@gotgenes/pi-permission-system 18.0.1 → 18.1.0

package/test/access-intent/bash/program.test.ts

@@ -91,6 +91,63 @@ describe("BashProgram", () => {
       expect(fileCandidate?.path.matchValues()).toEqual(["src/foo.ts"]);
       expect(fileCandidate?.path.boundaryValue()).toBe("");
     });
+
+    describe("rule-driven bare-token promotion (#509)", () => {
+      it("promotes a bare token when the matcher says it is promotable", async () => {
+        const isPromotable = (token: string): boolean => token === "id_rsa";
+        const program = await BashProgram.parse(
+          "cat id_rsa",
+          normalizer,
+          isPromotable,
+        );
+        const candidates = program.pathRuleCandidates();
+        expect(candidates.map(({ token }) => token)).toEqual(["id_rsa"]);
+        expect(candidates[0].path.matchValues()).toEqual([
+          "/projects/my-app/id_rsa",
+          "id_rsa",
+        ]);
+      });
+
+      it("does not promote a bare token the matcher rejects", async () => {
+        const isPromotable = (token: string): boolean => token === "id_rsa";
+        const program = await BashProgram.parse(
+          "git status",
+          normalizer,
+          isPromotable,
+        );
+        expect(program.pathRuleCandidates()).toHaveLength(0);
+      });
+
+      it("does not promote any bare token with the default no-op matcher", async () => {
+        const program = await BashProgram.parse("cat id_rsa", normalizer);
+        expect(program.pathRuleCandidates()).toHaveLength(0);
+      });
+
+      it("keeps a promoted token literal-only after an unknown cd (#393)", async () => {
+        const isPromotable = (token: string): boolean => token === "id_rsa";
+        const program = await BashProgram.parse(
+          'cd "$DIR" && cat id_rsa',
+          normalizer,
+          isPromotable,
+        );
+        const candidate = program
+          .pathRuleCandidates()
+          .find((c) => c.token === "id_rsa");
+        expect(candidate?.path.matchValues()).toEqual(["id_rsa"]);
+      });
+
+      it("does not double-promote a token the shape gate already accepts", async () => {
+        // ./id_rsa already passes classifyTokenAsRuleCandidate; the promoted
+        // fallback must not run (and must not duplicate the candidate).
+        const isPromotable = (): boolean => true;
+        const program = await BashProgram.parse(
+          "cat ./id_rsa",
+          normalizer,
+          isPromotable,
+        );
+        expect(program.pathRuleCandidates()).toHaveLength(1);
+      });
+    });
   });
 
   describe("externalPaths", () => {

package/test/access-intent/bash/token-classification.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "vitest";
 
 import {
+  classifyPromotedRuleCandidate,
   classifyTokenAsPathCandidate,
   classifyTokenAsRuleCandidate,
 } from "#src/access-intent/bash/token-classification";
@@ -314,3 +315,49 @@ describe("classifyTokenAsRuleCandidate", () => {
     }
   });
 });
+
+describe("classifyPromotedRuleCandidate", () => {
+  test("shape-eligible bare token promoted when predicate returns true", () => {
+    expect(classifyPromotedRuleCandidate("id_rsa", () => true)).toBe("id_rsa");
+  });
+
+  test("shape-eligible bare token rejected when predicate returns false", () => {
+    expect(classifyPromotedRuleCandidate("id_rsa", () => false)).toBeNull();
+  });
+
+  test("predicate receives the raw token", () => {
+    const isPromotable = (token: string): boolean => token === "key.pem";
+    expect(classifyPromotedRuleCandidate("key.pem", isPromotable)).toBe(
+      "key.pem",
+    );
+    expect(classifyPromotedRuleCandidate("other.pem", isPromotable)).toBeNull();
+  });
+
+  describe("shared rejection still applies regardless of the predicate", () => {
+    test("flag (leading dash) → null", () => {
+      expect(classifyPromotedRuleCandidate("-r", () => true)).toBeNull();
+    });
+
+    test("env assignment → null", () => {
+      expect(classifyPromotedRuleCandidate("FOO=/bar", () => true)).toBeNull();
+    });
+
+    test("URL → null", () => {
+      expect(
+        classifyPromotedRuleCandidate("https://example.com", () => true),
+      ).toBeNull();
+    });
+
+    test("@scope/package → null", () => {
+      expect(classifyPromotedRuleCandidate("@foo/bar", () => true)).toBeNull();
+    });
+
+    test("regex metacharacters → null", () => {
+      expect(classifyPromotedRuleCandidate("foo.*", () => true)).toBeNull();
+    });
+
+    test("empty string → null", () => {
+      expect(classifyPromotedRuleCandidate("", () => true)).toBeNull();
+    });
+  });
+});

