@gotgenes/pi-permission-system 17.0.0 → 17.1.1

package/test/session-rules.test.ts

@@ -131,6 +131,7 @@ describe("SessionRules", () => {
         "external_directory",
         "/other/project/src/foo.ts",
         session.getRuleset(),
+        "linux",
       );
       expect(result.action).toBe("allow");
     });
@@ -142,6 +143,7 @@ describe("SessionRules", () => {
         "external_directory",
         "/other/unrelated/file.ts",
         session.getRuleset(),
+        "linux",
       );
       // No rule matches — evaluate returns synthetic rule with default action "ask"
       expect(result.action).toBe("ask");
@@ -154,6 +156,7 @@ describe("SessionRules", () => {
         "external_directory",
         "/other/project-b/foo.ts",
         session.getRuleset(),
+        "linux",
       );
       expect(result.action).toBe("ask");
     });
@@ -166,6 +169,7 @@ describe("SessionRules", () => {
         "external_directory",
         "/other/project/src/",
         session.getRuleset(),
+        "linux",
       );
       expect(result.action).toBe("allow");
     });
@@ -179,6 +183,7 @@ describe("SessionRules", () => {
           "external_directory",
           "/project-a/foo.ts",
           session.getRuleset(),
+          "linux",
         ).action,
       ).toBe("allow");
       expect(
@@ -186,6 +191,7 @@ describe("SessionRules", () => {
           "external_directory",
           "/project-b/bar.ts",
           session.getRuleset(),
+          "linux",
         ).action,
       ).toBe("allow");
       expect(
@@ -193,6 +199,7 @@ describe("SessionRules", () => {
           "external_directory",
           "/project-c/baz.ts",
           session.getRuleset(),
+          "linux",
         ).action,
       ).toBe("ask");
     });
@@ -204,6 +211,7 @@ describe("SessionRules", () => {
         "bash",
         "/other/project/foo.ts",
         session.getRuleset(),
+        "linux",
       );
       expect(result.action).toBe("ask");
     });
@@ -218,6 +226,7 @@ describe("SessionRules", () => {
           "external_directory",
           "/old/project/file.ts",
           session.getRuleset(),
+          "linux",
         ).action,
       ).toBe("ask");
       expect(
@@ -225,6 +234,7 @@ describe("SessionRules", () => {
           "external_directory",
           "/new/project/file.ts",
           session.getRuleset(),
+          "linux",
         ).action,
       ).toBe("allow");
     });
@@ -270,6 +280,7 @@ describe("deriveApprovalPattern", () => {
         "external_directory",
         "/other/project/src/bar.ts",
         session.getRuleset(),
+        "linux",
       ).action,
     ).toBe("allow");
   });
@@ -283,6 +294,7 @@ describe("deriveApprovalPattern", () => {
         "external_directory",
         "/other/project/lib/bar.ts",
         session.getRuleset(),
+        "linux",
       ).action,
     ).toBe("ask");
   });
@@ -295,10 +307,15 @@ describe("deriveApprovalPattern", () => {
     const session = new SessionRules();
     session.approve("edit", pattern);
     expect(
-      evaluate("edit", "/test/project/index.html", session.getRuleset()).action,
+      evaluate(
+        "edit",
+        "/test/project/index.html",
+        session.getRuleset(),
+        "linux",
+      ).action,
     ).toBe("allow");
-    expect(evaluate("edit", "/etc/passwd", session.getRuleset()).action).toBe(
-      "ask",
-    );
+    expect(
+      evaluate("edit", "/etc/passwd", session.getRuleset(), "linux").action,
+    ).toBe("ask");
   });
 });

package/test/skill-prompt-sanitizer.test.ts

@@ -1,5 +1,6 @@
 import { resolve } from "node:path";
 import { afterEach, describe, expect, test, vi } from "vitest";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionManager } from "#src/permission-manager";
 import {
   findSkillPathMatch,
@@ -30,6 +31,11 @@ afterEach(() => {
 
 const CWD = "/projects/my-app";
 
