openAgent

1import { PermissionV1 } from "@opencode-ai/core/v1/permission"
2import { LayerNode } from "@opencode-ai/core/effect/layer-node"
3import { describe, test, expect } from "bun:test"
4import { Effect } from "effect"
5import { Permission } from "../src/permission"
6import { Config } from "@/config/config"
7import { testEffect } from "./lib/effect"
8 
9const it = testEffect(LayerNode.compile(Config.node))
10 
11const load = Config.use.get()
12 
13describe("Permission.evaluate for permission.task", () => {
14  const createRuleset = (rules: Record<string, "allow" | "deny" | "ask">): PermissionV1.Ruleset =>
15    Object.entries(rules).map(([pattern, action]) => ({
16      permission: "task",
17      pattern,
18      action,
19    }))
20 
21  test("returns ask when no match (default)", () => {
22    expect(Permission.evaluate("task", "code-reviewer", []).action).toBe("ask")
23  })
24 
25  test("returns deny for explicit deny", () => {
26    const ruleset = createRuleset({ "code-reviewer": "deny" })
27    expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
28  })
29 
30  test("returns allow for explicit allow", () => {
31    const ruleset = createRuleset({ "code-reviewer": "allow" })
32    expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("allow")
33  })
34 
35  test("returns ask for explicit ask", () => {
36    const ruleset = createRuleset({ "code-reviewer": "ask" })
37    expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("ask")
38  })
39 
40  test("matches wildcard patterns with deny", () => {
41    const ruleset = createRuleset({ "orchestrator-*": "deny" })
42    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("deny")
43    expect(Permission.evaluate("task", "orchestrator-slow", ruleset).action).toBe("deny")
44    expect(Permission.evaluate("task", "general", ruleset).action).toBe("ask")
45  })
46 
47  test("matches wildcard patterns with allow", () => {
48    const ruleset = createRuleset({ "orchestrator-*": "allow" })
49    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("allow")
50    expect(Permission.evaluate("task", "orchestrator-slow", ruleset).action).toBe("allow")
51  })
52 
53  test("matches wildcard patterns with ask", () => {
54    const ruleset = createRuleset({ "orchestrator-*": "ask" })
55    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("ask")
56    const globalRuleset = createRuleset({ "*": "ask" })
57    expect(Permission.evaluate("task", "code-reviewer", globalRuleset).action).toBe("ask")
58  })
59 
60  test("later rules take precedence (last match wins)", () => {
61    const ruleset = createRuleset({
62      "orchestrator-*": "deny",
63      "orchestrator-fast": "allow",
64    })
65    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("allow")
66    expect(Permission.evaluate("task", "orchestrator-slow", ruleset).action).toBe("deny")
67  })
68 
69  test("matches global wildcard", () => {
70    expect(Permission.evaluate("task", "any-agent", createRuleset({ "*": "allow" })).action).toBe("allow")
71    expect(Permission.evaluate("task", "any-agent", createRuleset({ "*": "deny" })).action).toBe("deny")
72    expect(Permission.evaluate("task", "any-agent", createRuleset({ "*": "ask" })).action).toBe("ask")
73  })
74})
75 
76describe("Permission.disabled for task tool", () => {
77  // Note: The `disabled` function checks if a TOOL should be completely removed from the tool list.
78  // It only disables a tool when there's a rule with `pattern: "*"` and `action: "deny"`.
79  // It does NOT evaluate complex subagent patterns - those are handled at runtime by `evaluate`.
80  const createRuleset = (rules: Record<string, "allow" | "deny" | "ask">): PermissionV1.Ruleset =>
81    Object.entries(rules).map(([pattern, action]) => ({
82      permission: "task",
83      pattern,
84      action,
85    }))
86 
87  test("task tool is disabled when global deny pattern exists (even with specific allows)", () => {
88    // When "*": "deny" exists, the task tool is disabled because the disabled() function
89    // only checks for wildcard deny patterns - it doesn't consider that specific subagents might be allowed
90    const ruleset = createRuleset({
91      "orchestrator-*": "allow",
92      "*": "deny",
93    })
94    const disabled = Permission.disabled(["task", "bash", "read"], ruleset)
95    // The task tool IS disabled because there's a pattern: "*" with action: "deny"
96    expect(disabled.has("task")).toBe(true)
97  })
98 
99  test("task tool is disabled when global deny pattern exists (even with ask overrides)", () => {
100    const ruleset = createRuleset({
101      "orchestrator-*": "ask",
102      "*": "deny",
103    })
104    const disabled = Permission.disabled(["task"], ruleset)
105    // The task tool IS disabled because there's a pattern: "*" with action: "deny"
106    expect(disabled.has("task")).toBe(true)
107  })
108 
109  test("task tool is disabled when global deny pattern exists", () => {
110    const ruleset = createRuleset({ "*": "deny" })
111    const disabled = Permission.disabled(["task"], ruleset)
112    expect(disabled.has("task")).toBe(true)
113  })
114 
115  test("task tool is NOT disabled when only specific patterns are denied (no wildcard)", () => {
116    // The disabled() function only disables tools when pattern: "*" && action: "deny"
117    // Specific subagent denies don't disable the task tool - those are handled at runtime
118    const ruleset = createRuleset({
119      "orchestrator-*": "deny",
120      general: "deny",
121    })
122    const disabled = Permission.disabled(["task"], ruleset)
123    // The task tool is NOT disabled because no rule has pattern: "*" with action: "deny"
124    expect(disabled.has("task")).toBe(false)
125  })
126 
127  test("task tool is enabled when no task rules exist (default ask)", () => {
128    const disabled = Permission.disabled(["task"], [])
129    expect(disabled.has("task")).toBe(false)
130  })
131 
132  test("task tool is NOT disabled when last wildcard pattern is allow", () => {
133    // Last matching rule wins - if wildcard allow comes after wildcard deny, tool is enabled
134    const ruleset = createRuleset({
135      "*": "deny",
136      "orchestrator-coder": "allow",
137    })
138    const disabled = Permission.disabled(["task"], ruleset)
139    // The disabled() function uses findLast and checks if the last matching rule
