admin/my-pi
1
0
Fork 0
mirror of https://bitbucket.org/siakitem/my-pi.git synced 2026-10-26 10:45:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(permission-system): simplify policy and autoreview flow

Browse Source
This commit is contained in:
云服务部-叶林立
2026-09-03 02:01:06 +08:00
parent 180da95ab7
commit 6e7effa792
112 changed files with 911 additions and 10346 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pi-permission-system/test/handlers/tool-call.test.ts
-80
View File
@@ -292,86 +292,6 @@ describe("handleToolCall — bash command chain gate", () => {
});
});
// ---------------------------------------------------------------------------
// Moved from permission-system.test.ts catch-all (#342)
// ---------------------------------------------------------------------------
describe("handleToolCall — bash external-directory policy states", () => {
it("allows bash command with only internal paths when external_directory is denied", async () => {
const { handler } = makeHandler({ tools: ["bash"] });
const event = makeToolCallEvent("bash", {
input: { command: "cat src/index.ts" },
});
const result = await handler.handleToolCall(event, makeCtx());
expect(result).toEqual({ action: "allow" });
});
it("blocks bash command with external path when external_directory is ask and no UI", async () => {
const { handler } = makeHandler({
session: {
checkPermission: makeSurfaceCheck({
external_directory: { state: "ask", source: "special" },
}),
},
tools: ["bash"],
prompter: {
escalate: vi.fn().mockResolvedValue({
approved: false,
state: "denied",
confirmationUnavailable: true,
}),
},
});
const event = makeToolCallEvent("bash", {
input: { command: "cat /etc/hosts" },
});
const result = await handler.handleToolCall(
event,
makeCtx({ hasUI: false }),
);
expect(result).toMatchObject({ action: "block" });
expect(String((result as { reason?: unknown }).reason)).toMatch(
/no interactive UI/i,
);
});
it("allows bash command with external path when external_directory is allow", async () => {
const { handler } = makeHandler({
session: {
checkPermission: makeSurfaceCheck({
external_directory: { state: "allow", source: "special" },
}),
},
tools: ["bash"],
});
const event = makeToolCallEvent("bash", {
input: { command: "cat /etc/hosts" },
});
const result = await handler.handleToolCall(event, makeCtx());
expect(result).toEqual({ action: "allow" });
});
it("applies bash pattern deny after external_directory allow", async () => {
const { handler } = makeHandler({
session: {
checkPermission: makeSurfaceCheck(
{
external_directory: { state: "allow", source: "special" },
bash: { state: "deny", source: "bash" },
},
{ state: "allow" },
),
},
tools: ["bash"],
});
const event = makeToolCallEvent("bash", {
input: { command: "cat /etc/hosts" },
});
const result = await handler.handleToolCall(event, makeCtx());
expect(result).toMatchObject({ action: "block" });
});
});
describe("handleToolCall — generic ask prompt content", () => {
it("ask prompt includes serialized tool input for informed approval", async () => {
const { handler, prompter } = makeHandler({