tmux-team 2.0.0-alpha.1 → 2.0.0-alpha.4

package/src/pm/commands.ts

@@ -5,6 +5,12 @@
 import type { Context } from '../types.js';
 import { ExitCodes } from '../exits.js';
 import { colors } from '../ui.js';
+import {
+  checkPermission,
+  buildPermissionPath,
+  PermissionChecks,
+  type PermissionCheck,
+} from './permissions.js';
 import {
   findCurrentTeamId,
   getStorageAdapter,
@@ -62,11 +68,28 @@ function parseStatus(s: string): TaskStatus {
   throw new Error(`Invalid status: ${s}. Use: pending, in_progress, done`);
 }
 
+function requirePermission(ctx: Context, check: PermissionCheck): void {
+  const result = checkPermission(ctx.config, check);
+
+  // Display warning if there's an identity conflict
+  if (result.warning) {
+    ctx.ui.warn(result.warning);
+  }
+
+  if (!result.allowed) {
+    const permPath = buildPermissionPath(check);
+    ctx.ui.error(`Permission denied: ${result.actor} cannot perform ${permPath}`);
+    ctx.exit(ExitCodes.ERROR);
+  }
+}
+
 // ─────────────────────────────────────────────────────────────
 // Commands
 // ─────────────────────────────────────────────────────────────
 
 export async function cmdPmInit(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.teamCreate());
+
   const { ui, flags, paths } = ctx;
 
   // Parse flags: --name, --backend, --repo
@@ -157,6 +180,8 @@ export async function cmdPmMilestone(ctx: Context, args: string[]): Promise<void
 }
 
 async function cmdMilestoneAdd(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.milestoneCreate());
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
@@ -184,6 +209,8 @@ async function cmdMilestoneAdd(ctx: Context, args: string[]): Promise<void> {
 }
 
 async function cmdMilestoneList(ctx: Context, _args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.milestoneList());
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
@@ -208,6 +235,8 @@ async function cmdMilestoneList(ctx: Context, _args: string[]): Promise<void> {
 }
 
 async function cmdMilestoneDone(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.milestoneUpdate(['status']));
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
@@ -264,11 +293,14 @@ export async function cmdPmTask(ctx: Context, args: string[]): Promise<void> {
 }
 
 async function cmdTaskAdd(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.taskCreate());
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
-  // Parse args: <title> [--milestone <id>] [--assignee <name>]
+  // Parse args: <title> [--milestone <id>] [--assignee <name>] [--body <text>]
   let title = '';
+  let body: string | undefined;
   let milestone: string | undefined;
   let assignee: string | undefined;
 
@@ -281,6 +313,10 @@ async function cmdTaskAdd(ctx: Context, args: string[]): Promise<void> {
       assignee = args[++i];
     } else if (args[i].startsWith('--assignee=')) {
       assignee = args[i].slice(11);
+    } else if (args[i] === '--body' || args[i] === '-b') {
+      body = args[++i];
+    } else if (args[i].startsWith('--body=')) {
+      body = args[i].slice(7);
     } else if (!title) {
       title = args[i];
     }
@@ -291,7 +327,7 @@ async function cmdTaskAdd(ctx: Context, args: string[]): Promise<void> {
     ctx.exit(ExitCodes.ERROR);
   }
 
-  const task = await storage.createTask({ title, milestone, assignee });
+  const task = await storage.createTask({ title, body, milestone, assignee });
 
   await storage.appendEvent({
     event: 'task_created',
@@ -310,6 +346,8 @@ async function cmdTaskAdd(ctx: Context, args: string[]): Promise<void> {
 }
 
 async function cmdTaskList(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.taskList());
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
@@ -350,6 +388,8 @@ async function cmdTaskList(ctx: Context, args: string[]): Promise<void> {
 }
 
 async function cmdTaskShow(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.taskShow());
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
@@ -382,7 +422,6 @@ async function cmdTaskShow(ctx: Context, args: string[]): Promise<void> {
 
 async function cmdTaskUpdate(ctx: Context, args: string[]): Promise<void> {
   const { ui, flags } = ctx;
-  const { storage } = await requireTeam(ctx);
 
   // Parse: <id> --status <status> [--assignee <name>]
   const id = args[0];
@@ -406,6 +445,15 @@ async function cmdTaskUpdate(ctx: Context, args: string[]): Promise<void> {
     }
   }
 
