@gotgenes/pi-permission-system 18.1.1 → 18.2.0

package/test/mcp-targets.test.ts

@@ -1,233 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  createMcpPermissionTargets,
-  McpTargetList,
-  parseQualifiedMcpToolName,
-} from "#src/mcp-targets";
-
-describe("parseQualifiedMcpToolName", () => {
-  it("returns server and tool for a valid qualified name", () => {
-    expect(parseQualifiedMcpToolName("exa:search")).toEqual({
-      server: "exa",
-      tool: "search",
-    });
-  });
-
-  it("returns server and tool with surrounding whitespace trimmed", () => {
-    expect(parseQualifiedMcpToolName("  exa : search  ")).toEqual({
-      server: "exa",
-      tool: "search",
-    });
-  });
-
-  it("returns null for empty string", () => {
-    expect(parseQualifiedMcpToolName("")).toBeNull();
-  });
-
-  it("returns null for whitespace-only string", () => {
-    expect(parseQualifiedMcpToolName("   ")).toBeNull();
-  });
-
-  it("returns null when colon is the first character", () => {
-    expect(parseQualifiedMcpToolName(":search")).toBeNull();
-  });
-
-  it("returns null when colon is the last character", () => {
-    expect(parseQualifiedMcpToolName("exa:")).toBeNull();
-  });
-
-  it("returns null for a plain tool name with no colon", () => {
-    expect(parseQualifiedMcpToolName("exa_search")).toBeNull();
-  });
-
-  it("returns null when server part is empty after trimming", () => {
-    expect(parseQualifiedMcpToolName(" :search")).toBeNull();
-  });
-
-  it("returns null when tool part is empty after trimming", () => {
-    expect(parseQualifiedMcpToolName("exa: ")).toBeNull();
-  });
-});
-
-describe("createMcpPermissionTargets", () => {
-  describe("tool call (input.tool)", () => {
-    it("produces targets for a bare tool name with no configured servers", () => {
-      const targets = createMcpPermissionTargets({ tool: "exa_search" }, []);
-      expect(targets).toContain("exa_search");
-      expect(targets).toContain("mcp_call");
-    });
-
-    it("produces targets for a qualified tool name (server:tool)", () => {
-      const targets = createMcpPermissionTargets({ tool: "exa:search" }, []);
-      expect(targets).toContain("exa_search");
-      expect(targets).toContain("exa:search");
-      expect(targets).toContain("exa");
-      expect(targets).toContain("mcp_call");
-    });
-
-    it("produces targets for a tool call with explicit server field", () => {
-      const targets = createMcpPermissionTargets(
-        { tool: "search", server: "exa" },
-        [],
-      );
-      expect(targets).toContain("exa_search");
-      expect(targets).toContain("exa:search");
-      expect(targets).toContain("exa");
-      expect(targets).toContain("mcp_call");
-    });
-
-    it("derives server targets from configured server names when tool name ends with _<server>", () => {
-      const targets = createMcpPermissionTargets({ tool: "exa_search" }, [
-        "exa",
-      ]);
-      // exa_search ends with _exa? No — it ends with _search. This tool name
-      // does NOT trigger server derivation because it does not end with _exa.
