@gotgenes/pi-permission-system 16.2.1 → 17.1.0

package/test/input-normalizer.test.ts

@@ -18,54 +18,64 @@ afterEach(() => {
 describe("normalizeInput — non-MCP surfaces", () => {
   describe("special / path", () => {
     it("uses path from input as the lookup value", () => {
-      const result = normalizeInput("path", { path: ".env" }, []);
+      const result = normalizeInput("path", { path: ".env" }, [], "linux");
       expect(result.surface).toBe("path");
       expect(result.values).toEqual([".env"]);
       expect(result.resultExtras).toEqual({});
     });
 
     it("falls back to '*' when path is missing", () => {
-      const result = normalizeInput("path", {}, []);
+      const result = normalizeInput("path", {}, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when path is not a string", () => {
-      const result = normalizeInput("path", { path: 42 }, []);
+      const result = normalizeInput("path", { path: 42 }, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when path is an empty string", () => {
-      const result = normalizeInput("path", { path: "" }, []);
+      const result = normalizeInput("path", { path: "" }, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when path is whitespace-only", () => {
-      const result = normalizeInput("path", { path: "   " }, []);
+      const result = normalizeInput("path", { path: "   " }, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("handles null input", () => {
-      const result = normalizeInput("path", null, []);
+      const result = normalizeInput("path", null, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("expands ~/... path value to absolute home path", () => {
-      const result = normalizeInput("path", { path: "~/.ssh/config" }, []);
+      const result = normalizeInput(
+        "path",
+        { path: "~/.ssh/config" },
+        [],
+        "linux",
+      );
       expect(result.values).toEqual([join("/mock/home", ".ssh/config")]);
     });
 
     it("expands $HOME/... path value to absolute home path", () => {
-      const result = normalizeInput("path", { path: "$HOME/.ssh/config" }, []);
+      const result = normalizeInput(
+        "path",
+        { path: "$HOME/.ssh/config" },
+        [],
+        "linux",
+      );
       expect(result.values).toEqual([join("/mock/home", ".ssh/config")]);
     });
 
     it("does not expand non-home values", () => {
-      const result = normalizeInput("path", { path: ".env" }, []);
+      const result = normalizeInput("path", { path: ".env" }, [], "linux");
       expect(result.values).toEqual([".env"]);
     });
 
     it("does not expand the '*' fallback", () => {
-      const result = normalizeInput("path", {}, []);
+      const result = normalizeInput("path", {}, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
@@ -74,6 +84,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "path",
         { path: "src/App.jsx" },
         [],
+        "linux",
         "/workspace/project",
       );
       expect(result.values).toEqual([
@@ -87,6 +98,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "path",
         { path: "src/App.jsx", pathPolicyValues: ["/etc/shadow"] },
         [],
+        "linux",
         "/workspace/project",
       );
       expect(result.values).toEqual([
@@ -102,6 +114,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "external_directory",
         { path: "/other/project" },
         [],
+        "linux",
       );
       expect(result.surface).toBe("external_directory");
       expect(result.values).toEqual(["/other/project"]);
@@ -109,22 +122,32 @@ describe("normalizeInput — non-MCP surfaces", () => {
     });
 
     it("falls back to '*' when path is missing", () => {
-      const result = normalizeInput("external_directory", {}, []);
+      const result = normalizeInput("external_directory", {}, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when path is not a string", () => {
-      const result = normalizeInput("external_directory", { path: 42 }, []);
+      const result = normalizeInput(
+        "external_directory",
+        { path: 42 },
+        [],
+        "linux",
+      );
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when path is an empty string", () => {
-      const result = normalizeInput("external_directory", { path: "" }, []);
+      const result = normalizeInput(
+        "external_directory",
+        { path: "" },
+        [],
+        "linux",
+      );
       expect(result.values).toEqual(["*"]);
     });
 
     it("handles null input", () => {
-      const result = normalizeInput("external_directory", null, []);
+      const result = normalizeInput("external_directory", null, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
@@ -133,6 +156,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "external_directory",
         { path: "~/dev/project" },
         [],
+        "linux",
       );
       expect(result.values).toEqual([join("/mock/home", "dev/project")]);
     });
@@ -142,6 +166,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "external_directory",
         { path: "$HOME/dev/project" },
         [],
+        "linux",
       );
       expect(result.values).toEqual([join("/mock/home", "dev/project")]);
     });
@@ -151,6 +176,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "external_directory",
         { path: "src/App.jsx" },
         [],
+        "linux",
         "/workspace/project",
       );
       expect(result.values).toEqual([
@@ -162,53 +188,63 @@ describe("normalizeInput — non-MCP surfaces", () => {
 
