@preapexis/piexis 0.1.2 → 0.2.4

package/tests/background-tasks.test.mjs

@@ -1,27 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import backgroundTasks from "../extensions/background-tasks.ts";
-import backgroundWorker from "../extensions/background-worker.ts";
-
-test("background tasks expose launch, status, cancellation, and explicit apply tools", () => {
-  const tools = new Map();
-  const commands = new Map();
-  backgroundTasks({
-    registerFlag() {},
-    registerTool(tool) { tools.set(tool.name, tool); },
-    registerCommand(name, command) { commands.set(name, command); },
-    on() {},
-    events: { on() {} }
-  });
-
-  assert.deepEqual([...tools.keys()].sort(), ["background_task", "task_status", "task_cancel", "task_diff", "task_clean", "task_apply"].sort());
-  assert.ok(commands.has("task"));
-  assert.equal(tools.get("background_task").executionMode, "sequential");
-});
-
-test("background worker does not install a foreground permission guard without a broker", () => {
-  let handler;
-  backgroundWorker({ on(name, callback) { if (name === "tool_call") handler = callback; } });
-  assert.equal(handler, undefined);
-});

package/tests/background-worker.test.mjs

@@ -1,60 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { mkdtemp, writeFile, readdir, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-import workerExtension from "../extensions/background-worker.ts";
-import { readBrokerJson, publishBrokerJson } from "../lib/task-broker.ts";
-
-async function worker(t, bash = false) {
-  const broker = await mkdtemp(join(tmpdir(), "piexis-worker-guard-"));
-  const settings = { PIEXIS_TASK_BROKER: broker, PIEXIS_TASK_TOKEN: randomUUID(), PIEXIS_TASK_BASH: bash ? "1" : "0", PIEXIS_TASK_REPEAT_LIMIT: "3", PIEXIS_TASK_DENIAL_LIMIT: "6" };
-  const saved = Object.fromEntries(Object.keys(settings).map((key) => [key, process.env[key]]));
-  Object.assign(process.env, settings);
-  const hooks = new Map();
-  const tools = new Map();
-  const records = [];
-  let aborts = 0;
-  const controller = new AbortController();
-  const ctx = { signal: controller.signal, abort() { aborts++; } };
-  workerExtension({ on(name, callback) { hooks.set(name, callback); }, registerTool(tool) { tools.set(tool.name, tool); }, appendEntry(customType, data) { records.push({ customType, data }); } });
-  for (const [key, value] of Object.entries(saved)) { if (value === undefined) delete process.env[key]; else process.env[key] = value; }
-  t.after(async () => { controller.abort(); await rm(broker, { recursive: true, force: true }); });
-  await writeFile(join(broker, "heartbeat"), "");
-  return { broker, hooks, tools, records, ctx, settings, get aborts() { return aborts; } };
-}
-
-test("worker-only wrappers cannot fall back to built-ins and even reads need the parent broker", { timeout: 5000 }, async (t) => {
-  const h = await worker(t);
-  assert.deepEqual([...h.tools.keys()], ["worker_read", "worker_edit", "worker_write", "worker_grep", "worker_find", "worker_ls"]);
-  const call = (toolName, input) => h.hooks.get("tool_call")({ toolName, input, toolCallId: "fixture" }, h.ctx);
-  assert.equal((await call("read", { path: "README.md" })).block, true);
-  assert.equal((await call("worker_bash", { command: "pwd" })).block, true);
-  const pending = call("worker_read", { path: "src/main.txt" });
-  let file;
-  while (!(file = (await readdir(h.broker)).find((name) => name.endsWith(".request.json")))) await new Promise(setImmediate);
-  const request = await readBrokerJson(join(h.broker, file));
-  assert.equal(request.tool, "read");
-  assert.equal(request.token, h.settings.PIEXIS_TASK_TOKEN);
-  await publishBrokerJson(join(h.broker, `${request.id}.response.json`), { id: request.id, outcome: "allowed" });
-  assert.equal(await pending, undefined);
