progmune-runtime 3.3.8 → 3.4.1

package/dist/agent-perception.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * Phase 12: Agent 感知层 (P2)
+ *
+ * 为 agent loop 提供"看清世界"的能力（设计文档 P2）：
+ *   - GitContext     — 仓库扫描 + git 上下文（分支/最近提交/变更文件/源文件清单）
+ *   - extractIRWithDelta — IR 提取 + 前后函数名差集（IR 增量重提的观测面）
+ *   - RepoWatcher    — 文件变更监听（fs.watch + 防抖）→ 触发 IR 重提回调
+ *
+ * 原则：感知失败不阻塞主循环（best-effort，明确记录 unavailable）。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RepoWatcher = void 0;
+exports.collectGitContext = collectGitContext;
+exports.extractIRWithDelta = extractIRWithDelta;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const extract_ir_1 = require("./extract-ir");
+// ── Git Context ──
+function git(projectPath, args) {
+    return (0, child_process_1.execSync)(`git -C "${projectPath}" ${args}`, {
+        encoding: "utf-8",
+        timeout: 10000,
+        stdio: "pipe",
+    });
+}
+/** 收集仓库上下文（分支、最近提交、变更文件）与源文件清单。best-effort。 */
+function collectGitContext(projectPath) {
+    try {
+        const branch = git(projectPath, "rev-parse --abbrev-ref HEAD").trim();
+        const recentCommits = git(projectPath, "log --oneline -5")
+            .split("\n").filter(Boolean);
+        // porcelain 输出首字符可能是空格（未暂存），必须整串不 trim 才能保住 3 字符状态列
+        const changedFiles = git(projectPath, "status --porcelain")
+            .split("\n").filter(Boolean).map((l) => l.slice(3).trim());
+        const sourceFiles = listSourceFiles(projectPath);
+        return { available: true, branch, recentCommits, changedFiles, sourceFiles };
+    }
+    catch (e) {
+        // 非 git 仓库等 → 只给源文件清单
+        try {
+            return {
+                available: false,
+                branch: "",
+                recentCommits: [],
+                changedFiles: [],
+                sourceFiles: listSourceFiles(projectPath),
+                error: e?.message || String(e),
+            };
+        }
+        catch {
+            return { available: false, branch: "", recentCommits: [], changedFiles: [], sourceFiles: [], error: e?.message || String(e) };
+        }
+    }
+}
+/** 浅层扫描项目源文件（不递归进依赖目录）。 */
+function listSourceFiles(projectPath) {
+    const SKIP_DIRS = new Set(["node_modules", "dist", "build", ".git", ".progmune_corpus", "__pycache__", "venv", ".venv"]);
+    const EXTS = new Set([".ts", ".js", ".py", ".tsx", ".jsx"]);
+    const out = [];
+    const stack = [projectPath];
+    const seen = new Set();
+    while (stack.length > 0 && out.length < 500) {
+        const dir = stack.pop();
+        if (seen.has(dir))
+            continue;
+        seen.add(dir);
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (!SKIP_DIRS.has(e.name) && !e.name.startsWith("."))
