@gotgenes/pi-permission-system 18.1.1 → 18.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (133) hide show
  1. package/CHANGELOG.md +25 -0
  2. package/docs/configuration.md +11 -0
  3. package/package.json +1 -2
  4. package/src/access-intent/access-path.ts +29 -4
  5. package/src/access-intent/bash/bash-path-resolver.ts +39 -18
  6. package/src/access-intent/bash/msys-bash-tokens.ts +64 -0
  7. package/src/extension-config.ts +7 -0
  8. package/src/forwarded-permissions/permission-forwarder.ts +6 -3
  9. package/src/handlers/gates/helpers.ts +1 -1
  10. package/src/handlers/gates/runner.ts +22 -0
  11. package/src/index.ts +10 -6
  12. package/src/path-normalizer.ts +105 -2
  13. package/src/permission-manager.ts +21 -1
  14. package/src/permission-prompter.ts +10 -16
  15. package/src/prompting-gateway.ts +13 -17
  16. package/src/rule.ts +21 -1
  17. package/src/status.ts +1 -1
  18. package/src/yolo-mode.ts +0 -30
  19. package/test/access-intent/access-path.test.ts +0 -277
  20. package/test/access-intent/bash/node-text.test.ts +0 -148
  21. package/test/access-intent/bash/parser.test.ts +0 -19
  22. package/test/access-intent/bash/program.test.ts +0 -673
  23. package/test/access-intent/bash/token-classification.test.ts +0 -363
  24. package/test/access-intent/bash/token-collection.test.ts +0 -300
  25. package/test/active-agent.test.ts +0 -155
  26. package/test/async-cache.test.ts +0 -48
  27. package/test/bash-arity.test.ts +0 -144
  28. package/test/bash-external-directory.test.ts +0 -1022
  29. package/test/builtin-tool-input-formatters.test.ts +0 -109
  30. package/test/canonicalize-path.test.ts +0 -119
  31. package/test/composition-root.test.ts +0 -698
  32. package/test/config-loader.test.ts +0 -740
  33. package/test/config-modal.test.ts +0 -320
  34. package/test/config-paths.test.ts +0 -83
  35. package/test/config-pipeline.test.ts +0 -90
  36. package/test/config-reporter.test.ts +0 -147
  37. package/test/config-store.test.ts +0 -466
  38. package/test/decision-audit.test.ts +0 -72
  39. package/test/decision-reporter.test.ts +0 -112
  40. package/test/denial-messages.test.ts +0 -714
  41. package/test/detect-permissive-bash-fallback.test.ts +0 -56
  42. package/test/expand-home.test.ts +0 -93
  43. package/test/extension-config.test.ts +0 -129
  44. package/test/extension-paths.test.ts +0 -108
  45. package/test/forwarded-permissions/io.test.ts +0 -251
  46. package/test/forwarding-manager.test.ts +0 -200
  47. package/test/handlers/before-agent-start.test.ts +0 -314
  48. package/test/handlers/external-directory-integration.test.ts +0 -515
  49. package/test/handlers/external-directory-session-dedup.test.ts +0 -175
  50. package/test/handlers/external-directory-symlink-acceptance.test.ts +0 -167
  51. package/test/handlers/gates/bash-command-metamorphic.test.ts +0 -88
  52. package/test/handlers/gates/bash-command.test.ts +0 -257
  53. package/test/handlers/gates/bash-external-directory.test.ts +0 -268
  54. package/test/handlers/gates/bash-path.test.ts +0 -346
  55. package/test/handlers/gates/candidate-check.test.ts +0 -52
  56. package/test/handlers/gates/external-directory-messages.test.ts +0 -85
  57. package/test/handlers/gates/external-directory-policy.test.ts +0 -134
  58. package/test/handlers/gates/external-directory.test.ts +0 -267
  59. package/test/handlers/gates/helpers.test.ts +0 -165
  60. package/test/handlers/gates/path.test.ts +0 -369
  61. package/test/handlers/gates/runner.test.ts +0 -408
  62. package/test/handlers/gates/skill-input-gate-pipeline.test.ts +0 -176
  63. package/test/handlers/gates/skill-input.test.ts +0 -128
  64. package/test/handlers/gates/skill-read.test.ts +0 -161
  65. package/test/handlers/gates/tool-call-gate-pipeline.test.ts +0 -356
  66. package/test/handlers/gates/tool.test.ts +0 -244
  67. package/test/handlers/input-events.test.ts +0 -168
  68. package/test/handlers/input.test.ts +0 -199
