@gotgenes/pi-permission-system 18.1.1 → 18.2.0

package/test/synthesize.test.ts

@@ -1,302 +0,0 @@
-import { describe, expect, test } from "vitest";
-import type { RuleOrigin } from "#src/rule";
-import { evaluate } from "#src/rule";
-import {
-  composeRuleset,
-  synthesizeBaseline,
-  synthesizeDefaults,
-} from "#src/synthesize";
-
-// ── synthesizeDefaults ─────────────────────────────────────────────────────
-
-describe("synthesizeDefaults", () => {
-  test("emits a single universal catch-all rule with layer 'default' and origin 'builtin'", () => {
-    const rules = synthesizeDefaults("ask");
-    expect(rules).toHaveLength(1);
-    expect(rules[0]).toEqual({
-      surface: "*",
-      pattern: "*",
-      action: "ask",
-      layer: "default",
-      origin: "builtin",
-    });
-  });
-
-  test("reflects the supplied PermissionState as the action", () => {
-    expect(synthesizeDefaults("allow")[0].action).toBe("allow");
-    expect(synthesizeDefaults("deny")[0].action).toBe("deny");
-    expect(synthesizeDefaults("ask")[0].action).toBe("ask");
-  });
-
-  test("universal rule catches any surface via wildcardMatch", () => {
-    const rules = synthesizeDefaults("ask");
-    expect(evaluate("read", "*", rules, "linux").action).toBe("ask");
-    expect(evaluate("bash", "git status", rules, "linux").action).toBe("ask");
-    expect(evaluate("external_directory", "*", rules, "linux").action).toBe(
-      "ask",
-    );
-    expect(evaluate("future_surface", "*", rules, "linux").action).toBe("ask");
-  });
-
-  test("universal rule has layer 'default'", () => {
-    const rules = synthesizeDefaults("allow");
-    expect(evaluate("read", "*", rules, "linux").layer).toBe("default");
-  });
-
-  test("defaults to origin 'builtin' when no origin supplied", () => {
-    const rules = synthesizeDefaults("ask");
-    expect(rules[0].origin).toBe("builtin");
-  });
-
-  test("universal rule carries config scope origin when supplied", () => {
-    const origin: RuleOrigin = "global";
-    const rules = synthesizeDefaults("ask", origin);
-    expect(rules[0].origin).toBe("global");
-  });
-
-  test("origin is preserved through evaluate()", () => {
-    const rules = synthesizeDefaults("allow", "project");
-    const result = evaluate("read", "*", rules, "linux");
-    expect(result.origin).toBe("project");
-  });
-
-  test("all RuleOrigin values are accepted", () => {
-    const origins: RuleOrigin[] = [
-      "global",
-      "project",
-      "agent",
-      "project-agent",
-      "builtin",
-      "baseline",
-      "session",
-    ];
-    for (const origin of origins) {
-      const rules = synthesizeDefaults("ask", origin);
-      expect(rules[0].origin).toBe(origin);
-    }
-  });
-});
-
-// ── synthesizeBaseline ─────────────────────────────────────────────────────
-
-describe("synthesizeBaseline", () => {
-  test("returns empty ruleset when config has no mcp allow rules", () => {
-    const configRules = [
-      {
-        surface: "mcp",
-        pattern: "*",
-        action: "deny" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    expect(synthesizeBaseline(configRules)).toEqual([]);
-  });
-
-  test("returns empty ruleset for empty config rules", () => {
-    expect(synthesizeBaseline([])).toEqual([]);
-  });
-
-  test("synthesizes 5 baseline rules when at least one mcp allow config rule exists", () => {
-    const configRules = [
-      {
-        surface: "mcp",
-        pattern: "exa:*",
-        action: "allow" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const rules = synthesizeBaseline(configRules);
-    expect(rules).toHaveLength(5);
-  });
-
-  test("baseline rules all have layer 'baseline', action 'allow', and origin 'baseline'", () => {
-    const configRules = [
-      {
-        surface: "mcp",
-        pattern: "exa:*",
-        action: "allow" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const rules = synthesizeBaseline(configRules);
-    for (const rule of rules) {
-      expect(rule.layer).toBe("baseline");
-      expect(rule.action).toBe("allow");
-      expect(rule.surface).toBe("mcp");
-      expect(rule.origin).toBe("baseline");
-    }
-  });
-
-  test("baseline rules cover the 5 MCP metadata targets", () => {
-    const configRules = [
-      {
-        surface: "mcp",
-        pattern: "exa:*",
-        action: "allow" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const rules = synthesizeBaseline(configRules);
-    const patterns = rules.map((r) => r.pattern);
-    expect(patterns).toContain("mcp_status");
-    expect(patterns).toContain("mcp_list");
-    expect(patterns).toContain("mcp_search");
-    expect(patterns).toContain("mcp_describe");
