M0: compilable skeleton — Kigi 0.1.0 fork surgery

Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an unofficial Kimi Code CLI community build. Rename & identity - 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin -> kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical); ptyctl, ptyctl-cli, third_party/ unchanged; proto package xai.grok.tools.v1 -> kigi.tools.v1 - Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* -> KIGI_*, `kigi --version` carries the unofficial-community-build notice - clap identity, help text, startup banner, prompt templates rebranded (templates re-encrypted) Deletions (PRD removal list #5/#6/#7/#9/#10) - voice input (xai-grok-voice) and all TUI wiring - telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers, trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload module & dc_log, heap-profile uploader, auth-diagnostics uploader, session-analytics halves of feedback; local zero-egress observability preserved in new kigi-log crate (unified log, --debug firehose, subsystem file logs, opt-in instrumentation) - announcements (crate, remote-settings fields, TUI surfaces) - plugin marketplace (crate, sources/browse/CTA/extensions-modal tab); direct plugin install/uninstall/update via kigi-agent git_install kept - relay/gateway/assets endpoints and features (agent relay, headless relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now ~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation - functional types rehomed instead of deleted: PermissionMode -> kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource -> session signals, TerminalDiagnostics -> kigi-pager-render, agent_id -> shell util Endpoints - kigi-env rewritten: single production KigiEndpoints {coding_api_base_url https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted Toolchain & workspace hygiene - Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to workspace at 0.21 (Option->Result API migration), quick-xml 0.41 - Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by all members, members sorted, unused deps pruned - cargo-deny advisories gate (deny.toml with documented transitive exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux) - cross-crate test seams re-gated behind `test-support` cargo feature; insta snapshot baselines renamed to the kigi_tui prefix - clippy --workspace --all-targets: zero warnings; fmt clean Fixes surfaced by the port - updater probe/installer divergence (bin/kigi vs bin/grok symlink set) - idle model-metadata refresh dead under KIGI_CODE_BASE_URL override (new is_effective_coding_endpoint_url, loopback+override aware) - macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions, fast-worktree); RSS measurement tests serialized via serial_test Docs & legal (Apache §4) - NOTICE added (upstream attribution + change statement); THIRD-PARTY notices sustained; kigi-tools ported-code notices extended; README, CONTRIBUTING, SECURITY, AGENTS.md rewritten Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch, command parity, config import (M2), Computer Hub excision & final brand-token sweep (M2), distribution & self-update rewrite (M3).
2026-07-17 05:31:01 -04:00
commit d6c20fc13f
2612 changed files with 1353757 additions and 0 deletions
@@ -0,0 +1,498 @@
+//! Tool-permission emit: when the rules engine returns "ask" for a guarded
+//! tool, request the decision from chat over the server instead of prompting a
+//! local ACP client, then map chat's reply back onto a [`PromptOutcome`] so the
+//! manager's existing decision + `ALWAYS_*` persistence applies unchanged.
+use crate::permission::prompter::{PromptOutcome, tool_name_for_access};
+use crate::permission::types::AccessKind;
+use async_trait::async_trait;
+use kigi_computer_hub_sdk::harness::PERMISSION_REQUEST_KIND;
+use kigi_computer_hub_sdk::{ToolServer, WeakToolServer};
+use kigi_tool_protocol::SessionId;
+use prometheus::{HistogramVec, IntCounter, register_histogram_vec, register_int_counter};
+use serde_json::Value;
+use std::sync::LazyLock;
+/// Wall-clock time the workspace awaits chat's decision on a `permission_request`
+/// hook. `outcome` is `ok` (chat replied) or `error` (transport failure /
+/// backstop deadline).
+static PERMISSION_REPLY_DURATION: LazyLock<HistogramVec> = LazyLock::new(|| {
+    register_histogram_vec!(
+        "grok_workspace_permission_reply_seconds",
+        "Wall-clock time awaiting chat's reply to a permission_request hook",
+        &["outcome"],
+        vec![0.5, 1.0, 2.0, 5.0, 10.0, 30.0, 60.0, 120.0, 300.0, 600.0]
+    )
+    .expect("grok_workspace_permission_reply_seconds must register once")
+});
+/// Permission requests whose reply timed out (the server backstop deadline fired).
