@gotgenes/pi-permission-system 17.1.0 → 18.0.0

package/src/input-normalizer.ts

@@ -1,25 +1,60 @@
+import type { AccessIntent } from "./access-intent/access-intent";
 import { stripBashCommentLines } from "./bash-arity";
 import { createMcpPermissionTargets } from "./mcp-targets";
-import { getPathPolicyValues, PATH_BEARING_TOOLS } from "./path-utils";
+import type { PathNormalizer } from "./path-normalizer";
+import { PATH_SURFACES } from "./path-utils";
 import { getNonEmptyString, toRecord } from "./value-guards";
 
 /**
- * Construct a surface-appropriate input object from a raw value string.
+ * Build the {@link AccessIntent} an external policy query (the `Symbol.for()`
+ * service and the event-bus RPC) feeds to the resolver from a `(surface, value)`
+ * pair.
  *
- * This is the inverse of `normalizeInput()` — it builds the minimal input
- * object that `PermissionManager.checkPermission()` expects for a given
- * surface, from a single string value.
+ * For a path-shaped surface (`path`, `external_directory`, or a path-bearing
+ * tool) carrying a non-empty value, it builds an `AccessPath` and emits an
+ * `access-path` intent, so the resolver matches the lexical aliases ∪ canonical
+ * (symlink-resolved) set — at parity with the gates (#486, #502). Every other
+ * surface, and any value-less surface-level query, keeps the `tool` intent so
+ * the manager's `normalizeInput` `["*"]` fallback is preserved.
+ */
+export function buildAccessIntentForSurface(
+  surface: string,
+  value: string | undefined,
+  normalizer: PathNormalizer,
+  agentName: string | undefined,
+): AccessIntent {
+  const pathValue = getNonEmptyString(value);
+  if (pathValue !== null && PATH_SURFACES.has(surface)) {
+    return {
+      kind: "access-path",
+      surface,
+      path: normalizer.forPath(pathValue),
+      agentName,
+    };
+  }
+  return {
+    kind: "tool",
+    surface,
+    input: buildInputForSurface(surface, value),
+    agentName,
+  };
+}
+
+/**
+ * Construct a surface-appropriate input object from a raw value string for the
+ * `tool`-intent branch of {@link buildAccessIntentForSurface} (the non-path
+ * surfaces and value-less path queries).
  *
- * Used by the event-bus RPC handler and the `Symbol.for()` service accessor
- * so external callers can query policy with `(surface, value)` instead of
- * constructing a full tool-call input payload.
+ * This is the inverse of `normalizeInput()` — it builds the minimal input
+ * object that the manager expects for a given surface, from a single string
+ * value.
  *
  * Note: MCP inputs are complex (server name + tool name derivation). Callers
  * providing an MCP surface receive a best-effort policy evaluation using the
  * value as a pre-qualified target string. Pass the fully-qualified target
  * (e.g. "exa:search" or "exa") directly.
  */
-export function buildInputForSurface(
+function buildInputForSurface(
   surface: string,
   value: string | undefined,
 ): unknown {
@@ -51,12 +86,16 @@ export interface NormalizedInput {
   resultExtras: Record<string, unknown>;
 }
 
-const SPECIAL_PERMISSION_KEYS = new Set(["external_directory", "path"]);
-
 /**
  * Map a raw tool invocation to the surface/values/extras triple needed by
  * `checkPermission()`.
  *
+ * Handles bash, skill, mcp, and extension surfaces. Path-bearing tool surfaces
+ * (`path`, `external_directory`, `read`, `write`, `edit`, `grep`, `find`,
+ * `ls`) now route through the access-path gate (#502) and service/RPC builder
+ * (#503) before reaching the manager, so they never arrive here with a real
+ * path value — all fall through to the extension catch-all `["*"]`.
+ *
  * @param toolName - Normalized (trimmed) tool name from the tool-call event.
  * @param input    - Raw input payload from the tool-call event.
  * @param configuredMcpServerNames - Ordered list of MCP server names from the
@@ -66,18 +105,7 @@ export function normalizeInput(
   toolName: string,
   input: unknown,
   configuredMcpServerNames: readonly string[],
-  platform: NodeJS.Platform,
-  cwd?: string,
 ): NormalizedInput {
-  // --- Special surfaces (path, external_directory) ---
-  if (SPECIAL_PERMISSION_KEYS.has(toolName)) {
-    return {
-      surface: toolName,
-      values: normalizePathSurfaceValues(input, platform, cwd),
-      resultExtras: {},
-    };
-  }
-
   // --- Skill ---
   if (toolName === "skill") {
     const record = toRecord(input);
@@ -120,43 +148,13 @@ export function normalizeInput(
     };
   }
 