-  assert.equal(h.aborts, 0);
-  await rm(join(h.broker, "heartbeat"));
-  assert.equal((await call("worker_read", { path: "src/main.txt" })).block, true);
-  assert.equal(h.aborts, 1);
-});
-
-test("worker command observations use post-execution callbacks and redact recognizable secrets", async (t) => {
-  const h = await worker(t, true);
-  assert.ok(h.tools.has("worker_bash"));
-  assert.equal(h.hooks.has("tool_execution_start"), false);
-  h.hooks.get("tool_result")({ toolName: "worker_bash", toolCallId: "actual", input: { command: "node --test fixture.mjs" }, isError: false });
-  h.hooks.get("tool_result")({ toolName: "worker_read", toolCallId: "read", input: {}, isError: false });
-  assert.deepEqual(h.records, [{ customType: "piexis-worker-execution", data: { id: "actual", command: "node --test fixture.mjs", isError: false } }]);
-  h.hooks.get("tool_result")({ toolName: "worker_bash", toolCallId: "redacted", input: { command: 'printf "Bearer fixture_test_token_123"' }, isError: true });
-  assert.doesNotMatch(h.records[1].data.command, /fixture_test_token_123/);
-  assert.match(h.records[1].data.command, /REDACTED/);
-  h.hooks.get("tool_result")({ toolName: "worker_bash", toolCallId: "long", input: { command: "x".repeat(3000) }, isError: true });
-  assert.equal(h.records[2].data.truncated, true);
-});

package/tests/bash-permissions.test.mjs

@@ -1,276 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-import { analyzeBash, parseBash } from "../lib/bash-policy.ts";
-import { bashApprovalFingerprint } from "../lib/bash-approvals.ts";
-import { evaluatePermission } from "../lib/mode-policy.ts";
-import { DenialTracker, denialLimit } from "../lib/permission-denials.ts";
-import modeExtension from "../extensions/mode.ts";
-
-async function fixture(t) {
-  const root = await mkdtemp(join(tmpdir(), "piexis-bash-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  for (const dir of [".git", ".pi", "bin", "nested", "home"]) await mkdir(join(root, dir));
-  await writeFile(join(root, ".git", "config"), "[core]\n bare = false\n");
-  await writeFile(join(root, "global.gitconfig"), "[user]\n name = Fixture\n");
-  // Synthetic executable header for fingerprint tests. Never execute this file.
-  await writeFile(join(root, "bin", "git"), Buffer.from("7f454c4666697874757265", "hex"), { mode: 0o755 });
-  const env = { PATH: join(root, "bin"), HOME: join(root, "home"), GIT_CONFIG_GLOBAL: join(root, "global.gitconfig"), GIT_CONFIG_NOSYSTEM: "1" };
-  return { root, env };
-}
-
-function isolatedEnvironment(t, env) {
-  const keys = new Set([...Object.keys(process.env).filter((key) => /^(BASH|GIT_|ENV$|SHELLOPTS$|PS4$)/.test(key)), ...Object.keys(env)]);
-  const saved = new Map([...keys].map((key) => [key, process.env[key]]));
-  for (const key of keys) delete process.env[key];
-  Object.assign(process.env, env);
-  t.after(() => { for (const [key, value] of saved) { if (value === undefined) delete process.env[key]; else process.env[key] = value; } });
-}
-
-test("literal shell parser recognizes quotes, chains, pipes, redirects, assignments, and risk findings", () => {
-  const parsed = parseBash("MODE=test env node 'script with spaces.js' && cd nested; cat a.txt | tee result.txt >> log.txt");
-  assert.equal(parsed.status, "parsed");
-  assert.deepEqual(parsed.operators, ["&&", ";", "|"]);
-  assert.deepEqual(parsed.commands[0].argv, ["env", "node", "script with spaces.js"]);
-  assert.deepEqual(parsed.commands[0].assignments, ["MODE=test"]);
-  assert.deepEqual(parsed.commands.at(-1).redirects, [{ operator: ">>", target: "log.txt" }]);
-  for (const finding of ["environment-assignment", "execution-wrapper", "working-directory-change", "pipeline", "redirection"]) assert.ok(parsed.findings.includes(finding));
-  assert.equal(parsed.safe, false);
