@gotgenes/pi-permission-system 18.1.0 → 18.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (132) hide show
  1. package/CHANGELOG.md +23 -0
  2. package/docs/assets/logo.png +0 -0
  3. package/docs/assets/logo.svg +213 -0
  4. package/docs/configuration.md +700 -0
  5. package/docs/cross-extension-api.md +525 -0
  6. package/docs/guides/permission-frontmatter-for-subagent-extensions.md +201 -0
  7. package/docs/guides/upstream-issue-template.md +113 -0
  8. package/docs/migration/legacy-to-flat.md +365 -0
  9. package/docs/opencode-compatibility.md +213 -0
  10. package/docs/session-approvals.md +68 -0
  11. package/docs/subagent-integration.md +102 -0
  12. package/docs/troubleshooting.md +53 -0
  13. package/package.json +5 -2
  14. package/src/access-intent/access-path.ts +29 -4
  15. package/src/access-intent/bash/bash-path-resolver.ts +39 -18
  16. package/src/access-intent/bash/msys-bash-tokens.ts +64 -0
  17. package/src/path-normalizer.ts +105 -2
  18. package/test/access-intent/access-path.test.ts +0 -277
  19. package/test/access-intent/bash/node-text.test.ts +0 -148
  20. package/test/access-intent/bash/parser.test.ts +0 -19
  21. package/test/access-intent/bash/program.test.ts +0 -673
  22. package/test/access-intent/bash/token-classification.test.ts +0 -363
  23. package/test/access-intent/bash/token-collection.test.ts +0 -300
  24. package/test/active-agent.test.ts +0 -155
  25. package/test/async-cache.test.ts +0 -48
  26. package/test/bash-arity.test.ts +0 -144
  27. package/test/bash-external-directory.test.ts +0 -1022
  28. package/test/builtin-tool-input-formatters.test.ts +0 -109
  29. package/test/canonicalize-path.test.ts +0 -119
  30. package/test/composition-root.test.ts +0 -698
  31. package/test/config-loader.test.ts +0 -740
  32. package/test/config-modal.test.ts +0 -320
  33. package/test/config-paths.test.ts +0 -83
  34. package/test/config-pipeline.test.ts +0 -90
  35. package/test/config-reporter.test.ts +0 -147
  36. package/test/config-store.test.ts +0 -466
  37. package/test/decision-audit.test.ts +0 -72
  38. package/test/decision-reporter.test.ts +0 -112
  39. package/test/denial-messages.test.ts +0 -714
  40. package/test/detect-permissive-bash-fallback.test.ts +0 -56
  41. package/test/expand-home.test.ts +0 -93
  42. package/test/extension-config.test.ts +0 -129
  43. package/test/extension-paths.test.ts +0 -108
  44. package/test/forwarded-permissions/io.test.ts +0 -251
  45. package/test/forwarding-manager.test.ts +0 -200
  46. package/test/handlers/before-agent-start.test.ts +0 -314
  47. package/test/handlers/external-directory-integration.test.ts +0 -515
  48. package/test/handlers/external-directory-session-dedup.test.ts +0 -175
  49. package/test/handlers/external-directory-symlink-acceptance.test.ts +0 -167
  50. package/test/handlers/gates/bash-command-metamorphic.test.ts +0 -88
  51. package/test/handlers/gates/bash-command.test.ts +0 -257
  52. package/test/handlers/gates/bash-external-directory.test.ts +0 -268
  53. package/test/handlers/gates/bash-path.test.ts +0 -346
  54. package/test/handlers/gates/candidate-check.test.ts +0 -52
  55. package/test/handlers/gates/external-directory-messages.test.ts +0 -85
  56. package/test/handlers/gates/external-directory-policy.test.ts +0 -134
  57. package/test/handlers/gates/external-directory.test.ts +0 -267
  58. package/test/handlers/gates/helpers.test.ts +0 -165
  59. package/test/handlers/gates/path.test.ts +0 -369
  60. package/test/handlers/gates/runner.test.ts +0 -408
  61. package/test/handlers/gates/skill-input-gate-pipeline.test.ts +0 -176
  62. package/test/handlers/gates/skill-input.test.ts +0 -128
  63. package/test/handlers/gates/skill-read.test.ts +0 -161
  64. package/test/handlers/gates/tool-call-gate-pipeline.test.ts +0 -356
  65. package/test/handlers/gates/tool.test.ts +0 -244
  66. package/test/handlers/input-events.test.ts +0 -168
  67. package/test/handlers/input.test.ts +0 -199
