@gotgenes/pi-permission-system 20.2.0 → 20.4.0

package/src/index.ts

@@ -1,12 +1,17 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
+import { warmBashParser } from "./access-intent/bash/parser";
 import { AuthorizerSelection } from "./authority/authorizer-selection";
 import {
   ForwardedRequestServer,
   type ServingPolicy,
 } from "./authority/forwarded-request-server";
+import { ForwardingManager } from "./authority/forwarding-manager";
+import { requestPermissionDecisionFromUi } from "./authority/permission-dialog";
 import { PermissionPrompter } from "./authority/permission-prompter";
 import { SubagentDetection } from "./authority/subagent-detection";
+import { subscribeSubagentLifecycle } from "./authority/subagent-lifecycle-events";
+import { getSubagentSessionRegistry } from "./authority/subagent-registry";
 import { registerBuiltinToolInputFormatters } from "./builtin-tool-input-formatters";
 import { registerPermissionSystemCommand } from "./config-modal";
 import { getGlobalConfigPath } from "./config-paths";
@@ -15,7 +20,6 @@ import { DecisionAudit } from "./decision-audit";
 import { GateDecisionReporter } from "./decision-reporter";
 import { isYoloModeEnabled } from "./extension-config";
 import { computeExtensionPaths } from "./extension-paths";
-import { ForwardingManager } from "./forwarding-manager";
 import {
   AgentPrepHandler,
   PermissionGateHandler,
@@ -26,7 +30,7 @@ import { SkillInputGatePipeline } from "./handlers/gates/skill-input-gate-pipeli
 import { ToolCallGatePipeline } from "./handlers/gates/tool-call-gate-pipeline";
 import { createFailClosedToolCall } from "./handlers/tool-call-boundary";
 import { buildAccessIntentForSurface } from "./input-normalizer";
-import { requestPermissionDecisionFromUi } from "./permission-dialog";
+import { pathFlavorForPlatform } from "./path/path-flavor";
 import { PermissionManager } from "./permission-manager";
 import { PermissionResolver } from "./permission-resolver";
 import { PermissionSession } from "./permission-session";
@@ -34,8 +38,6 @@ import { LocalPermissionsService } from "./permissions-service";
 import { PermissionServiceLifecycle } from "./service-lifecycle";
 import { PermissionSessionLogger } from "./session-logger";
 import { SessionRules } from "./session-rules";
-import { subscribeSubagentLifecycle } from "./subagent-lifecycle-events";
-import { getSubagentSessionRegistry } from "./subagent-registry";
 import { ToolAccessExtractorRegistry } from "./tool-access-extractor-registry";
 import { ToolInputFormatterRegistry } from "./tool-input-formatter-registry";
 
@@ -44,17 +46,19 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // getPackageDir() is Pi's own install dir; auto-allow it for read-only tools
   // so the agent can read Pi's bundled docs/examples regardless of layout.
   const paths = computeExtensionPaths(agentDir, getPackageDir());
-  // The single process.platform read for the whole extension; injected into the
-  // session (PathNormalizer) and, later, rule evaluation. Interior modules must
-  // not read process.platform (enforced by the eslint guard scoped to src/).
-  const hostPlatform = process.platform;
+  // The single process.platform read for the whole extension, resolved once
+  // into the path-language flavor that every consumer shares (the session's
+  // PathNormalizer, rule evaluation, and subagent detection). Interior modules
+  // must not read process.platform (enforced by the eslint guard scoped to
+  // src/) and never re-derive the win32 flavor — they receive this product.
+  const hostFlavor = pathFlavorForPlatform(process.platform);
   const sessionRules = new SessionRules();
   const subagentRegistry = getSubagentSessionRegistry();
   // Single owner of subagent detection, shared across every consumer instead of
   // threading the (subagentSessionsDir, platform, registry) triple into each.
   const subagentDetection = new SubagentDetection({
     subagentSessionsDir: paths.subagentSessionsDir,
-    platform: hostPlatform,
+    flavor: hostFlavor,
     registry: subagentRegistry,
   });
   const formatterRegistry = new ToolInputFormatterRegistry();
@@ -75,7 +79,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // assigned below. yolo becomes a composition-stage ask→allow rewrite (#526).
   const permissionManager = new PermissionManager({
     agentDir,
-    platform: hostPlatform,
+    flavor: hostFlavor,
     isYoloEnabled: () => isYoloModeEnabled(configStore.current()),
   });
 