+// `findSkillPathMatch` only uses the normalizer's platform (it compares two
+// already-absolute paths via `isWithinDirectory`), so this CWD-baked instance
+// serves every call regardless of the entries' cwd.
+const normalizer = new PathNormalizer("linux", CWD);
+
 function makeManager(
   defaultState: "allow" | "deny" | "ask" = "allow",
   overrides: Record<string, "allow" | "deny" | "ask"> = {},
@@ -72,7 +78,7 @@ describe("resolveSkillPromptEntries", () => {
   test("returns unchanged prompt and empty entries when no skills section present", () => {
     const input = "You are a helpful assistant.";
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(input, manager, null, CWD);
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toBe(input);
     expect(result.entries).toEqual([]);
     expect(manager.checkPermission).not.toHaveBeenCalled();
@@ -81,7 +87,7 @@ describe("resolveSkillPromptEntries", () => {
   test("keeps all skills when all are allowed", () => {
     const input = availableSkillsSection("librarian", "ask-user");
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(input, manager, null, CWD);
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.prompt).toContain("ask-user");
     expect(result.entries).toHaveLength(2);
@@ -90,7 +96,7 @@ describe("resolveSkillPromptEntries", () => {
   test("removes denied skill from section", () => {
     const input = availableSkillsSection("librarian", "dangerous");
     const manager = makeManager("allow", { dangerous: "deny" });
-    const result = resolveSkillPromptEntries(input, manager, null, CWD);
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.prompt).not.toContain("dangerous");
     // denied skill is excluded from returned entries
@@ -100,7 +106,7 @@ describe("resolveSkillPromptEntries", () => {
   test("removes entire section when all skills are denied", () => {
     const input = `Intro\n${availableSkillsSection("dangerous")}\nOutro`;
     const manager = makeManager("deny");
-    const result = resolveSkillPromptEntries(input, manager, null, CWD);
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).not.toContain("<available_skills>");
     expect(result.prompt).toContain("Intro");
     expect(result.prompt).toContain("Outro");
@@ -110,7 +116,7 @@ describe("resolveSkillPromptEntries", () => {
   test("keeps ask-state skills in section and entries", () => {
     const input = availableSkillsSection("librarian");
     const manager = makeManager("ask");
-    const result = resolveSkillPromptEntries(input, manager, null, CWD);
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.entries).toHaveLength(1);
     expect(result.entries[0].state).toBe("ask");
@@ -119,7 +125,7 @@ describe("resolveSkillPromptEntries", () => {
   test("delegates permission check to permissionManager for each skill", () => {
     const input = availableSkillsSection("alpha", "beta");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, null, CWD);
+    resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(manager.checkPermission).toHaveBeenCalledWith(
       "skill",
       { name: "alpha" },
@@ -135,7 +141,7 @@ describe("resolveSkillPromptEntries", () => {
   test("passes agentName to permissionManager", () => {
     const input = availableSkillsSection("librarian");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, "my-agent", CWD);
+    resolveSkillPromptEntries(input, manager, "my-agent", normalizer);
     expect(manager.checkPermission).toHaveBeenCalledWith(
       "skill",
       { name: "librarian" },
@@ -150,7 +156,7 @@ describe("resolveSkillPromptEntries", () => {
       availableSkillsSection("librarian"),
     ].join("\n");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, null, CWD);
+    resolveSkillPromptEntries(input, manager, null, normalizer);
     // Should only be called once despite appearing twice.
     expect(manager.checkPermission).toHaveBeenCalledTimes(1);
   });
@@ -159,7 +165,7 @@ describe("resolveSkillPromptEntries", () => {
     const location = "/skills/librarian/SKILL.md";
     const input = availableSkillsSection("librarian");
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(input, manager, null, CWD);
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.entries[0].normalizedLocation).toBe(location);
     expect(result.entries[0].normalizedBaseDir).toBe("/skills/librarian");
   });
@@ -169,7 +175,7 @@ describe("resolveSkillPromptEntries", () => {
     const section2 = availableSkillsSection("beta");
     const input = `${section1}\n${section2}`;
     const manager = makeManager("allow", { beta: "deny" });
-    const result = resolveSkillPromptEntries(input, manager, null, CWD);
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.entries.map((e) => e.name)).toContain("alpha");
     expect(result.entries.map((e) => e.name)).not.toContain("beta");
   });
@@ -198,15 +204,21 @@ describe("findSkillPathMatch", () => {
   ];
 
