@gotgenes/pi-permission-system 17.1.0 → 17.1.1

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [17.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v17.1.0...pi-permission-system-v17.1.1) (2026-06-29)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** gate Windows drive-letter paths in bash external_directory ([#508](https://github.com/gotgenes/pi-packages/issues/508)) ([2d33183](https://github.com/gotgenes/pi-packages/commit/2d331834254f58bcb0782b3da353132821536296))
+
 ## [17.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v17.0.0...pi-permission-system-v17.1.0) (2026-06-28)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "17.1.0",
+  "version": "17.1.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/bash-path-resolver.ts

@@ -347,7 +347,7 @@ export class BashPathResolver {
       // anywhere, so flag it conservatively (resolved against the baked cwd
       // only for a display path). Absolute / `~` candidates are base-independent
       // below.
-      if (base.kind === "unknown" && isRelativeCandidate(candidate)) {
+      if (base.kind === "unknown" && this.isRelativeCandidate(candidate)) {
         const accessPath = this.normalizer.forPath(candidate);
         const canonical = accessPath.boundaryValue();
         if (canonical && !isSafeSystemPath(canonical) && !seen.has(canonical)) {
@@ -421,7 +421,7 @@ export class BashPathResolver {
     // An unknown base + relative candidate stays literal-only: a resolved
     // absolute or canonical alias would resolve against the wrong directory and
     // could spuriously match a rule (#393).
-    if (base.kind === "unknown" && isRelativeCandidate(candidate)) {
+    if (base.kind === "unknown" && this.isRelativeCandidate(candidate)) {
       return this.normalizer.forLiteral(normalizePathPolicyLiteral(candidate));
     }
 
@@ -431,6 +431,20 @@ export class BashPathResolver {
         : undefined;
     return this.normalizer.forPath(candidate, { resolveBase });
   }
+
+  /**
+   * True when a path candidate is relative (resolved against the effective
+   * directory) rather than absolute or home-relative (`~…`), which are
+   * base-independent.
+   *
+   * Delegates the absoluteness decision to the platform-aware `PathNormalizer`
+   * rather than a POSIX-only `startsWith("/")` check, so Windows drive-letter
+   * paths (`C:/…`, `C:\…`) are correctly treated as absolute on win32 and as
+   * relative on POSIX (where they denote an in-CWD path).
+   */
+  private isRelativeCandidate(candidate: string): boolean {
+    return !this.normalizer.isAbsolute(candidate) && !candidate.startsWith("~");
+  }
 }
 
 // ── Pure AST/string helpers ──────────────────────────────────────────────────
@@ -519,13 +533,3 @@ function literalTextOf(node: TSNode): string | null {
       return null;
   }
 }
-
-/**
- * True when a path candidate is relative (resolved against the effective
- * directory) rather than absolute (`/…`) or home-relative (`~…`), which are
- * base-independent.
- * Used to decide which candidates an unknown base affects.
- */
-function isRelativeCandidate(candidate: string): boolean {
-  return !candidate.startsWith("/") && !candidate.startsWith("~");
-}

package/src/access-intent/bash/token-classification.ts

@@ -8,6 +8,12 @@
  * Both classifiers share the private `rejectNonPathToken` predicate that captures
  * the seven rejection cases common to both (the production clone this module was
  * extracted to eliminate).
+ *
+ * Both classifiers recognize Windows drive-letter absolute paths (`C:/…`, `C:\…`)
+ * unconditionally on all platforms. On POSIX the token resolves as a real in-CWD
+ * relative path and is gated by the `path` surface; on Windows the `PathNormalizer`
+ * routes it through the absolute-path branch. Shape recognition is platform-independent
+ * string matching; the platform-sensitive absoluteness decision belongs to `PathNormalizer`.
  */
 
