@gotgenes/pi-permission-system 4.8.0 → 5.0.0

package/tests/synthesize.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "vitest";
+import type { RuleOrigin } from "../src/rule";
 import { evaluate } from "../src/rule";
 import {
   composeRuleset,
@@ -9,7 +10,7 @@ import {
 // ── synthesizeDefaults ─────────────────────────────────────────────────────
 
 describe("synthesizeDefaults", () => {
-  test("emits a single universal catch-all rule with layer 'default'", () => {
+  test("emits a single universal catch-all rule with layer 'default' and origin 'builtin'", () => {
     const rules = synthesizeDefaults("ask");
     expect(rules).toHaveLength(1);
     expect(rules[0]).toEqual({
@@ -17,6 +18,7 @@ describe("synthesizeDefaults", () => {
       pattern: "*",
       action: "ask",
       layer: "default",
+      origin: "builtin",
     });
   });
 
@@ -38,6 +40,39 @@ describe("synthesizeDefaults", () => {
     const rules = synthesizeDefaults("allow");
     expect(evaluate("read", "*", rules).layer).toBe("default");
   });
+
+  test("defaults to origin 'builtin' when no origin supplied", () => {
+    const rules = synthesizeDefaults("ask");
+    expect(rules[0].origin).toBe("builtin");
+  });
+
+  test("universal rule carries config scope origin when supplied", () => {
+    const origin: RuleOrigin = "global";
+    const rules = synthesizeDefaults("ask", origin);
+    expect(rules[0].origin).toBe("global");
+  });
+
+  test("origin is preserved through evaluate()", () => {
+    const rules = synthesizeDefaults("allow", "project");
+    const result = evaluate("read", "*", rules);
+    expect(result.origin).toBe("project");
+  });
+
+  test("all RuleOrigin values are accepted", () => {
+    const origins: RuleOrigin[] = [
+      "global",
+      "project",
+      "agent",
+      "project-agent",
+      "builtin",
+      "baseline",
+      "session",
+    ];
+    for (const origin of origins) {
+      const rules = synthesizeDefaults("ask", origin);
+      expect(rules[0].origin).toBe(origin);
+    }
+  });
 });
 
 // ── synthesizeBaseline ─────────────────────────────────────────────────────
@@ -50,6 +85,7 @@ describe("synthesizeBaseline", () => {
         pattern: "*",
         action: "deny" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     expect(synthesizeBaseline(configRules)).toEqual([]);
@@ -66,19 +102,21 @@ describe("synthesizeBaseline", () => {
         pattern: "exa:*",
         action: "allow" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const rules = synthesizeBaseline(configRules);
     expect(rules).toHaveLength(5);
   });
 
-  test("baseline rules all have layer 'baseline' and action 'allow'", () => {
+  test("baseline rules all have layer 'baseline', action 'allow', and origin 'baseline'", () => {
     const configRules = [
       {
         surface: "mcp",
         pattern: "exa:*",
         action: "allow" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const rules = synthesizeBaseline(configRules);
@@ -86,6 +124,7 @@ describe("synthesizeBaseline", () => {
       expect(rule.layer).toBe("baseline");
       expect(rule.action).toBe("allow");
       expect(rule.surface).toBe("mcp");
+      expect(rule.origin).toBe("baseline");
     }
   });
 
@@ -96,6 +135,7 @@ describe("synthesizeBaseline", () => {
         pattern: "exa:*",
         action: "allow" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const rules = synthesizeBaseline(configRules);
@@ -114,6 +154,7 @@ describe("synthesizeBaseline", () => {
         pattern: "git *",
         action: "allow" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     expect(synthesizeBaseline(configRules)).toEqual([]);
@@ -126,12 +167,14 @@ describe("synthesizeBaseline", () => {
         pattern: "exa:*",
         action: "allow" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const rules = synthesizeBaseline(configRules);
     const result = evaluate("mcp", "mcp_status", rules);
     expect(result.action).toBe("allow");
     expect(result.layer).toBe("baseline");
+    expect(result.origin).toBe("baseline");
   });
 });
 