   test("returns null for empty normalized path", () => {
-    expect(findSkillPathMatch("", entries)).toBeNull();
+    expect(findSkillPathMatch("", entries, normalizer)).toBeNull();
   });
 
   test("returns null for empty entries array", () => {
-    expect(findSkillPathMatch("/skills/librarian/SKILL.md", [])).toBeNull();
+    expect(
+      findSkillPathMatch("/skills/librarian/SKILL.md", [], normalizer),
+    ).toBeNull();
   });
 
   test("matches exact location path", () => {
-    const match = findSkillPathMatch("/skills/librarian/SKILL.md", entries);
+    const match = findSkillPathMatch(
+      "/skills/librarian/SKILL.md",
+      entries,
+      normalizer,
+    );
     expect(match?.name).toBe("librarian");
   });
 
@@ -214,12 +226,17 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian/extra/helper.md",
       entries,
+      normalizer,
     );
     expect(match?.name).toBe("librarian");
   });
 
   test("returns null for path not within any skill directory", () => {
-    const match = findSkillPathMatch("/other/path/file.md", entries);
+    const match = findSkillPathMatch(
+      "/other/path/file.md",
+      entries,
+      normalizer,
+    );
     expect(match).toBeNull();
   });
 
@@ -228,6 +245,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian-extra/SKILL.md",
       entries,
+      normalizer,
     );
     expect(match).toBeNull();
   });
@@ -254,6 +272,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/parent/child/helper.md",
       nestedEntries,
+      normalizer,
     );
     expect(match?.name).toBe("child");
   });
@@ -329,7 +348,7 @@ test("REGRESSION: resolveSkillPromptEntries sanitizes every available_skills blo
       prompt,
       asChecker(manager),
       null,
-      "/cwd",
+      new PathNormalizer("linux", "/cwd"),
     );
 
     expect(result.prompt).not.toContain("denied-skill");
@@ -376,17 +395,19 @@ test("REGRESSION: resolveSkillPromptEntries keeps only visible skills available
       prompt,
       asChecker(manager),
       null,
-      "/cwd",
+      new PathNormalizer("linux", "/cwd"),
     );
     const visiblePath = resolve("/cwd", "./skills/visible/file.ts");
     const blockedPath = resolve("/cwd", "./skills/blocked/file.ts");
     const matchedVisibleSkill = findSkillPathMatch(
       process.platform === "win32" ? visiblePath.toLowerCase() : visiblePath,
       result.entries,
+      normalizer,
     );
     const matchedBlockedSkill = findSkillPathMatch(
       process.platform === "win32" ? blockedPath.toLowerCase() : blockedPath,
       result.entries,
+      normalizer,
     );
 
     expect(matchedVisibleSkill?.name).toBe("visible-skill");

package/test/subagent-context.test.ts

@@ -66,43 +66,73 @@ describe("isRegisteredSubagentChild", () => {
 
 describe("normalizeFilesystemPath", () => {
   test("normalizes a simple absolute path", () => {
-    expect(normalizeFilesystemPath("/projects/my-app")).toBe(
+    expect(normalizeFilesystemPath("/projects/my-app", "linux")).toBe(
       "/projects/my-app",
     );
   });
 
