@gotgenes/pi-permission-system 18.1.1 → 18.2.0

package/test/detect-permissive-bash-fallback.test.ts

@@ -1,56 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { detectPermissiveBashFallback } from "#src/config-loader";
-import type { FlatPermissionConfig } from "#src/types";
-
-describe("detectPermissiveBashFallback", () => {
-  it("warns when top-level '*' is allow and bash is absent", () => {
-    const permission: FlatPermissionConfig = { "*": "allow" };
-
-    const issue = detectPermissiveBashFallback(permission);
-
-    expect(issue).toBeDefined();
-    expect(issue).toContain("bash");
-    expect(issue).toContain("allow");
-  });
-
-  it("warns when top-level '*' is allow and bash map has no '*' key", () => {
-    const permission: FlatPermissionConfig = {
-      "*": "allow",
-      bash: { "git *": "ask" },
-    };
-
-    expect(detectPermissiveBashFallback(permission)).toBeDefined();
-  });
-
-  it("does not warn when bash is a bare string surface", () => {
-    const permission: FlatPermissionConfig = { "*": "allow", bash: "ask" };
-
-    expect(detectPermissiveBashFallback(permission)).toBeUndefined();
-  });
-
-  it("does not warn when bash map has an explicit '*' key", () => {
-    const permission: FlatPermissionConfig = {
-      "*": "allow",
-      bash: { "*": "ask", "git *": "allow" },
-    };
-
-    expect(detectPermissiveBashFallback(permission)).toBeUndefined();
-  });
-
-  it("does not warn when top-level '*' is not allow", () => {
-    const permission: FlatPermissionConfig = { "*": "ask" };
-
-    expect(detectPermissiveBashFallback(permission)).toBeUndefined();
-  });
-
-  it("does not warn when top-level '*' is absent", () => {
-    const permission: FlatPermissionConfig = { bash: { "git *": "ask" } };
-
-    expect(detectPermissiveBashFallback(permission)).toBeUndefined();
-  });
-
-  it("does not warn when permission is undefined", () => {
-    expect(detectPermissiveBashFallback(undefined)).toBeUndefined();
-  });
-});

package/test/expand-home.test.ts

@@ -1,93 +0,0 @@
-import { join } from "node:path";
-import { afterEach, describe, expect, test, vi } from "vitest";
-
-const mockHomedir = vi.hoisted(() => vi.fn(() => "/home/testuser"));
-
-vi.mock("node:os", () => ({
-  homedir: mockHomedir,
-  default: { homedir: mockHomedir },
-}));
-
-import { expandHomePath } from "#src/expand-home";
-
-const FAKE_HOME = "/home/testuser";
-
-afterEach(() => {
-  mockHomedir.mockClear();
-});
-
-describe("expandHomePath", () => {
-  describe("~ expansion", () => {
-    test("bare ~ expands to homedir()", () => {
-      expect(expandHomePath("~")).toBe(FAKE_HOME);
-    });
-
-    test("~/path expands to homedir()/path", () => {
-      expect(expandHomePath("~/dev/project")).toBe(
-        join(FAKE_HOME, "dev/project"),
-      );
-    });
-
-    test("~/path/* expands to homedir()/path/*", () => {
-      expect(expandHomePath("~/dev/*")).toBe(join(FAKE_HOME, "dev/*"));
-    });
-
-    test("~\\ (Windows separator) expands to homedir() + rest", () => {
-      expect(expandHomePath("~\\dev\\project")).toBe(
-        join(FAKE_HOME, "dev\\project"),
-      );
-    });
-
-    test("~username (no separator) is not expanded (no-op)", () => {
-      expect(expandHomePath("~username")).toBe("~username");
-    });
-  });
-
-  describe("$HOME expansion", () => {
-    test("bare $HOME expands to homedir()", () => {
-      expect(expandHomePath("$HOME")).toBe(FAKE_HOME);
-    });
-
-    test("$HOME/path expands to homedir()/path", () => {
-      expect(expandHomePath("$HOME/dev/project")).toBe(
-        join(FAKE_HOME, "dev/project"),
-      );
-    });
-
-    test("$HOME/path/* expands to homedir()/path/*", () => {
-      expect(expandHomePath("$HOME/dev/*")).toBe(join(FAKE_HOME, "dev/*"));
-    });
-
-    test("$HOME\\ (Windows separator) expands to homedir() + rest", () => {
-      expect(expandHomePath("$HOME\\dev\\project")).toBe(
-        join(FAKE_HOME, "dev\\project"),
-      );
-    });
-
-    test("$HOMEDIR (no separator) is not expanded (no-op)", () => {
-      expect(expandHomePath("$HOMEDIR")).toBe("$HOMEDIR");
-    });
-  });
-
-  describe("no-op patterns", () => {
-    test("absolute path is unchanged", () => {
-      expect(expandHomePath("/usr/local/bin")).toBe("/usr/local/bin");
-    });
-
-    test("relative path is unchanged", () => {
-      expect(expandHomePath("dev/project")).toBe("dev/project");
-    });
-
-    test("glob-only pattern is unchanged", () => {
-      expect(expandHomePath("*")).toBe("*");
-    });
-
-    test("empty string is unchanged", () => {
-      expect(expandHomePath("")).toBe("");
-    });
-
-    test("bash command pattern starting with a word is unchanged", () => {
-      expect(expandHomePath("git push *")).toBe("git push *");
-    });
-  });
-});