-    expect(patterns).toContain("mcp_connect");
-  });
-
-  test("baseline is NOT synthesized when allow rule is on a non-mcp surface", () => {
-    const configRules = [
-      {
-        surface: "bash",
-        pattern: "git *",
-        action: "allow" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    expect(synthesizeBaseline(configRules)).toEqual([]);
-  });
-
-  test("baseline auto-allows mcp_status when an mcp allow rule exists", () => {
-    const configRules = [
-      {
-        surface: "mcp",
-        pattern: "exa:*",
-        action: "allow" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const rules = synthesizeBaseline(configRules);
-    const result = evaluate("mcp", "mcp_status", rules, "linux");
-    expect(result.action).toBe("allow");
-    expect(result.layer).toBe("baseline");
-    expect(result.origin).toBe("baseline");
-  });
-});
-
-// ── composeRuleset ─────────────────────────────────────────────────────────
-
-describe("composeRuleset", () => {
-  test("returns concatenation of all layers in order", () => {
-    const defaults = synthesizeDefaults("ask");
-    const baseline = synthesizeBaseline([
-      {
-        surface: "mcp",
-        pattern: "exa:*",
-        action: "allow",
-        layer: "config",
-        origin: "global" as const,
-      },
-    ]);
-    const config = [
-      {
-        surface: "bash",
-        pattern: "rm -rf *",
-        action: "deny" as const,
-        origin: "global" as const,
-      },
-    ];
-    const composed = composeRuleset(defaults, baseline, config);
-    expect(composed.length).toBe(
-      defaults.length + baseline.length + config.length,
-    );
-  });
-
-  test("defaults come first (lowest priority), config comes last (highest priority)", () => {
-    const defaults = synthesizeDefaults("ask");
-    const config = [
-      {
-        surface: "bash",
-        pattern: "*",
-        action: "deny" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const composed = composeRuleset(defaults, [], config);
-    const result = evaluate("bash", "echo hello", composed, "linux");
-    expect(result.action).toBe("deny");
-    expect(result.layer).toBe("config");
-  });
-
-  test("config beats default for matching patterns", () => {
-    const defaults = synthesizeDefaults("ask");
-    const config = [
-      {
-        surface: "read",
-        pattern: "*",
-        action: "allow" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const composed = composeRuleset(defaults, [], config);
-    const result = evaluate("read", "*", composed, "linux");
-    expect(result.action).toBe("allow");
-    expect(result.layer).toBe("config");
-  });
-
-  test("baseline beats default but config beats baseline", () => {
-    const defaults = synthesizeDefaults("ask");
-    const baseline = [
-      {
-        surface: "mcp",
-        pattern: "mcp_status",
-        action: "allow" as const,
-        layer: "baseline" as const,
-        origin: "baseline" as const,
-      },
-    ];
-    const config = [
-      {
-        surface: "mcp",
-        pattern: "mcp_status",
-        action: "deny" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const composed = composeRuleset(defaults, baseline, config);
-    const result = evaluate("mcp", "mcp_status", composed, "linux");
-    expect(result.action).toBe("deny");
-    expect(result.layer).toBe("config");
-  });
-
-  test("config beats baseline for specific patterns", () => {
-    const defaults = synthesizeDefaults("ask");
-    const baseline = [
-      {
-        surface: "mcp",
-        pattern: "mcp_status",
-        action: "allow" as const,
-        layer: "baseline" as const,
-        origin: "baseline" as const,
-      },
-    ];
-    const config = [
-      {
-        surface: "mcp",
-        pattern: "exa_web_search",
-        action: "allow" as const,
-        layer: "config" as const,
-        origin: "global" as const,
-      },
-    ];
-    const composed = composeRuleset(defaults, baseline, config);
-    const result = evaluate("mcp", "exa_web_search", composed, "linux");
-    expect(result.action).toBe("allow");
-    expect(result.layer).toBe("config");
-  });
-
-  test("handles empty layers gracefully", () => {
-    const defaults = synthesizeDefaults("ask");
-    const composed = composeRuleset(defaults, [], []);
-    expect(composed).toEqual(defaults);
-  });
-});

package/test/system-prompt-sanitizer.test.ts

@@ -1,382 +0,0 @@
-import { afterEach, describe, expect, test, vi } from "vitest";
-
-import { sanitizeAvailableToolsSection } from "#src/system-prompt-sanitizer";
-
-afterEach(() => {
-  vi.restoreAllMocks();
-});
-
-// Helpers for building prompt sections.