@@ -132,6 +136,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     logger,
     policy: servingPolicy,
     escalator: authorizerSelection,
+    // Records a whole-session grant into the same SessionRules the resolver and
+    // gate runner read, so a serving-scope grant governs the parent and future
+    // forwarded resolutions.
+    recorder: sessionRules,
     registry: subagentRegistry,
   });
 
@@ -142,7 +150,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     sessionRules,
     configStore,
     authorizerSelection,
-    hostPlatform,
+    hostFlavor,
   );
 
   // refresh() must run after `session` is assigned: a debug-write IO failure
@@ -200,7 +208,14 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     logger,
     audit,
   );
-  const agentPrep = new AgentPrepHandler(session, resolver, toolRegistry);
+  const agentPrep = new AgentPrepHandler(
+    session,
+    resolver,
+    toolRegistry,
+    () => {
+      void warmBashParser();
+    },
+  );
 
   const reporter = new GateDecisionReporter(logger, pi.events);
   const gateRunner = new GateRunner(

package/src/input-normalizer.ts

@@ -1,4 +1,5 @@
 import type { AccessIntent } from "./access-intent/access-intent";
+import { classifyToolKind } from "./access-intent/tool-kind";
 import { stripBashCommentLines } from "./bash-arity";
 import { createMcpPermissionTargets } from "./mcp-targets";
 import type { PathNormalizer } from "./path-normalizer";
@@ -106,55 +107,59 @@ export function normalizeInput(
   input: unknown,
   configuredMcpServerNames: readonly string[],
 ): NormalizedInput {
-  // --- Skill ---
-  if (toolName === "skill") {
-    const record = toRecord(input);
-    const skillName = record.name;
-    const lookupValue = typeof skillName === "string" ? skillName : "*";
-    return {
-      surface: "skill",
-      values: [lookupValue],
-      resultExtras: {},
-    };
-  }
+  switch (classifyToolKind(toolName)) {
+    // --- Skill ---
+    case "skill": {
+      const record = toRecord(input);
+      const skillName = record.name;
+      const lookupValue = typeof skillName === "string" ? skillName : "*";
+      return {
+        surface: "skill",
+        values: [lookupValue],
+        resultExtras: {},
+      };
+    }
 
-  // --- Bash ---
-  if (toolName === "bash") {
-    const record = toRecord(input);
-    const command = typeof record.command === "string" ? record.command : "";
-    // Strip leading shell comment lines so pattern matching operates on the
-    // actual command, not a `# description` prefix agents often prepend.
-    // Fall back to the raw command when stripping leaves nothing, so an
-    // all-comment command still evaluates against its literal text.
-    const matchValue = stripBashCommentLines(command) || command;
-    return {
-      surface: "bash",
-      values: [matchValue],
-      resultExtras: { command },
-    };
-  }
+    // --- Bash ---
+    case "bash": {
+      const record = toRecord(input);
+      const command = typeof record.command === "string" ? record.command : "";
+      // Strip leading shell comment lines so pattern matching operates on the
+      // actual command, not a `# description` prefix agents often prepend.
+      // Fall back to the raw command when stripping leaves nothing, so an
+      // all-comment command still evaluates against its literal text.
+      const matchValue = stripBashCommentLines(command) || command;
+      return {
+        surface: "bash",
+        values: [matchValue],
+        resultExtras: { command },
+      };
+    }
 