 // ── Public classifiers ─────────────────────────────────────────────────────
@@ -19,6 +25,7 @@
  * - Absolute paths (starting with `/`)
  * - Home-relative paths (starting with `~/`)
  * - Parent-traversal paths (containing `..`)
+ * - Windows drive-letter absolute paths (`C:/…` or `C:\…`)
  *
  * Returns the raw token string if it qualifies, or `null` to skip.
  */
@@ -28,6 +35,7 @@ export function classifyTokenAsPathCandidate(token: string): string | null {
   if (token.startsWith("/")) return token;
   if (token.startsWith("~/")) return token;
   if (token.includes("..")) return token;
+  if (WINDOWS_DRIVE_PATH_PATTERN.test(token)) return token;
 
   return null;
 }
@@ -38,8 +46,13 @@ export function classifyTokenAsPathCandidate(token: string): string | null {
  * Accepts the same shapes as `classifyTokenAsPathCandidate`, plus:
  * - Dot-files and `./`-relative paths (starting with `.`)
  * - Any relative path containing `/` (e.g. `src/foo.ts`)
+ * - Windows drive-letter absolute paths (`C:/…` or `C:\…`)
  *
  * The `~/foo` case is covered by `includes("/")` — no separate `~/` branch needed.
+ * The forward-slash drive form (`C:/…`) is also caught by `includes("/")`, but the
+ * explicit `WINDOWS_DRIVE_PATH_PATTERN` branch makes both separator forms first-class
+ * and order-independent, and covers the backslash-only form (`D:\…`) which `includes("/")`
+ * cannot reach.
  *
  * Does NOT require the strict "must start with `/` or `~/` or contain `..`"
  * gate that the external-directory classifier uses.
@@ -52,12 +65,22 @@ export function classifyTokenAsRuleCandidate(token: string): string | null {
   if (token.startsWith(".")) return token;
   if (token.includes("/")) return token; // covers ~/ paths and all relative paths with /
   if (token.includes("..")) return token; // bare ".." (no slash)
+  if (WINDOWS_DRIVE_PATH_PATTERN.test(token)) return token; // backslash-only drive form
 
   return null;
 }
 
 // ── Private rejection predicate ────────────────────────────────────────────
 
+/**
+ * Windows drive-letter absolute path: a single ASCII letter, a colon, then a
+ * separator (`/` or `\`). Matches `C:/…` and `C:\…` but not drive-relative
+ * `C:foo` (no separator) or multi-letter schemes (`https:`, `mailto:`).
+ * Single-letter schemes with `//` (e.g. `c://x`) are already rejected by
+ * `URL_PATTERN` before this pattern is tested.
+ */
+const WINDOWS_DRIVE_PATH_PATTERN = /^[a-zA-Z]:[/\\]/;
+
 /**
  * URL pattern to skip tokens that look like URLs rather than paths.
  */

package/src/handlers/before-agent-start.ts

@@ -84,8 +84,7 @@ export class AgentPrepHandler {
       toolPromptResult.prompt,
       this.resolver,
       agentName,
-      ctx.cwd,
-      this.session.getPlatform(),
+      this.session.getPathNormalizer(),
     );
     this.session.setActiveSkillEntries(skillPromptResult.entries);
     return skillPromptResult.prompt !== event.systemPrompt

package/src/handlers/gates/external-directory.ts

@@ -1,5 +1,5 @@
 import type { PathNormalizer } from "#src/path-normalizer";
-import { getToolInputPath, isPiInfrastructureRead } from "#src/path-utils";
+import { getToolInputPath } from "#src/path-utils";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
@@ -22,7 +22,6 @@ export function describeExternalDirectoryGate(
   infraDirs: string[],
   resolver: ScopedPermissionResolver,
   normalizer: PathNormalizer,
-  platform: NodeJS.Platform,
   extractors?: ToolAccessExtractorLookup,
 ): GateResult {
   const externalDirectoryPath = getToolInputPath(
@@ -40,18 +39,9 @@ export function describeExternalDirectoryGate(
   // check (below) use the canonical, symlink-resolved path; pattern matching
   // uses the typed and resolved aliases (#418).
   const accessPath = normalizer.forPath(externalDirectoryPath);
-  const canonicalExtPath = accessPath.boundaryValue();
 
