@gotgenes/pi-permission-system 17.1.0 → 18.0.0

package/test/permissions-service.test.ts

@@ -1,34 +1,42 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { ScopedPermissionManager } from "#src/permission-manager";
+import { beforeEach, describe, expect, it, type Mock, vi } from "vitest";
+import type { AccessIntent } from "#src/access-intent/access-intent";
+import { PathNormalizer } from "#src/path-normalizer";
 import { LocalPermissionsService } from "#src/permissions-service";
-import type { Ruleset } from "#src/rule";
-import type { SessionRules } from "#src/session-rules";
 import type { ToolAccessExtractorRegistrar } from "#src/tool-access-extractor-registry";
 import type {
   ToolInputFormatter,
   ToolInputFormatterRegistrar,
 } from "#src/tool-input-formatter-registry";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
 
 import { makeCheckResult } from "#test/helpers/handler-fixtures";
-import { makeFakePermissionManager } from "#test/helpers/session-fixtures";
 
-// ── input-normalizer stub ──────────────────────────────────────────────────
-
-const mockBuildInputForSurface = vi.hoisted(() =>
-  vi.fn<(surface: string, value?: string) => unknown>(),
+// Mock node:fs so realpathSync (the canonical alias) is controllable.
+const realpathSync = vi.hoisted(() =>
+  vi.fn<(path: string) => string>((p) => p),
 );
-
-vi.mock("#src/input-normalizer", () => ({
-  buildInputForSurface: mockBuildInputForSurface,
+vi.mock("node:fs", () => ({
+  realpathSync,
+  default: { realpathSync },
 }));
 
 // ── helpers ────────────────────────────────────────────────────────────────
 
-function makeSessionRules(
-  rules: Ruleset = [],
-): Pick<SessionRules, "getRuleset"> {
+interface FakeResolver {
+  resolve: Mock<(intent: AccessIntent) => PermissionCheckResult>;
+  getToolPermission: Mock<
+    (toolName: string, agentName?: string) => PermissionState
+  >;
+}
+
+function makeResolver(): FakeResolver {
   return {
-    getRuleset: vi.fn<SessionRules["getRuleset"]>().mockReturnValue(rules),
+    resolve: vi
+      .fn<(intent: AccessIntent) => PermissionCheckResult>()
+      .mockReturnValue(makeCheckResult()),
+    getToolPermission: vi
+      .fn<(toolName: string, agentName?: string) => PermissionState>()
+      .mockReturnValue("ask"),
   };
 }
 
@@ -49,90 +57,97 @@ function makeAccessExtractorRegistry(): ToolAccessExtractorRegistrar {
 }
 
 function makeService(overrides?: {
-  permissionManager?: ScopedPermissionManager;
-  sessionRules?: Pick<SessionRules, "getRuleset">;
+  resolver?: FakeResolver;
   formatterRegistry?: ToolInputFormatterRegistrar;
   accessExtractorRegistry?: ToolAccessExtractorRegistrar;
 }) {
-  const permissionManager =
-    overrides?.permissionManager ?? makeFakePermissionManager();
-  const sessionRules = overrides?.sessionRules ?? makeSessionRules();
+  const resolver = overrides?.resolver ?? makeResolver();
+  // The published service always answers against the parent session's cwd.
+  const session = { getPathNormalizer: () => normalizer };
   const formatterRegistry =
     overrides?.formatterRegistry ?? makeFormatterRegistry();
   const accessExtractorRegistry =
     overrides?.accessExtractorRegistry ?? makeAccessExtractorRegistry();
   const service = new LocalPermissionsService(
-    permissionManager,
-    sessionRules,
+    resolver,
+    session,
     formatterRegistry,
     accessExtractorRegistry,
   );
-  return {
-    service,
-    permissionManager,
-    sessionRules,
-    formatterRegistry,
-    accessExtractorRegistry,
-  };
+  return { service, resolver, formatterRegistry, accessExtractorRegistry };
 }
 
