@gotgenes/pi-permission-system 3.0.0 → 3.0.1

package/tests/common.test.ts

@@ -0,0 +1,189 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+
+import {
+  extractFrontmatter,
+  getNonEmptyString,
+  isPermissionState,
+  parseSimpleYamlMap,
+  toRecord,
+} from "../src/common.js";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("toRecord", () => {
+  test("returns empty object for null", () => {
+    expect(toRecord(null)).toEqual({});
+  });
+
+  test("returns empty object for undefined", () => {
+    expect(toRecord(undefined)).toEqual({});
+  });
+
+  test("returns empty object for a string", () => {
+    expect(toRecord("hello")).toEqual({});
+  });
+
+  test("returns empty object for a number", () => {
+    expect(toRecord(42)).toEqual({});
+  });
+
+  test("returns empty object for an array", () => {
+    expect(toRecord(["a", "b"])).toEqual({});
+  });
+
+  test("returns the object itself for a plain object", () => {
+    const input = { a: 1, b: "two" };
+    expect(toRecord(input)).toBe(input);
+  });
+
+  test("returns the object for a nested object", () => {
+    const input = { x: { y: 3 } };
+    expect(toRecord(input)).toBe(input);
+  });
+});
+
+describe("getNonEmptyString", () => {
+  test("returns null for non-string values", () => {
+    expect(getNonEmptyString(null)).toBeNull();
+    expect(getNonEmptyString(undefined)).toBeNull();
+    expect(getNonEmptyString(42)).toBeNull();
+    expect(getNonEmptyString({})).toBeNull();
+    expect(getNonEmptyString([])).toBeNull();
+  });
+
+  test("returns null for empty string", () => {
+    expect(getNonEmptyString("")).toBeNull();
+  });
+
+  test("returns null for whitespace-only string", () => {
+    expect(getNonEmptyString("   ")).toBeNull();
+    expect(getNonEmptyString("\t\n")).toBeNull();
+  });
+
+  test("returns trimmed string for valid string", () => {
+    expect(getNonEmptyString("hello")).toBe("hello");
+    expect(getNonEmptyString("  hello  ")).toBe("hello");
+  });
+
+  test("returns single non-whitespace character", () => {
+    expect(getNonEmptyString("a")).toBe("a");
+  });
+});
+
+describe("isPermissionState", () => {
+  test("returns true for 'allow'", () => {
+    expect(isPermissionState("allow")).toBe(true);
+  });
+
+  test("returns true for 'deny'", () => {
+    expect(isPermissionState("deny")).toBe(true);
+  });
+
+  test("returns true for 'ask'", () => {
+    expect(isPermissionState("ask")).toBe(true);
+  });
+
+  test("returns false for unrecognized strings", () => {
+    expect(isPermissionState("ALLOW")).toBe(false);
+    expect(isPermissionState("permit")).toBe(false);
+    expect(isPermissionState("")).toBe(false);
+    expect(isPermissionState("block")).toBe(false);
+  });
+
+  test("returns false for non-string types", () => {
+    expect(isPermissionState(null)).toBe(false);
+    expect(isPermissionState(undefined)).toBe(false);
+    expect(isPermissionState(1)).toBe(false);
+    expect(isPermissionState({})).toBe(false);
+  });
+});
+
+describe("extractFrontmatter", () => {
+  test("returns empty string when no frontmatter delimiter", () => {
+    expect(extractFrontmatter("# Hello\nSome content")).toBe("");