@@ -141,10 +184,21 @@ describe("composeRuleset", () => {
   test("returns concatenation of all layers in order", () => {
     const defaults = synthesizeDefaults("ask");
     const baseline = synthesizeBaseline([
-      { surface: "mcp", pattern: "exa:*", action: "allow", layer: "config" },
+      {
+        surface: "mcp",
+        pattern: "exa:*",
+        action: "allow",
+        layer: "config",
+        origin: "global" as const,
+      },
     ]);
     const config = [
-      { surface: "bash", pattern: "rm -rf *", action: "deny" as const },
+      {
+        surface: "bash",
+        pattern: "rm -rf *",
+        action: "deny" as const,
+        origin: "global" as const,
+      },
     ];
     const composed = composeRuleset(defaults, baseline, config);
     expect(composed.length).toBe(
@@ -160,6 +214,7 @@ describe("composeRuleset", () => {
         pattern: "*",
         action: "deny" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const composed = composeRuleset(defaults, [], config);
@@ -176,6 +231,7 @@ describe("composeRuleset", () => {
         pattern: "*",
         action: "allow" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const composed = composeRuleset(defaults, [], config);
@@ -192,6 +248,7 @@ describe("composeRuleset", () => {
         pattern: "mcp_status",
         action: "allow" as const,
         layer: "baseline" as const,
+        origin: "baseline" as const,
       },
     ];
     const config = [
@@ -200,6 +257,7 @@ describe("composeRuleset", () => {
         pattern: "mcp_status",
         action: "deny" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const composed = composeRuleset(defaults, baseline, config);
@@ -216,6 +274,7 @@ describe("composeRuleset", () => {
         pattern: "mcp_status",
         action: "allow" as const,
         layer: "baseline" as const,
+        origin: "baseline" as const,
       },
     ];
     const config = [
@@ -224,6 +283,7 @@ describe("composeRuleset", () => {
         pattern: "exa_web_search",
         action: "allow" as const,
         layer: "config" as const,
+        origin: "global" as const,
       },
     ];
     const composed = composeRuleset(defaults, baseline, config);

package/tests/tool-input-preview.test.ts

@@ -365,6 +365,7 @@ describe("getToolInputPreviewForLog", () => {
       toolName: "bash",
       state: "allow",
       source: "tool",
+      origin: "builtin",
     };
     expect(
       getToolInputPreviewForLog(result, { command: "ls" }, pathBearingTools),
@@ -376,6 +377,7 @@ describe("getToolInputPreviewForLog", () => {
       toolName: "mcp",
       state: "allow",
       source: "tool",
+      origin: "builtin",
     };
     expect(
       getToolInputPreviewForLog(result, {}, pathBearingTools),
@@ -387,6 +389,7 @@ describe("getToolInputPreviewForLog", () => {
       toolName: "some-server:some-tool",
       state: "allow",
       source: "mcp",
+      origin: "builtin",
     };
     expect(
       getToolInputPreviewForLog(result, {}, pathBearingTools),
@@ -398,6 +401,7 @@ describe("getToolInputPreviewForLog", () => {
       toolName: "read",
       state: "allow",
       source: "tool",
+      origin: "builtin",
     };
     const preview = getToolInputPreviewForLog(
       result,
@@ -413,6 +417,7 @@ describe("getToolInputPreviewForLog", () => {
       toolName: "task",
       state: "allow",
       source: "tool",
+      origin: "builtin",
     };
     const preview = getToolInputPreviewForLog(
       result,
@@ -431,6 +436,7 @@ describe("getPermissionLogContext", () => {
       toolName: "bash",
       state: "allow",
       source: "tool",
+      origin: "builtin",
       command: "ls -la",
     };
     const ctx = getPermissionLogContext(result, {}, pathBearingTools);
@@ -444,6 +450,7 @@ describe("getPermissionLogContext", () => {
       toolName: "read",
       state: "allow",
       source: "tool",
+      origin: "builtin",
     };
     const ctx = getPermissionLogContext(
       result,
@@ -452,4 +459,26 @@ describe("getPermissionLogContext", () => {
     );
     expect(ctx.toolInputPreview).toContain("/foo.ts");
   });
+
+  test("includes origin from check result when present", () => {
+    const result: PermissionCheckResult = {
+      toolName: "read",
+      state: "allow",
+      source: "tool",
+      origin: "project",
+    };
+    const ctx = getPermissionLogContext(result, {}, pathBearingTools);
+    expect(ctx.origin).toBe("project");
+  });
+
+  test("origin is 'builtin' when check result has builtin origin", () => {
+    const result: PermissionCheckResult = {
+      toolName: "read",
+      state: "allow",
+      source: "tool",
+      origin: "builtin",
+    };
+    const ctx = getPermissionLogContext(result, {}, pathBearingTools);
+    expect(ctx.origin).toBe("builtin");
+  });
 });