+const normalizer = new PathNormalizer("linux", "/test/project");
+
 // ── tests ──────────────────────────────────────────────────────────────────
 
 beforeEach(() => {
-  mockBuildInputForSurface.mockReset();
-  mockBuildInputForSurface.mockReturnValue({ type: "tool-input" });
+  realpathSync.mockReset();
+  realpathSync.mockImplementation((p: string) => p);
 });
 
 describe("checkPermission", () => {
-  it("builds the surface input from surface and value", () => {
-    const { service } = makeService();
-    service.checkPermission("bash", "echo hi");
-    expect(mockBuildInputForSurface).toHaveBeenCalledWith("bash", "echo hi");
+  it("resolves a non-path surface through a tool intent", () => {
+    const { service, resolver } = makeService();
+    service.checkPermission("bash", "echo hi", "my-agent");
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "bash",
+      input: { command: "echo hi" },
+      agentName: "my-agent",
+    });
   });
 
-  it("builds the surface input with undefined value when value is omitted", () => {
-    const { service } = makeService();
-    service.checkPermission("read");
-    expect(mockBuildInputForSurface).toHaveBeenCalledWith("read", undefined);
+  it("resolves an external_directory path query through an access-path intent matching the canonical alias", () => {
+    realpathSync.mockImplementation((p: string) =>
+      p === "/test/project/link" ? "/test/project/real" : p,
+    );
+    const { service, resolver } = makeService();
+    service.checkPermission("external_directory", "link");
+    expect(resolver.resolve).toHaveBeenCalledTimes(1);
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent.kind).toBe("access-path");
+    if (intent.kind === "access-path") {
+      expect(intent.surface).toBe("external_directory");
+      expect(intent.path.matchValues()).toContain("/test/project/real");
+    }
   });
 
-  it("calls permissionManager.check with a tool intent, built input, agentName, and current ruleset", () => {
-    const ruleset: Ruleset = [
-      { surface: "bash", pattern: "*", action: "allow", origin: "global" },
-    ];
-    const builtInput = { type: "bash-input" };
-    mockBuildInputForSurface.mockReturnValue(builtInput);
-    const { service, permissionManager, sessionRules } = makeService({
-      sessionRules: makeSessionRules(ruleset),
-    });
-    service.checkPermission("bash", "echo hi", "my-agent");
-    expect(permissionManager.check).toHaveBeenCalledWith(
-      {
-        kind: "tool",
-        surface: "bash",
-        input: builtInput,
-        agentName: "my-agent",
-      },
-      ruleset,
-    );
-    void sessionRules; // used indirectly
+  it("resolves a path-bearing tool query (read) through an access-path intent", () => {
+    const { service, resolver } = makeService();
+    service.checkPermission("read", "/test/project/.env");
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent.kind).toBe("access-path");
+    if (intent.kind === "access-path") {
+      expect(intent.surface).toBe("read");
+      expect(intent.path.value()).toBe("/test/project/.env");
+    }
+  });
+
+  it("falls back to a tool intent for a value-less path query", () => {
+    const { service, resolver } = makeService();
+    service.checkPermission("path");
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent.kind).toBe("tool");
   });
 
-  it("returns the result from permissionManager.check", () => {
+  it("returns the result from resolver.resolve", () => {
     const expected = makeCheckResult({ state: "deny", toolName: "bash" });
-    const { service, permissionManager } = makeService();
-    vi.mocked(permissionManager.check).mockReturnValue(expected);
+    const resolver = makeResolver();
+    resolver.resolve.mockReturnValue(expected);
+    const { service } = makeService({ resolver });
     const result = service.checkPermission("bash", "rm -rf /");
     expect(result).toBe(expected);
   });
 });
 
