@gotgenes/pi-permission-system 17.0.0 → 17.1.1

package/test/bash-external-directory.test.ts

@@ -18,13 +18,27 @@ vi.mock("node:fs", () => ({
 }));
 
 import { formatDenyReason } from "#src/denial-messages";
-import { extractExternalPathsFromBashCommand } from "#src/handlers/gates/bash-path-extractor";
+import { extractExternalPathsFromBashCommand as extractWithNormalizer } from "#src/handlers/gates/bash-path-extractor";
 import { formatBashExternalDirectoryAskPrompt } from "#src/handlers/gates/external-directory-messages";
+import { PathNormalizer } from "#src/path-normalizer";
 
 afterEach(() => {
   vi.restoreAllMocks();
 });
 
+// The production facade now takes a PathNormalizer (platform + cwd baked in);
+// this wrapper preserves the (command, cwd) call shape the suite uses
+// throughout so the projection-correctness assertions stay unchanged.
+function extractExternalPathsFromBashCommand(
+  command: string,
+  cwd: string,
+): Promise<string[]> {
+  return extractWithNormalizer(
+    command,
+    new PathNormalizer(process.platform, cwd),
+  );
+}
+
 describe("extractExternalPathsFromBashCommand", () => {
   const cwd = "/projects/my-app";
 
@@ -939,6 +953,44 @@ describe("formatBashExternalDirectoryAskPrompt", () => {
   });
 });
 
+describe("Windows drive-letter paths (win32 semantics)", () => {
+  const windowsCwd = "C:/projects/app";
+
+  async function extractWin32(command: string): Promise<string[]> {
+    return extractWithNormalizer(
+      command,
+      new PathNormalizer("win32", windowsCwd),
+    );
+  }
+
+  test("forward-slash drive path outside CWD is flagged", async () => {
+    const result = await extractWin32("cat C:/Windows/win.ini");
+    expect(result).not.toHaveLength(0);
+  });
+
+  test("different drive letter outside CWD is flagged", async () => {
+    const result = await extractWin32("cat D:/secrets/password.txt");
+    expect(result).not.toHaveLength(0);
+  });
+
+  test("drive path inside CWD is not flagged (known base)", async () => {
+    const result = await extractWin32("cat C:/projects/app/inside.txt");
+    expect(result).toHaveLength(0);
+  });
+
+  test("drive path inside CWD is not flagged after non-literal cd (unknown base)", async () => {
+    // Before the isRelativeCandidate conversion, the hand-rolled startsWith("/")
+    // check treats C:/ as relative on win32, so the unknown-base conservative
+    // branch fires and over-flags an inside-CWD drive path.
+    // After the conversion (!normalizer.isAbsolute), C:/ is absolute on win32
+    // and routes to the resolved branch with its inside-CWD check.
+    const result = await extractWin32(
+      'cd "$D" && cat C:/projects/app/inside.txt',
+    );
+    expect(result).toHaveLength(0);
+  });
+});
+
 describe("bash external-directory denial messages (centralized)", () => {
   test("denial message includes command, paths, and extension tag", () => {
     const result = formatDenyReason({

package/test/canonicalize-path.test.ts

@@ -21,12 +21,14 @@ describe("canonicalizePath", () => {
   });
 
   test("returns empty string for empty input", () => {
-    expect(canonicalizePath("")).toBe("");
+    expect(canonicalizePath("", "linux")).toBe("");
   });
 
   test("returns realpathSync result when path exists", () => {
     realpathSync.mockReturnValueOnce("/real/projects/app");
-    expect(canonicalizePath("/projects/link")).toBe("/real/projects/app");
+    expect(canonicalizePath("/projects/link", "linux")).toBe(
+      "/real/projects/app",
+    );
   });
 
