@gotgenes/pi-permission-system 5.4.0 → 5.5.0

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.5.0](https://github.com/gotgenes/pi-permission-system/compare/v5.4.0...v5.5.0) (2026-05-07)
+
+
+### Features
+
+* extract FilePolicyLoader from PermissionManager ([705d800](https://github.com/gotgenes/pi-permission-system/commit/705d800ec326d99798be2abaeba83235adae55b2))
+
+
+### Bug Fixes
+
+* pass through npm calls targeting .pi/npm directory ([4104712](https://github.com/gotgenes/pi-permission-system/commit/4104712a17baa2b1eae5fd6388357b672798f8bb))
+
+
+### Documentation
+
+* add PolicyLoader to target architecture ([fbbb85f](https://github.com/gotgenes/pi-permission-system/commit/fbbb85f76830880c8b3906f3694c7a7f7bb7fab5))
+* plan extract PolicyLoader from PermissionManager ([#108](https://github.com/gotgenes/pi-permission-system/issues/108)) ([4d5f0df](https://github.com/gotgenes/pi-permission-system/commit/4d5f0df11af4bd87061ca38c19a14cc807dd6e84))
+* **retro:** add retro notes for issue [#107](https://github.com/gotgenes/pi-permission-system/issues/107) ([d979562](https://github.com/gotgenes/pi-permission-system/commit/d979562cee6e2aca0e1f2d232c8d18ddb7926dd4))
+
 ## [5.4.0](https://github.com/gotgenes/pi-permission-system/compare/v5.3.4...v5.4.0) (2026-05-07)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "5.4.0",
+  "version": "5.5.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "files": [

package/src/permission-manager.ts

@@ -1,21 +1,12 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { getAgentDir } from "@mariozechner/pi-coding-agent";
-
-import {
-  extractFrontmatter,
-  isPermissionState,
-  parseSimpleYamlMap,
-  toRecord,
-} from "./common";
-import {
-  loadUnifiedConfig,
-  normalizeUnifiedConfig,
-  stripJsonComments,
-} from "./config-loader";
-import { getGlobalConfigPath } from "./config-paths";
+import { isPermissionState } from "./common";
 import { normalizeInput } from "./input-normalizer";
 import { normalizeFlatConfig } from "./normalize";
+import {
+  FilePolicyLoader,
+  type PolicyLoader,
+  type PolicyLoaderOptions,
+  type ResolvedPolicyPaths,
+} from "./policy-loader";
 import type { Rule, RuleOrigin, Ruleset } from "./rule";
 import { evaluate, evaluateFirst } from "./rule";
 import {
@@ -27,19 +18,8 @@ import type {
   FlatPermissionConfig,
   PermissionCheckResult,
   PermissionState,
-  ScopeConfig,
 } from "./types";
 
-function defaultGlobalConfigPath(): string {
-  return getGlobalConfigPath(getAgentDir());
-}
-function defaultAgentsDir(): string {
-  return join(getAgentDir(), "agents");
-}
-function defaultGlobalMcpConfigPath(): string {
-  return join(getAgentDir(), "mcp.json");
-}
-
 const BUILT_IN_TOOL_PERMISSION_NAMES = new Set([
   "bash",
   "read",
@@ -83,49 +63,10 @@ function mergeFlatPermissions(
   return merged;
 }
 
-function readConfiguredMcpServerNamesFromConfigPath(
-  configPath: string,
-): string[] {
-  try {
-    const raw = readFileSync(configPath, "utf-8");
-    const parsed = JSON.parse(stripJsonComments(raw)) as unknown;
-    const root = toRecord(parsed);
-    const serverRecord = toRecord(root.mcpServers ?? root["mcp-servers"]);
-
-    return Object.keys(serverRecord)
-      .map((name) => name.trim())
-      .filter((name) => name.length > 0);
-  } catch {
-    return [];
-  }
-}
-
-function getConfiguredMcpServerNamesFromPaths(
-  paths: readonly string[],
-): string[] {
-  const seen = new Set<string>();
-
-  for (const path of paths) {
-    for (const name of readConfiguredMcpServerNamesFromConfigPath(path)) {
-      seen.add(name);
-    }
-  }
-
-  return [...seen].sort(
-    (left, right) => right.length - left.length || left.localeCompare(right),
-  );
-}
-
-export interface ResolvedPolicyPaths {
-  globalConfigPath: string;
-  globalConfigExists: boolean;
-  projectConfigPath: string | null;
-  projectConfigExists: boolean;
-  agentsDir: string;
-  agentsDirExists: boolean;
-  projectAgentsDir: string | null;
-  projectAgentsDirExists: boolean;
-}
+type FileCacheEntry<TValue> = {
+  stamp: string;
+  value: TValue;
+};
 
 type ResolvedPermissions = {
   /**
@@ -135,223 +76,47 @@ type ResolvedPermissions = {
   composedRules: Ruleset;
 };
 
