@gotgenes/pi-permission-system 5.9.0 → 5.11.0

package/tests/handlers/tool-call.test.ts

@@ -1,10 +1,13 @@
 import type { ExtensionContext } from "@mariozechner/pi-coding-agent";
 import { describe, expect, it, vi } from "vitest";
 
-import { getEventInput, handleToolCall } from "../../src/handlers/tool-call";
-import type { HandlerDeps } from "../../src/handlers/types";
-import type { SessionState } from "../../src/runtime";
-import type { PermissionCheckResult } from "../../src/types";
+import {
+  getEventInput,
+  PermissionGateHandler,
+} from "../../src/handlers/permission-gate-handler";
+import type { PermissionSession } from "../../src/permission-session";
+import type { ToolRegistry } from "../../src/tool-registry";
+import type { PermissionCheckResult, PermissionState } from "../../src/types";
 
 // ── SDK stubs ──────────────────────────────────────────────────────────────
 vi.mock("@mariozechner/pi-coding-agent", async (importOriginal) => {
@@ -55,49 +58,58 @@ function makePermissionResult(
   return { state, toolName: "read", source: "tool", origin: "builtin" };
 }
 
-function makeSession(overrides: Partial<SessionState> = {}): SessionState {
+function makeSession(
+  overrides: Partial<Record<keyof PermissionSession, unknown>> = {},
+): PermissionSession {
   return {
-    runtimeContext: null,
-    permissionManager: {
-      checkPermission: vi.fn().mockReturnValue(makePermissionResult("allow")),
-    } as unknown as SessionState["permissionManager"],
-    activeSkillEntries: [],
-    lastKnownActiveAgentName: null,
-    lastActiveToolsCacheKey: null,
-    lastPromptStateCacheKey: null,
-    sessionRules: {
-      approve: vi.fn(),
-      getRuleset: vi.fn().mockReturnValue([]),
-      clear: vi.fn(),
-    } as unknown as SessionState["sessionRules"],
+    logger: { debug: vi.fn(), review: vi.fn(), warn: vi.fn() },
+    activate: vi.fn(),
+    resolveAgentName: vi.fn().mockReturnValue(null),
+    checkPermission: vi.fn().mockReturnValue(makePermissionResult("allow")),
+    getToolPermission: vi.fn().mockReturnValue("allow" as PermissionState),
+    getSessionRuleset: vi.fn().mockReturnValue([]),
+    approveSessionRule: vi.fn(),
+    getActiveSkillEntries: vi.fn().mockReturnValue([]),
+    getInfrastructureDirs: vi
+      .fn()
+      .mockReturnValue(["/test/agent", "/test/agent/git"]),
+    getInfrastructureReadPaths: vi.fn().mockReturnValue([]),
+    canPrompt: vi.fn().mockReturnValue(true),
+    prompt: vi.fn().mockResolvedValue({ approved: true, state: "approved" }),
     ...overrides,
+  } as unknown as PermissionSession;
+}
+
+function makeEvents() {
+  return {
+    emit: vi.fn(),
+    on: vi.fn().mockReturnValue(() => undefined),
   };
 }
 
-function makeDeps(overrides: Partial<HandlerDeps> = {}): HandlerDeps {
+function makeToolRegistry(overrides: Partial<ToolRegistry> = {}): ToolRegistry {
   return {
-    session: makeSession(),
-    logger: { debug: vi.fn(), review: vi.fn(), warn: vi.fn() },
-    piInfrastructureDirs: ["/test/agent", "/test/agent/git"],
-    getPiInfrastructureReadPaths: vi.fn().mockReturnValue([]),
-    createPermissionManagerForCwd: vi.fn(),
-    refreshExtensionConfig: vi.fn(),
-    logResolvedConfigPaths: vi.fn(),
-    resolveAgentName: vi.fn().mockReturnValue(null),
-    canRequestPermissionConfirmation: vi.fn().mockReturnValue(true),
-    promptPermission: vi
-      .fn()
-      .mockResolvedValue({ approved: true, state: "approved" }),
-    createPermissionRequestId: vi.fn().mockReturnValue("req-id"),
-    events: { emit: vi.fn(), on: vi.fn().mockReturnValue(() => undefined) },
-    forwarding: { start: vi.fn(), stop: vi.fn() },
-    stopPermissionRpcHandlers: vi.fn(),
-    getAllTools: vi.fn().mockReturnValue([{ name: "read" }, { name: "bash" }]),
-    setActiveTools: vi.fn(),
+    getAll: vi.fn().mockReturnValue([{ name: "read" }, { name: "bash" }]),
+    setActive: vi.fn(),
     ...overrides,
   };
 }
 