   test("re-appends a non-existent leaf to the canonical parent", () => {
@@ -35,7 +37,7 @@ describe("canonicalizePath", () => {
         throw enoent("/projects/app/new-file.ts");
       })
       .mockReturnValueOnce("/canonical/app");
-    expect(canonicalizePath("/projects/app/new-file.ts")).toBe(
+    expect(canonicalizePath("/projects/app/new-file.ts", "linux")).toBe(
       "/canonical/app/new-file.ts",
     );
   });
@@ -52,7 +54,7 @@ describe("canonicalizePath", () => {
         throw enoent("/projects/app");
       })
       .mockReturnValueOnce("/canonical/projects");
-    expect(canonicalizePath("/projects/app/src/new-file.ts")).toBe(
+    expect(canonicalizePath("/projects/app/src/new-file.ts", "linux")).toBe(
       "/canonical/projects/app/src/new-file.ts",
     );
   });
@@ -61,7 +63,7 @@ describe("canonicalizePath", () => {
     realpathSync.mockImplementation(() => {
       throw enoent("");
     });
-    expect(canonicalizePath("/nonexistent/path/file.ts")).toBe(
+    expect(canonicalizePath("/nonexistent/path/file.ts", "linux")).toBe(
       "/nonexistent/path/file.ts",
     );
   });
@@ -70,14 +72,18 @@ describe("canonicalizePath", () => {
     realpathSync.mockImplementation(() => {
       throw Object.assign(new Error("ELOOP"), { code: "ELOOP" });
     });
-    expect(canonicalizePath("/some/looping/path")).toBe("/some/looping/path");
+    expect(canonicalizePath("/some/looping/path", "linux")).toBe(
+      "/some/looping/path",
+    );
   });
 
   test("returns input unchanged on EACCES (permission denied)", () => {
     realpathSync.mockImplementation(() => {
       throw Object.assign(new Error("EACCES"), { code: "EACCES" });
     });
-    expect(canonicalizePath("/restricted/path")).toBe("/restricted/path");
+    expect(canonicalizePath("/restricted/path", "linux")).toBe(
+      "/restricted/path",
+    );
   });
 
   test("handles ENOTDIR by walking up (like ENOENT)", () => {
@@ -86,8 +92,28 @@ describe("canonicalizePath", () => {
         throw Object.assign(new Error("ENOTDIR"), { code: "ENOTDIR" });
       })
       .mockReturnValueOnce("/real/parent");
-    expect(canonicalizePath("/real/parent/not-a-dir")).toBe(
+    expect(canonicalizePath("/real/parent/not-a-dir", "linux")).toBe(
       "/real/parent/not-a-dir",
     );
   });
+
+  // ── injected platform flavor (win32-separator splitting) ──────────────
+
+  test("win32: splits and rejoins on the backslash separator", () => {
+    realpathSync
+      .mockImplementationOnce(() => {
+        throw enoent("C:\\projects\\link\\file.ts");
+      })
+      .mockReturnValueOnce("C:\\real\\app");
+    expect(canonicalizePath("C:\\projects\\link\\file.ts", "win32")).toBe(
+      "C:\\real\\app\\file.ts",
+    );
+  });
+
+  test("win32: resolves an existing path via realpathSync", () => {
+    realpathSync.mockReturnValueOnce("C:\\real\\app");
+    expect(canonicalizePath("C:\\projects\\link", "win32")).toBe(
+      "C:\\real\\app",
+    );
+  });
 });

package/test/forwarding-manager.test.ts

@@ -30,7 +30,11 @@ function makeForwarder() {
 }
 
 function makeManager() {
-  return new ForwardingManager("/agent/subagent-sessions", makeForwarder());
+  return new ForwardingManager(
+    "/agent/subagent-sessions",
+    makeForwarder(),
+    "linux",
+  );
 }
 
 // ── Tests ─────────────────────────────────────────────────────────────────
@@ -180,6 +184,7 @@ describe("ForwardingManager", () => {
       const manager = new ForwardingManager(
         "/custom/subagent-dir",
         makeForwarder(),
+        "linux",
       );
       const ctx = makeCtx();
       manager.start(ctx);
@@ -187,6 +192,7 @@ describe("ForwardingManager", () => {
       expect(mockIsSubagentExecutionContext).toHaveBeenCalledWith(
         ctx,
         "/custom/subagent-dir",
+        "linux",
         undefined,
       );
     });

