shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(coding-agent): avoid project trust prompt for update (#5674)

Browse Source
This commit is contained in:
Armin Ronacher
2026-06-12 23:37:16 +02:00
committed by GitHub
parent a7cdc679e7
commit b4bff7f0d0
15 changed files with 185 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
packages/coding-agent/test/package-command-paths.test.ts
View File

@@ -1,4 +1,4 @@
import { mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -202,6 +202,69 @@ describe("package commands", () => {
}
});
it("does not prompt or ask extensions for project trust during update", async () => {
mkdirSync(join(projectDir, ".pi"), { recursive: true });
writeFileSync(join(agentDir, "settings.json"), JSON.stringify({ defaultProjectTrust: "always" }));
const fakeNpmPath = join(tempDir, "fake-project-npm.cjs");
const recordPath = join(tempDir, "project-update.json");
writeFileSync(
fakeNpmPath,
`const fs=require("node:fs");fs.writeFileSync(${JSON.stringify(recordPath)},JSON.stringify(process.argv.slice(2)));`,
);
writeFileSync(
join(projectDir, ".pi", "settings.json"),
JSON.stringify({ packages: ["npm:fake-package"], npmCommand: [originalExecPath, fakeNpmPath] }),
);
let projectTrustCalled = false;
const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
try {
await expect(
main(["update", "--extensions"], {
extensionFactories: [
(pi) => {
pi.on("project_trust", () => {
projectTrustCalled = true;
return { trusted: "yes" };
});
},
],
}),
).resolves.toBeUndefined();
expect(projectTrustCalled).toBe(false);
expect(existsSync(recordPath)).toBe(false);
expect(process.exitCode).toBeUndefined();
} finally {
logSpy.mockRestore();
}
});
it("uses saved project trust during update", async () => {
mkdirSync(join(projectDir, ".pi"), { recursive: true });
const fakeNpmPath = join(tempDir, "fake-trusted-project-npm.cjs");
const recordPath = join(tempDir, "trusted-project-update.json");
writeFileSync(
fakeNpmPath,
`const fs=require("node:fs");fs.writeFileSync(${JSON.stringify(recordPath)},JSON.stringify(process.argv.slice(2)));`,
);
writeFileSync(
join(projectDir, ".pi", "settings.json"),
JSON.stringify({ packages: ["npm:fake-package"], npmCommand: [originalExecPath, fakeNpmPath] }),
);
new ProjectTrustStore(agentDir).set(projectDir, true);
const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
try {
await expect(main(["update", "--extensions"])).resolves.toBeUndefined();
expect(existsSync(recordPath)).toBe(true);
expect(process.exitCode).toBeUndefined();
} finally {
logSpy.mockRestore();
}
});
it("lets trust.json override default project trust", async () => {
mkdirSync(join(projectDir, ".pi"), { recursive: true });
writeFileSync(join(agentDir, "settings.json"), JSON.stringify({ defaultProjectTrust: "always" }));
@@ -223,6 +286,7 @@ describe("package commands", () => {
it("blocks local package changes when project is untrusted", async () => {
mkdirSync(join(projectDir, ".pi"), { recursive: true });
writeFileSync(join(projectDir, ".pi", "settings.json"), "{}");
const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
try {

2
packages/coding-agent/test/resource-loader.test.ts
View File

@@ -376,7 +376,7 @@ Content`,
expect(loader.getSystemPrompt()).toBe("You are a helpful assistant.");
});
it("should skip trust-gated project resources when project is not trusted", async () => {
it("should skip project resources that require trust when project is not trusted", async () => {
const piDir = join(cwd, ".pi");
const extensionsDir = join(piDir, "extensions");
const skillDir = join(piDir, "skills", "project-skill");

