@gotgenes/pi-permission-system 17.1.0 → 18.0.0

package/test/handlers/gates/external-directory.test.ts

@@ -43,7 +43,6 @@ function gateUnderTest(
     infraDirs,
     resolver,
     new PathNormalizer(process.platform, tcc.cwd),
-    "linux",
     extractors,
   );
 }

package/test/handlers/gates/skill-read.test.ts

@@ -1,8 +1,12 @@
 import { describe, expect, it, vi } from "vitest";
 import { describeSkillReadGate } from "#src/handlers/gates/skill-read";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 
+// All test tccs use cwd "/test/project"; one normalizer serves every call.
+const normalizer = new PathNormalizer("linux", "/test/project");
+
 // ── SDK stubs ──────────────────────────────────────────────────────────────
 vi.mock("@earendil-works/pi-coding-agent", async (importOriginal) => {
   const original =
@@ -43,21 +47,21 @@ describe("describeSkillReadGate", () => {
   it("returns null when tool is not read", () => {
     const result = describeSkillReadGate(
       makeTcc({ toolName: "write" }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry()],
     );
     expect(result).toBeNull();
   });
 
   it("returns null when no active skill entries", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => []);
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => []);
     expect(result).toBeNull();
   });
 
   it("returns null when read path does not match any skill", () => {
     const result = describeSkillReadGate(
       makeTcc({ input: { path: "/test/project/src/index.ts" } }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry()],
     );
     expect(result).toBeNull();
@@ -66,14 +70,14 @@ describe("describeSkillReadGate", () => {
   it("returns null when input has no path", () => {
     const result = describeSkillReadGate(
       makeTcc({ input: {} }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry()],
     );
     expect(result).toBeNull();
   });
 
   it("returns GateDescriptor with preResolved.state matching skill entry state (ask)", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ state: "ask" }),
     ]);
     expect(result).not.toBeNull();
@@ -82,7 +86,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("returns GateDescriptor with preResolved.state matching skill entry state (allow)", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ state: "allow" }),
     ]);
     expect(result).not.toBeNull();
@@ -91,7 +95,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("returns GateDescriptor with preResolved.state matching skill entry state (deny)", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ state: "deny" }),
     ]);
     expect(result).not.toBeNull();
@@ -100,7 +104,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("decision surface is 'skill' and decision value is the skill name", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ name: "my-skill" }),
     ])!;
     expect(result.decision.surface).toBe("skill");
@@ -108,7 +112,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("denialContext contains the skill name and read path", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ name: "librarian" }),
     ])!;
     expect(result.denialContext).toEqual({
@@ -122,7 +126,7 @@ describe("describeSkillReadGate", () => {
   it("promptDetails includes skill_read source and skillName", () => {
     const result = describeSkillReadGate(
       makeTcc({ agentName: "test-agent", toolCallId: "tc-42" }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry({ name: "my-skill" })],
     )!;
     expect(result.promptDetails).toMatchObject({
@@ -138,7 +142,7 @@ describe("describeSkillReadGate", () => {
   it("logContext includes skill_read source and skillName", () => {
     const result = describeSkillReadGate(
       makeTcc({ agentName: "agent-1" }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry({ name: "librarian" })],
     )!;
     expect(result.logContext).toMatchObject({
@@ -149,7 +153,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("surface is 'skill' on the descriptor", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry(),
     ])!;
     expect(result.surface).toBe("skill");

package/test/handlers/gates/tool-call-gate-pipeline.test.ts

@@ -22,6 +22,16 @@ vi.mock("#src/access-intent/bash/program", () => ({
   BashProgram: { parse: mockBashProgramParse },
 }));
 
+// Mock node:fs so realpathSync (used by canonicalizePath) is controllable for
+// the per-tool symlink-resolution test. Default implementation is identity.
+const realpathSync = vi.hoisted(() =>
+  vi.fn<(path: string) => string>((p) => p),
+);
+vi.mock("node:fs", () => ({
+  realpathSync,
+  default: { realpathSync },
+}));
+
 function makeMockBashProgram() {
   return {
     commands: vi.fn<() => []>(() => []),
@@ -36,6 +46,8 @@ describe("ToolCallGatePipeline", () => {
   beforeEach(() => {
     mockBashProgramParse.mockReset();
     mockBashProgramParse.mockResolvedValue(makeMockBashProgram());
+    realpathSync.mockReset();
+    realpathSync.mockImplementation((p: string) => p);
   });
 