-      expect(targets).toContain("exa_search");
-    });
-
-    it("does not include duplicate entries", () => {
-      const targets = createMcpPermissionTargets({ tool: "exa:search" }, [
-        "exa",
-      ]);
-      const unique = [...new Set(targets)];
-      expect(targets).toEqual(unique);
-    });
-  });
-
-  describe("connect call (input.connect)", () => {
-    it("produces targets for a connect operation", () => {
-      const targets = createMcpPermissionTargets({ connect: "exa" }, []);
-      expect(targets).toContain("mcp_connect_exa");
-      expect(targets).toContain("exa");
-      expect(targets).toContain("mcp_connect");
-    });
-
-    it("does not include mcp_call for connect operations", () => {
-      const targets = createMcpPermissionTargets({ connect: "exa" }, []);
-      expect(targets).not.toContain("mcp_call");
-    });
-  });
-
-  describe("describe operation (input.describe)", () => {
-    it("produces targets for a describe operation on a qualified tool", () => {
-      const targets = createMcpPermissionTargets(
-        { describe: "exa:search" },
-        [],
-      );
-      expect(targets).toContain("exa_search");
-      expect(targets).toContain("exa:search");
-      expect(targets).toContain("exa");
-      expect(targets).toContain("mcp_describe");
-    });
-  });
-
-  describe("search operation (input.search)", () => {
-    it("produces mcp_search and the search string as targets", () => {
-      const targets = createMcpPermissionTargets({ search: "weather" }, []);
-      expect(targets).toContain("weather");
-      expect(targets).toContain("mcp_search");
-    });
-
-    it("includes server targets when server is provided alongside search", () => {
-      const targets = createMcpPermissionTargets(
-        { search: "weather", server: "exa" },
-        [],
-      );
-      expect(targets).toContain("mcp_server_exa");
-      expect(targets).toContain("exa");
-      expect(targets).toContain("mcp_search");
-    });
-  });
-
-  describe("server listing (input.server only)", () => {
-    it("produces mcp_list and server-specific targets", () => {
-      const targets = createMcpPermissionTargets({ server: "exa" }, []);
-      expect(targets).toContain("mcp_server_exa");
-      expect(targets).toContain("exa");
-      expect(targets).toContain("mcp_list");
-    });
-  });
-
-  describe("status (no meaningful input)", () => {
-    it("produces mcp_status for empty input", () => {
-      const targets = createMcpPermissionTargets({}, []);
-      expect(targets).toContain("mcp_status");
-    });
-
-    it("produces mcp_status for null input", () => {
-      const targets = createMcpPermissionTargets(null, []);
-      expect(targets).toContain("mcp_status");
-    });
-
-    it("produces mcp_status when no server/tool/connect/describe/search present", () => {
-      const targets = createMcpPermissionTargets({ unrelated: "value" }, [
-        "exa",
-      ]);
-      expect(targets).toContain("mcp_status");
-    });
-  });
-
-  describe("priority ordering", () => {
-    it("tool targets appear before mcp_call", () => {
-      const targets = createMcpPermissionTargets({ tool: "exa:search" }, []);
-      const mcpCallIdx = targets.indexOf("mcp_call");
-      const exaSearchIdx = targets.indexOf("exa_search");
-      expect(exaSearchIdx).toBeGreaterThanOrEqual(0);
-      expect(mcpCallIdx).toBeGreaterThan(exaSearchIdx);
-    });
-  });
-});
-
-describe("McpTargetList", () => {
-  describe("add", () => {
-    it("ignores null", () => {
-      const list = new McpTargetList();
-      list.add(null);
-      expect(list.toArray()).toEqual([]);
-    });
-
-    it("ignores empty string", () => {
-      const list = new McpTargetList();
-      list.add("");
-      expect(list.toArray()).toEqual([]);
-    });
-
-    it("appends a new value", () => {
-      const list = new McpTargetList();
-      list.add("exa");
-      expect(list.toArray()).toEqual(["exa"]);
-    });
-
-    it("dedups repeated values", () => {
-      const list = new McpTargetList();
-      list.add("exa");
-      list.add("exa");
-      expect(list.toArray()).toEqual(["exa"]);
-    });
-
-    it("preserves first-insertion order across a mix of values", () => {
-      const list = new McpTargetList();
-      list.add("exa_search");
-      list.add("exa:search");
-      list.add("exa");
-      list.add("exa_search"); // duplicate — must not change order
-      list.add("mcp_call");
-      expect(list.toArray()).toEqual([
-        "exa_search",
-        "exa:search",
-        "exa",
-        "mcp_call",
-      ]);
-    });
-  });
-
-  describe("toArray", () => {
-    it("returns an independent copy that does not mutate the list", () => {
-      const list = new McpTargetList();
-      list.add("exa");
-      const first = list.toArray();
-      first.push("mutated");
-      expect(list.toArray()).toEqual(["exa"]);
-    });
-  });
-});

package/test/node-modules-discovery.test.ts

@@ -1,97 +0,0 @@
-import { beforeEach, describe, expect, test, vi } from "vitest";
-
-// Hoisted stubs for mocks that reference them in vi.mock factories.