  68. package/test/handlers/lifecycle.test.ts +0 -221
  69. package/test/handlers/tool-call-boundary.test.ts +0 -145
  70. package/test/handlers/tool-call-events.test.ts +0 -277
  71. package/test/handlers/tool-call.test.ts +0 -395
  72. package/test/handlers/validate-requested-tool.test.ts +0 -92
  73. package/test/helpers/external-directory-fixtures.ts +0 -269
  74. package/test/helpers/gate-fixtures.ts +0 -316
  75. package/test/helpers/handler-fixtures.ts +0 -335
  76. package/test/helpers/make-fake-pi.ts +0 -100
  77. package/test/helpers/manager-harness.ts +0 -112
  78. package/test/helpers/session-fixtures.ts +0 -199
  79. package/test/input-normalizer.test.ts +0 -325
  80. package/test/logging.test.ts +0 -51
  81. package/test/mcp-targets.test.ts +0 -233
  82. package/test/node-modules-discovery.test.ts +0 -97
  83. package/test/normalize.test.ts +0 -247
  84. package/test/path-containment.test.ts +0 -161
  85. package/test/path-normalization.test.ts +0 -233
  86. package/test/path-normalizer.test.ts +0 -196
  87. package/test/path-surfaces.test.ts +0 -55
  88. package/test/pattern-suggest.test.ts +0 -248
  89. package/test/permission-dialog.test.ts +0 -205
  90. package/test/permission-event-rpc.test.ts +0 -560
  91. package/test/permission-events.test.ts +0 -400
  92. package/test/permission-forwarder.test.ts +0 -370
  93. package/test/permission-forwarding.test.ts +0 -315
  94. package/test/permission-gate.test.ts +0 -269
  95. package/test/permission-manager-unified.test.ts +0 -3714
  96. package/test/permission-merge.test.ts +0 -61
  97. package/test/permission-prompter.test.ts +0 -518
  98. package/test/permission-prompts.test.ts +0 -363
  99. package/test/permission-resolver.test.ts +0 -277
  100. package/test/permission-session.test.ts +0 -404
  101. package/test/permission-ui-prompt.test.ts +0 -146
  102. package/test/permissions-service.test.ts +0 -192
  103. package/test/pi-infrastructure-read.test.ts +0 -432
  104. package/test/policy-loader.test.ts +0 -561
  105. package/test/prompting-gateway.test.ts +0 -231
  106. package/test/rule.test.ts +0 -650
  107. package/test/safe-system-paths.test.ts +0 -46
  108. package/test/scope-merge.test.ts +0 -116
  109. package/test/service-lifecycle.test.ts +0 -163
  110. package/test/service.test.ts +0 -261
  111. package/test/session-approval.test.ts +0 -75
  112. package/test/session-logger.test.ts +0 -200
  113. package/test/session-rules.test.ts +0 -321
  114. package/test/session-start.test.ts +0 -112
  115. package/test/skill-prompt-sanitizer.test.ts +0 -418
  116. package/test/status.test.ts +0 -10
  117. package/test/subagent-context.test.ts +0 -372
  118. package/test/subagent-lifecycle-events.test.ts +0 -132
  119. package/test/subagent-registry.test.ts +0 -145
  120. package/test/synthesize.test.ts +0 -302
  121. package/test/system-prompt-sanitizer.test.ts +0 -382
  122. package/test/tool-access-extractor-registry.test.ts +0 -77
  123. package/test/tool-input-formatter-registry.test.ts +0 -75
  124. package/test/tool-input-path.test.ts +0 -84
  125. package/test/tool-input-preview.test.ts +0 -129
  126. package/test/tool-input-prompt-formatters.test.ts +0 -115
  127. package/test/tool-preview-formatter.test.ts +0 -458
  128. package/test/tool-registry.test.ts +0 -197
  129. package/test/value-guards.test.ts +0 -193
  130. package/test/wildcard-matcher.test.ts +0 -424
  131. package/test/yaml-frontmatter.test.ts +0 -91
  132. package/test/yolo-mode.test.ts +0 -188
@@ -1,155 +0,0 @@
1
- import { afterEach, describe, expect, test, vi } from "vitest";
2
- import {
3
- ACTIVE_AGENT_TAG_REGEX,
4
- type ActiveAgentContext,
5
- getActiveAgentName,
6
- getActiveAgentNameFromSystemPrompt,
7
- normalizeAgentName,
8
- type SessionEntryView,
9
- } from "#src/active-agent";
10
-
11
- afterEach(() => {
12
- vi.restoreAllMocks();
13
- });
14
-
15
- function makeCtx(entries: SessionEntryView[]): ActiveAgentContext {
