603 lines
27 KiB
TypeScript
603 lines
27 KiB
TypeScript
import { describe, expect, it, vi } from 'vitest'
|
|
import { Context } from 'cordis'
|
|
import type { Agent } from '@deepseek-ai/dsh-agent'
|
|
import { CallId } from '@deepseek-ai/dsh-llm'
|
|
import { carrierKeyOf, scopeHost } from '@deepseek-ai/dsh-scope'
|
|
import SessionStore, { Session, SessionId } from '@deepseek-ai/dsh-session'
|
|
import type { SessionEvent } from '@deepseek-ai/dsh-session'
|
|
import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
|
|
import ApprovalService, { ApprovalOutcome, ApprovalRequest, effectiveApprovalPolicy, setApprovalPolicy } from '@deepseek-ai/dsh-user-approval'
|
|
|
|
/**
|
|
* A minimal Agent stand-in — the service only reaches `agent.session.append`
|
|
* and folds `.events`. Seeded inside an open turn by default (request()'s
|
|
* turn-enclosure precondition); pass `seed` to stage idle/closed logs.
|
|
* Returns the recorded audit appends alongside the fake.
|
|
*/
|
|
function fakeAgent(seed: Array<{ type: string }> = [{ type: 'turn/start' }, { type: 'user/message' }]): { agent: Agent; appended: Array<{ type: string; data: Record<string, unknown> }> } {
|
|
const appended: Array<{ type: string; data: Record<string, unknown> }> = []
|
|
const agent = {
|
|
session: {
|
|
events: seed,
|
|
append: (type: string, data: Record<string, unknown>) => {
|
|
appended.push({ type, data })
|
|
return { type, data } as unknown as SessionEvent
|
|
},
|
|
},
|
|
} as unknown as Agent
|
|
return { agent, appended }
|
|
}
|
|
|
|
async function mounted(): Promise<Context> {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService)
|
|
return ctx
|
|
}
|
|
|
|
function requestOf(agent: Agent, overrides: Partial<ApprovalRequest> = {}): ApprovalRequest {
|
|
return { agent, toolName: 'echo', ...overrides }
|
|
}
|
|
|
|
describe('ApprovalService.request', () => {
|
|
it('throws before appending anything when no turn has ever opened (idle ask)', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent([])
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).rejects.toThrow(/outside an open turn/)
|
|
expect(appended).toHaveLength(0)
|
|
})
|
|
|
|
it('throws between turns — a closed turn does not satisfy the enclosure precondition', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent([{ type: 'turn/start' }, { type: 'turn/end' }])
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).rejects.toThrow(/outside an open turn/)
|
|
expect(appended).toHaveLength(0)
|
|
})
|
|
|
|
it('fails closed to unavailable when nobody listens, auditing the asked/decided pair', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent()
|
|
|
|
const outcome = await ctx.approval.request(requestOf(agent, { callId: CallId('call-1'), reason: 'hook says ask' }))
|
|
|
|
expect(outcome).toBe('unavailable')
|
|
expect(appended.map(e => e.type)).toEqual(['approval/asked', 'approval/decided'])
|
|
const [asked, decided] = appended
|
|
expect(asked?.data).toMatchObject({ toolName: 'echo', callId: 'call-1', reason: 'hook says ask' })
|
|
expect(decided?.data).toMatchObject({ outcome: 'unavailable' })
|
|
expect(decided?.data['id']).toBe(asked?.data['id'])
|
|
})
|
|
|
|
it('omits absent optional fields from the asked audit event', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent()
|
|
|
|
await ctx.approval.request(requestOf(agent))
|
|
|
|
expect(Object.keys(appended[0]?.data ?? {}).sort()).toEqual(['id', 'toolName'])
|
|
})
|
|
|
|
it('snapshots request identity, scope, payload, and audit before deferred dispatch', async () => {
|
|
const ctx = await mounted()
|
|
const { agent: acceptedAgent, appended: acceptedAudit } = fakeAgent()
|
|
const { agent: replacementAgent, appended: replacementAudit } = fakeAgent()
|
|
const host = await scopeHost(ctx, ['approval'])
|
|
const acceptedScope = host.mint(acceptedAgent)
|
|
const replacementScope = host.mint(replacementAgent)
|
|
const dispatchStarted = Promise.withResolvers<'started'>()
|
|
const answer = Promise.withResolvers<ApprovalOutcome>()
|
|
const originalSignal = new AbortController().signal
|
|