+  });
+
+  test("returns empty string when only opening delimiter with no closing", () => {
+    expect(extractFrontmatter("---\nkey: value")).toBe("");
+  });
+
+  test("returns frontmatter body between delimiters", () => {
+    const markdown = "---\nissue: 1\ntitle: Test\n---\n# Content";
+    expect(extractFrontmatter(markdown)).toBe("issue: 1\ntitle: Test");
+  });
+
+  test("returns empty string when file does not start with ---", () => {
+    expect(extractFrontmatter("content\n---\nkey: val\n---")).toBe("");
+  });
+
+  test("handles CRLF line endings", () => {
+    const markdown = "---\r\nissue: 5\r\n---\r\n# Content";
+    expect(extractFrontmatter(markdown)).toBe("issue: 5");
+  });
+
+  test("returns empty string for empty string input", () => {
+    expect(extractFrontmatter("")).toBe("");
+  });
+
+  test("returns empty frontmatter for --- \\n--- with nothing between", () => {
+    const markdown = "---\n---\n# Content";
+    expect(extractFrontmatter(markdown)).toBe("");
+  });
+});
+
+describe("parseSimpleYamlMap", () => {
+  test("returns empty object for empty string", () => {
+    expect(parseSimpleYamlMap("")).toEqual({});
+  });
+
+  test("parses simple key-value pairs", () => {
+    const yaml = "issue: 21\ntitle: Test";
+    expect(parseSimpleYamlMap(yaml)).toEqual({ issue: "21", title: "Test" });
+  });
+
+  test("strips surrounding quotes from values", () => {
+    const yaml = 'title: "My Title"';
+    expect(parseSimpleYamlMap(yaml)).toEqual({ title: "My Title" });
+
+    const yaml2 = "title: 'My Title'";
+    expect(parseSimpleYamlMap(yaml2)).toEqual({ title: "My Title" });
+  });
+
+  test("skips lines without colon or with colon at position 0", () => {
+    const yaml = "no separator here\n:starts-with-colon: val\nkey: val";
+    const result = parseSimpleYamlMap(yaml);
+    expect(result.key).toBe("val");
+    expect(result["no separator here"]).toBeUndefined();
+  });
+
+  test("skips comment lines", () => {
+    const yaml = "# This is a comment\nkey: value";
+    expect(parseSimpleYamlMap(yaml)).toEqual({ key: "value" });
+  });
+
+  test("skips blank lines", () => {
+    const yaml = "\n\nkey: value\n\n";
+    expect(parseSimpleYamlMap(yaml)).toEqual({ key: "value" });
+  });
+
+  test("parses nested map (child indented under parent)", () => {
+    const yaml = "parent:\n  child: nested_value";
+    const result = parseSimpleYamlMap(yaml);
+    expect(result.parent).toEqual({ child: "nested_value" });
+  });
+
+  test("handles multi-line values correctly (second line is new key)", () => {
+    const yaml = "key1: val1\nkey2: val2";
+    const result = parseSimpleYamlMap(yaml);
+    expect(result.key1).toBe("val1");
+    expect(result.key2).toBe("val2");
+  });
+
+  test("strips quotes from keys", () => {
+    const yaml = '"quoted-key": value';
+    const result = parseSimpleYamlMap(yaml);
+    expect(result["quoted-key"]).toBe("value");
+  });
+});

package/tests/external-directory.test.ts

@@ -0,0 +1,250 @@
+import { join } from "node:path";
+import { afterEach, describe, expect, test, vi } from "vitest";
+
+// Mock node:os so tilde-expansion is deterministic across platforms.
