@gotgenes/pi-permission-system 16.1.0 → 16.2.1

package/test/handlers/gates/bash-external-directory.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
+import type { AccessIntent } from "#src/access-intent/access-intent";
 import { BashProgram } from "#src/access-intent/bash/program";
-import { getNonEmptyString, toRecord } from "#src/common";
 import { describeBashExternalDirectoryGate } from "#src/handlers/gates/bash-external-directory";
 import type {
   GateBypass,
@@ -11,6 +11,7 @@ import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
 import type { ToolCallContext } from "#src/handlers/gates/types";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { PermissionCheckResult } from "#src/types";
+import { getNonEmptyString, toRecord } from "#src/value-guards";
 
 import { makeResolver } from "#test/helpers/gate-fixtures";
 
@@ -40,6 +41,13 @@ function makeCheckResult(
   };
 }
 
+/** Extract the policy match values a resolve(intent) call carries. */
+function intentValues(intent: AccessIntent): readonly string[] {
+  if (intent.kind === "access-path") return intent.path.matchValues();
+  if (intent.kind === "path-values") return intent.values;
+  return [];
+}
+
 /**
  * Mirror the handler's parse-once derivation: parse the bash command into a
  * shared `BashProgram` and inject it, exactly as `permission-gate-handler.ts`
@@ -76,18 +84,19 @@ describe("describeBashExternalDirectoryGate", () => {
     expect(result).toBeNull();
   });
 
-  it("resolves each external path on the external_directory surface via resolvePathPolicy (#418)", async () => {
+  it("resolves each external path on the external_directory surface via an access-path intent (#418)", async () => {
     const resolver = makeResolver(makeCheckResult("ask"));
     await describeGate(
       makeTcc({ input: { command: "cat /outside/a.ts" } }),
       resolver,
     );
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      ["/outside/a.ts"],
-      undefined,
-      "external_directory",
-    );
-    expect(resolver.resolve).not.toHaveBeenCalled();
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent).toMatchObject({
+      kind: "access-path",
+      surface: "external_directory",
+      agentName: undefined,
+    });
+    expect(intentValues(intent)).toEqual(["/outside/a.ts"]);
   });
 
   it("returns GateBypass when all external paths are session-covered", async () => {
@@ -122,11 +131,10 @@ describe("describeBashExternalDirectoryGate", () => {
     // not just session-level allow. This was the bug: source !== "session"
     // kept config-allowed paths in the uncovered set.
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.length > 0
-          ? makeCheckResult("allow", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).length > 0
+        ? makeCheckResult("allow", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(makeTcc(), resolver);
     expect(result).not.toBeNull();
@@ -138,11 +146,10 @@ describe("describeBashExternalDirectoryGate", () => {
     // silently downgrading a config-level deny to ask. After the fix, the
     // descriptor's preCheck is derived from the actual path check result.
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.length > 0
-          ? makeCheckResult("deny", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).length > 0
+        ? makeCheckResult("deny", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(makeTcc(), resolver);
     expect(isGateDescriptor(result)).toBe(true);
@@ -199,11 +206,10 @@ describe("describeBashExternalDirectoryGate", () => {
   it("config-allowed path is excluded; remaining ask path produces a descriptor", async () => {
     // One path config-allowed, one config-ask → descriptor with only the ask path.
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/a.ts")
-          ? makeCheckResult("allow", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).includes("/outside/a.ts")
+        ? makeCheckResult("allow", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(
       makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
@@ -220,11 +226,10 @@ describe("describeBashExternalDirectoryGate", () => {
   it("config-denied path makes worstCheck deny even when another path is ask", async () => {
     // One path config-denied, one config-ask → descriptor with preCheck.state === "deny".
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/a.ts")
-          ? makeCheckResult("deny", { source: "special" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).includes("/outside/a.ts")
+        ? makeCheckResult("deny", { source: "special" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(
       makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
@@ -241,11 +246,10 @@ describe("describeBashExternalDirectoryGate", () => {
 
   it("only includes uncovered paths when some are session-covered", async () => {
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/a.ts")
-          ? makeCheckResult("allow", { source: "session" })
-          : makeCheckResult("ask"),
+    resolver.resolve.mockImplementation((intent) =>
+      intentValues(intent).includes("/outside/a.ts")
+        ? makeCheckResult("allow", { source: "session" })
+        : makeCheckResult("ask"),
     );
     const result = await describeGate(
       makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),

