@librechat/agents 3.4.7 → 3.5.0

package/src/hooks/__tests__/createToolPolicyHook.test.ts

@@ -1,268 +0,0 @@
-import { describe, it, expect } from '@jest/globals';
-import type {
-  HookCallback,
-  PreToolUseHookInput,
-  PreToolUseHookOutput,
-} from '../types';
-import { createToolPolicyHook } from '../createToolPolicyHook';
-
-const baseInput: Omit<PreToolUseHookInput, 'toolName'> = {
-  hook_event_name: 'PreToolUse',
-  runId: 'r-1',
-  toolInput: {},
-  toolUseId: 'call-1',
-  stepId: 'step-1',
-  turn: 0,
-};
-
-async function callHook(
-  hook: HookCallback<'PreToolUse'>,
-  toolName: string
-): Promise<PreToolUseHookOutput> {
-  const signal = new AbortController().signal;
-  return await hook({ ...baseInput, toolName }, signal);
-}
-
-describe('createToolPolicyHook — default mode', () => {
-  it('asks for tools that match no rule', async () => {
-    const hook = createToolPolicyHook({ mode: 'default' });
-    expect((await callHook(hook, 'unknown_tool')).decision).toBe('ask');
-  });
-
-  it('allows tools that match an allow pattern', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      allow: ['read_file', 'grep'],
-    });
-    expect((await callHook(hook, 'read_file')).decision).toBe('allow');
-    expect((await callHook(hook, 'grep')).decision).toBe('allow');
-    expect((await callHook(hook, 'write_file')).decision).toBe('ask');
-  });
-
-  it('denies tools that match a deny pattern', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      deny: ['delete_*'],
-    });
-    expect((await callHook(hook, 'delete_file')).decision).toBe('deny');
-    expect((await callHook(hook, 'read_file')).decision).toBe('ask');
-  });
-
-  it('asks tools that match an ask pattern (redundant in default mode but explicit)', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      ask: ['execute_*'],
-    });
-    expect((await callHook(hook, 'execute_code')).decision).toBe('ask');
-  });
-});
-
-describe('createToolPolicyHook — dontAsk mode', () => {
-  it('denies tools that match no rule (no human prompt)', async () => {
-    const hook = createToolPolicyHook({ mode: 'dontAsk' });
-    expect((await callHook(hook, 'unknown_tool')).decision).toBe('deny');
-  });
-
-  it('still allows tools that match an allow pattern', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'dontAsk',
-      allow: ['read_*'],
-    });
-    expect((await callHook(hook, 'read_file')).decision).toBe('allow');
-    expect((await callHook(hook, 'write_file')).decision).toBe('deny');
-  });
-
-  it('still asks tools that match an explicit ask pattern (overrides dontAsk default)', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'dontAsk',
-      ask: ['execute_*'],
-    });
-    expect((await callHook(hook, 'execute_code')).decision).toBe('ask');
-    expect((await callHook(hook, 'unknown_tool')).decision).toBe('deny');
-  });
-});
-
-describe('createToolPolicyHook — bypass mode', () => {
-  it('allows everything by default', async () => {
-    const hook = createToolPolicyHook({ mode: 'bypass' });
-    expect((await callHook(hook, 'anything')).decision).toBe('allow');
-    expect((await callHook(hook, 'execute_code')).decision).toBe('allow');
-  });
-
-  it('still denies tools that match a deny pattern (deny always wins)', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'bypass',
-      deny: ['delete_*'],
-    });
-    expect((await callHook(hook, 'delete_file')).decision).toBe('deny');
-    expect((await callHook(hook, 'read_file')).decision).toBe('allow');
-  });
-
-  it('still asks tools that match an explicit ask pattern', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'bypass',
-      ask: ['execute_*'],
-    });
-    expect((await callHook(hook, 'execute_code')).decision).toBe('ask');
-  });
-});
-
-describe('createToolPolicyHook — pattern matching', () => {
-  it('matches glob `*` wildcards', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      allow: ['mcp:github:*'],
-    });
-    expect((await callHook(hook, 'mcp:github:create_issue')).decision).toBe(
-      'allow'
-    );
-    expect((await callHook(hook, 'mcp:github:list_repos')).decision).toBe(
-      'allow'
-    );
-    expect((await callHook(hook, 'mcp:slack:post')).decision).toBe('ask');
-  });
-