const replacementSignal = new AbortController().signal
|
|
let heardBy: 'accepted' | 'replacement' | undefined
|
|
let received: ApprovalRequest | undefined
|
|
let carrier: unknown
|
|
acceptedScope.ctx.on('approval/request', function (req) {
|
|
heardBy = 'accepted'
|
|
received = req
|
|
carrier = carrierKeyOf(this)
|
|
dispatchStarted.resolve('started')
|
|
return answer.promise
|
|
})
|
|
replacementScope.ctx.on('approval/request', function (req) {
|
|
heardBy = 'replacement'
|
|
received = req
|
|
carrier = carrierKeyOf(this)
|
|
dispatchStarted.resolve('started')
|
|
return answer.promise
|
|
})
|
|
const request = requestOf(acceptedAgent, {
|
|
toolName: 'original-tool',
|
|
callId: CallId('original-call'),
|
|
reason: 'original reason',
|
|
signal: originalSignal,
|
|
})
|
|
|
|
const pending = ctx.approval.request(request)
|
|
// request() has returned, but the answerer dispatch is deliberately queued
|
|
// in a microtask. Mutating the caller-owned record must not redirect it.
|
|
request.agent = replacementAgent
|
|
request.toolName = 'mutated-before-dispatch'
|
|
request.callId = CallId('mutated-call')
|
|
request.reason = 'mutated reason'
|
|
request.signal = replacementSignal
|
|
await dispatchStarted.promise
|
|
// Mutation while the answer is pending must not redirect the final audit.
|
|
request.toolName = 'mutated-after-dispatch'
|
|
request.reason = 'mutated again'
|
|
answer.resolve('allowed-once')
|
|
|
|
await expect(pending).resolves.toBe('allowed-once')
|
|
expect(heardBy).toBe('accepted')
|
|
expect(carrier).toBe(acceptedAgent)
|
|
expect(received).not.toBe(request)
|
|
expect(Object.isFrozen(received)).toBe(true)
|
|
expect(received).toMatchObject({
|
|
agent: acceptedAgent,
|
|
toolName: 'original-tool',
|
|
callId: 'original-call',
|
|
reason: 'original reason',
|
|
signal: originalSignal,
|
|
})
|
|
expect(acceptedAudit).toHaveLength(2)
|
|
expect(acceptedAudit[0]?.data).toMatchObject({
|
|
toolName: 'original-tool',
|
|
callId: 'original-call',
|
|
reason: 'original reason',
|
|
})
|
|
expect(acceptedAudit[1]?.data).toMatchObject({ outcome: 'allowed-once' })
|
|
expect(acceptedAudit[1]?.data['id']).toBe(acceptedAudit[0]?.data['id'])
|
|
expect(replacementAudit).toEqual([])
|
|
await host.dispose()
|
|
})
|
|
|
|
it('contains an approval/asked observer throw after append and still completes the pair', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(SessionStore)
|
|
await ctx.plugin(ApprovalService)
|
|
const session = ctx.sessions.create(SessionId('asked-observer-throw'))
|
|
session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
|
|
const agent = { session } as unknown as Agent
|
|
const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
|
|
ctx.on('session/event', (_session, event) => {
|
|
if (event.type === 'approval/asked') throw new Error('observer failed after asked append')
|
|
})
|
|
ctx.on('approval/request', () => Promise.resolve<ApprovalOutcome>('allowed-once'))
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('allowed-once')
|
|
|
|
const audit = session.events.filter(event => event.type.startsWith('approval/'))
|
|
const asked = session.events.find((event): event is SessionEvent<'approval/asked'> => event.type === 'approval/asked')
|
|
const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided')
|
|
expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided'])
|
|
expect(decided?.data.id).toBe(asked?.data.id)
|
|
expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/asked observer threw'))
|
|
})
|
|
|
|
it('contains an approval/decided observer throw after append and still resolves', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(SessionStore)
|
|
await ctx.plugin(ApprovalService)
|
|
const session = ctx.sessions.create(SessionId('decided-observer-throw'))
|
|
session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
|
|
const agent = { session } as unknown as Agent
|
|
const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
|
|
ctx.on('session/event', (_session, event) => {
|
|
if (event.type === 'approval/decided') throw new Error('observer failed after decided append')