package/test/handlers/external-directory-symlink-acceptance.test.ts

@@ -22,6 +22,7 @@ import {
 } from "#src/handlers/gates/descriptor";
 import { describeExternalDirectoryGate } from "#src/handlers/gates/external-directory";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import { PermissionResolver } from "#src/permission-resolver";
 import { SessionRules } from "#src/session-rules";
 import type { ScopeConfig } from "#src/types";
@@ -83,7 +84,12 @@ describe("external_directory symlink acceptance (#418)", () => {
       },
     });
     try {
-      const result = describeExternalDirectoryGate(readTcc(), [], resolver);
+      const result = describeExternalDirectoryGate(
+        readTcc(),
+        [],
+        resolver,
+        new PathNormalizer(process.platform, cwd),
+      );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("allow");
     } finally {
@@ -101,7 +107,12 @@ describe("external_directory symlink acceptance (#418)", () => {
       },
     });
     try {
-      const result = describeExternalDirectoryGate(readTcc(), [], resolver);
+      const result = describeExternalDirectoryGate(
+        readTcc(),
+        [],
+        resolver,
+        new PathNormalizer(process.platform, cwd),
+      );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("allow");
     } finally {
@@ -114,7 +125,12 @@ describe("external_directory symlink acceptance (#418)", () => {
       permission: { external_directory: { "*": "ask" } },
     });
     try {
-      const result = describeExternalDirectoryGate(readTcc(), [], resolver);
+      const result = describeExternalDirectoryGate(
+        readTcc(),
+        [],
+        resolver,
+        new PathNormalizer(process.platform, cwd),
+      );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("ask");
     } finally {
@@ -137,7 +153,10 @@ describe("external_directory symlink acceptance (#418)", () => {
         toolCallId: "tc-2",
         cwd,
       };
-      const program = await BashProgram.parse(command, cwd);
+      const program = await BashProgram.parse(
+        command,
+        new PathNormalizer(process.platform, cwd),
+      );
       const result = describeBashExternalDirectoryGate(tcc, program, resolver);
       // All external paths are covered by the allow → bypass, no prompt.
       expect(isGateBypass(result)).toBe(true);

package/test/handlers/gates/bash-command-metamorphic.test.ts

@@ -12,6 +12,7 @@
 import { describe, expect, it } from "vitest";
 import { BashProgram } from "#src/access-intent/bash/program";
 import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { PermissionState } from "#src/types";
 
@@ -48,7 +49,10 @@ async function decide(
   command: string,
   resolver: ScopedPermissionResolver,
 ): Promise<PermissionState> {
-  const program = await BashProgram.parse(command, "/cwd");
+  const program = await BashProgram.parse(
+    command,
+    new PathNormalizer(process.platform, "/cwd"),
+  );
   return resolveBashCommandCheck(
     command,
     program.commands(),

package/test/handlers/gates/bash-external-directory.test.ts

@@ -9,6 +9,7 @@ import type {
 } from "#src/handlers/gates/descriptor";
 import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { PermissionCheckResult } from "#src/types";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
@@ -59,7 +60,10 @@ async function describeGate(
   const command = getNonEmptyString(toRecord(tcc.input).command);
   const bashProgram =
     tcc.toolName === "bash" && command
-      ? await BashProgram.parse(command, tcc.cwd)
+      ? await BashProgram.parse(
+          command,
+          new PathNormalizer(process.platform, tcc.cwd),
+        )
       : null;
   return describeBashExternalDirectoryGate(tcc, bashProgram, resolver);
 }

package/test/handlers/gates/bash-path.test.ts

@@ -19,6 +19,7 @@ import type {
 } from "#src/handlers/gates/descriptor";
 import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
 
@@ -45,7 +46,10 @@ async function describeGate(
   const command = getNonEmptyString(toRecord(tcc.input).command);
   const bashProgram =
     tcc.toolName === "bash" && command
-      ? await BashProgram.parse(command, tcc.cwd)
+      ? await BashProgram.parse(
+          command,
+          new PathNormalizer(process.platform, tcc.cwd),
+        )
       : null;
   return describeBashPathGate(tcc, bashProgram, resolver);
 }
@@ -235,6 +239,7 @@ describe("describeBashPathGate", () => {
       path: AccessPath.forPath("src/file.txt", {
         cwd: "/test/project",
         resolveBase: "/test/project/nested",
+        platform: "linux",
       }),
       agentName: undefined,
     });

package/test/handlers/gates/external-directory-policy.test.ts

@@ -25,7 +25,10 @@ function makeCheckResult(
 
 describe("resolveExternalDirectoryPolicy", () => {
   it("resolves the path's match aliases on the external_directory surface (#418)", () => {
-    const path = AccessPath.forPath("/outside/a.ts", { cwd });
+    const path = AccessPath.forPath("/outside/a.ts", {
+      cwd,
+      platform: "linux",
+    });
     const resolver = makeResolver(makeCheckResult("ask"));
 
