@gotgenes/pi-permission-system 18.1.1 → 18.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (122) hide show
  1. package/CHANGELOG.md +16 -0
  2. package/docs/configuration.md +11 -0
  3. package/package.json +1 -2
  4. package/src/access-intent/access-path.ts +29 -4
  5. package/src/access-intent/bash/bash-path-resolver.ts +39 -18
  6. package/src/access-intent/bash/msys-bash-tokens.ts +64 -0
  7. package/src/path-normalizer.ts +105 -2
  8. package/test/access-intent/access-path.test.ts +0 -277
  9. package/test/access-intent/bash/node-text.test.ts +0 -148
  10. package/test/access-intent/bash/parser.test.ts +0 -19
  11. package/test/access-intent/bash/program.test.ts +0 -673
  12. package/test/access-intent/bash/token-classification.test.ts +0 -363
  13. package/test/access-intent/bash/token-collection.test.ts +0 -300
  14. package/test/active-agent.test.ts +0 -155
  15. package/test/async-cache.test.ts +0 -48
  16. package/test/bash-arity.test.ts +0 -144
  17. package/test/bash-external-directory.test.ts +0 -1022
  18. package/test/builtin-tool-input-formatters.test.ts +0 -109
  19. package/test/canonicalize-path.test.ts +0 -119
  20. package/test/composition-root.test.ts +0 -698
  21. package/test/config-loader.test.ts +0 -740
  22. package/test/config-modal.test.ts +0 -320
  23. package/test/config-paths.test.ts +0 -83
  24. package/test/config-pipeline.test.ts +0 -90
  25. package/test/config-reporter.test.ts +0 -147
  26. package/test/config-store.test.ts +0 -466
  27. package/test/decision-audit.test.ts +0 -72
  28. package/test/decision-reporter.test.ts +0 -112
  29. package/test/denial-messages.test.ts +0 -714
  30. package/test/detect-permissive-bash-fallback.test.ts +0 -56
  31. package/test/expand-home.test.ts +0 -93
  32. package/test/extension-config.test.ts +0 -129
  33. package/test/extension-paths.test.ts +0 -108
  34. package/test/forwarded-permissions/io.test.ts +0 -251
  35. package/test/forwarding-manager.test.ts +0 -200
  36. package/test/handlers/before-agent-start.test.ts +0 -314
  37. package/test/handlers/external-directory-integration.test.ts +0 -515
  38. package/test/handlers/external-directory-session-dedup.test.ts +0 -175
  39. package/test/handlers/external-directory-symlink-acceptance.test.ts +0 -167
  40. package/test/handlers/gates/bash-command-metamorphic.test.ts +0 -88
  41. package/test/handlers/gates/bash-command.test.ts +0 -257
  42. package/test/handlers/gates/bash-external-directory.test.ts +0 -268
  43. package/test/handlers/gates/bash-path.test.ts +0 -346
  44. package/test/handlers/gates/candidate-check.test.ts +0 -52
  45. package/test/handlers/gates/external-directory-messages.test.ts +0 -85
  46. package/test/handlers/gates/external-directory-policy.test.ts +0 -134
  47. package/test/handlers/gates/external-directory.test.ts +0 -267
  48. package/test/handlers/gates/helpers.test.ts +0 -165
  49. package/test/handlers/gates/path.test.ts +0 -369
  50. package/test/handlers/gates/runner.test.ts +0 -408
  51. package/test/handlers/gates/skill-input-gate-pipeline.test.ts +0 -176
  52. package/test/handlers/gates/skill-input.test.ts +0 -128
  53. package/test/handlers/gates/skill-read.test.ts +0 -161
  54. package/test/handlers/gates/tool-call-gate-pipeline.test.ts +0 -356
  55. package/test/handlers/gates/tool.test.ts +0 -244
  56. package/test/handlers/input-events.test.ts +0 -168
  57. package/test/handlers/input.test.ts +0 -199
  58. package/test/handlers/lifecycle.test.ts +0 -221
  59. package/test/handlers/tool-call-boundary.test.ts +0 -145
  60. package/test/handlers/tool-call-events.test.ts +0 -277
  61. package/test/handlers/tool-call.test.ts +0 -395
  62. package/test/handlers/validate-requested-tool.test.ts +0 -92
  63. package/test/helpers/external-directory-fixtures.ts +0 -269
