@gotgenes/pi-permission-system 18.1.1 → 18.1.2

package/test/handlers/external-directory-integration.test.ts

@@ -1,515 +0,0 @@
-/**
- * Integration tests for external_directory tool_call enforcement.
- *
- * These tests exercise PermissionGateHandler.handleToolCall with the
- * external-directory gate, verifying the full descriptor→runner pipeline
- * while mocking only the PermissionSession boundary.
- *
- * Regression guard: importing the four external-directory message helpers
- * ensures the test file fails to load if any helper is removed.
- */
-
-import { describe, expect, it, vi } from "vitest";
-
-import { EXTENSION_TAG } from "#src/denial-messages";
-import { formatExternalDirectoryAskPrompt } from "#src/handlers/gates/external-directory-messages";
-import type { PermissionCheckResult } from "#src/types";
-import {
-  ALL_PATH_BEARING_TOOLS,
-  ALL_TOOLS,
-  blockReviewEntries,
-  EXT_DIR_CWD,
-  EXTERNAL_PATH,
-  findExtDirDecision,
-  makeApprovingPrompter,
-  makeDenyingPrompter,
-  makeExtDirCheck,
-  makeUnavailablePrompter,
-  OPTIONAL_PATH_TOOLS,
-} from "#test/helpers/external-directory-fixtures";
-import {
-  getDecisionEvents,
-  makeCtx,
-  makeHandler,
-  makeToolCallEvent,
-} from "#test/helpers/handler-fixtures";
-
-// ── SDK stubs ──────────────────────────────────────────────────────────────
-vi.mock("@earendil-works/pi-coding-agent", async (importOriginal) => {
-  const original =
-    await importOriginal<typeof import("@earendil-works/pi-coding-agent")>();
-  return { ...original };
-});
-
-// ── Regression guard: helper presence ──────────────────────────────────────
-
-describe("external_directory helper regression guard", () => {
-  it("formatExternalDirectoryAskPrompt is a callable function", () => {
-    expect(typeof formatExternalDirectoryAskPrompt).toBe("function");
-    expect(
-      formatExternalDirectoryAskPrompt(
-        "read",
-        "/outside/file",
-        undefined,
-        "/project",
-      ),
-    ).toContain("/outside/file");
-  });
-
-  it("EXTENSION_TAG is the expected value", () => {
-    expect(EXTENSION_TAG).toBe("[pi-permission-system]");
-  });
-
-  // formatExternalDirectoryDenyReason, formatExternalDirectoryUserDeniedReason,
-  // and formatExternalDirectoryHardStopHint have moved to denial-messages.ts.
-  // Their behavior is tested in denial-messages.test.ts.
-});
-
-// ── Path scope: gate applicability ────────────────────────────────────────
-
-describe("external_directory path scope", () => {
-  it("skips external_directory check when path is inside CWD", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", {
-      input: { path: `${EXT_DIR_CWD}/src/index.ts` },
-    });
-    const result = await handler.handleToolCall(event, makeCtx());
-    // Should not be blocked — the external_directory gate is skipped,
-    // and the tool gate sees "allow" (default toolState in makeExtDirCheck)
-    expect(result).toEqual({ action: "allow" });
-  });
-
-  it("fires external_directory check when path is outside CWD", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toMatchObject({ action: "block" });
-  });
-
-  it("skips external_directory check for non-path-bearing tool (bash)", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny", "allow") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("bash", {
-      input: { command: `cat ${EXTERNAL_PATH}` },
-    });
-    // bash is not in PATH_BEARING_TOOLS, so the external_directory gate
-    // for tool path does not fire (bash-external-directory gate is separate)
-    const result = await handler.handleToolCall(event, makeCtx());
-    // bash-external-directory gate MAY fire separately, but the tool-path
-    // external_directory gate does NOT fire for bash
-    // We verify the checkPermission was not called with "external_directory"
-    // from the tool-path gate by checking the result is not blocked by it
-    expect(result).toBeDefined();
-  });
-
-  it.each(
-    ALL_PATH_BEARING_TOOLS,
-  )("blocks %s with an out-of-cwd path when external_directory is deny", async (toolName) => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent(toolName, {
-      input: { path: EXTERNAL_PATH },
-    });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toMatchObject({ action: "block" });
-  });
-
-  it.each(
-    OPTIONAL_PATH_TOOLS,
-  )("skips external_directory check for %s when path is omitted", async (toolName) => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    // No path in input — external_directory gate should not fire