+  // Check permissions based on which fields are being updated
+  const fields: string[] = [];
+  if (status) fields.push('status');
+  if (assignee) fields.push('assignee');
+  if (fields.length > 0) {
+    requirePermission(ctx, PermissionChecks.taskUpdate(fields));
+  }
+
+  const { storage } = await requireTeam(ctx);
   const task = await storage.getTask(id);
   if (!task) {
     ui.error(`Task ${id} not found`);
@@ -443,6 +491,8 @@ async function cmdTaskUpdate(ctx: Context, args: string[]): Promise<void> {
 }
 
 async function cmdTaskDone(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.taskUpdate(['status']));
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
@@ -479,7 +529,6 @@ async function cmdTaskDone(ctx: Context, args: string[]): Promise<void> {
 
 export async function cmdPmDoc(ctx: Context, args: string[]): Promise<void> {
   const { ui, flags } = ctx;
-  const { teamId, storage } = await requireTeam(ctx);
 
   const id = args[0];
   if (!id) {
@@ -487,13 +536,22 @@ export async function cmdPmDoc(ctx: Context, args: string[]): Promise<void> {
     ctx.exit(ExitCodes.ERROR);
   }
 
+  const printOnly = args.includes('--print') || args.includes('-p');
+
+  // Check permission based on mode
+  if (printOnly || flags.json) {
+    requirePermission(ctx, PermissionChecks.docRead());
+  } else {
+    requirePermission(ctx, PermissionChecks.docUpdate());
+  }
+
+  const { teamId, storage } = await requireTeam(ctx);
   const task = await storage.getTask(id);
   if (!task) {
     ui.error(`Task ${id} not found`);
     ctx.exit(ExitCodes.PANE_NOT_FOUND);
   }
 
-  const printOnly = args.includes('--print') || args.includes('-p');
   const doc = await storage.getTaskDoc(id);
 
   if (printOnly || flags.json) {
@@ -516,6 +574,8 @@ export async function cmdPmDoc(ctx: Context, args: string[]): Promise<void> {
 }
 
 export async function cmdPmLog(ctx: Context, args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.logRead());
+
   const { ui, flags } = ctx;
   const { storage } = await requireTeam(ctx);
 
@@ -553,12 +613,15 @@ export async function cmdPmLog(ctx: Context, args: string[]): Promise<void> {
 }
 
 export async function cmdPmList(ctx: Context, _args: string[]): Promise<void> {
+  requirePermission(ctx, PermissionChecks.teamList());
+
   const { ui, flags, paths } = ctx;
 
   const teams = listTeams(paths.globalDir);
+  const currentTeamId = findCurrentTeamId(process.cwd(), paths.globalDir);
 
   if (flags.json) {
-    ui.json(teams);
+    ui.json({ teams, currentTeamId });
     return;
   }
 
@@ -569,8 +632,14 @@ export async function cmdPmList(ctx: Context, _args: string[]): Promise<void> {
 
   console.log();
   ui.table(
-    ['ID', 'NAME', 'CREATED'],
-    teams.map((t) => [t.id.slice(0, 8) + '...', t.name, t.createdAt.slice(0, 10)])
+    ['', 'ID', 'NAME', 'BACKEND', 'CREATED'],
+    teams.map((t) => [
+      t.id === currentTeamId ? colors.green('→') : ' ',
+      t.id.slice(0, 8) + '...',
+      t.name,
+      t.backend === 'github' ? colors.cyan('github') : colors.dim('fs'),
+      t.createdAt.slice(0, 10),
+    ])
   );
   console.log();
 }

package/src/pm/manager.ts

@@ -8,7 +8,7 @@ import crypto from 'crypto';
 import type { StorageAdapter } from './storage/adapter.js';
 import { createFSAdapter } from './storage/fs.js';
 import { createGitHubAdapter } from './storage/github.js';
-import type { Team, TeamConfig, StorageBackend } from './types.js';
+import type { Team, TeamConfig, TeamWithConfig, StorageBackend } from './types.js';
 
 /**
  * Resolve the teams directory from global config path.
@@ -107,21 +107,27 @@ export function generateTeamId(): string {
 }
 
 /**
- * List all teams.
+ * List all teams with their backend config.
  */
-export function listTeams(globalDir: string): Team[] {
+export function listTeams(globalDir: string): TeamWithConfig[] {
   const teamsDir = getTeamsDir(globalDir);
   if (!fs.existsSync(teamsDir)) return [];
 
