@gotgenes/pi-permission-system 16.0.1 → 16.1.0

package/src/handlers/gates/external-directory.ts

@@ -1,6 +1,5 @@
+import { AccessPath } from "#src/access-intent/access-path";
 import {
-  canonicalNormalizePathForComparison,
-  getExternalDirectoryPolicyValues,
   getToolInputPath,
   isPathOutsideWorkingDirectory,
   isPiInfrastructureRead,
@@ -12,6 +11,7 @@ import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateResult } from "./descriptor";
 import { formatExternalDirectoryAskPrompt } from "./external-directory-messages";
+import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -28,8 +28,6 @@ export function describeExternalDirectoryGate(
   resolver: ScopedPermissionResolver,
   extractors?: ToolAccessExtractorLookup,
 ): GateResult {
-  if (!tcc.cwd) return null;
-
   const externalDirectoryPath = getToolInputPath(
     tcc.toolName,
     tcc.input,
@@ -44,10 +42,11 @@ export function describeExternalDirectoryGate(
   // The boundary decision (above) and the infrastructure-read containment
   // check (below) use the canonical, symlink-resolved path; pattern matching
   // uses the typed and resolved aliases (#418).
-  const canonicalExtPath = canonicalNormalizePathForComparison(
+  const accessPath = AccessPath.forExternalDirectory(
     externalDirectoryPath,
     tcc.cwd,
   );
+  const canonicalExtPath = accessPath.boundaryValue();
 
   // ── Pi infrastructure read bypass ──────────────────────────────────────
   if (
@@ -85,13 +84,11 @@ export function describeExternalDirectoryGate(
     tcc.agentName ?? undefined,
   );
 
-  // Match against both the typed and symlink-resolved aliases on the
-  // external_directory surface, so a config pattern on either form applies
-  // (#418). The runner consumes this preCheck and skips its own resolve.
-  const preCheck = resolver.resolvePathPolicy(
-    getExternalDirectoryPolicyValues(externalDirectoryPath, tcc.cwd),
+  // The runner consumes this preCheck and skips its own resolve.
+  const preCheck = resolveExternalDirectoryPolicy(
+    accessPath,
+    resolver,
     tcc.agentName ?? undefined,
-    "external_directory",
   );
   const pattern = deriveApprovalPattern(
     normalizePathForComparison(externalDirectoryPath, tcc.cwd),

package/src/handlers/gates/path.ts

@@ -37,9 +37,7 @@ export function describePathGate(
 
   // Resolve to the canonical (cwd-anchored, absolute) path so the approval
   // pattern matches the policy values a later call produces.
-  const approvalPath = tcc.cwd
-    ? normalizePathForComparison(filePath, tcc.cwd)
-    : filePath;
+  const approvalPath = normalizePathForComparison(filePath, tcc.cwd);
   const pattern = deriveApprovalPattern(approvalPath);
 
   const descriptor: GateDescriptor = {

package/src/handlers/gates/skill-read.ts

@@ -29,10 +29,6 @@ export function describeSkillReadGate(
     return null;
   }
 
-  if (tcc.cwd === undefined) {
-    return null;
-  }
-
   const normalizedReadPath = normalizePathForComparison(path, tcc.cwd);
   const matchedSkill = findSkillPathMatch(
     normalizedReadPath,

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -1,3 +1,4 @@
+import { BashProgram } from "#src/access-intent/bash/program";
 import { getNonEmptyString, toRecord } from "#src/common";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
@@ -10,7 +11,6 @@ import {
 import { resolveBashCommandCheck } from "./bash-command";
 import { describeBashExternalDirectoryGate } from "./bash-external-directory";
 import { describeBashPathGate } from "./bash-path";
-import { BashProgram } from "./bash-program";
 import type { GateResult } from "./descriptor";
 import { describeExternalDirectoryGate } from "./external-directory";
 import { describePathGate } from "./path";
@@ -66,7 +66,7 @@ export class ToolCallGatePipeline {
     const command = getNonEmptyString(toRecord(tcc.input).command);
     const bashProgram =
       tcc.toolName === "bash" && command
-        ? await BashProgram.parse(command)
+        ? await BashProgram.parse(command, tcc.cwd)
         : null;
 
     const formatter = new ToolPreviewFormatter(

package/src/handlers/gates/tool.ts

@@ -28,7 +28,7 @@ function deriveSuggestionValue(
   if (tcc.toolName === "mcp") return check.target ?? "mcp";
   const path = getPathBearingToolPath(tcc.toolName, tcc.input);
   if (path === null) return "*";
-  return tcc.cwd ? normalizePathForComparison(path, tcc.cwd) : path;
+  return normalizePathForComparison(path, tcc.cwd);
 }
 
