
-      expect(session.getInfrastructureReadPaths()).toEqual(["/extra/path"]);
+      expect(session.getInfrastructureReadDirs()).toEqual([
+        "/test/agent",
+        "/test/agent/git",
+        "/extra/path",
+      ]);
     });
 
-    it("getInfrastructureReadPaths returns empty when config omits the field", () => {
+    it("getInfrastructureReadDirs returns only piInfrastructureDirs when config omits the field", () => {
       const { session } = createSession();
-      expect(session.getInfrastructureReadPaths()).toEqual([]);
+      expect(session.getInfrastructureReadDirs()).toEqual([
+        "/test/agent",
+        "/test/agent/git",
+      ]);
     });
   });
 
@@ -478,23 +528,38 @@ describe("PermissionSession", () => {
       const { session } = createSession({ runtimeDeps });
       expect(session.config).toBe(fakeConfig);
     });
+
+    it("getToolPreviewLimits returns resolved preview limits from config", () => {
+      const runtimeDeps = makeRuntimeDeps();
+      (runtimeDeps.getConfig as ReturnType<typeof vi.fn>).mockReturnValue({
+        toolInputPreviewMaxLength: 400,
+        toolTextSummaryMaxLength: 120,
+      });
+      const { session } = createSession({ runtimeDeps });
+      const limits = session.getToolPreviewLimits();
+      expect(limits.toolInputPreviewMaxLength).toBe(400);
+      expect(limits.toolTextSummaryMaxLength).toBe(120);
+    });
+
+    it("getToolPreviewLimits falls back to built-in defaults when config omits fields", () => {
+      const { session } = createSession();
+      const limits = session.getToolPreviewLimits();
+      expect(limits.toolInputPreviewMaxLength).toBeGreaterThan(0);
+      expect(limits.toolTextSummaryMaxLength).toBeGreaterThan(0);
+      expect(limits.toolInputLogPreviewMaxLength).toBeGreaterThan(0);
+    });
   });
 
   describe("reload", () => {
-    it("recreates PermissionManager for current context cwd", () => {
-      const { session } = createSession();
+    it("configures PermissionManager for current context cwd", () => {
+      const pm = makePermissionManager();
+      const { session } = createSession({ permissionManager: pm });
       const ctx = makeCtx({ cwd: "/project" });
       session.activate(ctx);
 
-      const pm2 = makePermissionManager();
-      mockCreatePermissionManagerForCwd.mockReturnValue(pm2);
-
       session.reload();
 
-      expect(mockCreatePermissionManagerForCwd).toHaveBeenCalledWith(
-        "/test/agent",
-        "/project",
-      );
+      expect(pm.configureForCwd).toHaveBeenCalledWith("/project");
     });
 
     it("clears caches and skill entries", () => {
@@ -532,6 +597,62 @@ describe("PermissionSession", () => {
     });
   });
 
+  describe("canConfirm", () => {
+    it("returns true when context is active and canPrompt returns true", () => {
+      const { session } = createSession();
+      session.activate(makeCtx());
+      expect(session.canConfirm()).toBe(true);
+    });
+
+    it("returns false when no context is active", () => {
+      const { session } = createSession();
+      expect(session.canConfirm()).toBe(false);
+    });
+
+    it("returns false when canPrompt returns false", () => {
+      const runtimeDeps = makeRuntimeDeps();
+      (
+        runtimeDeps.canRequestPermissionConfirmation as ReturnType<typeof vi.fn>
+      ).mockReturnValue(false);
+      const { session } = createSession({ runtimeDeps });
+      session.activate(makeCtx());
+      expect(session.canConfirm()).toBe(false);
+    });
+  });
+
+  describe("promptPermission", () => {
+    it("delegates to prompt with stored context", async () => {
+      const { session, runtimeDeps } = createSession();
+      const ctx = makeCtx();
+      session.activate(ctx);
+      const details = {
+        requestId: "req-1",
+        source: "tool_call" as const,
+        agentName: null,
+        message: "Allow?",
+      };
+
+      const result = await session.promptPermission(details);
+
+      expect(runtimeDeps.promptPermission).toHaveBeenCalledWith(ctx, details);
+      expect(result).toEqual({ approved: true, state: "approved" });
+    });
+
+    it("throws when no context is active", async () => {
+      const { session } = createSession();
+      const details = {
+        requestId: "req-1",
+        source: "tool_call" as const,
+        agentName: null,
+        message: "Allow?",
+      };
+
+      await expect(session.promptPermission(details)).rejects.toThrow(
+        "promptPermission called before the session was activated",
+      );
+    });
+  });
+
   describe("canPrompt", () => {
     it("delegates to runtimeDeps.canRequestPermissionConfirmation", () => {
       const { session, runtimeDeps } = createSession();
@@ -573,19 +694,4 @@ describe("PermissionSession", () => {
       expect(result).toEqual({ approved: true, state: "approved" });
     });
   });
-
-  describe("createPermissionRequestId", () => {
-    it("starts with the given prefix", () => {
-      const { session } = createSession();
-      const id = session.createPermissionRequestId("skill-input");
-      expect(id.startsWith("skill-input-")).toBe(true);
-    });
-
-    it("generates unique IDs on repeated calls", () => {
-      const { session } = createSession();
-      const id1 = session.createPermissionRequestId("test");
-      const id2 = session.createPermissionRequestId("test");
-      expect(id1).not.toBe(id2);
-    });
-  });
 });

