@zerwiz/sessrumnir 0.1.8-alpha

package/resources/permission-prompt-text.test.ts

@@ -0,0 +1,111 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { fillTemplate, loadPermissionPromptText } from './permission-prompt-text'
+
+function localesWith(files: Record<string, unknown>): string {
+  const dir = mkdtempSync(join(tmpdir(), 'pi-desktop-locales-'))
+  for (const [language, content] of Object.entries(files)) {
+    mkdirSync(join(dir, language))
+    writeFileSync(join(dir, language, 'translation.json'), JSON.stringify(content))
+  }
+  return dir
+}
+
+// A valid code with no language file (the pseudo-language has none).
+const LANGUAGE_WITHOUT_FILE = 'en-XA'
+const TEST_LANGUAGE = 'de'
+
+const ENGLISH = {
+  permissions: { prompt: { title: 'Allow {{tool}}?', body: '{{agent}} wants to run {{tool}}.', target: 'Target: {{path}}', command: 'Command: {{command}}' } },
+}
+
+const PLACEHOLDER_ONLY_TEXT = {
+  title: '{{tool}}?',
+  body: '{{agent}}: {{tool}}',
+  target: '{{path}}',
+  command: '{{command}}',
+}
+
+test('reads the chosen language', () => {
+  const dir = localesWith({ en: ENGLISH, de: { permissions: { prompt: { title: '{{tool}} erlauben?', body: 'b', target: 't', command: 'c' } } } })
+  assert.equal(loadPermissionPromptText(dir, 'de').title, '{{tool}} erlauben?')
+})
+
+test('falls back to English for each missing or empty value', () => {
+  const dir = localesWith({ en: ENGLISH, de: { permissions: { prompt: { title: '', body: '{{agent}}: {{tool}}' } } } })
+  const text = loadPermissionPromptText(dir, 'de')
+  assert.equal(text.title, 'Allow {{tool}}?')
+  assert.equal(text.body, '{{agent}}: {{tool}}')
+  assert.equal(text.command, 'Command: {{command}}')
+})
+
+test('a missing language file uses English', () => {
+  const dir = localesWith({ en: ENGLISH })
+  assert.equal(loadPermissionPromptText(dir, LANGUAGE_WITHOUT_FILE).title, 'Allow {{tool}}?')
+})
+
+test('no language (older GUI) reads English', () => {
+  const dir = localesWith({ en: ENGLISH })
+  assert.equal(loadPermissionPromptText(dir, null).title, 'Allow {{tool}}?')
+})
+
+test('no locales folder uses placeholder-only templates', () => {
+  assert.deepEqual(loadPermissionPromptText(null, 'en'), PLACEHOLDER_ONLY_TEXT)
+})
+
+test('a language code with path parts is not read', () => {
+  const dir = localesWith({ en: ENGLISH })
+  assert.equal(loadPermissionPromptText(dir, '../en').title, 'Allow {{tool}}?')
+})
+
+test('fillTemplate replaces known names and keeps $ patterns literal', () => {
+  assert.equal(fillTemplate('Run {{tool}} on {{path}}', { tool: 'bash', path: '$&' }), 'Run bash on $&')
+  assert.equal(fillTemplate('{{unknown}} stays', {}), '{{unknown}} stays')
+})
+
+// A translation that drops or mangles a required placeholder must not hide
+// what the user is approving, so it is rejected in favor of the English text.
