@gotgenes/pi-permission-system 16.0.0 → 16.0.2

package/test/{handlers/gates/bash-token-classification.test.ts → access-intent/bash/token-classification.test.ts}

@@ -3,7 +3,7 @@ import { describe, expect, test } from "vitest";
 import {
   classifyTokenAsPathCandidate,
   classifyTokenAsRuleCandidate,
-} from "#src/handlers/gates/bash-token-classification";
+} from "#src/access-intent/bash/token-classification";
 
 // ── Shared rejection behaviour ─────────────────────────────────────────────
 //

package/test/access-intent/bash/token-collection.test.ts

@@ -0,0 +1,300 @@
+import { describe, expect, it } from "vitest";
+import type { TSNode } from "#src/access-intent/bash/parser";
+import { getParser } from "#src/access-intent/bash/parser";
+import {
+  collectCommandTokens,
+  collectPathCandidateTokens,
+  collectRedirectTokens,
+  extractCommandName,
+} from "#src/access-intent/bash/token-collection";
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+/** Depth-first search for the first node of the given type. */
+function findNode(node: TSNode, type: string): TSNode | null {
+  if (node.type === type) return node;
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (!child) continue;
+    const found = findNode(child, type);
+    if (found) return found;
+  }
+  return null;
+}
+
+/** Parse a bash snippet and return the first `command` node. */
+async function parseCommandNode(cmd: string): Promise<{
+  node: TSNode;
+  tree: { rootNode: TSNode; delete(): void };
+}> {
+  const parser = await getParser();
+  const tree = parser.parse(cmd);
+  if (!tree) throw new Error("parser.parse returned null");
+  const node = findNode(tree.rootNode, "command");
+  if (!node) throw new Error(`no command node found in: ${cmd}`);
+  return { node, tree };
+}
+
+/** Parse a bash snippet and return the first `file_redirect` node. */
+async function parseRedirectNode(cmd: string): Promise<{
+  node: TSNode;
+  tree: { rootNode: TSNode; delete(): void };
+}> {
+  const parser = await getParser();
+  const tree = parser.parse(cmd);
+  if (!tree) throw new Error("parser.parse returned null");
+  const node = findNode(tree.rootNode, "file_redirect");
+  if (!node) throw new Error(`no file_redirect node found in: ${cmd}`);
+  return { node, tree };
+}
+
+// ── extractCommandName ────────────────────────────────────────────────────────
+
+describe("extractCommandName", () => {
+  it("returns the basename for a bare command", async () => {
+    const { node, tree } = await parseCommandNode("sed 's/x/y/' file.txt");
+    try {
+      expect(extractCommandName(node)).toBe("sed");
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("strips the directory prefix from an absolute command path", async () => {
+    const { node, tree } = await parseCommandNode(
+      "/usr/bin/sed 's/x/y/' file.txt",
+    );
+    try {
+      expect(extractCommandName(node)).toBe("sed");
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("returns the substitution text when the command name is a command substitution", async () => {
+    // $(which sed) parses with a command_name child whose text is "$(which sed)";
+    // resolveNodeText returns that text, so extractCommandName returns its basename.
+    // PATTERN_FIRST_COMMANDS.get("$(which sed)") returns undefined, so
+    // collectCommandTokens falls back to generic collection — correct behaviour.
+    const { node, tree } = await parseCommandNode(
+      "$(which sed) 's/x/y/' file.txt",
+    );
+    try {
+      expect(extractCommandName(node)).toBe("$(which sed)");
+    } finally {
+      tree.delete();
