feat(when): allow when clauses to check filesystem state via fs.* functions

[fohte]

Purpose

• The information a runok when: clause can read is limited to env / flags / args / paths / redirects / pipe / vars / flag_groups / os, with no access to live filesystem state at evaluation time
  • Setups like "allow git commit only when the pre-commit skill ran" -- gating on a marker file touched by a Claude Code skill -- cannot be expressed
• No existing runok surface fills the same role
  • The <path:name> placeholder is pattern matching on a command argument; it does not check the disk
  • An extension calling --check is possible, but spawning a subprocess just for an existence test is overkill

Approach

• Add fs.exists(path) / fs.is_file(path) / fs.is_dir(path), callable from when: clauses
  • Ship the same three-piece set as bash's [ -e ] / [ -f ] / [ -d ] from the start, so the API does not drift in naming later
• I/O error policy: collapse NotFound to false, surface anything else (e.g. EACCES) as a CEL evaluation error
  • Folding permission errors into false would let when: fs.exists(marker) silently misclassify a non-statable parent as "marker absent" and quietly bypass the gate
• Symlinks are followed; broken symlinks return false from all three
• Empty-string arguments return false (not an error)

rules:
  # Allow `git commit` only when the pre-commit skill has run
  - allow: 'git commit *'
    when: "fs.exists('/tmp/runok-precommit-ok')"
  - ask: 'git commit *'

  # Allow `git push` only when the working tree is a git repository
  - allow: 'git push *'
    when: "fs.is_dir('.git')"

Design decisions

Naming style

Decision	Design	Pros	Cons
Chosen	fs.exists / fs.is_file / fs.is_dir (snake_case)	Matches the existing flag_groups snake_case / mirrors bash's -f and -d intuitively	Diverges from CEL's standard library convention (camelCase)
Rejected	fs.isFile / fs.isDir (camelCase)	Matches CEL built-ins like startsWith	Diverges from runok's own context variables (flag_groups); confusing to authors

I/O error handling

Decision	Design	Pros	Cons
Chosen	Collapse only NotFound to false; anything else becomes a CEL error	Prevents permission failures from being mistaken for "marker absent" and quietly opening the gate	A when: clause given an unstatable path stops evaluation with an error
Rejected	Collapse every stat failure to false	Simpler implementation	Equates "not readable" with "not present"; lets cases that should deny slip to allow

fs.* dispatch

Decision	Design	Pros	Cons
Chosen	Register fs as a sentinel map; register exists / is_file / is_dir as functions with a receiver check	Users write fs.exists("p") (consistent with other context surfaces) / misuse like 'foo'.exists('bar') is rejected	cel-interpreter has no real namespace, so the receiver check has to be implemented by hand
Rejected	Register flat function names fs_exists / fs_is_file / fs_is_dir	Simpler, no receiver check needed	Forces fs_exists("p") syntax, diverging from paths.X / flags.X / vars.X

[codecov]

Codecov Report

❌ Patch coverage is 97.01493% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.03%. Comparing base (9bb68ce) to head (ee51d01).

Files with missing lines	Patch %	Lines
src/rules/expr_evaluator.rs	97.01%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #341      +/-   ##
==========================================
+ Coverage   88.98%   89.03%   +0.04%     
==========================================
  Files          53       53              
  Lines       12513    12580      +67     
==========================================
+ Hits        11135    11200      +65     
- Misses       1378     1380       +2     

Flag	Coverage Δ
Linux	88.84% <97.01%> (+0.02%)	⬆️
macOS	90.17% <97.01%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gemini-code-assist]

Code Review

This pull request introduces new fs.* CEL functions (fs.exists, fs.is_file, fs.is_dir) to enable filesystem-based conditions in when clauses, complete with documentation and tests. The implementation includes logic to follow symlinks and properly handle I/O errors. Review feedback suggests optimizing the sentinel key lookup to prevent unnecessary allocations and refactoring the filesystem check implementations to reduce code duplication.