140    // has pattern: "*" and action: "deny". In this case, the last rule matching
141    // "task" permission has pattern "orchestrator-coder", not "*", so not disabled
142    expect(disabled.has("task")).toBe(false)
143  })
144})
145 
146// Integration tests that load permissions from real config files
147describe("permission.task with real config files", () => {
148  it.instance(
149    "loads task permissions from opencode.json config",
150    () =>
151      Effect.gen(function* () {
152        const config = yield* load
153        const ruleset = Permission.fromConfig(config.permission ?? {})
154        // general and orchestrator-fast should be allowed, code-reviewer denied
155        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
156        expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("allow")
157        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
158      }),
159    {
160      git: true,
161      config: {
162        permission: {
163          task: {
164            "*": "allow",
165            "code-reviewer": "deny",
166          },
167        },
168      },
169    },
170  )
171 
172  it.instance(
173    "loads task permissions with wildcard patterns from config",
174    () =>
175      Effect.gen(function* () {
176        const config = yield* load
177        const ruleset = Permission.fromConfig(config.permission ?? {})
178        // general and code-reviewer should be ask, orchestrator-* denied
179        expect(Permission.evaluate("task", "general", ruleset).action).toBe("ask")
180        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("ask")
181        expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("deny")
182      }),
183    {
184      git: true,
185      config: {
186        permission: {
187          task: {
188            "*": "ask",
189            "orchestrator-*": "deny",
190          },
191        },
192      },
193    },
194  )
195 
196  it.instance(
197    "evaluate respects task permission from config",
198    () =>
199      Effect.gen(function* () {
200        const config = yield* load
201        const ruleset = Permission.fromConfig(config.permission ?? {})
202        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
203        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
204        // Unspecified agents default to "ask"
205        expect(Permission.evaluate("task", "unknown-agent", ruleset).action).toBe("ask")
206      }),
207    {
208      git: true,
209      config: {
210        permission: {
211          task: {
212            general: "allow",
213            "code-reviewer": "deny",
214          },
215        },
216      },
217    },
218  )
219 
220  it.instance(
221    "mixed permission config with task and other tools",
222    () =>
223      Effect.gen(function* () {
224        const config = yield* load
225        const ruleset = Permission.fromConfig(config.permission ?? {})
226 
227        // Verify task permissions
228        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
229        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
230 
231        // Verify other tool permissions
232        expect(Permission.evaluate("bash", "*", ruleset).action).toBe("allow")
233        expect(Permission.evaluate("edit", "*", ruleset).action).toBe("ask")
234 
235        // Verify disabled tools
236        const disabled = Permission.disabled(["bash", "edit", "task"], ruleset)
237        expect(disabled.has("bash")).toBe(false)
238        expect(disabled.has("edit")).toBe(false)
239        // task is NOT disabled because disabled() uses findLast, and the last rule
240        // matching "task" permission is {pattern: "general", action: "allow"}, not pattern: "*"
241        expect(disabled.has("task")).toBe(false)
242      }),
243    {
244      git: true,
245      config: {
246        permission: {
247          bash: "allow",
248          edit: "ask",
249          task: {
250            "*": "deny",
251            general: "allow",
252          },
253        },
254      },
255    },
256  )
257 
258  it.instance(
259    "task tool disabled when global deny comes last in config",
260    () =>
261      Effect.gen(function* () {
262        const config = yield* load
263        const ruleset = Permission.fromConfig(config.permission ?? {})
264 
265        // Last matching rule wins - "*" deny is last, so all agents are denied
266        expect(Permission.evaluate("task", "general", ruleset).action).toBe("deny")
267        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
268        expect(Permission.evaluate("task", "unknown", ruleset).action).toBe("deny")
269 
270        // Since "*": "deny" is the last rule, disabled() finds it with findLast
271        // and sees pattern: "*" with action: "deny", so task is disabled
272        const disabled = Permission.disabled(["task"], ruleset)
273        expect(disabled.has("task")).toBe(true)
274      }),
275    {
276      git: true,
277      config: {
278        permission: {
279          task: {
280            general: "allow",
281            "code-reviewer": "allow",
282            "*": "deny",
283          },
284        },
285      },
286    },
287  )
288 
289  it.instance(
290    "task tool NOT disabled when specific allow comes last in config",
291    () =>
292      Effect.gen(function* () {
293        const config = yield* load
294        const ruleset = Permission.fromConfig(config.permission ?? {})
295 
296        // Evaluate uses findLast - "general" allow comes after "*" deny
297        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
298        // Other agents still denied by the earlier "*" deny
299        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
300 
301        // disabled() uses findLast and checks if the last rule has pattern: "*" with action: "deny"
302        // In this case, the last rule is {pattern: "general", action: "allow"}, not pattern: "*"
303        // So the task tool is NOT disabled (even though most subagents are denied)
304        const disabled = Permission.disabled(["task"], ruleset)
305        expect(disabled.has("task")).toBe(false)
306      }),
307    {
308      git: true,
309      config: {
310        permission: {
311          task: {
312            "*": "deny",
313            general: "allow",
314          },
315        },
316      },
317    },
318  )
319})
320