-  const teams: Team[] = [];
+  const teams: TeamWithConfig[] = [];
   const dirs = fs.readdirSync(teamsDir);
 
   for (const dir of dirs) {
-    const teamFile = path.join(teamsDir, dir, 'team.json');
+    const teamDir = path.join(teamsDir, dir);
+    const teamFile = path.join(teamDir, 'team.json');
     if (fs.existsSync(teamFile)) {
       try {
         const team = JSON.parse(fs.readFileSync(teamFile, 'utf-8')) as Team;
-        teams.push(team);
+        const config = getTeamConfig(teamDir);
+        teams.push({
+          ...team,
+          backend: config?.backend || 'fs',
+          repo: config?.repo,
+        });
       } catch {
         // Skip malformed team files
       }

package/src/pm/permissions.test.ts

@@ -0,0 +1,332 @@
+// ─────────────────────────────────────────────────────────────
+// Permission System Tests
+// ─────────────────────────────────────────────────────────────
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+  buildPermissionPath,
+  checkPermission,
+  getCurrentActor,
+  resolveActor,
+  PermissionChecks,
+} from './permissions.js';
+import type { ResolvedConfig } from '../types.js';
+
+function createMockConfig(agents: Record<string, { deny?: string[] }>): ResolvedConfig {
+  return {
+    mode: 'polling',
+    preambleMode: 'always',
+    defaults: { timeout: 60, pollInterval: 1, captureLines: 100 },
+    agents,
+    paneRegistry: {},
+  };
+}
+
+describe('buildPermissionPath', () => {
+  it('builds path without fields', () => {
+    expect(buildPermissionPath({ resource: 'task', action: 'list', fields: [] })).toBe(
+      'pm:task:list'
+    );
+  });
+
+  it('builds path with single field', () => {
+    expect(buildPermissionPath({ resource: 'task', action: 'update', fields: ['status'] })).toBe(
+      'pm:task:update(status)'
+    );
+  });
+
+  it('builds path with multiple fields sorted alphabetically', () => {
+    expect(
+      buildPermissionPath({ resource: 'task', action: 'update', fields: ['status', 'assignee'] })
+    ).toBe('pm:task:update(assignee,status)');
+  });
+
+  it('builds path with fields already sorted', () => {
+    expect(
+      buildPermissionPath({ resource: 'task', action: 'update', fields: ['assignee', 'status'] })
+    ).toBe('pm:task:update(assignee,status)');
+  });
+});
+
+describe('getCurrentActor', () => {
+  const originalEnv = { ...process.env };
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  it('returns TMT_AGENT_NAME if set', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+    delete process.env.TMUX_TEAM_ACTOR;
+    expect(getCurrentActor()).toBe('codex');
+  });
+
+  it('returns TMUX_TEAM_ACTOR if TMT_AGENT_NAME not set', () => {
+    delete process.env.TMT_AGENT_NAME;
+    process.env.TMUX_TEAM_ACTOR = 'gemini';
+    expect(getCurrentActor()).toBe('gemini');
+  });
+
+  it('returns human if no env vars set', () => {
+    delete process.env.TMT_AGENT_NAME;
+    delete process.env.TMUX_TEAM_ACTOR;
+    expect(getCurrentActor()).toBe('human');
+  });
+
+  it('prefers TMT_AGENT_NAME over TMUX_TEAM_ACTOR', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+    process.env.TMUX_TEAM_ACTOR = 'gemini';
+    expect(getCurrentActor()).toBe('codex');
+  });
+});
+
+describe('checkPermission', () => {
+  const originalEnv = { ...process.env };
+
+  beforeEach(() => {
+    process.env = { ...originalEnv };
+    // Disable pane detection in tests by unsetting TMUX
+    delete process.env.TMUX;
+  });
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  it('allows everything for human actor', () => {
+    delete process.env.TMT_AGENT_NAME;
+    delete process.env.TMUX_TEAM_ACTOR;
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(status)'] },
+    });
+
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['status'])).allowed).toBe(true);
+  });
+
+  it('allows when no deny patterns for agent', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: {}, // No deny patterns
+    });
+
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['status'])).allowed).toBe(true);
+  });
+
+  it('allows when agent not in config', () => {
+    process.env.TMT_AGENT_NAME = 'unknown-agent';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(status)'] },
+    });
+
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['status'])).allowed).toBe(true);
+  });
+
+  it('denies when pattern matches exactly', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(status)'] },
+    });
+
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['status'])).allowed).toBe(false);
+  });
+
+  it('denies when pattern matches any field', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(status)'] },
+    });
+
+    // Using both status and assignee, should still be denied because status is in deny list
+    expect(
+      checkPermission(config, PermissionChecks.taskUpdate(['status', 'assignee'])).allowed
+    ).toBe(false);
+  });
+
+  it('allows when fields do not match', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(status)'] },
+    });
+
+    // Only updating assignee, not status
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['assignee'])).allowed).toBe(true);
+  });
+