   // ── Pi infrastructure read bypass ──────────────────────────────────────
-  if (
-    isPiInfrastructureRead(
-      tcc.toolName,
-      canonicalExtPath,
-      infraDirs,
-      tcc.cwd,
-      platform,
-    )
-  ) {
+  if (normalizer.isInfrastructureRead(tcc.toolName, accessPath, infraDirs)) {
     return {
       action: "allow",
       log: {

package/src/handlers/gates/skill-read.ts

@@ -1,4 +1,4 @@
-import { normalizePathForComparison } from "#src/path-utils";
+import type { PathNormalizer } from "#src/path-normalizer";
 import { formatSkillPathAskPrompt } from "#src/permission-prompts";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 import { findSkillPathMatch } from "#src/skill-prompt-sanitizer";
@@ -15,7 +15,7 @@ import type { ToolCallContext } from "./types";
  */
 export function describeSkillReadGate(
   tcc: ToolCallContext,
-  platform: NodeJS.Platform,
+  normalizer: PathNormalizer,
   getActiveSkillEntries: () => SkillPromptEntry[],
 ): GateDescriptor | null {
   const activeSkillEntries = getActiveSkillEntries();
@@ -30,15 +30,11 @@ export function describeSkillReadGate(
     return null;
   }
 
-  const normalizedReadPath = normalizePathForComparison(
-    path,
-    tcc.cwd,
-    platform,
-  );
+  const normalizedReadPath = normalizer.comparableValue(path);
   const matchedSkill = findSkillPathMatch(
     normalizedReadPath,
     activeSkillEntries,
-    platform,
+    normalizer,
   );
 
   if (!matchedSkill) {

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -85,7 +85,7 @@ export class ToolCallGatePipeline {
 
     const gateProducers: Array<() => GateResult | Promise<GateResult>> = [
       () =>
-        describeSkillReadGate(tcc, platform, () =>
+        describeSkillReadGate(tcc, normalizer, () =>
           this.inputs.getActiveSkillEntries(),
         ),
       () =>
@@ -96,7 +96,6 @@ export class ToolCallGatePipeline {
           infraDirs,
           this.resolver,
           normalizer,
-          platform,
           this.customExtractors,
         ),
       () => describeBashExternalDirectoryGate(tcc, bashProgram, this.resolver),

package/src/path-normalizer.ts

@@ -4,6 +4,8 @@ import { AccessPath } from "./access-intent/access-path";
 import {
   isPathOutsideWorkingDirectory,
   isPathWithinDirectory,
+  isPiInfrastructureRead,
+  normalizePathForComparison,
 } from "./path-utils";
 
 /**
@@ -67,4 +69,32 @@ export class PathNormalizer {
   isOutsideWorkingDirectory(pathValue: string): boolean {
     return isPathOutsideWorkingDirectory(pathValue, this.cwd, this.platform);
   }
+
+  /**
+   * Lexical (not symlink-resolved) comparison value, resolved against the baked
+   * cwd. Mirrors the as-typed absolute form used for skill-prompt matching;
+   * touches no filesystem, unlike {@link forPath}'s canonical alias.
+   */
+  comparableValue(pathValue: string): string {
+    return normalizePathForComparison(pathValue, this.cwd, this.platform);
+  }
+
+  /**
+   * Pi infrastructure-read containment for a read-only tool, decided against
+   * the canonical (symlink-resolved) path and the baked cwd/platform. Takes the
+   * already-built {@link AccessPath} so the caller does not re-resolve it.
+   */
+  isInfrastructureRead(
+    toolName: string,
+    accessPath: AccessPath,
+    infraDirs: readonly string[],
+  ): boolean {
+    return isPiInfrastructureRead(
+      toolName,
+      accessPath.boundaryValue(),
+      infraDirs,
+      this.cwd,
+      this.platform,
+    );
+  }
 }

package/src/skill-prompt-sanitizer.ts

@@ -1,9 +1,6 @@
 import { dirname } from "node:path";
 
-import {
-  isPathWithinDirectory,
-  normalizePathForComparison,
-} from "./path-utils";
+import type { PathNormalizer } from "./path-normalizer";
 import type { PermissionCheckResult, PermissionState } from "./types";
 
 /**
@@ -151,24 +148,15 @@ function resolvePermissionState(
 function createResolvedSkillEntry(
   entry: ParsedSkillPromptEntry,
   state: PermissionState,
-  cwd: string,
-  platform: NodeJS.Platform,
+  normalizer: PathNormalizer,
 ): SkillPromptEntry {
   return {
     name: entry.name,
     description: entry.description,
     location: entry.location,
     state,
-    normalizedLocation: normalizePathForComparison(
-      entry.location,
-      cwd,
-      platform,
-    ),
-    normalizedBaseDir: normalizePathForComparison(
-      dirname(entry.location),
-      cwd,
-      platform,
-    ),
+    normalizedLocation: normalizer.comparableValue(entry.location),
+    normalizedBaseDir: normalizer.comparableValue(dirname(entry.location)),
   };
 }
 
