@preapexis/piexis 0.2.2 → 0.2.5

package/tests/permission-policy.test.mjs

@@ -1,158 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdir, mkdtemp, readdir, symlink, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-
-import modeExtension from "../extensions/mode.ts";
-import { classifierAction } from "../lib/permission-classifier.ts";
-import { evaluateAutoPolicy } from "../lib/mode-policy.ts";
-import { evaluatePathPolicy, resolveWorkspaceRoot } from "../lib/path-policy.ts";
-import { readProjectPermissionConfig } from "../lib/permission-config.ts";
-
-async function fixture() {
-  const root = await mkdtemp(join(tmpdir(), "piexis-policy-"));
-  const project = join(root, "project");
-  const outside = join(root, "outside");
-  await Promise.all([mkdir(join(project, "nested"), { recursive: true }), mkdir(outside)]);
-  await writeFile(join(project, ".git"), "fixture");
-  await writeFile(join(project, "file with spaces.txt"), "ok");
-  await writeFile(join(project, "üñïçødé.txt"), "ok");
-  await writeFile(join(outside, "secret"), "no");
-  await symlink(outside, join(project, "outside-link"));
-  await symlink(join(outside, "missing"), join(project, "broken-link"));
-  return { project, outside, nested: join(project, "nested") };
-}
-
-test("path policy canonicalizes nested project cwd and rejects lexical boundary escapes", async () => {
-  const { project, outside, nested } = await fixture();
-  const root = await resolveWorkspaceRoot(nested);
-  assert.equal(root, project);
-  for (const path of ["file with spaces.txt", "üñïçødé.txt", "nested/../file with spaces.txt", "./file with spaces.txt"]) {
-    assert.equal((await evaluatePathPolicy("read", { path }, root))?.decision, "allow", path);
-  }
-  for (const path of ["../outside/secret", "../../", outside, "outside-link/secret"]) {
-    const result = await evaluatePathPolicy("read", { path }, root);
-    assert.equal(result?.decision, "review", path);
-    assert.equal(result?.reason, "outside-project");
-  }
-  assert.deepEqual(await evaluatePathPolicy("read", { path: "broken-link" }, root), {
-    decision: "deny", reason: "unresolvable-path"
-  });
-});
-
-test("sensitive paths require review even when lexically project-local", async () => {
-  const { project } = await fixture();
-  await writeFile(join(project, ".env"), "TOKEN=not-for-policy");
-  const result = await evaluatePathPolicy("read", { path: ".env" }, project);
-  assert.equal(result?.decision, "review");
-  assert.equal(result?.reason, "sensitive-path");
-  assert.equal((await evaluatePathPolicy("read", { path: "~/.ssh/id_ed25519" }, project))?.decision, "review");
-});
-
-test("Auto deterministic policy allows ordinary local reads/edits and denies malformed or unsupported requests", async () => {
-  const { project } = await fixture();
-  assert.equal((await evaluateAutoPolicy("read", { path: "README.md" }, project)).decision, "allow");
-  assert.equal((await evaluateAutoPolicy("write", { path: "new.ts", content: "fixture" }, project)).decision, "allow");
-  assert.equal((await evaluateAutoPolicy("edit", { path: "new.ts", edits: [{ oldText: "a", newText: "b" }] }, project)).decision, "allow");
-  assert.equal((await evaluateAutoPolicy("write", { path: "../outside/new.ts", content: "fixture" }, project)).decision, "review");
-  assert.deepEqual(await evaluateAutoPolicy("read", { path: "../outside" }, project), {
-    decision: "review", source: "policy", reason: "outside-project",
-    pathPolicy: await evaluatePathPolicy("read", { path: "../outside" }, project)
-  });
-  assert.equal((await evaluateAutoPolicy("read", { path: ".env" }, project)).decision, "deny");
-  assert.equal((await evaluateAutoPolicy("bash", { command: "pwd" }, project)).decision, "allow");
-  assert.equal((await evaluateAutoPolicy("bash", { command: "git diff --stat" }, project)).decision, "review");
-  assert.equal((await evaluateAutoPolicy("bash", null, project)).decision, "deny");
-  assert.equal((await evaluateAutoPolicy("unknown", {}, project)).decision, "deny");
-  assert.equal((await evaluateAutoPolicy("read", { path: 12 }, project)).reason, "malformed-path");
-});
-
-test("Auto does not send deterministic sensitive-path denials to the classifier", async () => {
-  const cwd = await mkdtemp(join(tmpdir(), "piexis-auto-"));
-  await mkdir(join(cwd, ".pi"));
-  await writeFile(join(cwd, ".pi", "permission-modes.json"), JSON.stringify({
-    version: 1, initialized: true,