-  // --- Path-bearing tools (read, write, edit, grep, find, ls) ---
-  if (PATH_BEARING_TOOLS.has(toolName)) {
-    return {
-      surface: toolName,
-      values: normalizePathSurfaceValues(input, platform, cwd),
-      resultExtras: {},
-    };
-  }
-
-  // --- Extension tools (non-path-bearing) ---
+  // --- All other surfaces (path-bearing tools and extension tools) ---
+  // Path-bearing tools with a present path never reach here — the gate emits
+  // an access-path intent (#502). Missing-path and extension-tool cases both
+  // collapse to the surface catch-all.
   return {
     surface: toolName,
     values: ["*"],
     resultExtras: {},
   };
 }
-
-/**
- * Extract and normalize the path lookup values shared by every path surface
- * (`path`, `external_directory`, and the path-bearing tools).
- *
- * Missing, empty, or whitespace-only paths collapse to the surface catch-all
- * `"*"`. When CWD is known, a relative path also produces a normalized
- * absolute policy value and a project-relative alias while keeping its legacy
- * relative value, so values match home- and cwd-anchored patterns
- * symmetrically with how the patterns themselves are expanded (#350).
- *
- * Only `input.path` is read — policy values are never sourced from any other
- * (potentially attacker-controlled) field on the raw tool input.
- */
-function normalizePathSurfaceValues(
-  input: unknown,
-  platform: NodeJS.Platform,
-  cwd?: string,
-): string[] {
-  const path = getNonEmptyString(toRecord(input).path);
-  if (path === null) return ["*"];
-  const values = getPathPolicyValues(path, cwd ? { cwd } : {}, platform);
-  return values.length > 0 ? values : ["*"];
-}

package/src/path-normalizer.ts

@@ -4,6 +4,8 @@ import { AccessPath } from "./access-intent/access-path";
 import {
   isPathOutsideWorkingDirectory,
   isPathWithinDirectory,
+  isPiInfrastructureRead,
+  normalizePathForComparison,
 } from "./path-utils";
 
 /**
@@ -67,4 +69,32 @@ export class PathNormalizer {
   isOutsideWorkingDirectory(pathValue: string): boolean {
     return isPathOutsideWorkingDirectory(pathValue, this.cwd, this.platform);
   }
+
+  /**
+   * Lexical (not symlink-resolved) comparison value, resolved against the baked
+   * cwd. Mirrors the as-typed absolute form used for skill-prompt matching;
+   * touches no filesystem, unlike {@link forPath}'s canonical alias.
+   */
+  comparableValue(pathValue: string): string {
+    return normalizePathForComparison(pathValue, this.cwd, this.platform);
+  }
+
+  /**
+   * Pi infrastructure-read containment for a read-only tool, decided against
+   * the canonical (symlink-resolved) path and the baked cwd/platform. Takes the
+   * already-built {@link AccessPath} so the caller does not re-resolve it.
+   */
+  isInfrastructureRead(
+    toolName: string,
+    accessPath: AccessPath,
+    infraDirs: readonly string[],
+  ): boolean {
+    return isPiInfrastructureRead(
+      toolName,
+      accessPath.boundaryValue(),
+      infraDirs,
+      this.cwd,
+      this.platform,
+    );
+  }
 }

