@gotgenes/pi-permission-system 16.2.1 → 17.1.0

package/test/path-utils.test.ts

@@ -41,85 +41,111 @@ describe("normalizePathForComparison", () => {
   const cwd = "/projects/my-app";
 
   test("resolves absolute path unchanged", () => {
-    expect(normalizePathForComparison("/usr/local/bin", cwd)).toBe(
+    expect(normalizePathForComparison("/usr/local/bin", cwd, "linux")).toBe(
       "/usr/local/bin",
     );
   });
 
   test("resolves relative path against cwd", () => {
-    expect(normalizePathForComparison("src/foo.ts", cwd)).toBe(
+    expect(normalizePathForComparison("src/foo.ts", cwd, "linux")).toBe(
       "/projects/my-app/src/foo.ts",
     );
   });
 
   test("expands bare ~ to homedir", () => {
-    expect(normalizePathForComparison("~", cwd)).toBe("/mock/home");
+    expect(normalizePathForComparison("~", cwd, "linux")).toBe("/mock/home");
   });
 
   test("expands ~/... to homedir-relative path", () => {
-    expect(normalizePathForComparison("~/docs/readme.md", cwd)).toBe(
+    expect(normalizePathForComparison("~/docs/readme.md", cwd, "linux")).toBe(
       join("/mock/home", "docs/readme.md"),
     );
   });
 
   test("expands bare $HOME to homedir", () => {
-    expect(normalizePathForComparison("$HOME", cwd)).toBe("/mock/home");
+    expect(normalizePathForComparison("$HOME", cwd, "linux")).toBe(
+      "/mock/home",
+    );
   });
 
   test("expands $HOME/... to homedir-relative path", () => {
-    expect(normalizePathForComparison("$HOME/.ssh/config", cwd)).toBe(
+    expect(normalizePathForComparison("$HOME/.ssh/config", cwd, "linux")).toBe(
       join("/mock/home", ".ssh/config"),
     );
   });
 
   test("strips leading @ before resolving", () => {
-    expect(normalizePathForComparison("@/usr/local/bin", cwd)).toBe(
+    expect(normalizePathForComparison("@/usr/local/bin", cwd, "linux")).toBe(
       "/usr/local/bin",
     );
   });
 
   test("strips surrounding quotes", () => {
-    expect(normalizePathForComparison("'/usr/local/bin'", cwd)).toBe(
+    expect(normalizePathForComparison("'/usr/local/bin'", cwd, "linux")).toBe(
       "/usr/local/bin",
     );
-    expect(normalizePathForComparison('"/usr/local/bin"', cwd)).toBe(
+    expect(normalizePathForComparison('"/usr/local/bin"', cwd, "linux")).toBe(
       "/usr/local/bin",
     );
   });
 
   test("returns empty string for blank/whitespace-only path", () => {
-    expect(normalizePathForComparison("", cwd)).toBe("");
-    expect(normalizePathForComparison("   ", cwd)).toBe("");
+    expect(normalizePathForComparison("", cwd, "linux")).toBe("");
+    expect(normalizePathForComparison("   ", cwd, "linux")).toBe("");
+  });
+
+  // ── injected platform flavor (Windows is case-folded, win32-resolved) ────
+
+  test("win32: lowercases the resolved absolute path", () => {
+    expect(
+      normalizePathForComparison(
+        "C:\\Users\\Foo\\Bar.txt",
+        "C:\\Projects",
+        "win32",
+      ),
+    ).toBe("c:\\users\\foo\\bar.txt");
+  });
+
+  test("win32: resolves a relative path against cwd with win32 rules", () => {
+    expect(
+      normalizePathForComparison("src\\foo.ts", "C:\\Projects\\App", "win32"),
+    ).toBe("c:\\projects\\app\\src\\foo.ts");
+  });
+
+  test("posix platform leaves case untouched", () => {
+    expect(
+      normalizePathForComparison("/Projects/App/Src.ts", cwd, "linux"),
+    ).toBe("/Projects/App/Src.ts");
   });
 });
 
 describe("isPathWithinDirectory", () => {
   test("returns true when path equals directory", () => {
-    expect(isPathWithinDirectory("/a/b", "/a/b")).toBe(true);
+    expect(isPathWithinDirectory("/a/b", "/a/b", "linux")).toBe(true);
   });
 
   test("returns true when path is a direct child", () => {
-    expect(isPathWithinDirectory("/a/b/c", "/a/b")).toBe(true);
+    expect(isPathWithinDirectory("/a/b/c", "/a/b", "linux")).toBe(true);
   });
 