+function makeHandler(overrides?: {
+  session?: Partial<Record<keyof PermissionSession, unknown>>;
+  toolRegistry?: Partial<ToolRegistry>;
+}): {
+  handler: PermissionGateHandler;
+  session: PermissionSession;
+  toolRegistry: ToolRegistry;
+} {
+  const session = makeSession(overrides?.session);
+  const events = makeEvents();
+  const toolRegistry = makeToolRegistry(overrides?.toolRegistry);
+  const handler = new PermissionGateHandler(session, events, toolRegistry);
+  return { handler, session, toolRegistry };
+}
+
 // ── getEventInput ──────────────────────────────────────────────────────────
 
 describe("getEventInput", () => {
@@ -127,24 +139,19 @@ describe("getEventInput", () => {
 // ── handleToolCall ─────────────────────────────────────────────────────────
 
 describe("handleToolCall", () => {
-  it("sets runtime context", async () => {
-    const ctx = makeCtx();
-    const deps = makeDeps();
-    await handleToolCall(deps, makeToolCallEvent("read"), ctx);
-    expect(deps.session.runtimeContext).toBe(ctx);
-  });
-
-  it("starts forwarded permission polling", async () => {
+  it("activates session with ctx", async () => {
     const ctx = makeCtx();
-    const deps = makeDeps();
-    await handleToolCall(deps, makeToolCallEvent("read"), ctx);
-    expect(deps.forwarding.start).toHaveBeenCalledWith(ctx);
+    const { handler, session } = makeHandler();
+    await handler.handleToolCall(makeToolCallEvent("read"), ctx);
+    expect(session.activate).toHaveBeenCalledWith(ctx);
   });
 
   it("blocks when tool name cannot be resolved", async () => {
-    const deps = makeDeps();
-    // An event with no recognisable name field
-    const result = await handleToolCall(deps, { type: "tool_call" }, makeCtx());
+    const { handler } = makeHandler();
+    const result = await handler.handleToolCall(
+      { type: "tool_call" },
+      makeCtx(),
+    );
     expect(result).toEqual({
       block: true,
       reason: expect.stringContaining("tool"),
@@ -152,11 +159,12 @@ describe("handleToolCall", () => {
   });
 
   it("blocks when tool is not registered", async () => {
-    const deps = makeDeps({
-      getAllTools: vi.fn().mockReturnValue([{ name: "read" }]),
+    const { handler } = makeHandler({
+      toolRegistry: {
+        getAll: vi.fn().mockReturnValue([{ name: "read" }]),
+      },
     });
-    const result = await handleToolCall(
-      deps,
+    const result = await handler.handleToolCall(
       makeToolCallEvent("unknown-tool"),
       makeCtx(),
     );
@@ -164,10 +172,8 @@ describe("handleToolCall", () => {
   });
 
   it("returns empty object when tool is allowed", async () => {
-    // default makeRuntime() has checkPermission → "allow"
-    const deps = makeDeps();
-    const result = await handleToolCall(
-      deps,
+    const { handler } = makeHandler();
+    const result = await handler.handleToolCall(
       makeToolCallEvent("read"),
       makeCtx(),
     );
@@ -175,17 +181,12 @@ describe("handleToolCall", () => {
   });
 
   it("blocks when tool is denied by policy", async () => {
-    const deps = makeDeps({
-      session: makeSession({
-        permissionManager: {
-          checkPermission: vi
-            .fn()
-            .mockReturnValue(makePermissionResult("deny")),
-        } as unknown as SessionState["permissionManager"],
-      }),
+    const { handler } = makeHandler({
+      session: {
+        checkPermission: vi.fn().mockReturnValue(makePermissionResult("deny")),
+      },
     });
-    const result = await handleToolCall(
-      deps,
+    const result = await handler.handleToolCall(
       makeToolCallEvent("read"),
       makeCtx(),
     );
@@ -205,9 +206,13 @@ describe("handleToolCall — skill-read gate", () => {
       normalizedLocation: "/skills/librarian/SKILL.md",
       normalizedBaseDir: "/skills/librarian",
     };
-    const deps = makeDeps({
-      session: makeSession({ activeSkillEntries: [skillEntry] }),
-      getAllTools: vi.fn().mockReturnValue([{ toolName: "read" }]),
+    const { handler } = makeHandler({
+      session: {
+        getActiveSkillEntries: vi.fn().mockReturnValue([skillEntry]),
+      },
+      toolRegistry: {
+        getAll: vi.fn().mockReturnValue([{ toolName: "read" }]),
+      },
     });
     const event = {
       type: "tool_call",
@@ -215,7 +220,7 @@ describe("handleToolCall — skill-read gate", () => {
       toolName: "read",
       input: { path: "/skills/librarian/SKILL.md" },
     };
-    const result = await handleToolCall(deps, event, makeCtx());
+    const result = await handler.handleToolCall(event, makeCtx());
     expect(result).toMatchObject({ block: true });
   });
 