package/test/extension-config.test.ts

@@ -1,129 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import {
-  detectMisplacedPermissionKeys,
-  normalizePermissionSystemConfig,
-} from "#src/extension-config";
-
-describe("detectMisplacedPermissionKeys", () => {
-  it("returns an empty array for a record with only valid extension keys", () => {
-    const result = detectMisplacedPermissionKeys({
-      debugLog: true,
-      permissionReviewLog: true,
-      yoloMode: false,
-    });
-    expect(result).toEqual([]);
-  });
-
-  it("returns an empty array for an empty record", () => {
-    const result = detectMisplacedPermissionKeys({});
-    expect(result).toEqual([]);
-  });
-
-  it("returns misplaced key names when legacy permission-rule keys are present", () => {
-    const result = detectMisplacedPermissionKeys({
-      debugLog: true,
-      defaultPolicy: { tools: "ask" },
-      bash: { "git status": "allow" },
-    });
-    expect(result).toEqual(["defaultPolicy", "bash"]);
-  });
-
-  it("detects all known legacy permission-rule keys", () => {
-    const result = detectMisplacedPermissionKeys({
-      defaultPolicy: {},
-      tools: {},
-      bash: {},
-      mcp: {},
-      skills: {},
-      special: {},
-      external_directory: {},
-    });
-    expect(result).toEqual([
-      "defaultPolicy",
-      "tools",
-      "bash",
-      "mcp",
-      "skills",
-      "special",
-      "external_directory",
-    ]);
-  });
-
-  it("does not detect doom_loop as a misplaced permission key", () => {
-    const result = detectMisplacedPermissionKeys({
-      doom_loop: {},
-    });
-    expect(result).toEqual([]);
-  });
-
-  it("does not flag the new flat-format permission key as misplaced", () => {
-    const result = detectMisplacedPermissionKeys({
-      debugLog: false,
-      permission: { "*": "ask" },
-    });
-    expect(result).toEqual([]);
-  });
-
-  it("ignores unknown keys that are not permission-rule keys", () => {
-    const result = detectMisplacedPermissionKeys({
-      debugLog: true,
-      someRandomKey: "value",
-    });
-    expect(result).toEqual([]);
-  });
-});
-
-describe("normalizePermissionSystemConfig", () => {
-  it("normalizes a valid config object", () => {
-    const result = normalizePermissionSystemConfig({
-      debugLog: true,
-      permissionReviewLog: false,
-      yoloMode: true,
-    });
-    expect(result).toEqual({
-      debugLog: true,
-      permissionReviewLog: false,
-      yoloMode: true,
-    });
-  });
-
-  it("defaults debugLog to false when missing", () => {
-    const result = normalizePermissionSystemConfig({});
-    expect(result.debugLog).toBe(false);
-  });
-
-  it("defaults permissionReviewLog to true when missing", () => {
-    const result = normalizePermissionSystemConfig({});
-    expect(result.permissionReviewLog).toBe(true);
-  });
-
-  it("defaults yoloMode to false when missing", () => {
-    const result = normalizePermissionSystemConfig({});
-    expect(result.yoloMode).toBe(false);
-  });
-
-  it("includes toolInputPreviewMaxLength when a valid positive integer is provided", () => {
-    const result = normalizePermissionSystemConfig({
-      toolInputPreviewMaxLength: 400,
-    });
-    expect(result.toolInputPreviewMaxLength).toBe(400);
-  });
-
-  it("omits toolInputPreviewMaxLength when absent", () => {
-    const result = normalizePermissionSystemConfig({});
-    expect("toolInputPreviewMaxLength" in result).toBe(false);
-  });
-
-  it("includes toolTextSummaryMaxLength when a valid positive integer is provided", () => {
-    const result = normalizePermissionSystemConfig({
-      toolTextSummaryMaxLength: 120,
-    });
-    expect(result.toolTextSummaryMaxLength).toBe(120);
-  });
-
-  it("omits toolTextSummaryMaxLength when absent", () => {
-    const result = normalizePermissionSystemConfig({});
-    expect("toolTextSummaryMaxLength" in result).toBe(false);
-  });
-});