-  it('matches exact tool names', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      allow: ['read_file'],
-    });
-    expect((await callHook(hook, 'read_file')).decision).toBe('allow');
-    expect((await callHook(hook, 'read_file_lines')).decision).toBe('ask');
-  });
-
-  it('escapes regex metacharacters in literal portions', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      allow: ['tool.with.dots'],
-    });
-    expect((await callHook(hook, 'tool.with.dots')).decision).toBe('allow');
-    /** A literal regex `.` would also match `tool_with_dots`; glob shouldn't. */
-    expect((await callHook(hook, 'tool_with_dots')).decision).toBe('ask');
-  });
-
-  it('matches wildcards in the middle and end', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      ask: ['*search*'],
-    });
-    expect((await callHook(hook, 'web_search')).decision).toBe('ask');
-    expect((await callHook(hook, 'searcher')).decision).toBe('ask');
-    expect((await callHook(hook, 'read_file')).decision).toBe('ask'); // default mode
-    /** Confirm the ask path tagged it (not the fallthrough): explicit ask hits before mode fallthrough. */
-  });
-});
-
-describe('createToolPolicyHook — precedence', () => {
-  it('deny wins over ask', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      deny: ['execute_delete'],
-      ask: ['execute_*'],
-    });
-    expect((await callHook(hook, 'execute_delete')).decision).toBe('deny');
-  });
-
-  it('deny wins over allow', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      allow: ['read_*'],
-      deny: ['read_secret'],
-    });
-    expect((await callHook(hook, 'read_secret')).decision).toBe('deny');
-    expect((await callHook(hook, 'read_file')).decision).toBe('allow');
-  });
-
-  it('deny wins over bypass mode', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'bypass',
-      deny: ['delete_*'],
-    });
-    expect((await callHook(hook, 'delete_file')).decision).toBe('deny');
-    expect((await callHook(hook, 'anything_else')).decision).toBe('allow');
-  });
-
-  it('ask wins over allow in default mode', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      allow: ['execute_safe'],
-      ask: ['execute_*'],
-    });
-    expect((await callHook(hook, 'execute_safe')).decision).toBe('ask');
-    expect((await callHook(hook, 'execute_dangerous')).decision).toBe('ask');
-  });
-});
-
-describe('createToolPolicyHook — reason', () => {
-  it('attaches the configured reason to ask and deny decisions', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      deny: ['delete_*'],
-      reason: 'Tool {tool} requires manual review',
-    });
-    const denied = await callHook(hook, 'delete_file');
-    expect(denied.decision).toBe('deny');
-    expect(denied.reason).toBe('Tool delete_file requires manual review');
-
-    const asked = await callHook(hook, 'unknown_tool');
-    expect(asked.decision).toBe('ask');
-    expect(asked.reason).toBe('Tool unknown_tool requires manual review');
-  });
-
-  it('omits the reason field for allow decisions', async () => {
-    const hook = createToolPolicyHook({
-      mode: 'default',
-      allow: ['read_*'],
-      reason: 'never seen',
-    });
-    const result = await callHook(hook, 'read_file');
-    expect(result.decision).toBe('allow');
-    expect(result.reason).toBeUndefined();
-  });
-
-  it('does not add a reason field when no template is configured', async () => {
-    const hook = createToolPolicyHook({ mode: 'dontAsk' });
-    const result = await callHook(hook, 'unknown_tool');
-    expect(result.decision).toBe('deny');
-    expect(result.reason).toBeUndefined();
-  });
-});
-
-describe('createToolPolicyHook — registry integration', () => {
-  it('works when registered as a PreToolUse hook (round-trip via executeHooks)', async () => {
-    const { HookRegistry, executeHooks } = await import('../index');
-    const registry = new HookRegistry();
-    registry.register('PreToolUse', {
-      hooks: [
-        createToolPolicyHook({
-          mode: 'default',
-          allow: ['read_file'],
-          deny: ['delete_*'],
-          reason: 'review {tool}',
-        }),
-      ],
-    });
-
-    const allow = await executeHooks({
-      registry,
-      input: { ...baseInput, toolName: 'read_file' },
