@gotgenes/pi-permission-system 16.1.0 → 16.2.0

package/test/handlers/external-directory-session-dedup.test.ts

@@ -41,7 +41,7 @@ vi.mock("@earendil-works/pi-coding-agent", async (importOriginal) => {
  * Build a fully wired PermissionGateHandler for external-directory dedup
  * tests.
  *
- * `permissionManager.checkPermission` is configured so that:
+ * `permissionManager.check` is configured so that:
  * - `external_directory` surface returns "ask" on first call
  * - On subsequent calls it checks the shared `sessionRules` store; if a
  *   matching rule was recorded by the runner, it returns "allow" with
@@ -56,14 +56,16 @@ function makeDeduplicatingHandler(prompter?: GatePrompter): {
     makeRealSession();
   const { resolver } = makeRealResolver(permissionManager, sessionRules);
 
-  // Configure checkPermission to simulate config-level "ask" for external_directory
-  // but return "allow/session" when a session rule has been recorded.
-  vi.mocked(permissionManager.checkPermission).mockImplementation(
-    (surface, input, _agentName, rules): PermissionCheckResult => {
-      if (surface === "external_directory") {
-        const record = (input ?? {}) as Record<string, unknown>;
-        const pathValue = typeof record.path === "string" ? record.path : null;
+  // Unified check(intent) mock: "ask" for external_directory unless a session
+  // rule covers it; "allow" for everything else.
+  vi.mocked(permissionManager.check).mockImplementation(
+    (intent, rules): PermissionCheckResult => {
+      const { surface } = intent;
+      // Derive a representative path value from whichever intent kind arrived.
+      const pathValue =
+        intent.kind === "path-values" ? (intent.values[0] ?? null) : null;
 
+      if (surface === "external_directory") {
         if (pathValue && rules && rules.length > 0) {
           const match = rules.findLast(
             (r) =>
@@ -80,7 +82,6 @@ function makeDeduplicatingHandler(prompter?: GatePrompter): {
             };
           }
         }
-
         return {
           state: "ask",
           toolName: surface,
@@ -98,19 +99,6 @@ function makeDeduplicatingHandler(prompter?: GatePrompter): {
     },
   );
 
-  // The external-directory gates resolve through checkPathPolicy (#418); route
-  // it through the same configured checkPermission so session-approval dedup
-  // applies to the typed path alias.
-  vi.mocked(permissionManager.checkPathPolicy).mockImplementation(
-    (values, agentName, rules, surface = "path") =>
-      permissionManager.checkPermission(
-        surface,
-        { path: values[0] ?? "*" },
-        agentName,
-        rules,
-      ),
-  );
-
   const events = makeEvents();
   const reporter = new GateDecisionReporter(logger, events);
   const resolvedPrompter: GatePrompter = prompter ?? {
@@ -325,13 +313,13 @@ describe("session shutdown clears external-directory approvals", () => {
       makeRealSession();
     const { resolver } = makeRealResolver(permissionManager, sessionRules);
 
-    // external_directory=ask; session-covered paths return allow/session.
-    vi.mocked(permissionManager.checkPermission).mockImplementation(
-      (surface, input, _agentName, rules): PermissionCheckResult => {
+    // Unified check(intent): "ask" for external_directory unless session-covered.
+    vi.mocked(permissionManager.check).mockImplementation(
+      (intent, rules): PermissionCheckResult => {
+        const { surface } = intent;
+        const pathValue =
+          intent.kind === "path-values" ? (intent.values[0] ?? null) : null;
         if (surface === "external_directory") {
-          const record = (input ?? {}) as Record<string, unknown>;
-          const pathValue =
-            typeof record.path === "string" ? record.path : null;
           if (pathValue && rules && rules.length > 0) {
             const match = rules.findLast(
               (r) =>
@@ -364,18 +352,6 @@ describe("session shutdown clears external-directory approvals", () => {
       },
     );
 