+/// A subset of the histogram's `error` outcome, promoted to its own counter so a
+/// stuck/lost reply is distinguishable from other transport failures.
+static PERMISSION_TIMEOUT_TOTAL: LazyLock<IntCounter> = LazyLock::new(|| {
+    register_int_counter!(
+        "grok_workspace_permission_timeout_total",
+        "permission_request hooks whose reply timed out (backstop deadline fired)"
+    )
+    .expect("grok_workspace_permission_timeout_total must register once")
+});
+/// Zero-init this module's metric families. See [`crate::init_metrics`].
+pub(crate) fn init_metrics() {
+    for outcome in ["ok", "error"] {
+        let _ = PERMISSION_REPLY_DURATION.with_label_values(&[outcome]);
+    }
+    PERMISSION_TIMEOUT_TOTAL.inc_by(0);
+}
+/// Identifies the reply backstop-deadline timeout by its rendered message; the
+/// server SDK exposes no typed timeout variant to match on. If that message text
+/// changes, such a reply is recorded under the histogram's `error` outcome but
+/// not counted in `permission_timeout_total`.
+fn is_timeout_err(msg: &str) -> bool {
+    msg.contains("timed out")
+}
+/// Env var that enables the HITL-live **tool-permission** emit (workspace →
+/// chat over the server) for local e2e and gradual rollout. Prefer server capability
+/// negotiation long-term; this is the interim gate so tool-permission can be
+/// exercised without waiting on that wire format.
+pub const HITL_PERMISSION_LIVE_ENV: &str = "KIGI_HITL_PERMISSION_LIVE";
+/// Whether the HITL-live permission path is enabled.
+///
+/// Intended long-term gate: the chat flag `grok_chat_enable_hitl_live_path`,
+/// propagated by the server at session-bind (capability negotiation). Until that
+/// lands, honor [`HITL_PERMISSION_LIVE_ENV`] (`1` / `true` / `yes`) so local
+/// stacks and e2e can turn the emit on explicitly. Default remains **off**
+/// (fail closed to the local ACP prompt).
+pub fn hitl_permission_live_enabled() -> bool {
+    match std::env::var(HITL_PERMISSION_LIVE_ENV) {
+        Ok(v) => {
+            matches!(
+                v.trim().to_ascii_lowercase().as_str(),
+                "1" | "true" | "yes" | "on"
+            )
+        }
+        Err(_) => false,
+    }
+}
+/// Sends a `permission_request` hook to chat and awaits the decision reply.
+#[async_trait]
+pub trait PermissionHookTransport: Send + Sync {
+    /// Emit the permission-request `payload` and return chat's decision reply.
+    async fn request_permission(&self, payload: Value) -> Result<Value, String>;
+}
+/// Hub-backed permission transport (weak server handle; upgrades per request).
+pub struct ToolServerPermissionTransport {
+    server: WeakToolServer,
+    session_id: SessionId,
+}
+impl ToolServerPermissionTransport {
+    pub fn new(server: ToolServer, session_id: SessionId) -> Self {
+        Self {
+            server: server.downgrade(),
+            session_id,
+        }
+    }
+    /// Build from a session id held as a string; `None` if it is not a valid
+    /// [`SessionId`].