+    }
+  });
+});
+
+// ── collectCommandTokens — pattern-first commands ─────────────────────────────
+
+describe("collectCommandTokens — pattern-first commands", () => {
+  it("sed: skips the first positional (inline pattern) and collects the rest", async () => {
+    const { node, tree } = await parseCommandNode("sed 's/x/y/' a.txt b.txt");
+    try {
+      expect(collectCommandTokens(node)).toEqual(["a.txt", "b.txt"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("sed -e: skips the explicit script arg-consuming flag and collects positionals", async () => {
+    const { node, tree } = await parseCommandNode("sed -e 's/x/y/' file.txt");
+    try {
+      // -e consumes the next argument (the script), so file.txt is the first positional
+      // Since hasExplicitScript is set by -e, the positional is not skipped
+      expect(collectCommandTokens(node)).toEqual(["file.txt"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("sed -f: treats the next argument as a file path (file-consuming flag)", async () => {
+    const { node, tree } = await parseCommandNode(
+      "sed -f /scripts/script.sed file.txt",
+    );
+    try {
+      // -f consumes the next arg as a file path (extracted), and sets hasExplicitScript
+      expect(collectCommandTokens(node)).toEqual([
+        "/scripts/script.sed",
+        "file.txt",
+      ]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("grep: skips the first positional (pattern) and collects file arguments", async () => {
+    const { node, tree } = await parseCommandNode(
+      "grep pattern /etc/hosts /etc/passwd",
+    );
+    try {
+      expect(collectCommandTokens(node)).toEqual(["/etc/hosts", "/etc/passwd"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("grep -e: with explicit -e flag, all positionals are file arguments", async () => {
+    const { node, tree } = await parseCommandNode("grep -e pattern /etc/hosts");
+    try {
+      expect(collectCommandTokens(node)).toEqual(["/etc/hosts"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("grep: end-of-flags (--) causes subsequent args to be treated as positionals", async () => {
+    const { node, tree } = await parseCommandNode("grep -- pattern /etc/hosts");
+    try {
+      // After --, both 'pattern' (first positional) and '/etc/hosts' are positionals.
+      // pattern is the pattern positional and is skipped; /etc/hosts is collected.
+      expect(collectCommandTokens(node)).toEqual(["/etc/hosts"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("sd: skips the first two positionals (FIND and REPLACE_WITH) as patterns", async () => {
+    const { node, tree } = await parseCommandNode(
+      "sd find replace file.txt other.txt",
+    );
+    try {
+      expect(collectCommandTokens(node)).toEqual(["file.txt", "other.txt"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("rg: skips the pattern positional and collects file/dir arguments", async () => {
+    const { node, tree } = await parseCommandNode("rg pattern /etc/");
+    try {
+      expect(collectCommandTokens(node)).toEqual(["/etc/"]);
+    } finally {
+      tree.delete();
+    }
+  });
+});
+
+// ── collectCommandTokens — generic commands ───────────────────────────────────
+
+describe("collectCommandTokens — generic commands", () => {
+  it("collects all argument tokens after the command name", async () => {
+    const { node, tree } = await parseCommandNode("cat /etc/hosts /etc/passwd");
+    try {
+      expect(collectCommandTokens(node)).toEqual(["/etc/hosts", "/etc/passwd"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("skips variable assignment prefixes", async () => {