package/test/bash-external-directory.test.ts

@@ -924,7 +924,7 @@ describe("formatBashExternalDirectoryAskPrompt", () => {
   test("includes command, external paths, and CWD", () => {
     const result = formatBashExternalDirectoryAskPrompt(
       "cat /etc/hosts",
-      ["/etc/hosts"],
+      [{ path: "/etc/hosts" }],
       "/projects/my-app",
     );
     expect(result).toContain("cat /etc/hosts");
@@ -935,7 +935,7 @@ describe("formatBashExternalDirectoryAskPrompt", () => {
   test("includes agent name when provided", () => {
     const result = formatBashExternalDirectoryAskPrompt(
       "cat /etc/hosts",
-      ["/etc/hosts"],
+      [{ path: "/etc/hosts" }],
       "/projects/my-app",
       "my-agent",
     );
@@ -945,12 +945,26 @@ describe("formatBashExternalDirectoryAskPrompt", () => {
   test("shows multiple external paths", () => {
     const result = formatBashExternalDirectoryAskPrompt(
       "diff /etc/hosts /var/log/syslog",
-      ["/etc/hosts", "/var/log/syslog"],
+      [{ path: "/etc/hosts" }, { path: "/var/log/syslog" }],
       "/projects/my-app",
     );
     expect(result).toContain("/etc/hosts");
     expect(result).toContain("/var/log/syslog");
   });
+
+  test("discloses the resolved target per path when it differs", () => {
+    const result = formatBashExternalDirectoryAskPrompt(
+      "cat demo-symlink-passwd /etc/hosts",
+      [
+        { path: "demo-symlink-passwd", resolvedPath: "/etc/passwd" },
+        { path: "/etc/hosts" },
+      ],
+      "/projects/my-app",
+    );
+    expect(result).toBe(
+      "Current agent requested bash command 'cat demo-symlink-passwd /etc/hosts' which references path(s) outside working directory '/projects/my-app': demo-symlink-passwd (resolves to '/etc/passwd'), /etc/hosts. Allow this external directory access?",
+    );
+  });
 });
 
 describe("Windows drive-letter paths (win32 semantics)", () => {
@@ -996,7 +1010,7 @@ describe("bash external-directory denial messages (centralized)", () => {
     const result = formatDenyReason({
       kind: "bash_external_directory",
       command: "cat /etc/hosts",
-      externalPaths: ["/etc/hosts"],
+      externalPaths: [{ path: "/etc/hosts" }],
       cwd: "/projects/my-app",
     });
     expect(result).toContain("cat /etc/hosts");

package/test/composition-root.test.ts

@@ -501,6 +501,79 @@ describe("service path queries evaluate the supplied path (#503)", () => {
   });
 });
 