   describe("skill", () => {
     it("uses skill name from input.name", () => {
-      const result = normalizeInput("skill", { name: "librarian" }, []);
+      const result = normalizeInput(
+        "skill",
+        { name: "librarian" },
+        [],
+        "linux",
+      );
       expect(result.surface).toBe("skill");
       expect(result.values).toEqual(["librarian"]);
       expect(result.resultExtras).toEqual({});
     });
 
     it("falls back to '*' when name is missing", () => {
-      const result = normalizeInput("skill", {}, []);
+      const result = normalizeInput("skill", {}, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when name is not a string", () => {
-      const result = normalizeInput("skill", { name: 99 }, []);
+      const result = normalizeInput("skill", { name: 99 }, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
   });
 
   describe("bash", () => {
     it("uses command from input.command", () => {
-      const result = normalizeInput("bash", { command: "git status" }, []);
+      const result = normalizeInput(
+        "bash",
+        { command: "git status" },
+        [],
+        "linux",
+      );
       expect(result.surface).toBe("bash");
       expect(result.values).toEqual(["git status"]);
       expect(result.resultExtras).toEqual({ command: "git status" });
     });
 
     it("uses empty string when command is missing", () => {
-      const result = normalizeInput("bash", {}, []);
+      const result = normalizeInput("bash", {}, [], "linux");
       expect(result.values).toEqual([""]);
       expect(result.resultExtras).toEqual({ command: "" });
     });
 
     it("uses empty string when command is not a string", () => {
-      const result = normalizeInput("bash", { command: 42 }, []);
+      const result = normalizeInput("bash", { command: 42 }, [], "linux");
       expect(result.values).toEqual([""]);
       expect(result.resultExtras).toEqual({ command: "" });
     });
 
     it("strips leading comment lines from values but keeps original in resultExtras", () => {
       const cmd = "# Check debug logs\nfind /home -path '*debug*' -type f";
-      const result = normalizeInput("bash", { command: cmd }, []);
+      const result = normalizeInput("bash", { command: cmd }, [], "linux");
       expect(result.values).toEqual(["find /home -path '*debug*' -type f"]);
       expect(result.resultExtras).toEqual({ command: cmd });
     });
 
     it("strips multiple comment lines", () => {
       const cmd = "# Step 1\n# Step 2\ngit status --short";
-      const result = normalizeInput("bash", { command: cmd }, []);
+      const result = normalizeInput("bash", { command: cmd }, [], "linux");
       expect(result.values).toEqual(["git status --short"]);
     });
 
@@ -217,13 +253,14 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "bash",
         { command: "grep -rn foo src/" },
         [],
+        "linux",
       );
       expect(result.values).toEqual(["grep -rn foo src/"]);
     });
 
     it("falls back to original when all lines are comments", () => {
       const cmd = "# just a comment";
-      const result = normalizeInput("bash", { command: cmd }, []);
+      const result = normalizeInput("bash", { command: cmd }, [], "linux");
       expect(result.values).toEqual(["# just a comment"]);
     });
   });
@@ -235,6 +272,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
           tool,
           { path: "/project/src/main.ts" },
           [],
+          "linux",
         );
         expect(result.surface).toBe(tool);
         expect(result.values).toEqual(["/project/src/main.ts"]);
@@ -244,33 +282,43 @@ describe("normalizeInput — non-MCP surfaces", () => {
 
     it("falls back to '*' when input.path is missing", () => {
       for (const tool of ["read", "write", "edit", "grep", "find", "ls"]) {
-        const result = normalizeInput(tool, {}, []);
+        const result = normalizeInput(tool, {}, [], "linux");
         expect(result.values).toEqual(["*"]);
       }
     });
 
     it("falls back to '*' when input.path is empty string", () => {
-      const result = normalizeInput("read", { path: "" }, []);
+      const result = normalizeInput("read", { path: "" }, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when input.path is not a string", () => {
-      const result = normalizeInput("write", { path: 42 }, []);
+      const result = normalizeInput("write", { path: 42 }, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("falls back to '*' when input is null", () => {
-      const result = normalizeInput("edit", null, []);
+      const result = normalizeInput("edit", null, [], "linux");
       expect(result.values).toEqual(["*"]);
     });
 
     it("expands ~/... path value to absolute home path", () => {
-      const result = normalizeInput("read", { path: "~/.ssh/config" }, []);
+      const result = normalizeInput(
+        "read",
+        { path: "~/.ssh/config" },
+        [],
+        "linux",
+      );
       expect(result.values).toEqual([join("/mock/home", ".ssh/config")]);
     });
 
     it("expands $HOME/... path value to absolute home path", () => {
-      const result = normalizeInput("write", { path: "$HOME/.ssh/config" }, []);
+      const result = normalizeInput(
+        "write",
+        { path: "$HOME/.ssh/config" },
+        [],
+        "linux",
+      );
       expect(result.values).toEqual([join("/mock/home", ".ssh/config")]);
     });
 