-    // The external-directory tool gate resolves through checkPathPolicy (#418);
-    // route it through the same configured checkPermission.
-    vi.mocked(permissionManager.checkPathPolicy).mockImplementation(
-      (values, agentName, rules, surface = "path") =>
-        permissionManager.checkPermission(
-          surface,
-          { path: values[0] ?? "*" },
-          agentName,
-          rules,
-        ),
-    );
-
     const events = makeEvents();
     const reporter = new GateDecisionReporter(logger, events);
     const prompter: GatePrompter = {

package/test/handlers/gates/bash-command-metamorphic.test.ts

@@ -32,13 +32,15 @@ function makeKeyedResolver(
   rules: { match: string; state: PermissionState }[],
 ): ScopedPermissionResolver {
   return {
-    resolve: (_surface: string, input: { command?: string }) => {
-      const command = input.command ?? "";
+    resolve: (intent) => {
+      const command =
+        intent.kind === "tool"
+          ? ((intent.input as { command?: string }).command ?? "")
+          : "";
       const rule = rules.find((r) => command.includes(r.match));
       const state: PermissionState = rule?.state ?? "allow";
       return makeCheckResult({ state, source: "bash", command });
     },
-    resolvePathPolicy: () => makeCheckResult(),
   };
 }
 

package/test/handlers/gates/bash-command.test.ts

@@ -30,17 +30,18 @@ describe("resolveBashCommandCheck", () => {
 
     expect(result.state).toBe("allow");
     expect(resolver.resolve).toHaveBeenCalledTimes(1);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "bash",
-      { command: "npm install pkg" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "bash",
+      input: { command: "npm install pkg" },
+      agentName: undefined,
+    });
   });
 
   it("denies the chain when any sub-command is denied, reporting that command's pattern", () => {
     const resolver = makeResolver();
-    resolver.resolve.mockImplementation((_surface, input) => {
-      const command = (input as { command: string }).command;
+    resolver.resolve.mockImplementation((intent) => {
+      const command = (intent as { input: { command: string } }).input.command;
       return command.startsWith("npm")
         ? bashResult("deny", command, "npm *")
         : bashResult("allow", command, "cd *");
@@ -60,8 +61,8 @@ describe("resolveBashCommandCheck", () => {
 
   it("asks when a sub-command asks and none denies", () => {
     const resolver = makeResolver();
-    resolver.resolve.mockImplementation((_surface, input) => {
-      const command = (input as { command: string }).command;
+    resolver.resolve.mockImplementation((intent) => {
+      const command = (intent as { input: { command: string } }).input.command;
       return command.startsWith("git")
         ? bashResult("ask", command, "git *")
         : bashResult("allow", command, "cd *");
@@ -81,8 +82,8 @@ describe("resolveBashCommandCheck", () => {
 
   it("returns the first allow result when every sub-command is allowed", () => {
     const resolver = makeResolver();
-    resolver.resolve.mockImplementation((_surface, input) => {
-      const command = (input as { command: string }).command;
+    resolver.resolve.mockImplementation((intent) => {
+      const command = (intent as { input: { command: string } }).input.command;
       return bashResult("allow", command, `${command} *`);
     });
 
@@ -109,11 +110,12 @@ describe("resolveBashCommandCheck", () => {
 
     expect(result.state).toBe("allow");
     expect(resolver.resolve).toHaveBeenCalledTimes(1);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "bash",
-      { command: "# just a comment" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "bash",
+      input: { command: "# just a comment" },
+      agentName: undefined,
+    });
   });
 
   it("falls back to the whole command for an empty/whitespace-only command", () => {
@@ -144,17 +146,18 @@ describe("resolveBashCommandCheck", () => {
 
     resolveBashCommandCheck("npm i", [{ text: "npm i" }], "agent-x", resolver);
 