  69. package/test/handlers/lifecycle.test.ts +0 -221
  70. package/test/handlers/tool-call-boundary.test.ts +0 -145
  71. package/test/handlers/tool-call-events.test.ts +0 -277
  72. package/test/handlers/tool-call.test.ts +0 -395
  73. package/test/handlers/validate-requested-tool.test.ts +0 -92
  74. package/test/helpers/external-directory-fixtures.ts +0 -269
  75. package/test/helpers/gate-fixtures.ts +0 -316
  76. package/test/helpers/handler-fixtures.ts +0 -335
  77. package/test/helpers/make-fake-pi.ts +0 -100
  78. package/test/helpers/manager-harness.ts +0 -112
  79. package/test/helpers/session-fixtures.ts +0 -199
  80. package/test/input-normalizer.test.ts +0 -325
  81. package/test/logging.test.ts +0 -51
  82. package/test/mcp-targets.test.ts +0 -233
  83. package/test/node-modules-discovery.test.ts +0 -97
  84. package/test/normalize.test.ts +0 -247
  85. package/test/path-containment.test.ts +0 -161
  86. package/test/path-normalization.test.ts +0 -233
  87. package/test/path-normalizer.test.ts +0 -196
  88. package/test/path-surfaces.test.ts +0 -55
  89. package/test/pattern-suggest.test.ts +0 -248
  90. package/test/permission-dialog.test.ts +0 -205
  91. package/test/permission-event-rpc.test.ts +0 -560
  92. package/test/permission-events.test.ts +0 -400
  93. package/test/permission-forwarder.test.ts +0 -370
  94. package/test/permission-forwarding.test.ts +0 -315
  95. package/test/permission-gate.test.ts +0 -269
  96. package/test/permission-manager-unified.test.ts +0 -3714
  97. package/test/permission-merge.test.ts +0 -61
  98. package/test/permission-prompter.test.ts +0 -518
  99. package/test/permission-prompts.test.ts +0 -363
  100. package/test/permission-resolver.test.ts +0 -277
  101. package/test/permission-session.test.ts +0 -404
  102. package/test/permission-ui-prompt.test.ts +0 -146
  103. package/test/permissions-service.test.ts +0 -192
  104. package/test/pi-infrastructure-read.test.ts +0 -432
  105. package/test/policy-loader.test.ts +0 -561
  106. package/test/prompting-gateway.test.ts +0 -231
  107. package/test/rule.test.ts +0 -650
  108. package/test/safe-system-paths.test.ts +0 -46
  109. package/test/scope-merge.test.ts +0 -116
  110. package/test/service-lifecycle.test.ts +0 -163
  111. package/test/service.test.ts +0 -261
  112. package/test/session-approval.test.ts +0 -75
  113. package/test/session-logger.test.ts +0 -200
  114. package/test/session-rules.test.ts +0 -321
  115. package/test/session-start.test.ts +0 -112
  116. package/test/skill-prompt-sanitizer.test.ts +0 -418
  117. package/test/status.test.ts +0 -10
  118. package/test/subagent-context.test.ts +0 -372
  119. package/test/subagent-lifecycle-events.test.ts +0 -132
  120. package/test/subagent-registry.test.ts +0 -145
  121. package/test/synthesize.test.ts +0 -302
  122. package/test/system-prompt-sanitizer.test.ts +0 -382
  123. package/test/tool-access-extractor-registry.test.ts +0 -77
  124. package/test/tool-input-formatter-registry.test.ts +0 -75
  125. package/test/tool-input-path.test.ts +0 -84
  126. package/test/tool-input-preview.test.ts +0 -129
  127. package/test/tool-input-prompt-formatters.test.ts +0 -115
  128. package/test/tool-preview-formatter.test.ts +0 -458
  129. package/test/tool-registry.test.ts +0 -197
  130. package/test/value-guards.test.ts +0 -193
  131. package/test/wildcard-matcher.test.ts +0 -424
  132. package/test/yaml-frontmatter.test.ts +0 -91
  133. package/test/yolo-mode.test.ts +0 -188
@@ -1,155 +0,0 @@
1
- import { afterEach, describe, expect, test, vi } from "vitest";
2
- import {
3
- ACTIVE_AGENT_TAG_REGEX,
4
- type ActiveAgentContext,
5
- getActiveAgentName,
6
- getActiveAgentNameFromSystemPrompt,
7
- normalizeAgentName,
8
- type SessionEntryView,
9
- } from "#src/active-agent";
10
-
11
- afterEach(() => {
12
- vi.restoreAllMocks();
13
- });
14
-
15
- function makeCtx(entries: SessionEntryView[]): ActiveAgentContext {
16