+describe("bash bare-filename path gating (#509)", () => {
+  // Before #509 a bash bare-filename argument (`cat id_rsa`) bypassed the
+  // `path` surface entirely: the broad classifier only accepted tokens
+  // starting with `.`, containing `/`, containing `..`, or a Windows
+  // drive-letter absolute path. The same file accessed via a prefixed path
+  // (`cat ./id_rsa`) or the `read` tool was already gated. Rule-driven
+  // promotion closes the gap for a bare token matching a specific, non-`*`
+  // `path` deny/ask rule — the literal repro from the issue.
+
+  async function fireBashToolCall(
+    pi: ReturnType<typeof makeFakePi>,
+    ctx: unknown,
+    command: string,
+  ): Promise<{ block?: true; reason?: string }> {
+    return (await pi.fire(
+      "tool_call",
+      { name: "bash", input: { command }, toolCallId: "tc-1" },
+      ctx,
+    )) as { block?: true; reason?: string };
+  }
+
+  it("denies a bare filename matching a specific path deny rule", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "pi-perm-bare-token-cwd-"));
+    writeGlobalConfig({
+      permission: { "*": "allow", path: { id_rsa: "deny" } },
+    });
+
+    const pi = makeFakePi({ events: createEventBus() });
+    piPermissionSystemExtension(pi as unknown as ExtensionAPI);
+    const ctx = makeChildCtx(cwd, "bare-token-session-deny");
+    await fireSessionStart(pi, ctx);
+
+    const result = await fireBashToolCall(pi, ctx, "cat id_rsa");
+    expect(result.block).toBe(true);
+
+    rmSync(cwd, { recursive: true, force: true });
+  });
+
+  it("denies a bare filename matching a wildcard path deny rule", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "pi-perm-bare-token-cwd-"));
+    writeGlobalConfig({
+      permission: { "*": "allow", path: { "*.pem": "deny" } },
+    });
+
+    const pi = makeFakePi({ events: createEventBus() });
+    piPermissionSystemExtension(pi as unknown as ExtensionAPI);
+    const ctx = makeChildCtx(cwd, "bare-token-session-wildcard");
+    await fireSessionStart(pi, ctx);
+
+    const result = await fireBashToolCall(pi, ctx, "cat key.pem");
+    expect(result.block).toBe(true);
+
+    rmSync(cwd, { recursive: true, force: true });
+  });
+
+  it("leaves a bare token that does not match any path rule unaffected", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "pi-perm-bare-token-cwd-"));
+    writeGlobalConfig({
+      permission: { "*": "allow", path: { id_rsa: "deny" } },
+    });
+
+    const pi = makeFakePi({ events: createEventBus() });
+    piPermissionSystemExtension(pi as unknown as ExtensionAPI);
+    const ctx = makeChildCtx(cwd, "bare-token-session-unaffected");
+    await fireSessionStart(pi, ctx);
+
+    const result = await fireBashToolCall(pi, ctx, "git status");
+    expect(result.block).toBeUndefined();
+
+    rmSync(cwd, { recursive: true, force: true });
+  });
+});
+
 describe("multi-instance global service interplay", () => {
   // The fix (#302) scopes the process-global service slot to the publishing
   // instance. The parent publishes at its session_start; an in-process child

package/test/denial-messages.test.ts

@@ -242,6 +242,20 @@ describe("formatDenyReason", () => {
         "[pi-permission-system] Agent 'sec-agent' is not permitted to run tool 'read' for path '/etc/passwd' outside working directory '/project'.",
       );
     });
+
+    test("discloses the resolved path when it differs from the typed path", () => {
+      expect(
+        formatDenyReason({
+          kind: "external_directory",
+          toolName: "read",
+          pathValue: "demo-symlink-passwd",
+          resolvedPath: "/etc/passwd",
+          cwd: "/project",
+        }),
+      ).toBe(
+        "[pi-permission-system] Current agent is not permitted to run tool 'read' for path 'demo-symlink-passwd' (resolves to '/etc/passwd') outside working directory '/project'.",
+      );
+    });
   });
 