package/test/extension-paths.test.ts

@@ -1,108 +0,0 @@
-import { join } from "node:path";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const { mockDiscoverGlobalNodeModulesRoot } = vi.hoisted(() => ({
-  mockDiscoverGlobalNodeModulesRoot: vi.fn<() => string | null>(),
-}));
-
-vi.mock("../src/node-modules-discovery", () => ({
-  discoverGlobalNodeModulesRoot: mockDiscoverGlobalNodeModulesRoot,
-}));
-
-import { getGlobalLogsDir } from "#src/config-paths";
-import { computeExtensionPaths } from "#src/extension-paths";
-
-describe("computeExtensionPaths", () => {
-  beforeEach(() => {
-    mockDiscoverGlobalNodeModulesRoot.mockReset();
-    mockDiscoverGlobalNodeModulesRoot.mockReturnValue(
-      "/mock/global/node_modules",
-    );
-  });
-
-  it("sets agentDir from argument", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.agentDir).toBe("/test/agent");
-  });
-
-  it("derives sessionsDir as agentDir/sessions", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.sessionsDir).toBe("/test/agent/sessions");
-  });
-
-  it("derives subagentSessionsDir as agentDir/subagent-sessions", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.subagentSessionsDir).toBe("/test/agent/subagent-sessions");
-  });
-
-  it("derives forwardingDir as sessionsDir/permission-forwarding", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.forwardingDir).toBe(
-      join("/test/agent/sessions", "permission-forwarding"),
-    );
-  });
-
-  it("derives globalLogsDir via getGlobalLogsDir(agentDir)", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.globalLogsDir).toBe(getGlobalLogsDir("/test/agent"));
-  });
-
-  it("includes agentDir in piInfrastructureDirs", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.piInfrastructureDirs).toContain("/test/agent");
-  });
-
-  it("includes agentDir/git in piInfrastructureDirs", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.piInfrastructureDirs).toContain("/test/agent/git");
-  });
-
-  it("includes discovered global node_modules root in piInfrastructureDirs", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.piInfrastructureDirs).toContain("/mock/global/node_modules");
-  });
-
-  it("omits global node_modules from piInfrastructureDirs when discovery returns null", () => {
-    mockDiscoverGlobalNodeModulesRoot.mockReturnValue(null);
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.piInfrastructureDirs).toHaveLength(2);
-    expect(paths.piInfrastructureDirs).toContain("/test/agent");
-    expect(paths.piInfrastructureDirs).toContain("/test/agent/git");
-  });
-
-  it("all entries in piInfrastructureDirs are strings (no null)", () => {
-    mockDiscoverGlobalNodeModulesRoot.mockReturnValue(null);
-    const paths = computeExtensionPaths("/test/agent");
-    for (const dir of paths.piInfrastructureDirs) {
-      expect(typeof dir).toBe("string");
-    }
-  });
-
-  it("includes piPackageDir in piInfrastructureDirs when provided", () => {
-    const paths = computeExtensionPaths("/test/agent", "/pi/install");
-    expect(paths.piInfrastructureDirs).toContain("/pi/install");
-  });
-
-  it("omits piPackageDir when not provided (current behavior preserved)", () => {
-    const paths = computeExtensionPaths("/test/agent");
-    expect(paths.piInfrastructureDirs).toEqual([
-      "/test/agent",
-      "/test/agent/git",
-      "/mock/global/node_modules",
-    ]);
-  });
-
-  it("omits piPackageDir when given an empty string", () => {
-    const paths = computeExtensionPaths("/test/agent", "");
-    expect(paths.piInfrastructureDirs).not.toContain("");
-  });
-
-  it("two calls with different agentDirs produce independent results", () => {
-    const a = computeExtensionPaths("/agent/a");
-    const b = computeExtensionPaths("/agent/b");
-    expect(a.agentDir).toBe("/agent/a");
-    expect(b.agentDir).toBe("/agent/b");
-    expect(a.sessionsDir).toBe("/agent/a/sessions");
-    expect(b.sessionsDir).toBe("/agent/b/sessions");
-  });
-});

