@gotgenes/pi-permission-system 16.0.2 → 16.2.0

package/test/helpers/gate-fixtures.ts

@@ -26,13 +26,10 @@ import { makeCheckResult } from "#test/helpers/handler-fixtures";
  */
 export function makeResolver(defaultCheck?: PermissionCheckResult) {
   const resolve = vi.fn<ScopedPermissionResolver["resolve"]>();
-  const resolvePathPolicy =
-    vi.fn<ScopedPermissionResolver["resolvePathPolicy"]>();
   if (defaultCheck) {
     resolve.mockReturnValue(defaultCheck);
-    resolvePathPolicy.mockReturnValue(defaultCheck);
   }
-  return { resolve, resolvePathPolicy };
+  return { resolve };
 }
 
 /**
@@ -95,7 +92,6 @@ export function makeGateRunner(
   overrides: {
     resolveResult?: PermissionCheckResult;
     resolve?: ScopedPermissionResolver["resolve"];
-    resolvePathPolicy?: ScopedPermissionResolver["resolvePathPolicy"];
     recordSessionApproval?: SessionApprovalRecorder["recordSessionApproval"];
     canConfirm?: GatePrompter["canConfirm"];
     prompt?: GatePrompter["prompt"];
@@ -110,13 +106,6 @@ export function makeGateRunner(
       .mockReturnValue(
         overrides.resolveResult ?? makeCheckResult({ matchedPattern: "*" }),
       );
-  const resolvePathPolicy =
-    overrides.resolvePathPolicy ??
-    vi
-      .fn<ScopedPermissionResolver["resolvePathPolicy"]>()
-      .mockReturnValue(
-        overrides.resolveResult ?? makeCheckResult({ matchedPattern: "*" }),
-      );
   const recordSessionApproval =
     overrides.recordSessionApproval ??
     (vi.fn() as SessionApprovalRecorder["recordSessionApproval"]);
@@ -129,7 +118,7 @@ export function makeGateRunner(
       .fn<GatePrompter["prompt"]>()
       .mockResolvedValue({ approved: true, state: "approved" });
   const runner = new GateRunner(
-    { resolve, resolvePathPolicy },
+    { resolve },
     { recordSessionApproval },
     { canConfirm, prompt },
     reporter,
@@ -138,7 +127,6 @@ export function makeGateRunner(
     runner,
     deps: {
       resolve,
-      resolvePathPolicy,
       recordSessionApproval,
       canConfirm,
       prompt,
@@ -217,22 +205,22 @@ export function makePathDispatchResolver(
   defaultResult: PermissionCheckResult,
 ) {
   const resolve = vi.fn<ScopedPermissionResolver["resolve"]>();
-  resolve.mockImplementation((_surface, input) => {
-    const path = (input as Record<string, unknown>).path;
-    if (typeof path === "string" && path in byPath) {
-      return byPath[path];
+  resolve.mockImplementation((intent) => {
+    if (intent.kind === "tool") {
+      const path = (intent.input as Record<string, unknown>).path;
+      if (typeof path === "string" && path in byPath) {
+        return byPath[path];
+      }
+      return defaultResult;
     }
-    return defaultResult;
-  });
-  const resolvePathPolicy =
-    vi.fn<ScopedPermissionResolver["resolvePathPolicy"]>();
-  resolvePathPolicy.mockImplementation((values) => {
+    const values =
+      intent.kind === "access-path" ? intent.path.matchValues() : intent.values;
     for (const value of values) {
       if (value in byPath) return byPath[value];
     }
     return defaultResult;
   });
-  return { resolve, resolvePathPolicy };
+  return { resolve };
 }
 
 /**

package/test/helpers/handler-fixtures.ts

@@ -4,12 +4,13 @@
  * `makeHandler` builds a real PermissionSession + PermissionResolver and wires
  * them into the handler and pipelines exactly as `index.ts` does.
  * Call-site overrides for permission results flow through
- * `permissionManager.checkPermission`; session state overrides are applied
+ * `permissionManager.check`; session state overrides are applied
  * via vi.spyOn on the real session instance.
  */
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { vi } from "vitest";
 