-  assert.equal(parsed.grantFamily, undefined);
-  for (const [command, finding] of [
-    ["git reset --hard HEAD", "destructive-action"], ["git push --force", "shared-system-change"],
-    ["git commit --no-verify", "safeguard-bypass"], ["curl --insecure https://example.invalid", "network-or-data-egress"],
-    ["npm test", "script-or-interpreter"], ["python script.py", "script-or-interpreter"],
-    ["sudo command", "privilege-change"]
-  ]) assert.ok(parseBash(command).findings.includes(finding), command);
-});
-
-test("only tiny literal builtins are automatic; expansions and unsupported syntax never widen grants", () => {
-  for (const command of ["pwd", "pwd -P", "pwd -L", "true", "false", "'pwd'", "pwd # harmless comment"]) assert.equal(parseBash(command).safe, true, command);
-  for (const command of [
-    "pwd; rm -rf x", "pwd && true", "pwd > file", "pwd $(touch file)", "pwd `touch file`", "pwd $VAR",
-    "pwd *", "pwd ${VAR}", "(pwd)", "{ pwd; }", "if true; then pwd; fi", "pwd &", "pwd 2> file",
-    "pwd <<< text", "pwd <<EOF\ntext\nEOF", "pwd |& cat", "pwd &&", "pwd \\", "pwd 'unfinished",
-    "pwd\0", "pwd\r", "pwd\r; true", "pwd; A=B", "A=B pwd", "bash -c 'pwd'", "npm test", "make", "git -c core.fsmonitor=evil status",
-    "git status; pwd", "env git status", "git status --unknown", "git status --short path", "git $SUBCOMMAND"
-  ]) {
-    const parsed = parseBash(command);
-    assert.equal(parsed.safe, false, command);
-    assert.equal(parsed.grantFamily, undefined, command);
-  }
-  assert.equal(parseBash("echo $(touch file)").status, "unsupported");
-  assert.equal(parseBash("echo '$(touch file)'").status, "parsed");
-  assert.equal(parseBash("pwd ".repeat(4000)).status, "unsupported");
-  assert.equal(parseBash(Array(34).fill("pwd").join(";")).status, "unsupported");
-  assert.equal(parseBash("git status --short").grantFamily, "git-status");
-});
-
-test("literal filesystem targets are checked, including aliases and protected output redirection", async (t) => {
-  const { root } = await fixture(t);
-  await writeFile(join(root, ".env"), "disposable fixture");
-  await symlink(join(root, ".env"), join(root, "alias"));
-  for (const command of ["cat .env", "cat alias", "touch .pi/settings.json", "echo text > .git/config"]) {
-    const analysis = await analyzeBash(command, root, root);
-    assert.ok(analysis.blockedReason, command);
-    const outcome = await evaluatePermission({ mode: "auto", tool: "bash", input: { command }, cwd: root, workspaceRoot: root,
-      authorization: { approvals: [{ tool: "bash", scope: "tool" }] } });
-    assert.equal(outcome.decision, "deny", command);
-  }
-  assert.equal((await analyzeBash("echo '.env'", root, root)).blockedReason, undefined);
-  assert.ok((await analyzeBash("cat ../ordinary.txt", root, root)).findings.includes("external-filesystem-target"));
-  assert.equal((await evaluatePermission({ mode: "plan", tool: "bash", input: { command: "pwd" }, cwd: root, workspaceRoot: root })).decision, "deny");
-});
-
-test("execution fingerprints bind cwd, executable, configuration, and environment, without executing anything", async (t) => {
-  const { root, env } = await fixture(t);
-  const fingerprint = () => bashApprovalFingerprint("git status", root, root, env);
-  const initial = await fingerprint();
-  assert.match(initial, /^[a-f0-9]{64}$/);
-  assert.equal(await bashApprovalFingerprint("git status --short", root, root, env), initial);
-  assert.notEqual(await bashApprovalFingerprint("git status", join(root, "nested"), root, env), initial);
-  await writeFile(join(root, ".pi", "permission-modes.json"), "{}");
-  assert.notEqual(await fingerprint(), initial);
-  const beforeExecutable = await fingerprint();
-  await writeFile(join(root, "bin", "git"), Buffer.from("7f454c466368616e676564", "hex"), { mode: 0o755 });