+    const { node, tree } = await parseCommandNode("FOO=/bar cat /etc/hosts");
+    try {
+      expect(collectCommandTokens(node)).toEqual(["/etc/hosts"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("collects no tokens for a bare command with no arguments", async () => {
+    const { node, tree } = await parseCommandNode("ls");
+    try {
+      expect(collectCommandTokens(node)).toEqual([]);
+    } finally {
+      tree.delete();
+    }
+  });
+});
+
+// ── collectRedirectTokens ─────────────────────────────────────────────────────
+
+describe("collectRedirectTokens", () => {
+  it("collects the destination path from a stdout redirect", async () => {
+    const { node, tree } = await parseRedirectNode(
+      "cat /etc/hosts > /tmp/out.txt",
+    );
+    try {
+      expect(collectRedirectTokens(node)).toEqual(["/tmp/out.txt"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("collects the destination path from an append redirect", async () => {
+    const { node, tree } = await parseRedirectNode(
+      "echo hello >> /tmp/log.txt",
+    );
+    try {
+      expect(collectRedirectTokens(node)).toEqual(["/tmp/log.txt"]);
+    } finally {
+      tree.delete();
+    }
+  });
+
+  it("collects the source path from a stdin redirect", async () => {
+    const { node, tree } = await parseRedirectNode("cat < /etc/hosts");
+    try {
+      expect(collectRedirectTokens(node)).toEqual(["/etc/hosts"]);
+    } finally {
+      tree.delete();
+    }
+  });
+});
+
+// ── collectPathCandidateTokens ────────────────────────────────────────────────
+
+describe("collectPathCandidateTokens", () => {
+  it("collects all argument tokens from a simple command via the program root", async () => {
+    const parser = await getParser();
+    const tree = parser.parse("cat /etc/hosts");
+    try {
+      if (!tree) throw new Error("parse returned null");
+      expect(collectPathCandidateTokens(tree.rootNode)).toEqual(["/etc/hosts"]);
+    } finally {
+      tree?.delete();
+    }
+  });
+
+  it("collects redirect destinations as well as command arguments", async () => {
+    const parser = await getParser();
+    const tree = parser.parse("cat /etc/hosts > /tmp/out.txt");
+    try {
+      if (!tree) throw new Error("parse returned null");
+      expect(collectPathCandidateTokens(tree.rootNode)).toEqual([
+        "/etc/hosts",
+        "/tmp/out.txt",
+      ]);
+    } finally {
+      tree?.delete();
+    }
+  });
+
+  it("returns empty array for heredoc-only content (SKIP_SUBTREE_TYPES)", async () => {
+    const parser = await getParser();
+    const tree = parser.parse("cat <<EOF\nhello\nEOF");
+    try {
+      if (!tree) throw new Error("parse returned null");
+      // heredoc_body is in SKIP_SUBTREE_TYPES — its text must not be collected
+      const tokens = collectPathCandidateTokens(tree.rootNode);
+      expect(tokens).not.toContain("hello");
+    } finally {
+      tree?.delete();
+    }
+  });
+
+  it("recurses into command substitution to collect nested tokens", async () => {
+    const parser = await getParser();
+    const tree = parser.parse("cat $(echo /etc/hosts)");
+    try {
+      if (!tree) throw new Error("parse returned null");
+      // The command_substitution is a non-command, non-redirect node — recurse
+      const tokens = collectPathCandidateTokens(tree.rootNode);
+      // /etc/hosts is inside the substitution, collected by recursion
+      expect(tokens).toContain("/etc/hosts");
+    } finally {
+      tree?.delete();
+    }
+  });
+});