-function availableToolsSection(tools: string[]): string {
-  return ["Available tools:", ...tools.map((t) => `- ${t}`)].join("\n");
-}
-
-function guidelinesSection(guidelines: string[]): string {
-  return ["Guidelines:", ...guidelines.map((g) => `- ${g}`)].join("\n");
-}
-
-function prompt(...sections: string[]): string {
-  return sections.join("\n\n");
-}
-
-describe("sanitizeAvailableToolsSection — Available tools section", () => {
-  test("keeps allowed tool lines and the header, drops denied ones", () => {
-    const input = prompt(
-      availableToolsSection(["bash", "read"]),
-      "Other content",
-    );
-    const result = sanitizeAvailableToolsSection(input, ["read"]);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).toContain("Available tools:");
-    expect(result.prompt).toContain("- read");
-    expect(result.prompt).not.toContain("- bash");
-  });
-
-  test("leaves the section untouched when every tool is allowed", () => {
-    const input = prompt(
-      availableToolsSection(["bash", "read"]),
-      "Other content",
-    );
-    const result = sanitizeAvailableToolsSection(input, ["bash", "read"]);
-    expect(result.removed).toBe(false);
-    expect(result.prompt).toBe(input);
-  });
-
-  // Bug #33: findSection extends to lines.length when no subsequent recognised
-  // header follows, so content after the last section is silently deleted.
-  test("preserves content that follows the Available tools section (bug #33)", () => {
-    const input = prompt(
-      availableToolsSection(["bash", "read"]),
-      "Other content",
-    );
-    const result = sanitizeAvailableToolsSection(input, ["read"]);
-    expect(result.prompt).toContain("Other content");
-  });
-
-  test("removes the whole section when no tool is allowed", () => {
-    const input = prompt(
-      availableToolsSection(["bash", "read"]),
-      "Other content",
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("Available tools:");
-    expect(result.prompt).toContain("Other content");
-  });
-
-  test("removed flag is false when no Available tools section is present", () => {
-    const input = "Just some instructions.\n\nNo tools section.";
-    const result = sanitizeAvailableToolsSection(input, ["bash"]);
-    expect(result.removed).toBe(false);
-    expect(result.prompt).toBe(input);
-  });
-
-  test("keeps non-tool boilerplate prose near the section", () => {
-    const input = [
-      "Available tools:",
-      "- read: Read file contents",
-      "- bash: Run shell commands",
-      "",
-      "In addition to the tools above, you may have access to other custom tools depending on the project.",
-    ].join("\n");
-    const result = sanitizeAvailableToolsSection(input, ["read"]);
-    expect(result.prompt).toContain("- read: Read file contents");
-    expect(result.prompt).not.toContain("- bash: Run shell commands");
-    expect(result.prompt).toContain("In addition to the tools above");
-  });
-
-  test("returns original prompt reference unchanged when nothing is removed", () => {
-    const input = "No tools section here.";
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.prompt).toBe(input);
-  });
-
-  test("narrowing the full listing yields the already-narrowed listing (cache byte-stability)", () => {
-    const allowed = ["read", "edit", "write"];
-    const fullProse = [
-      "You are an assistant.",
-      "",
-      "Available tools:",
-      "- bash: Run shell commands",
-      "- read: Read file contents",
-      "- edit: Edit a file",
-      "- write: Write a file",
-      "",
-      "Guidelines:",
-      "- use bash for file operations like ls, rg, find",
-      "- use read to examine files instead of cat or sed.",
-      "- Be concise in your responses",
-    ].join("\n");
-    const narrowedProse = [
-      "You are an assistant.",
-      "",
-      "Available tools:",
-      "- read: Read file contents",
-      "- edit: Edit a file",
-      "- write: Write a file",
-      "",
-      "Guidelines:",
-      "- use read to examine files instead of cat or sed.",
-      "- Be concise in your responses",
-    ].join("\n");
-
-    const fromFull = sanitizeAvailableToolsSection(fullProse, allowed).prompt;
-    const fromNarrowed = sanitizeAvailableToolsSection(
-      narrowedProse,
-      allowed,
-    ).prompt;
-
-    // Idempotent on the already-narrowed input Pi feeds back on later turns.