+    pub fn from_session_id(server: ToolServer, session_id: &str) -> Option<Self> {
+        SessionId::new(session_id)
+            .ok()
+            .map(|sid| Self::new(server, sid))
+    }
+}
+#[async_trait]
+impl PermissionHookTransport for ToolServerPermissionTransport {
+    async fn request_permission(&self, payload: Value) -> Result<Value, String> {
+        let start = std::time::Instant::now();
+        let Some(server) = self.server.upgrade() else {
+            PERMISSION_REPLY_DURATION
+                .with_label_values(&["error"])
+                .observe(start.elapsed().as_secs_f64());
+            return Err("tool server gone (weak upgrade failed)".to_owned());
+        };
+        let raw = server
+            .request_hook(
+                self.session_id.clone(),
+                PERMISSION_REQUEST_KIND.to_owned(),
+                payload,
+            )
+            .await;
+        let outcome = match &raw {
+            Ok(_) => "ok",
+            Err(e) => {
+                if is_timeout_err(&e.to_string()) {
+                    PERMISSION_TIMEOUT_TOTAL.inc();
+                }
+                "error"
+            }
+        };
+        PERMISSION_REPLY_DURATION
+            .with_label_values(&[outcome])
+            .observe(start.elapsed().as_secs_f64());
+        raw.map_err(|e| e.to_string())
+    }
+}
+fn scope_for_access(access: &AccessKind) -> &'static str {
+    match access {
+        AccessKind::Bash(_) | AccessKind::Edit(_) | AccessKind::MCPTool { .. } => "write",
+        AccessKind::Read(_)
+        | AccessKind::Grep { .. }
+        | AccessKind::WebFetch(_)
+        | AccessKind::WebSearch(_) => "read",
+    }
+}
+fn describe_access(access: &AccessKind) -> String {
+    match access {
+        AccessKind::Bash(_) => "Run a terminal command".to_owned(),
+        AccessKind::Edit(path) => format!("Edit {path}"),
+        AccessKind::MCPTool { name, .. } => format!("Run MCP tool {name}"),
+        AccessKind::WebFetch(url) => format!("Fetch {url}"),
+        AccessKind::WebSearch(query) => format!("Search the web for {query}"),
+        AccessKind::Read(_) => "Read a file".to_owned(),
+        AccessKind::Grep { .. } => "Search file contents".to_owned(),
+    }
+}
+/// Build the server → chat `permission_request` payload. The field set matches
+/// chat's `PermissionRequestPayload` parser: `tool_call_id`, `tool_name`,
+/// `description`, `scope`, and the bash/edit context.
+pub(crate) fn build_permission_payload(access: &AccessKind, tool_call_id: &str) -> Value {
+    let mut payload = serde_json::json!(
+        { "tool_call_id" : tool_call_id, "tool_name" : tool_name_for_access(access),
+        "description" : describe_access(access), "scope" : scope_for_access(access), }
+    );
+    if let Some(map) = payload.as_object_mut() {
+        match access {
+            AccessKind::Bash(command) => {
+                map.insert("bash_command".to_owned(), Value::from(command.clone()));
+            }
+            AccessKind::Edit(path) => {
+                map.insert(
+                    "edit_file_paths".to_owned(),
+                    Value::from(vec![path.clone()]),
+                );
+            }
+            _ => {}
+        }
+    }
+    payload
+}
+/// Decode chat's decision reply onto a [`PromptOutcome`]. The reply is chat's
+/// `permission_answer_to_json` output: `{ "outcome", "scope"?, "followup_message"? }`.
+/// An unknown / `unspecified` outcome fails closed (reject).
+pub(crate) fn reply_to_outcome(reply: &Value) -> PromptOutcome {
+    let outcome = match reply.get("outcome") {
+        Some(Value::String(s)) => s.as_str(),
+        Some(Value::Number(n)) => match n.as_i64() {
+            Some(1) => "approve",
+            Some(2) => "reject",
+            Some(3) => "always_approve",
+            Some(4) => "always_reject",
+            _ => "",
+        },
+        _ => "",
+    };
+    let followup = reply
+        .get("followup_message")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty());
+    match outcome {
+        "approve" => PromptOutcome::AllowOnce,
+        "always_approve" => match scope_kind_value(reply) {
+            Some(("bash_command", Some(value))) => PromptOutcome::AllowAlwaysBashCommand(value),
+            Some(("server_prefix", Some(value))) => PromptOutcome::AllowAlwaysMcpServer(value),
+            Some(("domain", Some(value))) => PromptOutcome::AllowAlwaysDomain(value),
+            _ => PromptOutcome::AllowAlways,
+        },
+        "reject" => match followup {
+            Some(message) => PromptOutcome::FollowupMessage(message.to_owned()),
+            None => PromptOutcome::RejectOnce,
+        },
+        "always_reject" => match scope_kind_value(reply) {
+            Some(("bash_command", Some(value))) => PromptOutcome::RejectAlwaysBashCommand(value),
+            _ => PromptOutcome::RejectOnce,
+        },
+        "cancelled" => PromptOutcome::Cancelled,
+        _ => PromptOutcome::RejectOnce,
+    }
+}
+fn scope_kind_value(reply: &Value) -> Option<(&str, Option<String>)> {
+    let scope = reply.get("scope")?;
+    let kind = scope.get("kind").and_then(Value::as_str)?;
+    let value = scope
+        .get("value")
+        .and_then(Value::as_str)
+        .map(str::to_owned);
+    Some((kind, value))
+}
+/// Map a hub-served tool name + JSON args onto an [`AccessKind`] for the
+/// permission gate in [`crate::hub::SessionRoutedToolHandler`]. Returns `None`
+/// for tools that never need a user prompt (reads / todos / dynamic).
