@vellumai/assistant 0.6.5 → 0.6.6

package/src/permissions/approval-policy.test.ts

@@ -136,16 +136,16 @@ describe("allow rule", () => {
     expect(result.matchedRule).toBeUndefined();
   });
 
-  test("allow at High risk — containerized bash → allow (auto-allow), matchedRule present", () => {
+  test("allow at High risk — containerized bash without sandboxAutoApprove flag → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "bash",
       matchedRule: allowRule,
       isContainerized: true,
     });
-    expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("auto-allow-high-risk");
-    expect(result.matchedRule).toBe(allowRule);
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("high risk");
+    expect(result.matchedRule).toBeUndefined();
   });
 
   test("allow at High risk — non-bash tool, containerized → prompt, no matchedRule in decision", () => {
@@ -175,6 +175,113 @@ describe("allow rule", () => {
   });
 });
 
+// ── Sandbox auto-approve ─────────────────────────────────────────────────────
+
+describe("sandbox auto-approve", () => {
+  test("bash + hasSandboxAutoApprove + containerized → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("bash + hasSandboxAutoApprove + not containerized → allow (path resolution is baked in)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: false,
+    });
+    // hasSandboxAutoApprove === true means path resolution already passed upstream.
+    // The isContainerized gate was removed — sandbox auto-approve fires regardless.
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("bash + hasSandboxAutoApprove + not containerized + High risk → allow (path resolution validated upstream)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: false,
+    });
+    // Even at High risk, hasSandboxAutoApprove === true means the checker already
+    // validated that all path arguments are within the workspace root.
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("host_bash + hasSandboxAutoApprove + containerized → falls through", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "host_bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+    });
+    // host_bash is not "bash", so sandbox auto-approve doesn't fire.
+    // Falls through to risk-based: Low → allow (within default "low" threshold)
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
+
+  test("bash + no hasSandboxAutoApprove + containerized → falls through", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: false,
+      isContainerized: true,
+    });
+    // hasSandboxAutoApprove is false, so sandbox auto-approve doesn't fire.
+    // Falls through to risk-based: High → prompt
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("high risk");
+  });
+
+  test("sandbox auto-approve fires even for High risk commands", () => {
+    // e.g. rm -rf in a container — should be auto-approved
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("deny rule still blocks sandbox auto-approve commands", () => {
+    const denyRule = makeRule({ decision: "deny" });
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      matchedRule: denyRule,
+    });
+    // Deny at step 1 prevents step 3 (sandbox auto-approve)
+    expect(result.decision).toBe("deny");
+    expect(result.reason).toContain("deny rule");
+  });
+
+  test("strict mode blocks sandbox auto-approve", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      permissionsMode: "strict",
+    });
+    // Strict mode requires explicit rules — sandbox auto-approve only
+    // fires in workspace mode.
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("Strict mode");
+  });
+});
+
 // ── No rule: third-party skill tool ──────────────────────────────────────────
 
 describe("no rule — third-party skill tool", () => {
@@ -220,6 +327,44 @@ describe("no rule — third-party skill tool", () => {
     // Bundled skill + Low risk + no rule → handled by step 9 or 11
     expect(result.decision).toBe("allow");
   });
+
+  test("skill origin, not bundled, gateway threshold covers risk → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "custom_tool",
+      toolOrigin: "skill",
+      isSkillBundled: false,
+      autoApproveUpTo: "medium",
+      isGatewayThreshold: true,
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
+
+  test("skill origin, not bundled, gateway threshold does not cover risk → prompt", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "custom_tool",
+      toolOrigin: "skill",
+      isSkillBundled: false,
+      autoApproveUpTo: "medium",
+      isGatewayThreshold: true,
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("Skill tool");
+  });
+
+  test("hasManifestOverride, gateway threshold covers risk → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "unknown_tool",
+      hasManifestOverride: true,
+      autoApproveUpTo: "low",
+      isGatewayThreshold: true,
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
 });
 