   describe("bash_external_directory context", () => {
@@ -250,7 +264,7 @@ describe("formatDenyReason", () => {
         formatDenyReason({
           kind: "bash_external_directory",
           command: "cat /etc/hosts",
-          externalPaths: ["/etc/hosts"],
+          externalPaths: [{ path: "/etc/hosts" }],
           cwd: "/project",
         }),
       ).toBe(
@@ -263,7 +277,7 @@ describe("formatDenyReason", () => {
         formatDenyReason({
           kind: "bash_external_directory",
           command: "cp /etc/hosts /tmp/out",
-          externalPaths: ["/etc/hosts", "/tmp/out"],
+          externalPaths: [{ path: "/etc/hosts" }, { path: "/tmp/out" }],
           cwd: "/project",
           agentName: "my-agent",
         }),
@@ -271,6 +285,22 @@ describe("formatDenyReason", () => {
         "[pi-permission-system] Agent 'my-agent' is not permitted to run bash command 'cp /etc/hosts /tmp/out' which references path(s) outside working directory '/project': /etc/hosts, /tmp/out.",
       );
     });
+
+    test("discloses resolved targets per path when they differ", () => {
+      expect(
+        formatDenyReason({
+          kind: "bash_external_directory",
+          command: "cat demo-symlink-passwd /etc/hosts",
+          externalPaths: [
+            { path: "demo-symlink-passwd", resolvedPath: "/etc/passwd" },
+            { path: "/etc/hosts" },
+          ],
+          cwd: "/project",
+        }),
+      ).toBe(
+        "[pi-permission-system] Current agent is not permitted to run bash command 'cat demo-symlink-passwd /etc/hosts' which references path(s) outside working directory '/project': demo-symlink-passwd (resolves to '/etc/passwd'), /etc/hosts.",
+      );
+    });
   });
 
   describe("bash_path context", () => {
@@ -403,12 +433,26 @@ describe("formatUnavailableReason", () => {
     );
   });
 
+  test("external_directory discloses the resolved path when it differs from the typed path", () => {
+    expect(
+      formatUnavailableReason({
+        kind: "external_directory",
+        toolName: "read",
+        pathValue: "demo-symlink-passwd",
+        resolvedPath: "/etc/passwd",
+        cwd: "/project",
+      }),
+    ).toBe(
+      "[pi-permission-system] Accessing 'demo-symlink-passwd' (resolves to '/etc/passwd') outside the working directory requires approval, but no interactive UI is available.",
+    );
+  });
+
   test("bash_external_directory", () => {
     expect(
       formatUnavailableReason({
         kind: "bash_external_directory",
         command: "cat /etc/hosts",
-        externalPaths: ["/etc/hosts"],
+        externalPaths: [{ path: "/etc/hosts" }],
         cwd: "/project",
       }),
     ).toBe(
@@ -539,6 +583,20 @@ describe("formatUserDeniedReason", () => {
         "[pi-permission-system] User denied external directory access for tool 'edit' path '/etc/hosts'. Reason: too risky.",
       );
     });
+
+    test("discloses the resolved path when it differs from the typed path", () => {
+      expect(
+        formatUserDeniedReason({
+          kind: "external_directory",
+          toolName: "edit",
+          pathValue: "demo-symlink-hosts",
+          resolvedPath: "/etc/hosts",
+          cwd: "/project",
+        }),
+      ).toBe(
+        "[pi-permission-system] User denied external directory access for tool 'edit' path 'demo-symlink-hosts' (resolves to '/etc/hosts').",
+      );
+    });
   });
 
   describe("bash_external_directory context", () => {
@@ -547,7 +605,7 @@ describe("formatUserDeniedReason", () => {
         formatUserDeniedReason({
           kind: "bash_external_directory",
           command: "rm /etc/hosts",
-          externalPaths: ["/etc/hosts"],
+          externalPaths: [{ path: "/etc/hosts" }],
           cwd: "/project",
         }),
       ).toBe(
@@ -561,7 +619,7 @@ describe("formatUserDeniedReason", () => {
           {
             kind: "bash_external_directory",
             command: "rm /etc/hosts",
-            externalPaths: ["/etc/hosts"],
+            externalPaths: [{ path: "/etc/hosts" }],
             cwd: "/project",
           },
           "dangerous",