package/src/permission-event-rpc.ts

@@ -7,7 +7,8 @@
  * permission prompts without importing this package.
  */
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { buildInputForSurface } from "./input-normalizer";
+import { buildAccessIntentForSurface } from "./input-normalizer";
+import type { PathNormalizer } from "./path-normalizer";
 import type {
   PermissionPromptDecision,
   RequestPermissionOptions,
@@ -26,22 +27,26 @@ import {
   PERMISSIONS_RPC_CHECK_CHANNEL,
   PERMISSIONS_RPC_PROMPT_CHANNEL,
 } from "./permission-events";
-import type { ScopedPermissionManager } from "./permission-manager";
+import type { ScopedPermissionResolver } from "./permission-resolver";
 import { buildRpcUiPrompt } from "./permission-ui-prompt";
 import type { ReviewLogger } from "./session-logger";
-import type { SessionRules } from "./session-rules";
 
 /** Dependencies injected into the RPC handler registry. */
 export interface PermissionRpcDeps {
-  /** The shared PermissionManager instance. */
-  permissionManager: Pick<ScopedPermissionManager, "check">;
-  /** The shared SessionRules instance. */
-  sessionRules: Pick<SessionRules, "getRuleset">;
   /**
-   * Narrow session view: provides runtime context.
-   * Used by the prompt handler to check hasUI and access the UI dialog.
+   * The shared resolver: answers an access intent, composing the session
+   * ruleset and unwrapping `access-path` → `path-values` internally so the
+   * RPC check matches the same lexical ∪ canonical set the gates do (#503).
    */
-  session: { getRuntimeContext(): ExtensionContext | null };
+  resolver: Pick<ScopedPermissionResolver, "resolve">;
+  /**
+   * Narrow session view: runtime context for the prompt handler (hasUI / UI
+   * dialog) and the cwd-bound path normalizer for path-surface check queries.
+   */
+  session: {
+    getRuntimeContext(): ExtensionContext | null;
+    getPathNormalizer(): PathNormalizer;
+  };
   /** Show the interactive permission dialog in the parent session UI. */
   requestPermissionDecisionFromUi(
     ui: ExtensionContext["ui"],
@@ -107,12 +112,13 @@ function handleCheckRpc(
       return;
     }
 
-    const input = buildInputForSurface(surface, value);
-    const sessionRules = deps.sessionRules.getRuleset();
-    const result = deps.permissionManager.check(
-      { kind: "tool", surface, input, agentName: agentName ?? undefined },
-      sessionRules,
+    const intent = buildAccessIntentForSurface(
+      surface,
+      value,
+      deps.session.getPathNormalizer(),
+      agentName ?? undefined,
     );
+    const result = deps.resolver.resolve(intent);
 
     const data: PermissionsCheckReplyData = {
       result: result.state,

package/src/permission-manager.ts

@@ -96,7 +96,6 @@ export interface PermissionManagerOptions extends PolicyLoaderOptions {
 export class PermissionManager implements ScopedPermissionManager {
   private readonly agentDir: string | undefined;
   private readonly platform: NodeJS.Platform;
-  private currentCwd: string | undefined;
   private loader: PolicyLoader;
   private readonly resolvedPermissionsCache = new Map<
     string,
@@ -123,8 +122,6 @@ export class PermissionManager implements ScopedPermissionManager {
    * built with explicit paths), only the cache is cleared.
    */
   configureForCwd(cwd: string | undefined | null): void {
-    this.currentCwd =
-      typeof cwd === "string" && cwd.trim().length > 0 ? cwd : undefined;
     if (this.agentDir !== undefined) {
       this.loader = new FilePolicyLoader(
         derivePolicyLoaderOptions(this.agentDir, cwd),
@@ -248,7 +245,9 @@ export class PermissionManager implements ScopedPermissionManager {
   /**
    * Unified resolution entry point — dispatches on intent kind.
    *
-   * `"tool"` → normalizes raw input through `normalizeInput`.
+   * `"tool"` → normalizes raw input through `normalizeInput` (bash, skill, mcp,
+   * extension surfaces). Path-bearing surfaces arrive as `"path-values"` via
+   * the access-path gate (#502) or service/RPC builder (#503).
    * `"path-values"` → evaluates the precomputed values directly.
    */
   check(
@@ -280,8 +279,6 @@ export class PermissionManager implements ScopedPermissionManager {
       toolName,
       intent.input,
       this.loader.getConfiguredMcpServerNames(),
-      this.platform,
-      this.currentCwd,
     );
     return buildCheckResult(
       surface,