+                    stack.push(full);
+            }
+            else if (EXTS.has(path.extname(e.name))) {
+                out.push(path.relative(projectPath, full));
+            }
+        }
+    }
+    return out.sort();
+}
+// ── IR 增量 ──
+/**
+ * 提取 IR 并计算与上次函数名集合的差集。
+ * prevNames 缺省时只返回全量 IR（delta 为空）。
+ */
+function extractIRWithDelta(projectPath, prevNames) {
+    const ir = (0, extract_ir_1.extractIR)(projectPath);
+    const names = ir.map((f) => String(f.name || "")).filter(Boolean);
+    if (!prevNames) {
+        return { ir, delta: { added: [], removed: [], functionCount: names.length } };
+    }
+    const cur = new Set(names);
+    const added = names.filter((n) => !prevNames.has(n));
+    const removed = [...prevNames].filter((n) => !cur.has(n));
+    return { ir, delta: { added, removed, functionCount: names.length } };
+}
+// ── Repo Watcher ──
+const WATCH_EXTS = new Set([".ts", ".js", ".py", ".tsx", ".jsx"]);
+/**
+ * 文件变更监听器：fs.watch 递归监听项目目录，按文件防抖后回调。
+ * 用途：agent 或用户修改文件后触发 IR 增量重提（IR_STALE 消费方）。
+ */
+class RepoWatcher {
+    constructor(projectPath, onChange, debounceMs = 500) {
+        this.projectPath = projectPath;
+        this.onChange = onChange;
+        this.debounceMs = debounceMs;
+        this.watcher = null;
+        this.timers = new Map();
+    }
+    start() {
+        if (this.watcher)
+            return;
+        try {
+            this.watcher = fs.watch(this.projectPath, { recursive: true }, (event, filename) => {
+                if (!filename)
+                    return;
+                const ext = path.extname(String(filename));
+                if (!WATCH_EXTS.has(ext))
+                    return;
+                const rel = path.relative(this.projectPath, path.join(this.projectPath, String(filename)));
+                // 防抖：同一文件的连续事件合并
+                const prev = this.timers.get(rel);
+                if (prev)
+                    clearTimeout(prev);
+                this.timers.set(rel, setTimeout(() => {
+                    this.timers.delete(rel);
+                    try {
+                        this.onChange(rel);
+                    }
+                    catch { /* 回调异常不杀死 watcher */ }
+                }, this.debounceMs));
+            });
+            this.watcher.on("error", () => { });
+        }
+        catch {
+            this.watcher = null; // recursive 不支持时降级为不可用
+        }
+    }
+    stop() {
+        for (const t of this.timers.values())
+            clearTimeout(t);
+        this.timers.clear();
+        if (this.watcher) {
+            try {
+                this.watcher.close();
+            }
+            catch { /* ignore */ }
+            this.watcher = null;
+        }
+    }
+    get active() {
+        return this.watcher !== null;
+    }
+}
+exports.RepoWatcher = RepoWatcher;

package/dist/agent-perception.test.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Phase 12: 感知层测试 (P2)
+ *
+ * collectGitContext / extractIRWithDelta：mock git 与 IR，不触真实仓库。
+ * RepoWatcher：真实临时目录（fs.watch 需要真实文件系统）。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const child_process_1 = require("child_process");
+const extract_ir_1 = require("./extract-ir");
+const agent_perception_1 = require("./agent-perception");
+vitest_1.vi.mock("child_process", () => ({
+    execSync: vitest_1.vi.fn(),
+}));
+vitest_1.vi.mock("./extract-ir", () => ({
+    extractIR: vitest_1.vi.fn(),
+}));
+const mockExecSync = vitest_1.vi.mocked(child_process_1.execSync);
+const mockExtractIR = vitest_1.vi.mocked(extract_ir_1.extractIR);
+(0, vitest_1.beforeEach)(() => {
+    vitest_1.vi.clearAllMocks();
+});
+(0, vitest_1.describe)("agent-perception", () => {
+    (0, vitest_1.it)("collectGitContext 解析分支/提交/变更文件/源文件清单", () => {
+        mockExecSync.mockImplementation((cmd) => {
+            const c = String(cmd);
+            if (c.includes("rev-parse"))
+                return "main";
+            if (c.includes("log --oneline"))
