@komarspn/pi-permission-system 16.0.2

package/test/expand-home.test.ts

@@ -0,0 +1,93 @@
+import { join } from "node:path";
+import { afterEach, describe, expect, test, vi } from "vitest";
+
+const mockHomedir = vi.hoisted(() => vi.fn(() => "/home/testuser"));
+
+vi.mock("node:os", () => ({
+  homedir: mockHomedir,
+  default: { homedir: mockHomedir },
+}));
+
+import { expandHomePath } from "#src/expand-home";
+
+const FAKE_HOME = "/home/testuser";
+
+afterEach(() => {
+  mockHomedir.mockClear();
+});
+
+describe("expandHomePath", () => {
+  describe("~ expansion", () => {
+    test("bare ~ expands to homedir()", () => {
+      expect(expandHomePath("~")).toBe(FAKE_HOME);
+    });
+
+    test("~/path expands to homedir()/path", () => {
+      expect(expandHomePath("~/dev/project")).toBe(
+        join(FAKE_HOME, "dev/project"),
+      );
+    });
+
+    test("~/path/* expands to homedir()/path/*", () => {
+      expect(expandHomePath("~/dev/*")).toBe(join(FAKE_HOME, "dev/*"));
+    });
+
+    test("~\\ (Windows separator) expands to homedir() + rest", () => {
+      expect(expandHomePath("~\\dev\\project")).toBe(
+        join(FAKE_HOME, "dev\\project"),
+      );
+    });
+
+    test("~username (no separator) is not expanded (no-op)", () => {
+      expect(expandHomePath("~username")).toBe("~username");
+    });
+  });
+
+  describe("$HOME expansion", () => {
+    test("bare $HOME expands to homedir()", () => {
+      expect(expandHomePath("$HOME")).toBe(FAKE_HOME);
+    });
+
+    test("$HOME/path expands to homedir()/path", () => {
+      expect(expandHomePath("$HOME/dev/project")).toBe(
+        join(FAKE_HOME, "dev/project"),
+      );
+    });
+
+    test("$HOME/path/* expands to homedir()/path/*", () => {
+      expect(expandHomePath("$HOME/dev/*")).toBe(join(FAKE_HOME, "dev/*"));
+    });
+
+    test("$HOME\\ (Windows separator) expands to homedir() + rest", () => {
+      expect(expandHomePath("$HOME\\dev\\project")).toBe(
+        join(FAKE_HOME, "dev\\project"),
+      );
+    });
+
+    test("$HOMEDIR (no separator) is not expanded (no-op)", () => {
+      expect(expandHomePath("$HOMEDIR")).toBe("$HOMEDIR");
+    });
+  });
+
+  describe("no-op patterns", () => {
+    test("absolute path is unchanged", () => {
+      expect(expandHomePath("/usr/local/bin")).toBe("/usr/local/bin");
+    });
+
+    test("relative path is unchanged", () => {
+      expect(expandHomePath("dev/project")).toBe("dev/project");
+    });
+
+    test("glob-only pattern is unchanged", () => {
+      expect(expandHomePath("*")).toBe("*");
+    });
+
+    test("empty string is unchanged", () => {
+      expect(expandHomePath("")).toBe("");
+    });
+
+    test("bash command pattern starting with a word is unchanged", () => {
+      expect(expandHomePath("git push *")).toBe("git push *");
+    });
+  });
+});

package/test/extension-config.test.ts

@@ -0,0 +1,129 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  detectMisplacedPermissionKeys,
+  normalizePermissionSystemConfig,
+} from "#src/extension-config";
+
+describe("detectMisplacedPermissionKeys", () => {
+  it("returns an empty array for a record with only valid extension keys", () => {
+    const result = detectMisplacedPermissionKeys({
+      debugLog: true,
+      permissionReviewLog: true,
+      yoloMode: false,
+    });
+    expect(result).toEqual([]);
+  });
+
+  it("returns an empty array for an empty record", () => {
+    const result = detectMisplacedPermissionKeys({});
+    expect(result).toEqual([]);
+  });
+
+  it("returns misplaced key names when legacy permission-rule keys are present", () => {
+    const result = detectMisplacedPermissionKeys({
+      debugLog: true,
+      defaultPolicy: { tools: "ask" },
+      bash: { "git status": "allow" },
+    });
+    expect(result).toEqual(["defaultPolicy", "bash"]);
+  });
+
+  it("detects all known legacy permission-rule keys", () => {
