@terminai/cli 0.21.0

package/dist/src/config/trustedFolders.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Settings } from './settings.js';
+export declare const TRUSTED_FOLDERS_FILENAME = "trustedFolders.json";
+export declare function getUserSettingsDir(): string;
+export declare function getTrustedFoldersPath(): string;
+export declare enum TrustLevel {
+    TRUST_FOLDER = "TRUST_FOLDER",
+    TRUST_PARENT = "TRUST_PARENT",
+    DO_NOT_TRUST = "DO_NOT_TRUST"
+}
+export declare function isTrustLevel(value: unknown): value is TrustLevel;
+export interface TrustRule {
+    path: string;
+    trustLevel: TrustLevel;
+}
+export interface TrustedFoldersError {
+    message: string;
+    path: string;
+}
+export interface TrustedFoldersFile {
+    config: Record<string, TrustLevel>;
+    path: string;
+}
+export interface TrustResult {
+    isTrusted: boolean | undefined;
+    source: 'ide' | 'file' | undefined;
+}
+export declare class LoadedTrustedFolders {
+    readonly user: TrustedFoldersFile;
+    readonly errors: TrustedFoldersError[];
+    constructor(user: TrustedFoldersFile, errors: TrustedFoldersError[]);
+    get rules(): TrustRule[];
+    /**
+     * Returns true or false if the path should be "trusted". This function
+     * should only be invoked when the folder trust setting is active.
+     *
+     * @param location path
+     * @returns
+     */
+    isPathTrusted(location: string, config?: Record<string, TrustLevel>): boolean | undefined;
+    setValue(path: string, trustLevel: TrustLevel): void;
+}
+/**
+ * FOR TESTING PURPOSES ONLY.
+ * Resets the in-memory cache of the trusted folders configuration.
+ */
+export declare function resetTrustedFoldersForTesting(): void;
+export declare function loadTrustedFolders(): LoadedTrustedFolders;
+export declare function saveTrustedFolders(trustedFoldersFile: TrustedFoldersFile): void;
+/** Is folder trust feature enabled per the current applied settings */
+export declare function isFolderTrustEnabled(settings: Settings): boolean;
+export declare function isWorkspaceTrusted(settings: Settings, trustConfig?: Record<string, TrustLevel>): TrustResult;

package/dist/src/config/trustedFolders.js

@@ -0,0 +1,192 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { homedir } from 'node:os';
+import { FatalConfigError, getErrorMessage, isWithinRoot, ideContextStore, GEMINI_DIR, } from '@terminai/core';
+import stripJsonComments from 'strip-json-comments';
+export const TRUSTED_FOLDERS_FILENAME = 'trustedFolders.json';
+export function getUserSettingsDir() {
+    return path.join(homedir(), GEMINI_DIR);
+}
+export function getTrustedFoldersPath() {
+    if (process.env['GEMINI_CLI_TRUSTED_FOLDERS_PATH']) {
+        return process.env['GEMINI_CLI_TRUSTED_FOLDERS_PATH'];
+    }
+    return path.join(getUserSettingsDir(), TRUSTED_FOLDERS_FILENAME);
+}
+export var TrustLevel;
+(function (TrustLevel) {
+    TrustLevel["TRUST_FOLDER"] = "TRUST_FOLDER";
+    TrustLevel["TRUST_PARENT"] = "TRUST_PARENT";
+    TrustLevel["DO_NOT_TRUST"] = "DO_NOT_TRUST";
+})(TrustLevel || (TrustLevel = {}));
+export function isTrustLevel(value) {
+    return (typeof value === 'string' &&
+        Object.values(TrustLevel).includes(value));
+}
+export class LoadedTrustedFolders {
+    user;
+    errors;
+    constructor(user, errors) {
+        this.user = user;
+        this.errors = errors;
+    }
+    get rules() {
+        return Object.entries(this.user.config).map(([path, trustLevel]) => ({
+            path,
+            trustLevel,
+        }));
+    }
+    /**
+     * Returns true or false if the path should be "trusted". This function
+     * should only be invoked when the folder trust setting is active.