-const { mockSpawnSync, mockExistsSync } = vi.hoisted(() => ({
-  mockSpawnSync: vi.fn(),
-  mockExistsSync: vi.fn(),
-}));
-
-// Mock node:child_process so tests don't spawn real subprocesses.
-vi.mock("node:child_process", () => ({
-  spawnSync: mockSpawnSync,
-  default: { spawnSync: mockSpawnSync },
-}));
-
-// Mock node:fs so existsSync is controllable.
-vi.mock("node:fs", () => ({
-  existsSync: mockExistsSync,
-  default: { existsSync: mockExistsSync },
-}));
-
-import { discoverGlobalNodeModulesRoot } from "#src/node-modules-discovery";
-
-describe("discoverGlobalNodeModulesRoot", () => {
-  beforeEach(() => {
-    mockSpawnSync.mockReset();
-    mockExistsSync.mockReset();
-  });
-
-  test("returns node_modules root when URL is inside a node_modules tree", () => {
-    const fakeUrl =
-      "file:///opt/homebrew/lib/node_modules/@gotgenes/pi-permission-system/dist/external-directory.js";
-    const result = discoverGlobalNodeModulesRoot(fakeUrl);
-    expect(result).toBe("/opt/homebrew/lib/node_modules");
-    expect(mockSpawnSync).not.toHaveBeenCalled();
-  });
-
-  test("calls npm root -g as fallback when walk-up finds no node_modules ancestor", () => {
-    const npmRootPath = "/opt/homebrew/lib/node_modules";
-    mockSpawnSync.mockReturnValue({
-      status: 0,
-      stdout: `${npmRootPath}\n`,
-    });
-    mockExistsSync.mockReturnValue(true);
-
-    const fakeUrl = "file:///Users/dev/my-project/src/external-directory.ts";
-    const result = discoverGlobalNodeModulesRoot(fakeUrl);
-
-    expect(mockSpawnSync).toHaveBeenCalledWith(
-      "npm",
-      ["root", "-g"],
-      expect.objectContaining({ encoding: "utf-8" }),
-    );
-    expect(result).toBe(npmRootPath);
-  });
-
-  test("returns null when walk-up fails and npm root -g returns non-zero exit", () => {
-    mockSpawnSync.mockReturnValue({ status: 1, stdout: "" });
-
-    const fakeUrl = "file:///Users/dev/my-project/src/external-directory.ts";
-    const result = discoverGlobalNodeModulesRoot(fakeUrl);
-
-    expect(result).toBeNull();
-  });
-
-  test("returns null when walk-up fails and spawnSync throws", () => {
-    mockSpawnSync.mockImplementation(() => {
-      throw new Error("ENOENT");
-    });
-
-    const fakeUrl = "file:///Users/dev/my-project/src/external-directory.ts";
-    const result = discoverGlobalNodeModulesRoot(fakeUrl);
-
-    expect(result).toBeNull();
-  });
-
-  test("returns null when walk-up fails and npm root -g returns non-existent path", () => {
-    mockSpawnSync.mockReturnValue({
-      status: 0,
-      stdout: "/some/nonexistent/node_modules\n",
-    });
-    mockExistsSync.mockReturnValue(false);
-
-    const fakeUrl = "file:///Users/dev/my-project/src/external-directory.ts";
-    const result = discoverGlobalNodeModulesRoot(fakeUrl);
-
-    expect(result).toBeNull();
-  });
-
-  test("returns null when walk-up fails and npm root -g returns empty stdout", () => {
-    mockSpawnSync.mockReturnValue({ status: 0, stdout: "   " });
-
-    const fakeUrl = "file:///Users/dev/my-project/src/external-directory.ts";
-    const result = discoverGlobalNodeModulesRoot(fakeUrl);
-
-    expect(result).toBeNull();
-  });
-});

package/test/normalize.test.ts

@@ -1,247 +0,0 @@
-import { describe, expect, test } from "vitest";
-import { normalizeFlatConfig } from "#src/normalize";
-
-describe("normalizeFlatConfig", () => {
-  describe("string shorthand", () => {
-    test("string value produces a single catch-all rule for the surface", () => {
-      const result = normalizeFlatConfig({ read: "allow" });
-      expect(result).toEqual([
-        { surface: "read", pattern: "*", action: "allow", origin: "builtin" },
-      ]);