package/test/handlers/external-directory-integration.test.ts

@@ -47,7 +47,12 @@ describe("external_directory helper regression guard", () => {
   it("formatExternalDirectoryAskPrompt is a callable function", () => {
     expect(typeof formatExternalDirectoryAskPrompt).toBe("function");
     expect(
-      formatExternalDirectoryAskPrompt("read", "/outside/file", "/project"),
+      formatExternalDirectoryAskPrompt(
+        "read",
+        "/outside/file",
+        undefined,
+        "/project",
+      ),
     ).toContain("/outside/file");
   });
 

package/test/handlers/gates/external-directory-messages.test.ts

@@ -15,6 +15,7 @@ describe("formatExternalDirectoryAskPrompt", () => {
     const result = formatExternalDirectoryAskPrompt(
       "read",
       "/etc/passwd",
+      undefined,
       "/projects/my-app",
     );
     expect(result).toContain("Current agent");
@@ -27,6 +28,7 @@ describe("formatExternalDirectoryAskPrompt", () => {
     const result = formatExternalDirectoryAskPrompt(
       "write",
       "/tmp/out.txt",
+      undefined,
       "/projects/my-app",
       "my-agent",
     );
@@ -34,13 +36,35 @@ describe("formatExternalDirectoryAskPrompt", () => {
     expect(result).toContain("write");
     expect(result).toContain("/tmp/out.txt");
   });
+
+  test("discloses the resolved path when it differs from the typed path", () => {
+    const result = formatExternalDirectoryAskPrompt(
+      "read",
+      "demo-symlink-passwd",
+      "/etc/passwd",
+      "/projects/my-app",
+    );
+    expect(result).toBe(
+      "Current agent requested tool 'read' for path 'demo-symlink-passwd' (resolves to '/etc/passwd') outside working directory '/projects/my-app'. Allow this external directory access?",
+    );
+  });
+
+  test("omits the disclosure when resolvedPath is undefined", () => {
+    const result = formatExternalDirectoryAskPrompt(
+      "read",
+      "/etc/passwd",
+      undefined,
+      "/projects/my-app",
+    );
+    expect(result).not.toContain("resolves to");
+  });
 });
 
 describe("formatBashExternalDirectoryAskPrompt", () => {
   test("includes command, paths, cwd, and agent name", () => {
     const result = formatBashExternalDirectoryAskPrompt(
       "cat /etc/passwd",
-      ["/etc/passwd"],
+      [{ path: "/etc/passwd" }],
       "/projects/my-app",
       "my-agent",
     );
@@ -53,7 +77,7 @@ describe("formatBashExternalDirectoryAskPrompt", () => {
   test("uses 'Current agent' when no agent name provided", () => {
     const result = formatBashExternalDirectoryAskPrompt(
       "ls /tmp",
-      ["/tmp"],
+      [{ path: "/tmp" }],
       "/projects/my-app",
     );
     expect(result).toContain("Current agent");

package/test/handlers/gates/tool-call-gate-pipeline.test.ts

@@ -186,6 +186,7 @@ describe("ToolCallGatePipeline", () => {
       expect(mockBashProgramParse).toHaveBeenCalledWith(
         "echo hello",
         expect.any(PathNormalizer),
+        expect.any(Function),
       );
     });
 