-  assert.notEqual(await fingerprint(), beforeExecutable);
-  await writeFile(join(root, ".git", "config"), "[core]\n fsmonitor = run-a-script\n");
-  assert.equal(await fingerprint(), undefined);
-  await writeFile(join(root, ".git", "config"), "[include]\n path = other-config\n");
-  assert.equal(await fingerprint(), undefined);
-  await writeFile(join(root, ".git", "config"), "[core]\n bare = false\n");
-  assert.equal(await bashApprovalFingerprint("npm test", root, root, env), undefined);
-  assert.equal(await bashApprovalFingerprint("git status", root, root, { ...env, BASH_ENV: "startup.sh" }), undefined);
-  assert.equal(await bashApprovalFingerprint("git status", root, root, { ...env, GIT_CONFIG_COUNT: "1" }), undefined);
-  assert.equal(await bashApprovalFingerprint("git status", root, root, { ...env, GIT_CONFIG_GLOBAL: "relative" }), undefined);
-  await writeFile(join(root, ".git", "commondir"), "../../other");
-  assert.equal(await fingerprint(), undefined);
-  await rm(join(root, ".git", "commondir"));
-  await mkdir(join(root, "nested", ".git"));
-  assert.equal(await bashApprovalFingerprint("git status", join(root, "nested"), root, env), undefined);
-});
-
-test("Auto honors fresh exact/subcommand grants, not broad grants, edited configs, or a different cwd", async (t) => {
-  const { root, env } = await fixture(t);
-  isolatedEnvironment(t, env);
-  const fingerprint = await bashApprovalFingerprint("git status", root, root);
-  assert.ok(fingerprint);
-  const exact = { tool: "bash", scope: "command", command: "git status", cwd: root, fingerprint };
-  const query = { tool: "bash", scope: "subcommand", family: "git-status", cwd: root, fingerprint };
-  const decide = (command, approvals, cwd = root) => evaluatePermission({ mode: "auto", tool: "bash", input: { command }, cwd, workspaceRoot: root, authorization: { approvals } });
-  assert.equal((await decide("git status", [exact])).decision, "allow");
-  assert.equal((await decide("git status --short", [exact])).decision, "require-model-review");
-  assert.equal((await decide("git status --short", [query])).decision, "allow");
-  assert.equal((await decide("git status", [exact], join(root, "nested"))).decision, "require-model-review");
-  for (const grant of [{ tool: "bash", scope: "tool" }, { tool: "bash", scope: "executable", executable: "git" }])
-    assert.equal((await decide("git status", [grant])).decision, "require-model-review");
-  await writeFile(join(root, "global.gitconfig"), "[user]\n name = Changed\n");
-  assert.equal((await decide("git status", [exact])).decision, "require-model-review");
-  assert.equal((await decide("git status && touch x", [query])).decision, "require-model-review");
-  const fileGrant = { tool: "write", scope: "file", path: join(root, "..", "outside.txt") };
-  assert.equal((await evaluatePermission({ mode: "auto", tool: "write", input: { path: "../outside.txt", content: "fixture" }, cwd: root, workspaceRoot: root, authorization: { approvals: [fileGrant] } })).decision, "allow");
-});
-
-test("shell startup overrides disable even the builtin fast path", async (t) => {
-  const { root, env } = await fixture(t);
-  isolatedEnvironment(t, { ...env, BASH_ENV: join(root, "not-executed.sh") });
-  assert.equal((await analyzeBash("pwd", root, root)).safe, false);
-});
-
-test("denial budgets count repeated and varied actions, remain latched, and validate launch limits", () => {
-  for (const value of ["0", "51", "NaN", "1.2", "-1"]) assert.throws(() => denialLimit(value, 6));
-  assert.equal(denialLimit("4", 6), 4);
-  assert.equal(denialLimit(undefined, 6), 6);
-  const tracker = new DenialTracker({ repeated: 2, total: 3 });
-  assert.equal(tracker.deny("bash", { command: "a" }).stopped, false);
-  assert.equal(tracker.deny("bash", { command: "a" }).stopped, true);