     const result = resolveExternalDirectoryPolicy(path, resolver, undefined);
@@ -40,7 +43,10 @@ describe("resolveExternalDirectoryPolicy", () => {
   });
 
   it("threads the agent name through to the resolver", () => {
-    const path = AccessPath.forPath("/outside/a.ts", { cwd });
+    const path = AccessPath.forPath("/outside/a.ts", {
+      cwd,
+      platform: "linux",
+    });
     const resolver = makeResolver(makeCheckResult("allow"));
 
     resolveExternalDirectoryPolicy(path, resolver, "reviewer");
@@ -57,8 +63,8 @@ describe("resolveExternalDirectoryPolicy", () => {
 describe("selectUncoveredExternalPaths", () => {
   it("returns no uncovered paths when every path resolves to allow", () => {
     const paths = [
-      AccessPath.forPath("/outside/a.ts", { cwd }),
-      AccessPath.forPath("/outside/b.ts", { cwd }),
+      AccessPath.forPath("/outside/a.ts", { cwd, platform: "linux" }),
+      AccessPath.forPath("/outside/b.ts", { cwd, platform: "linux" }),
     ];
     const resolver = makeResolver(makeCheckResult("allow"));
 
@@ -73,8 +79,14 @@ describe("selectUncoveredExternalPaths", () => {
   });
 
   it("collects only paths whose resolved state is not allow", () => {
-    const allowed = AccessPath.forPath("/outside/ok.ts", { cwd });
-    const asked = AccessPath.forPath("/outside/ask.ts", { cwd });
+    const allowed = AccessPath.forPath("/outside/ok.ts", {
+      cwd,
+      platform: "linux",
+    });
+    const asked = AccessPath.forPath("/outside/ask.ts", {
+      cwd,
+      platform: "linux",
+    });
     const resolver = makeResolver();
     resolver.resolve.mockImplementation((intent) => {
       const values =
@@ -94,8 +106,14 @@ describe("selectUncoveredExternalPaths", () => {
   });
 
   it("returns the most restrictive uncovered check as worstCheck (deny > ask)", () => {
-    const asked = AccessPath.forPath("/outside/ask.ts", { cwd });
-    const denied = AccessPath.forPath("/outside/deny.ts", { cwd });
+    const asked = AccessPath.forPath("/outside/ask.ts", {
+      cwd,
+      platform: "linux",
+    });
+    const denied = AccessPath.forPath("/outside/deny.ts", {
+      cwd,
+      platform: "linux",
+    });
     const resolver = makeResolver();
     resolver.resolve.mockImplementation((intent) => {
       const values =

package/test/handlers/gates/external-directory.test.ts

@@ -7,6 +7,7 @@ import type {
 import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
 import { describeExternalDirectoryGate } from "#src/handlers/gates/external-directory";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import { makeResolver } from "#test/helpers/gate-fixtures";
@@ -37,7 +38,13 @@ function gateUnderTest(
     makeCheckResult({ state: "ask", toolName: "external_directory" }),
   ),
 ) {
-  return describeExternalDirectoryGate(tcc, infraDirs, resolver, extractors);
+  return describeExternalDirectoryGate(
+    tcc,
+    infraDirs,
+    resolver,
+    new PathNormalizer(process.platform, tcc.cwd),
+    extractors,
+  );
 }
 
 // ── tests ────────────────────��────────────────────────────────────��────────

package/test/handlers/gates/path.test.ts

@@ -15,6 +15,7 @@ import type { GateDescriptor } from "#src/handlers/gates/descriptor";
 import { isGateDescriptor } from "#src/handlers/gates/descriptor";
 import { describePathGate } from "#src/handlers/gates/path";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 
 import {
   makeGateCheckResult as makeCheckResult,
@@ -35,6 +36,10 @@ function makeTcc(overrides: Partial<ToolCallContext> = {}): ToolCallContext {
   };
 }
 