+     *
+     * @param location path
+     * @returns
+     */
+    isPathTrusted(location, config) {
+        const configToUse = config ?? this.user.config;
+        const trustedPaths = [];
+        const untrustedPaths = [];
+        for (const rule of Object.entries(configToUse).map(([path, trustLevel]) => ({ path, trustLevel }))) {
+            switch (rule.trustLevel) {
+                case TrustLevel.TRUST_FOLDER:
+                    trustedPaths.push(rule.path);
+                    break;
+                case TrustLevel.TRUST_PARENT:
+                    trustedPaths.push(path.dirname(rule.path));
+                    break;
+                case TrustLevel.DO_NOT_TRUST:
+                    untrustedPaths.push(rule.path);
+                    break;
+                default:
+                    // Do nothing for unknown trust levels.
+                    break;
+            }
+        }
+        for (const trustedPath of trustedPaths) {
+            if (isWithinRoot(location, trustedPath)) {
+                return true;
+            }
+        }
+        for (const untrustedPath of untrustedPaths) {
+            if (path.normalize(location) === path.normalize(untrustedPath)) {
+                return false;
+            }
+        }
+        return undefined;
+    }
+    setValue(path, trustLevel) {
+        const originalTrustLevel = this.user.config[path];
+        this.user.config[path] = trustLevel;
+        try {
+            saveTrustedFolders(this.user);
+        }
+        catch (e) {
+            // Revert the in-memory change if the save failed.
+            if (originalTrustLevel === undefined) {
+                delete this.user.config[path];
+            }
+            else {
+                this.user.config[path] = originalTrustLevel;
+            }
+            throw e;
+        }
+    }
+}
+let loadedTrustedFolders;
+/**
+ * FOR TESTING PURPOSES ONLY.
+ * Resets the in-memory cache of the trusted folders configuration.
+ */
+export function resetTrustedFoldersForTesting() {
+    loadedTrustedFolders = undefined;
+}
+export function loadTrustedFolders() {
+    if (loadedTrustedFolders) {
+        return loadedTrustedFolders;
+    }
+    const errors = [];
+    const userConfig = {};
+    const userPath = getTrustedFoldersPath();
+    // Load user trusted folders
+    try {
+        if (fs.existsSync(userPath)) {
+            const content = fs.readFileSync(userPath, 'utf-8');
+            const parsed = JSON.parse(stripJsonComments(content));
+            if (typeof parsed !== 'object' ||
+                parsed === null ||
+                Array.isArray(parsed)) {
+                errors.push({
+                    message: 'Trusted folders file is not a valid JSON object.',
+                    path: userPath,
+                });
+            }
+            else {
+                for (const [path, trustLevel] of Object.entries(parsed)) {
+                    if (isTrustLevel(trustLevel)) {
+                        userConfig[path] = trustLevel;
+                    }
+                    else {
+                        const possibleValues = Object.values(TrustLevel).join(', ');
+                        errors.push({
+                            message: `Invalid trust level "${trustLevel}" for path "${path}". Possible values are: ${possibleValues}.`,
+                            path: userPath,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    catch (error) {
+        errors.push({
+            message: getErrorMessage(error),
+            path: userPath,
+        });
+    }
+    loadedTrustedFolders = new LoadedTrustedFolders({ path: userPath, config: userConfig }, errors);
+    return loadedTrustedFolders;
+}
+export function saveTrustedFolders(trustedFoldersFile) {
+    // Ensure the directory exists
+    const dirPath = path.dirname(trustedFoldersFile.path);
+    if (!fs.existsSync(dirPath)) {
+        fs.mkdirSync(dirPath, { recursive: true });
+    }
+    fs.writeFileSync(trustedFoldersFile.path, JSON.stringify(trustedFoldersFile.config, null, 2), { encoding: 'utf-8', mode: 0o600 });
+}