+const COMMAND_WITHOUT_PLACEHOLDER = 'Befehl ausfuehren'
+const COMMAND_WITH_SPACED_PLACEHOLDER = 'Befehl:\n{{ command }}'
+const COMMAND_WITH_PLACEHOLDER = 'Befehl:\n{{command}}'
+
+test('a translated command missing its placeholder falls back to English', () => {
+  const dir = localesWith({ en: ENGLISH, [TEST_LANGUAGE]: { permissions: { prompt: { command: COMMAND_WITHOUT_PLACEHOLDER } } } })
+  assert.equal(loadPermissionPromptText(dir, TEST_LANGUAGE).command, ENGLISH.permissions.prompt.command)
+})
+
+test('a translated command with a malformed placeholder falls back to English', () => {
+  const dir = localesWith({ en: ENGLISH, [TEST_LANGUAGE]: { permissions: { prompt: { command: COMMAND_WITH_SPACED_PLACEHOLDER } } } })
+  assert.equal(loadPermissionPromptText(dir, TEST_LANGUAGE).command, ENGLISH.permissions.prompt.command)
+})
+
+test('a translated command that keeps its placeholder is used', () => {
+  const dir = localesWith({ en: ENGLISH, [TEST_LANGUAGE]: { permissions: { prompt: { command: COMMAND_WITH_PLACEHOLDER } } } })
+  assert.equal(loadPermissionPromptText(dir, TEST_LANGUAGE).command, COMMAND_WITH_PLACEHOLDER)
+})
+
+const SHIPPED_LOCALES_DIR = join(dirname(fileURLToPath(import.meta.url)), 'locales')
+const SHIPPED_LANGUAGE = 'en'
+const SAMPLE_TOOL = 'bash'
+const SAMPLE_AGENT = 'Pi'
+const SAMPLE_PATH = 'src/a.ts'
+const SAMPLE_COMMAND = 'ls -la'
+
+test('the shipped English prompt text matches today\'s wording', () => {
+  const text = loadPermissionPromptText(SHIPPED_LOCALES_DIR, SHIPPED_LANGUAGE)
+  assert.equal(fillTemplate(text.title, { tool: SAMPLE_TOOL }), 'Allow bash?')
+  assert.equal(fillTemplate(text.body, { agent: SAMPLE_AGENT, tool: SAMPLE_TOOL }), 'Pi wants to run the bash tool.')
+  assert.equal(fillTemplate(text.target, { path: SAMPLE_PATH }), 'Target: src/a.ts')
+  assert.equal(fillTemplate(text.command, { command: SAMPLE_COMMAND }), 'Command:\nls -la')
+})
+
+test('a corrupt English file uses placeholder-only templates', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'pi-desktop-locales-'))
+  mkdirSync(join(dir, SHIPPED_LANGUAGE))
+  writeFileSync(join(dir, SHIPPED_LANGUAGE, 'translation.json'), '{not json')
+  assert.deepEqual(loadPermissionPromptText(dir, TEST_LANGUAGE), PLACEHOLDER_ONLY_TEXT)
+})

package/resources/permission-prompt-text.ts

@@ -0,0 +1,84 @@
+/**
+ * Permission prompt text for the bundled Pi extension.
+ *
+ * The extension runs inside the Pi (or OMP) process and cannot import
+ * i18next, so this reads the app's language files directly. The GUI passes
+ * the folder and the resolved language in PI_DESKTOP_LOCALES_DIR and
+ * PI_DESKTOP_LANGUAGE.
+ *
+ * Must import only from `node:*` — no Electron, no Pi APIs.
+ */
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+export const PERMISSION_PROMPT_KEYS = ['title', 'body', 'target', 'command'] as const
+export type PermissionPromptKey = (typeof PERMISSION_PROMPT_KEYS)[number]
+export type PermissionPromptText = Record<PermissionPromptKey, string>
+
+const LOCALE_FILE_NAME = 'translation.json'
+const FALLBACK_LANGUAGE = 'en'
+// BCP 47 shape only, so a language value can never name a path outside the folder.
+const LANGUAGE_CODE = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/
+// Used when no language file can be read. No English words (the English file
+// is the single source for those), but every value the user must see to
+// decide is still shown.
+const PLACEHOLDER_TEMPLATES: PermissionPromptText = {
+  title: '{{tool}}?',
+  body: '{{agent}}: {{tool}}',
+  target: '{{path}}',
+  command: '{{command}}',
+}
+
+// Shared by fillTemplate and the placeholder check below. Never call .test()
+// or .exec() on this: a global regex keeps `lastIndex` state between calls.
+// matchAll and replace() both reset it internally, so those stay safe.
+const PLACEHOLDER_PATTERN = /\{\{(\w+)\}\}/g
+
+function placeholderNames(template: string): Set<string> {
+  return new Set(Array.from(template.matchAll(PLACEHOLDER_PATTERN), (match) => match[1]))
+}
+
+// Every placeholder the English template for a key uses is required in any
+// translation of that key, so a translation can never drop or misspell a
+// value the user must see to decide (e.g. the command being run).