package/src/permission-session.ts

@@ -85,11 +85,6 @@ export class PermissionSession implements ToolCallGateInputs {
     return this.context;
   }
 
-  /** The host platform injected at the composition root. */
-  getPlatform(): NodeJS.Platform {
-    return this.platform;
-  }
-
   // ── UI notifications ────────────────────────────────────────────────────
 
   /** Surface a warning message to the user via the active UI context, if any. */

package/src/permissions-service.ts

@@ -1,7 +1,7 @@
-import { buildInputForSurface } from "./input-normalizer";
-import type { ScopedPermissionManager } from "./permission-manager";
+import type { AccessIntent } from "./access-intent/access-intent";
+import { buildAccessIntentForSurface } from "./input-normalizer";
+import type { PathNormalizer } from "./path-normalizer";
 import type { PermissionsService } from "./service";
-import type { SessionRules } from "./session-rules";
 import type {
   ToolAccessExtractor,
   ToolAccessExtractorRegistrar,
@@ -10,18 +10,37 @@ import type {
   ToolInputFormatter,
   ToolInputFormatterRegistrar,
 } from "./tool-input-formatter-registry";
+import type { PermissionCheckResult, PermissionState } from "./types";
+
+/**
+ * Resolution surface the service needs: answer a gate-style {@link AccessIntent}
+ * (composing the session ruleset internally) and report a tool-level state.
+ * `PermissionResolver` satisfies it.
+ */
+interface ResolverForService {
+  resolve(intent: AccessIntent): PermissionCheckResult;
+  getToolPermission(toolName: string, agentName?: string): PermissionState;
+}
+
+/** Narrow session view: hands out the cwd-bound path normalizer. */
+interface PathNormalizerProvider {
+  getPathNormalizer(): PathNormalizer;
+}
 
 /**
  * In-process implementation of the cross-extension {@link PermissionsService}.
  *
  * Constructed once in the composition root and backed by the single shared
- * `PermissionManager` and `SessionRules` instances that `PermissionSession`
- * also uses — so service queries and gate-path approvals see the same state.
+ * `PermissionResolver` and `PermissionSession` that the gates also use — so
+ * service queries and gate-path decisions see the same state. Path-shaped
+ * surface queries route through the resolver as an `access-path` intent, so
+ * they match the lexical aliases ∪ canonical (symlink-resolved) set the gates
+ * do (#503); non-path surfaces stay on the `tool` intent.
  */
 export class LocalPermissionsService implements PermissionsService {
   constructor(
-    private readonly permissionManager: ScopedPermissionManager,
-    private readonly sessionRules: Pick<SessionRules, "getRuleset">,
+    private readonly resolver: ResolverForService,
+    private readonly session: PathNormalizerProvider,
     private readonly formatterRegistry: ToolInputFormatterRegistrar,
     private readonly accessExtractorRegistry: ToolAccessExtractorRegistrar,
   ) {}
@@ -31,18 +50,20 @@ export class LocalPermissionsService implements PermissionsService {
     value?: string,
     agentName?: string,
   ): ReturnType<PermissionsService["checkPermission"]> {
-    const input = buildInputForSurface(surface, value);
-    return this.permissionManager.check(
-      { kind: "tool", surface, input, agentName },
-      this.sessionRules.getRuleset(),
+    const intent = buildAccessIntentForSurface(
+      surface,
+      value,
+      this.session.getPathNormalizer(),
+      agentName,
     );
+    return this.resolver.resolve(intent);
   }
 
   getToolPermission(
     toolName: string,
     agentName?: string,
   ): ReturnType<PermissionsService["getToolPermission"]> {
-    return this.permissionManager.getToolPermission(toolName, agentName);
+    return this.resolver.getToolPermission(toolName, agentName);
   }
 
   registerToolInputFormatter(

package/src/skill-prompt-sanitizer.ts

@@ -1,9 +1,6 @@
 import { dirname } from "node:path";
 