@@ -279,6 +327,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "read",
         { path: "src/App.jsx" },
         [],
+        "linux",
         "/workspace/project",
       );
       expect(result.values).toEqual([
@@ -290,7 +339,12 @@ describe("normalizeInput — non-MCP surfaces", () => {
 
   describe("extension tools (non-path-bearing)", () => {
     it("uses '*' as the lookup value for extension tools", () => {
-      const result = normalizeInput("my_extension_tool", { some: "input" }, []);
+      const result = normalizeInput(
+        "my_extension_tool",
+        { some: "input" },
+        [],
+        "linux",
+      );
       expect(result.surface).toBe("my_extension_tool");
       expect(result.values).toEqual(["*"]);
       expect(result.resultExtras).toEqual({});
@@ -301,6 +355,7 @@ describe("normalizeInput — non-MCP surfaces", () => {
         "my_extension_tool",
         { path: "/some/path" },
         [],
+        "linux",
       );
       expect(result.values).toEqual(["*"]);
     });
@@ -309,17 +364,17 @@ describe("normalizeInput — non-MCP surfaces", () => {
 
 describe("normalizeInput — MCP surface", () => {
   it("surface is 'mcp'", () => {
-    const result = normalizeInput("mcp", { tool: "exa:search" }, []);
+    const result = normalizeInput("mcp", { tool: "exa:search" }, [], "linux");
     expect(result.surface).toBe("mcp");
   });
 
   it("values end with the catch-all 'mcp' target", () => {
-    const result = normalizeInput("mcp", { tool: "exa:search" }, []);
+    const result = normalizeInput("mcp", { tool: "exa:search" }, [], "linux");
     expect(result.values.at(-1)).toBe("mcp");
   });
 
   it("values include specific targets before the catch-all for a qualified tool call", () => {
-    const result = normalizeInput("mcp", { tool: "exa:search" }, []);
+    const result = normalizeInput("mcp", { tool: "exa:search" }, [], "linux");
     expect(result.values).toContain("exa_search");
     expect(result.values).toContain("exa:search");
     expect(result.values).toContain("exa");
@@ -332,34 +387,44 @@ describe("normalizeInput — MCP surface", () => {
     const rawTargets = createMcpPermissionTargets({ tool: "exa:search" }, [
       "exa",
     ]);
-    const result = normalizeInput("mcp", { tool: "exa:search" }, ["exa"]);
+    const result = normalizeInput(
+      "mcp",
+      { tool: "exa:search" },
+      ["exa"],
+      "linux",
+    );
     expect(result.values).toEqual([...rawTargets, "mcp"]);
   });
 
   it("resultExtras.target is the first specific target (most-specific)", () => {
-    const result = normalizeInput("mcp", { tool: "exa:search" }, []);
+    const result = normalizeInput("mcp", { tool: "exa:search" }, [], "linux");
     expect(result.resultExtras.target).toBe(result.values[0]);
   });
 
   it("resultExtras.target is 'mcp' when no specific targets are derived", () => {
     // Empty input → only mcp_status then mcp appended
-    const result = normalizeInput("mcp", {}, []);
+    const result = normalizeInput("mcp", {}, [], "linux");
     expect(result.resultExtras.target).toBe("mcp_status");
   });
 
   it("values contain no duplicates", () => {
-    const result = normalizeInput("mcp", { tool: "exa:search" }, ["exa"]);
+    const result = normalizeInput(
+      "mcp",
+      { tool: "exa:search" },
+      ["exa"],
+      "linux",
+    );
     const unique = [...new Set(result.values)];
     expect(result.values).toEqual(unique);
   });
 
   it("produces mcp_status + mcp for status input", () => {
-    const result = normalizeInput("mcp", {}, []);
+    const result = normalizeInput("mcp", {}, [], "linux");
     expect(result.values).toEqual(["mcp_status", "mcp"]);
   });
 
   it("produces connect targets + mcp for connect input", () => {
-    const result = normalizeInput("mcp", { connect: "exa" }, []);
+    const result = normalizeInput("mcp", { connect: "exa" }, [], "linux");
     expect(result.values).toContain("mcp_connect_exa");
     expect(result.values).toContain("mcp_connect");
     expect(result.values.at(-1)).toBe("mcp");