-    expect(fromNarrowed).toBe(narrowedProse);
-    // Turn 1 (full) and turn 2+ (narrowed) produce identical wire bytes.
-    expect(fromFull).toBe(fromNarrowed);
-  });
-});
-
-describe("sanitizeAvailableToolsSection — Guidelines section", () => {
-  test("removes bash guideline when bash is not in allowed tools", () => {
-    const input = prompt(
-      guidelinesSection(["use bash for file operations like ls, rg, find"]),
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("use bash for file operations");
-  });
-
-  test("keeps bash guideline when bash is in allowed tools", () => {
-    const input = prompt(
-      guidelinesSection(["use bash for file operations like ls, rg, find"]),
-    );
-    const result = sanitizeAvailableToolsSection(input, ["bash"]);
-    expect(result.removed).toBe(false);
-    expect(result.prompt).toContain("use bash for file operations");
-  });
-
-  test("removes read guideline when read is not allowed", () => {
-    const input = prompt(
-      guidelinesSection(["use read to examine files instead of cat or sed."]),
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("use read to examine files");
-  });
-
-  test("keeps read guideline when read is allowed", () => {
-    const input = prompt(
-      guidelinesSection(["use read to examine files instead of cat or sed."]),
-    );
-    const result = sanitizeAvailableToolsSection(input, ["read"]);
-    expect(result.removed).toBe(false);
-    expect(result.prompt).toContain("use read to examine files");
-  });
-
-  test("removes edit guideline when edit is not allowed", () => {
-    const input = prompt(
-      guidelinesSection([
-        "use edit for precise changes (old text must match exactly)",
-      ]),
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("use edit for precise changes");
-  });
-
-  test("removes write guideline when write is not allowed", () => {
-    const input = prompt(
-      guidelinesSection(["use write only for new files or complete rewrites"]),
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("use write only for new files");
-  });
-
-  test("removes entire Guidelines section when all bullets are filtered out", () => {
-    const input = prompt(
-      guidelinesSection([
-        "use bash for file operations like ls, rg, find",
-        "use write only for new files or complete rewrites",
-      ]),
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("Guidelines:");
-  });
-
-  test("preserves unrecognised guidelines regardless of allowed tools", () => {
-    const input = prompt(
-      guidelinesSection(["some custom guideline not in the rules"]),
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(false);
-    expect(result.prompt).toContain("some custom guideline not in the rules");
-  });
-
-  test("handles both sections together: removes tools section and filters guidelines", () => {
-    const input = prompt(
-      availableToolsSection(["bash"]),
-      guidelinesSection([
-        "use bash for file operations like ls, rg, find",
-        "use write only for new files or complete rewrites",
-        "some custom guideline not in the rules",
-      ]),
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("Available tools:");
-    expect(result.prompt).not.toContain("use bash for file operations");
-    expect(result.prompt).not.toContain("use write only for new files");
-    expect(result.prompt).toContain("some custom guideline not in the rules");
-  });
-
-  test("trims whitespace from allowed tool names", () => {
-    const input = prompt(
-      guidelinesSection(["use bash for file operations like ls, rg, find"]),
-    );
-    const result = sanitizeAvailableToolsSection(input, ["  bash  "]);
-    expect(result.removed).toBe(false);
-    expect(result.prompt).toContain("use bash for file operations");
-  });
-});
-
-describe("sanitizeAvailableToolsSection — multi-section prompt", () => {
-  test("collapses extra blank lines after removal", () => {
-    const input = prompt(
-      "Intro",
-      availableToolsSection(["bash"]),
-      guidelinesSection(["use bash for file operations like ls, rg, find"]),
-      "Closing",
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    // No run of 3+ consecutive newlines
-    expect(result.prompt).not.toMatch(/\n{3,}/);
-  });
-});
-
-describe("sanitizeAvailableToolsSection — findSection boundary edge cases", () => {
-  test("preserves content after Guidelines when Guidelines is the last recognised section", () => {
-    const input = prompt(
-      guidelinesSection(["use bash for file operations like ls, rg, find"]),
-      "Trailing custom instructions",
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.prompt).toContain("Trailing custom instructions");
-  });
-
-  test("preserves trailing prose when both sections are removed", () => {