 /**

package/src/handlers/gates/types.ts

@@ -9,5 +9,5 @@ export interface ToolCallContext {
   agentName: string | null;
   input: unknown;
   toolCallId: string;
-  cwd: string | undefined;
+  cwd: string;
 }

package/src/path-utils.ts

@@ -112,26 +112,6 @@ export function getPathPolicyValues(
   ];
 }
 
-/**
- * Equivalent `external_directory` policy-match values for a path: the lexical
- * (as-typed) alias list plus the canonical (symlink-resolved) absolute path.
- *
- * The outside-CWD boundary decision uses the canonical form separately; this
- * helper exists only for pattern matching, so a user's pattern on the typed
- * path (`/tmp/*`) and on the resolved path (`/private/tmp/*`) both match under
- * the last-match-wins alias evaluation. On systems where the path is not a
- * symlink the canonical form equals the lexical absolute alias and the `Set`
- * collapses it, leaving today's behavior unchanged.
- */
-export function getExternalDirectoryPolicyValues(
-  pathValue: string,
-  cwd: string,
-): string[] {
-  const lexical = getPathPolicyValues(pathValue, { cwd });
-  const canonical = canonicalNormalizePathForComparison(pathValue, cwd);
-  return canonical ? [...new Set([...lexical, canonical])] : lexical;
-}
-
 function getAbsolutePathPolicyValues(
   pathValue: string,
   options: PathPolicyValueOptions,

package/test/access-intent/access-path.test.ts

@@ -0,0 +1,107 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+// Mock node:os so tilde-expansion is deterministic across platforms.
+vi.mock("node:os", () => {
+  const homedir = vi.fn(() => "/mock/home");
+  return {
+    homedir,
+    default: { homedir },
+  };
+});
+
+// Mock node:fs so realpathSync (used by canonicalizePath) is controllable.
+// Default implementation is identity — lexical tests are unaffected.
+const realpathSync = vi.hoisted(() =>
+  vi.fn<(path: string) => string>((p) => p),
+);
+vi.mock("node:fs", () => ({
+  realpathSync,
+  default: { realpathSync },
+}));
+
+import { AccessPath } from "#src/access-intent/access-path";
+
+describe("AccessPath.forExternalDirectory", () => {
+  const cwd = "/projects/my-app";
+
+  beforeEach(() => {
+    realpathSync.mockReset();
+    realpathSync.mockImplementation((p: string) => p);
+  });
+
+  describe("matchValues()", () => {
+    test("adds the symlink-resolved alias alongside the typed path", () => {
+      // /tmp -> /private/tmp (the macOS symlink from the bug report, #418).
+      realpathSync.mockImplementation((p: string) =>
+        p.startsWith("/tmp") ? `/private${p}` : p,
+      );
+      expect(
+        AccessPath.forExternalDirectory("/tmp/x", cwd).matchValues(),
+      ).toEqual(["/tmp/x", "/private/tmp/x"]);
+    });
+
+    test("deduplicates when the canonical form equals the lexical form", () => {
+      expect(
+        AccessPath.forExternalDirectory("/etc/hosts", cwd).matchValues(),
+      ).toEqual(["/etc/hosts"]);
+    });
+
+    test("keeps the relative aliases for an in-cwd token without duplicating", () => {
+      expect(
+        AccessPath.forExternalDirectory("src/foo.ts", cwd).matchValues(),
+      ).toEqual(["/projects/my-app/src/foo.ts", "src/foo.ts"]);
+    });
+
+    test("includes only the lexical aliases when canonical is empty", () => {
+      // Force canonicalizePath to return the original (no-op symlink resolution
+      // effectively means canonical === lexical, handled by dedup).
+      expect(
+        AccessPath.forExternalDirectory("/etc/hosts", cwd).matchValues(),
+      ).not.toHaveLength(0);
+    });
+  });
+
+  describe("boundaryValue()", () => {
+    test("returns the canonical (symlink-resolved) form", () => {
+      realpathSync.mockImplementation((p: string) =>
+        p.startsWith("/tmp") ? `/private${p}` : p,
+      );
+      expect(
+        AccessPath.forExternalDirectory("/tmp/x", cwd).boundaryValue(),
+      ).toBe("/private/tmp/x");
+    });
+
+    test("returns the lexical form when path has no symlinks", () => {
+      expect(
+        AccessPath.forExternalDirectory("/etc/hosts", cwd).boundaryValue(),
+      ).toBe("/etc/hosts");
+    });
+
+    test("returns empty string for empty input", () => {
+      expect(AccessPath.forExternalDirectory("", cwd).boundaryValue()).toBe("");
+    });
+  });
+
+  describe("value()", () => {
+    test("returns the lexical (as-typed, normalized) form", () => {
+      realpathSync.mockImplementation((p: string) =>
+        p.startsWith("/tmp") ? `/private${p}` : p,
+      );
+      // Even when the path resolves to a different canonical, value() stays lexical.
+      expect(AccessPath.forExternalDirectory("/tmp/x", cwd).value()).toBe(
+        "/tmp/x",
+      );
+    });
+
+    test("normalizes the path against cwd", () => {
+      // A relative path becomes an absolute lexical value.
+      expect(AccessPath.forExternalDirectory("src/foo.ts", cwd).value()).toBe(
+        "/projects/my-app/src/foo.ts",
+      );
+    });
+
+    test("returns empty string for empty input", () => {
+      expect(AccessPath.forExternalDirectory("", cwd).value()).toBe("");
+    });
+  });
+});