+const REQUIRED_PLACEHOLDERS = Object.fromEntries(
+  PERMISSION_PROMPT_KEYS.map((key) => [key, placeholderNames(PLACEHOLDER_TEMPLATES[key])])
+) as Record<PermissionPromptKey, Set<string>>
+
+function hasRequiredPlaceholders(key: PermissionPromptKey, value: string): boolean {
+  const found = placeholderNames(value)
+  for (const name of REQUIRED_PLACEHOLDERS[key]) {
+    if (!found.has(name)) return false
+  }
+  return true
+}
+
+function readPromptSection(localesDir: string, language: string): Partial<PermissionPromptText> {
+  if (!LANGUAGE_CODE.test(language)) return {}
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(join(localesDir, language, LOCALE_FILE_NAME), 'utf-8'))
+    const section = (parsed as { permissions?: { prompt?: unknown } } | null)?.permissions?.prompt
+    if (!section || typeof section !== 'object') return {}
+    const text: Partial<PermissionPromptText> = {}
+    for (const key of PERMISSION_PROMPT_KEYS) {
+      const value = (section as Record<string, unknown>)[key]
+      if (typeof value === 'string' && value !== '' && hasRequiredPlaceholders(key, value)) text[key] = value
+    }
+    return text
+  } catch {
+    return {}
+  }
+}
+
+/** Prompt templates in `language` (null = English), with English for each missing value. */
+export function loadPermissionPromptText(localesDir: string | null, language: string | null): PermissionPromptText {
+  if (!localesDir) return { ...PLACEHOLDER_TEMPLATES }
+  const english = readPromptSection(localesDir, FALLBACK_LANGUAGE)
+  const chosen = language === null || language === FALLBACK_LANGUAGE ? {} : readPromptSection(localesDir, language)
+  return { ...PLACEHOLDER_TEMPLATES, ...english, ...chosen }
+}
+
+/** Fill {{name}} placeholders. A function replacer keeps `$&` in values literal. */
+export function fillTemplate(template: string, values: Readonly<Record<string, string>>): string {
+  return template.replace(PLACEHOLDER_PATTERN, (match, name: string) => values[name] ?? match)
+}

package/resources/permission-rules.test.ts

@@ -0,0 +1,351 @@
+import { strict as assert } from 'node:assert'
+import { describe, it, beforeEach } from 'node:test'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, utimesSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  PERMISSION_RULES_VERSION,
+  WORKSPACE_RULES_DIR_NAME,
+  validatePermissionRulesFile,
+  globToRegExp,
+  getPrimaryInput,
+  evaluateRules,
+  decideToolCall,
+  workspaceRulesPath,
+  loadEffectiveRules,
+  clearRulesCache,
+} from './permission-rules'
+
+describe('validatePermissionRulesFile', () => {
+  it('accepts a valid file and returns it typed', () => {
+    const file = validatePermissionRulesFile({
+      version: 1,
+      rules: [
+        { action: 'allow', tool: 'bash', match: 'npm test*' },
+        { action: 'deny', tool: '*' },
+      ],
+    })
+    assert.equal(file.version, PERMISSION_RULES_VERSION)
+    assert.equal(file.rules.length, 2)
+    assert.equal(file.rules[1].match, undefined)
+  })
+
+  it('accepts an empty rules array', () => {
+    assert.deepEqual(validatePermissionRulesFile({ version: 1, rules: [] }).rules, [])
+  })
+
+  it('rejects non-objects, arrays, and null', () => {
+    for (const bad of [null, 42, 'x', [], undefined]) {
+      assert.throws(() => validatePermissionRulesFile(bad), /object/)
+    }
+  })
+
+  it('rejects unknown top-level keys (typo protection)', () => {
+    assert.throws(
+      () => validatePermissionRulesFile({ version: 1, rules: [], extra: true }),
+      /unknown key "extra"/
+    )
+  })
+
+  it('rejects wrong or missing version', () => {
+    assert.throws(() => validatePermissionRulesFile({ version: 2, rules: [] }), /version/)
+    assert.throws(() => validatePermissionRulesFile({ rules: [] }), /version/)
+  })
+
+  it('rejects a rule with an unknown action', () => {
+    assert.throws(
+      () => validatePermissionRulesFile({ version: 1, rules: [{ action: 'actoin', tool: 'bash' }] }),
+      /action/
+    )
+  })
+
+  it('rejects a rule with unknown keys (typo protection)', () => {