- return {
17
- sessionManager: {
18
- getEntries: vi.fn(() => entries),
19
- },
20
- };
21
- }
22
-
23
- describe("ACTIVE_AGENT_TAG_REGEX", () => {
24
- test("matches double-quoted name attribute", () => {
25
- const match = '<active_agent name="my-agent">'.match(
26
- ACTIVE_AGENT_TAG_REGEX,
27
- );
28
- expect(match?.[1]).toBe("my-agent");
29
- });
30
-
31
- test("matches single-quoted name attribute", () => {
32
- const match = "<active_agent name='my-agent'>".match(
33
- ACTIVE_AGENT_TAG_REGEX,
34
- );
35
- expect(match?.[1]).toBe("my-agent");
36
- });
37
-
38
- test("is case-insensitive", () => {
39
- const match = '<ACTIVE_AGENT name="bot">'.match(ACTIVE_AGENT_TAG_REGEX);
40
- expect(match?.[1]).toBe("bot");
41
- });
42
-
43
- test("does not match when tag is absent", () => {
44
- expect("no tag here".match(ACTIVE_AGENT_TAG_REGEX)).toBeNull();
45
- });
46
- });
47
-
48
- describe("normalizeAgentName", () => {
49
- test("returns trimmed string for valid input", () => {
50
- expect(normalizeAgentName(" my-agent ")).toBe("my-agent");
51
- });
52
-
53
- test("returns null for empty string", () => {
54
- expect(normalizeAgentName("")).toBeNull();
55
- });
56
-
57
- test("returns null for whitespace-only string", () => {
58
- expect(normalizeAgentName(" ")).toBeNull();
59
- });
60
-
61
- test("returns null for non-string values", () => {
62
- expect(normalizeAgentName(null)).toBeNull();
63
- expect(normalizeAgentName(undefined)).toBeNull();
64
- expect(normalizeAgentName(42)).toBeNull();
65
- expect(normalizeAgentName({})).toBeNull();
66
- });
67
- });
68
-
69
- describe("getActiveAgentName", () => {
70
- test("returns null when session has no entries", () => {
71
- expect(getActiveAgentName(makeCtx([]))).toBeNull();
72
- });
73
-
74
- test("returns null when no active_agent custom entry exists", () => {
75
- const ctx = makeCtx([{ type: "message", data: { name: "agent" } }]);
76
- expect(getActiveAgentName(ctx)).toBeNull();
77
- });
78
-
79
- test("returns agent name from active_agent entry", () => {
80
- const ctx = makeCtx([
81
- { type: "custom", customType: "active_agent", data: { name: "bot" } },
82
- ]);
83
- expect(getActiveAgentName(ctx)).toBe("bot");
84
- });
85
-
86
- test("last-entry-wins: returns name from the last matching entry", () => {
87
- const ctx = makeCtx([
88
- { type: "custom", customType: "active_agent", data: { name: "first" } },
89
- { type: "custom", customType: "active_agent", data: { name: "last" } },
90
- ]);
91
- expect(getActiveAgentName(ctx)).toBe("last");
92
- });
93
-
94
- test("entry with name: null resets agent name to null", () => {
95
- const ctx = makeCtx([
96
- { type: "custom", customType: "active_agent", data: { name: "bot" } },
97
- { type: "custom", customType: "active_agent", data: { name: null } },
98
- ]);
99
- expect(getActiveAgentName(ctx)).toBeNull();
100
- });
101
-
102
- test("skips entries with whitespace-only name and continues scanning", () => {
103
- const ctx = makeCtx([
104
- { type: "custom", customType: "active_agent", data: { name: "first" } },
105
- { type: "custom", customType: "active_agent", data: { name: " " } },
106
- ]);
107
- // " " normalizes to null — not a sentinel reset, keeps scanning backwards
108
- expect(getActiveAgentName(ctx)).toBe("first");
109
- });
110
-
111
- test("ignores entries with wrong customType", () => {
112
- const ctx = makeCtx([
113
- { type: "custom", customType: "something_else", data: { name: "bot" } },
114
- ]);
115
- expect(getActiveAgentName(ctx)).toBeNull();
116
- });
117
-
118
- test("ignores entries with wrong type", () => {
119
- const ctx = makeCtx([
120
- { type: "tool_call", customType: "active_agent", data: { name: "bot" } },
121
- ]);
122
- expect(getActiveAgentName(ctx)).toBeNull();
123
- });
124
- });
125
-
126
- describe("getActiveAgentNameFromSystemPrompt", () => {
127
- test("returns null for undefined system prompt", () => {
128