-    const input = prompt(
-      availableToolsSection(["bash"]),
-      guidelinesSection(["use bash for file operations like ls, rg, find"]),
-      "Important user note",
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).not.toContain("Available tools:");
-    expect(result.prompt).not.toContain("Guidelines:");
-    expect(result.prompt).toContain("Important user note");
-  });
-
-  test("section at EOF is removed entirely when no tool is allowed", () => {
-    const input = availableToolsSection(["bash", "read"]);
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).toBe("");
-  });
-
-  test("section followed by blank lines then prose — prose survives removal", () => {
-    const input = ["Available tools:", "- bash", "", "", "Custom note"].join(
-      "\n",
-    );
-    const result = sanitizeAvailableToolsSection(input, []);
-    expect(result.removed).toBe(true);
-    expect(result.prompt).toContain("Custom note");
-    expect(result.prompt).not.toContain("Available tools:");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Moved from permission-system.test.ts catch-all (#342)
-// ---------------------------------------------------------------------------
-
-test("System prompt sanitizer keeps the active tools in the Available tools section", () => {
-  const prompt = [
-    "Available tools:",
-    "- read: Read file contents",
-    "- mcp: Discover, inspect, and call MCP tools across configured servers",
-    "",
-    "In addition to the tools above, you may have access to other custom tools depending on the project.",
-    "",
-    "Guidelines:",
-    "- Use mcp for MCP discovery first: search by capability, describe one exact tool name, then call it.",
-    "- Be concise in your responses",
-  ].join("\n");
-
-  const result = sanitizeAvailableToolsSection(prompt, ["read", "mcp"]);
-
-  expect(result.removed).toBe(false);
-  expect(result.prompt).toContain("Available tools:");
-  expect(result.prompt).toContain("- read: Read file contents");
-  expect(result.prompt).toContain("- mcp: Discover");
-  expect(result.prompt).toContain("In addition to the tools above");
-  expect(result.prompt).toMatch(/Guidelines:/);
-});
-
-test("System prompt sanitizer drops a denied tool's line but keeps the section", () => {
-  const prompt = [
-    "Available tools:",
-    "- read: Read file contents",
-    "- mcp: Discover, inspect, and call MCP tools across configured servers",
-    "",
-    "Guidelines:",
-    "- Use mcp for MCP discovery first: search by capability, describe one exact tool name, then call it.",
-    "- Be concise in your responses",
-  ].join("\n");
-
-  const result = sanitizeAvailableToolsSection(prompt, ["read"]);
-
-  expect(result.removed).toBe(true);
-  expect(result.prompt).toContain("Available tools:");
-  expect(result.prompt).toContain("- read: Read file contents");
-  expect(result.prompt).not.toContain("- mcp: Discover");
-});
-
-test("System prompt sanitizer removes denied tool guidelines while keeping global guidance", () => {
-  const prompt = [
-    "Guidelines:",
-    "- Use task when work SHOULD be delegated to one or more specialized agents instead of handled entirely in the current session.",
-    "- Use mcp for MCP discovery first: search by capability, describe one exact tool name, then call it.",
-    "- Prefer grep/find/ls tools over bash for file exploration (faster, respects .gitignore)",
-    "- Be concise in your responses",
-    "- Show file paths clearly when working with files",
-  ].join("\n");
-
-  const result = sanitizeAvailableToolsSection(prompt, ["bash", "grep", "mcp"]);
-
-  expect(result.removed).toBe(true);
-  expect(result.prompt).not.toContain("Use task when work SHOULD");
-  expect(result.prompt).toMatch(/Use mcp for MCP discovery first/i);
-  expect(result.prompt).toMatch(/Prefer grep\/find\/ls tools over bash/i);
-  expect(result.prompt).toMatch(/Be concise in your responses/);
-  expect(result.prompt).toMatch(
-    /Show file paths clearly when working with files/,
-  );
-});
-
-test("System prompt sanitizer removes inactive built-in write guidance", () => {
-  const prompt = [
-    "Guidelines:",
-    "- Use write only for new files or complete rewrites",
-    "- When summarizing your actions, output plain text directly - do NOT use cat or bash to display what you did",
-    "- Be concise in your responses",
-  ].join("\n");
-
-  const result = sanitizeAvailableToolsSection(prompt, ["read"]);
-
-  expect(result.removed).toBe(true);
-  expect(result.prompt).not.toContain(
-    "Use write only for new files or complete rewrites",
-  );
-  expect(result.prompt).not.toContain(
-    "do NOT use cat or bash to display what you did",
-  );
-  expect(result.prompt).toMatch(/Be concise in your responses/);
-});