+vi.mock("node:os", () => ({
+  homedir: vi.fn(() => "/mock/home"),
+}));
+
+import {
+  formatExternalDirectoryAskPrompt,
+  formatExternalDirectoryDenyReason,
+  formatExternalDirectoryHardStopHint,
+  formatExternalDirectoryUserDeniedReason,
+  getPathBearingToolPath,
+  isPathOutsideWorkingDirectory,
+  isPathWithinDirectory,
+  normalizePathForComparison,
+  PATH_BEARING_TOOLS,
+} from "../src/external-directory.js";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("PATH_BEARING_TOOLS", () => {
+  test("contains the expected tool names", () => {
+    for (const tool of ["read", "write", "edit", "find", "grep", "ls"]) {
+      expect(PATH_BEARING_TOOLS.has(tool)).toBe(true);
+    }
+  });
+
+  test("does not contain bash or mcp", () => {
+    expect(PATH_BEARING_TOOLS.has("bash")).toBe(false);
+    expect(PATH_BEARING_TOOLS.has("mcp")).toBe(false);
+  });
+});
+
+describe("normalizePathForComparison", () => {
+  const cwd = "/projects/my-app";
+
+  test("resolves absolute path unchanged", () => {
+    expect(normalizePathForComparison("/usr/local/bin", cwd)).toBe(
+      "/usr/local/bin",
+    );
+  });
+
+  test("resolves relative path against cwd", () => {
+    expect(normalizePathForComparison("src/foo.ts", cwd)).toBe(
+      "/projects/my-app/src/foo.ts",
+    );
+  });
+
+  test("expands bare ~ to homedir", () => {
+    expect(normalizePathForComparison("~", cwd)).toBe("/mock/home");
+  });
+
+  test("expands ~/... to homedir-relative path", () => {
+    expect(normalizePathForComparison("~/docs/readme.md", cwd)).toBe(
+      join("/mock/home", "docs/readme.md"),
+    );
+  });
+
+  test("strips leading @ before resolving", () => {
+    expect(normalizePathForComparison("@/usr/local/bin", cwd)).toBe(
+      "/usr/local/bin",
+    );
+  });
+
+  test("strips surrounding quotes", () => {
+    expect(normalizePathForComparison("'/usr/local/bin'", cwd)).toBe(
+      "/usr/local/bin",
+    );
+    expect(normalizePathForComparison('"/usr/local/bin"', cwd)).toBe(
+      "/usr/local/bin",
+    );
+  });
+
+  test("returns empty string for blank/whitespace-only path", () => {
+    expect(normalizePathForComparison("", cwd)).toBe("");
+    expect(normalizePathForComparison("   ", cwd)).toBe("");
+  });
+});
+
+describe("isPathWithinDirectory", () => {
+  test("returns true when path equals directory", () => {
+    expect(isPathWithinDirectory("/a/b", "/a/b")).toBe(true);
+  });
+
+  test("returns true when path is a direct child", () => {
+    expect(isPathWithinDirectory("/a/b/c", "/a/b")).toBe(true);
+  });
+
+  test("returns true when path is a deep descendant", () => {
+    expect(isPathWithinDirectory("/a/b/c/d/e", "/a/b")).toBe(true);
+  });
+
+  test("returns false when path is a sibling directory", () => {
+    expect(isPathWithinDirectory("/a/bc", "/a/b")).toBe(false);
+  });
+
+  test("returns false when path is outside the directory", () => {
+    expect(isPathWithinDirectory("/other/path", "/a/b")).toBe(false);
+  });
+
+  test("returns false for empty path", () => {
+    expect(isPathWithinDirectory("", "/a/b")).toBe(false);
+  });
+
+  test("returns false for empty directory", () => {
+    expect(isPathWithinDirectory("/a/b", "")).toBe(false);
+  });
+});
+
+describe("getPathBearingToolPath", () => {
+  test("returns path for a path-bearing tool", () => {
+    expect(getPathBearingToolPath("read", { path: "/src/foo.ts" })).toBe(
+      "/src/foo.ts",
+    );
+  });
+
+  test("returns null for a non-path-bearing tool", () => {
+    expect(getPathBearingToolPath("bash", { path: "/src/foo.ts" })).toBeNull();
+    expect(getPathBearingToolPath("mcp", { path: "/src/foo.ts" })).toBeNull();
+    expect(getPathBearingToolPath("task", { path: "/src/foo.ts" })).toBeNull();
+  });
+
+  test("returns null when input has no path", () => {