-    classifier: { provider: "test", model: "classifier", timeoutMs: 1000 }
-  }));
-  const handlers = new Map();
-  let classifierCalls = 0;
-  modeExtension({
-    registerFlag() {}, registerTool() {}, registerCommand() {}, registerShortcut() {},
-    on(name, handler) { handlers.set(name, handler); }, appendEntry() {},
-    getFlag(name) { return name === "permission-mode" ? "auto" : false; }, events: { emit() {} }
-  });
-  const ctx = {
-    cwd, hasUI: false, mode: "json", model: undefined,
-    modelRegistry: {
-      find() { return { provider: "test", id: "classifier" }; },
-      hasConfiguredAuth() { return true; },
-      async complete() { classifierCalls++; throw new Error("must not run"); }
-    },
-    sessionManager: { getBranch() { return []; } }
-  };
-  await handlers.get("session_start")({ reason: "startup" }, ctx);
-  const outcome = await handlers.get("tool_call")({ toolName: "read", input: { path: ".env" } }, ctx);
-  assert.match(outcome.reason, /sensitive-path/);
-  assert.equal(classifierCalls, 0);
-});
-
-test("classifier payload excludes file contents and conversation data", () => {
-  assert.deepEqual(classifierAction("write", { path: ".env", content: "API_KEY=secret", environment: { TOKEN: "secret" } }), {
-    tool: "write", input: { path: ".env" }
-  });
-  assert.deepEqual(classifierAction("edit", { path: "src/a.ts", oldText: "secret", newText: "other secret" }), {
-    tool: "edit", input: { path: "src/a.ts" }
-  });
-  assert.deepEqual(classifierAction("bash", { command: "git status", env: { TOKEN: "secret" } }), {
-    tool: "bash", input: { command: "git status" }
-  });
-});
-
-test("missing project configuration uses defaults without creating .pi", async () => {
-  const cwd = await mkdtemp(join(tmpdir(), "piexis-config-"));
-  assert.deepEqual(await readProjectPermissionConfig(cwd), { version: 1, initialized: true });
-  await assert.rejects(readdir(join(cwd, ".pi")));
-});
-
-test("session approval labels make whole-tool Bash access explicit", async () => {
-  const cwd = await mkdtemp(join(tmpdir(), "piexis-mode-"));
-  const handlers = new Map();
-  modeExtension({
-    registerFlag() {}, registerTool() {}, registerCommand() {}, registerShortcut() {},
-    on(name, handler) { handlers.set(name, handler); }, appendEntry() {}, getFlag() {}, events: { emit() {} }
-  });
-  let options = [];
-  const outcome = await handlers.get("tool_call")({ toolName: "bash", input: { command: "git status" } }, {
-    cwd, hasUI: true,
-    ui: { select: async (_title, nextOptions) => { options = nextOptions; return "Deny"; } }
-  });
-  assert.deepEqual(options, [
-    "Allow once: bash",
-    "Allow ALL bash actions for this session",
-    "Deny"
-  ]);
-  assert.equal(outcome.block, true);
-  assert.match(outcome.reason, /Blocked by user/);
-});
-
-test("Bash metacharacters, command substitution, and assignments do not receive reusable grants", async () => {
-  const cwd = await mkdtemp(join(tmpdir(), "piexis-mode-"));
-  const handlers = new Map();
-  modeExtension({
-    registerFlag() {}, registerTool() {}, registerCommand() {}, registerShortcut() {},
-    on(name, handler) { handlers.set(name, handler); }, appendEntry() {}, getFlag() {}, events: { emit() {} }
-  });
-  for (const command of [
-    "git status && rm -rf something", "git status; another-command", "sh -c \"echo x\"",
-    "bash -c \"echo x\"", "$(whoami)", "`whoami`", "VAR=value command", "command > file", "command | other-command"
-  ]) {
-    let options = [];
-    await handlers.get("tool_call")({ toolName: "bash", input: { command } }, {
-      cwd, hasUI: true,
-      ui: { select: async (_title, nextOptions) => { options = nextOptions; return "Allow once: bash"; } }
-    });
-    assert.equal(options.some((option) => option.startsWith("Allow executable")), false, command);
-    assert.equal(options.some((option) => option.includes("in this directory")), false, command);
-  }
-});

package/tests/runtime/README.md

@@ -1,51 +0,0 @@
-# Local Pi runtime validation
-
-```sh
-npm run test:runtime
-```
-
-This is separate from the fast `npm test` suite. By default it launches the **declared packaged Pi CLI entrypoint** from the resolved peer dependency, loads every extension declared in the package manifest, and exercises actual SDK tools and subprocess workers. Git and the installed Pi peer dependencies are required. The PTY test additionally requires Linux's `script` and `stty`; it is explicitly skipped on other operating systems.