+pub fn access_kind_for_hub_tool(tool_name: &str, args: &Value) -> Option<AccessKind> {
+    let name = tool_name.rsplit(':').next().unwrap_or(tool_name);
+    let name = name.strip_prefix("GrokBuild:").unwrap_or(name);
+    match name {
+        "run_terminal_command" | "run_terminal_cmd" | "bash" | "shell" => {
+            let cmd = args
+                .get("command")
+                .or_else(|| args.get("full_command"))
+                .and_then(Value::as_str)
+                .unwrap_or("")
+                .to_owned();
+            Some(AccessKind::Bash(cmd))
+        }
+        "search_replace" | "hashline_edit" => {
+            let path = args
+                .get("file_path")
+                .or_else(|| args.get("path"))
+                .and_then(Value::as_str)
+                .unwrap_or("unknown")
+                .to_owned();
+            Some(AccessKind::Edit(path))
+        }
+        "write" | "write_file" => {
+            let path = args
+                .get("file_path")
+                .or_else(|| args.get("path"))
+                .and_then(Value::as_str)
+                .unwrap_or("unknown")
+                .to_owned();
+            Some(AccessKind::Edit(path))
+        }
+        "apply_patch" => Some(AccessKind::Edit("apply_patch".to_owned())),
+        "web_fetch" => {
+            let url = args
+                .get("url")
+                .and_then(Value::as_str)
+                .unwrap_or("")
+                .to_owned();
+            Some(AccessKind::WebFetch(url))
+        }
+        n if n.contains("__") || n.starts_with("mcp") => Some(AccessKind::MCPTool {
+            name: tool_name.to_owned(),
+            input: args.clone(),
+        }),
+        _ => None,
+    }
+}
+/// Whether a [`PromptOutcome`] allows the tool call to proceed.
+pub fn prompt_outcome_allows(outcome: &PromptOutcome) -> bool {
+    matches!(
+        outcome,
+        PromptOutcome::AllowOnce
+            | PromptOutcome::AllowAlways
+            | PromptOutcome::AllowEditsForSession
+            | PromptOutcome::AllowAlwaysBashCommand(_)
+            | PromptOutcome::AllowAlwaysDomain(_)
+            | PromptOutcome::AllowAlwaysMcpTool(_)
+            | PromptOutcome::AllowAlwaysMcpServer(_)
+    )
+}
+/// Request a permission decision from chat over `transport` and map the reply
+/// to a [`PromptOutcome`]. A transport error fails closed (the manager turns an
+/// `Error` outcome into a reject) so a lost server connection never silently runs
+/// a guarded tool.
+pub async fn request_permission_via_hub(
+    transport: &dyn PermissionHookTransport,
+    access: &AccessKind,
+    tool_call_id: &str,
+) -> PromptOutcome {
+    let payload = build_permission_payload(access, tool_call_id);
+    match transport.request_permission(payload).await {
+        Ok(reply) => match reply_to_outcome(&reply) {
+            PromptOutcome::AllowAlways if matches!(access, AccessKind::Edit(_)) => {
+                PromptOutcome::AllowEditsForSession
+            }
+            other => other,
+        },
+        Err(e) => {
+            tracing::error!(error = % e, "hub permission request failed; rejecting");
+            PromptOutcome::Error(format!("hub permission request failed: {e}"))
+        }
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+    /// Pins the current SDK timeout wording the classifier matches on.