-      matchQuery: 'read_file',
-    });
-    expect(allow.decision).toBe('allow');
-
-    const deny = await executeHooks({
-      registry,
-      input: { ...baseInput, toolName: 'delete_file' },
-      matchQuery: 'delete_file',
-    });
-    expect(deny.decision).toBe('deny');
-    expect(deny.reason).toBe('review delete_file');
-
-    const ask = await executeHooks({
-      registry,
-      input: { ...baseInput, toolName: 'mystery_tool' },
-      matchQuery: 'mystery_tool',
-    });
-    expect(ask.decision).toBe('ask');
-  });
-});

package/src/hooks/__tests__/createWorkspacePolicyHook.test.ts

@@ -1,405 +0,0 @@
-import { tmpdir } from 'os';
-import { join, resolve } from 'path';
-import { mkdtemp, rm } from 'fs/promises';
-import { describe, it, expect, beforeEach, afterEach } from '@jest/globals';
-import type {
-  HookCallback,
-  PreToolUseHookInput,
-  PreToolUseHookOutput,
-} from '../types';
-import { createWorkspacePolicyHook } from '../createWorkspacePolicyHook';
-
-function call(
-  hook: HookCallback<'PreToolUse'>,
-  input: PreToolUseHookInput
-): Promise<PreToolUseHookOutput> {
-  return Promise.resolve(hook(input, new AbortController().signal));
-}
-
-function makeInput(
-  toolName: string,
-  toolInput: Record<string, unknown>
-): PreToolUseHookInput {
-  return {
-    hook_event_name: 'PreToolUse',
-    runId: 'r',
-    threadId: 't',
-    agentId: 'a',
-    toolName,
-    toolInput,
-    toolUseId: 'tu',
-    stepId: 's',
-    turn: 0,
-  };
-}
-
-describe('createWorkspacePolicyHook', () => {
-  let workspace: string;
-  let extra: string;
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'lc-wp-'));
-    extra = await mkdtemp(join(tmpdir(), 'lc-wp-extra-'));
-  });
-
-  afterEach(async () => {
-    await rm(workspace, { recursive: true, force: true });
-    await rm(extra, { recursive: true, force: true });
-  });
-
-  it('allows in-workspace relative paths', async () => {
-    const hook = createWorkspacePolicyHook({ root: workspace });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: 'src/x.ts' })
-    );
-    expect(out.decision).toBe('allow');
-  });
-
-  it('allows in-workspace absolute paths', async () => {
-    const hook = createWorkspacePolicyHook({ root: workspace });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: join(workspace, 'src/x.ts') })
-    );
-    expect(out.decision).toBe('allow');
-  });
-
-  it('allows additionalRoots paths', async () => {
-    const hook = createWorkspacePolicyHook({
-      root: workspace,
-      additionalRoots: [extra],
-    });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: join(extra, 'lib/y.ts') })
-    );
-    expect(out.decision).toBe('allow');
-  });
-
-  it('asks by default when path is outside the workspace (read tool)', async () => {
-    const hook = createWorkspacePolicyHook({ root: workspace });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: '/etc/passwd' })
-    );
-    expect(out.decision).toBe('ask');
-    expect(out.reason).toContain('/etc/passwd');
-    expect(out.allowedDecisions).toEqual(['approve', 'reject']);
-  });
-
-  it('asks by default when path is outside the workspace (write tool)', async () => {
-    const hook = createWorkspacePolicyHook({ root: workspace });
-    const out = await call(
-      hook,
-      makeInput('write_file', {
-        path: '/etc/foo',
-        content: 'malicious',
-      })
-    );
-    expect(out.decision).toBe('ask');
-  });
-
-  it('honours `outsideRead: deny` for read tools', async () => {
-    const hook = createWorkspacePolicyHook({
-      root: workspace,
-      outsideRead: 'deny',
-    });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: '/etc/passwd' })
-    );
-    expect(out.decision).toBe('deny');
-    expect(out.reason).toContain('/etc/passwd');
-  });
-
-  it('honours `outsideWrite: deny` for write tools', async () => {
-    const hook = createWorkspacePolicyHook({
-      root: workspace,
-      outsideWrite: 'deny',
-    });
-    const out = await call(
-      hook,
-      makeInput('edit_file', {
-        path: '/etc/foo',
-        old_text: 'a',
-        new_text: 'b',
-      })
-    );
-    expect(out.decision).toBe('deny');
-  });
-
-  it('honours `outsideRead: allow`', async () => {
