@gotgenes/pi-permission-system 17.1.1 → 18.0.0

package/test/composition-root.test.ts

@@ -479,6 +479,28 @@ describe("single source of truth for session state", () => {
   });
 });
 
+describe("service path queries evaluate the supplied path (#503)", () => {
+  // Before #503 the service path query dropped the value (buildInputForSurface
+  // returned {} for the `path` surface), so the query collapsed to ["*"] and a
+  // path-specific rule never fired. The query now builds an AccessPath, so the
+  // supplied path flows through the resolver → manager and matches `path` rules
+  // end-to-end.
+  it("resolves a path-surface query against a deny rule on the supplied path", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "pi-perm-svc-path-cwd-"));
+    const target = join(cwd, "secrets.env");
+    writeGlobalConfig({ permission: { path: { [target]: "deny" } } });
+
+    const pi = makeFakePi({ events: createEventBus() });
+    piPermissionSystemExtension(pi as unknown as ExtensionAPI);
+    await fireSessionStart(pi, makeChildCtx(cwd, "svc-path-session"));
+
+    const result = getPermissionsService()!.checkPermission("path", target);
+    expect(result.state).toBe("deny");
+
+    rmSync(cwd, { recursive: true, force: true });
+  });
+});
+
 describe("multi-instance global service interplay", () => {
   // The fix (#302) scopes the process-global service slot to the publishing
   // instance. The parent publishes at its session_start; an in-process child

package/test/handlers/gates/tool-call-gate-pipeline.test.ts

@@ -22,6 +22,16 @@ vi.mock("#src/access-intent/bash/program", () => ({
   BashProgram: { parse: mockBashProgramParse },
 }));
 
+// Mock node:fs so realpathSync (used by canonicalizePath) is controllable for
+// the per-tool symlink-resolution test. Default implementation is identity.
+const realpathSync = vi.hoisted(() =>
+  vi.fn<(path: string) => string>((p) => p),
+);
+vi.mock("node:fs", () => ({
+  realpathSync,
+  default: { realpathSync },
+}));
+
 function makeMockBashProgram() {
   return {
     commands: vi.fn<() => []>(() => []),
@@ -36,6 +46,8 @@ describe("ToolCallGatePipeline", () => {
   beforeEach(() => {
     mockBashProgramParse.mockReset();
     mockBashProgramParse.mockResolvedValue(makeMockBashProgram());
+    realpathSync.mockReset();
+    realpathSync.mockImplementation((p: string) => p);
   });
 
   // ── non-bash tools ───────────────────────────────────────────────────────
@@ -254,4 +266,65 @@ describe("ToolCallGatePipeline", () => {
       expect(result).toEqual({ action: "allow" });
     });
   });
+
+  // ── per-tool path-bearing gate (#502) ────────────────────────────────────
+
+  describe("evaluate — per-tool path-bearing gate (#502)", () => {
+    it("emits an access-path intent on the tool-name surface for a path-bearing tool", async () => {
+      const resolver = makeResolver(makeCheckResult());
+      const inputs = makeGateInputs();
+      const { runner } = makeGateRunner();
+      const pipeline = new ToolCallGatePipeline(resolver, inputs);
+
+      await pipeline.evaluate(
+        makeTcc({ toolName: "read", input: { path: "/test/cwd/foo.ts" } }),
+        runner,
+      );
+
+      const perTool = resolver.resolve.mock.calls.find(
+        ([intent]) => intent.surface === "read",
+      );
+      expect(perTool?.[0].kind).toBe("access-path");
+    });
+
+    it("keeps a path-bearing tool with no path on the tool intent", async () => {
+      const resolver = makeResolver(makeCheckResult());
+      const inputs = makeGateInputs();
+      const { runner } = makeGateRunner();
+      const pipeline = new ToolCallGatePipeline(resolver, inputs);
+
+      await pipeline.evaluate(makeTcc({ toolName: "read", input: {} }), runner);
+
+      const perTool = resolver.resolve.mock.calls.find(
+        ([intent]) => intent.surface === "read",
+      );
+      expect(perTool?.[0].kind).toBe("tool");
+    });
+
+    it("blocks when a per-tool rule matches the symlink-resolved form", async () => {
+      // /test/cwd/foo.env is a symlink to /vault/foo.env; the per-tool rule is
+      // keyed on the resolved target, which is only reachable via matchValues().
+      realpathSync.mockImplementation((p: string) =>
+        p === "/test/cwd/foo.env" ? "/vault/foo.env" : p,
+      );
+      const resolver = makeResolver();
+      resolver.resolve.mockImplementation((intent) =>
+        intent.kind === "access-path" &&
+        intent.surface === "read" &&
+        intent.path.matchValues().includes("/vault/foo.env")
+          ? makeCheckResult({ state: "deny", matchedPattern: "*.env" })
+          : makeCheckResult(),
+      );
+      const inputs = makeGateInputs();
+      const { runner } = makeGateRunner();
+      const pipeline = new ToolCallGatePipeline(resolver, inputs);
+
+      const result = await pipeline.evaluate(
+        makeTcc({ toolName: "read", input: { path: "/test/cwd/foo.env" } }),
+        runner,
+      );
+
+      expect(result).toMatchObject({ action: "block" });
+    });
+  });
 });

package/test/handlers/gates/tool.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import { describeToolGate } from "#src/handlers/gates/tool";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import {
   TOOL_INPUT_LOG_PREVIEW_MAX_LENGTH,
   TOOL_INPUT_PREVIEW_MAX_LENGTH,
@@ -45,6 +46,10 @@ function makeCheckResult(
   };
 }
 