@@ -198,8 +186,7 @@ export function resolveSkillPromptEntries(
   prompt: string,
   permissionManager: SkillPermissionChecker,
   agentName: string | null,
-  cwd: string,
-  platform: NodeJS.Platform,
+  normalizer: PathNormalizer,
 ): { prompt: string; entries: SkillPromptEntry[] } {
   const sections = parseAllSkillPromptSections(prompt);
   if (sections.length === 0) {
@@ -219,7 +206,7 @@ export function resolveSkillPromptEntries(
         agentName,
         permissionCache,
       );
-      return createResolvedSkillEntry(entry, state, cwd, platform);
+      return createResolvedSkillEntry(entry, state, normalizer);
     });
 
     const visibleSectionEntries = resolvedEntries.filter(
@@ -267,7 +254,7 @@ export function resolveSkillPromptEntries(
 export function findSkillPathMatch(
   normalizedPath: string,
   entries: readonly SkillPromptEntry[],
-  platform: NodeJS.Platform,
+  normalizer: PathNormalizer,
 ): SkillPromptEntry | null {
   if (!normalizedPath || entries.length === 0) {
     return null;
@@ -286,7 +273,7 @@ export function findSkillPathMatch(
   for (const entry of entries) {
     if (
       !entry.normalizedBaseDir ||
-      !isPathWithinDirectory(normalizedPath, entry.normalizedBaseDir, platform)
+      !normalizer.isWithinDirectory(normalizedPath, entry.normalizedBaseDir)
     ) {
       continue;
     }

package/test/access-intent/bash/token-classification.test.ts

@@ -114,6 +114,40 @@ describe("classifyTokenAsPathCandidate", () => {
       expect(classifyTokenAsPathCandidate("./build")).toBeNull();
     });
   });
+
+  describe("Windows drive-letter acceptance gate", () => {
+    test("forward-slash drive path → returned as-is", () => {
+      expect(classifyTokenAsPathCandidate("C:/Windows/win.ini")).toBe(
+        "C:/Windows/win.ini",
+      );
+      expect(classifyTokenAsPathCandidate("D:/secrets/password.txt")).toBe(
+        "D:/secrets/password.txt",
+      );
+    });
+
+    test("backslash drive path → returned as-is", () => {
+      expect(classifyTokenAsPathCandidate("C:\\Windows\\win.ini")).toBe(
+        "C:\\Windows\\win.ini",
+      );
+      expect(classifyTokenAsPathCandidate("D:\\secrets\\password.txt")).toBe(
+        "D:\\secrets\\password.txt",
+      );
+    });
+
+    test("lowercase drive letter → returned as-is", () => {
+      expect(classifyTokenAsPathCandidate("c:/foo")).toBe("c:/foo");
+    });
+
+    test("single-letter scheme with double-slash (c://x) → null (URL_PATTERN fires first)", () => {
+      // c:// matches URL_PATTERN before the drive-letter check runs.
+      expect(classifyTokenAsPathCandidate("c://x")).toBeNull();
+    });
+
+    test("drive-relative path without separator (C:foo) → null", () => {
+      // No / or \ after the colon — not an absolute drive path per node:path.
+      expect(classifyTokenAsPathCandidate("C:foo")).toBeNull();
+    });
+  });
 });
 
 describe("classifyTokenAsRuleCandidate", () => {
@@ -204,6 +238,35 @@ describe("classifyTokenAsRuleCandidate", () => {
     });
   });
 