+                return "abc123 feat: login\nbcd456 fix: session";
+            if (c.includes("status --porcelain"))
+                return " M src/auth.ts\n?? src/new.ts";
+            throw new Error("unexpected cmd: " + c);
+        });
+        const ctx = (0, agent_perception_1.collectGitContext)("/tmp/fake-project");
+        (0, vitest_1.expect)(ctx.available).toBe(true);
+        (0, vitest_1.expect)(ctx.branch).toBe("main");
+        (0, vitest_1.expect)(ctx.recentCommits).toHaveLength(2);
+        (0, vitest_1.expect)(ctx.changedFiles).toEqual(["src/auth.ts", "src/new.ts"]);
+        (0, vitest_1.expect)(ctx.sourceFiles.length).toBeGreaterThanOrEqual(0);
+    });
+    (0, vitest_1.it)("collectGitContext 非 git 仓库时降级为 available=false 且不抛", () => {
+        mockExecSync.mockImplementation(() => {
+            throw new Error("fatal: not a git repository");
+        });
+        const ctx = (0, agent_perception_1.collectGitContext)("/tmp/fake-project");
+        (0, vitest_1.expect)(ctx.available).toBe(false);
+        (0, vitest_1.expect)(ctx.error).toContain("not a git repository");
+    });
+    (0, vitest_1.it)("extractIRWithDelta 计算新增/消失函数差集", () => {
+        mockExtractIR.mockReturnValue([
+            { name: "verify_password" },
+            { name: "main" },
+        ]);
+        const prev = new Set(["verify_password", "logout"]);
+        const { delta } = (0, agent_perception_1.extractIRWithDelta)("/tmp/fake-project", prev);
+        (0, vitest_1.expect)(delta.added).toEqual(["main"]);
+        (0, vitest_1.expect)(delta.removed).toEqual(["logout"]);
+        (0, vitest_1.expect)(delta.functionCount).toBe(2);
+    });
+    (0, vitest_1.it)("RepoWatcher 文件变更防抖回调", async () => {
+        const fs = await Promise.resolve().then(() => __importStar(require("fs")));
+        const os = await Promise.resolve().then(() => __importStar(require("os")));
+        const path = await Promise.resolve().then(() => __importStar(require("path")));
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-watch-"));
+        const changed = [];
+        const w = new agent_perception_1.RepoWatcher(dir, (f) => changed.push(f), 50);
+        w.start();
+        // 等待 watcher 就绪后写文件
+        await new Promise((r) => setTimeout(r, 100));
+        fs.writeFileSync(path.join(dir, "new.ts"), "export function f() {}");
+        await new Promise((r) => setTimeout(r, 300));
+        w.stop();
+        (0, vitest_1.expect)(changed).toContain("new.ts");
+        (0, vitest_1.expect)(w.active).toBe(false);
+    });
+    (0, vitest_1.it)("RepoWatcher 忽略非源文件扩展名", async () => {
+        const fs = await Promise.resolve().then(() => __importStar(require("fs")));
+        const os = await Promise.resolve().then(() => __importStar(require("os")));
+        const path = await Promise.resolve().then(() => __importStar(require("path")));
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-watch2-"));
+        const changed = [];
+        const w = new agent_perception_1.RepoWatcher(dir, (f) => changed.push(f), 50);
+        w.start();
+        await new Promise((r) => setTimeout(r, 100));
+        fs.writeFileSync(path.join(dir, "notes.txt"), "hello");
+        await new Promise((r) => setTimeout(r, 300));
+        w.stop();
+        (0, vitest_1.expect)(changed).toHaveLength(0);
+    });
+});

package/dist/agent-permissions.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Phase 12: Agent 操作级安全层 (P5 v1) —— 沙箱 + 审批门
+ *
+ * 设计文档 P5 决策结果：DSH（deepseek-harness）不可验证/不存在，
+ * 按「独立立项」自建最小可用集：
+ *
+ *   读（read）   → 自动
+ *   写（write）  → 必须经验证门（execute 的 8 门 + 编译/指纹；巡逻报告走 FsSandbox 白名单）
+ *   跑 shell（exec）    → 审批门（交互确认或 --yes）
+ *   提交（commit）      → 审批门（本版默认拒绝，需显式 --approve-commit）
+ *
+ * 修复信任悖论：自动修复/自动合并 = 永不（autoApplied 恒 false，由 agent-patrol 保证）。
+ * 每次权限决策产出审计事件，供 loop/patrol 审计轨迹复用。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRESET_AGENT = exports.PRESET_PATROL = void 0;
+exports.checkSandboxWrite = checkSandboxWrite;