  64. package/test/helpers/gate-fixtures.ts +0 -316
  65. package/test/helpers/handler-fixtures.ts +0 -335
  66. package/test/helpers/make-fake-pi.ts +0 -100
  67. package/test/helpers/manager-harness.ts +0 -112
  68. package/test/helpers/session-fixtures.ts +0 -199
  69. package/test/input-normalizer.test.ts +0 -325
  70. package/test/logging.test.ts +0 -51
  71. package/test/mcp-targets.test.ts +0 -233
  72. package/test/node-modules-discovery.test.ts +0 -97
  73. package/test/normalize.test.ts +0 -247
  74. package/test/path-containment.test.ts +0 -161
  75. package/test/path-normalization.test.ts +0 -233
  76. package/test/path-normalizer.test.ts +0 -196
  77. package/test/path-surfaces.test.ts +0 -55
  78. package/test/pattern-suggest.test.ts +0 -248
  79. package/test/permission-dialog.test.ts +0 -205
  80. package/test/permission-event-rpc.test.ts +0 -560
  81. package/test/permission-events.test.ts +0 -400
  82. package/test/permission-forwarder.test.ts +0 -370
  83. package/test/permission-forwarding.test.ts +0 -315
  84. package/test/permission-gate.test.ts +0 -269
  85. package/test/permission-manager-unified.test.ts +0 -3714
  86. package/test/permission-merge.test.ts +0 -61
  87. package/test/permission-prompter.test.ts +0 -518
  88. package/test/permission-prompts.test.ts +0 -363
  89. package/test/permission-resolver.test.ts +0 -277
  90. package/test/permission-session.test.ts +0 -404
  91. package/test/permission-ui-prompt.test.ts +0 -146
  92. package/test/permissions-service.test.ts +0 -192
  93. package/test/pi-infrastructure-read.test.ts +0 -432
  94. package/test/policy-loader.test.ts +0 -561
  95. package/test/prompting-gateway.test.ts +0 -231
  96. package/test/rule.test.ts +0 -650
  97. package/test/safe-system-paths.test.ts +0 -46
  98. package/test/scope-merge.test.ts +0 -116
  99. package/test/service-lifecycle.test.ts +0 -163
  100. package/test/service.test.ts +0 -261
  101. package/test/session-approval.test.ts +0 -75
  102. package/test/session-logger.test.ts +0 -200
  103. package/test/session-rules.test.ts +0 -321
  104. package/test/session-start.test.ts +0 -112
  105. package/test/skill-prompt-sanitizer.test.ts +0 -418
  106. package/test/status.test.ts +0 -10
  107. package/test/subagent-context.test.ts +0 -372
  108. package/test/subagent-lifecycle-events.test.ts +0 -132
  109. package/test/subagent-registry.test.ts +0 -145
  110. package/test/synthesize.test.ts +0 -302
  111. package/test/system-prompt-sanitizer.test.ts +0 -382
  112. package/test/tool-access-extractor-registry.test.ts +0 -77
  113. package/test/tool-input-formatter-registry.test.ts +0 -75
  114. package/test/tool-input-path.test.ts +0 -84
  115. package/test/tool-input-preview.test.ts +0 -129
  116. package/test/tool-input-prompt-formatters.test.ts +0 -115
  117. package/test/tool-preview-formatter.test.ts +0 -458
  118. package/test/tool-registry.test.ts +0 -197
  119. package/test/value-guards.test.ts +0 -193
  120. package/test/wildcard-matcher.test.ts +0 -424
  121. package/test/yaml-frontmatter.test.ts +0 -91
  122. package/test/yolo-mode.test.ts +0 -188
@@ -1,155 +0,0 @@
1
- import { afterEach, describe, expect, test, vi } from "vitest";
2
- import {
3
- ACTIVE_AGENT_TAG_REGEX,
4
- type ActiveAgentContext,
5
- getActiveAgentName,
6
- getActiveAgentNameFromSystemPrompt,
7
- normalizeAgentName,
8
- type SessionEntryView,
9
- } from "#src/active-agent";
10
-
11
- afterEach(() => {
12
- vi.restoreAllMocks();
13
- });
14
-
15
- function makeCtx(entries: SessionEntryView[]): ActiveAgentContext {
16
- return {
17
- sessionManager: {
18
- getEntries: vi.fn(() => entries),
19
- },
20
- };
21
- }
22
-
23
- describe("ACTIVE_AGENT_TAG_REGEX", () => {
24
- test("matches double-quoted name attribute", () => {
25
- const match = '<active_agent name="my-agent">'.match(