package/test/access-intent/bash/node-text.test.ts

@@ -0,0 +1,147 @@
+import { describe, expect, it } from "vitest";
+import {
+  resolveNodeText,
+  SKIP_SUBTREE_TYPES,
+} from "#src/access-intent/bash/node-text";
+import type { TSNode } from "#src/access-intent/bash/parser";
+
+// Minimal fake TSNode builder — only fills the fields resolveNodeText reads.
+function makeNode(type: string, text: string, children: TSNode[] = []): TSNode {
+  return {
+    type,
+    text,
+    childCount: children.length,
+    isNamed: true,
+    child: (i) => children[i] ?? null,
+  };
+}
+
+describe("SKIP_SUBTREE_TYPES", () => {
+  it("contains the three node types that must not be descended", () => {
+    expect(SKIP_SUBTREE_TYPES.has("heredoc_body")).toBe(true);
+    expect(SKIP_SUBTREE_TYPES.has("heredoc_end")).toBe(true);
+    expect(SKIP_SUBTREE_TYPES.has("comment")).toBe(true);
+  });
+
+  it("does not contain common argument node types", () => {
+    expect(SKIP_SUBTREE_TYPES.has("word")).toBe(false);
+    expect(SKIP_SUBTREE_TYPES.has("string")).toBe(false);
+    expect(SKIP_SUBTREE_TYPES.has("raw_string")).toBe(false);
+  });
+});
+
+describe("resolveNodeText", () => {
+  describe("word nodes", () => {
+    it("returns the node text unchanged", () => {
+      expect(resolveNodeText(makeNode("word", "hello"))).toBe("hello");
+    });
+  });
+
+  describe("raw_string nodes (single-quoted)", () => {
+    it("strips surrounding single quotes", () => {
+      expect(resolveNodeText(makeNode("raw_string", "'content'"))).toBe(
+        "content",
+      );
+    });
+
+    it("strips single quotes around a path", () => {
+      expect(resolveNodeText(makeNode("raw_string", "'/etc/hosts'"))).toBe(
+        "/etc/hosts",
+      );
+    });
+
+    it("returns text as-is when not fully single-quoted", () => {
+      // A raw_string node without enclosing quotes (defensive fallback)
+      expect(resolveNodeText(makeNode("raw_string", "noquotes"))).toBe(
+        "noquotes",
+      );
+    });
+  });
+
+  describe("string nodes (double-quoted)", () => {
+    it("concatenates inner word children, skipping quote delimiters", () => {
+      const quoteOpen = makeNode('"', '"');
+      const content = makeNode("string_content", "hello world");
+      const quoteClose = makeNode('"', '"');
+      const node = makeNode("string", '"hello world"', [
+        quoteOpen,
+        content,
+        quoteClose,
+      ]);
+      expect(resolveNodeText(node)).toBe("hello world");
+    });
+
+    it("concatenates multiple inner children", () => {
+      const quoteOpen = makeNode('"', '"');
+      const part1 = makeNode("string_content", "foo");
+      const part2 = makeNode("simple_expansion", "$BAR");
+      const quoteClose = makeNode('"', '"');
+      const node = makeNode("string", '"foo$BAR"', [
+        quoteOpen,
+        part1,
+        part2,
+        quoteClose,
+      ]);
+      expect(resolveNodeText(node)).toBe("foo$BAR");
+    });
+