+exports.decidePermission = decidePermission;
+exports.interactiveConfirm = interactiveConfirm;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ── Presets ──
+exports.PRESET_PATROL = {
+    read: "auto",
+    write: "sandbox", // 只允许 .progmune_* 报告文件
+    exec: "deny", // 巡逻不执行 shell
+    commit: "deny",
+};
+exports.PRESET_AGENT = {
+    read: "auto",
+    // 写文件的安全由 execute 内置验证门保证（8 门 + SSG + 编译/指纹，免疫门在环内）——
+    // 权限层不重复设门，避免双重审批拖垮自主循环。
+    write: "auto",
+    exec: "approve", // 跑测试等 shell 操作需审批（--yes 或交互确认）
+    commit: "deny", // P5 v1 不自动 commit
+};
+function presetOf(name) {
+    return name === "patrol" ? exports.PRESET_PATROL : exports.PRESET_AGENT;
+}
+// ── FsSandbox ──
+/** 巡逻报告等产品文件白名单（相对项目根） */
+const SANDBOX_ALLOWED_FILES = new Set([".progmune_patrol_report.md", ".progmune_patrol_report.json"]);
+/** 判断目标路径是否在项目目录内。 */
+function isInsideProject(projectPath, target) {
+    const absProject = path.resolve(projectPath);
+    const absTarget = path.resolve(target);
+    return absTarget === absProject || absTarget.startsWith(absProject + path.sep);
+}
+/**
+ * 沙箱写判定：仅允许项目内 + 白名单文件。
+ */
+function checkSandboxWrite(ctx) {
+    const absProject = path.resolve(ctx.projectPath);
+    const rel = path.relative(absProject, path.resolve(ctx.target));
+    const allowed = isInsideProject(absProject, ctx.target) && SANDBOX_ALLOWED_FILES.has(rel.replace(/\\/g, "/"));
+    return {
+        allowed,
+        level: "write",
+        detail: allowed
+            ? `sandbox: 项目内白名单文件 ${rel}`
+            : `sandbox: 拒绝写入 ${rel}（不在白名单或超出项目边界）`,
+        audit: { event: "permission:sandbox", detail: allowed ? `allow write ${rel}` : `deny write ${rel}` },
+    };
+}
+// ── Decision Engine ──
+/**
+ * 按预设判定一次操作。规则：
+ *   auto    → 允许
+ *   sandbox → FsSandbox 白名单判定
+ *   approve → 审批门（preApproved 或交互确认）
+ *   deny    → 拒绝
+ */
+function decidePermission(preset, ctx, confirmFn) {
+    const mode = presetOf(preset)[ctx.level];
+    if (mode === "auto") {
+        return {
+            allowed: true,
+            level: ctx.level,
+            detail: `auto: ${ctx.level} ${ctx.target}`,
+            audit: { event: "permission:auto", detail: `${ctx.level} ${ctx.target}` },
+        };
+    }
+    if (mode === "sandbox") {
+        return checkSandboxWrite(ctx);
+    }
+    if (mode === "approve") {
+        const prompt = `审批请求: ${ctx.level} → ${ctx.target}`;
+        const approved = ctx.preApproved === true || (confirmFn ? confirmFn(prompt) : false);
+        return {
+            allowed: approved,
+            level: ctx.level,
+            detail: approved ? `approve: ${ctx.level} ${ctx.target}` : `审批未通过: ${ctx.level} ${ctx.target}`,
+            audit: { event: "permission:approve", detail: approved ? `approved ${ctx.level} ${ctx.target}` : `denied ${ctx.level} ${ctx.target}` },
+        };
+    }
+    return {
+        allowed: false,
+        level: ctx.level,
+        detail: `deny: ${ctx.level} ${ctx.target}（P5 v1 默认拒绝，需显式升级预设）`,
+        audit: { event: "permission:deny", detail: `${ctx.level} ${ctx.target}` },
+    };
+}
+// ── Interactive confirm (TTY) ──
+/** 交互确认：读 stdin 一行，y/yes 为同意。无 TTY 时返回 false。 */
+function interactiveConfirm(prompt) {
+    if (!process.stdin.isTTY)
+        return false;
+    const fd = fs.openSync("/dev/tty", "r"); // 直读 tty，绕过管道 stdin
+    try {
+        process.stdout.write(`${prompt} [y/N] `);
+        const buf = Buffer.alloc(16);
+        const n = fs.readSync(fd, buf, 0, 16, null);
+        const answer = buf.toString("utf-8", 0, n).trim().toLowerCase();
+        return answer === "y" || answer === "yes";
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch { /* ignore */ }
+    }
+}

package/dist/agent-permissions.test.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Phase 12: 操作级安全层测试 (P5 v1)
+ *
+ * 预设判定 / FsSandbox 白名单 / 审批门 / deny 默认——全部纯函数，不触真实 FS。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const agent_permissions_1 = require("./agent-permissions");