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "bash",
-      { command: "npm i" },
-      "agent-x",
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "bash",
+      input: { command: "npm i" },
+      agentName: "agent-x",
+    });
   });
 
   it("tags the winning result with the offending command's execution context", () => {
     const resolver = makeResolver();
-    resolver.resolve.mockImplementation((_surface, input) => {
-      const command = (input as { command: string }).command;
+    resolver.resolve.mockImplementation((intent) => {
+      const command = (intent as { input: { command: string } }).input.command;
       return command.startsWith("rm")
         ? bashResult("deny", command, "rm *")
         : bashResult("allow", command, "echo *");

package/test/handlers/gates/bash-external-directory.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import type { AccessIntent } from "#src/access-intent/access-intent";
 import { BashProgram } from "#src/access-intent/bash/program";
 import { getNonEmptyString, toRecord } from "#src/common";
 import { describeBashExternalDirectoryGate } from "#src/handlers/gates/bash-external-directory";
@@ -40,6 +41,13 @@ function makeCheckResult(
   };
 }
 
+/** Extract the policy match values a resolve(intent) call carries. */
+function intentValues(intent: AccessIntent): readonly string[] {
+  if (intent.kind === "access-path") return intent.path.matchValues();
+  if (intent.kind === "path-values") return intent.values;
+  return [];
+}
+
 /**
  * Mirror the handler's parse-once derivation: parse the bash command into a
  * shared `BashProgram` and inject it, exactly as `permission-gate-handler.ts`
@@ -76,18 +84,19 @@ describe("describeBashExternalDirectoryGate", () => {
     expect(result).toBeNull();
   });
 
-  it("resolves each external path on the external_directory surface via resolvePathPolicy (#418)", async () => {
+  it("resolves each external path on the external_directory surface via an access-path intent (#418)", async () => {
     const resolver = makeResolver(makeCheckResult("ask"));
     await describeGate(
       makeTcc({ input: { command: "cat /outside/a.ts" } }),
       resolver,
     );
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      ["/outside/a.ts"],
-      undefined,
-      "external_directory",
-    );
-    expect(resolver.resolve).not.toHaveBeenCalled();
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent).toMatchObject({
+      kind: "access-path",
+      surface: "external_directory",
+      agentName: undefined,
+    });
+    expect(intentValues(intent)).toEqual(["/outside/a.ts"]);
   });
 
   it("returns GateBypass when all external paths are session-covered", async () => {
@@ -122,11 +131,10 @@ describe("describeBashExternalDirectoryGate", () => {
     // not just session-level allow. This was the bug: source !== "session"
     // kept config-allowed paths in the uncovered set.
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.length > 0
-          ? makeCheckResult("allow", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).length > 0
+        ? makeCheckResult("allow", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(makeTcc(), resolver);
     expect(result).not.toBeNull();
@@ -138,11 +146,10 @@ describe("describeBashExternalDirectoryGate", () => {
     // silently downgrading a config-level deny to ask. After the fix, the
     // descriptor's preCheck is derived from the actual path check result.
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.length > 0
-          ? makeCheckResult("deny", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).length > 0
+        ? makeCheckResult("deny", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(makeTcc(), resolver);
     expect(isGateDescriptor(result)).toBe(true);
@@ -199,11 +206,10 @@ describe("describeBashExternalDirectoryGate", () => {
   it("config-allowed path is excluded; remaining ask path produces a descriptor", async () => {
     // One path config-allowed, one config-ask → descriptor with only the ask path.
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/a.ts")
-          ? makeCheckResult("allow", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).includes("/outside/a.ts")
+        ? makeCheckResult("allow", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(
       makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
@@ -220,11 +226,10 @@ describe("describeBashExternalDirectoryGate", () => {
   it("config-denied path makes worstCheck deny even when another path is ask", async () => {
     // One path config-denied, one config-ask → descriptor with preCheck.state === "deny".
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/a.ts")
-          ? makeCheckResult("deny", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).includes("/outside/a.ts")
+        ? makeCheckResult("deny", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(
       makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
@@ -241,11 +246,10 @@ describe("describeBashExternalDirectoryGate", () => {
 
