1+// Policy doctor metadata tests cover rule metadata.
2+import { describe, expect, it } from "vitest";
3+import { POLICY_RULE_METADATA, type PolicyRuleMetadata } from "./metadata.js";
4+5+describe("policy doctor metadata", () => {
6+it("describes strictness for agent-scoped policy fields", () => {
7+expect(
8+(POLICY_RULE_METADATA as readonly PolicyRuleMetadata[])
9+.filter(
10+(rule) =>
11+rule.scopeSelectors?.includes("agentIds") ||
12+rule.scopeSelectors?.includes("channelIds"),
13+)
14+.map((rule) => {
15+const description: {
16+path: string;
17+strictness: PolicyRuleMetadata["strictness"];
18+selectors: PolicyRuleMetadata["scopeSelectors"];
19+emptyList?: PolicyRuleMetadata["emptyList"];
20+} = {
21+path: rule.policyPath.join("."),
22+strictness: rule.strictness,
23+selectors: rule.scopeSelectors,
24+};
25+if (rule.emptyList !== undefined) {
26+description.emptyList = rule.emptyList;
27+}
28+return description;
29+}),
30+).toEqual([
31+{
32+path: "agents.workspace.allowedAccess",
33+strictness: "allowlist-subset",
34+emptyList: "disabled",
35+selectors: ["agentIds"],
36+},
37+{
38+path: "agents.workspace.denyTools",
39+strictness: "denylist-superset",
40+selectors: ["agentIds"],
41+},
42+{
43+path: "tools.profiles.allow",
44+strictness: "allowlist-subset",
45+emptyList: "disabled",
46+selectors: ["agentIds"],
47+},
48+{
49+path: "tools.fs.requireWorkspaceOnly",
50+strictness: "requires-true",
51+selectors: ["agentIds"],
52+},
53+{
54+path: "tools.exec.allowSecurity",
55+strictness: "allowlist-subset",
56+emptyList: "disabled",
57+selectors: ["agentIds"],
58+},
59+{
60+path: "tools.exec.requireAsk",
61+strictness: "allowlist-subset",
62+emptyList: "disabled",
63+selectors: ["agentIds"],
64+},
65+{
66+path: "tools.exec.allowHosts",
67+strictness: "allowlist-subset",
68+emptyList: "disabled",
69+selectors: ["agentIds"],
70+},
71+{ path: "tools.elevated.allow", strictness: "requires-false", selectors: ["agentIds"] },
72+{
73+path: "tools.alsoAllow.expected",
74+strictness: "exact-list",
75+emptyList: "meaningful",
76+selectors: ["agentIds"],
77+},
78+{ path: "tools.denyTools", strictness: "denylist-superset", selectors: ["agentIds"] },
79+{
80+path: "sandbox.requireMode",
81+strictness: "allowlist-subset",
82+emptyList: "disabled",
83+selectors: ["agentIds"],
84+},
85+{
86+path: "sandbox.allowBackends",
87+strictness: "allowlist-subset",
88+emptyList: "disabled",
89+selectors: ["agentIds"],
90+},
91+{
92+path: "sandbox.containers.denyHostNetwork",
93+strictness: "requires-true",
94+selectors: ["agentIds"],
95+},
96+{
97+path: "sandbox.containers.denyContainerNamespaceJoin",
98+strictness: "requires-true",
99+selectors: ["agentIds"],
100+},
101+{
102+path: "sandbox.containers.requireReadOnlyMounts",
103+strictness: "requires-true",
104+selectors: ["agentIds"],
105+},
106+{
107+path: "sandbox.containers.denyContainerRuntimeSocketMounts",
108+strictness: "requires-true",
109+selectors: ["agentIds"],
110+},
111+{
112+path: "sandbox.containers.denyUnconfinedProfiles",
113+strictness: "requires-true",
114+selectors: ["agentIds"],
115+},
116+{
117+path: "sandbox.browser.requireCdpSourceRange",
118+strictness: "requires-true",
119+selectors: ["agentIds"],
120+},
121+{
122+path: "ingress.channels.allowDmPolicies",
123+strictness: "allowlist-subset",
124+emptyList: "disabled",
125+selectors: ["channelIds"],
126+},
127+{
128+path: "ingress.channels.denyOpenGroups",
129+strictness: "requires-true",
130+selectors: ["channelIds"],
131+},
132+{
133+path: "ingress.channels.requireMentionInGroups",
134+strictness: "requires-true",
135+selectors: ["channelIds"],
136+},
137+{
138+path: "dataHandling.memory.denySessionTranscriptIndexing",
139+strictness: "requires-true",
140+selectors: ["agentIds"],
141+},
142+{
143+path: "execApprovals.agents.allowSecurity",
144+strictness: "allowlist-subset",
145+emptyList: "disabled",
146+selectors: ["agentIds"],
147+},
148+{
149+path: "execApprovals.agents.allowAutoAllowSkills",
150+strictness: "requires-false",
151+selectors: ["agentIds"],
152+},
153+{
154+path: "execApprovals.agents.allowlist.expected",
155+strictness: "exact-list",
156+emptyList: "meaningful",
157+selectors: ["agentIds"],
158+},
159+]);
160+});
161+});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。