+// The gate reads the path normalizer (platform + cwd baked in) from the
+// session; here it is bound to the makeTcc default cwd.
+const normalizer = new PathNormalizer(process.platform, "/test/project");
+
 // ── tests ──────────────────────────────────────────────────────────────────
 
 describe("describePathGate", () => {
@@ -48,6 +53,7 @@ describe("describePathGate", () => {
     const result = describePathGate(
       makeTcc({ toolName: "bash", input: { command: "ls" } }),
       resolver,
+      normalizer,
     );
     expect(result).toBeNull();
     expect(resolver.resolve).not.toHaveBeenCalled();
@@ -58,13 +64,14 @@ describe("describePathGate", () => {
     const result = describePathGate(
       makeTcc({ toolName: "read", input: {} }),
       resolver,
+      normalizer,
     );
     expect(result).toBeNull();
   });
 
   it("returns null when path check result is allow", () => {
     const resolver = makeResolver(makeCheckResult({ state: "allow" }));
-    const result = describePathGate(makeTcc(), resolver);
+    const result = describePathGate(makeTcc(), resolver, normalizer);
     expect(result).toBeNull();
   });
 
@@ -77,7 +84,7 @@ describe("describePathGate", () => {
         origin: "builtin",
       }),
     );
-    const result = describePathGate(makeTcc(), resolver);
+    const result = describePathGate(makeTcc(), resolver, normalizer);
     expect(result).toBeNull();
   });
 
@@ -90,7 +97,7 @@ describe("describePathGate", () => {
         origin: "global",
       }),
     );
-    const result = describePathGate(makeTcc(), resolver);
+    const result = describePathGate(makeTcc(), resolver, normalizer);
     expect(result).not.toBeNull();
     expect(isGateDescriptor(result)).toBe(true);
   });
@@ -99,7 +106,7 @@ describe("describePathGate", () => {
     const resolver = makeResolver(
       makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
     );
-    const result = describePathGate(makeTcc(), resolver);
+    const result = describePathGate(makeTcc(), resolver, normalizer);
     expect(result).not.toBeNull();
     expect(isGateDescriptor(result)).toBe(true);
     const desc = result as GateDescriptor;
@@ -111,7 +118,7 @@ describe("describePathGate", () => {
     const resolver = makeResolver(
       makeCheckResult({ state: "ask", matchedPattern: "*.env" }),
     );
-    const result = describePathGate(makeTcc(), resolver);
+    const result = describePathGate(makeTcc(), resolver, normalizer);
     expect(result).not.toBeNull();
     expect(isGateDescriptor(result)).toBe(true);
     const desc = result as GateDescriptor;
@@ -126,6 +133,7 @@ describe("describePathGate", () => {
     const result = describePathGate(
       makeTcc({ input: { path: "/test/project/src/.env" } }),
       resolver,
+      normalizer,
     ) as GateDescriptor;
     expect(result.sessionApproval).toBeDefined();
     expect(result.sessionApproval?.surface).toBe("path");
@@ -139,6 +147,7 @@ describe("describePathGate", () => {
     const result = describePathGate(
       makeTcc({ input: { path: "index.html" }, cwd: "/test/project" }),
       resolver,
+      normalizer,
     ) as GateDescriptor;
     expect(result.sessionApproval?.surface).toBe("path");
     expect(result.sessionApproval?.representativePattern).toBe(
@@ -150,7 +159,11 @@ describe("describePathGate", () => {
     const resolver = makeResolver(
       makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
     );
-    const result = describePathGate(makeTcc(), resolver) as GateDescriptor;
+    const result = describePathGate(
+      makeTcc(),
+      resolver,
+      normalizer,
+    ) as GateDescriptor;
     expect(result.denialContext).toEqual({
       kind: "path",
       toolName: "read",
@@ -163,18 +176,25 @@ describe("describePathGate", () => {
     const resolver = makeResolver(
       makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
     );
-    const result = describePathGate(makeTcc(), resolver) as GateDescriptor;
+    const result = describePathGate(
+      makeTcc(),
+      resolver,
+      normalizer,
+    ) as GateDescriptor;
     expect(result.decision.surface).toBe("path");
     expect(result.decision.value).toBe(".env");
   });
 