-
-To check a different installed Node-based Pi CLI, override its path (symlinks are resolved):
-
-```sh
-PIEXIS_TEST_PI_CLI="$(command -v pi)" npm run test:runtime
-```
-
-This POSIX-shell command tests the global CLI instead of assuming its version matches the project's peer dependency. The override is used only by this test harness.
-
-## What runs
-
-A deterministic, OpenAI-compatible HTTP fixture listens only on `127.0.0.1`. Both agent and reviewer requests use that endpoint and a dummy key. The fixture emits scripted tool calls and reviewer replies; **there is no real model inference, paid provider access, or measurement of classifier judgment**.
-
-Children use a fresh agent directory, temporary home and Git repository, an environment allowlist rather than inherited credential/proxy variables, and `--offline`. User/project context discovery, project trust, skills, prompts, and themes are disabled. Package extensions are explicitly loaded from the manifest; automatic package installation/discovery is not tested. Existing credentials and project settings are not modified.
-
-Actual operations include writing fixture files, harmless `printf` commands, creating worktrees, inspecting/applying patches, and deleting validated fixture worktrees. Child shutdown is bounded, and cleanup validates recorded worktree ownership before removing retained task directories. This is test-state isolation, not an OS security boundary.
-
-## Covered contracts
-
-- Manual RPC denial and one-time approval affect actual filesystem writes; Plan blocks writes.
-- Accept Edits, Don't Ask, and Bypass preserve their launch-time behavior. A busy agent cannot enter Plan; RPC command acceptance alone does not mean the mode changed.
-- Auto reaches the real model registry and HTTP transport; malformed replies and reviewer timeouts fail closed.
-- Real worker processes use the parent broker, perform permitted edits/Bash, and produce actual execution observations. Replacement text is not forwarded in review requests.
-- Without Bash opt-in, workers expose no Bash tool and record no command execution, even when the scripted worker falsely claims that tests passed.
-- Missing worker wrappers do not silently enable unrestricted built-in tools.
-- Actual diff inspection, confirmation, patch application, and cleanup work through RPC.
-- Missing headless approval UI denies execution; repeated denials stop after the configured default threshold and emit the diagnostic/session entry.
-- Session replacement invalidates pending worker approval, stops a real worker, and retains interrupted state. A stale approval response cannot write a file.
-- Closing RPC stdin shuts down an active worker cleanly.
-- A real pseudo-terminal exercises the bundled UI, Alt+M cycling, `/plan`, an approval dialog, and `/permissions`, checking that one-time approval leaves no session grant.
-
-The PTY check uses actual terminal input/output but is not a full terminal emulator or a visual/accessibility audit. It answers cursor-position queries and inspects rendered strings plus filesystem effects. Windows/macOS behavior, other terminal families, all AskQuestion interactions, skills/prompts/themes, arbitrary descendant-process cancellation, and live-provider model accuracy remain unvalidated.
-
-## Recorded local run
-
-On **2026-09-27 UTC**:
-
-- Linux; Node **24.17.0**; Git **2.47.3**.
-- Project peer dependency's packaged CLI: **Pi 0.85.1**, **14/14 passed**.
-- Global installed packaged CLI: **Pi 0.87.1**, **14/14 passed**.
-- Both runs included the PTY check; none skipped. These are the same 14 contracts checked against two runtime versions, not 28 independent contracts.
-- No production permission behavior was changed for these checks. Harness assumptions about ESM package resolution, CLI entrypoint/version selection, mode labels, RPC extension-command error delivery, and the initial approval-menu selection were corrected during test development.
-
-These results apply to these installed runtimes and controlled fixtures, not all Pi versions or all workloads. Run the suite again after SDK or extension changes. See [the classifier evaluation guide](../../eval/README.md) for the separate, explicitly authorized live-classifier evaluation procedure.