+    assert.throws(
+      () =>
+        validatePermissionRulesFile({
+          version: 1,
+          rules: [{ action: 'deny', tool: 'bash', mach: 'rm *' }],
+        }),
+      /unknown key "mach"/
+    )
+  })
+
+  it('rejects empty or non-string tool and non-string match', () => {
+    assert.throws(() => validatePermissionRulesFile({ version: 1, rules: [{ action: 'deny', tool: '' }] }), /tool/)
+    assert.throws(() => validatePermissionRulesFile({ version: 1, rules: [{ action: 'deny', tool: 7 }] }), /tool/)
+    assert.throws(
+      () => validatePermissionRulesFile({ version: 1, rules: [{ action: 'deny', tool: 'bash', match: 3 }] }),
+      /match/
+    )
+  })
+})
+
+describe('globToRegExp', () => {
+  it('matches literal text exactly (anchored)', () => {
+    assert.ok(globToRegExp('npm test', false).test('npm test'))
+    assert.ok(!globToRegExp('npm test', false).test('npm test --watch'))
+    assert.ok(!globToRegExp('npm test', false).test('x npm test'))
+  })
+
+  it('* matches any sequence including empty, spaces, slashes, and newlines', () => {
+    assert.ok(globToRegExp('npm *', false).test('npm run build'))
+    assert.ok(globToRegExp('rm -rf *', false).test('rm -rf /'))
+    assert.ok(globToRegExp('git *', false).test('git commit -m "line1\nline2"'))
+    assert.ok(globToRegExp('a*b', false).test('ab'))
+  })
+
+  it('escapes regex metacharacters in the pattern', () => {
+    assert.ok(globToRegExp('foo.sh', false).test('foo.sh'))
+    assert.ok(!globToRegExp('foo.sh', false).test('fooXsh'))
+    assert.ok(globToRegExp('a+b (c) [d] {e} ^$ |?', false).test('a+b (c) [d] {e} ^$ |?'))
+  })
+
+  it('honors case sensitivity flag', () => {
+    assert.ok(!globToRegExp('*.env*', false).test('.ENV'))
+    assert.ok(globToRegExp('*.env*', true).test('.ENV'))
+  })
+})
+
+describe('getPrimaryInput', () => {
+  it('uses command for bash', () => {
+    assert.deepEqual(getPrimaryInput('bash', { command: 'ls -la' }), { value: 'ls -la', kind: 'command' })
+  })
+
+  it('uses path for tools with a path input', () => {
+    assert.deepEqual(getPrimaryInput('edit', { path: 'src/a.ts', old: 'x' }), { value: 'src/a.ts', kind: 'path' })
+    assert.deepEqual(getPrimaryInput('read', { path: '/etc/hosts' }), { value: '/etc/hosts', kind: 'path' })
+  })
+
+  it('falls back to JSON for anything else', () => {
+    assert.deepEqual(getPrimaryInput('fetch', { url: 'https://x' }), { value: '{"url":"https://x"}', kind: 'json' })
+    assert.deepEqual(getPrimaryInput('bash', undefined), { value: 'null', kind: 'json' })
+  })
+})
+
+describe('evaluateRules', () => {
+  const LINUX = 'linux'
+  const rules = [
+    { action: 'allow' as const, tool: 'bash', match: 'npm test*' },
+    { action: 'deny' as const, tool: 'bash', match: 'rm -rf *' },
+    { action: 'deny' as const, tool: '*', match: '*.env*' },
+    { action: 'allow' as const, tool: 'grep' },
+  ]
+
+  it('returns deny when a deny rule matches, with the matching rule', () => {
+    const result = evaluateRules(rules, 'bash', { command: 'rm -rf /tmp/x' }, LINUX)
+    assert.equal(result.decision, 'deny')
+    if (result.decision === 'deny') assert.equal(result.rule.match, 'rm -rf *')
+  })
+
+  it('deny beats allow regardless of rule order', () => {
+    const both = [
+      { action: 'allow' as const, tool: 'bash', match: 'rm *' },
+      { action: 'deny' as const, tool: 'bash', match: 'rm *' },
+    ]
+    assert.equal(evaluateRules(both, 'bash', { command: 'rm x' }, LINUX).decision, 'deny')
+    assert.equal(evaluateRules(both.slice().reverse(), 'bash', { command: 'rm x' }, LINUX).decision, 'deny')
+  })
+
+  it('returns allow when only an allow rule matches', () => {
+    assert.equal(evaluateRules(rules, 'bash', { command: 'npm test --run' }, LINUX).decision, 'allow')
+  })
+
+  it('a rule without match applies to every invocation of its tool', () => {
+    assert.equal(evaluateRules(rules, 'grep', { pattern: 'x' }, LINUX).decision, 'allow')
+  })
+