   // ── non-bash tools ───────────────────────────────────────────────────────
@@ -254,4 +266,65 @@ describe("ToolCallGatePipeline", () => {
       expect(result).toEqual({ action: "allow" });
     });
   });
+
+  // ── per-tool path-bearing gate (#502) ────────────────────────────────────
+
+  describe("evaluate — per-tool path-bearing gate (#502)", () => {
+    it("emits an access-path intent on the tool-name surface for a path-bearing tool", async () => {
+      const resolver = makeResolver(makeCheckResult());
+      const inputs = makeGateInputs();
+      const { runner } = makeGateRunner();
+      const pipeline = new ToolCallGatePipeline(resolver, inputs);
+
+      await pipeline.evaluate(
+        makeTcc({ toolName: "read", input: { path: "/test/cwd/foo.ts" } }),
+        runner,
+      );
+
+      const perTool = resolver.resolve.mock.calls.find(
+        ([intent]) => intent.surface === "read",
+      );
+      expect(perTool?.[0].kind).toBe("access-path");
+    });
+
+    it("keeps a path-bearing tool with no path on the tool intent", async () => {
+      const resolver = makeResolver(makeCheckResult());
+      const inputs = makeGateInputs();
+      const { runner } = makeGateRunner();
+      const pipeline = new ToolCallGatePipeline(resolver, inputs);
+
+      await pipeline.evaluate(makeTcc({ toolName: "read", input: {} }), runner);
+
+      const perTool = resolver.resolve.mock.calls.find(
+        ([intent]) => intent.surface === "read",
+      );
+      expect(perTool?.[0].kind).toBe("tool");
+    });
+
+    it("blocks when a per-tool rule matches the symlink-resolved form", async () => {
+      // /test/cwd/foo.env is a symlink to /vault/foo.env; the per-tool rule is
+      // keyed on the resolved target, which is only reachable via matchValues().
+      realpathSync.mockImplementation((p: string) =>
+        p === "/test/cwd/foo.env" ? "/vault/foo.env" : p,
+      );
+      const resolver = makeResolver();
+      resolver.resolve.mockImplementation((intent) =>
+        intent.kind === "access-path" &&
+        intent.surface === "read" &&
+        intent.path.matchValues().includes("/vault/foo.env")
+          ? makeCheckResult({ state: "deny", matchedPattern: "*.env" })
+          : makeCheckResult(),
+      );
+      const inputs = makeGateInputs();
+      const { runner } = makeGateRunner();
+      const pipeline = new ToolCallGatePipeline(resolver, inputs);
+
+      const result = await pipeline.evaluate(
+        makeTcc({ toolName: "read", input: { path: "/test/cwd/foo.env" } }),
+        runner,
+      );
+
+      expect(result).toMatchObject({ action: "block" });
+    });
+  });
 });

package/test/handlers/gates/tool.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import { describeToolGate } from "#src/handlers/gates/tool";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import {
   TOOL_INPUT_LOG_PREVIEW_MAX_LENGTH,
   TOOL_INPUT_PREVIEW_MAX_LENGTH,
@@ -45,6 +46,10 @@ function makeCheckResult(
   };
 }
 
+// The per-tool gate now receives the AccessPath the pipeline builds, bound to
+// the makeTcc default cwd; approval values derive from `accessPath.value()`.
+const normalizer = new PathNormalizer("linux", "/test/project");
+
 // ── tests ──────────────────────────────────────────────────────────────────
 
 describe("describeToolGate", () => {
@@ -53,7 +58,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "read" }),
       makeCheckResult("ask"),
       makeFormatter(),
-      "linux",
     );
     expect(desc.surface).toBe("read");
     expect(desc.decision.surface).toBe("read");
@@ -64,7 +68,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "write" }),
       makeCheckResult("ask"),
       makeFormatter(),
-      "linux",
     );
     expect(desc.decision.value).toBe("write");
   });
@@ -78,7 +81,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "git status" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.surface).toBe("bash");
     expect(desc.decision.surface).toBe("bash");
@@ -94,7 +96,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "mcp", input: { tool: "server:tool" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.surface).toBe("mcp");
     expect(desc.decision.surface).toBe("mcp");
@@ -103,7 +104,7 @@ describe("describeToolGate", () => {
 