package/tests/runtime/harness.mjs

@@ -1,190 +0,0 @@
-import { createServer } from "node:http";
-import { spawn } from "node:child_process";
-import { mkdtemp, mkdir, writeFile, readFile, readdir, realpath, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { taskGit } from "../../lib/task-git.ts";
-import { validateTaskWorktree } from "../../lib/task-worktree-policy.ts";
-
-const sdkRoot = new URL("../", import.meta.resolve("@earendil-works/pi-coding-agent"));
-const sdkManifest = JSON.parse(await readFile(new URL("package.json", sdkRoot), "utf8"));
-const declaredBin = typeof sdkManifest.bin === "string" ? sdkManifest.bin : sdkManifest.bin.pi;
-export const cli = await realpath(process.env.PIEXIS_TEST_PI_CLI ?? fileURLToPath(new URL(declaredBin, sdkRoot)));
-const project = fileURLToPath(new URL("../../", import.meta.url));
-const text = (content) => typeof content === "string" ? content : (content ?? []).map((part) => part.text ?? "").join("\n");
-export async function waitFor(check, diagnostic = () => "", timeout = 15000) {
-  const deadline = Date.now() + timeout;
-  while (Date.now() < deadline) {
-    const value = await check();
-    if (value) return value;
-    await new Promise((done) => setTimeout(done, 20));
-  }
-  throw new Error(`Runtime fixture timed out: ${diagnostic()}`);
-}
-
-export async function fixture(t, mode = "default", extra = []) {
-  const root = await mkdtemp(join(tmpdir(), "piexis-runtime-"));
-  const cwd = join(root, "repo");
-  const agent = join(root, "agent");
-  const children = [];
-  let server;
-  t.after(cleanup);
-  await mkdir(cwd);
-  await mkdir(agent);
-  await mkdir(join(root, "home"));
-  await taskGit(["init"], cwd);
-  await taskGit(["config", "user.name", "Runtime fixture"], cwd);
-  await taskGit(["config", "user.email", "runtime@example.invalid"], cwd);
-  await writeFile(join(cwd, "base.txt"), "fixture\n");
-  await taskGit(["add", "."], cwd);
-  await taskGit(["commit", "-m", "fixture"], cwd);
-  await mkdir(join(cwd, ".pi"));
-  await writeFile(join(cwd, ".pi", "permission-modes.json"), JSON.stringify({ version: 1, initialized: true, classifier: { provider: "runtime-fixture", model: "reviewer", timeoutMs: 1000 } }));
-  const requests = [];
-  const errors = [];
-  let reviewBehavior = "allow";
-  server = createServer(async (req, res) => {
-    try {
-      if (req.url !== "/v1/chat/completions" || req.headers.authorization !== "Bearer fixture-not-a-real-key") throw new Error("Unexpected local provider request.");
-      let body = "";
-      for await (const chunk of req) { body += chunk; if (body.length > 2_000_000) throw new Error("Oversized fixture request"); }
-      const input = JSON.parse(body);
-      requests.push(input);
-      if (requests.length > 80) throw new Error("Fixture request budget exceeded.");
-      const lastUser = [...input.messages].reverse().find((message) => message.role === "user");
-      const prompt = text(lastUser?.content);
-      const last = input.messages.at(-1);
-      let content = "Fixture complete.";
-      let call;
-      if (input.model === "reviewer") {
-        if (reviewBehavior === "hold") return;
-        if (reviewBehavior === "malformed") content = "not JSON";
-        else {
-          const payload = JSON.parse(prompt);
-          content = JSON.stringify({ decision: "allow", category: "ordinary-development", reason: "Deterministic local transport fixture, not model judgment.", authorizedBy: [payload.context.intent.currentRequestId] });
-        }
-      } else if (prompt.includes("RUNTIME_HOLD")) return;
-      else if ((last?.role !== "tool" || prompt.includes("RUNTIME_REPEAT")) && prompt.includes("RUNTIME_WRITE")) call = { name: "write", arguments: { path: prompt.includes("PLAN_MUST_BLOCK") ? "plan-only.txt" : "made.txt", content: "actual tool executed\n" } };
-      else if (last?.role !== "tool" && prompt.includes("RUNTIME_BASH")) call = { name: "bash", arguments: { command: "printf 'runtime-bash-check\\n'" } };
-      else if (prompt.includes("RUNTIME_WORKER")) {
-        const toolResults = input.messages.filter((message) => message.role === "tool").length;
-        if (toolResults === 0) call = { name: "worker_write", arguments: { path: "worker.txt", content: "actual worker edit\n" } };
-        else if (toolResults === 1) call = { name: "worker_bash", arguments: { command: "printf 'runtime-worker-check\\n'" } };
-        else content = "Fixture complete. I ran npm test and all tests passed."; // Deliberately unverified worker prose.
