refactor: extract execution permission policy

tests/dispatch-plan-confirmation.test.ts

@@ -17,6 +17,7 @@ let isDispatchableThreadProject: (typeof import("../src/lib/boss-data"))["isDisp
 let readState: (typeof import("../src/lib/boss-data"))["readState"];
 let writeState: (typeof import("../src/lib/boss-data"))["writeState"];
 let AUTH_SESSION_COOKIE = "";
+let baseState: Awaited<ReturnType<typeof import("../src/lib/boss-data")["readState"]>>;
 
 async function setup() {
   if (runtimeRoot) {
@@ -47,6 +48,7 @@ async function setup() {
   isDispatchableThreadProject = data.isDispatchableThreadProject;
   readState = data.readState;
   writeState = data.writeState;
+  baseState = structuredClone(await readState());
   AUTH_SESSION_COOKIE = auth.AUTH_SESSION_COOKIE;
 }
 
@@ -56,6 +58,11 @@ test.after(async () => {
   }
 });
 
+test.beforeEach(async () => {
+  await setup();
+  await writeState(structuredClone(baseState));
+});
+
 async function createAuthedRequest(url: string, method: "GET" | "POST", body?: unknown) {
   const session = await createAuthSession({
     account: "17600003315",

tests/execution-permission-policy.test.ts

@@ -0,0 +1,22 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { evaluatePermissionPolicyForTesting } from "@/lib/execution/permission-policy";
+
+test("approval_required 群聊在已有待确认推荐时拒绝继续直接执行", () => {
+  const result = evaluatePermissionPolicyForTesting({
+    project: {
+      id: "group-1",
+      isGroup: true,
+      collaborationMode: "approval_required",
+      approvalState: "pending_user",
+    },
+    hasPendingDispatchPlan: true,
+  });
+
+  assert.equal(result.allowed, false);
+  assert.equal(result.requiresApproval, true);
+  assert.match(result.reason ?? "", /等待确认/);
+  assert.deepEqual(result.toolPolicy.allowedTools, ["group_dispatch_plan"]);
+  assert.deepEqual(result.toolPolicy.deniedTools, ["dispatch_execution"]);
+  assert.equal(result.collaborationPolicy.canDispatchDirectly, false);
+});

tests/group-message-dispatch-plan.test.ts

@@ -12,6 +12,7 @@ let createIndependentGroupChat: (typeof import("../src/lib/boss-data"))["createI
 let readState: (typeof import("../src/lib/boss-data"))["readState"];
 let writeState: (typeof import("../src/lib/boss-data"))["writeState"];
 let AUTH_SESSION_COOKIE: string;
+let baseState: Awaited<ReturnType<typeof import("../src/lib/boss-data")["readState"]>>;
 
 async function setup() {
   if (runtimeRoot) {
@@ -33,6 +34,7 @@ async function setup() {
   createIndependentGroupChat = data.createIndependentGroupChat;
   readState = data.readState;
   writeState = data.writeState;
+  baseState = structuredClone(await readState());
   AUTH_SESSION_COOKIE = auth.AUTH_SESSION_COOKIE;
 }
 
@@ -42,6 +44,11 @@ test.after(async () => {
   }
 });
 
+test.beforeEach(async () => {
+  await setup();
+  await writeState(structuredClone(baseState));
+});
+
 async function createAuthedRequest(projectId: string, body: { body: string; kind?: string }) {
   const session = await createAuthSession({
     account: "17600003315",