-    const hook = createWorkspacePolicyHook({
-      root: workspace,
-      outsideRead: 'allow',
-    });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: '/etc/passwd' })
-    );
-    expect(out.decision).toBe('allow');
-  });
-
-  it('passes through when the tool has no extractor (e.g. bash)', async () => {
-    const hook = createWorkspacePolicyHook({ root: workspace });
-    const out = await call(
-      hook,
-      makeInput('bash', { command: 'cat /etc/passwd' })
-    );
-    expect(out.decision).toBe('allow');
-  });
-
-  it('passes through when the path arg is missing/empty', async () => {
-    const hook = createWorkspacePolicyHook({ root: workspace });
-    const out = await call(hook, makeInput('grep_search', { pattern: 'x' }));
-    expect(out.decision).toBe('allow');
-  });
-
-  it('allows custom extractors to opt new tools in', async () => {
-    const hook = createWorkspacePolicyHook({
-      root: workspace,
-      pathExtractors: {
-        my_custom_tool: (i) => (typeof i.target === 'string' ? [i.target] : []),
-      },
-    });
-    const inside = await call(
-      hook,
-      makeInput('my_custom_tool', { target: 'in/workspace.ts' })
-    );
-    expect(inside.decision).toBe('allow');
-
-    const outside = await call(
-      hook,
-      makeInput('my_custom_tool', { target: '/elsewhere/x.ts' })
-    );
-    // Unknown tools default to write-policy (stricter): 'ask'.
-    expect(outside.decision).toBe('ask');
-  });
-
-  it('formats the reason via {tool} and {paths}', async () => {
-    const hook = createWorkspacePolicyHook({
-      root: workspace,
-      reason: '{tool} blocked from {paths}',
-    });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: '/somewhere/else.ts' })
-    );
-    expect(out.reason).toBe('read_file blocked from /somewhere/else.ts');
-  });
-
-  it('handles a tool input with an array of paths', async () => {
-    const hook = createWorkspacePolicyHook({
-      root: workspace,
-      pathExtractors: {
-        multi_file_tool: (i) =>
-          Array.isArray(i.paths) ? (i.paths as string[]) : [],
-      },
-    });
-    const out = await call(
-      hook,
-      makeInput('multi_file_tool', {
-        paths: [join(workspace, 'a.ts'), '/etc/passwd'],
-      })
-    );
-    expect(out.decision).toBe('ask');
-    expect(out.reason).toContain('/etc/passwd');
-    expect(out.reason).not.toContain(join(workspace, 'a.ts'));
-  });
-
-  it('respects resolved root paths (relative root config)', async () => {
-    const hook = createWorkspacePolicyHook({ root: '.' });
-    const out = await call(
-      hook,
-      makeInput('read_file', { path: resolve('.', 'src/x.ts') })
-    );
-    expect(out.decision).toBe('allow');
-  });
-
-  describe('symlink-escape (Codex P1 #10)', () => {
-    it('rejects a symlink inside the workspace that points outside', async () => {
-      const fs = await import('fs/promises');
-      await fs.writeFile(join(extra, 'secret.txt'), 'top-secret\n');
-      await fs.symlink(join(extra, 'secret.txt'), join(workspace, 'escape'));
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('read_file', { path: 'escape' })
-      );
-      expect(out.decision).toBe('deny');
-      expect(out.reason).toContain('escape');
-    });
-
-    it('still allows a lexically-outside path that realpaths back inside (alternate mount via symlink)', async () => {
-      const fs = await import('fs/promises');
-      await fs.writeFile(join(workspace, 'file.ts'), 'export {};\n');
-      const altMount = join(extra, 'alt-mount');
-      await fs.symlink(workspace, altMount);
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('read_file', { path: join(altMount, 'file.ts') })
-      );
-      expect(out.decision).toBe('allow');
-    });
-  });
-
-  describe('compile_check command path extraction (Codex P1 #26)', () => {
-    it('extracts absolute paths from compile_check commands so the policy fires', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'cat /etc/passwd' })
-      );
-      expect(out.decision).toBe('deny');
-      expect(out.reason).toContain('/etc/passwd');
-    });
-
-    it('extracts paths from --flag=/path-style tokens', async () => {
-      // compile_check is in READ_TOOLS, so the policy uses outsideRead.
