tests/test_permissions.py

• _store · function · L18-L22 — def _store(tmp_path)
• test_seed_defaults_and_fallback · function · L26-L50 — def test_seed_defaults_and_fallback(tmp_path)
• test_env_read_denied_even_over_conversation_allow · function · L53-L76 — def test_env_read_denied_even_over_conversation_allow(tmp_path)
• test_conversation_allow_overrides_global_ask · function · L79-L92 — def test_conversation_allow_overrides_global_ask(tmp_path)
• test_pattern_specificity · function · L95-L114 — def test_pattern_specificity(tmp_path)
• test_project_scope · function · L117-L140 — def test_project_scope(tmp_path)
• test_upsert_and_delete_rule · function · L143-L157 — def test_upsert_and_delete_rule(tmp_path)
• test_broker_headless_fails_closed_unless_operator_explicitly_allows · function · L161-L177 — def test_broker_headless_fails_closed_unless_operator_explicitly_allows( tmp_path, monkeypatch )
• test_broker_guardian_fence_precedes_default_allow_rule · function · L180-L241 — def test_broker_guardian_fence_precedes_default_allow_rule(tmp_path, monkeypatch)
• test_broker_guardian_uses_config_selection_without_legacy_env · function · L244-L276 — def test_broker_guardian_uses_config_selection_without_legacy_env( tmp_path, monkeypatch )
• GuardianConfig · class · L250-L259 — class GuardianConfig
• test_broker_config_only_guardian_predicate_failure_fails_closed · function · L279-L311 — def test_broker_config_only_guardian_predicate_failure_fails_closed( tmp_path, monkeypatch )
• GuardianConfig · class · L285-L287 — class GuardianConfig
• fail_policy_check · function · L289-L290 — def fail_policy_check(**_kwargs)
• test_guardian_file_policy_precedes_restart_once_grant · function · L314-L375 — def test_guardian_file_policy_precedes_restart_once_grant(tmp_path, monkeypatch)
• test_broker_blocks_until_allowed_and_persists · function · L378-L423 — def test_broker_blocks_until_allowed_and_persists(tmp_path)
• run · function · L385-L388 — def run()
• test_broker_deny_returns_soft_fail · function · L426-L449 — def test_broker_deny_returns_soft_fail(tmp_path)
• run · function · L433-L437 — def run(): # use a still-gated tool (bash) so the ask→deny round-trip actually prompts
• test_live_allow_fails_closed_after_exact_action_hash_tamper · function · L452-L507 — def test_live_allow_fails_closed_after_exact_action_hash_tamper(tmp_path)
• test_live_allow_after_deadline_commits_timeout_before_resolved_event · function · L510-L565 — def test_live_allow_after_deadline_commits_timeout_before_resolved_event(tmp_path)
• emit · function · L516-L521 — def emit(event)
• test_live_resolution_remains_in_flight_until_durable_commit · function · L568-L641 — def test_live_resolution_remains_in_flight_until_durable_commit(tmp_path, monkeypatch)
• delayed_resolve · function · L593-L596 — def delayed_resolve(args, *kwargs)
• test_broker_cancel_denies_pending · function · L644-L670 — def test_broker_cancel_denies_pending(tmp_path)
• run · function · L651-L654 — def run()
• test_durable_pending_request_survives_broker_restart_and_can_be_resolved · function · L673-L715 — def test_durable_pending_request_survives_broker_restart_and_can_be_resolved(tmp_path)
• test_broker_rejects_non_boolean_allow_without_resolving · function · L719-L741 — def test_broker_rejects_non_boolean_allow_without_resolving(tmp_path, invalid_allow)
• test_restart_approval_requires_fresh_turn_and_never_replays_arguments · function · L744-L925 — def test_restart_approval_requires_fresh_turn_and_never_replays_arguments(tmp_path)
• test_restart_resolution_scopes_rule_and_rejects_cross_frame_decision · function · L928-L978 — def test_restart_resolution_scopes_rule_and_rejects_cross_frame_decision(tmp_path)
• test_racing_restart_retry_cannot_escalate_once_to_global · function · L981-L1048 — def test_racing_restart_retry_cannot_escalate_once_to_global(tmp_path)
