From 1025540fcc2a69609a0131a7168300205656d728 Mon Sep 17 00:00:00 2001 From: Kit Langton Date: Sat, 6 Jun 2026 21:58:41 -0400 Subject: [PATCH] test(core): cover managed output read permissions (#31166) --- packages/core/test/permission.test.ts | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/packages/core/test/permission.test.ts b/packages/core/test/permission.test.ts index 6e91da1af6..ebe06400e9 100644 --- a/packages/core/test/permission.test.ts +++ b/packages/core/test/permission.test.ts @@ -161,6 +161,21 @@ describe("PermissionV2", () => { }), ) + it.effect("allows managed output reads without granting external directory access", () => + Effect.gen(function* () { + yield* setup([ + { action: "*", resource: "*", effect: "deny" }, + { action: "read", resource: "*", effect: "allow" }, + ]) + const service = yield* PermissionV2.Service + + expect(yield* service.ask(assertion({ resources: ["tool_123"] }))).toMatchObject({ effect: "allow" }) + expect( + yield* service.ask(assertion({ action: "external_directory", resources: ["/tmp/tool-output/*"] })), + ).toMatchObject({ effect: "deny" }) + }), + ) + it.effect("uses build permissions when the Session agent is omitted", () => Effect.gen(function* () { yield* setup()