   test("returns true when path is a deep descendant", () => {
-    expect(isPathWithinDirectory("/a/b/c/d/e", "/a/b")).toBe(true);
+    expect(isPathWithinDirectory("/a/b/c/d/e", "/a/b", "linux")).toBe(true);
   });
 
   test("returns false when path is a sibling directory", () => {
-    expect(isPathWithinDirectory("/a/bc", "/a/b")).toBe(false);
+    expect(isPathWithinDirectory("/a/bc", "/a/b", "linux")).toBe(false);
   });
 
   test("returns false when path is outside the directory", () => {
-    expect(isPathWithinDirectory("/other/path", "/a/b")).toBe(false);
+    expect(isPathWithinDirectory("/other/path", "/a/b", "linux")).toBe(false);
   });
 
   test("returns false for empty path", () => {
-    expect(isPathWithinDirectory("", "/a/b")).toBe(false);
+    expect(isPathWithinDirectory("", "/a/b", "linux")).toBe(false);
   });
 
   test("returns false for empty directory", () => {
-    expect(isPathWithinDirectory("/a/b", "")).toBe(false);
+    expect(isPathWithinDirectory("/a/b", "", "linux")).toBe(false);
   });
 
   // ── platform-aware containment (Windows is case-insensitive) ────────────
@@ -319,49 +345,65 @@ describe("isPathOutsideWorkingDirectory", () => {
   });
 
   test("returns false when path is inside cwd", () => {
-    expect(isPathOutsideWorkingDirectory("/projects/my-app/src", cwd)).toBe(
-      false,
-    );
+    expect(
+      isPathOutsideWorkingDirectory("/projects/my-app/src", cwd, "linux"),
+    ).toBe(false);
   });
 
   test("returns false when path equals cwd", () => {
-    expect(isPathOutsideWorkingDirectory("/projects/my-app", cwd)).toBe(false);
+    expect(
+      isPathOutsideWorkingDirectory("/projects/my-app", cwd, "linux"),
+    ).toBe(false);
   });
 
   test("returns true when path is outside cwd", () => {
-    expect(isPathOutsideWorkingDirectory("/etc/passwd", cwd)).toBe(true);
+    expect(isPathOutsideWorkingDirectory("/etc/passwd", cwd, "linux")).toBe(
+      true,
+    );
   });
 
   test("returns true for home directory when outside cwd", () => {
-    expect(isPathOutsideWorkingDirectory("~/secrets", cwd)).toBe(true);
+    expect(isPathOutsideWorkingDirectory("~/secrets", cwd, "linux")).toBe(true);
   });
 
   test("returns false for relative path resolving inside cwd", () => {
-    expect(isPathOutsideWorkingDirectory("src/index.ts", cwd)).toBe(false);
+    expect(isPathOutsideWorkingDirectory("src/index.ts", cwd, "linux")).toBe(
+      false,
+    );
   });
 
   test("returns false for empty path (normalizes to empty string)", () => {
-    expect(isPathOutsideWorkingDirectory("", cwd)).toBe(false);
+    expect(isPathOutsideWorkingDirectory("", cwd, "linux")).toBe(false);
   });
 
   test("returns false for /dev/null regardless of cwd", () => {
-    expect(isPathOutsideWorkingDirectory("/dev/null", cwd)).toBe(false);
+    expect(isPathOutsideWorkingDirectory("/dev/null", cwd, "linux")).toBe(
+      false,
+    );
   });
 
   test("returns false for /dev/stdin regardless of cwd", () => {
-    expect(isPathOutsideWorkingDirectory("/dev/stdin", cwd)).toBe(false);
+    expect(isPathOutsideWorkingDirectory("/dev/stdin", cwd, "linux")).toBe(
+      false,
+    );
   });
 
   test("returns false for /dev/stdout regardless of cwd", () => {
-    expect(isPathOutsideWorkingDirectory("/dev/stdout", cwd)).toBe(false);
+    expect(isPathOutsideWorkingDirectory("/dev/stdout", cwd, "linux")).toBe(
+      false,
+    );
   });
 
   test("returns false for /dev/stderr regardless of cwd", () => {
-    expect(isPathOutsideWorkingDirectory("/dev/stderr", cwd)).toBe(false);
+    expect(isPathOutsideWorkingDirectory("/dev/stderr", cwd, "linux")).toBe(
+      false,
+    );
   });
 
