@gotgenes/pi-permission-system 18.1.1 → 18.2.0

package/test/handlers/gates/bash-external-directory.test.ts

@@ -1,268 +0,0 @@
-import { describe, expect, it } from "vitest";
-import type { AccessIntent } from "#src/access-intent/access-intent";
-import { BashProgram } from "#src/access-intent/bash/program";
-import { describeBashExternalDirectoryGate } from "#src/handlers/gates/bash-external-directory";
-import type {
-  GateBypass,
-  GateDescriptor,
-  GateResult,
-} from "#src/handlers/gates/descriptor";
-import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
-import type { ToolCallContext } from "#src/handlers/gates/types";
-import { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import type { PermissionCheckResult } from "#src/types";
-import { getNonEmptyString, toRecord } from "#src/value-guards";
-
-import { makeResolver } from "#test/helpers/gate-fixtures";
-
-// ── helpers ────────────────────────────────────────────────────────────────
-
-function makeTcc(overrides: Partial<ToolCallContext> = {}): ToolCallContext {
-  return {
-    toolName: "bash",
-    agentName: null,
-    input: { command: "cat /outside/project/file.ts" },
-    toolCallId: "tc-1",
-    cwd: "/test/project",
-    ...overrides,
-  };
-}
-
-function makeCheckResult(
-  state: "allow" | "deny" | "ask",
-  overrides: Partial<PermissionCheckResult> = {},
-): PermissionCheckResult {
-  return {
-    state,
-    toolName: "external_directory",
-    source: "special",
-    origin: "builtin",
-    ...overrides,
-  };
-}
-
-/** Extract the policy match values a resolve(intent) call carries. */
-function intentValues(intent: AccessIntent): readonly string[] {
-  if (intent.kind === "access-path") return intent.path.matchValues();
-  return [];
-}
-
-/**
- * Mirror the handler's parse-once derivation: parse the bash command into a
- * shared `BashProgram` and inject it, exactly as `permission-gate-handler.ts`
- * does, so the gate is exercised through the production wiring.
- */
-async function describeGate(
-  tcc: ToolCallContext,
-  resolver: ScopedPermissionResolver,
-): Promise<GateResult> {
-  const command = getNonEmptyString(toRecord(tcc.input).command);
-  const bashProgram =
-    tcc.toolName === "bash" && command
-      ? await BashProgram.parse(
-          command,
-          new PathNormalizer(process.platform, tcc.cwd),
-        )
-      : null;
-  return describeBashExternalDirectoryGate(tcc, bashProgram, resolver);
-}
-
-// ── tests ──────────────────────────────────────────────────────────────────
-
-describe("describeBashExternalDirectoryGate", () => {
-  it("returns null when tool is not bash", async () => {
-    const result = await describeGate(
-      makeTcc({ toolName: "read" }),
-      makeResolver(makeCheckResult("ask")),
-    );
-    expect(result).toBeNull();
-  });
-
-  it("returns null when command has no external paths", async () => {
-    const result = await describeGate(
-      makeTcc({ input: { command: "ls -la" } }),
-      makeResolver(makeCheckResult("ask")),
-    );
-    expect(result).toBeNull();
-  });
-
-  it("resolves each external path on the external_directory surface via an access-path intent (#418)", async () => {
-    const resolver = makeResolver(makeCheckResult("ask"));
-    await describeGate(
-      makeTcc({ input: { command: "cat /outside/a.ts" } }),
-      resolver,
-    );
-    const intent = resolver.resolve.mock.calls[0][0];
-    expect(intent).toMatchObject({
-      kind: "access-path",
-      surface: "external_directory",
-      agentName: undefined,
-    });
-    expect(intentValues(intent)).toEqual(["/outside/a.ts"]);
-  });
-
-  it("returns GateBypass when all external paths are session-covered", async () => {
-    const resolver = makeResolver(
-      makeCheckResult("allow", { source: "session" }),
-    );
-    const result = await describeGate(makeTcc(), resolver);
-    expect(result).not.toBeNull();
-    expect(isGateBypass(result)).toBe(true);
-    const bypass = result as GateBypass;
-    expect(bypass.action).toBe("allow");
-    expect(bypass.log).toMatchObject({
-      event: "permission_request.session_approved",
-      details: expect.objectContaining({ resolution: "session_approved" }),
-    });
-  });
-
-  it("returns GateDescriptor with multi-pattern sessionApproval for uncovered paths", async () => {
-    const result = await describeGate(
-      makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
-      makeResolver(makeCheckResult("ask")),
-    );
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.sessionApproval).toBeDefined();
-    if (!desc.sessionApproval) return;
-    expect(desc.sessionApproval.patterns.length).toBeGreaterThan(0);
-  });
-
-  it("returns GateBypass when all external paths are config-level allowed", async () => {
-    // Config-level allow (source: "special") should suppress the prompt,
-    // not just session-level allow. This was the bug: source !== "session"
-    // kept config-allowed paths in the uncovered set.