-import {
-  isPathWithinDirectory,
-  normalizePathForComparison,
-} from "./path-utils";
+import type { PathNormalizer } from "./path-normalizer";
 import type { PermissionCheckResult, PermissionState } from "./types";
 
 /**
@@ -151,24 +148,15 @@ function resolvePermissionState(
 function createResolvedSkillEntry(
   entry: ParsedSkillPromptEntry,
   state: PermissionState,
-  cwd: string,
-  platform: NodeJS.Platform,
+  normalizer: PathNormalizer,
 ): SkillPromptEntry {
   return {
     name: entry.name,
     description: entry.description,
     location: entry.location,
     state,
-    normalizedLocation: normalizePathForComparison(
-      entry.location,
-      cwd,
-      platform,
-    ),
-    normalizedBaseDir: normalizePathForComparison(
-      dirname(entry.location),
-      cwd,
-      platform,
-    ),
+    normalizedLocation: normalizer.comparableValue(entry.location),
+    normalizedBaseDir: normalizer.comparableValue(dirname(entry.location)),
   };
 }
 
@@ -198,8 +186,7 @@ export function resolveSkillPromptEntries(
   prompt: string,
   permissionManager: SkillPermissionChecker,
   agentName: string | null,
-  cwd: string,
-  platform: NodeJS.Platform,
+  normalizer: PathNormalizer,
 ): { prompt: string; entries: SkillPromptEntry[] } {
   const sections = parseAllSkillPromptSections(prompt);
   if (sections.length === 0) {
@@ -219,7 +206,7 @@ export function resolveSkillPromptEntries(
         agentName,
         permissionCache,
       );
-      return createResolvedSkillEntry(entry, state, cwd, platform);
+      return createResolvedSkillEntry(entry, state, normalizer);
     });
 
     const visibleSectionEntries = resolvedEntries.filter(
@@ -267,7 +254,7 @@ export function resolveSkillPromptEntries(
 export function findSkillPathMatch(
   normalizedPath: string,
   entries: readonly SkillPromptEntry[],
-  platform: NodeJS.Platform,
+  normalizer: PathNormalizer,
 ): SkillPromptEntry | null {
   if (!normalizedPath || entries.length === 0) {
     return null;
@@ -286,7 +273,7 @@ export function findSkillPathMatch(
   for (const entry of entries) {
     if (
       !entry.normalizedBaseDir ||
-      !isPathWithinDirectory(normalizedPath, entry.normalizedBaseDir, platform)
+      !normalizer.isWithinDirectory(normalizedPath, entry.normalizedBaseDir)
     ) {
       continue;
     }

package/test/access-intent/bash/program.test.ts

@@ -375,7 +375,7 @@ describe("BashProgram", () => {
       const symlinkCwd = "/private/tmp";
       realpathSync.mockImplementation((p: string) => {
         if (p === "/tmp") return "/private/tmp";
-        if (p.startsWith("/tmp/")) return "/private/tmp" + p.slice(4);
+        if (p.startsWith("/tmp/")) return `/private/tmp${p.slice(4)}`;
         return p;
       });
       const program = await BashProgram.parse(