+    expect(getPathBearingToolPath("read", {})).toBeNull();
+    expect(getPathBearingToolPath("read", { path: "" })).toBeNull();
+    expect(getPathBearingToolPath("read", null)).toBeNull();
+  });
+});
+
+describe("isPathOutsideWorkingDirectory", () => {
+  const cwd = "/projects/my-app";
+
+  test("returns false when path is inside cwd", () => {
+    expect(isPathOutsideWorkingDirectory("/projects/my-app/src", cwd)).toBe(
+      false,
+    );
+  });
+
+  test("returns false when path equals cwd", () => {
+    expect(isPathOutsideWorkingDirectory("/projects/my-app", cwd)).toBe(false);
+  });
+
+  test("returns true when path is outside cwd", () => {
+    expect(isPathOutsideWorkingDirectory("/etc/passwd", cwd)).toBe(true);
+  });
+
+  test("returns true for home directory when outside cwd", () => {
+    expect(isPathOutsideWorkingDirectory("~/secrets", cwd)).toBe(true);
+  });
+
+  test("returns false for relative path resolving inside cwd", () => {
+    expect(isPathOutsideWorkingDirectory("src/index.ts", cwd)).toBe(false);
+  });
+
+  test("returns false for empty path (normalizes to empty string)", () => {
+    expect(isPathOutsideWorkingDirectory("", cwd)).toBe(false);
+  });
+});
+
+describe("formatExternalDirectoryHardStopHint", () => {
+  test("returns the hard stop instruction string", () => {
+    const hint = formatExternalDirectoryHardStopHint();
+    expect(hint).toContain("Hard stop");
+    expect(hint).toContain("external directory");
+  });
+});
+
+describe("formatExternalDirectoryAskPrompt", () => {
+  test("uses 'Current agent' when no agent name provided", () => {
+    const result = formatExternalDirectoryAskPrompt(
+      "read",
+      "/etc/passwd",
+      "/projects/my-app",
+    );
+    expect(result).toContain("Current agent");
+    expect(result).toContain("read");
+    expect(result).toContain("/etc/passwd");
+    expect(result).toContain("/projects/my-app");
+  });
+
+  test("uses agent name when provided", () => {
+    const result = formatExternalDirectoryAskPrompt(
+      "write",
+      "/tmp/out.txt",
+      "/projects/my-app",
+      "my-agent",
+    );
+    expect(result).toContain("Agent 'my-agent'");
+    expect(result).toContain("write");
+    expect(result).toContain("/tmp/out.txt");
+  });
+});
+
+describe("formatExternalDirectoryDenyReason", () => {
+  test("includes tool name, path, cwd, agent name, and hard stop hint", () => {
+    const result = formatExternalDirectoryDenyReason(
+      "read",
+      "/etc/passwd",
+      "/projects/my-app",
+      "sec-agent",
+    );
+    expect(result).toContain("Agent 'sec-agent'");
+    expect(result).toContain("read");
+    expect(result).toContain("/etc/passwd");
+    expect(result).toContain("/projects/my-app");
+    expect(result).toContain("Hard stop");
+  });
+
+  test("uses 'Current agent' without agent name", () => {
+    const result = formatExternalDirectoryDenyReason(
+      "read",
+      "/etc",
+      "/projects",
+    );
+    expect(result).toContain("Current agent");
+  });
+});
+
+describe("formatExternalDirectoryUserDeniedReason", () => {
+  test("includes tool name and path", () => {
+    const result = formatExternalDirectoryUserDeniedReason(
+      "edit",
+      "/etc/hosts",
+    );
+    expect(result).toContain("edit");
+    expect(result).toContain("/etc/hosts");
+    expect(result).toContain("Hard stop");
+  });
+
+  test("appends denial reason when provided", () => {
+    const result = formatExternalDirectoryUserDeniedReason(
+      "edit",
+      "/etc/hosts",
+      "too risky",
+    );
+    expect(result).toContain("Reason: too risky");
+  });
+
+  test("omits reason suffix when not provided", () => {
+    const result = formatExternalDirectoryUserDeniedReason(
+      "edit",
+      "/etc/hosts",
+    );
+    expect(result).not.toContain("Reason:");
+  });
+});