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) =>
-      intentValues(intent).length > 0
-        ? makeCheckResult("allow", { source: "special" })
-        : makeCheckResult("ask"),
-    );
-    const result = await describeGate(makeTcc(), resolver);
-    expect(result).not.toBeNull();
-    expect(isGateBypass(result)).toBe(true);
-  });
-
-  it("uses worst-check state from uncovered paths for preCheck (config deny > catch-all ask)", async () => {
-    // The path-less extCheck used to always return the "*" catch-all (ask),
-    // silently downgrading a config-level deny to ask. After the fix, the
-    // descriptor's preCheck is derived from the actual path check result.
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) =>
-      intentValues(intent).length > 0
-        ? makeCheckResult("deny", { source: "special" })
-        : makeCheckResult("ask"),
-    );
-    const result = await describeGate(makeTcc(), resolver);
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.preCheck?.state).toBe("deny");
-  });
-
-  it("descriptor surface is 'external_directory'", async () => {
-    const result = await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult("ask")),
-    );
-    const desc = result as GateDescriptor;
-    expect(desc.surface).toBe("external_directory");
-  });
-
-  it("descriptor decision surface is 'external_directory'", async () => {
-    const result = await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult("ask")),
-    );
-    const desc = result as GateDescriptor;
-    expect(desc.decision.surface).toBe("external_directory");
-  });
-
-  it("denialContext contains the command and external paths", async () => {
-    const result = await describeGate(
-      makeTcc({ input: { command: "cat /outside/file.ts" } }),
-      makeResolver(makeCheckResult("ask")),
-    );
-    const desc = result as GateDescriptor;
-    expect(desc.denialContext).toMatchObject({
-      kind: "bash_external_directory",
-      command: "cat /outside/file.ts",
-      cwd: "/test/project",
-    });
-  });
-
-  it("promptDetails includes command and tool_call source", async () => {
-    const result = await describeGate(
-      makeTcc({ agentName: "agent-1", toolCallId: "tc-5" }),
-      makeResolver(makeCheckResult("ask")),
-    );
-    const desc = result as GateDescriptor;
-    expect(desc.promptDetails).toMatchObject({
-      source: "tool_call",
-      agentName: "agent-1",
-      toolCallId: "tc-5",
-      toolName: "bash",
-      command: "cat /outside/project/file.ts",
-    });
-  });
-
-  it("config-allowed path is excluded; remaining ask path produces a descriptor", async () => {
-    // One path config-allowed, one config-ask → descriptor with only the ask path.
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) =>
-      intentValues(intent).includes("/outside/a.ts")
-        ? makeCheckResult("allow", { source: "special" })
-        : makeCheckResult("ask"),
-    );
-    const result = await describeGate(
-      makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
-      resolver,
-    );
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.sessionApproval).toBeDefined();
-    if (!desc.sessionApproval) return;
-    expect(desc.sessionApproval.patterns.length).toBe(1);
-    expect(desc.preCheck?.state).toBe("ask");
-  });
-
-  it("config-denied path makes worstCheck deny even when another path is ask", async () => {
-    // One path config-denied, one config-ask → descriptor with preCheck.state === "deny".
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) =>
-      intentValues(intent).includes("/outside/a.ts")
-        ? makeCheckResult("deny", { source: "special" })
-        : makeCheckResult("ask"),
-    );
-    const result = await describeGate(
-      makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
-      resolver,
-    );
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.preCheck?.state).toBe("deny");
-    // Both paths are uncovered (neither is allow), so both patterns are included.
-    expect(desc.sessionApproval).toBeDefined();
-    if (!desc.sessionApproval) return;
-    expect(desc.sessionApproval.patterns.length).toBe(2);
-  });
-
-  it("only includes uncovered paths when some are session-covered", async () => {
-    const resolver = makeResolver();
-    resolver.resolve.mockImplementation((intent) =>
-      intentValues(intent).includes("/outside/a.ts")
-        ? makeCheckResult("allow", { source: "session" })
-        : makeCheckResult("ask"),
-    );
-    const result = await describeGate(
-      makeTcc({ input: { command: "diff /outside/a.ts /outside/b.ts" } }),
-      resolver,
-    );
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    // Should have patterns only for the uncovered path
-    expect(desc.sessionApproval).toBeDefined();
-    if (!desc.sessionApproval) return;
-    expect(desc.sessionApproval.patterns.length).toBe(1);
-  });
-});

package/test/handlers/gates/bash-path.test.ts

@@ -1,346 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-// Mock node:os so tilde-expansion is deterministic across platforms.