-    const event = makeToolCallEvent(toolName);
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toEqual({ action: "allow" });
-  });
-});
-
-// ── Policy state matrix: allow and deny ────────────────────────────────────
-
-describe("external_directory policy state — allow", () => {
-  it("falls through to tool gate when external_directory is allow", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toEqual({ action: "allow" });
-  });
-
-  it("emits decision event with policy_allow on external_directory surface", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    expect(findExtDirDecision(events)).toMatchObject({
-      surface: "external_directory",
-      result: "allow",
-      resolution: "policy_allow",
-    });
-  });
-
-  it("does not write a block review-log entry when external_directory is allow", async () => {
-    const { handler, logger } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    expect(blockReviewEntries(logger)).toHaveLength(0);
-  });
-});
-
-// #144: allow external reads, gate external writes
-describe("external_directory — allow external reads, gate external writes (#144)", () => {
-  it("allows read of external path when external_directory and read are both allow", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow", "allow") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toEqual({ action: "allow" });
-  });
-
-  it("prompts for write to external path when external_directory allows but write is ask", async () => {
-    const { handler, prompter } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow", "ask") },
-      prompter: makeApprovingPrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("write", {
-      input: { path: EXTERNAL_PATH },
-    });
-    const result = await handler.handleToolCall(event, makeCtx());
-    // external_directory passes; write gate prompts and user approves
-    expect(result).toEqual({ action: "allow" });
-    expect(prompter.prompt).toHaveBeenCalledOnce();
-  });
-
-  it("blocks write to external path when external_directory allows but write is deny", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow", "deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("write", {
-      input: { path: EXTERNAL_PATH },
-    });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toMatchObject({ action: "block" });
-  });
-
-  it("emits separate decision events for external_directory and write surfaces", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow", "deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("write", {
-      input: { path: EXTERNAL_PATH },
-    });
-    await handler.handleToolCall(event, makeCtx());
-    const decisions = getDecisionEvents(events);
-    const writeDecision = decisions.find((d) => d.surface === "write");
-    expect(findExtDirDecision(events)).toMatchObject({
-      surface: "external_directory",
-      result: "allow",
-      resolution: "policy_allow",
-    });
-    expect(writeDecision).toMatchObject({
-      surface: "write",
-      result: "deny",
-      resolution: "policy_deny",
-    });
-  });
-});
-
-describe("external_directory policy state — deny", () => {
-  it("blocks with reason containing the external path", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toMatchObject({ action: "block" });
-    expect((result as { reason?: string }).reason).toContain(EXTERNAL_PATH);
-  });
-
-  it("block reason contains extension attribution", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect((result as { reason?: string }).reason).toContain(
-      "[pi-permission-system]",
-    );
-    expect((result as { reason?: string }).reason).not.toContain("Hard stop");
-  });
-
-  it("writes review-log entry with resolution policy_denied", async () => {
-    const { handler, logger } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    const entries = blockReviewEntries(logger);
-    expect(entries.length).toBeGreaterThanOrEqual(1);
-    expect(entries[0][1]).toMatchObject({
-      resolution: "policy_denied",
-    });
-  });
-
-  it("emits decision event with policy_deny on external_directory surface", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    expect(findExtDirDecision(events)).toMatchObject({
-      surface: "external_directory",
-      result: "deny",
-      resolution: "policy_deny",
-    });
-  });
-});
-
-// ── Policy state matrix: ask ────────────────────────────────────────────────
-