-type FileCacheEntry<TValue> = {
-  stamp: string;
-  value: TValue;
-};
-
-function getFileStamp(path: string): string {
-  try {
-    return String(statSync(path).mtimeMs);
-  } catch {
-    return "missing";
-  }
+export interface PermissionManagerOptions extends PolicyLoaderOptions {
+  policyLoader?: PolicyLoader;
 }
 
 export class PermissionManager {
-  private readonly globalConfigPath: string;
-  private readonly agentsDir: string;
-  private readonly projectGlobalConfigPath: string | null;
-  private readonly projectAgentsDir: string | null;
-  private readonly globalMcpConfigPath: string;
-  private readonly configuredMcpServerNamesOverride: readonly string[] | null;
-  private globalConfigCache: FileCacheEntry<ScopeConfig> | null = null;
-  private projectGlobalConfigCache: FileCacheEntry<ScopeConfig> | null = null;
-  private readonly agentConfigCache = new Map<
-    string,
-    FileCacheEntry<ScopeConfig>
-  >();
-  private readonly projectAgentConfigCache = new Map<
-    string,
-    FileCacheEntry<ScopeConfig>
-  >();
+  private readonly loader: PolicyLoader;
   private readonly resolvedPermissionsCache = new Map<
     string,
     FileCacheEntry<ResolvedPermissions>
   >();
-  private configuredMcpServerNamesCache: FileCacheEntry<
-    readonly string[]
-  > | null = null;
-  private accumulatedConfigIssues: string[] = [];
-
-  constructor(
-    options: {
-      globalConfigPath?: string;
-      agentsDir?: string;
-      projectGlobalConfigPath?: string;
-      projectAgentsDir?: string;
-      globalMcpConfigPath?: string;
-      mcpServerNames?: readonly string[];
-    } = {},
-  ) {
-    this.globalConfigPath =
-      options.globalConfigPath || defaultGlobalConfigPath();
-    this.agentsDir = options.agentsDir || defaultAgentsDir();
-    this.projectGlobalConfigPath = options.projectGlobalConfigPath || null;
-    this.projectAgentsDir = options.projectAgentsDir || null;
-    this.globalMcpConfigPath =
-      options.globalMcpConfigPath || defaultGlobalMcpConfigPath();
-    this.configuredMcpServerNamesOverride = options.mcpServerNames
-      ? [
-          ...new Set(
-            options.mcpServerNames
-              .map((name) => name.trim())
-              .filter((name) => name.length > 0),
-          ),
-        ]
-      : null;
-  }
 
-  private accumulateConfigIssues(issues: string[]): void {
-    for (const issue of issues) {
-      if (!this.accumulatedConfigIssues.includes(issue)) {
-        this.accumulatedConfigIssues.push(issue);
-      }
-    }
+  constructor(options: PermissionManagerOptions = {}) {
+    this.loader = options.policyLoader ?? new FilePolicyLoader(options);
   }
 
   getConfigIssues(agentName?: string): string[] {
     // Trigger a load/resolve to ensure issues are collected.
     this.resolvePermissions(agentName);
-    return [...this.accumulatedConfigIssues];
-  }
-
-  private loadGlobalConfig(): ScopeConfig {
-    const stamp = getFileStamp(this.globalConfigPath);
-    if (this.globalConfigCache?.stamp === stamp) {
-      return this.globalConfigCache.value;
-    }
-
-    const { config, issues } = loadUnifiedConfig(this.globalConfigPath);
-    this.accumulateConfigIssues(issues);
-
-    const value: ScopeConfig = {
-      permission: config.permission,
-    };
-
-    this.globalConfigCache = { stamp, value };
-    return value;
-  }
-
-  private loadProjectGlobalConfig(): ScopeConfig {
-    if (!this.projectGlobalConfigPath) {
-      return {};
-    }
-
-    const stamp = getFileStamp(this.projectGlobalConfigPath);
-    if (this.projectGlobalConfigCache?.stamp === stamp) {
-      return this.projectGlobalConfigCache.value;
-    }
-
-    const { config, issues } = loadUnifiedConfig(this.projectGlobalConfigPath);
-    this.accumulateConfigIssues(issues);
-
-    const value: ScopeConfig = {
-      permission: config.permission,
-    };
-
-    this.projectGlobalConfigCache = { stamp, value };
-    return value;
-  }
-
-  private loadScopeConfigFrom(
-    dir: string | null,
-    cache: Map<string, FileCacheEntry<ScopeConfig>>,
-    agentName?: string,
-  ): ScopeConfig {
-    if (!dir || !agentName) {
-      return {};
-    }
-
-    const filePath = join(dir, `${agentName}.md`);
-    const stamp = getFileStamp(filePath);
-    const cached = cache.get(agentName);
-    if (cached?.stamp === stamp) {
-      return cached.value;
-    }
-
-    let value: ScopeConfig;
-    try {
-      const markdown = readFileSync(filePath, "utf-8");
-      const frontmatter = extractFrontmatter(markdown);
-      if (!frontmatter) {
-        value = {};
-      } else {
-        const parsed = parseSimpleYamlMap(frontmatter);
-        // Re-use the config-loader normalizer so the flat permission shape
-        // is validated the same way as on-disk config files.
-        const { config, issues } = normalizeUnifiedConfig(parsed);
-        this.accumulateConfigIssues(issues);
-        value = { permission: config.permission };
-      }
-    } catch {
-      value = {};
-    }
-
-    cache.set(agentName, { stamp, value });
-    return value;
-  }
-
-  private loadScopeConfig(agentName?: string): ScopeConfig {
-    return this.loadScopeConfigFrom(
-      this.agentsDir,
-      this.agentConfigCache,
-      agentName,
-    );
-  }
-
-  private loadProjectScopeConfig(agentName?: string): ScopeConfig {
-    return this.loadScopeConfigFrom(
-      this.projectAgentsDir,
-      this.projectAgentConfigCache,
-      agentName,
-    );
+    return [...this.loader.getConfigIssues()];
   }
 