+    const result = detectMisplacedPermissionKeys({
+      defaultPolicy: {},
+      tools: {},
+      bash: {},
+      mcp: {},
+      skills: {},
+      special: {},
+      external_directory: {},
+    });
+    expect(result).toEqual([
+      "defaultPolicy",
+      "tools",
+      "bash",
+      "mcp",
+      "skills",
+      "special",
+      "external_directory",
+    ]);
+  });
+
+  it("does not detect doom_loop as a misplaced permission key", () => {
+    const result = detectMisplacedPermissionKeys({
+      doom_loop: {},
+    });
+    expect(result).toEqual([]);
+  });
+
+  it("does not flag the new flat-format permission key as misplaced", () => {
+    const result = detectMisplacedPermissionKeys({
+      debugLog: false,
+      permission: { "*": "ask" },
+    });
+    expect(result).toEqual([]);
+  });
+
+  it("ignores unknown keys that are not permission-rule keys", () => {
+    const result = detectMisplacedPermissionKeys({
+      debugLog: true,
+      someRandomKey: "value",
+    });
+    expect(result).toEqual([]);
+  });
+});
+
+describe("normalizePermissionSystemConfig", () => {
+  it("normalizes a valid config object", () => {
+    const result = normalizePermissionSystemConfig({
+      debugLog: true,
+      permissionReviewLog: false,
+      yoloMode: true,
+    });
+    expect(result).toEqual({
+      debugLog: true,
+      permissionReviewLog: false,
+      yoloMode: true,
+    });
+  });
+
+  it("defaults debugLog to false when missing", () => {
+    const result = normalizePermissionSystemConfig({});
+    expect(result.debugLog).toBe(false);
+  });
+
+  it("defaults permissionReviewLog to true when missing", () => {
+    const result = normalizePermissionSystemConfig({});
+    expect(result.permissionReviewLog).toBe(true);
+  });
+
+  it("defaults yoloMode to false when missing", () => {
+    const result = normalizePermissionSystemConfig({});
+    expect(result.yoloMode).toBe(false);
+  });
+
+  it("includes toolInputPreviewMaxLength when a valid positive integer is provided", () => {
+    const result = normalizePermissionSystemConfig({
+      toolInputPreviewMaxLength: 400,
+    });
+    expect(result.toolInputPreviewMaxLength).toBe(400);
+  });
+
+  it("omits toolInputPreviewMaxLength when absent", () => {
+    const result = normalizePermissionSystemConfig({});
+    expect("toolInputPreviewMaxLength" in result).toBe(false);
+  });
+
+  it("includes toolTextSummaryMaxLength when a valid positive integer is provided", () => {
+    const result = normalizePermissionSystemConfig({
+      toolTextSummaryMaxLength: 120,
+    });
+    expect(result.toolTextSummaryMaxLength).toBe(120);
+  });
+
+  it("omits toolTextSummaryMaxLength when absent", () => {
+    const result = normalizePermissionSystemConfig({});
+    expect("toolTextSummaryMaxLength" in result).toBe(false);
+  });
+});

package/test/extension-paths.test.ts

@@ -0,0 +1,108 @@
+import { join } from "node:path";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { mockDiscoverGlobalNodeModulesRoot } = vi.hoisted(() => ({
+  mockDiscoverGlobalNodeModulesRoot: vi.fn<() => string | null>(),
+}));
+
+vi.mock("../src/node-modules-discovery", () => ({
+  discoverGlobalNodeModulesRoot: mockDiscoverGlobalNodeModulesRoot,
+}));
+
+import { getGlobalLogsDir } from "#src/config-paths";
+import { computeExtensionPaths } from "#src/extension-paths";
+
+describe("computeExtensionPaths", () => {
+  beforeEach(() => {
+    mockDiscoverGlobalNodeModulesRoot.mockReset();
+    mockDiscoverGlobalNodeModulesRoot.mockReturnValue(
+      "/mock/global/node_modules",
+    );
+  });
+
+  it("sets agentDir from argument", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.agentDir).toBe("/test/agent");
+  });
+
+  it("derives sessionsDir as agentDir/sessions", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.sessionsDir).toBe("/test/agent/sessions");
+  });
+