package/test/forwarded-permissions/io.test.ts

@@ -1,251 +0,0 @@
-import {
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-import {
-  cleanupPermissionForwardingLocationIfEmpty,
-  formatUnknownErrorMessage,
-  isErrnoCode,
-  logPermissionForwardingError,
-  logPermissionForwardingWarning,
-  tryRemoveDirectoryIfEmpty,
-} from "#src/forwarded-permissions/io";
-import { createPermissionForwardingLocation } from "#src/permission-forwarding";
-import type { DebugReviewLogger } from "#src/session-logger";
-
-// ── helpers ────────────────────────────────────────────────────────────────
-
-function makeLogger(): DebugReviewLogger {
-  return {
-    review: vi.fn(),
-    debug: vi.fn(),
-  };
-}
-
-// ── formatUnknownErrorMessage ──────────────────────────────────────────────
-
-describe("formatUnknownErrorMessage", () => {
-  it("returns the error message for Error instances", () => {
-    expect(formatUnknownErrorMessage(new Error("oops"))).toBe("oops");
-  });
-
-  it("converts non-Error values to string", () => {
-    expect(formatUnknownErrorMessage("raw string")).toBe("raw string");
-    expect(formatUnknownErrorMessage(42)).toBe("42");
-  });
-
-  it("falls back to String(error) for Error with empty message", () => {
-    // error.message is falsy (""), so the function falls through to String(error)
-    const e = new Error("");
-    expect(formatUnknownErrorMessage(e)).toBe("Error");
-  });
-});
-
-// ── isErrnoCode ────────────────────────────────────────────────────────────
-
-describe("isErrnoCode", () => {
-  it("returns true when code matches", () => {
-    expect(isErrnoCode({ code: "ENOENT" }, "ENOENT")).toBe(true);
-  });
-
-  it("returns false when code does not match", () => {
-    expect(isErrnoCode({ code: "EACCES" }, "ENOENT")).toBe(false);
-  });
-
-  it("returns false for null", () => {
-    expect(isErrnoCode(null, "ENOENT")).toBe(false);
-  });
-
-  it("returns false when no code property", () => {
-    expect(isErrnoCode({}, "ENOENT")).toBe(false);
-  });
-});
-
-// ── logPermissionForwardingWarning ─────────────────────────────────────────
-
-describe("logPermissionForwardingWarning", () => {
-  it("calls logger.review with the warning event", () => {
-    const logger = makeLogger();
-    logPermissionForwardingWarning(logger, "something went wrong");
-    expect(logger.review).toHaveBeenCalledWith(
-      "permission_forwarding.warning",
-      { message: "something went wrong" },
-    );
-  });
-
-  it("calls logger.debug with the warning event", () => {
-    const logger = makeLogger();
-    logPermissionForwardingWarning(logger, "something went wrong");
-    expect(logger.debug).toHaveBeenCalledWith("permission_forwarding.warning", {
-      message: "something went wrong",
-    });
-  });
-
-  it("includes formatted error when an error is provided", () => {
-    const logger = makeLogger();
-    logPermissionForwardingWarning(logger, "bad thing", new Error("fs fail"));
-    expect(logger.review).toHaveBeenCalledWith(
-      "permission_forwarding.warning",
-      { message: "bad thing", error: "fs fail" },
-    );
-  });
-
-  it("does not throw when logger is null", () => {
-    expect(() => logPermissionForwardingWarning(null, "ignored")).not.toThrow();
-  });
-
-  it("does not call anything when logger is null", () => {
-    // Verify the null-logger path is a true no-op — cannot easily spy on null,
-    // but we can verify the call succeeds silently.
-    expect(() =>
-      logPermissionForwardingWarning(null, "msg", new Error("err")),
-    ).not.toThrow();
-  });
-});
-
-// ── logPermissionForwardingError ───────────────────────────────────────────
-
-describe("logPermissionForwardingError", () => {
-  it("calls logger.review with the error event", () => {
-    const logger = makeLogger();
-    logPermissionForwardingError(logger, "critical failure");
-    expect(logger.review).toHaveBeenCalledWith("permission_forwarding.error", {
-      message: "critical failure",
-    });
-  });
-
-  it("calls logger.debug with the error event", () => {
-    const logger = makeLogger();
-    logPermissionForwardingError(logger, "critical failure");
-    expect(logger.debug).toHaveBeenCalledWith("permission_forwarding.error", {
-      message: "critical failure",
-    });
-  });
-
-  it("includes formatted error when an error is provided", () => {
-    const logger = makeLogger();
-    logPermissionForwardingError(logger, "io error", new Error("ENOENT"));