+    it("returns empty string for an empty double-quoted string", () => {
+      const quoteOpen = makeNode('"', '"');
+      const quoteClose = makeNode('"', '"');
+      const node = makeNode("string", '""', [quoteOpen, quoteClose]);
+      expect(resolveNodeText(node)).toBe("");
+    });
+  });
+
+  describe("string_content, simple_expansion, and expansion nodes", () => {
+    it("returns text as-is for string_content", () => {
+      expect(resolveNodeText(makeNode("string_content", "plain text"))).toBe(
+        "plain text",
+      );
+    });
+
+    it("returns text as-is for simple_expansion (e.g. $HOME)", () => {
+      // retro 0350: $HOME returns the literal text of a simple_expansion node
+      expect(resolveNodeText(makeNode("simple_expansion", "$HOME"))).toBe(
+        "$HOME",
+      );
+    });
+
+    it("returns text as-is for expansion", () => {
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: intentional literal — testing that expansion node text is returned verbatim
+      expect(resolveNodeText(makeNode("expansion", "${VAR}"))).toBe("${VAR}");
+    });
+  });
+
+  describe("concatenation nodes", () => {
+    it("concatenates resolved children", () => {
+      const word = makeNode("word", "/etc/");
+      const expansion = makeNode("simple_expansion", "$FILE");
+      const node = makeNode("concatenation", "/etc/$FILE", [word, expansion]);
+      expect(resolveNodeText(node)).toBe("/etc/$FILE");
+    });
+
+    it("handles nested concatenation-of-string", () => {
+      // A concatenation whose child is a double-quoted string
+      const quoteOpen = makeNode('"', '"');
+      const content = makeNode("string_content", "bar");
+      const quoteClose = makeNode('"', '"');
+      const inner = makeNode("string", '"bar"', [
+        quoteOpen,
+        content,
+        quoteClose,
+      ]);
+      const prefix = makeNode("word", "foo");
+      const node = makeNode("concatenation", 'foo"bar"', [prefix, inner]);
+      expect(resolveNodeText(node)).toBe("foobar");
+    });
+  });
+
+  describe("default fallback", () => {
+    it("returns the raw text for unknown node types", () => {
+      expect(resolveNodeText(makeNode("unknown_type", "rawtext"))).toBe(
+        "rawtext",
+      );
+    });
+  });
+});

package/test/access-intent/bash/parser.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { getParser } from "#src/access-intent/bash/parser";
+
+describe("getParser", () => {
+  it("parses a simple bash command and returns a non-null root node", async () => {
+    const parser = await getParser();
+    const tree = parser.parse("echo hi");
+    expect(tree).not.toBeNull();
+    expect(tree?.rootNode).toBeDefined();
+    expect(tree?.rootNode.type).toBe("program");
+    tree?.delete();
+  });
+
+  it("returns the same memoized parser instance on repeated calls", async () => {
+    const first = await getParser();
+    const second = await getParser();
+    expect(first).toBe(second);
+  });
+});