• StaleGlobalView · class · L996-L1007 — class StaleGlobalView
• getattr · method · L997-L998 — def getattr(self, name)
• get_permission_request · method · L1000-L1003 — def get_permission_request(self, decision_id)
• resolve_permission_request · method · L1005-L1007 — def resolve_permission_request(self, args, *kwargs)
• global_retry · function · L1012-L1022 — def global_retry()
• test_suggest_patterns_generalizes · function · L1051-L1056 — def test_suggest_patterns_generalizes()
• _dispatcher · function · L1060-L1068 — def _dispatcher(tmp_path)
• _wait_ask · function · L1071-L1077 — def _wait_ask(events)
• test_dispatcher_skips_wider_file_inventory_when_stage7_is_disabled · function · L1080-L1098 — def test_dispatcher_skips_wider_file_inventory_when_stage7_is_disabled( tmp_path, monkeypatch )
• unexpected_wider_inventory · function · L1088-L1089 — def unexpected_wider_inventory()
• test_dispatcher_passes_web_download_destination_separately_from_domain · function · L1101-L1126 — def test_dispatcher_passes_web_download_destination_separately_from_domain( tmp_path, monkeypatch )
• CapturingBroker · class · L1109-L1112 — class CapturingBroker
• gate · method · L1110-L1112 — def gate(self, **kwargs)
• test_dispatcher_reports_default_recursive_search_scope_to_permission_card · function · L1129-L1149 — def test_dispatcher_reports_default_recursive_search_scope_to_permission_card( tmp_path, monkeypatch )
• CapturingBroker · class · L1137-L1140 — class CapturingBroker
• gate · method · L1138-L1140 — def gate(self, **kwargs)
• test_dispatcher_guardian_denies_unattended_credential_path · function · L1152-L1197 — def test_dispatcher_guardian_denies_unattended_credential_path(tmp_path, monkeypatch)
• test_dispatcher_uses_durable_auto_reviewer_for_credential_aliases · function · L1200-L1238 — def test_dispatcher_uses_durable_auto_reviewer_for_credential_aliases( tmp_path, monkeypatch )
• test_dispatcher_gate_denies_write_file_soft_fail · function · L1241-L1271 — def test_dispatcher_gate_denies_write_file_soft_fail(tmp_path): # bash is no longer a host method (shell runs kernel-local); write_file — # pinned to 'ask' for this conversation — exercises the same deny path.
• test_dispatcher_gate_allows_and_runs_write_file · function · L1274-L1301 — def test_dispatcher_gate_allows_and_runs_write_file(tmp_path)
• test_dispatcher_permission_carries_exact_action_attribution · function · L1304-L1376 — def test_dispatcher_permission_carries_exact_action_attribution(tmp_path)
• run · function · L1331-L1342 — def run()
• test_new_control_tool_class_auto_routes_and_defaults_to_approval · function · L1379-L1432 — def test_new_control_tool_class_auto_routes_and_defaults_to_approval(tmp_path)
• ExtensionProbeTool · class · L1385-L1396 — class ExtensionProbeTool(Tool)
• execute · method · L1394-L1396 — def execute(self, context, arguments)
• test_control_tool_secret_guard_is_independent_of_approval · function · L1435-L1466 — def test_control_tool_secret_guard_is_independent_of_approval(tmp_path)
• UngatedSecretProbeTool · class · L1441-L1454 — class UngatedSecretProbeTool(Tool)
• execute · method · L1452-L1454 — def execute(self, context, arguments)
• test_plugin_tool_cannot_shadow_existing_non_control_host_method · function · L1469-L1489 — def test_plugin_tool_cannot_shadow_existing_non_control_host_method(tmp_path)
• CredentialShadowTool · class · L1473-L1480 — class CredentialShadowTool(Tool)
• execute · method · L1479-L1480 — def execute(self, context, arguments)
• test_dispatcher_readonly_tool_not_gated_by_default · function · L1492-L1502 — def test_dispatcher_readonly_tool_not_gated_by_default(tmp_path): # glob is seeded 'allow', so a read-only tool must NOT emit a prompt.