108
packages/coding-agent/test/trust-manager.test.ts
View File

@@ -1,13 +1,8 @@
import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
import { mkdirSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterEach, beforeEach, describe, expect, it } from "vitest";
import {
getProjectTrustPath,
hasProjectConfigDir,
hasProjectTrustInputs,
ProjectTrustStore,
} from "../src/core/trust-manager.ts";
import { hasTrustRequiringProjectResources, ProjectTrustStore } from "../src/core/trust-manager.ts";
describe("ProjectTrustStore", () => {
let tempDir: string;
@@ -26,86 +21,47 @@ describe("ProjectTrustStore", () => {
rmSync(tempDir, { recursive: true, force: true });
});
it("stores decisions per cwd", () => {
const store = new ProjectTrustStore(agentDir);
expect(store.get(cwd)).toBeNull();
expect(store.getEntry(cwd)).toBeNull();
store.set(cwd, true);
expect(store.get(cwd)).toBe(true);
expect(store.getEntry(cwd)).toEqual({ path: getProjectTrustPath(cwd), decision: true });
store.set(cwd, false);
expect(store.get(cwd)).toBe(false);
expect(store.getEntry(cwd)).toEqual({ path: getProjectTrustPath(cwd), decision: false });
store.set(cwd, null);
expect(store.get(cwd)).toBeNull();
expect(store.getEntry(cwd)).toBeNull();
});
it("inherits the closest saved decision from parent directories", () => {
const store = new ProjectTrustStore(agentDir);
const parentDir = join(tempDir, "trusted-parent");
const childDir = join(parentDir, "project");
const grandchildDir = join(childDir, "nested");
mkdirSync(grandchildDir, { recursive: true });
store.set(parentDir, true);
expect(store.get(childDir)).toBe(true);
expect(store.getEntry(childDir)).toEqual({ path: getProjectTrustPath(parentDir), decision: true });
expect(store.get(grandchildDir)).toBe(true);
expect(store.getEntry(grandchildDir)).toEqual({ path: getProjectTrustPath(parentDir), decision: true });
store.set(childDir, false);
expect(store.get(grandchildDir)).toBe(false);
expect(store.getEntry(grandchildDir)).toEqual({ path: getProjectTrustPath(childDir), decision: false });
});
it("can clear a child override to inherit parent trust", () => {
it("stores decisions and inherits from parent directories", () => {
const store = new ProjectTrustStore(agentDir);
const parentDir = join(tempDir, "trusted-parent");
const childDir = join(parentDir, "project");
mkdirSync(childDir, { recursive: true });
expect(store.get(childDir)).toBeNull();
store.set(parentDir, true);
store.set(childDir, false);
expect(store.getEntry(childDir)).toEqual({ path: getProjectTrustPath(childDir), decision: false });
store.setMany([
{ path: parentDir, decision: true },
{ path: childDir, decision: null },
]);
expect(store.get(childDir)).toBe(true);
expect(store.getEntry(childDir)).toEqual({ path: getProjectTrustPath(parentDir), decision: true });
store.set(childDir, false);
expect(store.get(childDir)).toBe(false);
store.set(childDir, null);
expect(store.get(childDir)).toBe(true);
});
it("fails loudly without overwriting malformed trust stores", () => {
const trustPath = join(agentDir, "trust.json");
writeFileSync(trustPath, "{not json", "utf-8");
const store = new ProjectTrustStore(agentDir);
it("detects trust-requiring project resources", () => {
const originalHome = process.env.HOME;
process.env.HOME = tempDir;
try {
mkdirSync(join(tempDir, ".pi", "agent"), { recursive: true });
mkdirSync(join(tempDir, ".agents", "skills"), { recursive: true });
expect(hasTrustRequiringProjectResources(tempDir)).toBe(false);
expect(hasTrustRequiringProjectResources(cwd)).toBe(false);
expect(() => store.get(cwd)).toThrow(/Failed to read trust store/);
expect(() => store.set(cwd, true)).toThrow(/Failed to read trust store/);
expect(readFileSync(trustPath, "utf-8")).toBe("{not json");
});
writeFileSync(join(tempDir, ".pi", "settings.json"), "{}");
expect(hasTrustRequiringProjectResources(tempDir)).toBe(true);
rmSync(join(tempDir, ".pi", "settings.json"), { force: true });
it("detects project trust inputs", () => {
expect(hasProjectConfigDir(cwd)).toBe(false);
expect(hasProjectTrustInputs(cwd)).toBe(false);
mkdirSync(join(cwd, ".pi"), { recursive: true });
writeFileSync(join(cwd, ".pi", "settings.json"), "{}");
expect(hasTrustRequiringProjectResources(cwd)).toBe(true);
mkdirSync(join(cwd, ".pi"), { recursive: true });
expect(hasProjectConfigDir(cwd)).toBe(true);
expect(hasProjectTrustInputs(cwd)).toBe(true);
rmSync(join(cwd, ".pi"), { recursive: true, force: true });
writeFileSync(join(cwd, "AGENTS.md"), "Project instructions");
expect(hasProjectTrustInputs(cwd)).toBe(false);
rmSync(join(cwd, "AGENTS.md"), { force: true });
writeFileSync(join(cwd, "CLAUDE.md"), "Legacy project instructions");
expect(hasProjectTrustInputs(cwd)).toBe(false);
rmSync(join(cwd, "CLAUDE.md"), { force: true });
mkdirSync(join(cwd, ".agents", "skills"), { recursive: true });
expect(hasProjectTrustInputs(cwd)).toBe(true);
rmSync(join(cwd, ".pi"), { recursive: true, force: true });
mkdirSync(join(cwd, ".agents", "skills"), { recursive: true });
expect(hasTrustRequiringProjectResources(cwd)).toBe(true);
} finally {
if (originalHome === undefined) {
delete process.env.HOME;
} else {
process.env.HOME = originalHome;
}
}
});
});