+(0, vitest_1.describe)("agent-permissions", () => {
+    (0, vitest_1.it)("auto 操作直接允许（读、agent 写）", () => {
+        const read = (0, agent_permissions_1.decidePermission)("patrol", { level: "read", target: "src/auth.ts", projectPath: "/p" });
+        (0, vitest_1.expect)(read.allowed).toBe(true);
+        (0, vitest_1.expect)(read.audit.event).toBe("permission:auto");
+        // agent 预设：写 = auto（安全由 execute 验证门保证）
+        const write = (0, agent_permissions_1.decidePermission)("agent", { level: "write", target: "out.ts", projectPath: "/p" });
+        (0, vitest_1.expect)(write.allowed).toBe(true);
+    });
+    (0, vitest_1.it)("sandbox 写：白名单内项目文件允许，越界或非白名单拒绝", () => {
+        const ok = (0, agent_permissions_1.checkSandboxWrite)({
+            level: "write",
+            target: "/p/.progmune_patrol_report.md",
+            projectPath: "/p",
+        });
+        (0, vitest_1.expect)(ok.allowed).toBe(true);
+        const outside = (0, agent_permissions_1.checkSandboxWrite)({
+            level: "write",
+            target: "/etc/passwd",
+            projectPath: "/p",
+        });
+        (0, vitest_1.expect)(outside.allowed).toBe(false);
+        (0, vitest_1.expect)(outside.detail).toContain("拒绝");
+        const notWhitelisted = (0, agent_permissions_1.checkSandboxWrite)({
+            level: "write",
+            target: "/p/src/auth.ts",
+            projectPath: "/p",
+        });
+        (0, vitest_1.expect)(notWhitelisted.allowed).toBe(false);
+    });
+    (0, vitest_1.it)("审批门：preApproved 或 confirmFn 同意才放行", () => {
+        const denied = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "npm test", projectPath: "/p" });
+        (0, vitest_1.expect)(denied.allowed).toBe(false);
+        (0, vitest_1.expect)(denied.audit.event).toBe("permission:approve");
+        const approved = (0, agent_permissions_1.decidePermission)("agent", {
+            level: "exec", target: "npm test", projectPath: "/p", preApproved: true,
+        });
+        (0, vitest_1.expect)(approved.allowed).toBe(true);
+        const confirmed = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "npm test", projectPath: "/p" }, () => true);
+        (0, vitest_1.expect)(confirmed.allowed).toBe(true);
+        const rejected = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "npm test", projectPath: "/p" }, () => false);
+        (0, vitest_1.expect)(rejected.allowed).toBe(false);
+    });
+    (0, vitest_1.it)("deny 默认：巡逻 exec/commit 与 agent commit 一律拒绝（修复信任悖论）", () => {
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("patrol", { level: "exec", target: "tsc", projectPath: "/p" }).allowed).toBe(false);
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("patrol", { level: "commit", target: "git commit", projectPath: "/p" }).allowed).toBe(false);
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("agent", { level: "commit", target: "git commit", projectPath: "/p" }).allowed).toBe(false);
+        // 即使 --yes 也不能绕过 deny
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("agent", {
+            level: "commit", target: "git commit", projectPath: "/p", preApproved: true,
+        }).allowed).toBe(false);
+    });
+    (0, vitest_1.it)("预设表结构完整（四种级别齐全）", () => {
+        const levels = ["read", "write", "exec", "commit"];
+        for (const l of levels) {
+            (0, vitest_1.expect)(agent_permissions_1.PRESET_PATROL[l]).toBeDefined();
+            (0, vitest_1.expect)(agent_permissions_1.PRESET_AGENT[l]).toBeDefined();
+        }
+        // 修复信任悖论：两个预设的 commit 都不可自动放行
+        (0, vitest_1.expect)(agent_permissions_1.PRESET_PATROL.commit).toBe("deny");
+        (0, vitest_1.expect)(agent_permissions_1.PRESET_AGENT.commit).toBe("deny");
+    });
+    (0, vitest_1.it)("审批未通过时审计事件带 denied 标记", () => {
+        const d = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "pytest", projectPath: "/p" });
+        (0, vitest_1.expect)(d.audit.detail).toContain("denied");
+    });
+});