   test("collapses redundant separators", () => {
-    expect(normalizeFilesystemPath("/projects//my-app")).toBe(
+    expect(normalizeFilesystemPath("/projects//my-app", "linux")).toBe(
       "/projects/my-app",
     );
   });
 
   test("resolves . and .. segments", () => {
-    expect(normalizeFilesystemPath("/projects/my-app/../other")).toBe(
+    expect(normalizeFilesystemPath("/projects/my-app/../other", "linux")).toBe(
       "/projects/other",
     );
   });
+
+  test("win32: lowercases and normalizes with win32 separators", () => {
+    expect(normalizeFilesystemPath("C:\\Projects\\My-App", "win32")).toBe(
+      "c:\\projects\\my-app",
+    );
+  });
+
+  test("posix: leaves case untouched", () => {
+    expect(normalizeFilesystemPath("/Projects/My-App", "linux")).toBe(
+      "/Projects/My-App",
+    );
+  });
+});
+
+describe("isSubagentExecutionContext — injected platform (#510)", () => {
+  test("win32: detects a subagent session dir case-insensitively", () => {
+    const subagentRoot = "C:\\Sessions\\Subagents";
+    const sessionDir = "c:\\sessions\\subagents\\child";
+    expect(
+      isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot, "win32"),
+    ).toBe(true);
+  });
+
+  test("posix: the same mixed-case dir is not a subagent context", () => {
+    const subagentRoot = "/Sessions/Subagents";
+    const sessionDir = "/sessions/subagents/child";
+    expect(
+      isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot, "linux"),
+    ).toBe(false);
+  });
 });
 
 describe("isSubagentExecutionContext — env hint detection", () => {
   test("returns true when PI_IS_SUBAGENT is set", () => {
     vi.stubEnv("PI_IS_SUBAGENT", "true");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_SESSION_ID is set", () => {
     vi.stubEnv("PI_SUBAGENT_SESSION_ID", "abc123");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_AGENT_ROUTER_SUBAGENT is set", () => {
     vi.stubEnv("PI_AGENT_ROUTER_SUBAGENT", "1");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
@@ -110,35 +140,35 @@ describe("isSubagentExecutionContext — env hint detection", () => {
   test("returns true when PI_SUBAGENT_CHILD is set", () => {
     vi.stubEnv("PI_SUBAGENT_CHILD", "1");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_RUN_ID is set", () => {
     vi.stubEnv("PI_SUBAGENT_RUN_ID", "run-abc");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_CHILD_AGENT is set", () => {
     vi.stubEnv("PI_SUBAGENT_CHILD_AGENT", "worker");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_DEPTH is set", () => {
     vi.stubEnv("PI_SUBAGENT_DEPTH", "1");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_DEPTH is zero (depth-0 is still a subagent context)", () => {
     vi.stubEnv("PI_SUBAGENT_DEPTH", "0");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
@@ -146,28 +176,28 @@ describe("isSubagentExecutionContext — env hint detection", () => {
   test("returns true when PI_SUBAGENT_NAME is set", () => {
     vi.stubEnv("PI_SUBAGENT_NAME", "my-agent");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_ID is set", () => {
     vi.stubEnv("PI_SUBAGENT_ID", "id-xyz");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_SESSION is set", () => {
     vi.stubEnv("PI_SUBAGENT_SESSION", "session-xyz");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
   test("returns true when PI_SUBAGENT_ACTIVITY_FILE is set", () => {
     vi.stubEnv("PI_SUBAGENT_ACTIVITY_FILE", "/tmp/activity.json");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(true);
   });
 