+/** Is folder trust feature enabled per the current applied settings */
+export function isFolderTrustEnabled(settings) {
+    const folderTrustSetting = settings.security?.folderTrust?.enabled ?? false;
+    return folderTrustSetting;
+}
+function getWorkspaceTrustFromLocalConfig(trustConfig) {
+    const folders = loadTrustedFolders();
+    const configToUse = trustConfig ?? folders.user.config;
+    if (folders.errors.length > 0) {
+        const errorMessages = folders.errors.map((error) => `Error in ${error.path}: ${error.message}`);
+        throw new FatalConfigError(`${errorMessages.join('\n')}\nPlease fix the configuration file and try again.`);
+    }
+    const isTrusted = folders.isPathTrusted(process.cwd(), configToUse);
+    return {
+        isTrusted,
+        source: isTrusted !== undefined ? 'file' : undefined,
+    };
+}
+export function isWorkspaceTrusted(settings, trustConfig) {
+    if (!isFolderTrustEnabled(settings)) {
+        return { isTrusted: true, source: undefined };
+    }
+    const ideTrust = ideContextStore.get()?.workspaceState?.isTrusted;
+    if (ideTrust !== undefined) {
+        return { isTrusted: ideTrust, source: 'ide' };
+    }
+    // Fall back to the local user configuration
+    return getWorkspaceTrustFromLocalConfig(trustConfig);
+}
+//# sourceMappingURL=trustedFolders.js.map

package/dist/src/config/trustedFolders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedFolders.js","sourceRoot":"","sources":["../../../src/config/trustedFolders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,GACX,MAAM,gBAAgB,CAAC;AAExB,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,IAAI,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,wBAAwB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAN,IAAY,UAIX;AAJD,WAAY,UAAU;IACpB,2CAA6B,CAAA;IAC7B,2CAA6B,CAAA;IAC7B,2CAA6B,CAAA;AAC/B,CAAC,EAJW,UAAU,KAAV,UAAU,QAIrB;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAmB,CAAC,CACxD,CAAC;AACJ,CAAC;AAsBD,MAAM,OAAO,oBAAoB;IAEpB;IACA;IAFX,YACW,IAAwB,EACxB,MAA6B;QAD7B,SAAI,GAAJ,IAAI,CAAoB;QACxB,WAAM,GAAN,MAAM,CAAuB;IACrC,CAAC;IAEJ,IAAI,KAAK;QACP,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI;YACJ,UAAU;SACX,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CACX,QAAgB,EAChB,MAAmC;QAEnC,MAAM,WAAW,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/C,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAChD,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC/C,EAAE,CAAC;YACF,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxB,KAAK,UAAU,CAAC,YAAY;oBAC1B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7B,MAAM;gBACR,KAAK,UAAU,CAAC,YAAY;oBAC1B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,UAAU,CAAC,YAAY;oBAC1B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM;gBACR;oBACE,uCAAuC;oBACvC,MAAM;YACV,CAAC;QACH,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,UAAsB;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;QACpC,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kDAAkD;YAClD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC;YAC9C,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;CACF;AAED,IAAI,oBAAsD,CAAC;AAE3D;;;GAGG;AACH,MAAM,UAAU,6BAA6B;IAC3C,oBAAoB,GAAG,SAAS,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,UAAU,GAA+B,EAAE,CAAC;IAElD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IAEzC,4BAA4B;IAC5B,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YAE/D,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxD,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC7B,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC5D,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,wBAAwB,UAAU,eAAe,IAAI,2BAA2B,cAAc,GAAG;4BAC1G,IAAI,EAAE,QAAQ;yBACf,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC;YAC/B,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,GAAG,IAAI,oBAAoB,CAC7C,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,EACtC,MAAM,CACP,CAAC;IACF,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,kBAAsC;IAEtC,8BAA8B;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,EAAE,CAAC,aAAa,CACd,kBAAkB,CAAC,IAAI,EACvB,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAClD,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CACnC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,IAAI,KAAK,CAAC;IAC5E,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,gCAAgC,CACvC,WAAwC;IAExC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IAEvD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CACtD,CAAC;QACF,MAAM,IAAI,gBAAgB,CACxB,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO;QACL,SAAS;QACT,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAkB,EAClB,WAAwC;IAExC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,4CAA4C;IAC5C,OAAO,gCAAgC,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC"}

package/dist/src/config/trustedFolders.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/config/trustedFolders.test.js

@@ -0,0 +1,379 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as osActual from 'node:os';
+import { FatalConfigError, ideContextStore } from '@terminai/core';
+import { describe, it, expect, vi, beforeEach, afterEach, } from 'vitest';
+import * as fs from 'node:fs';
+import stripJsonComments from 'strip-json-comments';
+import * as path from 'node:path';
+import { loadTrustedFolders, getTrustedFoldersPath, TrustLevel, isWorkspaceTrusted, resetTrustedFoldersForTesting, } from './trustedFolders.js';
+vi.mock('os', async (importOriginal) => {
+    const actualOs = await importOriginal();
+    return {
+        ...actualOs,
+        homedir: vi.fn(() => '/mock/home/user'),
+        platform: vi.fn(() => 'linux'),
+    };
+});
+vi.mock('fs', async (importOriginal) => {
+    const actualFs = await importOriginal();
+    return {
+        ...actualFs,
+        existsSync: vi.fn(),
+        readFileSync: vi.fn(),
+        writeFileSync: vi.fn(),
+        mkdirSync: vi.fn(),
+    };
+});
+vi.mock('strip-json-comments', () => ({
+    default: vi.fn((content) => content),
+}));
+describe('Trusted Folders Loading', () => {
+    let mockFsExistsSync;
+    let mockStripJsonComments;
+    let mockFsWriteFileSync;
+    beforeEach(() => {
+        resetTrustedFoldersForTesting();
+        vi.resetAllMocks();
+        mockFsExistsSync = vi.mocked(fs.existsSync);
+        mockStripJsonComments = vi.mocked(stripJsonComments);
+        mockFsWriteFileSync = vi.mocked(fs.writeFileSync);
+        vi.mocked(osActual.homedir).mockReturnValue('/mock/home/user');
+        mockStripJsonComments.mockImplementation((jsonString) => jsonString);
+        mockFsExistsSync.mockReturnValue(false);
+        fs.readFileSync.mockReturnValue('{}');
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('should load empty rules if no files exist', () => {
+        const { rules, errors } = loadTrustedFolders();
+        expect(rules).toEqual([]);
+        expect(errors).toEqual([]);
+    });
+    describe('isPathTrusted', () => {
+        function setup({ config = {} } = {}) {
+            mockFsExistsSync.mockImplementation((p) => p === getTrustedFoldersPath());
+            fs.readFileSync.mockImplementation((p) => {
+                if (p === getTrustedFoldersPath())
+                    return JSON.stringify(config);
+                return '{}';
+            });
+            const folders = loadTrustedFolders();
+            return { folders };
+        }
+        it('provides a method to determine if a path is trusted', () => {
+            const { folders } = setup({
+                config: {
+                    './myfolder': TrustLevel.TRUST_FOLDER,
+                    '/trustedparent/trustme': TrustLevel.TRUST_PARENT,
+                    '/user/folder': TrustLevel.TRUST_FOLDER,
+                    '/secret': TrustLevel.DO_NOT_TRUST,
+                    '/secret/publickeys': TrustLevel.TRUST_FOLDER,
+                },
+            });
+            expect(folders.isPathTrusted('/secret')).toBe(false);
+            expect(folders.isPathTrusted('/user/folder')).toBe(true);
+            expect(folders.isPathTrusted('/secret/publickeys/public.pem')).toBe(true);
+            expect(folders.isPathTrusted('/user/folder/harhar')).toBe(true);
+            expect(folders.isPathTrusted('myfolder/somefile.jpg')).toBe(true);