26
- ACTIVE_AGENT_TAG_REGEX,
27
- );
28
- expect(match?.[1]).toBe("my-agent");
29
- });
30
-
31
- test("matches single-quoted name attribute", () => {
32
- const match = "<active_agent name='my-agent'>".match(
33
- ACTIVE_AGENT_TAG_REGEX,
34
- );
35
- expect(match?.[1]).toBe("my-agent");
36
- });
37
-
38
- test("is case-insensitive", () => {
39
- const match = '<ACTIVE_AGENT name="bot">'.match(ACTIVE_AGENT_TAG_REGEX);
40
- expect(match?.[1]).toBe("bot");
41
- });
42
-
43
- test("does not match when tag is absent", () => {
44
- expect("no tag here".match(ACTIVE_AGENT_TAG_REGEX)).toBeNull();
45
- });
46
- });
47
-
48
- describe("normalizeAgentName", () => {
49
- test("returns trimmed string for valid input", () => {
50
- expect(normalizeAgentName(" my-agent ")).toBe("my-agent");
51
- });
52
-
53
- test("returns null for empty string", () => {
54
- expect(normalizeAgentName("")).toBeNull();
55
- });
56
-
57
- test("returns null for whitespace-only string", () => {
58
- expect(normalizeAgentName(" ")).toBeNull();
59
- });
60
-
61
- test("returns null for non-string values", () => {
62
- expect(normalizeAgentName(null)).toBeNull();
63
- expect(normalizeAgentName(undefined)).toBeNull();
64
- expect(normalizeAgentName(42)).toBeNull();
65
- expect(normalizeAgentName({})).toBeNull();
66
- });
67
- });
68
-
69
- describe("getActiveAgentName", () => {
70
- test("returns null when session has no entries", () => {
71
- expect(getActiveAgentName(makeCtx([]))).toBeNull();
72
- });
73
-
74
- test("returns null when no active_agent custom entry exists", () => {
75
- const ctx = makeCtx([{ type: "message", data: { name: "agent" } }]);
76
- expect(getActiveAgentName(ctx)).toBeNull();
77
- });
78
-
79
- test("returns agent name from active_agent entry", () => {
80
- const ctx = makeCtx([
81
- { type: "custom", customType: "active_agent", data: { name: "bot" } },
82
- ]);
83
- expect(getActiveAgentName(ctx)).toBe("bot");
84
- });
85
-
86
- test("last-entry-wins: returns name from the last matching entry", () => {
87
- const ctx = makeCtx([
88
- { type: "custom", customType: "active_agent", data: { name: "first" } },
89
- { type: "custom", customType: "active_agent", data: { name: "last" } },
90
- ]);
91
- expect(getActiveAgentName(ctx)).toBe("last");
92
- });
93
-
94
- test("entry with name: null resets agent name to null", () => {
95
- const ctx = makeCtx([
96
- { type: "custom", customType: "active_agent", data: { name: "bot" } },
97
- { type: "custom", customType: "active_agent", data: { name: null } },
98
- ]);
99
- expect(getActiveAgentName(ctx)).toBeNull();
100
- });
101
-
102
- test("skips entries with whitespace-only name and continues scanning", () => {
103
- const ctx = makeCtx([
104
- { type: "custom", customType: "active_agent", data: { name: "first" } },
105
- { type: "custom", customType: "active_agent", data: { name: " " } },
106
- ]);
107
- // " " normalizes to null — not a sentinel reset, keeps scanning backwards
108
- expect(getActiveAgentName(ctx)).toBe("first");
109
- });
110
-
111
- test("ignores entries with wrong customType", () => {
112
- const ctx = makeCtx([
113
- { type: "custom", customType: "something_else", data: { name: "bot" } },
114
- ]);
115
- expect(getActiveAgentName(ctx)).toBeNull();
116
- });
117
-
118
- test("ignores entries with wrong type", () => {
119
- const ctx = makeCtx([
120
- { type: "tool_call", customType: "active_agent", data: { name: "bot" } },
121
- ]);
122
- expect(getActiveAgentName(ctx)).toBeNull();
123
- });
124
- });
125
-
126
- describe("getActiveAgentNameFromSystemPrompt", () => {
127
- test("returns null for undefined system prompt", () => {
128
- expect(getActiveAgentNameFromSystemPrompt(undefined)).toBeNull();
129
- });
130
-
131
- test("returns null for empty system prompt", () => {
132