   getResolvedPolicyPaths(): ResolvedPolicyPaths {
-    return {
-      globalConfigPath: this.globalConfigPath,
-      globalConfigExists: existsSync(this.globalConfigPath),
-      projectConfigPath: this.projectGlobalConfigPath,
-      projectConfigExists: this.projectGlobalConfigPath
-        ? existsSync(this.projectGlobalConfigPath)
-        : false,
-      agentsDir: this.agentsDir,
-      agentsDirExists: existsSync(this.agentsDir),
-      projectAgentsDir: this.projectAgentsDir,
-      projectAgentsDirExists: this.projectAgentsDir
-        ? existsSync(this.projectAgentsDir)
-        : false,
-    };
+    return this.loader.getResolvedPolicyPaths();
   }
 
   getPolicyCacheStamp(agentName?: string): string {
-    const agentStamp = agentName
-      ? getFileStamp(join(this.agentsDir, `${agentName}.md`))
-      : "missing";
-    const projectStamp = this.projectGlobalConfigPath
-      ? getFileStamp(this.projectGlobalConfigPath)
-      : "none";
-    const projectAgentStamp =
-      this.projectAgentsDir && agentName
-        ? getFileStamp(join(this.projectAgentsDir, `${agentName}.md`))
-        : "none";
-
-    return `${getFileStamp(this.globalConfigPath)}|${projectStamp}|${agentStamp}|${projectAgentStamp}`;
+    return this.loader.getCacheStamp(agentName);
   }
 
   private resolvePermissions(agentName?: string): ResolvedPermissions {
     const cacheKey = agentName || "__global__";
-    const stamp = this.getPolicyCacheStamp(agentName);
+    const stamp = this.loader.getCacheStamp(agentName);
     const cached = this.resolvedPermissionsCache.get(cacheKey);
     if (cached?.stamp === stamp) {
       return cached.value;
     }
 
-    const globalConfig = this.loadGlobalConfig();
-    const projectConfig = this.loadProjectGlobalConfig();
-    const agentConfig = this.loadScopeConfig(agentName);
-    const projectAgentConfig = this.loadProjectScopeConfig(agentName);
+    const globalConfig = this.loader.loadGlobalConfig();
+    const projectConfig = this.loader.loadProjectConfig();
+    const agentConfig = this.loader.loadAgentConfig(agentName);
+    const projectAgentConfig = this.loader.loadProjectAgentConfig(agentName);
 
     // Merge permission objects across scopes (lowest → highest precedence).
     // Build a parallel origin map that tracks which scope contributed each
@@ -442,24 +207,6 @@ export class PermissionManager {
     return value;
   }
 
-  private getConfiguredMcpServerNames(): readonly string[] {
-    if (this.configuredMcpServerNamesOverride) {
-      return this.configuredMcpServerNamesOverride;
-    }
-
-    const paths = [this.globalMcpConfigPath];
-    const stamp = paths
-      .map((path) => `${path}:${getFileStamp(path)}`)
-      .join("|");
-    if (this.configuredMcpServerNamesCache?.stamp === stamp) {
-      return this.configuredMcpServerNamesCache.value;
-    }
-
-    const value = getConfiguredMcpServerNamesFromPaths(paths);
-    this.configuredMcpServerNamesCache = { stamp, value };
-    return value;
-  }
-
   /**
    * Return the composed config-layer rules for the given agent scope.
    * Used by the `/permission-system show` command to display effective rules
@@ -518,7 +265,7 @@ export class PermissionManager {
     const { surface, values, resultExtras } = normalizeInput(
       normalizedToolName,
       input,
-      this.getConfiguredMcpServerNames(),
+      this.loader.getConfiguredMcpServerNames(),
     );
 
     const { rule, value } = evaluateFirst(surface, values, fullRules);
@@ -579,4 +326,6 @@ function deriveSource(
 
 // Keep isPermissionState and toRecord available for convenience — they are
 // used directly in some handler files that import from permission-manager.
-export { isPermissionState, toRecord };
+export { isPermissionState, toRecord } from "./common";
+// Re-export types that external modules import from this file.
+export type { PolicyLoader, ResolvedPolicyPaths } from "./policy-loader";