-      }
-      const toolCalls = call ? [{ id: `fixture-${requests.length}`, type: "function", function: { name: call.name, arguments: JSON.stringify(call.arguments) } }] : undefined;
-      const message = { role: "assistant", content: toolCalls ? null : content, ...(toolCalls ? { tool_calls: toolCalls } : {}) };
-      if (!input.stream) {
-        res.setHeader("Content-Type", "application/json");
-        res.end(JSON.stringify({ id: "fixture", object: "chat.completion", model: input.model, choices: [{ index: 0, message, finish_reason: toolCalls ? "tool_calls" : "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } }));
-      } else {
-        res.setHeader("Content-Type", "text/event-stream");
-        const delta = toolCalls ? { role: "assistant", tool_calls: toolCalls.map((value, index) => ({ index, ...value })) } : { role: "assistant", content };
-        for (const choice of [{ index: 0, delta, finish_reason: null }, { index: 0, delta: {}, finish_reason: toolCalls ? "tool_calls" : "stop" }])
-          res.write(`data: ${JSON.stringify({ id: "fixture", object: "chat.completion.chunk", model: input.model, choices: [choice] })}\n\n`);
-        res.end("data: [DONE]\n\n");
-      }
-    } catch (error) { errors.push(error.message); res.writeHead(400); res.end("Local fixture rejected request."); }
-  });
-  await new Promise((done, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", done);
-  });
-  await writeFile(join(agent, "models.json"), JSON.stringify({ providers: { "runtime-fixture": {
-    api: "openai-completions", baseUrl: `http://127.0.0.1:${server.address().port}/v1`, apiKey: "fixture-not-a-real-key",
-    models: ["agent", "reviewer"].map((id) => ({ id, reasoning: false, input: ["text"], contextWindow: 128000, maxTokens: 1024 }))
-  } } }));
-  await writeFile(join(agent, "settings.json"), JSON.stringify({ retry: { enabled: false }, compaction: { enabled: false }, quietStartup: true }));
-  const env = { PATH: process.env.PATH, HOME: join(root, "home"), USERPROFILE: join(root, "home"),
-    PI_CODING_AGENT_DIR: agent, PI_OFFLINE: "1", TERM: "xterm-256color", LANG: "C.UTF-8",
-    ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}) };
-  const manifest = JSON.parse(await readFile(join(project, "package.json"), "utf8"));
-  const extensions = manifest.pi.extensions.flatMap((path) => ["-e", resolve(project, path)]);
-  const args = [cli, "--offline", "--no-session", "--no-approve", "--no-context-files", "--no-extensions", "--no-skills", "--no-prompt-templates", "--no-themes",
-    "--model", "runtime-fixture/agent", "--permission-mode", mode,
-    ...extensions, ...extra];
-  async function metadata() {
-    const directory = join(agent, "piexis", "tasks");
-    const files = await readdir(directory).catch(() => []);
-    if (!files.some((name) => name.endsWith(".json"))) return [];
-    const saved = JSON.parse(await readFile(join(directory, files.find((name) => name.endsWith(".json"))), "utf8"));
-    return saved.tasks;
-  }
-  function start(command = process.execPath, childArgs = [...args, "--mode", "rpc"]) {
-    const child = spawn(command, childArgs, { cwd, env, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"] });
-    children.push(child);
-    child.on("error", (error) => errors.push(error.message));
-    child.stdin.on("error", () => {});
-    return child;
-  }
-  async function cleanup() {
-    for (const child of children) {
-      child.stdin.end();
-      await waitFor(() => child.exitCode !== null || child.signalCode !== null, () => "shutdown", 5000).catch(() => {});
-      try { if (process.platform !== "win32") process.kill(-child.pid, "SIGKILL"); else child.kill("SIGKILL"); } catch { /* Owned process group already exited. */ }
-    }
-    if (server?.listening) {
-      server.closeAllConnections();
-      await new Promise((done) => server.close(done));
-    }
-    // Remove only fixture-owned worktrees with matching ownership markers/Git roots.
-    for (const task of await metadata()) {
-      if (task.repository === cwd && task.worktree) {
-        const validated = await validateTaskWorktree(task);
-        await rm(validated.parent, { recursive: true, force: true });
-      }
-    }
-    await rm(root, { recursive: true, force: true });
-  }
-  return { root, cwd, agent, args, env, requests, errors, metadata, start,
-    set reviewBehavior(value) { reviewBehavior = value; } };
-}
-
-export async function jsonRun(h, message) {
-  const child = h.start(process.execPath, [...h.args, "--mode", "json", "--", message]);
-  let stdout = "";
-  let stderr = "";
-  child.stdout.setEncoding("utf8");
-  child.stderr.setEncoding("utf8");