+import type { ResolvedAccessIntent } from "#src/access-intent/access-intent";
 import { GateDecisionReporter } from "#src/decision-reporter";
 import type { GatePrompter } from "#src/gate-prompter";
 import { GateRunner } from "#src/handlers/gates/runner";
@@ -238,21 +239,26 @@ export function makeHandler(overrides?: {
   const so = overrides?.session;
   const surfaceCheck = so?.checkPermission;
   if (surfaceCheck) {
-    vi.mocked(permissionManager.checkPermission).mockImplementation(
-      surfaceCheck,
-    );
-    // The bash path and external-directory gates resolve through
-    // checkPathPolicy; route it through the same surface dispatcher (threading
-    // the real surface) so `path` / `external_directory` overrides apply to
-    // bash tokens and tool paths alike (#418).
-    vi.mocked(permissionManager.checkPathPolicy).mockImplementation(
-      (values, agentName, sessionRules, surface = "path") =>
-        surfaceCheck(
-          surface,
-          { path: values[0] ?? "*" },
-          agentName,
+    // Route the unified check(intent) through the surface dispatcher so
+    // makeSurfaceCheck / makeBashCommandCheck overrides apply to all gate
+    // paths via the single manager entry point (#478).
+    vi.mocked(permissionManager.check).mockImplementation(
+      (intent: ResolvedAccessIntent, sessionRules) => {
+        if (intent.kind === "path-values") {
+          return surfaceCheck(
+            intent.surface,
+            { path: intent.values[0] ?? "*" },
+            intent.agentName,
+            sessionRules,
+          );
+        }
+        return surfaceCheck(
+          intent.surface,
+          intent.input,
+          intent.agentName,
           sessionRules,
-        ),
+        );
+      },
     );
   }
   if (so?.getActiveSkillEntries) {

package/test/helpers/session-fixtures.ts

@@ -13,6 +13,7 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { vi } from "vitest";
 
+import type { ResolvedAccessIntent } from "#src/access-intent/access-intent";
 import type { SessionConfigStore } from "#src/config-store";
 import { DEFAULT_EXTENSION_CONFIG } from "#src/extension-config";
 import type { ExtensionPaths } from "#src/extension-paths";
@@ -87,12 +88,10 @@ export function makeForwarding(): ForwardingController {
 export function makeFakePermissionManager() {
   return {
     configureForCwd: vi.fn<(cwd: string | undefined | null) => void>(),
-    checkPermission: vi
+    check: vi
       .fn<
         (
-          toolName: string,
-          input: unknown,
-          agentName?: string,
+          intent: ResolvedAccessIntent,
           sessionRules?: Ruleset,
         ) => PermissionCheckResult
       >()
@@ -102,20 +101,6 @@ export function makeFakePermissionManager() {
         source: "tool",
         origin: "builtin",
       }),
-    checkPathPolicy: vi
-      .fn<
-        (
-          values: readonly string[],
-          agentName?: string,
-          sessionRules?: Ruleset,
-        ) => PermissionCheckResult
-      >()
-      .mockReturnValue({
-        state: "allow",
-        toolName: "path",
-        source: "special",
-        origin: "builtin",
-      }),
     getToolPermission: vi
       .fn<(toolName: string, agentName?: string) => PermissionState>()
       .mockReturnValue("allow"),

package/test/path-utils.test.ts

@@ -22,7 +22,6 @@ vi.mock("node:fs", () => ({
 
 import {
   canonicalNormalizePathForComparison,
-  getExternalDirectoryPolicyValues,
   getPathBearingToolPath,
   getPathPolicyValues,
   getToolInputPath,
@@ -615,36 +614,3 @@ describe("getPathPolicyValues", () => {
     expect(getPathPolicyValues("   ", { cwd })).toEqual([]);
   });
 });
-
-describe("getExternalDirectoryPolicyValues", () => {
-  const cwd = "/projects/my-app";
-
-  beforeEach(() => {
-    realpathSync.mockReset();
-    realpathSync.mockImplementation((p: string) => p);
-  });
-
-  test("adds the symlink-resolved alias alongside the typed path", () => {
-    // /tmp -> /private/tmp (the macOS symlink from the bug report).
-    realpathSync.mockImplementation((p: string) =>
-      p.startsWith("/tmp") ? `/private${p}` : p,
-    );
-    expect(getExternalDirectoryPolicyValues("/tmp/x", cwd)).toEqual([
-      "/tmp/x",
-      "/private/tmp/x",
-    ]);
-  });
-
-  test("dedups when the canonical form equals the lexical form", () => {
-    expect(getExternalDirectoryPolicyValues("/etc/hosts", cwd)).toEqual([
-      "/etc/hosts",
-    ]);
-  });
-
-  test("keeps the relative aliases for an in-cwd token without duplicating", () => {
-    expect(getExternalDirectoryPolicyValues("src/foo.ts", cwd)).toEqual([
-      "/projects/my-app/src/foo.ts",
-      "src/foo.ts",
-    ]);
-  });
-});