-  // --- MCP ---
-  if (toolName === "mcp") {
-    const mcpTargets = [
-      ...createMcpPermissionTargets(input, configuredMcpServerNames),
-      "mcp",
-    ];
-    const fallbackTarget = mcpTargets[0] ?? "mcp";
-    return {
-      surface: "mcp",
-      values: mcpTargets,
-      resultExtras: { target: fallbackTarget },
-    };
-  }
+    // --- MCP ---
+    case "mcp": {
+      const mcpTargets = [
+        ...createMcpPermissionTargets(input, configuredMcpServerNames),
+        "mcp",
+      ];
+      const fallbackTarget = mcpTargets[0] ?? "mcp";
+      return {
+        surface: "mcp",
+        values: mcpTargets,
+        resultExtras: { target: fallbackTarget },
+      };
+    }
 
-  // --- All other surfaces (path-bearing tools and extension tools) ---
-  // Path-bearing tools with a present path never reach here — the gate emits
-  // an access-path intent (#502). Missing-path and extension-tool cases both
-  // collapse to the surface catch-all.
-  return {
-    surface: toolName,
-    values: ["*"],
-    resultExtras: {},
-  };
+    // --- All other surfaces (path-bearing tools and extension tools) ---
+    // Path-bearing tools with a present path never reach here — the gate emits
+    // an access-path intent (#502). Missing-path and extension-tool cases both
+    // collapse to the surface catch-all.
+    case "path":
+    case "extension":
+      return {
+        surface: toolName,
+        values: ["*"],
+        resultExtras: {},
+      };
+  }
 }

package/src/{canonicalize-path.ts → path/canonicalize-path.ts}

@@ -1,5 +1,6 @@
 import { realpathSync } from "node:fs";
-import { posix as posixPath, win32 as winPath } from "node:path";
+
+import type { PathFlavor } from "#src/path/path-flavor";
 
 /**
  * Resolve symlinks in an absolute path, best-effort.
@@ -13,11 +14,11 @@ import { posix as posixPath, win32 as winPath } from "node:path";
  */
 export function canonicalizePath(
   absolutePath: string,
-  platform: NodeJS.Platform,
+  flavor: PathFlavor,
 ): string {
   if (!absolutePath) return absolutePath;
 
-  const impl = platform === "win32" ? winPath : posixPath;
+  const { impl } = flavor;
   const root = impl.parse(absolutePath).root;
   const rest = absolutePath.slice(root.length);
   const parts = rest.split(impl.sep).filter(Boolean);

package/src/path/path-containment.ts

@@ -0,0 +1,24 @@
+import type { PathFlavor } from "#src/path/path-flavor";
+import { isSafeSystemPath } from "#src/safe-system-paths";
+
+/**
+ * Pure geometry: is `canonicalPath` outside `canonicalCwd`?
+ *
+ * Both operands must already be canonical (symlink-resolved, win32-lowercased)
+ * — the caller prepares them (see {@link PathNormalizer.isOutsideWorkingDirectory}).
+ * This predicate touches no filesystem and does no derivation; the containment
+ * geometry lives on {@link PathFlavor.isWithin}.
+ */
+export function isPathOutsideWorkingDirectory(
+  canonicalPath: string,
+  canonicalCwd: string,
+  flavor: PathFlavor,
+): boolean {
+  if (!canonicalCwd || !canonicalPath) {
+    return false;
+  }
+  if (isSafeSystemPath(canonicalPath)) {
+    return false;
+  }
+  return !flavor.isWithin(canonicalPath, canonicalCwd);
+}