-    });
-
-    test("string shorthand works for multiple surfaces", () => {
-      const result = normalizeFlatConfig({ read: "allow", write: "deny" });
-      expect(result).toEqual([
-        { surface: "read", pattern: "*", action: "allow", origin: "builtin" },
-        { surface: "write", pattern: "*", action: "deny", origin: "builtin" },
-      ]);
-    });
-
-    test("universal fallback '*' becomes a catch-all rule with surface '*'", () => {
-      const result = normalizeFlatConfig({ "*": "ask" });
-      expect(result).toEqual([
-        { surface: "*", pattern: "*", action: "ask", origin: "builtin" },
-      ]);
-    });
-
-    test("external_directory string shorthand maps directly to its surface", () => {
-      const result = normalizeFlatConfig({ external_directory: "ask" });
-      expect(result).toEqual([
-        {
-          surface: "external_directory",
-          pattern: "*",
-          action: "ask",
-          origin: "builtin",
-        },
-      ]);
-    });
-
-    test("invalid string values (non-PermissionState) are ignored", () => {
-      const result = normalizeFlatConfig({
-        read: "allow",
-        write: "invalid" as never,
-      });
-      expect(result).toEqual([
-        { surface: "read", pattern: "*", action: "allow", origin: "builtin" },
-      ]);
-    });
-  });
-
-  describe("object pattern map", () => {
-    test("object value produces one rule per pattern", () => {
-      const result = normalizeFlatConfig({
-        bash: { "*": "ask", "git *": "allow" },
-      });
-      expect(result).toEqual([
-        { surface: "bash", pattern: "*", action: "ask", origin: "builtin" },
-        {
-          surface: "bash",
-          pattern: "git *",
-          action: "allow",
-          origin: "builtin",
-        },
-      ]);
-    });
-
-    test("mcp object map produces rules with surface 'mcp'", () => {
-      const result = normalizeFlatConfig({
-        mcp: { "*": "ask", mcp_status: "allow" },
-      });
-      expect(result).toEqual([
-        { surface: "mcp", pattern: "*", action: "ask", origin: "builtin" },
-        {
-          surface: "mcp",
-          pattern: "mcp_status",
-          action: "allow",
-          origin: "builtin",
-        },
-      ]);
-    });
-
-    test("skill object map produces rules with surface 'skill'", () => {
-      const result = normalizeFlatConfig({
-        skill: { "*": "ask", librarian: "allow" },
-      });
-      expect(result).toEqual([
-        { surface: "skill", pattern: "*", action: "ask", origin: "builtin" },
-        {
-          surface: "skill",
-          pattern: "librarian",
-          action: "allow",
-          origin: "builtin",
-        },
-      ]);
-    });
-
-    test("invalid action values in object map are ignored", () => {
-      const result = normalizeFlatConfig({
-        bash: { "git *": "allow", "rm -rf *": "bad" as never },
-      });
-      expect(result).toEqual([
-        {
-          surface: "bash",
-          pattern: "git *",
-          action: "allow",
-          origin: "builtin",
-        },
-      ]);
-    });
-  });
-
-  describe("mixed surfaces", () => {
-    test("full mixed config produces rules in insertion order", () => {
-      const result = normalizeFlatConfig({
-        "*": "ask",
-        read: "allow",
-        write: "deny",
-        bash: { "*": "ask", "git *": "allow" },
-        mcp: { mcp_status: "allow" },
-        skill: { "*": "ask" },
-        external_directory: "ask",
-      });
-      expect(result).toEqual([
-        { surface: "*", pattern: "*", action: "ask", origin: "builtin" },
-        { surface: "read", pattern: "*", action: "allow", origin: "builtin" },