+  describe("Windows drive-letter acceptance gate", () => {
+    test("forward-slash drive path → returned as-is", () => {
+      // Forward-slash form was already accepted via token.includes("/").
+      // The explicit branch makes it first-class and order-independent.
+      expect(classifyTokenAsRuleCandidate("C:/Windows/win.ini")).toBe(
+        "C:/Windows/win.ini",
+      );
+    });
+
+    test("backslash drive path → returned as-is (new: no forward slash)", () => {
+      // Previously dropped by both classifiers; the backslash form has no /
+      // so the includes("/") branch could not catch it.
+      expect(classifyTokenAsRuleCandidate("D:\\secrets\\password.txt")).toBe(
+        "D:\\secrets\\password.txt",
+      );
+      expect(classifyTokenAsRuleCandidate("C:\\Windows\\win.ini")).toBe(
+        "C:\\Windows\\win.ini",
+      );
+    });
+
+    test("lowercase drive letter (backslash) → returned as-is", () => {
+      expect(classifyTokenAsRuleCandidate("c:\\foo")).toBe("c:\\foo");
+    });
+
+    test("drive-relative path without separator (C:foo) → null", () => {
+      expect(classifyTokenAsRuleCandidate("C:foo")).toBeNull();
+    });
+  });
+
   describe("rule-vs-path divergence", () => {
     const dotFiles = [".env", ".gitignore", ".eslintrc"];
     const relPaths = ["src/index.ts", "lib/utils.js", "config/settings.json"];
@@ -230,6 +293,18 @@ describe("classifyTokenAsRuleCandidate", () => {
       });
     }
 
+    const winDrivePaths = [
+      "C:/Windows/win.ini",
+      "D:\\secrets\\password.txt",
+      "c:/foo",
+    ];
+    for (const tok of winDrivePaths) {
+      test(`Windows drive path "${tok}": both classifiers accept`, () => {
+        expect(classifyTokenAsRuleCandidate(tok)).toBe(tok);
+        expect(classifyTokenAsPathCandidate(tok)).toBe(tok);
+      });
+    }
+
     const sharedRejected = ["hello", "--flag", "FOO=/bar", "https://x.com"];
     for (const tok of sharedRejected) {
       test(`"${tok}": both classifiers reject`, () => {

package/test/bash-external-directory.test.ts

@@ -953,6 +953,44 @@ describe("formatBashExternalDirectoryAskPrompt", () => {
   });
 });
 
+describe("Windows drive-letter paths (win32 semantics)", () => {
+  const windowsCwd = "C:/projects/app";
+
+  async function extractWin32(command: string): Promise<string[]> {
+    return extractWithNormalizer(
+      command,
+      new PathNormalizer("win32", windowsCwd),
+    );
+  }
+
+  test("forward-slash drive path outside CWD is flagged", async () => {
+    const result = await extractWin32("cat C:/Windows/win.ini");
+    expect(result).not.toHaveLength(0);
+  });
+
+  test("different drive letter outside CWD is flagged", async () => {
+    const result = await extractWin32("cat D:/secrets/password.txt");
+    expect(result).not.toHaveLength(0);
+  });
+
+  test("drive path inside CWD is not flagged (known base)", async () => {
+    const result = await extractWin32("cat C:/projects/app/inside.txt");
+    expect(result).toHaveLength(0);
+  });
+
+  test("drive path inside CWD is not flagged after non-literal cd (unknown base)", async () => {
+    // Before the isRelativeCandidate conversion, the hand-rolled startsWith("/")
+    // check treats C:/ as relative on win32, so the unknown-base conservative
+    // branch fires and over-flags an inside-CWD drive path.
+    // After the conversion (!normalizer.isAbsolute), C:/ is absolute on win32
+    // and routes to the resolved branch with its inside-CWD check.
+    const result = await extractWin32(
+      'cd "$D" && cat C:/projects/app/inside.txt',
+    );
+    expect(result).toHaveLength(0);
+  });
+});
+
 describe("bash external-directory denial messages (centralized)", () => {
   test("denial message includes command, paths, and extension tag", () => {
     const result = formatDenyReason({

package/test/handlers/external-directory-symlink-acceptance.test.ts

@@ -89,7 +89,6 @@ describe("external_directory symlink acceptance (#418)", () => {
         [],
         resolver,
         new PathNormalizer(process.platform, cwd),
-        "linux",
       );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("allow");
@@ -113,7 +112,6 @@ describe("external_directory symlink acceptance (#418)", () => {
         [],
         resolver,
         new PathNormalizer(process.platform, cwd),
-        "linux",
       );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("allow");
@@ -132,7 +130,6 @@ describe("external_directory symlink acceptance (#418)", () => {
         [],
         resolver,
         new PathNormalizer(process.platform, cwd),
-        "linux",
       );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("ask");

package/test/handlers/gates/external-directory.test.ts

@@ -43,7 +43,6 @@ function gateUnderTest(
     infraDirs,
     resolver,
     new PathNormalizer(process.platform, tcc.cwd),
-    "linux",
     extractors,
   );
 }