- expect(getActiveAgentNameFromSystemPrompt(undefined)).toBeNull();
129
- });
130
-
131
- test("returns null for empty system prompt", () => {
132
- expect(getActiveAgentNameFromSystemPrompt("")).toBeNull();
133
- });
134
-
135
- test("returns null when tag is absent", () => {
136
- expect(
137
- getActiveAgentNameFromSystemPrompt("You are a helpful assistant."),
138
- ).toBeNull();
139
- });
140
-
141
- test("extracts agent name from tag in system prompt", () => {
142
- const prompt = 'You are helpful.\n<active_agent name="my-bot">\nDo work.';
143
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBe("my-bot");
144
- });
145
-
146
- test("returns null when tag name is empty", () => {
147
- const prompt = '<active_agent name="">';
148
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBeNull();
149
- });
150
-
151
- test("trims whitespace from extracted name", () => {
152
- const prompt = '<active_agent name=" trimmed ">';
153
- expect(getActiveAgentNameFromSystemPrompt(prompt)).toBe("trimmed");
154
- });
155
- });
@@ -1,48 +0,0 @@
1
- import { describe, expect, it, vi } from "vitest";
2
-
3
- import { memoizeAsyncWithRetry } from "#src/async-cache";
4
-
5
- describe("memoizeAsyncWithRetry", () => {
6
- it("invokes the factory once and shares the resolved value across calls", async () => {
7
- const factory = vi.fn<() => Promise<number>>().mockResolvedValue(42);
8
- const memoized = memoizeAsyncWithRetry(factory);
9
-
10
- const results = await Promise.all([memoized(), memoized(), memoized()]);
11
-
12
- expect(results).toEqual([42, 42, 42]);
13
- expect(factory).toHaveBeenCalledTimes(1);
14
- });
15
-
16
- it("caches the same promise instance on success", async () => {
17
- const factory = vi.fn<() => Promise<string>>().mockResolvedValue("parser");
18
- const memoized = memoizeAsyncWithRetry(factory);
19
-
20
- await memoized();
21
- await memoized();
22
-
23
- expect(factory).toHaveBeenCalledTimes(1);
24
- });
25
-
26
- it("surfaces the rejection to the caller each time the factory fails", async () => {
27
- const error = new Error("init failed");
28
- const factory = vi.fn<() => Promise<number>>().mockRejectedValue(error);
29
- const memoized = memoizeAsyncWithRetry(factory);
30
-
31
- await expect(memoized()).rejects.toThrow("init failed");
32
- await expect(memoized()).rejects.toThrow("init failed");
33
- });
34
-
35
- it("drops a rejected result so the next call re-invokes the factory", async () => {
36
- const factory = vi
37
- .fn<() => Promise<number>>()
38
- .mockRejectedValueOnce(new Error("transient"))
39
- .mockResolvedValue(7);
40
- const memoized = memoizeAsyncWithRetry(factory);
41
-
42
- await expect(memoized()).rejects.toThrow("transient");
43
- const recovered = await memoized();
44
-
45
- expect(recovered).toBe(7);
46
- expect(factory).toHaveBeenCalledTimes(2);
47
- });
48
- });
@@ -1,144 +0,0 @@
1
- import { describe, expect, it } from "vitest";
2
- import { ARITY, prefix, stripBashCommentLines } from "#src/bash-arity";
3
-
4
- describe("ARITY dictionary", () => {
5
- it("is exported as a plain object", () => {
6
- expect(typeof ARITY).toBe("object");
7
- });
8
-
9
- it("maps 'git' to arity 2", () => {
10
- expect(ARITY.git).toBe(2);
11
- });
12
-
13
- it("maps 'npm run' to arity 3", () => {
14
- expect(ARITY["npm run"]).toBe(3);
15
- });
16
-
17
- it("maps 'npm' to arity 2 (fallback when 'npm run' does not match)", () => {
18
- expect(ARITY.npm).toBe(2);
19
- });
20
-
21
- it("maps 'docker compose' to arity 3", () => {
22
- expect(ARITY["docker compose"]).toBe(3);
23
- });
24
-
25
- it("maps 'docker' to arity 2 (fallback)", () => {
26
- expect(ARITY.docker).toBe(2);
27
- });
28
- });
29
-
30
- describe("prefix", () => {
31
- it("returns empty array for empty input", () => {
32
- expect(prefix([])).toEqual([]);
33
- });
34
-
35
- it("returns single-element array for a bare known command", () => {
36
- // 'git' alone has arity 2 but only 1 token is available — clamp.