@@ -202,6 +203,31 @@ describe("ToolCallGatePipeline", () => {
 
       expect(mockBashProgramParse).not.toHaveBeenCalled();
     });
+
+    it("passes the session's promotable path-token matcher into BashProgram.parse (#509)", async () => {
+      const resolver = makeResolver(makeCheckResult());
+      const isPromotable = vi.fn((token: string) => token === "id_rsa");
+      const getPromotablePathTokenMatcher = vi.fn(() => isPromotable);
+      const inputs = makeGateInputs({ getPromotablePathTokenMatcher });
+      const { runner } = makeGateRunner();
+      const pipeline = new ToolCallGatePipeline(resolver, inputs);
+
+      await pipeline.evaluate(
+        makeTcc({
+          toolName: "bash",
+          input: { command: "cat id_rsa" },
+          agentName: "my-agent",
+        }),
+        runner,
+      );
+
+      expect(getPromotablePathTokenMatcher).toHaveBeenCalledWith("my-agent");
+      expect(mockBashProgramParse).toHaveBeenCalledWith(
+        "cat id_rsa",
+        expect.any(PathNormalizer),
+        isPromotable,
+      );
+    });
   });
 
   // ── customExtractors threading (#352) ────────────────────────────────────

package/test/helpers/gate-fixtures.ts

@@ -15,7 +15,7 @@ import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 import type { ToolPreviewFormatterOptions } from "#src/tool-preview-formatter";
-import type { PermissionCheckResult } from "#src/types";
+import type { PathRuleTokenMatcher, PermissionCheckResult } from "#src/types";
 
 import { makeCheckResult } from "#test/helpers/handler-fixtures";
 
@@ -255,6 +255,9 @@ export function makeGateInputs(
     getInfrastructureReadDirs?: () => string[];
     getToolPreviewLimits?: () => ToolPreviewFormatterOptions;
     getPathNormalizer?: () => PathNormalizer;
+    getPromotablePathTokenMatcher?: (
+      agentName?: string,
+    ) => PathRuleTokenMatcher;
   } = {},
 ): ToolCallGateInputs {
   return {
@@ -275,6 +278,9 @@ export function makeGateInputs(
       vi.fn<() => PathNormalizer>(
         () => new PathNormalizer(process.platform, "/test/cwd"),
       ),
+    getPromotablePathTokenMatcher:
+      overrides.getPromotablePathTokenMatcher ??
+      vi.fn<(agentName?: string) => PathRuleTokenMatcher>(() => () => false),
   };
 }
 

package/test/helpers/session-fixtures.ts

@@ -25,7 +25,11 @@ import type { PromptingGatewayLifecycle } from "#src/prompting-gateway";
 import type { Ruleset } from "#src/rule";
 import type { SessionLogger } from "#src/session-logger";
 import { SessionRules } from "#src/session-rules";
-import type { PermissionCheckResult, PermissionState } from "#src/types";
+import type {
+  PathRuleTokenMatcher,
+  PermissionCheckResult,
+  PermissionState,
+} from "#src/types";
 
 // ── Per-collaborator fake factories ────────────────────────────────────────
 
@@ -105,6 +109,9 @@ export function makeFakePermissionManager() {
       .fn<(toolName: string, agentName?: string) => PermissionState>()
       .mockReturnValue("allow"),
     getConfigIssues: vi.fn((): string[] => []),
+    getPromotablePathTokenMatcher: vi
+      .fn<(agentName?: string) => PathRuleTokenMatcher>()
+      .mockReturnValue(() => false),
   };
 }
 