package/test/handlers/gates/skill-read.test.ts

@@ -1,8 +1,12 @@
 import { describe, expect, it, vi } from "vitest";
 import { describeSkillReadGate } from "#src/handlers/gates/skill-read";
 import type { ToolCallContext } from "#src/handlers/gates/types";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 
+// All test tccs use cwd "/test/project"; one normalizer serves every call.
+const normalizer = new PathNormalizer("linux", "/test/project");
+
 // ── SDK stubs ──────────────────────────────────────────────────────────────
 vi.mock("@earendil-works/pi-coding-agent", async (importOriginal) => {
   const original =
@@ -43,21 +47,21 @@ describe("describeSkillReadGate", () => {
   it("returns null when tool is not read", () => {
     const result = describeSkillReadGate(
       makeTcc({ toolName: "write" }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry()],
     );
     expect(result).toBeNull();
   });
 
   it("returns null when no active skill entries", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => []);
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => []);
     expect(result).toBeNull();
   });
 
   it("returns null when read path does not match any skill", () => {
     const result = describeSkillReadGate(
       makeTcc({ input: { path: "/test/project/src/index.ts" } }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry()],
     );
     expect(result).toBeNull();
@@ -66,14 +70,14 @@ describe("describeSkillReadGate", () => {
   it("returns null when input has no path", () => {
     const result = describeSkillReadGate(
       makeTcc({ input: {} }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry()],
     );
     expect(result).toBeNull();
   });
 
   it("returns GateDescriptor with preResolved.state matching skill entry state (ask)", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ state: "ask" }),
     ]);
     expect(result).not.toBeNull();
@@ -82,7 +86,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("returns GateDescriptor with preResolved.state matching skill entry state (allow)", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ state: "allow" }),
     ]);
     expect(result).not.toBeNull();
@@ -91,7 +95,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("returns GateDescriptor with preResolved.state matching skill entry state (deny)", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ state: "deny" }),
     ]);
     expect(result).not.toBeNull();
@@ -100,7 +104,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("decision surface is 'skill' and decision value is the skill name", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ name: "my-skill" }),
     ])!;
     expect(result.decision.surface).toBe("skill");
@@ -108,7 +112,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("denialContext contains the skill name and read path", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry({ name: "librarian" }),
     ])!;
     expect(result.denialContext).toEqual({
@@ -122,7 +126,7 @@ describe("describeSkillReadGate", () => {
   it("promptDetails includes skill_read source and skillName", () => {
     const result = describeSkillReadGate(
       makeTcc({ agentName: "test-agent", toolCallId: "tc-42" }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry({ name: "my-skill" })],
     )!;
     expect(result.promptDetails).toMatchObject({
@@ -138,7 +142,7 @@ describe("describeSkillReadGate", () => {
   it("logContext includes skill_read source and skillName", () => {
     const result = describeSkillReadGate(
       makeTcc({ agentName: "agent-1" }),
-      "linux",
+      normalizer,
       () => [makeSkillEntry({ name: "librarian" })],
     )!;
     expect(result.logContext).toMatchObject({
@@ -149,7 +153,7 @@ describe("describeSkillReadGate", () => {
   });
 
   it("surface is 'skill' on the descriptor", () => {
-    const result = describeSkillReadGate(makeTcc(), "linux", () => [
+    const result = describeSkillReadGate(makeTcc(), normalizer, () => [
       makeSkillEntry(),
     ])!;
     expect(result.surface).toBe("skill");

package/test/path-normalizer.test.ts

@@ -77,6 +77,13 @@ describe("PathNormalizer", () => {
       );
       expect(normalizer.isOutsideWorkingDirectory("/etc/hosts")).toBe(true);
     });
+
+    test("comparableValue returns the lexical absolute form (no FS)", () => {
+      expect(normalizer.comparableValue("src/foo.ts")).toBe(
+        "/projects/my-app/src/foo.ts",
+      );
+      expect(normalizer.comparableValue("/etc/hosts")).toBe("/etc/hosts");
+    });
   });
 