16
- return {
17
- sessionManager: {
18
- getEntries: vi.fn(() => entries),
19
- },
20
- };
21
- }
22
-
23
- describe("ACTIVE_AGENT_TAG_REGEX", () => {
24
- test("matches double-quoted name attribute", () => {
25
- const match = '<active_agent name="my-agent">'.match(
26
- ACTIVE_AGENT_TAG_REGEX,
27
- );
28
- expect(match?.[1]).toBe("my-agent");
29
- });
30
-
31
- test("matches single-quoted name attribute", () => {
32
- const match = "<active_agent name='my-agent'>".match(
33
- ACTIVE_AGENT_TAG_REGEX,
34
- );
35
- expect(match?.[1]).toBe("my-agent");
36
- });
37
-
38
- test("is case-insensitive", () => {
39
- const match = '<ACTIVE_AGENT name="bot">'.match(ACTIVE_AGENT_TAG_REGEX);
40
- expect(match?.[1]).toBe("bot");
41
- });
42
-
43
- test("does not match when tag is absent", () => {
44
- expect("no tag here".match(ACTIVE_AGENT_TAG_REGEX)).toBeNull();
45
- });
46
- });
47
-
48
- describe("normalizeAgentName", () => {
49
- test("returns trimmed string for valid input", () => {
50
- expect(normalizeAgentName(" my-agent ")).toBe("my-agent");
51
- });
52
-
53
- test("returns null for empty string", () => {
54
- expect(normalizeAgentName("")).toBeNull();
55
- });
56
-
57
- test("returns null for whitespace-only string", () => {
58
- expect(normalizeAgentName(" ")).toBeNull();
59
- });
60
-
61
- test("returns null for non-string values", () => {
62
- expect(normalizeAgentName(null)).toBeNull();
63
- expect(normalizeAgentName(undefined)).toBeNull();
64
- expect(normalizeAgentName(42)).toBeNull();
65
- expect(normalizeAgentName({})).toBeNull();
66
- });
67
- });
68
-
69
- describe("getActiveAgentName", () => {
70
- test("returns null when session has no entries", () => {
71
- expect(getActiveAgentName(makeCtx([]))).toBeNull();
72
- });
73
-
74
- test("returns null when no active_agent custom entry exists", () => {
75
- const ctx = makeCtx([{ type: "message", data: { name: "agent" } }]);
76
- expect(getActiveAgentName(ctx)).toBeNull();
77
- });
78
-
79
- test("returns agent name from active_agent entry", () => {
80
- const ctx = makeCtx([
81
- { type: "custom", customType: "active_agent", data: { name: "bot" } },
82
- ]);
83
- expect(getActiveAgentName(ctx)).toBe("bot");
84
- });
85
-
86
- test("last-entry-wins: returns name from the last matching entry", () => {
87
- const ctx = makeCtx([
88
- { type: "custom", customType: "active_agent", data: { name: "first" } },
89
- { type: "custom", customType: "active_agent", data: { name: "last" } },
90
- ]);
91
- expect(getActiveAgentName(ctx)).toBe("last");
92
- });
93
-
94
- test("entry with name: null resets agent name to null", () => {
95
- const ctx = makeCtx([
96
- { type: "custom", customType: "active_agent", data: { name: "bot" } },
97
- { type: "custom", customType: "active_agent", data: { name: null } },
98
- ]);
99
- expect(getActiveAgentName(ctx)).toBeNull();
100
- });
101
-
102
- test("skips entries with whitespace-only name and continues scanning", () => {
103
- const ctx = makeCtx([
104
- { type: "custom", customType: "active_agent", data: { name: "first" } },
105
- { type: "custom", customType: "active_agent", data: { name: " " } },
106
- ]);
107
- // " " normalizes to null — not a sentinel reset, keeps scanning backwards
108
- expect(getActiveAgentName(ctx)).toBe("first");
109
- });
110
-
111
- test("ignores entries with wrong customType", () => {
112
- const ctx = makeCtx([
113
- { type: "custom", customType: "something_else", data: { name: "bot" } },
114
- ]);
115
- expect(getActiveAgentName(ctx)).toBeNull();
116
- });
117
-
118
- test("ignores entries with wrong type", () => {
119
- const ctx = makeCtx([
120
- { type: "tool_call", customType: "active_agent", data: { name: "bot" } },
121
- ]);
122
- expect(getActiveAgentName(ctx)).toBeNull();
123
- });
124
- });
125
-
126
- describe("getActiveAgentNameFromSystemPrompt", () => {
127
- test("returns null for undefined system prompt", () => {
128