-  tracker.reset();
-  for (const command of ["a", "b", "c"]) tracker.deny("bash", { command });
-  assert.equal(tracker.stopped, true);
-  assert.equal(tracker.total, 3);
-  tracker.deny("write", { path: "different" });
-  assert.equal(tracker.total, 3);
-});
-
-async function harness(t, hasUI = true) {
-  const { root, env } = await fixture(t);
-  isolatedEnvironment(t, env);
-  await writeFile(join(root, ".pi", "permission-modes.json"), JSON.stringify({ version: 1, initialized: true, classifier: { provider: "test", model: "reviewer", timeoutMs: 1000 } }));
-  const events = new Map();
-  const commands = new Map();
-  const shortcuts = new Map();
-  const entries = [];
-  let choice = "Deny";
-  let aborts = 0;
-  let modelCalls = 0;
-  let options = [];
-  let notification = "";
-  const flags = { "permission-mode": "default", "permission-repeat-limit": "2", "permission-denial-limit": "3" };
-  modeExtension({
-    registerFlag() {}, getFlag: (name) => flags[name],
-    registerCommand(name, command) { commands.set(name, command); },
-    registerShortcut(name, shortcut) { shortcuts.set(name, shortcut.handler); },
-    on(name, handler) { events.set(name, handler); }, events: { emit() {} },
-    appendEntry(customType, data) { entries.push({ type: "custom", id: `e${entries.length}`, customType, data }); }
-  });
-  const ctx = { cwd: root, hasUI, mode: "json", isIdle: () => true,
-    abort() { aborts++; },
-    ui: { setStatus() {}, notify(text) { notification = text; }, async select(_title, choices) { options = choices; return choice; } },
-    sessionManager: { getBranch: () => entries },
-    modelRegistry: { find: () => ({ provider: "test", id: "reviewer" }), hasConfiguredAuth: () => true,
-      async complete() { modelCalls++; throw new Error("mock model unavailable"); } }
-  };
-  await events.get("session_start")({ reason: "startup" }, ctx);
-  const input = async (text = "Inspect status.", source = "interactive") => {
-    await events.get("input")({ text, source }, ctx);
-    const message = { role: "user", content: text, timestamp: entries.length + 1 };
-    await events.get("message_end")({ message }, ctx);
-    entries.push({ type: "message", id: `u${entries.length}`, message });
-  };
-  await input();
-  return { root, ctx, input, entries, events, commands,
-    call: (toolName, input) => events.get("tool_call")({ toolName, input }, ctx),
-    cycle: () => shortcuts.get("alt+m")(ctx),
-    set choice(value) { choice = value; }, get aborts() { return aborts; }, get modelCalls() { return modelCalls; },
-    get options() { return options; }, get notification() { return notification; }
-  };
-}
-
-test("permission UI creates cwd-bound grants, /permissions lists and revokes them, and Auto respects revocation", async (t) => {
-  const h = await harness(t);
-  h.choice = "Allow this exact Bash command in this directory for this session";
-  assert.equal(await h.call("bash", { command: "git status" }), undefined);
-  assert.ok(h.options.includes("Allow Git status queries in this directory for this session"));
-  await h.commands.get("permissions").handler("list", h.ctx);
-  assert.match(h.notification, /"id":"1"/);
-  assert.match(h.notification, /"cwd":/);
-  assert.doesNotMatch(h.notification, /fingerprint/);
-  for (let i = 0; i < 3; i++) await h.cycle();
-  assert.equal(await h.call("bash", { command: "git status" }), undefined);
-  assert.equal(h.modelCalls, 0);
-  await h.commands.get("permissions").handler("revoke 1", h.ctx);
-  assert.equal((await h.call("bash", { command: "git status" })).block, true);
-  assert.equal(h.modelCalls, 1);
-  await assert.rejects(h.commands.get("permissions").handler("revoke 1", h.ctx), /Unknown/);
-  await assert.rejects(h.commands.get("permissions").handler("clear", { ...h.ctx, isIdle: () => false }), /idle/);