   describe("win32 flavor", () => {
@@ -119,5 +126,41 @@ describe("PathNormalizer", () => {
       ).toBe(false);
       expect(normalizer.isOutsideWorkingDirectory("C:\\Other\\dir")).toBe(true);
     });
+
+    test("comparableValue case-folds the lexical absolute form", () => {
+      expect(normalizer.comparableValue("src\\foo.ts")).toBe(
+        "c:\\projects\\app\\src\\foo.ts",
+      );
+    });
+  });
+
+  describe("isInfrastructureRead", () => {
+    const normalizer = new PathNormalizer("linux", "/projects/my-app");
+
+    test("allows a read-only tool targeting a configured infra dir", () => {
+      const ap = normalizer.forPath("/infra/git/pkg/SKILL.md");
+      expect(normalizer.isInfrastructureRead("read", ap, ["/infra"])).toBe(
+        true,
+      );
+    });
+
+    test("does not allow a write tool targeting an infra dir", () => {
+      const ap = normalizer.forPath("/infra/git/pkg/file.ts");
+      expect(normalizer.isInfrastructureRead("write", ap, ["/infra"])).toBe(
+        false,
+      );
+    });
+
+    test("does not allow a read-only tool outside any infra dir", () => {
+      const ap = normalizer.forPath("/elsewhere/file.ts");
+      expect(normalizer.isInfrastructureRead("read", ap, ["/infra"])).toBe(
+        false,
+      );
+    });
+
+    test("allows a read targeting the project-local .pi/npm dir (from baked cwd)", () => {
+      const ap = normalizer.forPath("/projects/my-app/.pi/npm/dep/index.js");
+      expect(normalizer.isInfrastructureRead("read", ap, [])).toBe(true);
+    });
   });
 });

package/test/skill-prompt-sanitizer.test.ts

@@ -1,5 +1,6 @@
 import { resolve } from "node:path";
 import { afterEach, describe, expect, test, vi } from "vitest";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionManager } from "#src/permission-manager";
 import {
   findSkillPathMatch,
@@ -30,6 +31,11 @@ afterEach(() => {
 
 const CWD = "/projects/my-app";
 
+// `findSkillPathMatch` only uses the normalizer's platform (it compares two
+// already-absolute paths via `isWithinDirectory`), so this CWD-baked instance
+// serves every call regardless of the entries' cwd.
+const normalizer = new PathNormalizer("linux", CWD);
+
 function makeManager(
   defaultState: "allow" | "deny" | "ask" = "allow",
   overrides: Record<string, "allow" | "deny" | "ask"> = {},
@@ -72,13 +78,7 @@ describe("resolveSkillPromptEntries", () => {
   test("returns unchanged prompt and empty entries when no skills section present", () => {
     const input = "You are a helpful assistant.";
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toBe(input);
     expect(result.entries).toEqual([]);
     expect(manager.checkPermission).not.toHaveBeenCalled();
@@ -87,13 +87,7 @@ describe("resolveSkillPromptEntries", () => {
   test("keeps all skills when all are allowed", () => {
     const input = availableSkillsSection("librarian", "ask-user");
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.prompt).toContain("ask-user");
     expect(result.entries).toHaveLength(2);
@@ -102,13 +96,7 @@ describe("resolveSkillPromptEntries", () => {
   test("removes denied skill from section", () => {
     const input = availableSkillsSection("librarian", "dangerous");
     const manager = makeManager("allow", { dangerous: "deny" });
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.prompt).not.toContain("dangerous");
     // denied skill is excluded from returned entries
@@ -118,13 +106,7 @@ describe("resolveSkillPromptEntries", () => {
   test("removes entire section when all skills are denied", () => {
     const input = `Intro\n${availableSkillsSection("dangerous")}\nOutro`;
     const manager = makeManager("deny");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).not.toContain("<available_skills>");
     expect(result.prompt).toContain("Intro");
     expect(result.prompt).toContain("Outro");
@@ -134,13 +116,7 @@ describe("resolveSkillPromptEntries", () => {
   test("keeps ask-state skills in section and entries", () => {
     const input = availableSkillsSection("librarian");
     const manager = makeManager("ask");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.entries).toHaveLength(1);
     expect(result.entries[0].state).toBe("ask");
@@ -149,7 +125,7 @@ describe("resolveSkillPromptEntries", () => {
   test("delegates permission check to permissionManager for each skill", () => {
     const input = availableSkillsSection("alpha", "beta");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, null, CWD, "linux");
+    resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(manager.checkPermission).toHaveBeenCalledWith(
       "skill",
       { name: "alpha" },
@@ -165,7 +141,7 @@ describe("resolveSkillPromptEntries", () => {
   test("passes agentName to permissionManager", () => {
     const input = availableSkillsSection("librarian");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, "my-agent", CWD, "linux");
+    resolveSkillPromptEntries(input, manager, "my-agent", normalizer);
     expect(manager.checkPermission).toHaveBeenCalledWith(
       "skill",
       { name: "librarian" },
@@ -180,7 +156,7 @@ describe("resolveSkillPromptEntries", () => {
       availableSkillsSection("librarian"),
     ].join("\n");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, null, CWD, "linux");
+    resolveSkillPromptEntries(input, manager, null, normalizer);
     // Should only be called once despite appearing twice.
     expect(manager.checkPermission).toHaveBeenCalledTimes(1);
   });
@@ -189,13 +165,7 @@ describe("resolveSkillPromptEntries", () => {
     const location = "/skills/librarian/SKILL.md";
     const input = availableSkillsSection("librarian");
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.entries[0].normalizedLocation).toBe(location);
     expect(result.entries[0].normalizedBaseDir).toBe("/skills/librarian");
   });
@@ -205,13 +175,7 @@ describe("resolveSkillPromptEntries", () => {
     const section2 = availableSkillsSection("beta");
     const input = `${section1}\n${section2}`;
     const manager = makeManager("allow", { beta: "deny" });
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.entries.map((e) => e.name)).toContain("alpha");
     expect(result.entries.map((e) => e.name)).not.toContain("beta");
   });
@@ -240,12 +204,12 @@ describe("findSkillPathMatch", () => {
   ];
 