- expect(getActiveAgentNameFromSystemPrompt(undefined)).toBeNull();
129
- });
130
-
131
- test("returns null for empty system prompt", () => {
132
- expect(getActiveAgentNameFromSystemPrompt("")).toBeNull();
133
- });
134
-
135
- test("returns null when tag is absent", () => {
136
- expect(
137
- getActiveAgentNameFromSystemPrompt("You are a helpful assistant."),
138
- ).toBeNull();
139
- });
140
-
141
- test("extracts agent name from tag in system prompt", () => {
142
- const prompt = 'You are helpful.\n<active_agent name="my-bot">\nDo work.';
143
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBe("my-bot");
144
- });
145
-
146
- test("returns null when tag name is empty", () => {
147
- const prompt = '<active_agent name="">';
148
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBeNull();
149
- });
150
-
151
- test("trims whitespace from extracted name", () => {
152
- const prompt = '<active_agent name=" trimmed ">';
153
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBe("trimmed");
154
- });
155
- });
@@ -1,48 +0,0 @@
1
- import { describe, expect, it, vi } from "vitest";
2
-
3
- import { memoizeAsyncWithRetry } from "#src/async-cache";
4
-
5
- describe("memoizeAsyncWithRetry", () => {
6
- it("invokes the factory once and shares the resolved value across calls", async () => {
7
- const factory = vi.fn<() => Promise<number>>().mockResolvedValue(42);
8
- const memoized = memoizeAsyncWithRetry(factory);
9
-
10
- const results = await Promise.all([memoized(), memoized(), memoized()]);
11
-
12
- expect(results).toEqual([42, 42, 42]);
13
- expect(factory).toHaveBeenCalledTimes(1);
14
- });
15
-
16
- it("caches the same promise instance on success", async () => {
17
- const factory = vi.fn<() => Promise<string>>().mockResolvedValue("parser");
18
- const memoized = memoizeAsyncWithRetry(factory);
19
-
20
- await memoized();
21
- await memoized();
22
-
23
- expect(factory).toHaveBeenCalledTimes(1);
24
- });
25
-
26
- it("surfaces the rejection to the caller each time the factory fails", async () => {
27
- const error = new Error("init failed");
28
- const factory = vi.fn<() => Promise<number>>().mockRejectedValue(error);
29
- const memoized = memoizeAsyncWithRetry(factory);
30
-
31
- await expect(memoized()).rejects.toThrow("init failed");
32
- await expect(memoized()).rejects.toThrow("init failed");
33
- });
34
-
35
- it("drops a rejected result so the next call re-invokes the factory", async () => {
36
- const factory = vi
37
- .fn<() => Promise<number>>()
38
- .mockRejectedValueOnce(new Error("transient"))
39
- .mockResolvedValue(7);
40
- const memoized = memoizeAsyncWithRetry(factory);
41
-
42
- await expect(memoized()).rejects.toThrow("transient");
43
- const recovered = await memoized();
44
-
45
- expect(recovered).toBe(7);
46
- expect(factory).toHaveBeenCalledTimes(2);
47
- });
48
- });
@@ -1,144 +0,0 @@
1
- import { describe, expect, it } from "vitest";
2
- import { ARITY, prefix, stripBashCommentLines } from "#src/bash-arity";
3
-
4
- describe("ARITY dictionary", () => {
5
- it("is exported as a plain object", () => {
6
- expect(typeof ARITY).toBe("object");
7
- });
8
-
9
- it("maps 'git' to arity 2", () => {
10
- expect(ARITY.git).toBe(2);
11
- });
12
-
13
- it("maps 'npm run' to arity 3", () => {
14
- expect(ARITY["npm run"]).toBe(3);
15
- });
16
-
17
- it("maps 'npm' to arity 2 (fallback when 'npm run' does not match)", () => {
18
- expect(ARITY.npm).toBe(2);
19
- });
20
-
21
- it("maps 'docker compose' to arity 3", () => {
22
- expect(ARITY["docker compose"]).toBe(3);
23
- });
24
-
25
- it("maps 'docker' to arity 2 (fallback)", () => {
26
- expect(ARITY.docker).toBe(2);
27
- });
28
- });
29
-
30
- describe("prefix", () => {
31
- it("returns empty array for empty input", () => {
32
- expect(prefix([])).toEqual([]);
33
- });
34
-
35
- it("returns single-element array for a bare known command", () => {
36
- // 'git' alone has arity 2 but only 1 token is available — clamp.