@@ -228,9 +233,13 @@ describe("handleToolCall — skill-read gate", () => {
       normalizedLocation: "/skills/librarian/SKILL.md",
       normalizedBaseDir: "/skills/librarian",
     };
-    const deps = makeDeps({
-      session: makeSession({ activeSkillEntries: [skillEntry] }),
-      getAllTools: vi.fn().mockReturnValue([{ toolName: "read" }]),
+    const { handler } = makeHandler({
+      session: {
+        getActiveSkillEntries: vi.fn().mockReturnValue([skillEntry]),
+      },
+      toolRegistry: {
+        getAll: vi.fn().mockReturnValue([{ toolName: "read" }]),
+      },
     });
     const event = {
       type: "tool_call",
@@ -238,7 +247,7 @@ describe("handleToolCall — skill-read gate", () => {
       toolName: "read",
       input: { path: "/test/project/src/index.ts" },
     };
-    const result = await handleToolCall(deps, event, makeCtx());
+    const result = await handler.handleToolCall(event, makeCtx());
     expect(result).toEqual({});
   });
 });
@@ -247,15 +256,13 @@ describe("handleToolCall — skill-read gate", () => {
 
 describe("handleToolCall — external-directory gate", () => {
   it("blocks a read of a path outside cwd when policy is deny", async () => {
-    const deps = makeDeps({
-      session: makeSession({
-        permissionManager: {
-          checkPermission: vi
-            .fn()
-            .mockReturnValue(makePermissionResult("deny")),
-        } as unknown as SessionState["permissionManager"],
-      }),
-      getAllTools: vi.fn().mockReturnValue([{ name: "read" }]),
+    const { handler } = makeHandler({
+      session: {
+        checkPermission: vi.fn().mockReturnValue(makePermissionResult("deny")),
+      },
+      toolRegistry: {
+        getAll: vi.fn().mockReturnValue([{ name: "read" }]),
+      },
     });
     const event = {
       type: "tool_call",
@@ -263,7 +270,7 @@ describe("handleToolCall — external-directory gate", () => {
       name: "read",
       input: { path: "/outside/project/file.ts" },
     };
-    const result = await handleToolCall(deps, event, makeCtx());
+    const result = await handler.handleToolCall(event, makeCtx());
     expect(result).toMatchObject({ block: true });
   });
 });
@@ -272,15 +279,13 @@ describe("handleToolCall — external-directory gate", () => {
 
 describe("handleToolCall — bash external-directory gate", () => {
   it("blocks a bash command referencing an external path when policy is deny", async () => {
-    const deps = makeDeps({
-      session: makeSession({
-        permissionManager: {
-          checkPermission: vi
-            .fn()
-            .mockReturnValue(makePermissionResult("deny")),
-        } as unknown as SessionState["permissionManager"],
-      }),
-      getAllTools: vi.fn().mockReturnValue([{ name: "bash" }]),
+    const { handler } = makeHandler({
+      session: {
+        checkPermission: vi.fn().mockReturnValue(makePermissionResult("deny")),
+      },
+      toolRegistry: {
+        getAll: vi.fn().mockReturnValue([{ name: "bash" }]),
+      },
     });
     const event = {
       type: "tool_call",
@@ -288,7 +293,7 @@ describe("handleToolCall — bash external-directory gate", () => {
       name: "bash",
       input: { command: "cat /outside/project/file.ts" },
     };
-    const result = await handleToolCall(deps, event, makeCtx());
+    const result = await handler.handleToolCall(event, makeCtx());
     expect(result).toMatchObject({ block: true });
   });
 });

package/tests/permission-prompter.test.ts

@@ -15,8 +15,8 @@ vi.mock("../src/forwarded-permissions/polling", () => ({
 
 import type { ExtensionContext } from "@mariozechner/pi-coding-agent";
 import { DEFAULT_EXTENSION_CONFIG } from "../src/extension-config";
-import type { PromptPermissionDetails } from "../src/handlers/types";
 import type { PermissionPromptDecision } from "../src/permission-dialog";
+import type { PromptPermissionDetails } from "../src/permission-prompter";
 import {
   PermissionPrompter,
   type PermissionPrompterDeps,