   test("returns true for /dev/null/subdir (not a safe path)", () => {
-    expect(isPathOutsideWorkingDirectory("/dev/null/subdir", cwd)).toBe(true);
+    expect(
+      isPathOutsideWorkingDirectory("/dev/null/subdir", cwd, "linux"),
+    ).toBe(true);
   });
 
   test("returns true for in-cwd symlink that resolves to external path", () => {
@@ -370,7 +412,9 @@ describe("isPathOutsideWorkingDirectory", () => {
       if (p === "/projects/my-app/link/hosts") return "/etc/hosts";
       return p;
     });
-    expect(isPathOutsideWorkingDirectory("./link/hosts", cwd)).toBe(true);
+    expect(isPathOutsideWorkingDirectory("./link/hosts", cwd, "linux")).toBe(
+      true,
+    );
   });
 
   test("returns false for path inside a symlinked cwd", () => {
@@ -382,7 +426,11 @@ describe("isPathOutsideWorkingDirectory", () => {
       return p;
     });
     expect(
-      isPathOutsideWorkingDirectory("/tmp/workspace/file.ts", symlinkCwd),
+      isPathOutsideWorkingDirectory(
+        "/tmp/workspace/file.ts",
+        symlinkCwd,
+        "linux",
+      ),
     ).toBe(false);
   });
 });
@@ -400,20 +448,34 @@ describe("canonicalNormalizePathForComparison", () => {
       if (p === "/projects/link") return "/real/projects/app";
       return p;
     });
-    expect(canonicalNormalizePathForComparison("/projects/link", cwd)).toBe(
-      "/real/projects/app",
-    );
+    expect(
+      canonicalNormalizePathForComparison("/projects/link", cwd, "linux"),
+    ).toBe("/real/projects/app");
   });
 
   test("returns empty string for empty input", () => {
-    expect(canonicalNormalizePathForComparison("", cwd)).toBe("");
+    expect(canonicalNormalizePathForComparison("", cwd, "linux")).toBe("");
   });
 
   test("returns lexical form when no symlinks (identity realpathSync)", () => {
     expect(
-      canonicalNormalizePathForComparison("/projects/my-app/src/index.ts", cwd),
+      canonicalNormalizePathForComparison(
+        "/projects/my-app/src/index.ts",
+        cwd,
+        "linux",
+      ),
     ).toBe("/projects/my-app/src/index.ts");
   });
+
+  test("win32: lowercases the canonical form", () => {
+    expect(
+      canonicalNormalizePathForComparison(
+        "C:\\Projects\\App\\Src",
+        "C:\\Projects\\App",
+        "win32",
+      ),
+    ).toBe("c:\\projects\\app\\src");
+  });
 });
 
 describe("isPiInfrastructureRead", () => {
@@ -427,6 +489,7 @@ describe("isPiInfrastructureRead", () => {
         "/mock/home/.pi/agent/config.json",
         infraDirs,
         cwd,
+        "linux",
       ),
     ).toBe(true);
   });
@@ -438,6 +501,7 @@ describe("isPiInfrastructureRead", () => {
         "/mock/home/.pi/agent/config.json",
         infraDirs,
         cwd,
+        "linux",
       ),
     ).toBe(false);
   });
@@ -449,6 +513,7 @@ describe("isPiInfrastructureRead", () => {
         "/projects/my-app/.pi/npm/package.json",
         [],
         cwd,
+        "linux",
       ),
     ).toBe(true);
   });
@@ -460,14 +525,15 @@ describe("isPiInfrastructureRead", () => {
         "/projects/my-app/.pi/git/some-file",
         [],
         cwd,
+        "linux",
       ),
     ).toBe(true);
   });
 
   test("returns false for path outside all infra dirs and project dirs", () => {
-    expect(isPiInfrastructureRead("read", "/etc/passwd", infraDirs, cwd)).toBe(
-      false,
-    );
+    expect(
+      isPiInfrastructureRead("read", "/etc/passwd", infraDirs, cwd, "linux"),
+    ).toBe(false);
   });
 