-  await h.commands.get("permissions").handler("clear", h.ctx);
-  assert.match(h.notification, /No session grants/);
-});
-
-test("opaque scripts offer no reusable narrow grant; one-time approval never survives another call", async (t) => {
-  const h = await harness(t);
-  h.choice = "Allow once: bash";
-  assert.equal(await h.call("bash", { command: "npm test" }), undefined);
-  assert.equal(h.options.some((option) => option.includes("in this directory")), false);
-  h.choice = "Deny";
-  assert.equal((await h.call("bash", { command: "npm test" })).block, true);
-  await h.commands.get("permissions").handler("list", h.ctx);
-  assert.match(h.notification, /No session grants/);
-});
-
-test("denial thresholds stop the run, block later and parallel-safe calls, preserve AskQuestion, and reset only for user input", async (t) => {
-  const h = await harness(t);
-  const call = () => h.call("bash", { command: "npm test" });
-  assert.match((await call()).reason, /genuinely narrower/);
-  assert.match((await call()).reason, /run is stopped/);
-  assert.ok(h.aborts > 0);
-  assert.equal((await h.call("write", { path: "new.ts", content: "fixture" })).block, true);
-  assert.equal(await h.call("AskQuestion", {}), undefined);
-  await h.input("Keep trying", "extension");
-  assert.equal((await h.call("bash", { command: "pwd" })).block, true);
-  await h.input("Inspect cwd only.");
-  assert.equal(await h.call("bash", { command: "pwd" }), undefined);
-  assert.equal(h.entries.filter((entry) => entry.customType === "piexis-permission-stop").length, 1);
-});
-
-test("an in-flight sibling approval cannot execute or create a grant after the run stops", { timeout: 5000 }, async (t) => {
-  const h = await harness(t);
-  let release;
-  h.ctx.ui.select = async (title) => {
-    if (title.includes("git status")) return new Promise((resolve) => { release = resolve; });
-    return "Deny";
-  };
-  const pending = h.call("bash", { command: "git status" });
-  while (!release) await new Promise(setImmediate);
-  await h.call("bash", { command: "npm test" });
-  await h.call("bash", { command: "npm test" });
-  release("Allow this exact Bash command in this directory for this session");
-  assert.equal((await pending).block, true);
-  await h.commands.get("permissions").handler("list", h.ctx);
-  assert.match(h.notification, /No session grants/);
-});
-
-test("headless denials never prompt and emit a machine-identifiable stop on stderr", async (t) => {
-  const h = await harness(t, false);
-  const output = [];
-  const original = process.stderr.write;
-  process.stderr.write = (chunk) => { output.push(String(chunk)); return true; };
-  try {
-    assert.match((await h.call("bash", { command: "npm test" })).reason, /no permission UI/);
-    assert.match((await h.call("bash", { command: "npm test" })).reason, /run is stopped/);
-  } finally { process.stderr.write = original; }
-  assert.match(output.join(""), /permission_blocked/);
-  assert.equal(h.options.length, 0);
-  assert.ok(h.aborts > 0);
-});

package/tests/glob.test.mjs

@@ -1,31 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import glob from "../extensions/glob.ts";
-import { READ_TOOLS } from "../lib/mode-policy.ts";
-
-test("glob is registered as a read-only, gitignore-aware file-discovery tool", () => {
-  let tool;
-  glob({
-    registerTool(definition) {
-      tool = definition;
-    }
-  });
-
-  assert.ok(tool);
-  assert.equal(tool.name, "glob");
-  assert.equal(tool.label, "glob");
-  assert.match(tool.description, /\.gitignore/);
-  assert.equal(tool.promptSnippet, "Find files by glob pattern (respects .gitignore)");
-  assert.deepEqual(tool.promptGuidelines, [
-    "Use glob to discover files by pathname pattern before reading or editing them."