package/test/permission-event-rpc.test.ts

@@ -37,7 +37,7 @@ function makeDeps(
 ): PermissionRpcDeps {
   return {
     permissionManager: {
-      checkPermission: vi.fn().mockReturnValue(makeCheckResult("allow")),
+      check: vi.fn().mockReturnValue(makeCheckResult("allow")),
     },
     sessionRules: { getRuleset: vi.fn().mockReturnValue([]) },
     session: { getRuntimeContext: vi.fn().mockReturnValue(null) },
@@ -74,7 +74,7 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
     const bus = createEventBus();
     const deps = makeDeps({
       permissionManager: {
-        checkPermission: vi.fn().mockReturnValue(makeCheckResult("allow")),
+        check: vi.fn().mockReturnValue(makeCheckResult("allow")),
       },
     });
     registerPermissionRpcHandlers(bus, deps);
@@ -101,7 +101,7 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
     const bus = createEventBus();
     const deps = makeDeps({
       permissionManager: {
-        checkPermission: vi.fn().mockReturnValue(
+        check: vi.fn().mockReturnValue(
           makeCheckResult("deny", {
             origin: "project",
             matchedPattern: "rm *",
@@ -132,7 +132,7 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
     const bus = createEventBus();
     const deps = makeDeps({
       permissionManager: {
-        checkPermission: vi
+        check: vi
           .fn()
           .mockReturnValue(
             makeCheckResult("ask", { matchedPattern: undefined }),
@@ -157,11 +157,11 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
     }
   });
 
-  it("passes agentName to checkPermission when provided", async () => {
-    const checkPermission = vi.fn().mockReturnValue(makeCheckResult("allow"));
+  it("passes agentName to check when provided", async () => {
+    const check = vi.fn().mockReturnValue(makeCheckResult("allow"));
     const bus = createEventBus();
     const deps = makeDeps({
-      permissionManager: { checkPermission },
+      permissionManager: { check },
     });
     registerPermissionRpcHandlers(bus, deps);
 
@@ -177,10 +177,12 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
     });
     await replyPromise;
 
-    expect(checkPermission).toHaveBeenCalledWith(
-      "bash",
-      expect.anything(),
-      "Worker",
+    expect(check).toHaveBeenCalledWith(
+      expect.objectContaining({
+        kind: "tool",
+        surface: "bash",
+        agentName: "Worker",
+      }),
       expect.anything(),
     );
   });
@@ -194,10 +196,10 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
         origin: "session" as const,
       },
     ];
-    const checkPermission = vi.fn().mockReturnValue(makeCheckResult("allow"));
+    const check = vi.fn().mockReturnValue(makeCheckResult("allow"));
     const bus = createEventBus();
     const deps = makeDeps({
-      permissionManager: { checkPermission },
+      permissionManager: { check },
       sessionRules: { getRuleset: vi.fn().mockReturnValue(sessionRules) },
     });
     registerPermissionRpcHandlers(bus, deps);
@@ -213,10 +215,12 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
     });
     await replyPromise;
 
-    expect(checkPermission).toHaveBeenCalledWith(
-      "bash",
-      expect.anything(),
-      undefined,
+    expect(check).toHaveBeenCalledWith(
+      expect.objectContaining({
+        kind: "tool",
+        surface: "bash",
+        agentName: undefined,
+      }),
       sessionRules,
     );
   });
@@ -243,10 +247,10 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
   });
 
   it("unsubCheck stops the handler from firing", async () => {
-    const checkPermission = vi.fn().mockReturnValue(makeCheckResult("allow"));
+    const check = vi.fn().mockReturnValue(makeCheckResult("allow"));
     const bus = createEventBus();
     const deps = makeDeps({
-      permissionManager: { checkPermission },
+      permissionManager: { check },
     });
     const handles = registerPermissionRpcHandlers(bus, deps);
     handles.unsubCheck();
@@ -258,7 +262,7 @@ describe("registerPermissionRpcHandlers — permissions:rpc:check", () => {
 
     // Give async handlers a chance to fire
     await new Promise((resolve) => setTimeout(resolve, 10));
-    expect(checkPermission).not.toHaveBeenCalled();
+    expect(check).not.toHaveBeenCalled();
   });
 });