-        { surface: "write", pattern: "*", action: "deny", origin: "builtin" },
-        { surface: "bash", pattern: "*", action: "ask", origin: "builtin" },
-        {
-          surface: "bash",
-          pattern: "git *",
-          action: "allow",
-          origin: "builtin",
-        },
-        {
-          surface: "mcp",
-          pattern: "mcp_status",
-          action: "allow",
-          origin: "builtin",
-        },
-        { surface: "skill", pattern: "*", action: "ask", origin: "builtin" },
-        {
-          surface: "external_directory",
-          pattern: "*",
-          action: "ask",
-          origin: "builtin",
-        },
-      ]);
-    });
-  });
-
-  describe("empty and edge cases", () => {
-    test("empty permission object produces empty ruleset", () => {
-      expect(normalizeFlatConfig({})).toEqual([]);
-    });
-
-    test("non-object values (null, array) nested in map are skipped", () => {
-      const result = normalizeFlatConfig({
-        bash: null as never,
-        read: "allow",
-      });
-      expect(result).toEqual([
-        { surface: "read", pattern: "*", action: "allow", origin: "builtin" },
-      ]);
-    });
-  });
-
-  describe("deny with reason", () => {
-    test("{ action: 'deny', reason } produces a deny rule carrying the reason", () => {
-      const result = normalizeFlatConfig({
-        bash: { "npm *": { action: "deny", reason: "Use pnpm instead" } },
-      });
-      expect(result).toEqual([
-        {
-          surface: "bash",
-          pattern: "npm *",
-          action: "deny",
-          reason: "Use pnpm instead",
-          origin: "builtin",
-        },
-      ]);
-    });
-
-    test("{ action: 'deny' } without a reason produces a deny rule without reason", () => {
-      const result = normalizeFlatConfig({
-        bash: { "rm -rf *": { action: "deny" } },
-      });
-      expect(result).toEqual([
-        {
-          surface: "bash",
-          pattern: "rm -rf *",
-          action: "deny",
-          origin: "builtin",
-        },
-      ]);
-    });
-
-    test("deny-with-reason and plain strings coexist in the same surface", () => {
-      const result = normalizeFlatConfig({
-        bash: {
-          "git *": "allow",
-          "npm *": { action: "deny", reason: "Use pnpm" },
-          "*": "ask",
-        },
-      });
-      expect(result).toEqual([
-        {
-          surface: "bash",
-          pattern: "git *",
-          action: "allow",
-          origin: "builtin",
-        },
-        {
-          surface: "bash",
-          pattern: "npm *",
-          action: "deny",
-          reason: "Use pnpm",
-          origin: "builtin",
-        },
-        { surface: "bash", pattern: "*", action: "ask", origin: "builtin" },
-      ]);
-    });
-
-    test("top-level deny-with-reason object is treated as a pattern map", () => {
-      // At the surface level, { action: "deny", reason: "..." } is parsed as a
-      // pattern→action map: "action" is a pattern key with action "deny", and
-      // "reason" maps to a non-PermissionState string that is dropped.
-      const result = normalizeFlatConfig({
-        bash: { action: "deny", reason: "Not allowed" } as never,
-      });
-      expect(result).toEqual([
-        {
-          surface: "bash",
-          pattern: "action",
-          action: "deny",
-          origin: "builtin",
-        },
-      ]);
-    });
-
-    test("non-string reason is rejected (malformed config)", () => {
-      const result = normalizeFlatConfig({
-        bash: { "npm *": { action: "deny", reason: 42 } as never },
-      });
-      expect(result).toEqual([]);
-    });
-  });
-});