   // ── glob patterns ─────────────────────────────────────────────────
@@ -479,6 +545,7 @@ describe("isPiInfrastructureRead", () => {
         "/opt/homebrew/Cellar/pi-coding-agent/0.74.0/libexec/lib/node_modules/@earendil-works/pi-coding-agent/SKILL.md",
         ["/opt/homebrew/**/@earendil-works/pi-coding-agent/**"],
         cwd,
+        "linux",
       ),
     ).toBe(true);
   });
@@ -490,6 +557,7 @@ describe("isPiInfrastructureRead", () => {
         "/etc/passwd",
         ["/opt/homebrew/**/@earendil-works/pi-coding-agent/**"],
         cwd,
+        "linux",
       ),
     ).toBe(false);
   });
@@ -502,6 +570,7 @@ describe("isPiInfrastructureRead", () => {
         "/mock/home/.pi/agent/config.json",
         ["~/.pi/agent"],
         cwd,
+        "linux",
       ),
     ).toBe(true);
   });
@@ -582,35 +651,45 @@ describe("getPathPolicyValues", () => {
   const cwd = "/projects/my-app";
 
   test("returns only the literal when no base is available", () => {
-    expect(getPathPolicyValues("src/foo.ts")).toEqual(["src/foo.ts"]);
-    expect(getPathPolicyValues("src/foo.ts", {})).toEqual(["src/foo.ts"]);
+    expect(getPathPolicyValues("src/foo.ts", {}, "linux")).toEqual([
+      "src/foo.ts",
+    ]);
+    expect(getPathPolicyValues("src/foo.ts", {}, "linux")).toEqual([
+      "src/foo.ts",
+    ]);
   });
 
   test("adds absolute and project-relative aliases for a relative token", () => {
-    expect(getPathPolicyValues("src/foo.ts", { cwd })).toEqual([
+    expect(getPathPolicyValues("src/foo.ts", { cwd }, "linux")).toEqual([
       "/projects/my-app/src/foo.ts",
       "src/foo.ts",
     ]);
   });
 
   test("omits the relative alias for a token outside cwd", () => {
-    expect(getPathPolicyValues("/etc/hosts", { cwd })).toEqual(["/etc/hosts"]);
+    expect(getPathPolicyValues("/etc/hosts", { cwd }, "linux")).toEqual([
+      "/etc/hosts",
+    ]);
   });
 
   test("resolves against resolveBase while aliasing relative to cwd", () => {
     expect(
-      getPathPolicyValues("foo.txt", {
-        cwd,
-        resolveBase: "/projects/my-app/nested",
-      }),
+      getPathPolicyValues(
+        "foo.txt",
+        {
+          cwd,
+          resolveBase: "/projects/my-app/nested",
+        },
+        "linux",
+      ),
     ).toEqual(["/projects/my-app/nested/foo.txt", "nested/foo.txt", "foo.txt"]);
   });
 
   test("preserves the surface catch-all", () => {
-    expect(getPathPolicyValues("*", { cwd })).toEqual(["*"]);
+    expect(getPathPolicyValues("*", { cwd }, "linux")).toEqual(["*"]);
   });
 
   test("returns empty for blank input", () => {
-    expect(getPathPolicyValues("   ", { cwd })).toEqual([]);
+    expect(getPathPolicyValues("   ", { cwd }, "linux")).toEqual([]);
   });
 });

package/test/permission-forwarder.test.ts

@@ -18,6 +18,7 @@ function makeDeps(
   return {
     forwardingDir: "/tmp/forwarding",
     subagentSessionsDir: "/tmp/subagents",
+    platform: "linux",
     logger: { review: vi.fn(), debug: vi.fn() },
     requestPermissionDecisionFromUi: vi
       .fn()

package/test/permission-manager-unified.test.ts

@@ -71,6 +71,46 @@ const sessionAllow = (surface: string, pattern: string): Rule => ({
   origin: "session",
 });
 
+describe("PermissionManager — injected platform (#510)", () => {
+  const winAllow: Ruleset = [
+    sessionAllow("external_directory", "C:\\Users\\Foo\\pi\\*"),
+  ];
+
+  it("win32 manager folds case for path-surface matching", () => {
+    const manager = new PermissionManager({
+      globalConfigPath: "/nonexistent/config.json",
+      agentsDir: "/nonexistent/agents",
+      platform: "win32",
+    });
+    const result = manager.check(
+      {
+        kind: "path-values",
+        surface: "external_directory",
+        values: ["c:\\users\\foo\\pi\\docs\\readme.md"],
+      },
+      winAllow,
+    );
+    expect(result.state).toBe("allow");
+  });
+
+  it("posix manager keeps path-surface matching case-sensitive", () => {
+    const manager = new PermissionManager({
+      globalConfigPath: "/nonexistent/config.json",
+      agentsDir: "/nonexistent/agents",
+      platform: "linux",
+    });
+    const result = manager.check(
+      {
+        kind: "path-values",
+        surface: "external_directory",
+        values: ["c:\\users\\foo\\pi\\docs\\readme.md"],
+      },
+      winAllow,
+    );
+    expect(result.state).not.toBe("allow");
+  });
+});
+
 // Adapters that build an AccessIntent and call the unified `check` entry point,
 // so these tests exercise the single resolution path (#478) without a
 // production-class wrapper used only by tests.