-    expect(logger.review).toHaveBeenCalledWith("permission_forwarding.error", {
-      message: "io error",
-      error: "ENOENT",
-    });
-  });
-
-  it("does not throw when logger is null", () => {
-    expect(() => logPermissionForwardingError(null, "ignored")).not.toThrow();
-  });
-});
-
-// ── tryRemoveDirectoryIfEmpty ──────────────────────────────────────────────
-
-describe("tryRemoveDirectoryIfEmpty", () => {
-  let root: string;
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-  });
-
-  it("returns true when the directory does not exist", () => {
-    root = mkdtempSync(join(tmpdir(), "io-test-"));
-    const absent = join(root, "nonexistent");
-    expect(tryRemoveDirectoryIfEmpty(null, absent, "test")).toBe(true);
-  });
-
-  it("returns true and removes an empty directory", () => {
-    root = mkdtempSync(join(tmpdir(), "io-test-"));
-    const dir = join(root, "empty");
-    mkdirSync(dir);
-    expect(tryRemoveDirectoryIfEmpty(null, dir, "test")).toBe(true);
-    expect(existsSync(dir)).toBe(false);
-  });
-
-  it("returns false and leaves a non-empty directory in place", () => {
-    root = mkdtempSync(join(tmpdir(), "io-test-"));
-    const dir = join(root, "nonempty");
-    mkdirSync(dir);
-    writeFileSync(join(dir, "file.json"), "{}", "utf-8");
-    expect(tryRemoveDirectoryIfEmpty(null, dir, "test")).toBe(false);
-    expect(existsSync(dir)).toBe(true);
-  });
-});
-
-// ── cleanupPermissionForwardingLocationIfEmpty ─────────────────────────────
-
-describe("cleanupPermissionForwardingLocationIfEmpty", () => {
-  let root: string;
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-  });
-
-  it("preserves responses/ when requests/ is non-empty (the concurrent-request race)", () => {
-    root = mkdtempSync(join(tmpdir(), "io-cleanup-"));
-    const forwardingDir = join(root, "forwarding");
-    const location = createPermissionForwardingLocation(
-      forwardingDir,
-      "parent-session",
-    );
-    // Simulate: requests/ has a pending file, responses/ is momentarily empty
-    mkdirSync(location.requestsDir, { recursive: true });
-    mkdirSync(location.responsesDir, { recursive: true });
-    writeFileSync(join(location.requestsDir, "req-b.json"), "{}", "utf-8");
-    // responses/ is empty (sibling subagent A already cleaned up its response)
-
-    cleanupPermissionForwardingLocationIfEmpty(null, location);
-
-    // requests/ is non-empty → should NOT be removed
-    expect(existsSync(location.requestsDir)).toBe(true);
-    // responses/ must survive — removing it causes the ENOENT write loop
-    expect(existsSync(location.responsesDir)).toBe(true);
-    // sessionRoot must also survive while subdirs are present
-    expect(existsSync(location.sessionRootDir)).toBe(true);
-  });
-
-  it("removes both subdirs and sessionRoot when both are empty (normal serial cleanup)", () => {
-    root = mkdtempSync(join(tmpdir(), "io-cleanup-"));
-    const forwardingDir = join(root, "forwarding");
-    const location = createPermissionForwardingLocation(
-      forwardingDir,
-      "parent-session",
-    );
-    mkdirSync(location.requestsDir, { recursive: true });
-    mkdirSync(location.responsesDir, { recursive: true });
-    // Both empty — normal end-of-lifecycle state
-
-    cleanupPermissionForwardingLocationIfEmpty(null, location);
-
-    expect(existsSync(location.requestsDir)).toBe(false);
-    expect(existsSync(location.responsesDir)).toBe(false);
-    expect(existsSync(location.sessionRootDir)).toBe(false);
-  });
-
-  it("leaves responses/ in place when it is non-empty even if requests/ is empty", () => {
-    root = mkdtempSync(join(tmpdir(), "io-cleanup-"));
-    const forwardingDir = join(root, "forwarding");
-    const location = createPermissionForwardingLocation(
-      forwardingDir,
-      "parent-session",
-    );
-    mkdirSync(location.requestsDir, { recursive: true });
-    mkdirSync(location.responsesDir, { recursive: true });
-    writeFileSync(join(location.responsesDir, "resp.json"), "{}", "utf-8");
-    // requests/ is empty, responses/ has a stale response
-
-    cleanupPermissionForwardingLocationIfEmpty(null, location);
-
-    // requests/ is empty so it gets removed
-    expect(existsSync(location.requestsDir)).toBe(false);
-    // responses/ is non-empty → survives
-    expect(existsSync(location.responsesDir)).toBe(true);
-    // sessionRoot survives because responses/ is still present
-    expect(existsSync(location.sessionRootDir)).toBe(true);
-  });
-});