package/test/permission-manager-unified.test.ts

@@ -1096,6 +1096,87 @@ describe("PermissionManager with in-memory PolicyLoader", () => {
       ).toBe(true);
     });
   });
+
+  describe("getPromotablePathTokenMatcher (#509)", () => {
+    it("matches a bare token against a specific deny pattern", () => {
+      const manager = makeInMemoryManager({
+        global: { permission: { path: { id_rsa: "deny" } } },
+      });
+      const isPromotable = manager.getPromotablePathTokenMatcher();
+      expect(isPromotable("id_rsa")).toBe(true);
+      expect(isPromotable("other_file")).toBe(false);
+    });
+
+    it("matches a bare token against a specific ask wildcard pattern", () => {
+      const manager = makeInMemoryManager({
+        global: { permission: { path: { "*.pem": "ask" } } },
+      });
+      const isPromotable = manager.getPromotablePathTokenMatcher();
+      expect(isPromotable("key.pem")).toBe(true);
+      expect(isPromotable("key.txt")).toBe(false);
+    });
+
+    it("does not match against the universal '*' path pattern", () => {
+      const manager = makeInMemoryManager({
+        global: { permission: { path: { "*": "ask" } } },
+      });
+      const isPromotable = manager.getPromotablePathTokenMatcher();
+      expect(isPromotable("anything")).toBe(false);
+      expect(isPromotable("status")).toBe(false);
+    });
+
+    it("does not match against an allow-only path pattern", () => {
+      const manager = makeInMemoryManager({
+        global: { permission: { path: { id_rsa: "allow" } } },
+      });
+      const isPromotable = manager.getPromotablePathTokenMatcher();
+      expect(isPromotable("id_rsa")).toBe(false);
+    });
+
+    it("returns a no-op matcher when no path rules exist", () => {
+      const manager = makeInMemoryManager({
+        global: { permission: { read: "allow" } },
+      });
+      const isPromotable = manager.getPromotablePathTokenMatcher();
+      expect(isPromotable("id_rsa")).toBe(false);
+      expect(isPromotable("anything")).toBe(false);
+    });
+
+    it("folds case on an injected win32 platform", () => {
+      const manager = new PermissionManager({
+        policyLoader: createInMemoryPolicyLoader({
+          global: { permission: { path: { id_rsa: "deny" } } },
+        }),
+        platform: "win32",
+      });
+      const isPromotable = manager.getPromotablePathTokenMatcher();
+      expect(isPromotable("ID_RSA")).toBe(true);
+    });
+
+    it("stays case-sensitive on a POSIX platform", () => {
+      const manager = new PermissionManager({
+        policyLoader: createInMemoryPolicyLoader({
+          global: { permission: { path: { id_rsa: "deny" } } },
+        }),
+        platform: "linux",
+      });
+      const isPromotable = manager.getPromotablePathTokenMatcher();
+      expect(isPromotable("ID_RSA")).toBe(false);
+    });
+
+    it("scopes to the requested agent's composed rules", () => {
+      const manager = makeInMemoryManager({
+        global: { permission: { path: { id_rsa: "deny" } } },
+        agent: {
+          coder: { permission: { path: { "secret.key": "deny" } } },
+        },
+      });
+      const globalMatcher = manager.getPromotablePathTokenMatcher();
+      const agentMatcher = manager.getPromotablePathTokenMatcher("coder");
+      expect(globalMatcher("secret.key")).toBe(false);
+      expect(agentMatcher("secret.key")).toBe(true);
+    });
+  });
 });
 
 // ---------------------------------------------------------------------------

package/test/permission-resolver.test.ts

@@ -6,7 +6,11 @@ import { PermissionResolver } from "#src/permission-resolver";
 import type { Ruleset } from "#src/rule";
 import { SessionApproval } from "#src/session-approval";
 import { SessionRules } from "#src/session-rules";
-import type { PermissionCheckResult, PermissionState } from "#src/types";
+import type {
+  PathRuleTokenMatcher,
+  PermissionCheckResult,
+  PermissionState,
+} from "#src/types";
 
 function makePermissionManager() {
   return {
@@ -28,6 +32,9 @@ function makePermissionManager() {
       .fn<(toolName: string, agentName?: string) => PermissionState>()
       .mockReturnValue("allow"),
     getConfigIssues: vi.fn((): string[] => []),
+    getPromotablePathTokenMatcher: vi
+      .fn<(agentName?: string) => PathRuleTokenMatcher>()
+      .mockReturnValue(() => false),
   };
 }