 // ── No rule: strict mode ─────────────────────────────────────────────────────
@@ -266,6 +411,30 @@ describe("no rule — strict mode", () => {
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Strict mode");
   });
+
+  test("strict mode, gateway threshold covers risk → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "file_read",
+      permissionsMode: "strict",
+      autoApproveUpTo: "low",
+      isGatewayThreshold: true,
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
+
+  test("strict mode, gateway threshold does not cover risk → prompt", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Medium,
+      toolName: "file_read",
+      permissionsMode: "strict",
+      autoApproveUpTo: "low",
+      isGatewayThreshold: true,
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("Strict mode");
+  });
 });
 
 // ── No rule: workspace mode ──────────────────────────────────────────────────
@@ -305,7 +474,7 @@ describe("no rule — workspace mode", () => {
     expect(result.reason).toContain("medium risk");
   });
 
-  test("workspace mode, bash, NOT containerized, Low risk, workspace-scoped → falls through (no auto-allow for host bash)", () => {
+  test("workspace mode, bash, NOT containerized, Low risk, workspace-scoped → allow via workspace mode", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
@@ -313,10 +482,8 @@ describe("no rule — workspace mode", () => {
       isContainerized: false,
       isWorkspaceScoped: true,
     });
-    // Non-containerized bash falls through the workspace check.
-    // Then hits risk-based: Low → allow (within default "low" threshold)
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("low risk");
+    expect(result.reason).toContain("Workspace mode");
   });
 
   test("workspace mode, bash, containerized, Low risk, workspace-scoped → allow via workspace mode", () => {
@@ -474,10 +641,9 @@ describe("edge cases", () => {
     expect(result.decision).toBe("allow");
   });
 
-  test("workspace mode non-containerized bash, Low risk, workspace-scoped → low risk allow (not workspace allow)", () => {
-    // This is the subtle bash host exception. The workspace mode check
-    // specifically skips bash when not containerized, so it falls through
-    // to the risk-based path where Low risk still auto-allows.
+  test("workspace mode non-containerized bash, Low risk, workspace-scoped → workspace allow", () => {
+    // Non-containerized bash auto-allows via workspace mode like any other
+    // workspace-scoped tool when risk is Low.
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
@@ -486,10 +652,7 @@ describe("edge cases", () => {
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    // The reason should be "low risk" not "Workspace mode" — the workspace
-    // auto-allow was bypassed because bash is on the host.
-    expect(result.reason).not.toContain("Workspace mode");
-    expect(result.reason).toContain("low risk");
+    expect(result.reason).toContain("Workspace mode");
   });
 
   test("hasManifestOverride with toolOrigin set to skill — third-party check triggers on origin", () => {
@@ -618,6 +781,38 @@ describe("autoApproveUpTo threshold", () => {
     });
   });
 
+  describe('autoApproveUpTo: "high" — everything auto-allows', () => {
+    test("Low risk → allow", () => {
+      const result = evaluate({
+        riskLevel: RiskLevel.Low,
+        toolName: "some_tool",
+        autoApproveUpTo: "high",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+
+    test("Medium risk → allow", () => {
+      const result = evaluate({
+        riskLevel: RiskLevel.Medium,
+        toolName: "some_tool",
+        autoApproveUpTo: "high",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+
+    test("High risk → allow", () => {
+      const result = evaluate({
+        riskLevel: RiskLevel.High,
+        toolName: "some_tool",
+        autoApproveUpTo: "high",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+  });
+
   describe("threshold interacts correctly with rule-based decisions", () => {
     test("deny rule still denies regardless of threshold", () => {
       const denyRule = makeRule({ decision: "deny" });
@@ -631,18 +826,60 @@ describe("autoApproveUpTo threshold", () => {
       expect(result.matchedRule).toBe(denyRule);
     });
 