|
|
})
|
|
ctx.on('approval/request', () => Promise.resolve<ApprovalOutcome>('rejected'))
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('rejected')
|
|
|
|
const audit = session.events.filter(event => event.type.startsWith('approval/'))
|
|
const asked = session.events.find((event): event is SessionEvent<'approval/asked'> => event.type === 'approval/asked')
|
|
const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided')
|
|
expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided'])
|
|
expect(decided?.data).toMatchObject({ id: asked?.data.id, outcome: 'rejected' })
|
|
expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/decided observer threw'))
|
|
})
|
|
|
|
it('does not misclassify a pre-append failure as an observer failure', async () => {
|
|
const ctx = await mounted()
|
|
const failure = new Error('append failed before log growth')
|
|
const agent = {
|
|
session: {
|
|
events: [{ type: 'turn/start' }],
|
|
append: () => { throw failure },
|
|
},
|
|
} as unknown as Agent
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).rejects.toBe(failure)
|
|
})
|
|
|
|
it('returns the first answering listener outcome (single decision slot)', async () => {
|
|
const ctx = await mounted()
|
|
const { agent } = fakeAgent()
|
|
let secondRan = false
|
|
ctx.on('approval/request', () => Promise.resolve<ApprovalOutcome>('allowed-once'))
|
|
ctx.on('approval/request', () => {
|
|
secondRan = true
|
|
return Promise.resolve<ApprovalOutcome>('rejected')
|
|
})
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('allowed-once')
|
|
expect(secondRan).toBe(false)
|
|
})
|
|
|
|
it('lets a non-owning listener delegate via next() down to the fail-closed default', async () => {
|
|
const ctx = await mounted()
|
|
const { agent } = fakeAgent()
|
|
ctx.on('approval/request', (_req, next) => next())
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('unavailable')
|
|
})
|
|
|
|
it('dispatches to global and matching agent-scoped listeners, never a foreign scope', async () => {
|
|
const ctx = await mounted()
|
|
const { agent: agentA } = fakeAgent()
|
|
const { agent: agentB } = fakeAgent()
|
|
const host = await scopeHost(ctx, ['approval'])
|
|
const scopeA = host.mint(agentA)
|
|
const scopeB = host.mint(agentB)
|
|
const heard: string[] = []
|
|
ctx.on('approval/request', (req, next) => {
|
|
heard.push(req.agent === agentA ? 'global:A' : 'global:B')
|
|
return next()
|
|
})
|
|
scopeA.ctx.on('approval/request', (_req, next) => {
|
|
heard.push('scoped:A')
|
|
return next()
|
|
})
|
|
scopeB.ctx.on('approval/request', (_req, next) => {
|
|
heard.push('scoped:B')
|
|
return next()
|
|
})
|
|
|
|
await expect(ctx.approval.request(requestOf(agentA))).resolves.toBe('unavailable')
|
|
await expect(ctx.approval.request(requestOf(agentB))).resolves.toBe('unavailable')
|
|
|
|
expect(heard).toEqual(['global:A', 'scoped:A', 'global:B', 'scoped:B'])
|
|
await host.dispose()
|
|
})
|
|
|
|
it('keys the scoped dispatch carrier to the exact request agent', async () => {
|
|
const ctx = await mounted()
|
|
const { agent } = fakeAgent()
|
|
const host = await scopeHost(ctx, ['approval'])
|
|
const scope = host.mint(agent)
|
|
let seenKey: object | undefined
|
|
scope.ctx.on('approval/request', function (req, next) {
|
|
seenKey = carrierKeyOf(this)
|
|
expect(req.agent).toBe(agent)
|
|
return next()
|
|
})
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('unavailable')
|
|
|
|
expect(seenKey).toBe(agent)
|
|
await host.dispose()
|
|
})
|
|
|
|
it('contains a throwing answerer as unavailable', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent()
|
|
ctx.on('approval/request', () => Promise.reject(new Error('transport died')))
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('unavailable')
|
|
expect(appended[1]?.data).toMatchObject({ outcome: 'unavailable' })
|
|
})
|
|
|
|
it('normalizes a rogue non-vocabulary answer to unavailable', async () => {
|
|
const ctx = await mounted()
|
|
const { agent } = fakeAgent()
|
|
// A JS answerer can return anything; the seam must not leak it into
|
|
// callers' closed-union switches.