-vi.mock("node:os", () => {
-  const homedir = vi.fn(() => "/mock/home");
-  return {
-    homedir,
-    default: { homedir },
-  };
-});
-
-import { AccessPath } from "#src/access-intent/access-path";
-import { BashProgram } from "#src/access-intent/bash/program";
-import { describeBashPathGate } from "#src/handlers/gates/bash-path";
-import type {
-  GateBypass,
-  GateDescriptor,
-  GateResult,
-} from "#src/handlers/gates/descriptor";
-import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
-import type { ToolCallContext } from "#src/handlers/gates/types";
-import { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { getNonEmptyString, toRecord } from "#src/value-guards";
-
-import {
-  makeGateCheckResult as makeCheckResult,
-  makePathDispatchResolver,
-  makeResolver,
-  makeTcc,
-} from "#test/helpers/gate-fixtures";
-
-afterEach(() => {
-  vi.restoreAllMocks();
-});
-
-/**
- * Mirror the handler's parse-once derivation: parse the bash command into a
- * shared `BashProgram` and inject it, exactly as `permission-gate-handler.ts`
- * does, so the gate is exercised through the production wiring.
- */
-async function describeGate(
-  tcc: ToolCallContext,
-  resolver: ScopedPermissionResolver,
-): Promise<GateResult> {
-  const command = getNonEmptyString(toRecord(tcc.input).command);
-  const bashProgram =
-    tcc.toolName === "bash" && command
-      ? await BashProgram.parse(
-          command,
-          new PathNormalizer(process.platform, tcc.cwd),
-        )
-      : null;
-  return describeBashPathGate(tcc, bashProgram, resolver);
-}
-
-// ── tests ──────────────────────────────────────────────────────────────────
-
-describe("describeBashPathGate", () => {
-  it("returns null for non-bash tools", async () => {
-    const result = await describeGate(
-      makeTcc({ toolName: "read", input: { path: ".env" } }),
-      makeResolver(),
-    );
-    expect(result).toBeNull();
-  });
-
-  it("returns null when no tokens are extracted", async () => {
-    const result = await describeGate(
-      makeTcc({ input: { command: "echo hello" } }),
-      makeResolver(),
-    );
-    expect(result).toBeNull();
-  });
-
-  it("returns null when all tokens evaluate to allow", async () => {
-    const result = await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult({ state: "allow" })),
-    );
-    expect(result).toBeNull();
-  });
-
-  it("returns GateDescriptor when a token evaluates to deny", async () => {
-    const result = await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult({ state: "deny", matchedPattern: "*.env" })),
-    );
-    expect(result).not.toBeNull();
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.surface).toBe("path");
-    expect(desc.preCheck?.state).toBe("deny");
-  });
-
-  it("returns GateDescriptor when a token evaluates to ask", async () => {
-    const result = await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult({ state: "ask", matchedPattern: "*" })),
-    );
-    expect(result).not.toBeNull();
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.preCheck?.state).toBe("ask");
-  });
-
-  it("descriptor includes triggering token in prompt message", async () => {
-    const result = (await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult({ state: "deny", matchedPattern: "*.env" })),
-    )) as GateDescriptor;
-    expect(result.denialContext).toMatchObject({
-      kind: "bash_path",
-      command: "cat .env",
-      pathValue: ".env",
-    });
-    expect(result.promptDetails.message).toContain(".env");
-  });
-
-  it("descriptor decision uses surface 'path'", async () => {
-    const result = (await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult({ state: "deny", matchedPattern: "*.env" })),
-    )) as GateDescriptor;
-    expect(result.decision.surface).toBe("path");
-  });
-
-  it("returns GateBypass when session rule covers the path", async () => {
-    const result = await describeGate(
-      makeTcc(),
-      makeResolver(makeCheckResult({ state: "allow", source: "session" })),
-    );
-    expect(result).not.toBeNull();
-    expect(isGateBypass(result)).toBe(true);
-    expect((result as GateBypass).action).toBe("allow");
-  });
-
-  it("returns null when command is missing", async () => {
-    const result = await describeGate(makeTcc({ input: {} }), makeResolver());
-    expect(result).toBeNull();
-  });
-
-  it("evaluates most restrictive across multiple tokens", async () => {
-    const resolver = makePathDispatchResolver(
-      { "src/foo.ts": makeCheckResult({ state: "allow" }) },
-      makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
-    );
-    const result = await describeGate(
-      makeTcc({ input: { command: "cat src/foo.ts .env" } }),
-      resolver,
-    );
-    expect(result).not.toBeNull();
-    expect(isGateDescriptor(result)).toBe(true);