   it("only includes uncovered paths when some are session-covered", async () => {
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/a.ts")
-          ? makeCheckResult("allow", { source: "session" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).includes("/outside/a.ts")
+        ? makeCheckResult("allow", { source: "session" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(
       makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),

package/test/handlers/gates/bash-path.test.ts

@@ -228,14 +228,16 @@ describe("describeBashPathGate", () => {
       resolver,
     )) as GateDescriptor;
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      [
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "path-values",
+      surface: "path",
+      values: [
         "/test/project/nested/src/file.txt",
         "nested/src/file.txt",
         "src/file.txt",
       ],
-      undefined,
-    );
+      agentName: undefined,
+    });
     // The raw token drives the prompt, denial context, and session approval.
     expect(result.denialContext).toMatchObject({ pathValue: "src/file.txt" });
     expect(result.decision.value).toBe("src/file.txt");
@@ -253,10 +255,12 @@ describe("describeBashPathGate", () => {
       resolver,
     );
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      ["src/foo.ts"],
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "path-values",
+      surface: "path",
+      values: ["src/foo.ts"],
+      agentName: undefined,
+    });
   });
 
   it("binds a current-directory token's session approval to the cwd subtree", async () => {

package/test/handlers/gates/external-directory-policy.test.ts

@@ -30,11 +30,12 @@ describe("resolveExternalDirectoryPolicy", () => {
 
     const result = resolveExternalDirectoryPolicy(path, resolver, undefined);
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      path.matchValues(),
-      undefined,
-      "external_directory",
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "access-path",
+      surface: "external_directory",
+      path,
+      agentName: undefined,
+    });
     expect(result).toEqual(makeCheckResult("ask"));
   });
 
@@ -44,11 +45,12 @@ describe("resolveExternalDirectoryPolicy", () => {
 
     resolveExternalDirectoryPolicy(path, resolver, "reviewer");
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      path.matchValues(),
-      "reviewer",
-      "external_directory",
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "access-path",
+      surface: "external_directory",
+      path,
+      agentName: "reviewer",
+    });
   });
 });
 
@@ -74,12 +76,17 @@ describe("selectUncoveredExternalPaths", () => {
     const allowed = AccessPath.forExternalDirectory("/outside/ok.ts", cwd);
     const asked = AccessPath.forExternalDirectory("/outside/ask.ts", cwd);
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/ok.ts")
-          ? makeCheckResult("allow")
-          : makeCheckResult("ask"),
-    );
+    resolver.resolve.mockImplementation((intent) => {
+      const values =
+        intent.kind === "access-path"
+          ? intent.path.matchValues()
+          : intent.kind === "path-values"
+            ? intent.values
+            : [];
+      return values.includes("/outside/ok.ts")
+        ? makeCheckResult("allow")
+        : makeCheckResult("ask");
+    });
 
     const { uncovered } = selectUncoveredExternalPaths(
       [allowed, asked],
@@ -94,12 +101,17 @@ describe("selectUncoveredExternalPaths", () => {
     const asked = AccessPath.forExternalDirectory("/outside/ask.ts", cwd);
     const denied = AccessPath.forExternalDirectory("/outside/deny.ts", cwd);
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/deny.ts")
-          ? makeCheckResult("deny")
-          : makeCheckResult("ask"),
-    );
+    resolver.resolve.mockImplementation((intent) => {
+      const values =
+        intent.kind === "access-path"
+          ? intent.path.matchValues()
+          : intent.kind === "path-values"
+            ? intent.values
+            : [];
+      return values.includes("/outside/deny.ts")
+        ? makeCheckResult("deny")
+        : makeCheckResult("ask");
+    });
 