package/test/composition-root.test.ts

@@ -521,3 +521,83 @@ describe("multi-instance global service interplay", () => {
     rmSync(childCwd, { recursive: true, force: true });
   });
 });
+
+describe("session approvals do not leak across same-cwd session switches", () => {
+  // Pi caches the extension *import* (the jiti module, factory function) for
+  // same-cwd `/new` / `/resume` / `/fork` / `/import` switches
+  // (earendil-works/pi#5905). The factory is still re-invoked per switch, and
+  // `session_shutdown` still fires — so a session-scoped "allow for this
+  // session" grant must not survive into the next session.
+  //
+  // Two factory invocations against the same cwd model the cached-import
+  // switch: invocation #1 records an approval and shuts down; invocation #2 is
+  // the re-invoked cached factory. The new session must start with an empty
+  // SessionRules. Two independent mechanisms keep it empty, and the grant only
+  // leaks if *both* break together: `session_shutdown` clears the first
+  // instance's rules, and the re-invoked factory builds a fresh SessionRules
+  // (no module-scoped state bridges the switch — the per-session reset the
+  // fresh-jiti load used to provide is gone once the import is cached).
+
+  /** A UI ctx that approves the gate's "for this session" option (options[1]). */
+  function makeSessionApprovingCtx(cwd: string, sessionId: string): unknown {
+    return {
+      cwd,
+      hasUI: true,
+      sessionManager: {
+        getEntries: (): unknown[] => [],
+        getSessionId: (): string => sessionId,
+        getSessionDir: (): string => cwd,
+      },
+      ui: {
+        notify: (): void => {},
+        setStatus: (): void => {},
+        select: async (
+          _title: string,
+          options: string[],
+        ): Promise<string | undefined> => options[1],
+        input: async (): Promise<string | undefined> => undefined,
+      },
+    };
+  }
+
+  it("starts the next same-cwd session with an empty session ruleset", async () => {
+    writeGlobalConfig({
+      permission: { "*": "allow", demo: "ask" },
+    });
+
+    const cwd = mkdtempSync(join(tmpdir(), "pi-perm-switch-cwd-"));
+
+    // ── Session #1: approve `demo` for the session, then shut down ──────────
+    const firstPi = makeFakePi({ toolNames: ["demo"] });
+    piPermissionSystemExtension(firstPi as unknown as ExtensionAPI);
+
+    const firstCtx = makeSessionApprovingCtx(cwd, "switch-session-1");
+    await fireSessionStart(firstPi, firstCtx);
+
+    // The gate prompts and the mock selects options[1], recording a
+    // session-scoped approval the service can read back.
+    await firstPi.fire(
+      "tool_call",
+      { toolName: "demo", toolCallId: "demo-approve", input: { foo: "bar" } },
+      firstCtx,
+    );
+    expect(getPermissionsService()!.checkPermission("demo").state).toBe(
+      "allow",
+    );
+
+    // The switch tears down the old session before the new one starts.
+    await firstPi.fire("session_shutdown");
+
+    // ── Session #2: the re-invoked cached factory, same cwd ────────────────
+    const secondPi = makeFakePi({ toolNames: ["demo"] });
+    piPermissionSystemExtension(secondPi as unknown as ExtensionAPI);
+
+    await fireSessionStart(secondPi, makeChildCtx(cwd, "switch-session-2"));
+
+    // The previous session's approval must not be visible: `demo` is back to
+    // its configured `ask`, not the carried-over `allow`.
+    expect(getPermissionsService()!.checkPermission("demo").state).toBe("ask");
+
+    rmSync(cwd, { recursive: true, force: true });
+  });
+});

package/test/handlers/external-directory-symlink-acceptance.test.ts

@@ -13,9 +13,8 @@ import { mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-
+import { BashProgram } from "#src/access-intent/bash/program";
 import { describeBashExternalDirectoryGate } from "#src/handlers/gates/bash-external-directory";
-import { BashProgram } from "#src/handlers/gates/bash-program";
 import {
   type GateDescriptor,
   isGateBypass,
@@ -138,7 +137,7 @@ describe("external_directory symlink acceptance (#418)", () => {
         toolCallId: "tc-2",
         cwd,
       };
-      const program = await BashProgram.parse(command);
+      const program = await BashProgram.parse(command, cwd);
       const result = describeBashExternalDirectoryGate(tcc, program, resolver);
       // All external paths are covered by the allow → bypass, no prompt.
       expect(isGateBypass(result)).toBe(true);

package/test/handlers/gates/bash-command-metamorphic.test.ts

@@ -10,9 +10,8 @@
  * full fuzzer (tree-sitter fuzzing is brittle); it pins A3 directly.
  */
 import { describe, expect, it } from "vitest";
-
+import { BashProgram } from "#src/access-intent/bash/program";
 import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
-import { BashProgram } from "#src/handlers/gates/bash-program";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { PermissionState } from "#src/types";
 