+  it('tool "*" applies the rule to every tool', () => {
+    assert.equal(evaluateRules(rules, 'write', { path: 'app/.env.local' }, LINUX).decision, 'deny')
+  })
+
+  it('returns default when nothing matches', () => {
+    assert.equal(evaluateRules(rules, 'bash', { command: 'ls' }, LINUX).decision, 'default')
+  })
+
+  it('path matching normalizes backslashes and is case-insensitive on win32/darwin', () => {
+    const pathRules = [{ action: 'deny' as const, tool: '*', match: '*/secrets/*' }]
+    assert.equal(evaluateRules(pathRules, 'read', { path: 'C:\\proj\\secrets\\k.txt' }, 'win32').decision, 'deny')
+    assert.equal(evaluateRules(pathRules, 'read', { path: 'C:\\proj\\SECRETS\\k.txt' }, 'win32').decision, 'deny')
+    assert.equal(evaluateRules(pathRules, 'read', { path: '/proj/SECRETS/k.txt' }, 'darwin').decision, 'deny')
+    assert.equal(evaluateRules(pathRules, 'read', { path: '/proj/SECRETS/k.txt' }, 'linux').decision, 'default')
+  })
+
+  it('command matching stays case-sensitive on all platforms', () => {
+    const cmdRules = [{ action: 'deny' as const, tool: 'bash', match: 'RM *' }]
+    assert.equal(evaluateRules(cmdRules, 'bash', { command: 'rm x' }, 'win32').decision, 'default')
+  })
+})
+
+describe('decideToolCall', () => {
+  const rules = [
+    { action: 'allow' as const, tool: 'bash', match: 'npm test*' },
+    { action: 'deny' as const, tool: 'bash', match: 'rm -rf *' },
+  ]
+
+  it('deny rules block in every mode, including trusted and plan-readonly', () => {
+    for (const mode of ['trusted', 'plan-readonly', 'ask-edits', 'ask-commands', undefined]) {
+      const result = decideToolCall(mode, rules, 'bash', { command: 'rm -rf /' }, 'linux')
+      assert.equal(result.action, 'block')
+      if (result.action === 'block') assert.match(result.reason, /rm -rf \*/)
+    }
+  })
+
+  it('allow rules skip the prompt in ask modes', () => {
+    assert.deepEqual(decideToolCall('ask-commands', rules, 'bash', { command: 'npm test' }, 'linux'), { action: 'allow' })
+  })
+
+  it('preserves mode defaults when no rule matches', () => {
+    assert.deepEqual(decideToolCall('ask-edits', [], 'edit', { path: 'a' }, 'linux'), { action: 'prompt' })
+    assert.deepEqual(decideToolCall('ask-edits', [], 'write', { path: 'a' }, 'linux'), { action: 'prompt' })
+    assert.deepEqual(decideToolCall('ask-edits', [], 'bash', { command: 'x' }, 'linux'), { action: 'prompt' })
+    assert.deepEqual(decideToolCall('ask-edits', [], 'read', { path: 'a' }, 'linux'), { action: 'allow' })
+    assert.deepEqual(decideToolCall('ask-commands', [], 'bash', { command: 'x' }, 'linux'), { action: 'prompt' })
+    assert.deepEqual(decideToolCall('ask-commands', [], 'edit', { path: 'a' }, 'linux'), { action: 'allow' })
+    assert.deepEqual(decideToolCall('trusted', [], 'bash', { command: 'x' }, 'linux'), { action: 'allow' })
+    assert.deepEqual(decideToolCall(undefined, [], 'bash', { command: 'x' }, 'linux'), { action: 'allow' })
+  })
+})
+
+describe('loadEffectiveRules', () => {
+  const makeTmpDir = (): string => mkdtempSync(join(tmpdir(), 'pi-perm-rules-'))
+  const writeRules = (filePath: string, rules: unknown): void => {
+    writeFileSync(filePath, JSON.stringify({ version: 1, rules }), 'utf-8')
+  }
+
+  beforeEach(() => clearRulesCache())
+
+  it('returns none when neither file exists', () => {
+    const dir = makeTmpDir()
+    try {
+      const result = loadEffectiveRules(dir, join(dir, 'nope.json'))
+      assert.deepEqual(result, { rules: [], source: 'none' })
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('loads global rules when no workspace file exists', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'permission-rules.json')
+      writeRules(globalPath, [{ action: 'deny', tool: 'bash' }])
+      const result = loadEffectiveRules(dir, globalPath)
+      assert.equal(result.source, 'global')
+      assert.equal(result.rules.length, 1)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('a trusted workspace file fully replaces global rules', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'global.json')