 describe("getToolPermission", () => {
-  it("delegates to permissionManager.getToolPermission", () => {
-    const { service, permissionManager } = makeService();
-    vi.mocked(permissionManager.getToolPermission).mockReturnValue("deny");
+  it("delegates to resolver.getToolPermission", () => {
+    const resolver = makeResolver();
+    resolver.getToolPermission.mockReturnValue("deny");
+    const { service } = makeService({ resolver });
     const result = service.getToolPermission("write", "my-agent");
-    expect(permissionManager.getToolPermission).toHaveBeenCalledWith(
+    expect(resolver.getToolPermission).toHaveBeenCalledWith(
       "write",
       "my-agent",
     );
@@ -140,12 +155,9 @@ describe("getToolPermission", () => {
   });
 
   it("omits agentName when not provided", () => {
-    const { service, permissionManager } = makeService();
+    const { service, resolver } = makeService();
     service.getToolPermission("read");
-    expect(permissionManager.getToolPermission).toHaveBeenCalledWith(
-      "read",
-      undefined,
-    );
+    expect(resolver.getToolPermission).toHaveBeenCalledWith("read", undefined);
   });
 });
 

package/test/service.test.ts

@@ -1,5 +1,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { buildInputForSurface } from "#src/input-normalizer";
+import type { AccessIntent } from "#src/access-intent/access-intent";
+import { PathNormalizer } from "#src/path-normalizer";
+import { LocalPermissionsService } from "#src/permissions-service";
 import type { PermissionsService } from "#src/service";
 import {
   getPermissionsService,
@@ -8,7 +10,7 @@ import {
 } from "#src/service";
 import { ToolAccessExtractorRegistry } from "#src/tool-access-extractor-registry";
 import { ToolInputFormatterRegistry } from "#src/tool-input-formatter-registry";
-import type { PermissionCheckResult } from "#src/types";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
 
 // ── helpers ────────────────────────────────────────────────────────────────
 
@@ -77,7 +79,7 @@ describe("globalThis accessor", () => {
 
 // ── service adapter delegation ─────────────────────────────────────────────
 
-describe("service adapter delegation", () => {
+describe("service round-trip through the global slot", () => {
   afterEach(() => {
     const current = getPermissionsService();
     if (current) {
@@ -93,117 +95,68 @@ describe("service adapter delegation", () => {
     origin: "global",
   };
 
-  it("checkPermission delegates surface and value through buildInputForSurface", () => {
-    const checkPermission = vi.fn().mockReturnValue(fakeResult);
-    const sessionRules = [
-      {
-        surface: "bash",
-        pattern: "*",
-        action: "allow" as const,
-        layer: "session" as const,
-        origin: "session" as const,
-      },
-    ];
-
-    // Build the adapter the same way index.ts will
-    const service = makeService({
-      checkPermission(surface, value, agentName) {
-        const input = buildInputForSurface(surface, value);
-        return checkPermission(surface, input, agentName, sessionRules);
-      },
-    });
-
-    publishPermissionsService(service);
-    const retrieved = getPermissionsService()!;
-    const result = retrieved.checkPermission("bash", "git push");
-
-    expect(result).toBe(fakeResult);
-    expect(checkPermission).toHaveBeenCalledWith(
-      "bash",
-      { command: "git push" },
-      undefined,
-      sessionRules,
+  function makeResolver() {
+    return {
+      resolve: vi
+        .fn<(intent: AccessIntent) => PermissionCheckResult>()
+        .mockReturnValue(fakeResult),
+      getToolPermission: vi
+        .fn<(toolName: string, agentName?: string) => PermissionState>()
+        .mockReturnValue("ask"),
+    };
+  }
+
+  function publishLocalService(resolver: ReturnType<typeof makeResolver>) {
+    publishPermissionsService(
+      new LocalPermissionsService(
+        resolver,
+        {
+          getPathNormalizer: () => new PathNormalizer("linux", "/test/project"),
+        },
+        new ToolInputFormatterRegistry(),
+        new ToolAccessExtractorRegistry(),
+      ),
     );
-  });
+  }
 