package/test/access-intent/bash/token-classification.test.ts

@@ -114,6 +114,40 @@ describe("classifyTokenAsPathCandidate", () => {
       expect(classifyTokenAsPathCandidate("./build")).toBeNull();
     });
   });
+
+  describe("Windows drive-letter acceptance gate", () => {
+    test("forward-slash drive path → returned as-is", () => {
+      expect(classifyTokenAsPathCandidate("C:/Windows/win.ini")).toBe(
+        "C:/Windows/win.ini",
+      );
+      expect(classifyTokenAsPathCandidate("D:/secrets/password.txt")).toBe(
+        "D:/secrets/password.txt",
+      );
+    });
+
+    test("backslash drive path → returned as-is", () => {
+      expect(classifyTokenAsPathCandidate("C:\\Windows\\win.ini")).toBe(
+        "C:\\Windows\\win.ini",
+      );
+      expect(classifyTokenAsPathCandidate("D:\\secrets\\password.txt")).toBe(
+        "D:\\secrets\\password.txt",
+      );
+    });
+
+    test("lowercase drive letter → returned as-is", () => {
+      expect(classifyTokenAsPathCandidate("c:/foo")).toBe("c:/foo");
+    });
+
+    test("single-letter scheme with double-slash (c://x) → null (URL_PATTERN fires first)", () => {
+      // c:// matches URL_PATTERN before the drive-letter check runs.
+      expect(classifyTokenAsPathCandidate("c://x")).toBeNull();
+    });
+
+    test("drive-relative path without separator (C:foo) → null", () => {
+      // No / or \ after the colon — not an absolute drive path per node:path.
+      expect(classifyTokenAsPathCandidate("C:foo")).toBeNull();
+    });
+  });
 });
 
 describe("classifyTokenAsRuleCandidate", () => {
@@ -204,6 +238,35 @@ describe("classifyTokenAsRuleCandidate", () => {
     });
   });
 
+  describe("Windows drive-letter acceptance gate", () => {
+    test("forward-slash drive path → returned as-is", () => {
+      // Forward-slash form was already accepted via token.includes("/").
+      // The explicit branch makes it first-class and order-independent.
+      expect(classifyTokenAsRuleCandidate("C:/Windows/win.ini")).toBe(
+        "C:/Windows/win.ini",
+      );
+    });
+
+    test("backslash drive path → returned as-is (new: no forward slash)", () => {
+      // Previously dropped by both classifiers; the backslash form has no /
+      // so the includes("/") branch could not catch it.
+      expect(classifyTokenAsRuleCandidate("D:\\secrets\\password.txt")).toBe(
+        "D:\\secrets\\password.txt",
+      );
+      expect(classifyTokenAsRuleCandidate("C:\\Windows\\win.ini")).toBe(
+        "C:\\Windows\\win.ini",
+      );
+    });
+
+    test("lowercase drive letter (backslash) → returned as-is", () => {
+      expect(classifyTokenAsRuleCandidate("c:\\foo")).toBe("c:\\foo");
+    });
+
+    test("drive-relative path without separator (C:foo) → null", () => {
+      expect(classifyTokenAsRuleCandidate("C:foo")).toBeNull();
+    });
+  });
+
   describe("rule-vs-path divergence", () => {
     const dotFiles = [".env", ".gitignore", ".eslintrc"];
     const relPaths = ["src/index.ts", "lib/utils.js", "config/settings.json"];
@@ -230,6 +293,18 @@ describe("classifyTokenAsRuleCandidate", () => {
       });
     }
 
+    const winDrivePaths = [
+      "C:/Windows/win.ini",
+      "D:\\secrets\\password.txt",
+      "c:/foo",
+    ];
+    for (const tok of winDrivePaths) {
+      test(`Windows drive path "${tok}": both classifiers accept`, () => {
+        expect(classifyTokenAsRuleCandidate(tok)).toBe(tok);
+        expect(classifyTokenAsPathCandidate(tok)).toBe(tok);
+      });
+    }
+
     const sharedRejected = ["hello", "--flag", "FOO=/bar", "https://x.com"];
     for (const tok of sharedRejected) {
       test(`"${tok}": both classifiers reject`, () => {

package/test/bash-external-directory.test.ts

@@ -953,6 +953,44 @@ describe("formatBashExternalDirectoryAskPrompt", () => {
   });
 });
 