@@ -191,14 +221,14 @@ describe("isSubagentExecutionContext — env hint detection", () => {
   test("returns false when env hint value is empty string", () => {
     vi.stubEnv("PI_IS_SUBAGENT", "");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(false);
   });
 
   test("returns false when env hint value is whitespace only", () => {
     vi.stubEnv("PI_IS_SUBAGENT", "   ");
     expect(
-      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents"),
+      isSubagentExecutionContext(makeCtx(null), "/sessions/subagents", "linux"),
     ).toBe(false);
   });
 });
@@ -208,38 +238,42 @@ describe("isSubagentExecutionContext — session dir detection", () => {
 
   test("returns true when session dir is within subagent root", () => {
     const sessionDir = `${subagentRoot}/session-abc`;
-    expect(isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot)).toBe(
-      true,
-    );
+    expect(
+      isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot, "linux"),
+    ).toBe(true);
   });
 
   test("returns true when session dir equals subagent root", () => {
     expect(
-      isSubagentExecutionContext(makeCtx(subagentRoot), subagentRoot),
+      isSubagentExecutionContext(makeCtx(subagentRoot), subagentRoot, "linux"),
     ).toBe(true);
   });
 
   test("returns false when session dir is outside subagent root", () => {
     const sessionDir = "/home/user/.pi/agent/sessions/main-session";
-    expect(isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot)).toBe(
-      false,
-    );
+    expect(
+      isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot, "linux"),
+    ).toBe(false);
   });
 
   test("returns false when session dir is a sibling with shared prefix", () => {
     // "/sessions/subagents-extra" should not match root "/sessions/subagents"
     const sessionDir = `${subagentRoot}-extra/session-abc`;
-    expect(isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot)).toBe(
-      false,
-    );
+    expect(
+      isSubagentExecutionContext(makeCtx(sessionDir), subagentRoot, "linux"),
+    ).toBe(false);
   });
 
   test("returns false when getSessionDir returns null", () => {
-    expect(isSubagentExecutionContext(makeCtx(null), subagentRoot)).toBe(false);
+    expect(
+      isSubagentExecutionContext(makeCtx(null), subagentRoot, "linux"),
+    ).toBe(false);
   });
 
   test("returns false when getSessionDir returns empty string", () => {
-    expect(isSubagentExecutionContext(makeCtx(""), subagentRoot)).toBe(false);
+    expect(isSubagentExecutionContext(makeCtx(""), subagentRoot, "linux")).toBe(
+      false,
+    );
   });
 });
 
@@ -256,6 +290,7 @@ describe("isSubagentExecutionContext — registry detection", () => {
       isSubagentExecutionContext(
         makeCtx(outsideDir, childSessionId),
         subagentRoot,
+        "linux",
         registry,
       ),
     ).toBe(true);
@@ -268,6 +303,7 @@ describe("isSubagentExecutionContext — registry detection", () => {
       isSubagentExecutionContext(
         makeCtx(outsideDir, childSessionId),
         subagentRoot,
+        "linux",
         registry,
       ),
     ).toBe(true);
@@ -279,6 +315,7 @@ describe("isSubagentExecutionContext — registry detection", () => {
       isSubagentExecutionContext(
         makeCtx(outsideDir, childSessionId),
         subagentRoot,
+        "linux",
         registry,
       ),
     ).toBe(false);
@@ -287,7 +324,12 @@ describe("isSubagentExecutionContext — registry detection", () => {
   test("returns false when session id is empty and registry has no matching entry", () => {
     const registry = new SubagentSessionRegistry();
     expect(
-      isSubagentExecutionContext(makeCtx(null, ""), subagentRoot, registry),
+      isSubagentExecutionContext(
+        makeCtx(null, ""),
+        subagentRoot,
+        "linux",
+        registry,
+      ),
     ).toBe(false);
   });
 