+// The per-tool gate now receives the AccessPath the pipeline builds, bound to
+// the makeTcc default cwd; approval values derive from `accessPath.value()`.
+const normalizer = new PathNormalizer("linux", "/test/project");
+
 // ── tests ──────────────────────────────────────────────────────────────────
 
 describe("describeToolGate", () => {
@@ -53,7 +58,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "read" }),
       makeCheckResult("ask"),
       makeFormatter(),
-      "linux",
     );
     expect(desc.surface).toBe("read");
     expect(desc.decision.surface).toBe("read");
@@ -64,7 +68,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "write" }),
       makeCheckResult("ask"),
       makeFormatter(),
-      "linux",
     );
     expect(desc.decision.value).toBe("write");
   });
@@ -78,7 +81,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "git status" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.surface).toBe("bash");
     expect(desc.decision.surface).toBe("bash");
@@ -94,7 +96,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "mcp", input: { tool: "server:tool" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.surface).toBe("mcp");
     expect(desc.decision.surface).toBe("mcp");
@@ -103,7 +104,7 @@ describe("describeToolGate", () => {
 
   it("populates denialContext with kind 'tool' and check result", () => {
     const check = makeCheckResult("deny", { toolName: "read" });
-    const desc = describeToolGate(makeTcc(), check, makeFormatter(), "linux");
+    const desc = describeToolGate(makeTcc(), check, makeFormatter());
     expect(desc.denialContext).toEqual({
       kind: "tool",
       check,
@@ -118,7 +119,6 @@ describe("describeToolGate", () => {
       makeTcc({ agentName: "my-agent" }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.denialContext.agentName).toBe("my-agent");
   });
@@ -129,7 +129,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "ls" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.denialContext).toMatchObject({
       kind: "tool",
@@ -146,7 +145,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "git status" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.sessionApproval).toBeDefined();
     expect(desc.sessionApproval?.surface).toBe("bash");
@@ -163,16 +161,17 @@ describe("describeToolGate", () => {
       }),
       check,
       makeFormatter(),
-      "linux",
+      normalizer.forPath("index.html"),
     );
     expect(desc.sessionApproval?.surface).toBe("edit");
     expect(desc.sessionApproval?.representativePattern).toBe("/test/project/*");
   });
 
   it("resolves a sub-directory file's session approval to an absolute pattern", () => {
-    // Resolve-at-gate canonicalizes every path (not just the cwd-root case),
-    // so sub-directory approvals are absolute too — the deliberate tradeoff
-    // that keeps the pattern aligned with the policy values it is matched against.
+    // The approval value derives from the AccessPath's lexical absolute form
+    // (`value()`), so sub-directory approvals are absolute too — the deliberate
+    // tradeoff that keeps the pattern aligned with the policy values it is
+    // matched against.
     const check = makeCheckResult("ask", { toolName: "edit" });
     const desc = describeToolGate(
       makeTcc({
@@ -182,20 +181,31 @@ describe("describeToolGate", () => {
       }),
       check,
       makeFormatter(),
-      "linux",
+      normalizer.forPath("src/foo.ts"),
     );
     expect(desc.sessionApproval?.representativePattern).toBe(
       "/test/project/src/*",
     );
   });
 
+  it("falls back to a wildcard session approval when no AccessPath is given", () => {
+    // A path-bearing tool with no `input.path` keeps the `tool` intent and gets
+    // no AccessPath, so the suggestion collapses to the catch-all.
+    const desc = describeToolGate(
+      makeTcc({ toolName: "read", input: {} }),
+      makeCheckResult("ask"),
+      makeFormatter(),
+    );
+    expect(desc.sessionApproval?.surface).toBe("read");
+    expect(desc.sessionApproval?.representativePattern).toBe("*");
+  });
+
   it("populates promptDetails with correct fields", () => {
     const check = makeCheckResult("ask");
     const desc = describeToolGate(
       makeTcc({ toolName: "read", agentName: "my-agent", toolCallId: "tc-42" }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.promptDetails).toMatchObject({
       source: "tool_call",
@@ -213,7 +223,6 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "bash", input: { command: "ls" } }),
       check,
       makeFormatter(),
-      "linux",
     );
     expect(desc.logContext).toMatchObject({
       source: "tool_call",
@@ -227,7 +236,7 @@ describe("describeToolGate", () => {
       makeTcc({ toolName: "edit", input: { path: "/a.ts" } }),
       makeCheckResult("ask", { toolName: "edit" }),
       makeFormatter(),
-      "linux",
+      normalizer.forPath("/a.ts"),
     );
     expect(desc.surface).toBe("edit");
     expect(desc.input).toEqual({ path: "/a.ts" });

package/test/helpers/gate-fixtures.ts

@@ -255,7 +255,6 @@ export function makeGateInputs(
     getInfrastructureReadDirs?: () => string[];
     getToolPreviewLimits?: () => ToolPreviewFormatterOptions;
     getPathNormalizer?: () => PathNormalizer;
-    getPlatform?: () => NodeJS.Platform;
   } = {},
 ): ToolCallGateInputs {
   return {
@@ -276,8 +275,6 @@ export function makeGateInputs(
       vi.fn<() => PathNormalizer>(
         () => new PathNormalizer(process.platform, "/test/cwd"),
       ),
-    getPlatform:
-      overrides.getPlatform ?? vi.fn<() => NodeJS.Platform>(() => "linux"),
   };
 }