v2.9.4 (#669)

Co-authored-by: Clément Drouin <clement.drouin@mistral.ai>
Co-authored-by: Jean-Baptiste Muscat <jeanbaptiste.muscatdupuis@mistral.ai>
Co-authored-by: JeroenvdV <JeroenvdV@users.noreply.github.com>
Co-authored-by: Kim-Adeline Miguel <51720070+kimadeline@users.noreply.github.com>
Co-authored-by: Mathias Gesbert <mathias.gesbert@mistral.ai>
Co-authored-by: Paul Cacheux <paul.cacheux@mistral.ai>
Co-authored-by: Pierre Rossinès <pierre.rossines@mistral.ai>
Co-authored-by: Simon Van de Kerckhove <simon.vandekerckhove@mistral.ai>
Co-authored-by: Val <102326092+vdeva@users.noreply.github.com>
Co-authored-by: Vincent G <10739306+VinceOPS@users.noreply.github.com>
Co-authored-by: allansimon-mistral <allan.simon@ext.mistral.ai>
Co-authored-by: Mistral Vibe <vibe@mistral.ai>

tests/test_approve_always_permanent.py

@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+from pathlib import Path
+import tomllib
+
+from tests.conftest import build_test_agent_loop, build_test_vibe_config
+from vibe.core.tools.permissions import PermissionScope, RequiredPermission
+
+
+def _read_persisted_config(config_dir: Path) -> dict:
+    config_file = config_dir / "config.toml"
+    with config_file.open("rb") as f:
+        return tomllib.load(f)
+
+
+class TestApproveAlwaysPermanentNoGranularPermissions:
+    def test_sets_tool_permission_always_in_config(self, config_dir: Path):
+        agent = build_test_agent_loop()
+
+        agent.approve_always("bash", None, save_permanently=True)
+
+        persisted = _read_persisted_config(config_dir)
+        assert persisted["tools"]["bash"]["permission"] == "always"
+
+    def test_session_only_does_not_persist(self, config_dir: Path):
+        agent = build_test_agent_loop()
+
+        agent.approve_always("bash", None, save_permanently=False)
+
+        assert agent.config.tools["bash"]["permission"] == "always"
+        persisted = _read_persisted_config(config_dir)
+        assert "bash" not in persisted.get("tools", {})
+
+
+class TestApproveAlwaysPermanentWithGranularPermissions:
+    def _make_permissions(self) -> list[RequiredPermission]:
+        return [
+            RequiredPermission(
+                scope=PermissionScope.COMMAND_PATTERN,
+                invocation_pattern="npm install foo",
+                session_pattern="npm install *",
+                label="npm install *",
+            )
+        ]
+
+    def test_persists_allowlist_to_config(self, config_dir: Path):
+        agent = build_test_agent_loop()
+        perms = self._make_permissions()
+
+        agent.approve_always("bash", perms, save_permanently=True)
+
+        persisted = _read_persisted_config(config_dir)
+        assert persisted["tools"]["bash"]["allowlist"] == ["npm install *"]
+
+    def test_also_adds_session_rules(self, config_dir: Path):
+        agent = build_test_agent_loop()
+        perms = self._make_permissions()
+
+        agent.approve_always("bash", perms, save_permanently=True)
+
+        assert len(agent._session_rules) == 1
+        rule = agent._session_rules[0]
+        assert rule.tool_name == "bash"
+        assert rule.scope == PermissionScope.COMMAND_PATTERN
+        assert rule.session_pattern == "npm install *"
+
+    def test_session_only_does_not_persist_allowlist(self, config_dir: Path):
+        agent = build_test_agent_loop()
+        perms = self._make_permissions()
+
+        agent.approve_always("bash", perms, save_permanently=False)
+
+        assert len(agent._session_rules) == 1
+        persisted = _read_persisted_config(config_dir)
+        assert "bash" not in persisted.get("tools", {})
+
+    def test_does_not_duplicate_existing_allowlist_entries(self, config_dir: Path):
+        config = build_test_vibe_config(
+            tools={"bash": {"allowlist": ["npm install *"]}}
+        )
+        agent = build_test_agent_loop(config=config)
+        perms = self._make_permissions()
+
+        agent.approve_always("bash", perms, save_permanently=True)
+
+        persisted = _read_persisted_config(config_dir)
+        # Pattern already existed -- nothing new should be written
+        assert persisted.get("tools", {}).get("bash", {}).get("allowlist") is None
+
+    def test_appends_new_patterns_to_existing_allowlist(self, config_dir: Path):
+        config = build_test_vibe_config(tools={"bash": {"allowlist": ["git *"]}})
+        agent = build_test_agent_loop(config=config)
+        perms = self._make_permissions()
+
+        agent.approve_always("bash", perms, save_permanently=True)
+
+        persisted = _read_persisted_config(config_dir)
+        assert persisted["tools"]["bash"]["allowlist"] == ["git *", "npm install *"]
+
+    def test_multiple_permissions_persisted(self, config_dir: Path):
+        agent = build_test_agent_loop()
+        perms = [
+            RequiredPermission(
+                scope=PermissionScope.COMMAND_PATTERN,
+                invocation_pattern="npm install foo",
+                session_pattern="npm install *",
+                label="npm install *",
+            ),
+            RequiredPermission(
+                scope=PermissionScope.OUTSIDE_DIRECTORY,
+                invocation_pattern="/tmp/newdir",
+                session_pattern="/tmp/*",
+                label="/tmp/*",
+            ),
+        ]
+
+        agent.approve_always("bash", perms, save_permanently=True)
+
+        persisted = _read_persisted_config(config_dir)
+        assert persisted["tools"]["bash"]["allowlist"] == ["/tmp/*", "npm install *"]