+            expect(folders.isPathTrusted('/trustedparent/someotherfolder')).toBe(true);
+            expect(folders.isPathTrusted('/trustedparent/trustme')).toBe(true);
+            // No explicit rule covers this file
+            expect(folders.isPathTrusted('/secret/bankaccounts.json')).toBe(undefined);
+            expect(folders.isPathTrusted('/secret/mine/privatekey.pem')).toBe(undefined);
+            expect(folders.isPathTrusted('/user/someotherfolder')).toBe(undefined);
+        });
+    });
+    it('should load user rules if only user file exists', () => {
+        const userPath = getTrustedFoldersPath();
+        mockFsExistsSync.mockImplementation((p) => p === userPath);
+        const userContent = {
+            '/user/folder': TrustLevel.TRUST_FOLDER,
+        };
+        fs.readFileSync.mockImplementation((p) => {
+            if (p === userPath)
+                return JSON.stringify(userContent);
+            return '{}';
+        });
+        const { rules, errors } = loadTrustedFolders();
+        expect(rules).toEqual([
+            { path: '/user/folder', trustLevel: TrustLevel.TRUST_FOLDER },
+        ]);
+        expect(errors).toEqual([]);
+    });
+    it('should handle JSON parsing errors gracefully', () => {
+        const userPath = getTrustedFoldersPath();
+        mockFsExistsSync.mockImplementation((p) => p === userPath);
+        fs.readFileSync.mockImplementation((p) => {
+            if (p === userPath)
+                return 'invalid json';
+            return '{}';
+        });
+        const { rules, errors } = loadTrustedFolders();
+        expect(rules).toEqual([]);
+        expect(errors.length).toBe(1);
+        expect(errors[0].path).toBe(userPath);
+        expect(errors[0].message).toContain('Unexpected token');
+    });
+    it('should use GEMINI_CLI_TRUSTED_FOLDERS_PATH env var if set', () => {
+        const customPath = '/custom/path/to/trusted_folders.json';
+        process.env['GEMINI_CLI_TRUSTED_FOLDERS_PATH'] = customPath;
+        mockFsExistsSync.mockImplementation((p) => p === customPath);
+        const userContent = {
+            '/user/folder/from/env': TrustLevel.TRUST_FOLDER,
+        };
+        fs.readFileSync.mockImplementation((p) => {
+            if (p === customPath)
+                return JSON.stringify(userContent);
+            return '{}';
+        });
+        const { rules, errors } = loadTrustedFolders();
+        expect(rules).toEqual([
+            {
+                path: '/user/folder/from/env',
+                trustLevel: TrustLevel.TRUST_FOLDER,
+            },
+        ]);
+        expect(errors).toEqual([]);
+        delete process.env['GEMINI_CLI_TRUSTED_FOLDERS_PATH'];
+    });
+    it('setValue should update the user config and save it', () => {
+        const loadedFolders = loadTrustedFolders();
+        loadedFolders.setValue('/new/path', TrustLevel.TRUST_FOLDER);
+        expect(loadedFolders.user.config['/new/path']).toBe(TrustLevel.TRUST_FOLDER);
+        expect(mockFsWriteFileSync).toHaveBeenCalledWith(getTrustedFoldersPath(), JSON.stringify({ '/new/path': TrustLevel.TRUST_FOLDER }, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    });
+});
+describe('isWorkspaceTrusted', () => {
+    let mockCwd;
+    const mockRules = {};
+    const mockSettings = {
+        security: {
+            folderTrust: {
+                enabled: true,
+            },
+        },
+    };
+    beforeEach(() => {
+        resetTrustedFoldersForTesting();
+        vi.spyOn(process, 'cwd').mockImplementation(() => mockCwd);
+        vi.spyOn(fs, 'readFileSync').mockImplementation((p) => {
+            if (p === getTrustedFoldersPath()) {
+                return JSON.stringify(mockRules);
+            }
+            return '{}';
+        });
+        vi.spyOn(fs, 'existsSync').mockImplementation((p) => p === getTrustedFoldersPath());
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        // Clear the object
+        Object.keys(mockRules).forEach((key) => delete mockRules[key]);
+    });
+    it('should throw a fatal error if the config is malformed', () => {