+      writeRules(globalPath, [{ action: 'deny', tool: 'bash' }])
+      mkdirSync(join(dir, WORKSPACE_RULES_DIR_NAME))
+      writeRules(workspaceRulesPath(dir), [{ action: 'allow', tool: 'grep' }])
+      const result = loadEffectiveRules(dir, globalPath, { workspaceTrusted: true })
+      assert.equal(result.source, 'workspace')
+      assert.deepEqual(result.rules, [{ action: 'allow', tool: 'grep' }])
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('ignores an untrusted workspace allow rule but keeps global rules', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'global.json')
+      writeRules(globalPath, [{ action: 'deny', tool: 'bash' }])
+      mkdirSync(join(dir, WORKSPACE_RULES_DIR_NAME))
+      writeRules(workspaceRulesPath(dir), [{ action: 'allow', tool: 'bash' }])
+      // Untrusted by default: the repo's allow rule must not take effect.
+      const result = loadEffectiveRules(dir, globalPath)
+      assert.deepEqual(result.rules, [{ action: 'deny', tool: 'bash' }])
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('keeps an untrusted workspace deny rule layered on top of global', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'global.json')
+      writeRules(globalPath, [{ action: 'allow', tool: 'grep' }])
+      mkdirSync(join(dir, WORKSPACE_RULES_DIR_NAME))
+      writeRules(workspaceRulesPath(dir), [
+        { action: 'deny', tool: 'bash' },
+        { action: 'allow', tool: 'edit' },
+      ])
+      const result = loadEffectiveRules(dir, globalPath)
+      // Repo deny is honored; repo allow is dropped; global rules remain.
+      assert.ok(result.rules.some((r) => r.action === 'deny' && r.tool === 'bash'))
+      assert.ok(result.rules.some((r) => r.action === 'allow' && r.tool === 'grep'))
+      assert.ok(!result.rules.some((r) => r.action === 'allow' && r.tool === 'edit'))
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('malformed global file yields no rules plus an error', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'global.json')
+      writeFileSync(globalPath, '{ not json', 'utf-8')
+      const result = loadEffectiveRules(null, globalPath)
+      assert.equal(result.source, 'global')
+      assert.deepEqual(result.rules, [])
+      assert.ok(result.error)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('malformed workspace file falls back to global rules, keeping the error', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'global.json')
+      writeRules(globalPath, [{ action: 'deny', tool: 'bash' }])
+      mkdirSync(join(dir, WORKSPACE_RULES_DIR_NAME))
+      writeFileSync(workspaceRulesPath(dir), '{ not json', 'utf-8')
+      const result = loadEffectiveRules(dir, globalPath)
+      assert.equal(result.source, 'global')
+      assert.equal(result.rules.length, 1)
+      assert.ok(result.error)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('re-reads when mtime changes and caches when it does not', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'global.json')
+      writeRules(globalPath, [{ action: 'deny', tool: 'bash' }])
+      assert.equal(loadEffectiveRules(null, globalPath).rules.length, 1)
+      writeRules(globalPath, [
+        { action: 'deny', tool: 'bash' },
+        { action: 'deny', tool: 'edit' },
+      ])
+      // Force a distinct mtime even on coarse-grained filesystems.
+      const future = new Date(Date.now() + 5000)
+      utimesSync(globalPath, future, future)
+      assert.equal(loadEffectiveRules(null, globalPath).rules.length, 2)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('file deleted after caching falls back to none', () => {
+    const dir = makeTmpDir()
+    try {
+      const globalPath = join(dir, 'global.json')
+      writeRules(globalPath, [])
+      assert.equal(loadEffectiveRules(null, globalPath).source, 'global')
+      rmSync(globalPath)
+      assert.equal(loadEffectiveRules(null, globalPath).source, 'none')
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+})