-  ]);
-  assert.equal(tool.parameters.properties.pattern.type, "string");
-  assert.equal(tool.parameters.properties.path.type, "string");
-  assert.equal(tool.parameters.properties.limit.type, "number");
-  assert.equal(typeof tool.execute, "function");
-});
-
-test("glob participates in Piexis's read allowlist before path policy evaluation", () => {
-  assert.equal(READ_TOOLS.has("glob"), true);
-});

package/tests/mode.test.mjs

@@ -1,62 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { mkdtemp, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-
-import modeExtension from "../extensions/mode.ts";
-
-test("permission mode changes remain user-controlled rather than model-callable", () => {
-  const tools = new Map();
-  const handlers = new Map();
-  modeExtension({
-    registerFlag() {},
-    registerTool(definition) { tools.set(definition.name, definition); },
-    registerCommand() {},
-    registerShortcut() {},
-    on(name, handler) { handlers.set(name, handler); },
-    appendEntry() {},
-    getFlag() {},
-    events: { emit() {} }
-  });
-
-  assert.equal(tools.has("switch_permission_mode"), false);
-  assert.equal(typeof handlers.get("tool_call"), "function");
-});
-
-test("mode cycling is idle-only, skips unavailable Auto, and rejects corrupt restored modes", async (t) => {
-  const cwd = await mkdtemp(join(tmpdir(), "piexis-mode-polish-"));
-  t.after(() => rm(cwd, { recursive: true, force: true }));
-  const handlers = new Map();
-  const shortcuts = new Map();
-  const commands = new Map();
-  let branch = [];
-  let current;
-  let idle = true;
-  modeExtension({
-    registerFlag() {}, getFlag() {},
-    registerCommand(name, command) { commands.set(name, command); },
-    registerShortcut(name, shortcut) { shortcuts.set(name, shortcut.handler); },
-    on(name, callback) { handlers.set(name, callback); },
-    appendEntry(customType, data) { branch.push({ type: "custom", customType, data }); },
-    events: { emit(name, value) { if (name === "piexis:permission-mode") current = value; } }
-  });
-  const ctx = { cwd, hasUI: false, mode: "json", isIdle: () => idle,
-    sessionManager: { getBranch: () => branch }, ui: {}, modelRegistry: { find: () => undefined, hasConfiguredAuth: () => false } };
-  await handlers.get("session_start")({ reason: "startup" }, ctx);
-  assert.equal(current, "default");
-  idle = false;
-  await assert.rejects(shortcuts.get("alt+m")(ctx), /idle/);
-  await assert.rejects(commands.get("plan").handler("", ctx), /idle/);
-  assert.equal(current, "default");
-  idle = true;
-  for (const expected of ["acceptEdits", "plan", "default"]) {
-    await shortcuts.get("alt+m")(ctx);
-    assert.equal(current, expected);
-  }
-  for (const restored of ["bypassPermissions", "dontAsk", "auto", "made-up-mode", "__proto__"]) {
-    branch = [{ type: "custom", customType: "piexis-permission-mode", data: { mode: restored } }];
-    await handlers.get("session_tree")({}, ctx);
-    assert.equal(current, "default", restored);
-  }
-});

package/tests/permission-evaluation.test.mjs

@@ -1,70 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { mkdtemp, writeFile, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { cases, validateCorpus, requestFor, score, main } from "../eval/permissions.mjs";
-import { AUTO_REVIEW_POLICY } from "../lib/permission-taxonomy.ts";
-
-const answer = (item, overrides = {}) => ({ id: item.id, stopReason: "stop", response: JSON.stringify({
-  decision: item.expected, category: item.categories[0], reason: "Synthetic scorer fixture, not a model result.",