+describe("Windows drive-letter paths (win32 semantics)", () => {
+  const windowsCwd = "C:/projects/app";
+
+  async function extractWin32(command: string): Promise<string[]> {
+    return extractWithNormalizer(
+      command,
+      new PathNormalizer("win32", windowsCwd),
+    );
+  }
+
+  test("forward-slash drive path outside CWD is flagged", async () => {
+    const result = await extractWin32("cat C:/Windows/win.ini");
+    expect(result).not.toHaveLength(0);
+  });
+
+  test("different drive letter outside CWD is flagged", async () => {
+    const result = await extractWin32("cat D:/secrets/password.txt");
+    expect(result).not.toHaveLength(0);
+  });
+
+  test("drive path inside CWD is not flagged (known base)", async () => {
+    const result = await extractWin32("cat C:/projects/app/inside.txt");
+    expect(result).toHaveLength(0);
+  });
+
+  test("drive path inside CWD is not flagged after non-literal cd (unknown base)", async () => {
+    // Before the isRelativeCandidate conversion, the hand-rolled startsWith("/")
+    // check treats C:/ as relative on win32, so the unknown-base conservative
+    // branch fires and over-flags an inside-CWD drive path.
+    // After the conversion (!normalizer.isAbsolute), C:/ is absolute on win32
+    // and routes to the resolved branch with its inside-CWD check.
+    const result = await extractWin32(
+      'cd "$D" && cat C:/projects/app/inside.txt',
+    );
+    expect(result).toHaveLength(0);
+  });
+});
+
 describe("bash external-directory denial messages (centralized)", () => {
   test("denial message includes command, paths, and extension tag", () => {
     const result = formatDenyReason({

package/test/composition-root.test.ts

@@ -479,6 +479,28 @@ describe("single source of truth for session state", () => {
   });
 });
 
+describe("service path queries evaluate the supplied path (#503)", () => {
+  // Before #503 the service path query dropped the value (buildInputForSurface
+  // returned {} for the `path` surface), so the query collapsed to ["*"] and a
+  // path-specific rule never fired. The query now builds an AccessPath, so the
+  // supplied path flows through the resolver → manager and matches `path` rules
+  // end-to-end.
+  it("resolves a path-surface query against a deny rule on the supplied path", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "pi-perm-svc-path-cwd-"));
+    const target = join(cwd, "secrets.env");
+    writeGlobalConfig({ permission: { path: { [target]: "deny" } } });
+
+    const pi = makeFakePi({ events: createEventBus() });
+    piPermissionSystemExtension(pi as unknown as ExtensionAPI);
+    await fireSessionStart(pi, makeChildCtx(cwd, "svc-path-session"));
+
+    const result = getPermissionsService()!.checkPermission("path", target);
+    expect(result.state).toBe("deny");
+
+    rmSync(cwd, { recursive: true, force: true });
+  });
+});
+
 describe("multi-instance global service interplay", () => {
   // The fix (#302) scopes the process-global service slot to the publishing
   // instance. The parent publishes at its session_start; an in-process child

package/test/handlers/external-directory-symlink-acceptance.test.ts

@@ -89,7 +89,6 @@ describe("external_directory symlink acceptance (#418)", () => {
         [],
         resolver,
         new PathNormalizer(process.platform, cwd),
-        "linux",
       );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("allow");
@@ -113,7 +112,6 @@ describe("external_directory symlink acceptance (#418)", () => {
         [],
         resolver,
         new PathNormalizer(process.platform, cwd),
-        "linux",
       );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("allow");
@@ -132,7 +130,6 @@ describe("external_directory symlink acceptance (#418)", () => {
         [],
         resolver,
         new PathNormalizer(process.platform, cwd),
-        "linux",
       );
       expect(isGateDescriptor(result)).toBe(true);
       expect((result as GateDescriptor).preCheck?.state).toBe("ask");