-describe("external_directory policy state — ask", () => {
-  it("does not block when user approves", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeApprovingPrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toEqual({ action: "allow" });
-  });
-
-  it("emits user_approved decision when user approves", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeApprovingPrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    expect(findExtDirDecision(events)).toMatchObject({
-      surface: "external_directory",
-      result: "allow",
-      resolution: "user_approved",
-    });
-  });
-
-  it("blocks when user denies", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeDenyingPrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toMatchObject({ action: "block" });
-  });
-
-  it("emits user_denied decision when user denies", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeDenyingPrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    expect(findExtDirDecision(events)).toMatchObject({
-      surface: "external_directory",
-      result: "deny",
-      resolution: "user_denied",
-    });
-  });
-
-  it("block reason includes denialReason when user provides one", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeDenyingPrompter("not needed"),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(event, makeCtx());
-    expect(result).toMatchObject({ action: "block" });
-    expect((result as { reason?: string }).reason).toContain("not needed");
-  });
-
-  it("blocks with confirmation_unavailable when no UI is available", async () => {
-    const { handler } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeUnavailablePrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result = await handler.handleToolCall(
-      event,
-      makeCtx({ hasUI: false }),
-    );
-    expect(result).toMatchObject({ action: "block" });
-    expect((result as { reason?: string }).reason).toContain(
-      "outside the working directory",
-    );
-  });
-
-  it("writes review-log entry with confirmation_unavailable when no UI", async () => {
-    const { handler, logger } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeUnavailablePrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx({ hasUI: false }));
-    const entries = blockReviewEntries(logger);
-    expect(entries.length).toBeGreaterThanOrEqual(1);
-    expect(entries[0][1]).toMatchObject({
-      resolution: "confirmation_unavailable",
-    });
-  });
-
-  it("emits confirmation_unavailable decision when no UI", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("ask") },
-      prompter: makeUnavailablePrompter(),
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx({ hasUI: false }));
-    expect(findExtDirDecision(events)).toMatchObject({
-      surface: "external_directory",
-      result: "deny",
-      resolution: "confirmation_unavailable",
-    });
-  });
-});
-
-// ── Per-agent override ─────────────────────────────────────────────────────
-
-describe("external_directory per-agent override", () => {
-  it("honors per-agent override of external_directory policy", async () => {
-    // checkPermission varies by agentName: allow for "special-agent", deny otherwise
-    const agentAwareCheck = vi
-      .fn()
-      .mockImplementation(
-        (
-          surface: string,
-          _input: unknown,
-          agentName?: string,
-        ): PermissionCheckResult => {
-          if (surface === "external_directory") {
-            const state =
-              agentName === "special-agent" ? "allow" : ("deny" as const);
-            return {
-              state,
-              toolName: surface,
-              source: "tool",
-              origin: agentName === "special-agent" ? "agent" : "global",
-            };
-          }
-          return {
-            state: "allow",
-            toolName: surface,
-            source: "tool",
-            origin: "builtin",
-          };
-        },
-      );
-
-    // With agent override → allowed
-    const { handler: handler1, events: events1 } = makeHandler({
-      session: {
-        checkPermission: agentAwareCheck,
-        resolveAgentName: vi.fn().mockReturnValue("special-agent"),
-      },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    const result1 = await handler1.handleToolCall(event, makeCtx());
-    expect(result1).toEqual({ action: "allow" });
-
-    expect(findExtDirDecision(events1)).toMatchObject({
-      result: "allow",
-      resolution: "policy_allow",