37
- expect(prefix(["git"])).toEqual(["git"]);
38
- });
39
-
40
- it("returns arity-2 prefix for git subcommands", () => {
41
- expect(prefix(["git", "checkout", "main"])).toEqual(["git", "checkout"]);
42
- });
43
-
44
- it("returns arity-2 prefix for git status with flags", () => {
45
- expect(prefix(["git", "status", "--short"])).toEqual(["git", "status"]);
46
- });
47
-
48
- it("returns arity-3 prefix for npm run (longest match wins over npm arity-2)", () => {
49
- expect(prefix(["npm", "run", "dev"])).toEqual(["npm", "run", "dev"]);
50
- });
51
-
52
- it("returns arity-2 prefix for npm install (npm fallback, npm run does not match)", () => {
53
- expect(prefix(["npm", "install", "lodash"])).toEqual(["npm", "install"]);
54
- });
55
-
56
- it("returns arity-3 prefix for docker compose subcommands", () => {
57
- expect(prefix(["docker", "compose", "up", "--build"])).toEqual([
58
- "docker",
59
- "compose",
60
- "up",
61
- ]);
62
- });
63
-
64
- it("returns arity-2 prefix for docker pull (docker fallback)", () => {
65
- expect(prefix(["docker", "pull", "ubuntu"])).toEqual(["docker", "pull"]);
66
- });
67
-
68
- it("returns arity-1 prefix for unknown commands", () => {
69
- expect(prefix(["unknown-tool", "--flag"])).toEqual(["unknown-tool"]);
70
- });
71
-
72
- it("returns arity-1 prefix for rm (args are targets, not subcommands)", () => {
73
- expect(prefix(["rm", "-rf", "node_modules"])).toEqual(["rm"]);
74
- });
75
-
76
- it("returns arity-1 prefix for cat", () => {
77
- expect(prefix(["cat", "file.txt"])).toEqual(["cat"]);
78
- });
79
-
80
- it("is case-insensitive: 'Git' looks up as 'git'", () => {
81
- // Tokens are preserved as-is; only the lookup key is lowercased.
82
- expect(prefix(["Git", "checkout", "main"])).toEqual(["Git", "checkout"]);
83
- });
84
-
85
- it("clamps arity to available token count when command is shorter than arity", () => {
86
- // npm run has arity 3; only ["npm", "run"] provided → return both.
87
- expect(prefix(["npm", "run"])).toEqual(["npm", "run"]);
88
- });
89
-
90
- it("returns arity-2 prefix for pnpm run (longest match wins over pnpm)", () => {
91
- // pnpm run <script> — arity 3 means include the script name.
92
- expect(prefix(["pnpm", "run", "build"])).toEqual(["pnpm", "run", "build"]);
93
- });
94
-
95
- it("returns arity-2 prefix for cargo subcommands", () => {
96
- expect(prefix(["cargo", "build", "--release"])).toEqual(["cargo", "build"]);
97
- });
98
-
99
- it("returns arity-2 prefix for kubectl subcommands", () => {
100
- expect(prefix(["kubectl", "get", "pods"])).toEqual(["kubectl", "get"]);
101
- });
102
-
103
- it("returns arity-1 for bare 'ls' (args are paths)", () => {
104
- expect(prefix(["ls", "-la", "/tmp"])).toEqual(["ls"]);
105
- });
106
- });
107
-
108
- describe("stripBashCommentLines", () => {
109
- it("removes a single leading comment line", () => {
110
- expect(
111
- stripBashCommentLines("# Check debug logs\nfind /home -type f"),
112
- ).toBe("find /home -type f");
113
- });
114
-
115
- it("removes multiple leading comment lines", () => {
116
- expect(
117
- stripBashCommentLines("# Step 1\n# Step 2\ngit status --short"),
118
- ).toBe("git status --short");
119
- });
120
-
121
- it("returns empty string when all lines are comments", () => {
122
- expect(stripBashCommentLines("# just a comment")).toBe("");
123
- });
124
-
125
- it("returns empty string for blank input", () => {
126
- expect(stripBashCommentLines("")).toBe("");
127
- });
128
-
129
- it("returns the command unchanged when no comment lines are present", () => {
130
- expect(stripBashCommentLines("grep -rn foo src/")).toBe(
131
- "grep -rn foo src/",
132
- );
133
- });
134
-
135
- it("trims surrounding whitespace from the result", () => {
136
- expect(stripBashCommentLines("\n\n ls -la \n")).toBe("ls -la");
137
- });
138
-
139
- it("treats indented comment lines as comments", () => {
140
- expect(stripBashCommentLines(" # indented comment\necho hi")).toBe(
141
- "echo hi",
142
- );
143
- });
144
- });