package/test/permissions-service.test.ts

@@ -0,0 +1,151 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { PermissionManager } from "#src/permission-manager";
+import { LocalPermissionsService } from "#src/permissions-service";
+import type { Ruleset } from "#src/rule";
+import type { SessionRules } from "#src/session-rules";
+import type {
+  ToolInputFormatter,
+  ToolInputFormatterRegistry,
+} from "#src/tool-input-formatter-registry";
+
+import { makeCheckResult } from "#test/helpers/handler-fixtures";
+
+// ── input-normalizer stub ──────────────────────────────────────────────────
+
+const mockBuildInputForSurface = vi.hoisted(() =>
+  vi.fn<(surface: string, value?: string) => unknown>(),
+);
+
+vi.mock("#src/input-normalizer", () => ({
+  buildInputForSurface: mockBuildInputForSurface,
+}));
+
+// ── helpers ────────────────────────────────────────────────────────────────
+
+function makePermissionManager(): PermissionManager {
+  return {
+    checkPermission: vi
+      .fn<PermissionManager["checkPermission"]>()
+      .mockReturnValue(makeCheckResult()),
+    getToolPermission: vi
+      .fn<PermissionManager["getToolPermission"]>()
+      .mockReturnValue("allow"),
+  } as unknown as PermissionManager;
+}
+
+function makeSessionRules(rules: Ruleset = []): SessionRules {
+  return {
+    getRuleset: vi.fn<SessionRules["getRuleset"]>().mockReturnValue(rules),
+  } as unknown as SessionRules;
+}
+
+function makeFormatterRegistry(): ToolInputFormatterRegistry {
+  return {
+    register: vi
+      .fn<ToolInputFormatterRegistry["register"]>()
+      .mockReturnValue(vi.fn()),
+  } as unknown as ToolInputFormatterRegistry;
+}
+
+function makeService(overrides?: {
+  permissionManager?: PermissionManager;
+  sessionRules?: SessionRules;
+  formatterRegistry?: ToolInputFormatterRegistry;
+}) {
+  const permissionManager =
+    overrides?.permissionManager ?? makePermissionManager();
+  const sessionRules = overrides?.sessionRules ?? makeSessionRules();
+  const formatterRegistry =
+    overrides?.formatterRegistry ?? makeFormatterRegistry();
+  const service = new LocalPermissionsService(
+    permissionManager,
+    sessionRules,
+    formatterRegistry,
+  );
+  return { service, permissionManager, sessionRules, formatterRegistry };
+}
+
+// ── tests ──────────────────────────────────────────────────────────────────
+
+beforeEach(() => {
+  mockBuildInputForSurface.mockReset();
+  mockBuildInputForSurface.mockReturnValue({ type: "tool-input" });
+});
+
+describe("checkPermission", () => {
+  it("builds the surface input from surface and value", () => {
+    const { service } = makeService();
+    service.checkPermission("bash", "echo hi");
+    expect(mockBuildInputForSurface).toHaveBeenCalledWith("bash", "echo hi");
+  });
+
+  it("builds the surface input with undefined value when value is omitted", () => {
+    const { service } = makeService();
+    service.checkPermission("read");
+    expect(mockBuildInputForSurface).toHaveBeenCalledWith("read", undefined);
+  });
+
+  it("calls permissionManager.checkPermission with surface, built input, agentName, and current ruleset", () => {
+    const ruleset: Ruleset = [
+      { surface: "bash", pattern: "*", action: "allow", origin: "global" },
+    ];
+    const builtInput = { type: "bash-input" };
+    mockBuildInputForSurface.mockReturnValue(builtInput);
+    const { service, permissionManager, sessionRules } = makeService({
+      sessionRules: makeSessionRules(ruleset),
+    });
+    service.checkPermission("bash", "echo hi", "my-agent");
+    expect(permissionManager.checkPermission).toHaveBeenCalledWith(
+      "bash",
+      builtInput,
+      "my-agent",
+      ruleset,
+    );
+    void sessionRules; // used indirectly
+  });
+
+  it("returns the result from permissionManager.checkPermission", () => {
+    const expected = makeCheckResult({ state: "deny", toolName: "bash" });
+    const { service, permissionManager } = makeService();
+    vi.mocked(permissionManager.checkPermission).mockReturnValue(expected);
+    const result = service.checkPermission("bash", "rm -rf /");
+    expect(result).toBe(expected);
+  });
+});
+
+describe("getToolPermission", () => {
+  it("delegates to permissionManager.getToolPermission", () => {
+    const { service, permissionManager } = makeService();
+    vi.mocked(permissionManager.getToolPermission).mockReturnValue("deny");
+    const result = service.getToolPermission("write", "my-agent");
+    expect(permissionManager.getToolPermission).toHaveBeenCalledWith(
+      "write",
+      "my-agent",
+    );
+    expect(result).toBe("deny");
+  });
+
+  it("omits agentName when not provided", () => {
+    const { service, permissionManager } = makeService();
+    service.getToolPermission("read");
+    expect(permissionManager.getToolPermission).toHaveBeenCalledWith(
+      "read",
+      undefined,
+    );
+  });
+});
+
+describe("registerToolInputFormatter", () => {
+  it("delegates to formatterRegistry.register and returns the unsubscribe function", () => {
+    const unsub = vi.fn();
+    const { service, formatterRegistry } = makeService();
+    vi.mocked(formatterRegistry.register).mockReturnValue(unsub);
+    const formatter: ToolInputFormatter = vi.fn();
+    const result = service.registerToolInputFormatter("my-tool", formatter);
+    expect(formatterRegistry.register).toHaveBeenCalledWith(
+      "my-tool",
+      formatter,
+    );
+    expect(result).toBe(unsub);
+  });
+});