+        mockCwd = '/home/user/projectA';
+        // This mock needs to be specific to this test to override the one in beforeEach
+        vi.spyOn(fs, 'readFileSync').mockImplementation((p) => {
+            if (p === getTrustedFoldersPath()) {
+                return '{"foo": "bar",}'; // Malformed JSON with trailing comma
+            }
+            return '{}';
+        });
+        expect(() => isWorkspaceTrusted(mockSettings)).toThrow(FatalConfigError);
+        expect(() => isWorkspaceTrusted(mockSettings)).toThrow(/Please fix the configuration file/);
+    });
+    it('should throw a fatal error if the config is not a JSON object', () => {
+        mockCwd = '/home/user/projectA';
+        vi.spyOn(fs, 'readFileSync').mockImplementation((p) => {
+            if (p === getTrustedFoldersPath()) {
+                return 'null';
+            }
+            return '{}';
+        });
+        expect(() => isWorkspaceTrusted(mockSettings)).toThrow(FatalConfigError);
+        expect(() => isWorkspaceTrusted(mockSettings)).toThrow(/not a valid JSON object/);
+    });
+    it('should return true for a directly trusted folder', () => {
+        mockCwd = '/home/user/projectA';
+        mockRules['/home/user/projectA'] = TrustLevel.TRUST_FOLDER;
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: true,
+            source: 'file',
+        });
+    });
+    it('should return true for a child of a trusted folder', () => {
+        mockCwd = '/home/user/projectA/src';
+        mockRules['/home/user/projectA'] = TrustLevel.TRUST_FOLDER;
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: true,
+            source: 'file',
+        });
+    });
+    it('should return true for a child of a trusted parent folder', () => {
+        mockCwd = '/home/user/projectB';
+        mockRules['/home/user/projectB/somefile.txt'] = TrustLevel.TRUST_PARENT;
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: true,
+            source: 'file',
+        });
+    });
+    it('should return false for a directly untrusted folder', () => {
+        mockCwd = '/home/user/untrusted';
+        mockRules['/home/user/untrusted'] = TrustLevel.DO_NOT_TRUST;
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: false,
+            source: 'file',
+        });
+    });
+    it('should return undefined for a child of an untrusted folder', () => {
+        mockCwd = '/home/user/untrusted/src';
+        mockRules['/home/user/untrusted'] = TrustLevel.DO_NOT_TRUST;
+        expect(isWorkspaceTrusted(mockSettings).isTrusted).toBeUndefined();
+    });
+    it('should return undefined when no rules match', () => {
+        mockCwd = '/home/user/other';
+        mockRules['/home/user/projectA'] = TrustLevel.TRUST_FOLDER;
+        mockRules['/home/user/untrusted'] = TrustLevel.DO_NOT_TRUST;
+        expect(isWorkspaceTrusted(mockSettings).isTrusted).toBeUndefined();
+    });
+    it('should prioritize trust over distrust', () => {
+        mockCwd = '/home/user/projectA/untrusted';
+        mockRules['/home/user/projectA'] = TrustLevel.TRUST_FOLDER;
+        mockRules['/home/user/projectA/untrusted'] = TrustLevel.DO_NOT_TRUST;
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: true,
+            source: 'file',
+        });
+    });
+    it('should handle path normalization', () => {
+        mockCwd = '/home/user/projectA';
+        mockRules[`/home/user/../user/${path.basename('/home/user/projectA')}`] =
+            TrustLevel.TRUST_FOLDER;
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: true,
+            source: 'file',
+        });
+    });
+});
+describe('isWorkspaceTrusted with IDE override', () => {
+    afterEach(() => {
+        vi.clearAllMocks();
+        ideContextStore.clear();
+        resetTrustedFoldersForTesting();
+    });
+    const mockSettings = {
+        security: {
+            folderTrust: {
+                enabled: true,
+            },
+        },
+    };
+    it('should return true when ideTrust is true, ignoring config', () => {
+        ideContextStore.set({ workspaceState: { isTrusted: true } });
+        // Even if config says don't trust, ideTrust should win.