-  it("checkPermission passes agentName through", () => {
-    const checkPermission = vi.fn().mockReturnValue(fakeResult);
-
-    const service = makeService({
-      checkPermission(surface, value, agentName) {
-        const input = buildInputForSurface(surface, value);
-        return checkPermission(surface, input, agentName, []);
-      },
-    });
-
-    publishPermissionsService(service);
-    getPermissionsService()!.checkPermission("skill", "my-skill", "Explore");
-
-    expect(checkPermission).toHaveBeenCalledWith(
-      "skill",
-      { name: "my-skill" },
+  it("resolves a non-path query via a tool intent", () => {
+    const resolver = makeResolver();
+    publishLocalService(resolver);
+    const result = getPermissionsService()!.checkPermission(
+      "bash",
+      "git push",
       "Explore",
-      [],
     );
+    expect(result).toBe(fakeResult);
+    expect(resolver.resolve).toHaveBeenCalledWith({
+      kind: "tool",
+      surface: "bash",
+      input: { command: "git push" },
+      agentName: "Explore",
+    });
   });
 
-  it("getToolPermission delegates to the permission manager", () => {
-    const getToolPermissionFn = vi.fn(
-      (_t: string, _a?: string): "deny" => "deny",
-    );
-    const service: PermissionsService = {
-      checkPermission: vi.fn(),
-      getToolPermission(toolName, agentName) {
-        return getToolPermissionFn(toolName, agentName);
-      },
-      registerToolInputFormatter: vi.fn(),
-      registerToolAccessExtractor: vi.fn(),
-    };
+  it("resolves a path-surface query via an access-path intent", () => {
+    const resolver = makeResolver();
+    publishLocalService(resolver);
+    getPermissionsService()!.checkPermission("read", "/test/project/.env");
+    const intent = resolver.resolve.mock.calls[0][0];
+    expect(intent.kind).toBe("access-path");
+    if (intent.kind === "access-path") {
+      expect(intent.surface).toBe("read");
+    }
+  });
 
-    publishPermissionsService(service);
+  it("delegates getToolPermission through the resolver", () => {
+    const resolver = makeResolver();
+    resolver.getToolPermission.mockReturnValue("deny");
+    publishLocalService(resolver);
     const result = getPermissionsService()!.getToolPermission(
-      "bash",
+      "write",
       "Explore",
     );
-
     expect(result).toBe("deny");
-    expect(getToolPermissionFn).toHaveBeenCalledWith("bash", "Explore");
-  });
-
-  it("getToolPermission works without agentName", () => {
-    const getToolPermissionFn = vi.fn(
-      (_t: string, _a?: string): "ask" => "ask",
-    );
-    const service: PermissionsService = {
-      checkPermission: vi.fn(),
-      getToolPermission(toolName, agentName) {
-        return getToolPermissionFn(toolName, agentName);
-      },
-      registerToolInputFormatter: vi.fn(),
-      registerToolAccessExtractor: vi.fn(),
-    };
-
-    publishPermissionsService(service);
-    const result = getPermissionsService()!.getToolPermission("write");
-
-    expect(result).toBe("ask");
-    expect(getToolPermissionFn).toHaveBeenCalledWith("write", undefined);
-  });
-
-  it("checkPermission uses empty object for unknown surfaces", () => {
-    const checkPermission = vi.fn().mockReturnValue(fakeResult);
-
-    const service = makeService({
-      checkPermission(surface, value, agentName) {
-        const input = buildInputForSurface(surface, value);
-        return checkPermission(surface, input, agentName, []);
-      },
-    });
-
-    publishPermissionsService(service);
-    getPermissionsService()!.checkPermission("read", "/tmp/file");
-
-    expect(checkPermission).toHaveBeenCalledWith("read", {}, undefined, []);
+    expect(resolver.getToolPermission).toHaveBeenCalledWith("write", "Explore");
   });
 });
 

package/test/skill-prompt-sanitizer.test.ts

@@ -1,5 +1,6 @@
 import { resolve } from "node:path";
 import { afterEach, describe, expect, test, vi } from "vitest";
+import { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionManager } from "#src/permission-manager";
 import {
   findSkillPathMatch,
@@ -30,6 +31,11 @@ afterEach(() => {
 
 const CWD = "/projects/my-app";
 