package/test/permission-resolver.test.ts

@@ -120,28 +120,7 @@ describe("PermissionResolver", () => {
     });
   });
 
-  describe("resolve — path-values intent", () => {
-    it("forwards a path-values intent with the current session ruleset", () => {
-      const { resolver, permissionManager } = makeResolver();
-
-      resolver.resolve({
-        kind: "path-values",
-        surface: "path",
-        values: ["/proj/src/a.ts", "src/a.ts"],
-        agentName: "agent-x",
-      });
-
-      expect(permissionManager.check).toHaveBeenCalledWith(
-        {
-          kind: "path-values",
-          surface: "path",
-          values: ["/proj/src/a.ts", "src/a.ts"],
-          agentName: "agent-x",
-        },
-        [],
-      );
-    });
-
+  describe("resolve — session ruleset threading", () => {
     it("applies a recorded session approval on the next call", () => {
       const pm = makePermissionManager();
       const sessionRules = new SessionRules();
@@ -151,9 +130,12 @@ describe("PermissionResolver", () => {
         SessionApproval.single("path", "src/*"),
       );
       resolver.resolve({
-        kind: "path-values",
+        kind: "access-path",
         surface: "path",
-        values: ["src/a.ts"],
+        path: AccessPath.forPath("src/a.ts", {
+          cwd: "/proj",
+          platform: "linux",
+        }),
       });
 
       const passedRules = vi.mocked(pm.check).mock.calls[0][1];
@@ -169,10 +151,10 @@ describe("PermissionResolver", () => {
   describe("resolve — access-path intent", () => {
     it("unwraps the AccessPath via matchValues() into a path-values intent", () => {
       const { resolver, permissionManager } = makeResolver();
-      const accessPath = AccessPath.forExternalDirectory(
-        "/tmp/x",
-        "/workspace",
-      );
+      const accessPath = AccessPath.forPath("/tmp/x", {
+        cwd: "/workspace",
+        platform: "linux",
+      });
 
       resolver.resolve({
         kind: "access-path",
@@ -202,10 +184,10 @@ describe("PermissionResolver", () => {
         matchedPattern: "/tmp/*",
       });
       const { resolver } = makeResolver(pm);
-      const accessPath = AccessPath.forExternalDirectory(
-        "/tmp/x",
-        "/workspace",
-      );
+      const accessPath = AccessPath.forPath("/tmp/x", {
+        cwd: "/workspace",
+        platform: "linux",
+      });
 
       const result = resolver.resolve({
         kind: "access-path",

package/test/permission-session.test.ts

@@ -135,6 +135,47 @@ describe("PermissionSession", () => {
     });
   });
 
+  describe("getPathNormalizer", () => {
+    it("returns a normalizer bound to the reset session cwd", () => {
+      const { session } = createSession();
+      session.resetForNewSession(makeCtx({ cwd: "/projects/app" }));
+
+      const ap = session.getPathNormalizer().forPath("src/foo.ts");
+
+      expect(ap.value()).toBe("/projects/app/src/foo.ts");
+    });
+
+    it("rebinds the normalizer cwd on a subsequent reset", () => {
+      const { session } = createSession();
+      session.resetForNewSession(makeCtx({ cwd: "/projects/app" }));
+      session.resetForNewSession(makeCtx({ cwd: "/projects/other" }));
+
+      expect(session.getPathNormalizer().forPath("a.ts").value()).toBe(
+        "/projects/other/a.ts",
+      );
+    });
+
+    it("binds the normalizer on activate, before any reset (no fail-open)", () => {
+      const { session } = createSession();
+      // A tool call can activate the session before session_start resets it;
+      // the normalizer must still track the active ctx cwd.
+      session.activate(makeCtx({ cwd: "/projects/activated" }));
+
+      expect(session.getPathNormalizer().forPath("a.ts").value()).toBe(
+        "/projects/activated/a.ts",
+      );
+    });
+
+    it("builds a win32 normalizer when constructed with the win32 platform", () => {
+      const { session } = createSession({ platform: "win32" });
+      session.resetForNewSession(makeCtx({ cwd: "C:\\Projects\\App" }));
+
+      expect(session.getPathNormalizer().forPath("src\\foo.ts").value()).toBe(
+        "c:\\projects\\app\\src\\foo.ts",
+      );
+    });
+  });
+
   describe("shutdown", () => {
     it("clears session rules", () => {
       const { session, sessionRules } = createSession();