- expect(getActiveAgentNameFromSystemPrompt("")).toBeNull();
133
- });
134
-
135
- test("returns null when tag is absent", () => {
136
- expect(
137
- getActiveAgentNameFromSystemPrompt("You are a helpful assistant."),
138
- ).toBeNull();
139
- });
140
-
141
- test("extracts agent name from tag in system prompt", () => {
142
- const prompt = 'You are helpful.\n<active_agent name="my-bot">\nDo work.';
143
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBe("my-bot");
144
- });
145
-
146
- test("returns null when tag name is empty", () => {
147
- const prompt = '<active_agent name="">';
148
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBeNull();
149
- });
150
-
151
- test("trims whitespace from extracted name", () => {
152
- const prompt = '<active_agent name=" trimmed ">';
153
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBe("trimmed");
154
- });
155
- });
@@ -1,48 +0,0 @@
1
- import { describe, expect, it, vi } from "vitest";
2
-
3
- import { memoizeAsyncWithRetry } from "#src/async-cache";
4
-
5
- describe("memoizeAsyncWithRetry", () => {
6
- it("invokes the factory once and shares the resolved value across calls", async () => {
7
- const factory = vi.fn<() => Promise<number>>().mockResolvedValue(42);
8
- const memoized = memoizeAsyncWithRetry(factory);
9
-
10
- const results = await Promise.all([memoized(), memoized(), memoized()]);
11
-
12
- expect(results).toEqual([42, 42, 42]);
13
- expect(factory).toHaveBeenCalledTimes(1);
14
- });
15
-
16
- it("caches the same promise instance on success", async () => {
17
- const factory = vi.fn<() => Promise<string>>().mockResolvedValue("parser");
18
- const memoized = memoizeAsyncWithRetry(factory);
19
-
20
- await memoized();
21
- await memoized();
22
-
23
- expect(factory).toHaveBeenCalledTimes(1);
24
- });
25
-
26
- it("surfaces the rejection to the caller each time the factory fails", async () => {
27
- const error = new Error("init failed");
28
- const factory = vi.fn<() => Promise<number>>().mockRejectedValue(error);
29
- const memoized = memoizeAsyncWithRetry(factory);
30
-
31
- await expect(memoized()).rejects.toThrow("init failed");
32
- await expect(memoized()).rejects.toThrow("init failed");
33
- });
34
-
35
- it("drops a rejected result so the next call re-invokes the factory", async () => {
36
- const factory = vi
37
- .fn<() => Promise<number>>()
38
- .mockRejectedValueOnce(new Error("transient"))
39
- .mockResolvedValue(7);
40
- const memoized = memoizeAsyncWithRetry(factory);
41
-
42
- await expect(memoized()).rejects.toThrow("transient");
43
- const recovered = await memoized();
44
-
45
- expect(recovered).toBe(7);
46
- expect(factory).toHaveBeenCalledTimes(2);
47
- });
48
- });
@@ -1,144 +0,0 @@
1
- import { describe, expect, it } from "vitest";
2
- import { ARITY, prefix, stripBashCommentLines } from "#src/bash-arity";
3
-
4
- describe("ARITY dictionary", () => {
5
- it("is exported as a plain object", () => {
6
- expect(typeof ARITY).toBe("object");
7
- });
8
-
9
- it("maps 'git' to arity 2", () => {
10
- expect(ARITY.git).toBe(2);
11
- });
12
-
13
- it("maps 'npm run' to arity 3", () => {
14
- expect(ARITY["npm run"]).toBe(3);
15
- });
16
-
17
- it("maps 'npm' to arity 2 (fallback when 'npm run' does not match)", () => {
18
- expect(ARITY.npm).toBe(2);
19
- });
20
-
21
- it("maps 'docker compose' to arity 3", () => {
22
- expect(ARITY["docker compose"]).toBe(3);
23
- });
24
-
25
- it("maps 'docker' to arity 2 (fallback)", () => {
26
- expect(ARITY.docker).toBe(2);
27
- });
28
- });
29
-
30
- describe("prefix", () => {
31
- it("returns empty array for empty input", () => {
32
- expect(prefix([])).toEqual([]);
33
- });
34
-
35
- it("returns single-element array for a bare known command", () => {
36
- // 'git' alone has arity 2 but only 1 token is available — clamp.