|
|
ctx.on('approval/request', () => Promise.resolve('yolo' as ApprovalOutcome))
|
|
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('unavailable')
|
|
})
|
|
|
|
it('settles cancelled immediately on an already-aborted signal without asking anyone', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent()
|
|
let asked = false
|
|
ctx.on('approval/request', () => {
|
|
asked = true
|
|
return Promise.resolve<ApprovalOutcome>('allowed-once')
|
|
})
|
|
|
|
const outcome = await ctx.approval.request(requestOf(agent, { signal: AbortSignal.abort() }))
|
|
|
|
expect(outcome).toBe('cancelled')
|
|
expect(asked).toBe(false)
|
|
expect(appended.map(e => e.type)).toEqual(['approval/asked', 'approval/decided'])
|
|
expect(appended[1]?.data).toMatchObject({ outcome: 'cancelled' })
|
|
})
|
|
|
|
it('resolves cancelled when the signal aborts mid-question and discards the late answer', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent()
|
|
let settleLate: ((outcome: ApprovalOutcome) => void) | undefined
|
|
ctx.on('approval/request', () => new Promise<ApprovalOutcome>((resolve) => { settleLate = resolve }))
|
|
const controller = new AbortController()
|
|
|
|
const pending = ctx.approval.request(requestOf(agent, { signal: controller.signal }))
|
|
controller.abort()
|
|
await expect(pending).resolves.toBe('cancelled')
|
|
|
|
// The answerer settles after the fact: no second decided event appears.
|
|
settleLate?.('allowed-once')
|
|
await Promise.resolve()
|
|
expect(appended.filter(e => e.type === 'approval/decided')).toHaveLength(1)
|
|
expect(appended[1]?.data).toMatchObject({ outcome: 'cancelled' })
|
|
})
|
|
|
|
it('discards a late REJECTION after abort without an unhandled rejection', async () => {
|
|
const ctx = await mounted()
|
|
const { agent } = fakeAgent()
|
|
let rejectLate: ((error: Error) => void) | undefined
|
|
ctx.on('approval/request', () => new Promise<ApprovalOutcome>((_resolve, reject) => { rejectLate = reject }))
|
|
const controller = new AbortController()
|
|
|
|
const pending = ctx.approval.request(requestOf(agent, { signal: controller.signal }))
|
|
controller.abort()
|
|
await expect(pending).resolves.toBe('cancelled')
|
|
|
|
rejectLate?.(new Error('answered too late'))
|
|
// Drain microtasks: the contained rejection must not escape the seam.