-    expect((result as GateDescriptor).preCheck?.state).toBe("deny");
-  });
-
-  it("deny wins in multi-token: cp .env README.md", async () => {
-    const resolver = makePathDispatchResolver(
-      { ".env": makeCheckResult({ state: "deny", matchedPattern: "*.env" }) },
-      makeCheckResult({ state: "allow" }),
-    );
-    const result = await describeGate(
-      makeTcc({ input: { command: "cp .env README.md" } }),
-      resolver,
-    );
-    expect(result).not.toBeNull();
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.preCheck?.state).toBe("deny");
-    expect(desc.decision.value).toBe(".env");
-  });
-
-  it("extracts redirect target: echo test > .env triggers deny", async () => {
-    const resolver = makePathDispatchResolver(
-      { ".env": makeCheckResult({ state: "deny", matchedPattern: "*.env" }) },
-      makeCheckResult({ state: "allow" }),
-    );
-    const result = await describeGate(
-      makeTcc({ input: { command: "echo test > .env" } }),
-      resolver,
-    );
-    expect(result).not.toBeNull();
-    expect(isGateDescriptor(result)).toBe(true);
-    expect((result as GateDescriptor).preCheck?.state).toBe("deny");
-  });
-
-  it("returns null when all tokens match only the universal default", async () => {
-    const result = await describeGate(
-      makeTcc(),
-      makeResolver(
-        makeCheckResult({
-          state: "ask",
-          matchedPattern: undefined,
-          source: "special",
-          origin: "builtin",
-        }),
-      ),
-    );
-    expect(result).toBeNull();
-  });
-
-  it("ignores tokens matching universal default but fires for explicit rule matches", async () => {
-    const resolver = makePathDispatchResolver(
-      { ".env": makeCheckResult({ state: "deny", matchedPattern: "*.env" }) },
-      // Other tokens match only the universal default (no matchedPattern)
-      makeCheckResult({
-        state: "ask",
-        matchedPattern: undefined,
-        source: "special",
-        origin: "builtin",
-      }),
-    );
-    const result = await describeGate(
-      makeTcc({ input: { command: "cat src/foo.ts .env" } }),
-      resolver,
-    );
-    expect(result).not.toBeNull();
-    expect(isGateDescriptor(result)).toBe(true);
-    const desc = result as GateDescriptor;
-    expect(desc.preCheck?.state).toBe("deny");
-    expect(desc.decision.value).toBe(".env");
-  });
-
-  it("resolves cd-aware policy values while keeping the raw prompt token", async () => {
-    const resolver = makeResolver(
-      makeCheckResult({ state: "deny", matchedPattern: "*" }),
-    );
-    const result = (await describeGate(
-      makeTcc({
-        input: { command: "cd nested && cat src/file.txt" },
-        cwd: "/test/project",
-      }),
-      resolver,
-    )) as GateDescriptor;
-
-    expect(resolver.resolve).toHaveBeenCalledWith({
-      kind: "access-path",
-      surface: "path",
-      path: AccessPath.forPath("src/file.txt", {
-        cwd: "/test/project",
-        resolveBase: "/test/project/nested",
-        platform: "linux",
-      }),
-      agentName: undefined,
-    });
-    // The raw token drives the prompt, denial context, and session approval.
-    expect(result.denialContext).toMatchObject({ pathValue: "src/file.txt" });
-    expect(result.decision.value).toBe("src/file.txt");
-  });
-
-  it("does not resolve relative policy values through an unknown cd", async () => {
-    const resolver = makeResolver(
-      makeCheckResult({ state: "deny", matchedPattern: "*" }),
-    );
-    await describeGate(
-      makeTcc({
-        input: { command: 'cd "$DIR" && cat src/foo.ts' },
-        cwd: "/test/project",
-      }),
-      resolver,
-    );
-
-    expect(resolver.resolve).toHaveBeenCalledWith({
-      kind: "access-path",
-      surface: "path",
-      path: AccessPath.forLiteral("src/foo.ts"),
-      agentName: undefined,
-    });
-  });
-
-  it("binds a current-directory token's session approval to the cwd subtree", async () => {
-    const resolver = makeResolver(
-      makeCheckResult({ state: "ask", matchedPattern: "*" }),
-    );
-    const result = (await describeGate(
-      makeTcc({
-        input: { command: "cat .env" },
-        cwd: "/test/project",
-      }),
-      resolver,
-    )) as GateDescriptor;
-
-    expect(result.decision.value).toBe(".env");
-    expect(result.sessionApproval?.surface).toBe("path");
-    expect(result.sessionApproval?.representativePattern).toBe(
-      "/test/project/*",
-    );
-  });
-});
-
-// Home-relative path characterization (#350) ──────────────────────────────
-//
-// The parser extracts ~/... tokens from bash commands; the resolver receives
-// the raw token and normalizeInput handles expansion. These tests verify the
-// gate correctly dispatches ~/... tokens through the deny/ask path.