-      agentName: "special-agent",
-    });
-
-    // Without agent override → denied
-    const { handler: handler2 } = makeHandler({
-      session: {
-        checkPermission: agentAwareCheck,
-        resolveAgentName: vi.fn().mockReturnValue(null),
-      },
-      tools: ALL_TOOLS,
-    });
-    const result2 = await handler2.handleToolCall(event, makeCtx());
-    expect(result2).toMatchObject({ action: "block" });
-  });
-});
-
-// ── Decision event surface and value ──────────────────────────────────────
-
-describe("external_directory decision event fields", () => {
-  it("decision event value is the external path", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("deny") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    const extDirDecision = findExtDirDecision(events);
-    expect(extDirDecision).toBeDefined();
-    expect(extDirDecision!.value).toBe(EXTERNAL_PATH);
-  });
-
-  it("decision event includes agentName when present", async () => {
-    const { handler, events } = makeHandler({
-      session: {
-        checkPermission: makeExtDirCheck("allow"),
-        resolveAgentName: vi.fn().mockReturnValue("my-agent"),
-      },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    expect(findExtDirDecision(events)).toMatchObject({
-      agentName: "my-agent",
-    });
-  });
-
-  it("decision event agentName is null when no agent", async () => {
-    const { handler, events } = makeHandler({
-      session: { checkPermission: makeExtDirCheck("allow") },
-      tools: ALL_TOOLS,
-    });
-    const event = makeToolCallEvent("read", { input: { path: EXTERNAL_PATH } });
-    await handler.handleToolCall(event, makeCtx());
-    expect(findExtDirDecision(events)).toMatchObject({
-      agentName: null,
-    });
-  });
-});

package/test/handlers/external-directory-session-dedup.test.ts

@@ -1,175 +0,0 @@
-/**
- * Integration tests verifying that sequential tool calls to the same
- * external path only prompt once — the session-approval recorded by the
- * first call covers the second.
- *
- * Uses real PermissionSession + PermissionResolver + SessionRules so the
- * stateful approval-tracking path is exercised end-to-end.
- */
-
-import { describe, expect, it, vi } from "vitest";
-import {
-  makeApprovingPrompter,
-  makeDeduplicatingHandler,
-  makeDedupWiring,
-  makeExtDirBashEvent,
-  makeExtDirToolEvent,
-} from "#test/helpers/external-directory-fixtures";
-import { makeCtx } from "#test/helpers/handler-fixtures";
-
-// ── SDK stub ───────────────────────────────────────────────────────────────
-vi.mock("@earendil-works/pi-coding-agent", async (importOriginal) => {
-  const original =
-    await importOriginal<typeof import("@earendil-works/pi-coding-agent")>();
-  return { ...original };
-});
-
-// ── tests ──────────────────────────────────────────────────────────────────
-
-describe("external-directory session dedup", () => {
-  describe("path-bearing tools (read, write, edit)", () => {
-    it("does not re-prompt for the same external path after session approval", async () => {
-      const { handler, prompter } = makeDeduplicatingHandler();
-      const ctx = makeCtx();
-      const externalPath = "/outside/project/data.txt";
-
-      // First call — should prompt
-      const event1 = makeExtDirToolEvent("read", externalPath, "tc-1");
-      const result1 = await handler.handleToolCall(event1, ctx);
-      expect(result1).toEqual({ action: "allow" });
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-
-      // Second call — same path, should hit session rule, no prompt
-      const event2 = makeExtDirToolEvent("read", externalPath, "tc-2");
-      const result2 = await handler.handleToolCall(event2, ctx);
-      expect(result2).toEqual({ action: "allow" });
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-    });
-
-    it("does not re-prompt for a different file in the same external directory", async () => {
-      const { handler, prompter } = makeDeduplicatingHandler();
-      const ctx = makeCtx();
-
-      // First call — prompt for /outside/project/a.txt
-      const event1 = makeExtDirToolEvent(
-        "read",
-        "/outside/project/a.txt",
-        "tc-1",
-      );
-      await handler.handleToolCall(event1, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-
-      // Second call — /outside/project/b.txt is in the same directory
-      const event2 = makeExtDirToolEvent(
-        "read",
-        "/outside/project/b.txt",