+  it("derives subagentSessionsDir as agentDir/subagent-sessions", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.subagentSessionsDir).toBe("/test/agent/subagent-sessions");
+  });
+
+  it("derives forwardingDir as sessionsDir/permission-forwarding", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.forwardingDir).toBe(
+      join("/test/agent/sessions", "permission-forwarding"),
+    );
+  });
+
+  it("derives globalLogsDir via getGlobalLogsDir(agentDir)", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.globalLogsDir).toBe(getGlobalLogsDir("/test/agent"));
+  });
+
+  it("includes agentDir in piInfrastructureDirs", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.piInfrastructureDirs).toContain("/test/agent");
+  });
+
+  it("includes agentDir/git in piInfrastructureDirs", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.piInfrastructureDirs).toContain("/test/agent/git");
+  });
+
+  it("includes discovered global node_modules root in piInfrastructureDirs", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.piInfrastructureDirs).toContain("/mock/global/node_modules");
+  });
+
+  it("omits global node_modules from piInfrastructureDirs when discovery returns null", () => {
+    mockDiscoverGlobalNodeModulesRoot.mockReturnValue(null);
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.piInfrastructureDirs).toHaveLength(2);
+    expect(paths.piInfrastructureDirs).toContain("/test/agent");
+    expect(paths.piInfrastructureDirs).toContain("/test/agent/git");
+  });
+
+  it("all entries in piInfrastructureDirs are strings (no null)", () => {
+    mockDiscoverGlobalNodeModulesRoot.mockReturnValue(null);
+    const paths = computeExtensionPaths("/test/agent");
+    for (const dir of paths.piInfrastructureDirs) {
+      expect(typeof dir).toBe("string");
+    }
+  });
+
+  it("includes piPackageDir in piInfrastructureDirs when provided", () => {
+    const paths = computeExtensionPaths("/test/agent", "/pi/install");
+    expect(paths.piInfrastructureDirs).toContain("/pi/install");
+  });
+
+  it("omits piPackageDir when not provided (current behavior preserved)", () => {
+    const paths = computeExtensionPaths("/test/agent");
+    expect(paths.piInfrastructureDirs).toEqual([
+      "/test/agent",
+      "/test/agent/git",
+      "/mock/global/node_modules",
+    ]);
+  });
+
+  it("omits piPackageDir when given an empty string", () => {
+    const paths = computeExtensionPaths("/test/agent", "");
+    expect(paths.piInfrastructureDirs).not.toContain("");
+  });
+
+  it("two calls with different agentDirs produce independent results", () => {
+    const a = computeExtensionPaths("/agent/a");
+    const b = computeExtensionPaths("/agent/b");
+    expect(a.agentDir).toBe("/agent/a");
+    expect(b.agentDir).toBe("/agent/b");
+    expect(a.sessionsDir).toBe("/agent/a/sessions");
+    expect(b.sessionsDir).toBe("/agent/b/sessions");
+  });
+});

package/test/forwarded-permissions/io.test.ts

@@ -0,0 +1,251 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  cleanupPermissionForwardingLocationIfEmpty,
+  formatUnknownErrorMessage,
+  isErrnoCode,
+  logPermissionForwardingError,
+  logPermissionForwardingWarning,
+  tryRemoveDirectoryIfEmpty,
+} from "#src/forwarded-permissions/io";
+import { createPermissionForwardingLocation } from "#src/permission-forwarding";
+import type { DebugReviewLogger } from "#src/session-logger";
+
+// ── helpers ────────────────────────────────────────────────────────────────
+
+function makeLogger(): DebugReviewLogger {
+  return {
+    review: vi.fn(),
+    debug: vi.fn(),
+  };
+}
+
+// ── formatUnknownErrorMessage ──────────────────────────────────────────────
+
+describe("formatUnknownErrorMessage", () => {
+  it("returns the error message for Error instances", () => {
+    expect(formatUnknownErrorMessage(new Error("oops"))).toBe("oops");
+  });
+
+  it("converts non-Error values to string", () => {
+    expect(formatUnknownErrorMessage("raw string")).toBe("raw string");