+// `findSkillPathMatch` only uses the normalizer's platform (it compares two
+// already-absolute paths via `isWithinDirectory`), so this CWD-baked instance
+// serves every call regardless of the entries' cwd.
+const normalizer = new PathNormalizer("linux", CWD);
+
 function makeManager(
   defaultState: "allow" | "deny" | "ask" = "allow",
   overrides: Record<string, "allow" | "deny" | "ask"> = {},
@@ -72,13 +78,7 @@ describe("resolveSkillPromptEntries", () => {
   test("returns unchanged prompt and empty entries when no skills section present", () => {
     const input = "You are a helpful assistant.";
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toBe(input);
     expect(result.entries).toEqual([]);
     expect(manager.checkPermission).not.toHaveBeenCalled();
@@ -87,13 +87,7 @@ describe("resolveSkillPromptEntries", () => {
   test("keeps all skills when all are allowed", () => {
     const input = availableSkillsSection("librarian", "ask-user");
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.prompt).toContain("ask-user");
     expect(result.entries).toHaveLength(2);
@@ -102,13 +96,7 @@ describe("resolveSkillPromptEntries", () => {
   test("removes denied skill from section", () => {
     const input = availableSkillsSection("librarian", "dangerous");
     const manager = makeManager("allow", { dangerous: "deny" });
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.prompt).not.toContain("dangerous");
     // denied skill is excluded from returned entries
@@ -118,13 +106,7 @@ describe("resolveSkillPromptEntries", () => {
   test("removes entire section when all skills are denied", () => {
     const input = `Intro\n${availableSkillsSection("dangerous")}\nOutro`;
     const manager = makeManager("deny");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).not.toContain("<available_skills>");
     expect(result.prompt).toContain("Intro");
     expect(result.prompt).toContain("Outro");
@@ -134,13 +116,7 @@ describe("resolveSkillPromptEntries", () => {
   test("keeps ask-state skills in section and entries", () => {
     const input = availableSkillsSection("librarian");
     const manager = makeManager("ask");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.prompt).toContain("librarian");
     expect(result.entries).toHaveLength(1);
     expect(result.entries[0].state).toBe("ask");
@@ -149,7 +125,7 @@ describe("resolveSkillPromptEntries", () => {
   test("delegates permission check to permissionManager for each skill", () => {
     const input = availableSkillsSection("alpha", "beta");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, null, CWD, "linux");
+    resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(manager.checkPermission).toHaveBeenCalledWith(
       "skill",
       { name: "alpha" },
@@ -165,7 +141,7 @@ describe("resolveSkillPromptEntries", () => {
   test("passes agentName to permissionManager", () => {
     const input = availableSkillsSection("librarian");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, "my-agent", CWD, "linux");
+    resolveSkillPromptEntries(input, manager, "my-agent", normalizer);
     expect(manager.checkPermission).toHaveBeenCalledWith(
       "skill",
       { name: "librarian" },
@@ -180,7 +156,7 @@ describe("resolveSkillPromptEntries", () => {
       availableSkillsSection("librarian"),
     ].join("\n");
     const manager = makeManager("allow");
-    resolveSkillPromptEntries(input, manager, null, CWD, "linux");
+    resolveSkillPromptEntries(input, manager, null, normalizer);
     // Should only be called once despite appearing twice.
     expect(manager.checkPermission).toHaveBeenCalledTimes(1);
   });
@@ -189,13 +165,7 @@ describe("resolveSkillPromptEntries", () => {
     const location = "/skills/librarian/SKILL.md";
     const input = availableSkillsSection("librarian");
     const manager = makeManager("allow");
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.entries[0].normalizedLocation).toBe(location);
     expect(result.entries[0].normalizedBaseDir).toBe("/skills/librarian");
   });
@@ -205,13 +175,7 @@ describe("resolveSkillPromptEntries", () => {
     const section2 = availableSkillsSection("beta");
     const input = `${section1}\n${section2}`;
     const manager = makeManager("allow", { beta: "deny" });
-    const result = resolveSkillPromptEntries(
-      input,
-      manager,
-      null,
-      CWD,
-      "linux",
-    );
+    const result = resolveSkillPromptEntries(input, manager, null, normalizer);
     expect(result.entries.map((e) => e.name)).toContain("alpha");
     expect(result.entries.map((e) => e.name)).not.toContain("beta");
   });
@@ -240,12 +204,12 @@ describe("findSkillPathMatch", () => {
   ];
 