|
|
await new Promise((resolve) => { setTimeout(resolve, 0) })
|
|
})
|
|
|
|
it('resolves the answer when the signal never aborts', async () => {
|
|
const ctx = await mounted()
|
|
const { agent } = fakeAgent()
|
|
ctx.on('approval/request', () => Promise.resolve<ApprovalOutcome>('rejected'))
|
|
const controller = new AbortController()
|
|
|
|
await expect(ctx.approval.request(requestOf(agent, { signal: controller.signal }))).resolves.toBe('rejected')
|
|
})
|
|
|
|
it('issues a fresh id per request', async () => {
|
|
const ctx = await mounted()
|
|
const { agent, appended } = fakeAgent()
|
|
|
|
await ctx.approval.request(requestOf(agent))
|
|
await ctx.approval.request(requestOf(agent))
|
|
|
|
const ids = appended.filter(e => e.type === 'approval/asked').map(e => e.data['id'])
|
|
expect(ids).toHaveLength(2)
|
|
expect(ids[0]).not.toBe(ids[1])
|
|
})
|
|
|
|
it('drops a disposed plugin listener from the chain (HMR safety)', async () => {
|
|
const ctx = await mounted()
|
|
const { agent } = fakeAgent()
|
|
const fiber = await ctx.plugin((inner: Context) => {
|
|
inner.on('approval/request', () => Promise.resolve<ApprovalOutcome>('allowed-once'))
|
|
})
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('allowed-once')
|
|
|
|
await fiber.dispose()
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('unavailable')
|
|
})
|
|
})
|
|
|
|
describe('approval policy (the approval/policy fold)', () => {
|
|
const NEVER_SENTENCE = 'Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`).'
|
|
const ASK_MARKER = '<!-- dsh-user-approval-policy:ask -->'
|
|
const NEVER_MARKER = '<!-- dsh-user-approval-policy:never -->'
|
|
|
|
/**
|
|
* An agent stand-in over a REAL Session — gate, section, and narrator fold
|
|
* real events; the opened turn satisfies request()'s enclosure precondition.
|
|
*/
|
|
function sessionAgent(id: string): { agent: Agent; session: Session; injected: string[] } {
|
|
const session = new Session(SessionId(id))
|
|
session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
|
|
const injected: string[] = []
|
|
const agent = {
|
|
id,
|
|
session,
|
|
inject: (content: { type: string; text: string }[]) => { injected.push(content[0]?.text ?? '') },
|
|
} as unknown as Agent
|
|
return { agent, session, injected }
|
|
}
|
|
|
|
const preStep = (ctx: Context, agent: Agent): Promise<void> =>
|
|
ctx.serial('agent/pre-step', agent, 1, 1, '', [], new AbortController().signal)
|
|
|
|
/** Append a `request/header` snapshot whose system text is exactly `system`. */
|
|
function appendHeader(session: Session, system: string): void {
|
|
session.append('request/header', { header: { config: { model: 'mock' }, system }, reason: 'initial' })
|
|
}
|
|
|
|
it('folds to the last event, or undefined without one', () => {
|
|
const { session } = sessionAgent('sess-fold')
|
|
expect(effectiveApprovalPolicy(session.events)).toBeUndefined()
|
|
setApprovalPolicy(session, 'never')
|
|
setApprovalPolicy(session, 'ask')
|
|
expect(effectiveApprovalPolicy(session.events)).toBe('ask')
|
|
expect(session.events.at(-1)).toMatchObject({ type: 'approval/policy', data: { policy: 'ask' } })
|
|
})
|
|
|
|
it('defaults a schema-less construction to ask (the ?? narrows the optional TYPE)', async () => {
|
|
// Direct construction bypasses the plugin schema (the SystemPrompt-test
|
|
// precedent for covering a defaulted Config field's type-narrowing ??).
|
|
const ctx = new Context()
|
|
const service = new ApprovalService(ctx, {})
|
|
const { agent } = sessionAgent('sess-bare-config')
|
|
ctx.on('approval/request', () => Promise.resolve<ApprovalOutcome>('allowed-once'))
|
|
await expect(service.request({ agent, toolName: 'echo' })).resolves.toBe('allowed-once')
|
|
})
|
|
|
|
it('contains an answerer that throws SYNCHRONOUSLY as unavailable', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService)
|
|
const { agent } = sessionAgent('sess-syncthrow')
|
|
ctx.on('approval/request', () => { throw new Error('sync bug') })
|
|
await expect(ctx.approval.request({ agent, toolName: 'echo' })).resolves.toBe('unavailable')
|
|
})
|
|
|
|
it('a never config rejects deterministically without consulting any answerer', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService, { policy: 'never' })
|
|
const consulted = vi.fn()
|
|
ctx.on('approval/request', (_req, next) => { consulted(); return next() })
|
|
const { agent, session } = sessionAgent('sess-gate-1')
|
|
await expect(ctx.approval.request({ agent, toolName: 'bash' })).resolves.toBe('rejected')
|
|
expect(consulted).not.toHaveBeenCalled()
|
|
// The audit pair still lands on the session log.