package/test/path-normalizer.test.ts

@@ -0,0 +1,123 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+// Mock node:os so tilde-expansion is deterministic across platforms.
+vi.mock("node:os", () => {
+  const homedir = vi.fn(() => "/mock/home");
+  return {
+    homedir,
+    default: { homedir },
+  };
+});
+
+// Mock node:fs so realpathSync (used by canonicalizePath) is controllable.
+// Default implementation is identity — lexical assertions are unaffected.
+const realpathSync = vi.hoisted(() =>
+  vi.fn<(path: string) => string>((p) => p),
+);
+vi.mock("node:fs", () => ({
+  realpathSync,
+  default: { realpathSync },
+}));
+
+import { PathNormalizer } from "#src/path-normalizer";
+
+describe("PathNormalizer", () => {
+  beforeEach(() => {
+    realpathSync.mockReset();
+    realpathSync.mockImplementation((p: string) => p);
+  });
+
+  describe("posix flavor", () => {
+    const normalizer = new PathNormalizer("linux", "/projects/my-app");
+
+    test("forPath builds an AccessPath resolved against the baked cwd", () => {
+      const ap = normalizer.forPath("src/foo.ts");
+      expect(ap.value()).toBe("/projects/my-app/src/foo.ts");
+      expect(ap.matchValues()).toEqual([
+        "/projects/my-app/src/foo.ts",
+        "src/foo.ts",
+      ]);
+    });
+
+    test("forPath honors an explicit resolveBase", () => {
+      const ap = normalizer.forPath("foo.ts", {
+        resolveBase: "/projects/my-app/sub",
+      });
+      expect(ap.value()).toBe("/projects/my-app/sub/foo.ts");
+    });
+
+    test("forLiteral builds a literal-only AccessPath", () => {
+      const ap = normalizer.forLiteral("foo.ts");
+      expect(ap.matchValues()).toEqual(["foo.ts"]);
+      expect(ap.boundaryValue()).toBe("");
+    });
+
+    test("isAbsolute uses posix rules", () => {
+      expect(normalizer.isAbsolute("/etc/hosts")).toBe(true);
+      expect(normalizer.isAbsolute("rel/path")).toBe(false);
+    });
+
+    test("resolveBase resolves an offset against the baked cwd", () => {
+      expect(normalizer.resolveBase("sub")).toBe("/projects/my-app/sub");
+      expect(normalizer.resolveBase("/abs")).toBe("/abs");
+    });
+
+    test("joinBase joins an offset with a relative target", () => {
+      expect(normalizer.joinBase("sub", "nested")).toBe("sub/nested");
+    });
+
+    test("isWithinDirectory decides containment", () => {
+      expect(normalizer.isWithinDirectory("/a/b/c", "/a/b")).toBe(true);
+      expect(normalizer.isWithinDirectory("/a/x", "/a/b")).toBe(false);
+    });
+
+    test("isOutsideWorkingDirectory tests against the baked cwd", () => {
+      expect(normalizer.isOutsideWorkingDirectory("/projects/my-app/src")).toBe(
+        false,
+      );
+      expect(normalizer.isOutsideWorkingDirectory("/etc/hosts")).toBe(true);
+    });
+  });
+
+  describe("win32 flavor", () => {
+    const normalizer = new PathNormalizer("win32", "C:\\Projects\\App");
+
+    test("forPath builds a case-folded AccessPath with win32 rules", () => {
+      const ap = normalizer.forPath("src\\foo.ts");
+      expect(ap.value()).toBe("c:\\projects\\app\\src\\foo.ts");
+      expect(ap.matchValues()).toEqual([
+        "c:\\projects\\app\\src\\foo.ts",
+        "src\\foo.ts",
+      ]);
+    });
+
+    test("isAbsolute uses win32 rules", () => {
+      expect(normalizer.isAbsolute("C:\\Users\\foo")).toBe(true);
+      expect(normalizer.isAbsolute("rel\\path")).toBe(false);
+    });
+
+    test("resolveBase resolves an offset against the baked cwd", () => {
+      expect(normalizer.resolveBase("sub")).toBe("C:\\Projects\\App\\sub");
+    });
+
+    test("joinBase joins an offset with a relative target", () => {
+      expect(normalizer.joinBase("sub", "nested")).toBe("sub\\nested");
+    });
+
+    test("isWithinDirectory folds case", () => {
+      expect(
+        normalizer.isWithinDirectory(
+          "c:\\users\\foo\\dir\\sub",
+          "C:\\Users\\Foo\\dir",
+        ),
+      ).toBe(true);
+    });
+
+    test("isOutsideWorkingDirectory case-folds against the baked cwd", () => {
+      expect(
+        normalizer.isOutsideWorkingDirectory("c:\\projects\\app\\src"),
+      ).toBe(false);
+      expect(normalizer.isOutsideWorkingDirectory("C:\\Other\\dir")).toBe(true);
+    });
+  });
+});