     const { worstCheck } = selectUncoveredExternalPaths(
       [asked, denied],

package/test/handlers/gates/external-directory.test.ts

@@ -144,12 +144,18 @@ describe("describeExternalDirectoryGate", () => {
       undefined,
       resolver,
     );
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      ["/outside/project/file.ts"],
-      undefined,
-      "external_directory",
+    expect(resolver.resolve).toHaveBeenCalledWith(
+      expect.objectContaining({
+        kind: "access-path",
+        surface: "external_directory",
+        agentName: undefined,
+      }),
     );
-    expect(resolver.resolve).not.toHaveBeenCalled();
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent.kind).toBe("access-path");
+    if (intent.kind === "access-path") {
+      expect(intent.path.matchValues()).toEqual(["/outside/project/file.ts"]);
+    }
   });
 
   it("sessionApproval uses deriveApprovalPattern", () => {

package/test/handlers/gates/path.test.ts

@@ -155,11 +155,12 @@ describe("describePathGate", () => {
   it("resolves the path surface with the file path and agent name", () => {
     const resolver = makeResolver(makeCheckResult({ state: "allow" }));
     describePathGate(makeTcc({ agentName: "my-agent" }), resolver);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: ".env" },
-      "my-agent",
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: ".env" },
+      agentName: "my-agent",
+    });
   });
 });
 
@@ -187,11 +188,12 @@ describe("describePathGate — home-relative paths", () => {
       toolName: "read",
       pathValue: "~/.ssh/config",
     });
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: "~/.ssh/config" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: "~/.ssh/config" },
+      agentName: undefined,
+    });
   });
 
   it("passes raw $HOME/... path to resolver and builds descriptor on deny", () => {
@@ -243,11 +245,12 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
       resolver,
     );
     expect(isGateDescriptor(result)).toBe(true);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: ".env" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: ".env" },
+      agentName: undefined,
+    });
   });
 
   it("gates an MCP tool via arguments.path", () => {
@@ -259,11 +262,12 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
       resolver,
     );
     expect(isGateDescriptor(result)).toBe(true);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: ".env" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: ".env" },
+      agentName: undefined,
+    });
   });
 
   it("uses a registered extractor's path for a custom-shaped tool", () => {
@@ -275,11 +279,12 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
       resolver,
       extractorLookup("ffgrep", "target"),
     );
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: "/etc/passwd" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: "/etc/passwd" },
+      agentName: undefined,
+    });
   });
 
   it("returns null for an extension tool without a path", () => {

package/test/handlers/gates/runner.test.ts

@@ -215,7 +215,12 @@ describe("GateRunner — descriptor path", () => {
     const { runner, deps } = makeGateRunner();
     const result = await runner.run(makeDescriptor(), "test-agent", "tc-1");
     expect(result).toEqual({ action: "allow" });
-    expect(deps.resolve).toHaveBeenCalledWith("read", {}, "test-agent");
+    expect(deps.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "read",
+      input: {},
+      agentName: "test-agent",
+    });
     expect(deps.reporter.emitDecision).toHaveBeenCalledWith(
       expect.objectContaining({
         agentName: "test-agent",

package/test/handlers/gates/tool-call-gate-pipeline.test.ts

@@ -198,8 +198,8 @@ describe("ToolCallGatePipeline", () => {
     // block can only come from the path gate seeing the extracted path.
     function pathDenyingResolver() {
       const resolver = makeResolver();
-      resolver.resolve.mockImplementation((surface) =>
-        surface === "path"
+      resolver.resolve.mockImplementation((intent) =>
+        intent.surface === "path"
           ? makeCheckResult({ state: "deny", matchedPattern: "*" })
           : makeCheckResult(),
       );

package/test/handlers/input.test.ts

@@ -67,7 +67,7 @@ describe("handleInput", () => {
   it("does not check permissions for non-skill input", async () => {
     const { handler, permissionManager } = makeHandler();
     await handler.handleInput(makeInputEvent("just a message"), makeCtx());
-    expect(permissionManager.checkPermission).not.toHaveBeenCalled();
+    expect(permissionManager.check).not.toHaveBeenCalled();
   });
 
   it("returns continue when skill is allowed", async () => {