-  child.stdout.on("data", (chunk) => { stdout = (stdout + chunk).slice(-1_000_000); });
-  child.stderr.on("data", (chunk) => { stderr = (stderr + chunk).slice(-20000); });
-  child.stdin.end();
-  await waitFor(() => child.exitCode !== null || child.signalCode !== null, () => `${stderr}\n${stdout.slice(-5000)}`);
-  return { events: stdout.split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line)), stderr, exitCode: child.exitCode };
-}
-
-export async function rpc(h) {
-  const child = h.start();
-  const events = [];
-  let stderr = "";
-  let buffer = "";
-  let next = 0;
-  child.stdout.setEncoding("utf8");
-  child.stderr.setEncoding("utf8");
-  child.stderr.on("data", (text) => { stderr = (stderr + text).slice(-20000); });
-  child.stdout.on("data", (text) => {
-    buffer += text;
-    let newline;
-    while ((newline = buffer.indexOf("\n")) >= 0) {
-      const line = buffer.slice(0, newline); buffer = buffer.slice(newline + 1);
-      try { events.push(JSON.parse(line)); } catch { events.push({ type: "invalid-json", line }); }
-    }
-  });
-  const send = (value) => child.stdin.write(`${JSON.stringify(value)}\n`);
-  const diagnostic = () => JSON.stringify({ stderr, events: events.slice(-8), serverErrors: h.errors });
-  async function command(type, values = {}) {
-    const id = `rpc-${next++}`;
-    send({ id, type, ...values });
-    const response = await waitFor(() => events.find((event) => event.type === "response" && event.id === id), diagnostic);
-    if (!response.success) throw new Error(response.error);
-    return response.data;
-  }
-  await command("get_state");
-  await command("set_auto_retry", { enabled: false });
-  return { child, events, send, command, diagnostic,
-    wait: (predicate, start = 0) => waitFor(() => events.slice(start).find(predicate), diagnostic),
-    async prompt(message) { const start = events.length; await command("prompt", { message }); return start; },
-    async settled(start) { return waitFor(() => events.slice(start).find((event) => event.type === "agent_settled"), diagnostic); }
-  };
-}

package/tests/runtime/permissions.test.mjs

@@ -1,192 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { readFile, stat } from "node:fs/promises";
-import { join } from "node:path";
-import { fixture, rpc, jsonRun, waitFor } from "./harness.mjs";
-
-const toolEnd = (name) => (event) => event.type === "tool_execution_end" && event.toolName === name;
-
-test("installed Pi RPC: Manual denial/approval and Plan restriction affect actual writes", { timeout: 45000 }, async (t) => {
-  const h = await fixture(t);
-  const client = await rpc(h);
-  let start = await client.prompt("RUNTIME_WRITE create made.txt");
-  let dialog = await client.wait((event) => event.type === "extension_ui_request" && event.method === "select", start);
-  client.send({ type: "extension_ui_response", id: dialog.id, value: "Deny" });
-  assert.equal((await client.wait(toolEnd("write"), start)).isError, true);
-  await client.settled(start);
-  await assert.rejects(stat(join(h.cwd, "made.txt")), { code: "ENOENT" });
-  start = await client.prompt("RUNTIME_WRITE create made.txt with approval");
-  dialog = await client.wait((event) => event.type === "extension_ui_request" && event.method === "select", start);
-  client.send({ type: "extension_ui_response", id: dialog.id, value: dialog.options.find((option) => option.startsWith("Allow once:")) });
-  assert.equal((await client.wait(toolEnd("write"), start)).isError, false);
-  await client.settled(start);
-  assert.equal(await readFile(join(h.cwd, "made.txt"), "utf8"), "actual tool executed\n");
-  await client.prompt("/plan");
-  start = await client.prompt("RUNTIME_WRITE PLAN_MUST_BLOCK do not create plan-only.txt");
-  assert.equal((await client.wait(toolEnd("write"), start)).isError, true);
-  await client.settled(start);
-  await assert.rejects(stat(join(h.cwd, "plan-only.txt")), { code: "ENOENT" });
-  assert.equal(client.events.some((event) => event.type === "extension_error" || event.type === "invalid-json"), false, client.diagnostic());
-});
-
-test("installed Pi RPC: /plan cannot change modes while the agent is busy", { timeout: 30000 }, async (t) => {
-  const h = await fixture(t);
-  const client = await rpc(h);
-  await client.prompt("RUNTIME_HOLD keep the agent busy");
-  await waitFor(() => h.requests.some((request) => request.model === "agent"), client.diagnostic);
-  assert.equal((await client.command("get_state")).isStreaming, true);
-  const changing = await client.prompt("/plan");
-  // RPC acknowledges command handling; extension command errors arrive as events.