   it("populates denialContext with kind 'tool' and check result", () => {
     const check = makeCheckResult("deny", { toolName: "read" });
-    const desc = describeToolGate(makeTcc(), check, makeFormatter(), "linux");
+    const desc = describeToolGate(makeTcc(), check, makeFormatter());
     expect(desc.denialContext).toEqual({
       kind: "tool",
       check,
@@ -118,7 +119,6 @@ describe("describeToolGate", () => {
       makeTcc({ agentName: "my-agent" }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.denialContext.agentName).toBe("my-agent");
   });
@@ -129,7 +129,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "ls" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.denialContext).toMatchObject({
       kind: "tool",
@@ -146,7 +145,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "git status" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.sessionApproval).toBeDefined();
     expect(desc.sessionApproval?.surface).toBe("bash");
@@ -163,16 +161,17 @@ describe("describeToolGate", () => {
       }),
       check,
       makeFormatter(),
-      "linux",
+      normalizer.forPath("index.html"),
     );
     expect(desc.sessionApproval?.surface).toBe("edit");
     expect(desc.sessionApproval?.representativePattern).toBe("/test/project/*");
   });
 
   it("resolves a sub-directory file's session approval to an absolute pattern", () => {
-    // Resolve-at-gate canonicalizes every path (not just the cwd-root case),
-    // so sub-directory approvals are absolute too — the deliberate tradeoff
-    // that keeps the pattern aligned with the policy values it is matched against.
+    // The approval value derives from the AccessPath's lexical absolute form
+    // (`value()`), so sub-directory approvals are absolute too — the deliberate
+    // tradeoff that keeps the pattern aligned with the policy values it is
+    // matched against.
     const check = makeCheckResult("ask", { toolName: "edit" });
     const desc = describeToolGate(
       makeTcc({
@@ -182,20 +181,31 @@ describe("describeToolGate", () => {
       }),
       check,
       makeFormatter(),
-      "linux",
+      normalizer.forPath("src/foo.ts"),
     );
     expect(desc.sessionApproval?.representativePattern).toBe(
       "/test/project/src/*",
     );
   });
 
+  it("falls back to a wildcard session approval when no AccessPath is given", () => {
+    // A path-bearing tool with no `input.path` keeps the `tool` intent and gets
+    // no AccessPath, so the suggestion collapses to the catch-all.
+    const desc = describeToolGate(
+      makeTcc({ toolName: "read", input: {} }),
+      makeCheckResult("ask"),
+      makeFormatter(),
+    );
+    expect(desc.sessionApproval?.surface).toBe("read");
+    expect(desc.sessionApproval?.representativePattern).toBe("*");
+  });
+
   it("populates promptDetails with correct fields", () => {
     const check = makeCheckResult("ask");
     const desc = describeToolGate(
       makeTcc({ toolName: "read", agentName: "my-agent", toolCallId: "tc-42" }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.promptDetails).toMatchObject({
       source: "tool_call",
@@ -213,7 +223,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "ls" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.logContext).toMatchObject({
       source: "tool_call",
@@ -227,7 +236,7 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "edit", input: { path: "/a.ts" } }),
       makeCheckResult("ask", { toolName: "edit" }),
       makeFormatter(),
-      "linux",
+      normalizer.forPath("/a.ts"),
     );
     expect(desc.surface).toBe("edit");
     expect(desc.input).toEqual({ path: "/a.ts" });

package/test/helpers/gate-fixtures.ts

@@ -255,7 +255,6 @@ export function makeGateInputs(
     getInfrastructureReadDirs?: () => string[];
     getToolPreviewLimits?: () => ToolPreviewFormatterOptions;
     getPathNormalizer?: () => PathNormalizer;
-    getPlatform?: () => NodeJS.Platform;
   } = {},
 ): ToolCallGateInputs {
   return {
@@ -276,8 +275,6 @@ export function makeGateInputs(
       vi.fn<() => PathNormalizer>(
         () => new PathNormalizer(process.platform, "/test/cwd"),
       ),
-    getPlatform:
-      overrides.getPlatform ?? vi.fn<() => NodeJS.Platform>(() => "linux"),
   };
 }