+    #[test]
+    fn is_timeout_err_matches_backstop_wording_only() {
+        assert!(is_timeout_err("request timed out after 600s"));
+        assert!(is_timeout_err("request timed out after 600.0s"));
+        assert!(!is_timeout_err("connection lost"));
+        assert!(!is_timeout_err("tool server gone (weak upgrade failed)"));
+    }
+    #[test]
+    fn payload_for_bash_carries_command_and_write_scope() {
+        let payload = build_permission_payload(&AccessKind::Bash("rm -rf /tmp/x".into()), "tc-1");
+        assert_eq!(payload["tool_call_id"], "tc-1");
+        assert_eq!(payload["tool_name"], "run_terminal_command");
+        assert_eq!(payload["description"], "Run a terminal command");
+        assert_eq!(payload["scope"], "write");
+        assert_eq!(payload["bash_command"], "rm -rf /tmp/x");
+        assert!(payload.get("edit_file_paths").is_none());
+    }
+    #[test]
+    fn payload_for_edit_carries_file_paths() {
+        let payload = build_permission_payload(&AccessKind::Edit("src/main.rs".into()), "tc-2");
+        assert_eq!(payload["tool_name"], "search_replace");
+        assert_eq!(payload["description"], "Edit src/main.rs");
+        assert_eq!(payload["scope"], "write");
+        assert_eq!(
+            payload["edit_file_paths"],
+            serde_json::json!(["src/main.rs"])
+        );
+        assert!(payload.get("bash_command").is_none());
+        assert!(payload.get("edit_kind").is_none());
+    }
+    #[test]
+    fn payload_for_mcp_has_no_tool_context() {
+        let payload = build_permission_payload(
+            &AccessKind::MCPTool {
+                name: "linear__list".into(),
+                input: serde_json::Value::Null,
+            },
+            "tc-3",
+        );
+        assert_eq!(payload["tool_name"], "mcp:linear__list");
+        assert_eq!(payload["description"], "Run MCP tool linear__list");
+        assert_eq!(payload["scope"], "write");
+        assert!(payload.get("bash_command").is_none());
+        assert!(payload.get("edit_file_paths").is_none());
+    }
+    #[test]
+    fn reply_outcomes_map_to_prompt_outcomes() {
+        assert!(matches!(
+            reply_to_outcome(&serde_json::json!({ "outcome" : "approve" })),
+            PromptOutcome::AllowOnce
+        ));
+        assert!(matches!(
+            reply_to_outcome(&serde_json::json!({ "outcome" : "reject" })),
+            PromptOutcome::RejectOnce
+        ));
+        assert!(matches!(
+            reply_to_outcome(&serde_json::json!({ "outcome" : "cancelled" })),
+            PromptOutcome::Cancelled
+        ));
+        assert!(matches!(
+            reply_to_outcome(&serde_json::json!({ "outcome" : "unspecified"
+            })),
+            PromptOutcome::RejectOnce
+        ));
+        assert!(matches!(
+            reply_to_outcome(&serde_json::json!({})),
+            PromptOutcome::RejectOnce
+        ));
+    }
+    #[test]
+    fn reject_with_followup_routes_message_to_model() {
+        let reply = serde_json::json!(
+            { "outcome" : "reject", "followup_message" : "use cargo instead" }
+        );
+        match reply_to_outcome(&reply) {
+            PromptOutcome::FollowupMessage(m) => assert_eq!(m, "use cargo instead"),
+            other => panic!("expected FollowupMessage, got {other:?}"),
+        }
+    }
+    #[test]
+    fn always_approve_maps_scope_to_persistent_outcome() {
+        let bash = serde_json::json!(
+            { "outcome" : "always_approve", "scope" : { "kind" : "bash_command", "value"
+            : "cargo build" }, }
+        );
+        match reply_to_outcome(&bash) {
+            PromptOutcome::AllowAlwaysBashCommand(v) => assert_eq!(v, "cargo build"),