37
- expect(prefix(["git"])).toEqual(["git"]);
38
- });
39
-
40
- it("returns arity-2 prefix for git subcommands", () => {
41
- expect(prefix(["git", "checkout", "main"])).toEqual(["git", "checkout"]);
42
- });
43
-
44
- it("returns arity-2 prefix for git status with flags", () => {
45
- expect(prefix(["git", "status", "--short"])).toEqual(["git", "status"]);
46
- });
47
-
48
- it("returns arity-3 prefix for npm run (longest match wins over npm arity-2)", () => {
49
- expect(prefix(["npm", "run", "dev"])).toEqual(["npm", "run", "dev"]);
50
- });
51
-
52
- it("returns arity-2 prefix for npm install (npm fallback, npm run does not match)", () => {
53
- expect(prefix(["npm", "install", "lodash"])).toEqual(["npm", "install"]);
54
- });
55
-
56
- it("returns arity-3 prefix for docker compose subcommands", () => {
57
- expect(prefix(["docker", "compose", "up", "--build"])).toEqual([
58
- "docker",
59
- "compose",
60
- "up",
61
- ]);
62
- });
63
-
64
- it("returns arity-2 prefix for docker pull (docker fallback)", () => {
65
- expect(prefix(["docker", "pull", "ubuntu"])).toEqual(["docker", "pull"]);
66
- });
67
-
68
- it("returns arity-1 prefix for unknown commands", () => {
69
- expect(prefix(["unknown-tool", "--flag"])).toEqual(["unknown-tool"]);
70
- });
71
-
72
- it("returns arity-1 prefix for rm (args are targets, not subcommands)", () => {
73
- expect(prefix(["rm", "-rf", "node_modules"])).toEqual(["rm"]);
74
- });
75
-
76
- it("returns arity-1 prefix for cat", () => {
77
- expect(prefix(["cat", "file.txt"])).toEqual(["cat"]);
78
- });
79
-
80
- it("is case-insensitive: 'Git' looks up as 'git'", () => {
81
- // Tokens are preserved as-is; only the lookup key is lowercased.
82
- expect(prefix(["Git", "checkout", "main"])).toEqual(["Git", "checkout"]);
83
- });
84
-
85
- it("clamps arity to available token count when command is shorter than arity", () => {
86
- // npm run has arity 3; only ["npm", "run"] provided → return both.
87
- expect(prefix(["npm", "run"])).toEqual(["npm", "run"]);
88
- });
89
-
90
- it("returns arity-2 prefix for pnpm run (longest match wins over pnpm)", () => {
91
- // pnpm run <script> — arity 3 means include the script name.
92
- expect(prefix(["pnpm", "run", "build"])).toEqual(["pnpm", "run", "build"]);
93
- });
94
-
95
- it("returns arity-2 prefix for cargo subcommands", () => {
96
- expect(prefix(["cargo", "build", "--release"])).toEqual(["cargo", "build"]);
97
- });
98
-
99
- it("returns arity-2 prefix for kubectl subcommands", () => {
100
- expect(prefix(["kubectl", "get", "pods"])).toEqual(["kubectl", "get"]);
101
- });
102
-
103
- it("returns arity-1 for bare 'ls' (args are paths)", () => {
104
- expect(prefix(["ls", "-la", "/tmp"])).toEqual(["ls"]);
105
- });
106
- });
107
-
108
- describe("stripBashCommentLines", () => {
109
- it("removes a single leading comment line", () => {
110
- expect(
111
- stripBashCommentLines("# Check debug logs\nfind /home -type f"),
112
- ).toBe("find /home -type f");
113
- });
114
-
115
- it("removes multiple leading comment lines", () => {
116
- expect(
117
- stripBashCommentLines("# Step 1\n# Step 2\ngit status --short"),
118
- ).toBe("git status --short");
119
- });
120
-
121
- it("returns empty string when all lines are comments", () => {
122
- expect(stripBashCommentLines("# just a comment")).toBe("");
123
- });
124
-
125
- it("returns empty string for blank input", () => {
126
- expect(stripBashCommentLines("")).toBe("");
127
- });
128
-
129
- it("returns the command unchanged when no comment lines are present", () => {
130
- expect(stripBashCommentLines("grep -rn foo src/")).toBe(
131
- "grep -rn foo src/",
132
- );
133
- });
134
-
135
- it("trims surrounding whitespace from the result", () => {
136
- expect(stripBashCommentLines("\n\n ls -la \n")).toBe("ls -la");
137
- });
138
-
139
- it("treats indented comment lines as comments", () => {
140
- expect(stripBashCommentLines(" # indented comment\necho hi")).toBe(
141
- "echo hi",
142
- );
143
- });
144
- });