package/test/handlers/gates/bash-path.test.ts

@@ -10,7 +10,6 @@ vi.mock("node:os", () => {
 });
 
 import { BashProgram } from "#src/access-intent/bash/program";
-import { getNonEmptyString, toRecord } from "#src/common";
 import { describeBashPathGate } from "#src/handlers/gates/bash-path";
 import type {
   GateBypass,
@@ -20,6 +19,7 @@ import type {
 import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
 import type { ToolCallContext } from "#src/handlers/gates/types";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import { getNonEmptyString, toRecord } from "#src/value-guards";
 
 import {
   makeGateCheckResult as makeCheckResult,
@@ -228,14 +228,16 @@ describe("describeBashPathGate", () => {
       resolver,
     )) as GateDescriptor;
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      [
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "path-values",
+      surface: "path",
+      values: [
         "/test/project/nested/src/file.txt",
         "nested/src/file.txt",
         "src/file.txt",
       ],
-      undefined,
-    );
+      agentName: undefined,
+    });
     // The raw token drives the prompt, denial context, and session approval.
     expect(result.denialContext).toMatchObject({ pathValue: "src/file.txt" });
     expect(result.decision.value).toBe("src/file.txt");
@@ -253,10 +255,12 @@ describe("describeBashPathGate", () => {
       resolver,
     );
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      ["src/foo.ts"],
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "path-values",
+      surface: "path",
+      values: ["src/foo.ts"],
+      agentName: undefined,
+    });
   });
 
   it("binds a current-directory token's session approval to the cwd subtree", async () => {

package/test/handlers/gates/external-directory-policy.test.ts

@@ -30,11 +30,12 @@ describe("resolveExternalDirectoryPolicy", () => {
 
     const result = resolveExternalDirectoryPolicy(path, resolver, undefined);
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      path.matchValues(),
-      undefined,
-      "external_directory",
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "access-path",
+      surface: "external_directory",
+      path,
+      agentName: undefined,
+    });
     expect(result).toEqual(makeCheckResult("ask"));
   });
 
@@ -44,11 +45,12 @@ describe("resolveExternalDirectoryPolicy", () => {
 
     resolveExternalDirectoryPolicy(path, resolver, "reviewer");
 
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      path.matchValues(),
-      "reviewer",
-      "external_directory",
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "access-path",
+      surface: "external_directory",
+      path,
+      agentName: "reviewer",
+    });
   });
 });
 
@@ -74,12 +76,17 @@ describe("selectUncoveredExternalPaths", () => {
     const allowed = AccessPath.forExternalDirectory("/outside/ok.ts", cwd);
     const asked = AccessPath.forExternalDirectory("/outside/ask.ts", cwd);
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/ok.ts")
-          ? makeCheckResult("allow")
-          : makeCheckResult("ask"),
-    );
+    resolver.resolve.mockImplementation((intent) => {
+      const values =
+        intent.kind === "access-path"
+          ? intent.path.matchValues()
+          : intent.kind === "path-values"
+            ? intent.values
+            : [];
+      return values.includes("/outside/ok.ts")
+        ? makeCheckResult("allow")
+        : makeCheckResult("ask");
+    });
 
     const { uncovered } = selectUncoveredExternalPaths(
       [allowed, asked],
@@ -94,12 +101,17 @@ describe("selectUncoveredExternalPaths", () => {
     const asked = AccessPath.forExternalDirectory("/outside/ask.ts", cwd);
     const denied = AccessPath.forExternalDirectory("/outside/deny.ts", cwd);
     const resolver = makeResolver();
-    resolver.resolvePathPolicy.mockImplementation(
-      (values: readonly string[]) =>
-        values.includes("/outside/deny.ts")
-          ? makeCheckResult("deny")
-          : makeCheckResult("ask"),
-    );
+    resolver.resolve.mockImplementation((intent) => {
+      const values =
+        intent.kind === "access-path"
+          ? intent.path.matchValues()
+          : intent.kind === "path-values"
+            ? intent.values
+            : [];
+      return values.includes("/outside/deny.ts")
+        ? makeCheckResult("deny")
+        : makeCheckResult("ask");
+    });
 