+    expect(formatUnknownErrorMessage(42)).toBe("42");
+  });
+
+  it("falls back to String(error) for Error with empty message", () => {
+    // error.message is falsy (""), so the function falls through to String(error)
+    const e = new Error("");
+    expect(formatUnknownErrorMessage(e)).toBe("Error");
+  });
+});
+
+// ── isErrnoCode ────────────────────────────────────────────────────────────
+
+describe("isErrnoCode", () => {
+  it("returns true when code matches", () => {
+    expect(isErrnoCode({ code: "ENOENT" }, "ENOENT")).toBe(true);
+  });
+
+  it("returns false when code does not match", () => {
+    expect(isErrnoCode({ code: "EACCES" }, "ENOENT")).toBe(false);
+  });
+
+  it("returns false for null", () => {
+    expect(isErrnoCode(null, "ENOENT")).toBe(false);
+  });
+
+  it("returns false when no code property", () => {
+    expect(isErrnoCode({}, "ENOENT")).toBe(false);
+  });
+});
+
+// ── logPermissionForwardingWarning ─────────────────────────────────────────
+
+describe("logPermissionForwardingWarning", () => {
+  it("calls logger.review with the warning event", () => {
+    const logger = makeLogger();
+    logPermissionForwardingWarning(logger, "something went wrong");
+    expect(logger.review).toHaveBeenCalledWith(
+      "permission_forwarding.warning",
+      { message: "something went wrong" },
+    );
+  });
+
+  it("calls logger.debug with the warning event", () => {
+    const logger = makeLogger();
+    logPermissionForwardingWarning(logger, "something went wrong");
+    expect(logger.debug).toHaveBeenCalledWith("permission_forwarding.warning", {
+      message: "something went wrong",
+    });
+  });
+
+  it("includes formatted error when an error is provided", () => {
+    const logger = makeLogger();
+    logPermissionForwardingWarning(logger, "bad thing", new Error("fs fail"));
+    expect(logger.review).toHaveBeenCalledWith(
+      "permission_forwarding.warning",
+      { message: "bad thing", error: "fs fail" },
+    );
+  });
+
+  it("does not throw when logger is null", () => {
+    expect(() => logPermissionForwardingWarning(null, "ignored")).not.toThrow();
+  });
+
+  it("does not call anything when logger is null", () => {
+    // Verify the null-logger path is a true no-op — cannot easily spy on null,
+    // but we can verify the call succeeds silently.
+    expect(() =>
+      logPermissionForwardingWarning(null, "msg", new Error("err")),
+    ).not.toThrow();
+  });
+});
+
+// ── logPermissionForwardingError ───────────────────────────────────────────
+
+describe("logPermissionForwardingError", () => {
+  it("calls logger.review with the error event", () => {
+    const logger = makeLogger();
+    logPermissionForwardingError(logger, "critical failure");
+    expect(logger.review).toHaveBeenCalledWith("permission_forwarding.error", {
+      message: "critical failure",
+    });
+  });
+
+  it("calls logger.debug with the error event", () => {
+    const logger = makeLogger();
+    logPermissionForwardingError(logger, "critical failure");
+    expect(logger.debug).toHaveBeenCalledWith("permission_forwarding.error", {
+      message: "critical failure",
+    });
+  });
+
+  it("includes formatted error when an error is provided", () => {
+    const logger = makeLogger();
+    logPermissionForwardingError(logger, "io error", new Error("ENOENT"));
+    expect(logger.review).toHaveBeenCalledWith("permission_forwarding.error", {
+      message: "io error",
+      error: "ENOENT",
+    });
+  });
+
+  it("does not throw when logger is null", () => {
+    expect(() => logPermissionForwardingError(null, "ignored")).not.toThrow();
+  });
+});
+
+// ── tryRemoveDirectoryIfEmpty ──────────────────────────────────────────────
+
+describe("tryRemoveDirectoryIfEmpty", () => {
+  let root: string;
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it("returns true when the directory does not exist", () => {