|
|
expect(session.events.filter(e => e.type === 'approval/asked')).toHaveLength(1)
|
|
expect(session.events.filter(e => e.type === 'approval/decided')).toHaveLength(1)
|
|
})
|
|
|
|
it('the gate decides FIRST even against an answerer registered before the service (prepend)', async () => {
|
|
const ctx = new Context()
|
|
ctx.on('approval/request', () => Promise.resolve<ApprovalOutcome>('allowed-once'))
|
|
await ctx.plugin(ApprovalService, { policy: 'never' })
|
|
const { agent } = sessionAgent('sess-gate-2')
|
|
await expect(ctx.approval.request({ agent, toolName: 'bash' })).resolves.toBe('rejected')
|
|
})
|
|
|
|
it('never is unbypassable even by an answerer PREPENDED after the service mounts', async () => {
|
|
// Cordis prepend unshifts ahead of every existing listener, including any gate LISTENER the
|
|
// service could register — which is exactly why the 'never' decision lives inside request()
|
|
// instead.
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService, { policy: 'never' })
|
|
const consulted = vi.fn()
|
|
ctx.on('approval/request', () => { consulted(); return Promise.resolve<ApprovalOutcome>('allowed-once') }, { prepend: true })
|
|
const { agent, appended } = fakeAgent()
|
|
await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('rejected')
|
|
expect(consulted).not.toHaveBeenCalled()
|
|
expect(appended.map(e => e.type)).toEqual(['approval/asked', 'approval/decided'])
|
|
})
|
|
|
|
it('a session override outranks the configured default, in both directions', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService, { policy: 'never' })
|
|
ctx.on('approval/request', () => Promise.resolve<ApprovalOutcome>('allowed-once'))
|
|
const { agent, session } = sessionAgent('sess-gate-3')
|
|
setApprovalPolicy(session, 'ask')
|
|
await expect(ctx.approval.request({ agent, toolName: 'bash' })).resolves.toBe('allowed-once')
|
|
setApprovalPolicy(session, 'never')
|
|
await expect(ctx.approval.request({ agent, toolName: 'bash' })).resolves.toBe('rejected')
|
|
})
|
|
|
|
it('states never (and only never) in prose while recording either policy with a source-owned marker', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(SystemPrompt)
|
|
await ctx.plugin(ApprovalService)
|
|
const askAgent = sessionAgent('sess-sect-ask').agent
|
|
const { agent: neverAgent, session } = sessionAgent('sess-sect-never')
|
|
setApprovalPolicy(session, 'never')
|
|
const sectionFor = async (context: object) =>
|
|
(await ctx.systemPrompt.assemble(context)).sections.find(s => s.name === 'approval:policy')?.text
|
|
expect(await sectionFor({ agent: askAgent })).toBe(ASK_MARKER)
|
|
expect(await sectionFor({ agent: neverAgent })).toBe(`${NEVER_SENTENCE}\n${NEVER_MARKER}`)
|
|
// A bare assemble (no agent) has no session to state.
|
|
expect(await sectionFor({})).toBe('')
|
|
})
|
|
|
|
it('narrates nothing cold, once per coalesced switch (user wording), and idempotently', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService)
|
|
const { agent, session, injected } = sessionAgent('sess-narr-1')
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual([])
|
|
setApprovalPolicy(session, 'never')
|
|
setApprovalPolicy(session, 'ask')
|
|
setApprovalPolicy(session, 'never')
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual(['The approval policy changed from "ask" to "never" (changed by the user).'])
|
|
await preStep(ctx, agent)
|
|
expect(injected).toHaveLength(1)
|
|
setApprovalPolicy(session, 'ask')
|
|
setApprovalPolicy(session, 'never')
|
|
await preStep(ctx, agent)
|
|
expect(injected).toHaveLength(1)
|
|
})
|
|
|
|
it('reads what the model was told back from the folded header text after a restart', async () => {
|
|
// A session whose last request carried the never sentence resumes under
|
|
// an ask default: the narrator attributes the change to the operator.