   it("resolves the path surface with an access-path intent and agent name", () => {
     const resolver = makeResolver(makeCheckResult({ state: "allow" }));
-    describePathGate(makeTcc({ agentName: "my-agent" }), resolver);
+    describePathGate(makeTcc({ agentName: "my-agent" }), resolver, normalizer);
     expect(resolver.resolve).toHaveBeenCalledWith({
       kind: "access-path",
       surface: "path",
-      path: AccessPath.forPath(".env", { cwd: "/test/project" }),
+      path: AccessPath.forPath(".env", {
+        cwd: "/test/project",
+        platform: "linux",
+      }),
       agentName: "my-agent",
     });
   });
@@ -185,7 +205,7 @@ describe("describePathGate", () => {
       p === "/test/project/.env" ? "/vault/secret.env" : p,
     );
     const resolver = makeResolver(makeCheckResult({ state: "allow" }));
-    describePathGate(makeTcc(), resolver);
+    describePathGate(makeTcc(), resolver, normalizer);
 
     const intent = resolver.resolve.mock.lastCall?.[0];
     expect(intent?.kind).toBe("access-path");
@@ -209,6 +229,7 @@ describe("describePathGate — home-relative paths", () => {
     const result = describePathGate(
       makeTcc({ input: { path: "~/.ssh/config" } }),
       resolver,
+      normalizer,
     ) as GateDescriptor;
 
     expect(isGateDescriptor(result)).toBe(true);
@@ -222,7 +243,10 @@ describe("describePathGate — home-relative paths", () => {
     expect(resolver.resolve).toHaveBeenCalledWith({
       kind: "access-path",
       surface: "path",
-      path: AccessPath.forPath("~/.ssh/config", { cwd: "/test/project" }),
+      path: AccessPath.forPath("~/.ssh/config", {
+        cwd: "/test/project",
+        platform: "linux",
+      }),
       agentName: undefined,
     });
   });
@@ -234,6 +258,7 @@ describe("describePathGate — home-relative paths", () => {
     const result = describePathGate(
       makeTcc({ input: { path: "$HOME/.ssh/config" } }),
       resolver,
+      normalizer,
     ) as GateDescriptor;
 
     expect(isGateDescriptor(result)).toBe(true);
@@ -249,6 +274,7 @@ describe("describePathGate — home-relative paths", () => {
     const result = describePathGate(
       makeTcc({ input: { path: "~/.ssh/config" } }),
       resolver,
+      normalizer,
     );
     expect(result).toBeNull();
   });
@@ -274,12 +300,16 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
     const result = describePathGate(
       makeTcc({ toolName: "my-ext", input: { path: ".env" } }),
       resolver,
+      normalizer,
     );
     expect(isGateDescriptor(result)).toBe(true);
     expect(resolver.resolve).toHaveBeenCalledWith({
       kind: "access-path",
       surface: "path",
-      path: AccessPath.forPath(".env", { cwd: "/test/project" }),
+      path: AccessPath.forPath(".env", {
+        cwd: "/test/project",
+        platform: "linux",
+      }),
       agentName: undefined,
     });
   });
@@ -291,12 +321,16 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
     const result = describePathGate(
       makeTcc({ toolName: "mcp", input: { arguments: { path: ".env" } } }),
       resolver,
+      normalizer,
     );
     expect(isGateDescriptor(result)).toBe(true);
     expect(resolver.resolve).toHaveBeenCalledWith({
       kind: "access-path",
       surface: "path",
-      path: AccessPath.forPath(".env", { cwd: "/test/project" }),
+      path: AccessPath.forPath(".env", {
+        cwd: "/test/project",
+        platform: "linux",
+      }),
       agentName: undefined,
     });
   });
@@ -308,12 +342,16 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
     describePathGate(
       makeTcc({ toolName: "ffgrep", input: { target: "/etc/passwd" } }),
       resolver,
+      normalizer,
       extractorLookup("ffgrep", "target"),
     );
     expect(resolver.resolve).toHaveBeenCalledWith({
       kind: "access-path",
       surface: "path",
-      path: AccessPath.forPath("/etc/passwd", { cwd: "/test/project" }),
+      path: AccessPath.forPath("/etc/passwd", {
+        cwd: "/test/project",
+        platform: "linux",
+      }),
       agentName: undefined,
     });
   });
@@ -323,6 +361,7 @@ describe("describePathGate — extension and MCP tools (#352)", () => {
     const result = describePathGate(
       makeTcc({ toolName: "my-ext", input: { other: true } }),
       resolver,
+      normalizer,
     );
     expect(result).toBeNull();
     expect(resolver.resolve).not.toHaveBeenCalled();