+    root = mkdtempSync(join(tmpdir(), "io-test-"));
+    const absent = join(root, "nonexistent");
+    expect(tryRemoveDirectoryIfEmpty(null, absent, "test")).toBe(true);
+  });
+
+  it("returns true and removes an empty directory", () => {
+    root = mkdtempSync(join(tmpdir(), "io-test-"));
+    const dir = join(root, "empty");
+    mkdirSync(dir);
+    expect(tryRemoveDirectoryIfEmpty(null, dir, "test")).toBe(true);
+    expect(existsSync(dir)).toBe(false);
+  });
+
+  it("returns false and leaves a non-empty directory in place", () => {
+    root = mkdtempSync(join(tmpdir(), "io-test-"));
+    const dir = join(root, "nonempty");
+    mkdirSync(dir);
+    writeFileSync(join(dir, "file.json"), "{}", "utf-8");
+    expect(tryRemoveDirectoryIfEmpty(null, dir, "test")).toBe(false);
+    expect(existsSync(dir)).toBe(true);
+  });
+});
+
+// ── cleanupPermissionForwardingLocationIfEmpty ─────────────────────────────
+
+describe("cleanupPermissionForwardingLocationIfEmpty", () => {
+  let root: string;
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it("preserves responses/ when requests/ is non-empty (the concurrent-request race)", () => {
+    root = mkdtempSync(join(tmpdir(), "io-cleanup-"));
+    const forwardingDir = join(root, "forwarding");
+    const location = createPermissionForwardingLocation(
+      forwardingDir,
+      "parent-session",
+    );
+    // Simulate: requests/ has a pending file, responses/ is momentarily empty
+    mkdirSync(location.requestsDir, { recursive: true });
+    mkdirSync(location.responsesDir, { recursive: true });
+    writeFileSync(join(location.requestsDir, "req-b.json"), "{}", "utf-8");
+    // responses/ is empty (sibling subagent A already cleaned up its response)
+
+    cleanupPermissionForwardingLocationIfEmpty(null, location);
+
+    // requests/ is non-empty → should NOT be removed
+    expect(existsSync(location.requestsDir)).toBe(true);
+    // responses/ must survive — removing it causes the ENOENT write loop
+    expect(existsSync(location.responsesDir)).toBe(true);
+    // sessionRoot must also survive while subdirs are present
+    expect(existsSync(location.sessionRootDir)).toBe(true);
+  });
+
+  it("removes both subdirs and sessionRoot when both are empty (normal serial cleanup)", () => {
+    root = mkdtempSync(join(tmpdir(), "io-cleanup-"));
+    const forwardingDir = join(root, "forwarding");
+    const location = createPermissionForwardingLocation(
+      forwardingDir,
+      "parent-session",
+    );
+    mkdirSync(location.requestsDir, { recursive: true });
+    mkdirSync(location.responsesDir, { recursive: true });
+    // Both empty — normal end-of-lifecycle state
+
+    cleanupPermissionForwardingLocationIfEmpty(null, location);
+
+    expect(existsSync(location.requestsDir)).toBe(false);
+    expect(existsSync(location.responsesDir)).toBe(false);
+    expect(existsSync(location.sessionRootDir)).toBe(false);
+  });
+
+  it("leaves responses/ in place when it is non-empty even if requests/ is empty", () => {
+    root = mkdtempSync(join(tmpdir(), "io-cleanup-"));
+    const forwardingDir = join(root, "forwarding");
+    const location = createPermissionForwardingLocation(
+      forwardingDir,
+      "parent-session",
+    );
+    mkdirSync(location.requestsDir, { recursive: true });
+    mkdirSync(location.responsesDir, { recursive: true });
+    writeFileSync(join(location.responsesDir, "resp.json"), "{}", "utf-8");
+    // requests/ is empty, responses/ has a stale response
+
+    cleanupPermissionForwardingLocationIfEmpty(null, location);
+
+    // requests/ is empty so it gets removed
+    expect(existsSync(location.requestsDir)).toBe(false);
+    // responses/ is non-empty → survives
+    expect(existsSync(location.responsesDir)).toBe(true);
+    // sessionRoot survives because responses/ is still present
+    expect(existsSync(location.sessionRootDir)).toBe(true);
+  });
+});