refactor(permission-system): simplify policy and autoreview flow

This commit is contained in:
云服务部-叶林立
2026-09-03 02:01:06 +08:00
parent 180da95ab7
commit 6e7effa792
112 changed files with 911 additions and 10346 deletions
@@ -1,9 +1,5 @@
import { describe, expect, test } from "vitest";
import {
buildBashExternalDirectoryAskPayload,
buildExternalDirectoryAskPayload,
buildPathAskPayload,
} from "#src/presentation/path-ask-payload";
import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
describe("buildPathAskPayload", () => {
test("carries the typed path as the decision value and the rule that fired", () => {
@@ -38,89 +34,3 @@ describe("buildPathAskPayload", () => {
).toEqual({ agentName: null, forwarded: false, sessionId: null });
});
});
describe("buildExternalDirectoryAskPayload", () => {
test("carries the typed path, the boundary, and the requester", () => {
const payload = buildExternalDirectoryAskPayload({
toolName: "write",
pathValue: "/tmp/out.txt",
cwd: "/projects/my-app",
agentName: "my-agent",
});
expect(payload.kind).toBe("external_directory");
expect(payload.request.toolName).toBe("write");
expect(payload.request.value).toBe("/tmp/out.txt");
expect(payload.request.requester.agentName).toBe("my-agent");
expect(payload.evidence).toEqual([
{ label: "working directory", text: "/projects/my-app", detail: null },
]);
});
test("discloses the resolved path as its own entry when it differs", () => {
expect(
buildExternalDirectoryAskPayload({
toolName: "read",
pathValue: "demo-symlink-passwd",
resolvedPath: "/etc/passwd",
cwd: "/projects/my-app",
agentName: null,
}).evidence,
).toEqual([
{ label: "resolves to", text: "/etc/passwd", detail: null },
{ label: "working directory", text: "/projects/my-app", detail: null },
]);
});
test("omits the disclosure when resolvedPath is undefined", () => {
const payload = buildExternalDirectoryAskPayload({
toolName: "read",
pathValue: "/etc/passwd",
cwd: "/projects/my-app",
agentName: null,
});
expect(payload.evidence).toEqual([
{ label: "working directory", text: "/projects/my-app", detail: null },
]);
});
});
describe("buildBashExternalDirectoryAskPayload", () => {
test("makes the command the value and the paths it reached evidence", () => {
const payload = buildBashExternalDirectoryAskPayload({
command: "cat /etc/passwd",
externalPaths: [{ path: "/etc/passwd" }],
cwd: "/projects/my-app",
agentName: "my-agent",
toolName: "bash",
});
expect(payload.kind).toBe("bash_external_directory");
expect(payload.request.value).toBe("cat /etc/passwd");
expect(payload.request.requester.agentName).toBe("my-agent");
expect(payload.evidence).toEqual([
{ label: "working directory", text: "/projects/my-app", detail: null },
{ label: "external path", text: "/etc/passwd", detail: null },
]);
});
test("binds each path's canonical alias to its own entry", () => {
const payload = buildBashExternalDirectoryAskPayload({
command: "cat a b",
externalPaths: [
{ path: "/a", resolvedPath: "/private/a" },
{ path: "/b" },
],
cwd: "/repo",
agentName: null,
toolName: "bash",
});
expect(payload.evidence).toEqual([
{ label: "working directory", text: "/repo", detail: null },
{ label: "external path", text: "/a", detail: "/private/a" },
{ label: "external path", text: "/b", detail: null },
]);
});
});