• test_deny_is_absolute_over_broader_scope_allow · function · L1506-L1525 — def test_deny_is_absolute_over_broader_scope_allow(tmp_path): # a conversation 'deny bash ' must beat a broader-scope specific 'allow git '
• test_exact_literal_pattern_with_metachars_matches_itself · function · L1528-L1545 — def test_exact_literal_pattern_with_metachars_matches_itself(tmp_path)
• test_reset_restores_modified_default_decision · function · L1548-L1555 — def test_reset_restores_modified_default_decision(tmp_path)
• test_exec_background_gate_target_is_the_code · function · L1558-L1561 — def test_exec_background_gate_target_is_the_code()
• test_control_tool_gate_targets_preserve_missing_argument_defaults · function · L1564-L1571 — def test_control_tool_gate_targets_preserve_missing_argument_defaults()
• test_is_secret_path_case_insensitive · function · L1574-L1579 — def test_is_secret_path_case_insensitive()
• test_secret_file_read_hard_denied_without_prompt · function · L1582-L1592 — def test_secret_file_read_hard_denied_without_prompt(tmp_path): # read_file .env is blocked by the hard guard BEFORE the rule engine / prompt
• test_grep_and_glob_skip_secret_files · function · L1595-L1603 — def test_grep_and_glob_skip_secret_files(tmp_path)
• test_agent_query_cannot_read_settings_secret · function · L1610-L1622 — def test_agent_query_cannot_read_settings_secret(tmp_path): # A secret persisted under settings (the gateway stores the live API key # there) must not be reachable through host.query. The handler raises # PermissionError, which the worker turns into the soft-fail RuntimeError the # agent sees; the secret never appears in the error.
• test_credentials_set_secret_never_in_host_call_log · function · L1625-L1646 — def test_credentials_set_secret_never_in_host_call_log(tmp_path): # Explicitly authorize this synthetic credential write; headless ask # now fails closed. Its plaintext must never reach the host_call_log.
• test_recorder_never_tapes_credentials_set · function · L1649-L1676 — def test_recorder_never_tapes_credentials_set(tmp_path): # The replay-tape recorder must skip SECRET_ARG_HOST_CALLS: an exported # notebook tape must never carry a plaintext credential.
• test_every_decision_refusal_carries_a_code_the_gateway_can_map · function · L1682-L1705 — def test_every_decision_refusal_carries_a_code_the_gateway_can_map()
• test_a_foreign_decision_is_not_distinguishable_from_a_missing_one · function · L1708-L1714 — def test_a_foreign_decision_is_not_distinguishable_from_a_missing_one()
• test_the_recorded_but_uncontinued_refusal_marks_its_output_committed · function · L1717-L1742 — def test_the_recorded_but_uncontinued_refusal_marks_its_output_committed()
• _unattended_gate_env · function · L1745-L1763 — def _unattended_gate_env(monkeypatch, tmp_path)
• test_the_real_gate_auto_approves_only_read_only_actions · function · L1766-L1814 — def test_the_real_gate_auto_approves_only_read_only_actions(monkeypatch, tmp_path)
• gate · function · L1779-L1793 — def gate(tool, target, side_effect, dangerous=False)
• test_an_enabled_guardian_exception_never_falls_back_to_legacy_allow · function · L1817-L1843 — def test_an_enabled_guardian_exception_never_falls_back_to_legacy_allow( monkeypatch, tmp_path )
• broken_guardian · function · L1825-L1826 — def broken_guardian(_args, *_kwargs)
• test_the_real_gate_honours_import_quarantine_over_the_environment · function · L1846-L1871 — def test_the_real_gate_honours_import_quarantine_over_the_environment( monkeypatch, tmp_path )
• gate · function · L1854-L1866 — def gate(frame_id)
• test_guardian_hard_deny_does_not_read_a_filename_as_a_hostname · function · L1874-L1906 — def test_guardian_hard_deny_does_not_read_a_filename_as_a_hostname( tmp_path, monkeypatch )
• _web_session · function · L1909-L1919 — def _web_session(monkeypatch, tmp_path, selection)
• test_a_web_session_on_auto_review_is_adjudicated_not_parked · function · L1922-L1962 — def test_a_web_session_on_auto_review_is_adjudicated_not_parked(monkeypatch, tmp_path)
• gate · function · L1932-L1946 — def gate(method, target, side_effect)
• test_a_web_session_on_user_still_raises_the_approval_card · function · L1965-L1994 — def test_a_web_session_on_user_still_raises_the_approval_card(monkeypatch, tmp_path)
• run · function · L1974-L1984 — def run()
• test_guardian_audit_and_breaker_reconstruct_from_durable_rows · function · L1997-L2139 — def test_guardian_audit_and_breaker_reconstruct_from_durable_rows(tmp_path)
• Budgets · class · L2002-L2005 — class Budgets
• GuardianConfig · class · L2007-L2013 — class GuardianConfig
• emit · function · L2048-L2063 — def emit(event)
• test_guardian_audit_completion_failure_denies_without_guessing_audit_id · function · L2142-L2241 — def test_guardian_audit_completion_failure_denies_without_guessing_audit_id( tmp_path, monkeypatch )
• GuardianConfig · class · L2149-L2166 — class GuardianConfig
• fail_completion · function · L2201-L2202 — def fail_completion(_args, *_kwargs)