   test("returns null for empty normalized path", () => {
-    expect(findSkillPathMatch("", entries, "linux")).toBeNull();
+    expect(findSkillPathMatch("", entries, normalizer)).toBeNull();
   });
 
   test("returns null for empty entries array", () => {
     expect(
-      findSkillPathMatch("/skills/librarian/SKILL.md", [], "linux"),
+      findSkillPathMatch("/skills/librarian/SKILL.md", [], normalizer),
     ).toBeNull();
   });
 
@@ -253,7 +217,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian/SKILL.md",
       entries,
-      "linux",
+      normalizer,
     );
     expect(match?.name).toBe("librarian");
   });
@@ -262,13 +226,17 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian/extra/helper.md",
       entries,
-      "linux",
+      normalizer,
     );
     expect(match?.name).toBe("librarian");
   });
 
   test("returns null for path not within any skill directory", () => {
-    const match = findSkillPathMatch("/other/path/file.md", entries, "linux");
+    const match = findSkillPathMatch(
+      "/other/path/file.md",
+      entries,
+      normalizer,
+    );
     expect(match).toBeNull();
   });
 
@@ -277,7 +245,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/librarian-extra/SKILL.md",
       entries,
-      "linux",
+      normalizer,
     );
     expect(match).toBeNull();
   });
@@ -304,7 +272,7 @@ describe("findSkillPathMatch", () => {
     const match = findSkillPathMatch(
       "/skills/parent/child/helper.md",
       nestedEntries,
-      "linux",
+      normalizer,
     );
     expect(match?.name).toBe("child");
   });
@@ -380,8 +348,7 @@ test("REGRESSION: resolveSkillPromptEntries sanitizes every available_skills blo
       prompt,
       asChecker(manager),
       null,
-      "/cwd",
-      "linux",
+      new PathNormalizer("linux", "/cwd"),
     );
 
     expect(result.prompt).not.toContain("denied-skill");
@@ -428,20 +395,19 @@ test("REGRESSION: resolveSkillPromptEntries keeps only visible skills available
       prompt,
       asChecker(manager),
       null,
-      "/cwd",
-      "linux",
+      new PathNormalizer("linux", "/cwd"),
     );
     const visiblePath = resolve("/cwd", "./skills/visible/file.ts");
     const blockedPath = resolve("/cwd", "./skills/blocked/file.ts");
     const matchedVisibleSkill = findSkillPathMatch(
       process.platform === "win32" ? visiblePath.toLowerCase() : visiblePath,
       result.entries,
-      "linux",
+      normalizer,
     );
     const matchedBlockedSkill = findSkillPathMatch(
       process.platform === "win32" ? blockedPath.toLowerCase() : blockedPath,
       result.entries,
-      "linux",
+      normalizer,
     );
 
     expect(matchedVisibleSkill?.name).toBe("visible-skill");