37
- expect(prefix(["git"])).toEqual(["git"]);
38
- });
39
-
40
- it("returns arity-2 prefix for git subcommands", () => {
41
- expect(prefix(["git", "checkout", "main"])).toEqual(["git", "checkout"]);
42
- });
43
-
44
- it("returns arity-2 prefix for git status with flags", () => {
45
- expect(prefix(["git", "status", "--short"])).toEqual(["git", "status"]);
46
- });
47
-
48
- it("returns arity-3 prefix for npm run (longest match wins over npm arity-2)", () => {
49
- expect(prefix(["npm", "run", "dev"])).toEqual(["npm", "run", "dev"]);
50
- });
51
-
52
- it("returns arity-2 prefix for npm install (npm fallback, npm run does not match)", () => {
53
- expect(prefix(["npm", "install", "lodash"])).toEqual(["npm", "install"]);
54
- });
55
-
56
- it("returns arity-3 prefix for docker compose subcommands", () => {
57
- expect(prefix(["docker", "compose", "up", "--build"])).toEqual([
58
- "docker",
59
- "compose",
60
- "up",
61
- ]);
62
- });
63
-
64
- it("returns arity-2 prefix for docker pull (docker fallback)", () => {
65
- expect(prefix(["docker", "pull", "ubuntu"])).toEqual(["docker", "pull"]);
66
- });
67
-
68
- it("returns arity-1 prefix for unknown commands", () => {
69
- expect(prefix(["unknown-tool", "--flag"])).toEqual(["unknown-tool"]);
70
- });
71
-
72
- it("returns arity-1 prefix for rm (args are targets, not subcommands)", () => {
73
- expect(prefix(["rm", "-rf", "node_modules"])).toEqual(["rm"]);
74
- });
75
-
76
- it("returns arity-1 prefix for cat", () => {
77
- expect(prefix(["cat", "file.txt"])).toEqual(["cat"]);
78
- });
79
-
80
- it("is case-insensitive: 'Git' looks up as 'git'", () => {
81
- // Tokens are preserved as-is; only the lookup key is lowercased.
82
- expect(prefix(["Git", "checkout", "main"])).toEqual(["Git", "checkout"]);
83
- });
84
-
85
- it("clamps arity to available token count when command is shorter than arity", () => {
86
- // npm run has arity 3; only ["npm", "run"] provided → return both.
87
- expect(prefix(["npm", "run"])).toEqual(["npm", "run"]);
88
- });
89
-
90
- it("returns arity-2 prefix for pnpm run (longest match wins over pnpm)", () => {
91
- // pnpm run <script> — arity 3 means include the script name.
92
- expect(prefix(["pnpm", "run", "build"])).toEqual(["pnpm", "run", "build"]);
93
- });
94
-
95
- it("returns arity-2 prefix for cargo subcommands", () => {
96
- expect(prefix(["cargo", "build", "--release"])).toEqual(["cargo", "build"]);
97
- });
98
-
99
- it("returns arity-2 prefix for kubectl subcommands", () => {
100
- expect(prefix(["kubectl", "get", "pods"])).toEqual(["kubectl", "get"]);
101
- });
102
-
103
- it("returns arity-1 for bare 'ls' (args are paths)", () => {
104
- expect(prefix(["ls", "-la", "/tmp"])).toEqual(["ls"]);
105
- });
106
- });
107
-
108
- describe("stripBashCommentLines", () => {
109
- it("removes a single leading comment line", () => {
110
- expect(
111
- stripBashCommentLines("# Check debug logs\nfind /home -type f"),
112
- ).toBe("find /home -type f");
113
- });
114
-
115
- it("removes multiple leading comment lines", () => {
116
- expect(
117
- stripBashCommentLines("# Step 1\n# Step 2\ngit status --short"),
118
- ).toBe("git status --short");
119
- });
120
-
121
- it("returns empty string when all lines are comments", () => {
122
- expect(stripBashCommentLines("# just a comment")).toBe("");
123
- });
124
-
125
- it("returns empty string for blank input", () => {
126
- expect(stripBashCommentLines("")).toBe("");
127
- });
128
-
129
- it("returns the command unchanged when no comment lines are present", () => {
130
- expect(stripBashCommentLines("grep -rn foo src/")).toBe(
131
- "grep -rn foo src/",
132
- );
133
- });
134
-
135
- it("trims surrounding whitespace from the result", () => {
136
- expect(stripBashCommentLines("\n\n ls -la \n")).toBe("ls -la");
137
- });
138
-
139
- it("treats indented comment lines as comments", () => {
140
- expect(stripBashCommentLines(" # indented comment\necho hi")).toBe(
141
- "echo hi",
142
- );
143
- });
144
- });