   test("returns null for empty normalized path", () => {
-    expect(findSkillPathMatch("", entries, "linux")).toBeNull();
+    expect(findSkillPathMatch("", entries, normalizer)).toBeNull();
   });
 
   test("returns null for empty entries array", () => {
     expect(
-      findSkillPathMatch("/skills/librarian/SKILL.md", [], "linux"),
+      findSkillPathMatch("/skills/librarian/SKILL.md", [], normalizer),
     ).toBeNull();
   });
 
@@ -253,7 +217,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian/SKILL.md",
       entries,
-      "linux",
+      normalizer,
     );
     expect(match?.name).toBe("librarian");
   });
@@ -262,13 +226,17 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian/extra/helper.md",
       entries,
-      "linux",
+      normalizer,
     );
     expect(match?.name).toBe("librarian");
   });
 
   test("returns null for path not within any skill directory", () => {
-    const match = findSkillPathMatch("/other/path/file.md", entries, "linux");
+    const match = findSkillPathMatch(
+      "/other/path/file.md",
+      entries,
+      normalizer,
+    );
     expect(match).toBeNull();
   });
 
@@ -277,7 +245,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian-extra/SKILL.md",
       entries,
-      "linux",
+      normalizer,
     );
     expect(match).toBeNull();
   });
@@ -304,7 +272,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/parent/child/helper.md",
       nestedEntries,
-      "linux",
+      normalizer,
     );
     expect(match?.name).toBe("child");
   });
@@ -380,8 +348,7 @@ test("REGRESSION: resolveSkillPromptEntries sanitizes every available_skills blo
       prompt,
       asChecker(manager),
       null,
-      "/cwd",
-      "linux",
+      new PathNormalizer("linux", "/cwd"),
     );
 
     expect(result.prompt).not.toContain("denied-skill");
@@ -428,20 +395,19 @@ test("REGRESSION: resolveSkillPromptEntries keeps only visible skills available
       prompt,
       asChecker(manager),
       null,
-      "/cwd",
-      "linux",
+      new PathNormalizer("linux", "/cwd"),
     );
     const visiblePath = resolve("/cwd", "./skills/visible/file.ts");
     const blockedPath = resolve("/cwd", "./skills/blocked/file.ts");
     const matchedVisibleSkill = findSkillPathMatch(
       process.platform === "win32" ? visiblePath.toLowerCase() : visiblePath,
       result.entries,
-      "linux",
+      normalizer,
     );
     const matchedBlockedSkill = findSkillPathMatch(
       process.platform === "win32" ? blockedPath.toLowerCase() : blockedPath,
       result.entries,
-      "linux",
+      normalizer,
     );
 
     expect(matchedVisibleSkill?.name).toBe("visible-skill");