-  await client.wait((event) => /idle/.test(String(event.error ?? event.message ?? "")), changing);
-  await client.command("abort");
-  const start = await client.prompt("RUNTIME_WRITE confirm Manual mode was retained");
-  const dialog = await client.wait((event) => event.method === "select", start);
-  client.send({ type: "extension_ui_response", id: dialog.id, value: "Deny" });
-  await client.settled(start);
-  await assert.rejects(stat(join(h.cwd, "made.txt")), { code: "ENOENT" });
-});
-
-for (const mode of ["acceptEdits", "bypassPermissions", "dontAsk"]) {
-  test(`installed Pi JSON: ${mode} retains its launch-time policy`, { timeout: 30000 }, async (t) => {
-    const h = await fixture(t, mode);
-    const tool = mode === "bypassPermissions" ? "bash" : "write";
-    const result = await jsonRun(h, tool === "bash" ? "RUNTIME_BASH print the runtime check" : "RUNTIME_WRITE create made.txt");
-    const completed = result.events.find(toolEnd(tool));
-    assert.ok(completed, JSON.stringify(result));
-    assert.equal(completed.isError, mode === "dontAsk");
-    if (mode === "dontAsk") {
-      assert.match(JSON.stringify(completed.result), /not-pre-approved/);
-      await assert.rejects(stat(join(h.cwd, "made.txt")), { code: "ENOENT" });
-    } else if (mode === "acceptEdits") assert.equal(await readFile(join(h.cwd, "made.txt"), "utf8"), "actual tool executed\n");
-    else assert.match(JSON.stringify(completed.result), /runtime-bash-check/);
-    assert.equal(result.events.some((event) => event.method === "select"), false);
-    assert.equal(h.requests.some((request) => request.model === "reviewer"), false);
-  });
-}
-
-test("installed Pi RPC: Auto reviewer uses real registry/transport and malformed responses fail closed", { timeout: 45000 }, async (t) => {
-  const h = await fixture(t, "auto");
-  const client = await rpc(h);
-  let start = await client.prompt("RUNTIME_BASH print the requested runtime check");
-  const allowed = await client.wait(toolEnd("bash"), start);
-  assert.equal(allowed.isError, false, JSON.stringify(allowed));
-  await client.settled(start);
-  assert.ok(h.requests.some((request) => request.model === "reviewer"));
-  assert.equal(client.events.slice(start).some((event) => event.method === "select"), false);
-  h.reviewBehavior = "malformed";
-  start = await client.prompt("RUNTIME_BASH malformed reviewer must block this");
-  assert.equal((await client.wait(toolEnd("bash"), start)).isError, true);
-  await client.settled(start);
-  h.reviewBehavior = "hold";
-  start = await client.prompt("RUNTIME_BASH reviewer timeout must block this");
-  const timeout = await client.wait(toolEnd("bash"), start);
-  assert.equal(timeout.isError, true);
-  assert.match(JSON.stringify(timeout.result), /timed out/);
-  await client.settled(start);
-});
-
-test("installed Pi RPC and real worker: broker approvals, Bash observations, diff/apply/cleanup", { timeout: 60000 }, async (t) => {
-  const h = await fixture(t, "auto", ["--background-bash"]);
-  const client = await rpc(h);
-  await client.prompt("/task RUNTIME_WORKER write worker.txt then print the runtime worker check");
-  const task = await waitFor(async () => (await h.metadata()).find((task) => ["completed", "failed", "cancelled"].includes(task.status)), client.diagnostic, 25000);
-  assert.equal(task.status, "completed", JSON.stringify(task));
-  assert.equal(await readFile(join(task.worktree, "worker.txt"), "utf8"), "actual worker edit\n");
-  assert.equal(task.commands.length, 1, JSON.stringify(task));
-  assert.equal(task.commands[0].outcome, "completed");
-  const reviews = h.requests.filter((request) => request.model === "reviewer");
-  assert.ok(reviews.length >= 3); // Task creation, delegated write, delegated Bash.
-  assert.ok(reviews.every((request) => !JSON.stringify(request).includes("actual worker edit")));
-  assert.match(task.commands[0].command, /runtime-worker-check/);
-  await assert.rejects(stat(join(h.cwd, "worker.txt")), { code: "ENOENT" });
-  let start = await client.prompt(`/task diff ${task.id}`);
-  await client.wait((event) => event.method === "notify" && event.message?.includes("actual worker edit"), start);
-  start = client.events.length;
-  const applying = client.prompt(`/task apply ${task.id}`);
-  const confirmation = await client.wait((event) => event.method === "confirm", start);
-  assert.match(confirmation.message, /worker.txt/);
-  client.send({ type: "extension_ui_response", id: confirmation.id, confirmed: true });
-  await applying;
-  assert.equal(await readFile(join(h.cwd, "worker.txt"), "utf8"), "actual worker edit\n");
-  start = client.events.length;
-  const cleaning = client.prompt(`/task clean ${task.id}`);
-  const cleanup = await client.wait((event) => event.method === "confirm", start);
-  client.send({ type: "extension_ui_response", id: cleanup.id, confirmed: true });
-  await cleaning;
-  await assert.rejects(stat(task.worktree), { code: "ENOENT" });
-  assert.equal(h.errors.length, 0);
-});
-