+        vi.spyOn(fs, 'readFileSync').mockReturnValue(JSON.stringify({ [process.cwd()]: TrustLevel.DO_NOT_TRUST }));
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: true,
+            source: 'ide',
+        });
+    });
+    it('should return false when ideTrust is false, ignoring config', () => {
+        ideContextStore.set({ workspaceState: { isTrusted: false } });
+        // Even if config says trust, ideTrust should win.
+        vi.spyOn(fs, 'readFileSync').mockReturnValue(JSON.stringify({ [process.cwd()]: TrustLevel.TRUST_FOLDER }));
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: false,
+            source: 'ide',
+        });
+    });
+    it('should fall back to config when ideTrust is undefined', () => {
+        vi.spyOn(fs, 'existsSync').mockReturnValue(true);
+        vi.spyOn(fs, 'readFileSync').mockReturnValue(JSON.stringify({ [process.cwd()]: TrustLevel.TRUST_FOLDER }));
+        expect(isWorkspaceTrusted(mockSettings)).toEqual({
+            isTrusted: true,
+            source: 'file',
+        });
+    });
+    it('should always return true if folderTrust setting is disabled', () => {
+        const settings = {
+            security: {
+                folderTrust: {
+                    enabled: false,
+                },
+            },
+        };
+        ideContextStore.set({ workspaceState: { isTrusted: false } });
+        expect(isWorkspaceTrusted(settings)).toEqual({
+            isTrusted: true,
+            source: undefined,
+        });
+    });
+});
+describe('Trusted Folders Caching', () => {
+    beforeEach(() => {
+        resetTrustedFoldersForTesting();
+        vi.mocked(fs.existsSync).mockReturnValue(true);
+        vi.mocked(fs.readFileSync).mockReturnValue('{}');
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('should cache the loaded folders object', () => {
+        const readSpy = vi.spyOn(fs, 'readFileSync');
+        // First call should read the file
+        loadTrustedFolders();
+        expect(readSpy).toHaveBeenCalledTimes(1);
+        // Second call should use the cache
+        loadTrustedFolders();
+        expect(readSpy).toHaveBeenCalledTimes(1);
+        // Resetting should clear the cache
+        resetTrustedFoldersForTesting();
+        // Third call should read the file again
+        loadTrustedFolders();
+        expect(readSpy).toHaveBeenCalledTimes(2);
+    });
+});
+describe('invalid trust levels', () => {
+    const mockCwd = '/user/folder';
+    const mockRules = {};
+    beforeEach(() => {
+        resetTrustedFoldersForTesting();
+        vi.spyOn(process, 'cwd').mockImplementation(() => mockCwd);
+        vi.spyOn(fs, 'readFileSync').mockImplementation((p) => {
+            if (p === getTrustedFoldersPath()) {
+                return JSON.stringify(mockRules);
+            }
+            return '{}';
+        });
+        vi.spyOn(fs, 'existsSync').mockImplementation((p) => p === getTrustedFoldersPath());
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        // Clear the object
+        Object.keys(mockRules).forEach((key) => delete mockRules[key]);
+    });
+    it('should create a comprehensive error message for invalid trust level', () => {
+        mockRules[mockCwd] = 'INVALID_TRUST_LEVEL';
+        const { errors } = loadTrustedFolders();
+        const possibleValues = Object.values(TrustLevel).join(', ');
+        expect(errors.length).toBe(1);
+        expect(errors[0].message).toBe(`Invalid trust level "INVALID_TRUST_LEVEL" for path "${mockCwd}". Possible values are: ${possibleValues}.`);
+    });
+    it('should throw a fatal error for invalid trust level', () => {
+        const mockSettings = {
+            security: {
+                folderTrust: {
+                    enabled: true,
+                },
+            },
+        };
+        mockRules[mockCwd] = 'INVALID_TRUST_LEVEL';
+        expect(() => isWorkspaceTrusted(mockSettings)).toThrow(FatalConfigError);
+    });
+});
+//# sourceMappingURL=trustedFolders.test.js.map