@@ -47,7 +46,7 @@ async function decide(
   command: string,
   resolver: ScopedPermissionResolver,
 ): Promise<PermissionState> {
-  const program = await BashProgram.parse(command);
+  const program = await BashProgram.parse(command, "/cwd");
   return resolveBashCommandCheck(
     command,
     program.commands(),

package/test/handlers/gates/bash-external-directory.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "vitest";
+import { BashProgram } from "#src/access-intent/bash/program";
 import { getNonEmptyString, toRecord } from "#src/common";
 import { describeBashExternalDirectoryGate } from "#src/handlers/gates/bash-external-directory";
-import { BashProgram } from "#src/handlers/gates/bash-program";
 import type {
   GateBypass,
   GateDescriptor,
@@ -52,7 +52,7 @@ async function describeGate(
   const command = getNonEmptyString(toRecord(tcc.input).command);
   const bashProgram =
     tcc.toolName === "bash" && command
-      ? await BashProgram.parse(command)
+      ? await BashProgram.parse(command, tcc.cwd)
       : null;
   return describeBashExternalDirectoryGate(tcc, bashProgram, resolver);
 }
@@ -68,14 +68,6 @@ describe("describeBashExternalDirectoryGate", () => {
     expect(result).toBeNull();
   });
 
-  it("returns null when no CWD", async () => {
-    const result = await describeGate(
-      makeTcc({ cwd: undefined }),
-      makeResolver(makeCheckResult("ask")),
-    );
-    expect(result).toBeNull();
-  });
-
   it("returns null when command has no external paths", async () => {
     const result = await describeGate(
       makeTcc({ input: { command: "ls -la" } }),

package/test/handlers/gates/bash-path.test.ts

@@ -9,9 +9,9 @@ vi.mock("node:os", () => {
   };
 });
 
+import { BashProgram } from "#src/access-intent/bash/program";
 import { getNonEmptyString, toRecord } from "#src/common";
 import { describeBashPathGate } from "#src/handlers/gates/bash-path";
-import { BashProgram } from "#src/handlers/gates/bash-program";
 import type {
   GateBypass,
   GateDescriptor,
@@ -44,7 +44,7 @@ async function describeGate(
   const command = getNonEmptyString(toRecord(tcc.input).command);
   const bashProgram =
     tcc.toolName === "bash" && command
-      ? await BashProgram.parse(command)
+      ? await BashProgram.parse(command, tcc.cwd)
       : null;
   return describeBashPathGate(tcc, bashProgram, resolver);
 }

package/test/handlers/gates/external-directory.test.ts

@@ -43,11 +43,6 @@ function gateUnderTest(
 // ── tests ────────────────────��────────────────────────────────────��────────
 
 describe("describeExternalDirectoryGate", () => {
-  it("returns null when no CWD", () => {
-    const result = gateUnderTest(makeTcc({ cwd: undefined }), ["/test/agent"]);
-    expect(result).toBeNull();
-  });
-
   it("returns null when tool is not path-bearing", () => {
     const result = gateUnderTest(
       makeTcc({ toolName: "bash", input: { command: "ls" } }),

package/test/handlers/gates/tool-call-gate-pipeline.test.ts

@@ -16,7 +16,7 @@ const { mockBashProgramParse } = vi.hoisted(() => ({
   mockBashProgramParse: vi.fn(),
 }));
 
-vi.mock("#src/handlers/gates/bash-program", () => ({
+vi.mock("#src/access-intent/bash/program", () => ({
   BashProgram: { parse: mockBashProgramParse },
 }));
 
@@ -169,7 +169,10 @@ describe("ToolCallGatePipeline", () => {
       );
 
       expect(mockBashProgramParse).toHaveBeenCalledTimes(1);
-      expect(mockBashProgramParse).toHaveBeenCalledWith("echo hello");
+      expect(mockBashProgramParse).toHaveBeenCalledWith(
+        "echo hello",
+        "/test/project",
+      );
     });
 
     it("does not parse BashProgram when the bash command is empty", async () => {