@@ -301,6 +343,7 @@ describe("isSubagentExecutionContext — registry detection", () => {
       isSubagentExecutionContext(
         makeCtx(outsideDir, childSessionId),
         subagentRoot,
+        "linux",
         registry,
       ),
     ).toBe(true);
@@ -314,6 +357,7 @@ describe("isSubagentExecutionContext — registry detection", () => {
       isSubagentExecutionContext(
         makeCtx(outsideDir, childSessionId),
         subagentRoot,
+        "linux",
         registry,
       ),
     ).toBe(true);
@@ -321,6 +365,8 @@ describe("isSubagentExecutionContext — registry detection", () => {
 
   test("no registry passed — existing behaviour unchanged", () => {
     // Ensure the parameter is truly optional (no registry arg)
-    expect(isSubagentExecutionContext(makeCtx(null), subagentRoot)).toBe(false);
+    expect(
+      isSubagentExecutionContext(makeCtx(null), subagentRoot, "linux"),
+    ).toBe(false);
   });
 });

package/test/synthesize.test.ts

@@ -30,15 +30,17 @@ describe("synthesizeDefaults", () => {
 
   test("universal rule catches any surface via wildcardMatch", () => {
     const rules = synthesizeDefaults("ask");
-    expect(evaluate("read", "*", rules).action).toBe("ask");
-    expect(evaluate("bash", "git status", rules).action).toBe("ask");
-    expect(evaluate("external_directory", "*", rules).action).toBe("ask");
-    expect(evaluate("future_surface", "*", rules).action).toBe("ask");
+    expect(evaluate("read", "*", rules, "linux").action).toBe("ask");
+    expect(evaluate("bash", "git status", rules, "linux").action).toBe("ask");
+    expect(evaluate("external_directory", "*", rules, "linux").action).toBe(
+      "ask",
+    );
+    expect(evaluate("future_surface", "*", rules, "linux").action).toBe("ask");
   });
 
   test("universal rule has layer 'default'", () => {
     const rules = synthesizeDefaults("allow");
-    expect(evaluate("read", "*", rules).layer).toBe("default");
+    expect(evaluate("read", "*", rules, "linux").layer).toBe("default");
   });
 
   test("defaults to origin 'builtin' when no origin supplied", () => {
@@ -54,7 +56,7 @@ describe("synthesizeDefaults", () => {
 
   test("origin is preserved through evaluate()", () => {
     const rules = synthesizeDefaults("allow", "project");
-    const result = evaluate("read", "*", rules);
+    const result = evaluate("read", "*", rules, "linux");
     expect(result.origin).toBe("project");
   });
 
@@ -171,7 +173,7 @@ describe("synthesizeBaseline", () => {
       },
     ];
     const rules = synthesizeBaseline(configRules);
-    const result = evaluate("mcp", "mcp_status", rules);
+    const result = evaluate("mcp", "mcp_status", rules, "linux");
     expect(result.action).toBe("allow");
     expect(result.layer).toBe("baseline");
     expect(result.origin).toBe("baseline");
@@ -218,7 +220,7 @@ describe("composeRuleset", () => {
       },
     ];
     const composed = composeRuleset(defaults, [], config);
-    const result = evaluate("bash", "echo hello", composed);
+    const result = evaluate("bash", "echo hello", composed, "linux");
     expect(result.action).toBe("deny");
     expect(result.layer).toBe("config");
   });
@@ -235,7 +237,7 @@ describe("composeRuleset", () => {
       },
     ];
     const composed = composeRuleset(defaults, [], config);
-    const result = evaluate("read", "*", composed);
+    const result = evaluate("read", "*", composed, "linux");
     expect(result.action).toBe("allow");
     expect(result.layer).toBe("config");
   });
@@ -261,7 +263,7 @@ describe("composeRuleset", () => {
       },
     ];
     const composed = composeRuleset(defaults, baseline, config);
-    const result = evaluate("mcp", "mcp_status", composed);
+    const result = evaluate("mcp", "mcp_status", composed, "linux");
     expect(result.action).toBe("deny");
     expect(result.layer).toBe("config");
   });
@@ -287,7 +289,7 @@ describe("composeRuleset", () => {
       },
     ];
     const composed = composeRuleset(defaults, baseline, config);
-    const result = evaluate("mcp", "exa_web_search", composed);
+    const result = evaluate("mcp", "exa_web_search", composed, "linux");
     expect(result.action).toBe("allow");
     expect(result.layer).toBe("config");
   });