     const { worstCheck } = selectUncoveredExternalPaths(
       [asked, denied],

package/test/handlers/gates/external-directory.test.ts

@@ -144,12 +144,18 @@ describe("describeExternalDirectoryGate", () => {
       undefined,
       resolver,
     );
-    expect(resolver.resolvePathPolicy).toHaveBeenCalledWith(
-      ["/outside/project/file.ts"],
-      undefined,
-      "external_directory",
+    expect(resolver.resolve).toHaveBeenCalledWith(
+      expect.objectContaining({
+        kind: "access-path",
+        surface: "external_directory",
+        agentName: undefined,
+      }),
     );
-    expect(resolver.resolve).not.toHaveBeenCalled();
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent.kind).toBe("access-path");
+    if (intent.kind === "access-path") {
+      expect(intent.path.matchValues()).toEqual(["/outside/project/file.ts"]);
+    }
   });
 
   it("sessionApproval uses deriveApprovalPattern", () => {

package/test/handlers/gates/path.test.ts

@@ -155,11 +155,12 @@ describe("describePathGate", () => {
   it("resolves the path surface with the file path and agent name", () => {
     const resolver = makeResolver(makeCheckResult({ state: "allow" }));
     describePathGate(makeTcc({ agentName: "my-agent" }), resolver);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: ".env" },
-      "my-agent",
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: ".env" },
+      agentName: "my-agent",
+    });
   });
 });
 
@@ -187,11 +188,12 @@ describe("describePathGate — home-relative paths", () => {
       toolName: "read",
       pathValue: "~/.ssh/config",
     });
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: "~/.ssh/config" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: "~/.ssh/config" },
+      agentName: undefined,
+    });
   });
 
   it("passes raw $HOME/... path to resolver and builds descriptor on deny", () => {
@@ -243,11 +245,12 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
       resolver,
     );
     expect(isGateDescriptor(result)).toBe(true);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: ".env" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: ".env" },
+      agentName: undefined,
+    });
   });
 
   it("gates an MCP tool via arguments.path", () => {
@@ -259,11 +262,12 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
       resolver,
     );
     expect(isGateDescriptor(result)).toBe(true);
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: ".env" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: ".env" },
+      agentName: undefined,
+    });
   });
 
   it("uses a registered extractor's path for a custom-shaped tool", () => {
@@ -275,11 +279,12 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
       resolver,
       extractorLookup("ffgrep", "target"),
     );
-    expect(resolver.resolve).toHaveBeenCalledWith(
-      "path",
-      { path: "/etc/passwd" },
-      undefined,
-    );
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "path",
+      input: { path: "/etc/passwd" },
+      agentName: undefined,
+    });
   });
 
   it("returns null for an extension tool without a path", () => {

package/test/handlers/gates/runner.test.ts

@@ -215,7 +215,12 @@ describe("GateRunner — descriptor path", () => {
     const { runner, deps } = makeGateRunner();
     const result = await runner.run(makeDescriptor(), "test-agent", "tc-1");
     expect(result).toEqual({ action: "allow" });
-    expect(deps.resolve).toHaveBeenCalledWith("read", {}, "test-agent");
+    expect(deps.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "read",
+      input: {},
+      agentName: "test-agent",
+    });
     expect(deps.reporter.emitDecision).toHaveBeenCalledWith(
       expect.objectContaining({
         agentName: "test-agent",

package/test/handlers/gates/tool-call-gate-pipeline.test.ts

@@ -198,8 +198,8 @@ describe("ToolCallGatePipeline", () => {
     // block can only come from the path gate seeing the extracted path.
     function pathDenyingResolver() {
       const resolver = makeResolver();
-      resolver.resolve.mockImplementation((surface) =>
-        surface === "path"
+      resolver.resolve.mockImplementation((intent) =>
+        intent.surface === "path"
           ? makeCheckResult({ state: "deny", matchedPattern: "*" })
           : makeCheckResult(),
       );

package/test/handlers/input.test.ts

@@ -67,7 +67,7 @@ describe("handleInput", () => {
   it("does not check permissions for non-skill input", async () => {
     const { handler, permissionManager } = makeHandler();
     await handler.handleInput(makeInputEvent("just a message"), makeCtx());
-    expect(permissionManager.checkPermission).not.toHaveBeenCalled();
+    expect(permissionManager.check).not.toHaveBeenCalled();
   });
 
   it("returns continue when skill is allowed", async () => {