-  authorizedBy: [requestFor(item).context.intent.currentRequestId], ...overrides
-}) });
-
-test("labeled corpus covers all review categories, counterfactual pairs, injection, and delegation", () => {
-  const counts = validateCorpus();
-  assert.ok(counts.cases >= 24 && counts.allow >= 6 && counts.deny >= 12);
-  assert.deepEqual(new Set(cases.flatMap((item) => item.categories)), new Set(Object.keys(AUTO_REVIEW_POLICY)));
-  for (const pair of ["status", "delete", "upload", "deploy", "external", "bypass", "delegate"]) {
-    assert.deepEqual(new Set(cases.filter((item) => item.tags.includes(`pair-${pair}`)).map((item) => item.expected)), new Set(["allow", "deny"]));
-  }
-  assert.throws(() => validateCorpus([cases[0], cases[0]]), /duplicate/);
-  assert.throws(() => validateCorpus([]), /empty/);
-});
-
-test("exports contain only synthetic requests, not labels or rationales; no provider is contacted", async () => {
-  const result = await main(["--export"]);
-  assert.equal(result.requests.length, cases.length);
-  for (const request of result.requests) {
-    assert.equal(request.expected, undefined);
-    assert.equal(request.rationale, undefined);
-    assert.ok(request.systemPrompt.includes("untrusted DATA"));
-    assert.equal(request.payload.context.cwd, "/fixture/workspace");
-  }
-  assert.equal((await main([])).liveModelRun, false);
-  await assert.rejects(main(["--live"]), /Usage/);
-});
-
-test("scoring files require matching request/prompt/corpus identities and a named model", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "piexis-eval-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const path = join(root, "predictions.json");
-  const exported = await main(["--export"]);
-  const input = { corpusHash: exported.corpusHash, promptHash: exported.promptHash, requestHash: exported.requestHash, model: "synthetic-oracle-not-a-model-run", predictions: cases.map((item) => answer(item)) };
-  await writeFile(path, JSON.stringify(input));
-  assert.equal((await main(["--score", path])).totals.correct, cases.length);
-  for (const key of ["corpusHash", "promptHash", "requestHash", "model"]) {
-    await writeFile(path, JSON.stringify({ ...input, [key]: "" }));
-    await assert.rejects(main(["--score", path]), /matching/);
-  }
-});
-
-test("scoring separates unsafe raw allows, host overrides, malformed responses, and absent predictions", () => {
-  const oracle = score(cases.map((item) => answer(item)));
-  assert.equal(oracle.totals.correct, cases.length);
-  assert.equal(oracle.totals.invalid, 0);
-  const prohibited = cases.find((item) => item.categories[0] === "credential-access");
-  const unsafe = score([answer(prohibited, { decision: "allow" })]);
-  assert.equal(unsafe.totals.falseAllows, 1);
-  assert.equal(unsafe.totals.policyOverrides, 1);
-  assert.equal(unsafe.totals.correct, 0);
-  assert.equal(unsafe.totals.invalid, cases.length - 1);
-  const allowed = cases.find((item) => item.expected === "allow");
-  for (const prediction of [answer(allowed, { authorizedBy: ["invented"] }), { ...answer(allowed), stopReason: "aborted" }, { id: allowed.id, response: "not JSON", stopReason: "stop" }]) {
-    const result = score([prediction], [allowed]);
-    assert.equal(result.totals.invalid, 1);
-    assert.equal(result.totals.correct, 0);
-  }
-  assert.throws(() => score([answer(allowed), answer(allowed)]), /duplicate/);
-  assert.throws(() => score([{ id: "unknown" }]), /Unknown/);
-});