+            other => panic!("expected AllowAlwaysBashCommand, got {other:?}"),
+        }
+        let server = serde_json::json!(
+            { "outcome" : "always_approve", "scope" : { "kind" : "server_prefix", "value"
+            : "linear" }, }
+        );
+        match reply_to_outcome(&server) {
+            PromptOutcome::AllowAlwaysMcpServer(v) => assert_eq!(v, "linear"),
+            other => panic!("expected AllowAlwaysMcpServer, got {other:?}"),
+        }
+        assert!(matches!(
+            reply_to_outcome(&serde_json::json!({ "outcome" : "always_approve"
+            })),
+            PromptOutcome::AllowAlways
+        ));
+    }
+    #[test]
+    fn always_reject_with_bash_scope_persists_the_denied_prefix() {
+        let reply = serde_json::json!(
+            { "outcome" : "always_reject", "scope" : { "kind" : "bash_command", "value" :
+            "curl" }, }
+        );
+        match reply_to_outcome(&reply) {
+            PromptOutcome::RejectAlwaysBashCommand(v) => assert_eq!(v, "curl"),
+            other => panic!("expected RejectAlwaysBashCommand, got {other:?}"),
+        }
+    }
+    struct StubTransport {
+        reply: Result<Value, String>,
+        seen: Mutex<Option<Value>>,
+    }
+    #[async_trait]
+    impl PermissionHookTransport for StubTransport {
+        async fn request_permission(&self, payload: Value) -> Result<Value, String> {
+            *self.seen.lock().unwrap() = Some(payload);
+            self.reply.clone()
+        }
+    }
+    #[tokio::test]
+    async fn request_sends_payload_and_decodes_reply() {
+        let transport = StubTransport {
+            reply: Ok(serde_json::json!({ "outcome" : "approve" })),
+            seen: Mutex::new(None),
+        };
+        let outcome =
+            request_permission_via_hub(&transport, &AccessKind::Bash("ls -la".into()), "tc-7")
+                .await;
+        assert!(matches!(outcome, PromptOutcome::AllowOnce));
+        let seen = transport
+            .seen
+            .lock()
+            .unwrap()
+            .clone()
+            .expect("payload sent");
+        assert_eq!(seen["tool_call_id"], "tc-7");
+        assert_eq!(seen["bash_command"], "ls -la");
+    }
+    #[tokio::test]
+    async fn transport_error_fails_closed() {
+        let transport = StubTransport {
+            reply: Err("connection lost".to_owned()),
+            seen: Mutex::new(None),
+        };
+        let outcome =
+            request_permission_via_hub(&transport, &AccessKind::Edit("a.rs".into()), "tc-8").await;
+        assert!(matches!(outcome, PromptOutcome::Error(_)));
+    }
+    #[tokio::test]
+    async fn edit_always_approve_maps_to_session_scope() {
+        let transport = StubTransport {
+            reply: Ok(serde_json::json!({ "outcome" : "always_approve" })),
+            seen: Mutex::new(None),
+        };
+        let outcome =
+            request_permission_via_hub(&transport, &AccessKind::Edit("a.rs".into()), "tc-9").await;
+        assert!(matches!(outcome, PromptOutcome::AllowEditsForSession));
+        let transport = StubTransport {
+            reply: Ok(serde_json::json!({ "outcome" : "always_approve" })),
+            seen: Mutex::new(None),
+        };
+        let outcome = request_permission_via_hub(
+            &transport,
+            &AccessKind::MCPTool {
+                name: "x".into(),
+                input: serde_json::Value::Null,
+            },
+            "tc-10",
+        )
+        .await;
+        assert!(matches!(outcome, PromptOutcome::AllowAlways));
+    }
+    #[test]
+    fn hitl_permission_live_defaults_off_without_env() {
+        if std::env::var(HITL_PERMISSION_LIVE_ENV).is_err() {
+            assert!(!hitl_permission_live_enabled());
+        }
+    }
+}