52 lines
1.7 KiB
TypeScript
52 lines
1.7 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { evaluatePolicy } from './policy-engine'
|
|
import { getAgentProfileById, getResourceManifestById } from './resource-pool'
|
|
|
|
function mustGetAgent(agentId: string) {
|
|
const agent = getAgentProfileById(agentId)
|
|
if (!agent) {
|
|
throw new Error(`Missing agent profile: ${agentId}`)
|
|
}
|
|
return agent
|
|
}
|
|
|
|
function mustGetResource(resourceId: string) {
|
|
const resource = getResourceManifestById(resourceId)
|
|
if (!resource) {
|
|
throw new Error(`Missing resource manifest: ${resourceId}`)
|
|
}
|
|
return resource
|
|
}
|
|
|
|
describe('agent-os policy engine', () => {
|
|
it('denies git push command by command rule', () => {
|
|
const agent = mustGetAgent('agent.orchestrator.core')
|
|
const resource = mustGetResource('tool.shell.exec')
|
|
|
|
const result = evaluatePolicy(agent, resource, { command: 'git push origin main' })
|
|
|
|
expect(result.effect).toBe('deny')
|
|
expect(result.reasons.some((reason) => reason.includes('command_rule'))).toBe(true)
|
|
})
|
|
|
|
it('denies .env reads by path rule', () => {
|
|
const agent = mustGetAgent('agent.orchestrator.core')
|
|
const resource = mustGetResource('tool.fs.read')
|
|
|
|
const result = evaluatePolicy(agent, resource, { paths: ['/tmp/.env.local'] })
|
|
|
|
expect(result.effect).toBe('deny')
|
|
expect(result.reasons.some((reason) => reason.includes('path_rule'))).toBe(true)
|
|
})
|
|
|
|
it('degrades repeated calls via doom loop guard', () => {
|
|
const agent = mustGetAgent('agent.discovery.scout')
|
|
const resource = mustGetResource('tool.web.read')
|
|
|
|
const result = evaluatePolicy(agent, resource, { repeatedCallCount: 5 })
|
|
|
|
expect(result.effect).toBe('deny')
|
|
expect(result.reasons.some((reason) => reason.includes('doom_loop'))).toBe(true)
|
|
})
|
|
})
|