-    test("ask rule still prompts regardless of threshold", () => {
+    test("ask rule still prompts without gateway threshold flag", () => {
+      const askRule = makeRule({ decision: "ask" });
+      const result = evaluate({
+        riskLevel: RiskLevel.Low,
+        toolName: "bash",
+        matchedRule: askRule,
+        autoApproveUpTo: "medium",
+      });
+      expect(result.decision).toBe("prompt");
+      expect(result.matchedRule).toBe(askRule);
+    });
+
+    test("ask rule auto-approves when gateway threshold covers the risk", () => {
       const askRule = makeRule({ decision: "ask" });
       const result = evaluate({
         riskLevel: RiskLevel.Low,
         toolName: "bash",
         matchedRule: askRule,
         autoApproveUpTo: "medium",
+        isGatewayThreshold: true,
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+
+    test("ask rule still prompts when gateway threshold does not cover the risk", () => {
+      const askRule = makeRule({ decision: "ask" });
+      const result = evaluate({
+        riskLevel: RiskLevel.High,
+        toolName: "bash",
+        matchedRule: askRule,
+        autoApproveUpTo: "medium",
+        isGatewayThreshold: true,
       });
       expect(result.decision).toBe("prompt");
       expect(result.matchedRule).toBe(askRule);
     });
 
+    test("skill_load_dynamic ask rule always prompts even with gateway threshold", () => {
+      const dynamicSkillAskRule = makeRule({
+        decision: "ask",
+        pattern: "skill_load_dynamic:my-skill",
+      });
+      const result = evaluate({
+        riskLevel: RiskLevel.Low,
+        toolName: "skill_load",
+        matchedRule: dynamicSkillAskRule,
+        autoApproveUpTo: "high",
+        isGatewayThreshold: true,
+      });
+      expect(result.decision).toBe("prompt");
+      expect(result.matchedRule).toBe(dynamicSkillAskRule);
+    });
+
     test("allow rule still allows non-High regardless of threshold", () => {
       const allowRule = makeRule({ decision: "allow" });
       const result = evaluate({
@@ -727,6 +964,12 @@ describe("resolveThreshold", () => {
       expect(resolveThreshold("none", "headless")).toBe("none");
     });
 
+    test("returns high scalar for any context", () => {
+      expect(resolveThreshold("high", "conversation")).toBe("high");
+      expect(resolveThreshold("high", "background")).toBe("high");
+      expect(resolveThreshold("high", "headless")).toBe("high");
+    });
+
     test("returns scalar when executionContext is omitted", () => {
       expect(resolveThreshold("low")).toBe("low");
     });
@@ -808,12 +1051,13 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
   // This is the logic that replaces the old `riskLevel !== RiskLevel.High` check.
   function isWithinThreshold(
     riskLevel: RiskLevel,
-    bgThreshold: "none" | "low" | "medium",
+    bgThreshold: "none" | "low" | "medium" | "high",
   ): boolean {
     const thresholdOrdinal: Record<string, number> = {
       none: -1,
       low: 0,
       medium: 1,
+      high: 2,
     };
     const riskOrdinal: Record<string, number> = {
       [RiskLevel.Low]: 0,
@@ -906,7 +1150,38 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
     });
   });
 
+  describe('loosest config (background: "high") — everything auto-approves', () => {
+    test("Low risk → within threshold (auto-approve)", () => {
+      const bgThreshold = resolveThreshold(
+        { conversation: "low", background: "high", headless: "none" },
+        "background",
+      );
+      expect(bgThreshold).toBe("high");
+      expect(isWithinThreshold(RiskLevel.Low, bgThreshold)).toBe(true);
+    });
+
+    test("Medium risk → within threshold (auto-approve)", () => {
+      const bgThreshold = resolveThreshold(
+        { conversation: "low", background: "high", headless: "none" },
+        "background",
+      );
+      expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(true);
+    });
+
+    test("High risk → within threshold (auto-approve)", () => {
+      const bgThreshold = resolveThreshold(
+        { conversation: "low", background: "high", headless: "none" },
+        "background",
+      );
+      expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(true);
+    });
+  });
+
   describe("scalar config form resolves correctly for background context", () => {
+    test('scalar "high" → background resolves to high', () => {
+      expect(resolveThreshold("high", "background")).toBe("high");
+    });
+
     test('scalar "medium" → background resolves to medium', () => {
       expect(resolveThreshold("medium", "background")).toBe("medium");
     });