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService)
|
|
const { agent, session, injected } = sessionAgent('sess-narr-2')
|
|
appendHeader(session, `persona\n\n${NEVER_SENTENCE}\n${NEVER_MARKER}`)
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual(['The approval policy changed from "never" to "ask" (changed by the operator/config).'])
|
|
})
|
|
|
|
it('narrates a config default drift from the logged ask marker', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService, { policy: 'never' })
|
|
const { agent, session, injected } = sessionAgent('sess-narr-3')
|
|
appendHeader(session, `persona only\n${ASK_MARKER}`)
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual(['The approval policy changed from "ask" to "never" (changed by the operator/config).'])
|
|
})
|
|
|
|
it('a pinned override survives a default change silently', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService, { policy: 'never' })
|
|
const { agent, session, injected } = sessionAgent('sess-narr-4')
|
|
appendHeader(session, `persona only\n${ASK_MARKER}`)
|
|
setApprovalPolicy(session, 'ask')
|
|
appendHeader(session, `persona only\n${ASK_MARKER}`)
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual([])
|
|
})
|
|
|
|
it('does not infer never from deployment prose that quotes the never sentence', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService)
|
|
const { agent, session, injected } = sessionAgent('sess-narr-spoof-prose')
|
|
appendHeader(session, `persona quotes this warning: ${NEVER_SENTENCE}\n${ASK_MARKER}`)
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual([])
|
|
})
|
|
|
|
it('treats a legacy header with no source-owned marker as untold', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService, { policy: 'never' })
|
|
const { agent, session, injected } = sessionAgent('sess-narr-unmarked-header')
|
|
appendHeader(session, 'legacy persona-only header')
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual([])
|
|
})
|
|
|
|
it('uses the service marker after an earlier persona marker', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(ApprovalService)
|
|
const { agent, session, injected } = sessionAgent('sess-narr-spoof-marker')
|
|
appendHeader(session, `persona quotes ${NEVER_MARKER}\n${ASK_MARKER}`)
|
|
await preStep(ctx, agent)
|
|
expect(injected).toEqual([])
|
|
})
|
|
|
|
it('disposes the service prompt section and pre-step narrator together (HMR safety)', async () => {
|
|
const ctx = new Context()
|
|
await ctx.plugin(SystemPrompt)
|
|
const fiber = await ctx.plugin(ApprovalService)
|
|
const live = sessionAgent('sess-hmr-service-live')
|
|
const afterDispose = sessionAgent('sess-hmr-service-disposed')
|
|
const sectionFor = async () =>
|
|
(await ctx.systemPrompt.assemble({ agent: live.agent })).sections.find(section => section.name === 'approval:policy')
|
|
expect(await sectionFor()).toBeDefined()
|
|
|
|
appendHeader(live.session, `persona\n${ASK_MARKER}`)
|
|
setApprovalPolicy(live.session, 'never')
|
|
await preStep(ctx, live.agent)
|
|
expect(live.injected).toEqual(['The approval policy changed from "ask" to "never" (changed by the user).'])
|
|
|
|
appendHeader(afterDispose.session, `persona\n${ASK_MARKER}`)
|
|
setApprovalPolicy(afterDispose.session, 'never')
|
|
await fiber.dispose()
|
|
|
|
expect(await sectionFor()).toBeUndefined()
|
|
await preStep(ctx, afterDispose.agent)
|
|
expect(afterDispose.injected).toEqual([])
|
|
})
|
|
})
|