-        "tc-2",
-      );
-      await handler.handleToolCall(event2, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-    });
-
-    it("does prompt for a file in a different external directory", async () => {
-      const { handler, prompter } = makeDeduplicatingHandler();
-      const ctx = makeCtx();
-
-      // First call — /outside/alpha/file.txt
-      const event1 = makeExtDirToolEvent(
-        "read",
-        "/outside/alpha/file.txt",
-        "tc-1",
-      );
-      await handler.handleToolCall(event1, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-
-      // Second call — /outside/beta/file.txt is a different directory
-      const event2 = makeExtDirToolEvent(
-        "read",
-        "/outside/beta/file.txt",
-        "tc-2",
-      );
-      await handler.handleToolCall(event2, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(2);
-    });
-
-    it("re-prompts when user approved once (not for session)", async () => {
-      const approveOnce = makeApprovingPrompter();
-      const { handler, prompter } = makeDeduplicatingHandler(approveOnce);
-      const ctx = makeCtx();
-      const externalPath = "/outside/project/data.txt";
-
-      // First call — prompt, approved once
-      const event1 = makeExtDirToolEvent("read", externalPath, "tc-1");
-      await handler.handleToolCall(event1, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-
-      // Second call — no session rule recorded, should prompt again
-      const event2 = makeExtDirToolEvent("read", externalPath, "tc-2");
-      await handler.handleToolCall(event2, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(2);
-    });
-  });
-
-  describe("bash commands with external paths", () => {
-    it("does not re-prompt for a bash command referencing the same external path after session approval", async () => {
-      const { handler, prompter } = makeDeduplicatingHandler();
-      const ctx = makeCtx();
-
-      // First call — bash referencing /tmp/out.txt
-      const event1 = makeExtDirBashEvent("echo hello > /tmp/out.txt", "tc-1");
-      const result1 = await handler.handleToolCall(event1, ctx);
-      expect(result1).toEqual({ action: "allow" });
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-
-      // Second call — different bash command, same external path
-      const event2 = makeExtDirBashEvent("cat /tmp/out.txt", "tc-2");
-      const result2 = await handler.handleToolCall(event2, ctx);
-      expect(result2).toEqual({ action: "allow" });
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-    });
-
-    it("does not re-prompt for read after bash already approved the same directory", async () => {
-      const { handler, prompter } = makeDeduplicatingHandler();
-      const ctx = makeCtx();
-
-      // First call — bash writes to /tmp/out.txt
-      const event1 = makeExtDirBashEvent("echo hello > /tmp/out.txt", "tc-1");
-      await handler.handleToolCall(event1, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-
-      // Second call — read from /tmp/out.txt (same directory, different tool)
-      const event2 = makeExtDirToolEvent("read", "/tmp/out.txt", "tc-2");
-      await handler.handleToolCall(event2, ctx);
-      expect(prompter.prompt).toHaveBeenCalledTimes(1);
-    });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Moved from permission-system.test.ts catch-all (#342)
-// ---------------------------------------------------------------------------
-
-describe("session shutdown clears external-directory approvals", () => {
-  it("re-prompts for the same path after session shutdown", async () => {
-    const { handler, prompter, session } = makeDedupWiring();
-
-    const externalPath = "/tmp/sibling/foo.ts";
-    const ctx = makeCtx();
-    const event = makeExtDirToolEvent("read", externalPath, "tc-1");
-
-    // First access: prompt fires and records session approval.
-    await handler.handleToolCall(event, ctx);
-    expect(vi.mocked(prompter.prompt)).toHaveBeenCalledTimes(1);
-
-    // Second access: covered by session approval — no re-prompt.
-    await handler.handleToolCall({ ...event, toolCallId: "tc-2" }, ctx);
-    expect(vi.mocked(prompter.prompt)).toHaveBeenCalledTimes(1);
-
-    // Shutdown clears session approvals.
-    session.shutdown();
-
-    // Third access: session rules cleared — must re-prompt.
-    await handler.handleToolCall({ ...event, toolCallId: "tc-3" }, ctx);
-    expect(vi.mocked(prompter.prompt)).toHaveBeenCalledTimes(2);
-  });
-});