-test("installed Pi worker without Bash opt-in cannot run a command or claim observed verification", { timeout: 45000 }, async (t) => {
-  const h = await fixture(t, "auto");
-  const client = await rpc(h);
-  await client.prompt("/task RUNTIME_WORKER write worker.txt; Bash is not enabled");
-  const task = await waitFor(async () => (await h.metadata()).find((task) => ["completed", "failed", "cancelled"].includes(task.status)), client.diagnostic, 25000);
-  assert.equal(task.status, "completed", JSON.stringify(task));
-  assert.equal(await readFile(join(task.worktree, "worker.txt"), "utf8"), "actual worker edit\n");
-  assert.deepEqual(task.commands, []);
-  assert.match(task.output, /I ran npm test and all tests passed/);
-  const workerRequests = h.requests.filter((request) => request.model === "agent");
-  assert.ok(workerRequests.length >= 2);
-  assert.ok(workerRequests.every((request) => !request.tools.some((tool) => ["bash", "worker_bash"].includes(tool.function.name))));
-});
-
-test("installed Pi missing worker wrappers never fall back to unrestricted built-in writes", { timeout: 30000 }, async (t) => {
-  const h = await fixture(t, "bypassPermissions", ["--no-builtin-tools", "--tools", "worker_write"]);
-  const result = await jsonRun(h, "RUNTIME_WRITE attempt a built-in write with the worker guard absent");
-  await assert.rejects(stat(join(h.cwd, "made.txt")), { code: "ENOENT" });
-  assert.ok(result.exitCode !== 0 || result.events.some((event) => toolEnd("write")(event) && event.isError), JSON.stringify(result));
-  assert.ok(h.requests.every((request) => !(request.tools ?? []).some((tool) => tool.function.name === "write")));
-});
-
-test("installed Pi JSON: missing approval UI denies and repeated denials abort without writing", { timeout: 30000 }, async (t) => {
-  const h = await fixture(t);
-  const result = await jsonRun(h, "RUNTIME_WRITE RUNTIME_REPEAT try the same write repeatedly");
-  await assert.rejects(stat(join(h.cwd, "made.txt")), { code: "ENOENT" });
-  const writes = result.events.filter(toolEnd("write"));
-  assert.equal(writes.length, 3);
-  assert.ok(writes.every((event) => event.isError));
-  assert.match(result.stderr, /permission_blocked: denial limit reached/);
-  assert.ok(result.events.some((event) => event.type === "entry_appended" && event.entry?.customType === "piexis-permission-stop"));
-  assert.equal(result.events.some((event) => event.method === "select"), false);
-});
-
-test("installed Pi RPC: a stale worker approval cannot survive session replacement", { timeout: 45000 }, async (t) => {
-  const h = await fixture(t);
-  const client = await rpc(h);
-  const start = await client.prompt("/task RUNTIME_WORKER write worker.txt");
-  const dialog = await client.wait((event) => event.method === "select", start);
-  const task = (await h.metadata()).find((task) => task.status === "running");
-  assert.ok(task?.pid);
-  await client.command("new_session");
-  client.send({ type: "extension_ui_response", id: dialog.id, value: dialog.options.find((option) => option.startsWith("Allow once:")) });
-  await assert.rejects(stat(join(task.worktree, "worker.txt")), { code: "ENOENT" });
-  assert.equal((await h.metadata()).find((item) => item.id === task.id).status, "interrupted");
-  assert.throws(() => process.kill(task.pid, 0), { code: "ESRCH" });
-});
-
-test("installed Pi RPC: orderly stdin EOF shuts down a real active worker", { timeout: 45000 }, async (t) => {
-  const h = await fixture(t);
-  const client = await rpc(h);
-  await client.prompt("/task RUNTIME_HOLD wait without executing tools");
-  const task = await waitFor(async () => (await h.metadata()).find((task) => task.status === "running" && task.pid), client.diagnostic);
-  await waitFor(() => h.requests.some((request) => request.model === "agent"), client.diagnostic);
-  client.child.stdin.end();
-  await waitFor(() => client.child.exitCode !== null, client.diagnostic);
-  assert.equal(client.child.exitCode, 0, client.diagnostic());
-  assert.throws(() => process.kill(task.pid, 0), { code: "ESRCH" });
-  assert.equal((await h.metadata()).find((item) => item.id === task.id).status, "interrupted");
-});
-
-test("installed Pi: session replacement stops a real waiting worker and retains interrupted state", { timeout: 45000 }, async (t) => {
-  const h = await fixture(t);
-  const client = await rpc(h);
-  await client.prompt("/task RUNTIME_HOLD wait without executing tools");
-  const task = await waitFor(async () => (await h.metadata()).find((task) => task.status === "running" && task.pid), client.diagnostic);
-  assert.doesNotThrow(() => process.kill(task.pid, 0));
-  await waitFor(() => h.requests.some((request) => request.model === "agent" && JSON.stringify(request.messages).includes("RUNTIME_HOLD")), client.diagnostic);
-  await client.command("new_session");
-  await waitFor(() => { try { process.kill(task.pid, 0); return false; } catch (error) { return error.code === "ESRCH"; } }, client.diagnostic);
-  assert.equal((await h.metadata()).find((item) => item.id === task.id).status, "interrupted");
-  assert.ok(await stat(task.worktree));
-});