+  it('denies entire action when pattern has no fields', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update'] },
+    });
+
+    // Any update should be denied
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['status'])).allowed).toBe(false);
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['assignee'])).allowed).toBe(false);
+    expect(checkPermission(config, PermissionChecks.taskUpdate([])).allowed).toBe(false);
+  });
+
+  it('denies when wildcard pattern matches any field', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(*)'] },
+    });
+
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['status'])).allowed).toBe(false);
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['assignee'])).allowed).toBe(false);
+  });
+
+  it('allows no-field action when wildcard is used', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(*)'] },
+    });
+
+    // Wildcard only matches when fields are present
+    expect(checkPermission(config, PermissionChecks.taskUpdate([])).allowed).toBe(true);
+  });
+
+  it('allows different resource', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(status)'] },
+    });
+
+    expect(checkPermission(config, PermissionChecks.milestoneUpdate(['status'])).allowed).toBe(
+      true
+    );
+  });
+
+  it('allows different action', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: { deny: ['pm:task:update(status)'] },
+    });
+
+    expect(checkPermission(config, PermissionChecks.taskCreate()).allowed).toBe(true);
+    expect(checkPermission(config, PermissionChecks.taskList()).allowed).toBe(true);
+  });
+
+  it('handles multiple deny patterns', () => {
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const config = createMockConfig({
+      codex: {
+        deny: ['pm:task:update(status)', 'pm:milestone:update(status)', 'pm:task:delete'],
+      },
+    });
+
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['status'])).allowed).toBe(false);
+    expect(checkPermission(config, PermissionChecks.milestoneUpdate(['status'])).allowed).toBe(
+      false
+    );
+    expect(checkPermission(config, PermissionChecks.taskDelete()).allowed).toBe(false);
+    expect(checkPermission(config, PermissionChecks.taskUpdate(['assignee'])).allowed).toBe(true);
+  });
+});
+
+describe('PermissionChecks helpers', () => {
+  it('creates correct task checks', () => {
+    expect(PermissionChecks.taskList()).toEqual({ resource: 'task', action: 'list', fields: [] });
+    expect(PermissionChecks.taskShow()).toEqual({ resource: 'task', action: 'show', fields: [] });
+    expect(PermissionChecks.taskCreate()).toEqual({
+      resource: 'task',
+      action: 'create',
+      fields: [],
+    });
+    expect(PermissionChecks.taskUpdate(['status'])).toEqual({
+      resource: 'task',
+      action: 'update',
+      fields: ['status'],
+    });
+    expect(PermissionChecks.taskDelete()).toEqual({
+      resource: 'task',
+      action: 'delete',
+      fields: [],
+    });
+  });
+
+  it('creates correct milestone checks', () => {
+    expect(PermissionChecks.milestoneList()).toEqual({
+      resource: 'milestone',
+      action: 'list',
+      fields: [],
+    });
+    expect(PermissionChecks.milestoneCreate()).toEqual({
+      resource: 'milestone',
+      action: 'create',
+      fields: [],
+    });
+    expect(PermissionChecks.milestoneUpdate(['status'])).toEqual({
+      resource: 'milestone',
+      action: 'update',
+      fields: ['status'],
+    });
+  });
+
+  it('creates correct doc checks', () => {
+    expect(PermissionChecks.docRead()).toEqual({ resource: 'doc', action: 'read', fields: [] });
+    expect(PermissionChecks.docUpdate()).toEqual({ resource: 'doc', action: 'update', fields: [] });
+  });
+
+  it('creates correct team checks', () => {
+    expect(PermissionChecks.teamCreate()).toEqual({
+      resource: 'team',
+      action: 'create',
+      fields: [],
+    });
+    expect(PermissionChecks.teamList()).toEqual({ resource: 'team', action: 'list', fields: [] });
+  });
+
+  it('creates correct log checks', () => {
+    expect(PermissionChecks.logRead()).toEqual({ resource: 'log', action: 'read', fields: [] });
+  });
+});
+
+describe('resolveActor', () => {
+  const originalEnv = { ...process.env };
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  it('returns human when not in tmux and no env var', () => {
+    delete process.env.TMUX;
+    delete process.env.TMT_AGENT_NAME;
+    delete process.env.TMUX_TEAM_ACTOR;
+
+    const result = resolveActor({});
+    expect(result.actor).toBe('human');
+    expect(result.source).toBe('default');
+    expect(result.warning).toBeUndefined();
+  });
+
+  it('uses env var when not in tmux', () => {
+    delete process.env.TMUX;
+    process.env.TMT_AGENT_NAME = 'codex';
+
+    const result = resolveActor({});
+    expect(result.actor).toBe('codex');
+    expect(result.source).toBe('env');
+    expect(result.warning).toBeUndefined();
+  });
+
+  it('prefers TMT_AGENT_NAME over TMUX_TEAM_ACTOR', () => {
+    delete process.env.TMUX;
+    process.env.TMT_AGENT_NAME = 'codex';
+    process.env.TMUX_TEAM_ACTOR = 'gemini';
+
+    const result = resolveActor({});
+    expect(result.actor).toBe('codex');
+    expect(result.source).toBe('env');
+  });
+});