-
-describe("describeBashPathGate — home-relative paths", () => {
-  it("extracts ~/... token and builds descriptor on deny", async () => {
-    // node:os is mocked: homedir() returns "/mock/home".
-    // cat ~/.ssh/config → token "~/.ssh/config" extracted.
-    const resolver = makePathDispatchResolver(
-      {
-        "/mock/home/.ssh/config": makeCheckResult({
-          state: "deny",
-          matchedPattern: "~/.ssh/*",
-        }),
-      },
-      makeCheckResult({ state: "allow" }),
-    );
-    const result = (await describeGate(
-      makeTcc({ input: { command: "cat ~/.ssh/config" } }),
-      resolver,
-    )) as GateDescriptor;
-
-    expect(isGateDescriptor(result)).toBe(true);
-    expect(result.preCheck?.state).toBe("deny");
-    expect(result.denialContext).toMatchObject({
-      kind: "bash_path",
-      command: "cat ~/.ssh/config",
-      pathValue: "~/.ssh/config",
-    });
-  });
-
-  it("extracts $HOME/... token and builds descriptor on deny", async () => {
-    const resolver = makePathDispatchResolver(
-      {
-        "/mock/home/.ssh/config": makeCheckResult({
-          state: "deny",
-          matchedPattern: "$HOME/.ssh/*",
-        }),
-      },
-      makeCheckResult({ state: "allow" }),
-    );
-    const result = (await describeGate(
-      makeTcc({ input: { command: "cat $HOME/.ssh/config" } }),
-      resolver,
-    )) as GateDescriptor;
-
-    expect(isGateDescriptor(result)).toBe(true);
-    expect(result.preCheck?.state).toBe("deny");
-    expect(result.denialContext).toMatchObject({
-      kind: "bash_path",
-      pathValue: "$HOME/.ssh/config",
-    });
-  });
-});

package/test/handlers/gates/candidate-check.test.ts

@@ -1,52 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { pickMostRestrictive } from "#src/handlers/gates/candidate-check";
-
-import { makeGateCheckResult } from "#test/helpers/gate-fixtures";
-
-describe("pickMostRestrictive", () => {
-  it("returns undefined for an empty list", () => {
-    expect(pickMostRestrictive([])).toBeUndefined();
-  });
-
-  it("returns the single result for a one-element list", () => {
-    const only = makeGateCheckResult({ state: "allow" });
-    expect(pickMostRestrictive([only])).toBe(only);
-  });
-
-  it("prefers deny over ask and allow regardless of position", () => {
-    const allow = makeGateCheckResult({ state: "allow", matchedPattern: "a" });
-    const ask = makeGateCheckResult({ state: "ask", matchedPattern: "b" });
-    const deny = makeGateCheckResult({ state: "deny", matchedPattern: "c" });
-    expect(pickMostRestrictive([allow, ask, deny])).toBe(deny);
-    expect(pickMostRestrictive([deny, ask, allow])).toBe(deny);
-  });
-
-  it("prefers ask over allow when no deny is present", () => {
-    const allow = makeGateCheckResult({ state: "allow" });
-    const ask = makeGateCheckResult({ state: "ask" });
-    expect(pickMostRestrictive([allow, ask])).toBe(ask);
-  });
-
-  it("keeps the first deny on ties", () => {
-    const deny1 = makeGateCheckResult({
-      state: "deny",
-      matchedPattern: "first",
-    });
-    const deny2 = makeGateCheckResult({
-      state: "deny",
-      matchedPattern: "second",
-    });
-    expect(pickMostRestrictive([deny1, deny2])).toBe(deny1);
-  });
-
-  it("keeps the first ask on ties when no deny is present", () => {
-    const allow = makeGateCheckResult({ state: "allow" });
-    const ask1 = makeGateCheckResult({ state: "ask", matchedPattern: "first" });
-    const ask2 = makeGateCheckResult({
-      state: "ask",
-      matchedPattern: "second",
-    });
-    expect(pickMostRestrictive([allow, ask1, ask2])).toBe(ask1);
-  });
-});