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'tsc --out=/etc/foo' })
-      );
-      expect(out.decision).toBe('deny');
-      expect(out.reason).toContain('/etc/foo');
-    });
-
-    it('extracts ~/ and $HOME/ tokens', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const tilde = await call(
-        hook,
-        makeInput('compile_check', { command: 'cat ~/secret' })
-      );
-      expect(tilde.decision).toBe('deny');
-      const homeVar = await call(
-        hook,
-        makeInput('compile_check', { command: 'cat $HOME/secret' })
-      );
-      expect(homeVar.decision).toBe('deny');
-    });
-
-    it('allows in-workspace absolute paths in the command', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', {
-          command: `tsc --noEmit ${join(workspace, 'src/x.ts')}`,
-        })
-      );
-      expect(out.decision).toBe('allow');
-    });
-
-    it('allows commands with no absolute paths (relative-only auto-detect form)', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'npx tsc --noEmit' })
-      );
-      expect(out.decision).toBe('allow');
-    });
-
-    it('extracts paths wrapped in double quotes (Codex P1 #31)', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'cat "/etc/passwd"' })
-      );
-      expect(out.decision).toBe('deny');
-      expect(out.reason).toContain('/etc/passwd');
-    });
-
-    it('extracts paths wrapped in single quotes (Codex P1 #31)', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'cat \'/etc/passwd\'' })
-      );
-      expect(out.decision).toBe('deny');
-      expect(out.reason).toContain('/etc/passwd');
-    });
-
-    it('extracts quoted --flag="/path" tokens (Codex P1 #31)', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'tsc --out="/tmp/x"' })
-      );
-      expect(out.decision).toBe('deny');
-      expect(out.reason).toContain('/tmp/x');
-    });
-
-    it('extracts ../ parent-traversal tokens (Codex P2 #35)', async () => {
-      // `../secrets.txt` resolves to `<parent-of-workspace>/secrets.txt`
-      // which is outside the workspace boundary. Pre-fix the regex
-      // ignored relative tokens entirely so this looked like an
-      // empty-extract → allow.
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'cat ../secrets.txt' })
-      );
-      expect(out.decision).toBe('deny');
-      expect(out.reason).toContain('../secrets.txt');
-    });
-
-    it('extracts deeper traversal like ../../etc/foo (Codex P2 #35)', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'cat ../../etc/foo' })
-      );
-      expect(out.decision).toBe('deny');
-    });
-
-    it('does NOT trip on `./` or single-dot tokens (no false positives)', async () => {
-      const hook = createWorkspacePolicyHook({
-        root: workspace,
-        outsideRead: 'deny',
-      });
-      const out = await call(
-        hook,
-        makeInput('compile_check', { command: 'cd ./src && npx tsc' })
-      );
-      expect(out.decision).toBe('allow');
-    });
-  });
-});