package/src/path/path-flavor.ts

@@ -0,0 +1,114 @@
+import type { PlatformPath } from "node:path";
+import { posix as posixPath, win32 as winPath } from "node:path";
+
+import {
+  type BashTokenShape,
+  classifyWin32BashToken,
+} from "#src/access-intent/bash/msys-bash-tokens";
+import type { WildcardMatchOptions } from "#src/wildcard-matcher";
+
+/**
+ * The resolved product of the single win32-vs-POSIX platform decision: the
+ * platform's path *language* as one immutable collaborator.
+ *
+ * The win32-vs-POSIX difference is not variant growth (the set is closed) but
+ * **connascence of algorithm** — every path leaf must re-derive the same
+ * mapping identically, and in a permission system a leaf that misses the case
+ * fold or separator fold is a silent bypass (the #382 / #508 class). `PathFlavor`
+ * captures that mapping once so the leaves consume the resolved capability
+ * instead of re-interpreting a raw `NodeJS.Platform` string. It owns platform
+ * **semantics** — syntax ({@link hasPathSeparator}), token shape
+ * ({@link bashTokenShape}), and the equivalence relation ({@link fold} /
+ * {@link comparable} / {@link isWithin} / {@link matchOptions}); domain policy
+ * (lexical cleanup, alias generation, safe-system-path exclusions, rule
+ * dispatch) stays in the functions that consume it.
+ */
+export interface PathFlavor {
+  /**
+   * Node's own platform path strategy (`path.win32` | `path.posix`). Exposed
+   * directly — its post-migration consumers are all path-domain primitives and
+   * `PlatformPath` is itself a maintained strategy object, so wrapping it would
+   * be pure forwarding.
+   */
+  readonly impl: PlatformPath;
+  /**
+   * Wildcard match options for path-surface rule matching: the win32
+   * case-and-separator fold, or `undefined` on POSIX.
+   */
+  readonly matchOptions: WildcardMatchOptions | undefined;
+  /** Comparison case fold: win32 lowercases, POSIX returns the value unchanged. */
+  fold(value: string): string;
+  /**
+   * Resolve `pathValue` against `base`, normalize, and fold — the single home
+   * of the #382 case-fold invariant for absolute comparison values.
+   */
+  comparable(pathValue: string, base: string): string;
+  /** `path.relative`-based containment: is `pathValue` `directory` itself or nested inside it? */
+  isWithin(pathValue: string, directory: string): boolean;
+  /**
+   * True when `token` contains a path separator under this platform: `/` on
+   * POSIX; `/` or `\` on win32 (where a backslash is a separator, #520).
+   */
+  hasPathSeparator(token: string): boolean;
+  /**
+   * The MSYS/Git-Bash interpretation of a bash-command token. On win32 this
+   * carries device / drive-mount / posix-absolute / plain semantics; on POSIX
+   * every token is an ordinary path, so the shape is always `{ kind: "plain" }`.
+   */
+  bashTokenShape(token: string): BashTokenShape;
+}
+
+class PlatformPathFlavor implements PathFlavor {
+  readonly matchOptions: WildcardMatchOptions | undefined;
+
+  constructor(
+    readonly impl: PlatformPath,
+    private readonly windows: boolean,
+  ) {
+    this.matchOptions = windows
+      ? { caseInsensitive: true, windowsSeparators: true }
+      : undefined;
+  }
+
+  fold(value: string): string {
+    return this.windows ? value.toLowerCase() : value;
+  }
+
+  comparable(pathValue: string, base: string): string {
+    return this.fold(this.impl.normalize(this.impl.resolve(base, pathValue)));
+  }
+
+  isWithin(pathValue: string, directory: string): boolean {
+    if (!pathValue || !directory) return false;
+    if (pathValue === directory) return true;
+    const rel = this.impl.relative(directory, pathValue);
+    return (
+      rel !== "" &&
+      rel !== ".." &&
+      !rel.startsWith(`..${this.impl.sep}`) &&
+      !this.impl.isAbsolute(rel)
+    );
+  }
+
+  hasPathSeparator(token: string): boolean {
+    return token.includes("/") || (this.windows && token.includes("\\"));
+  }
+
+  bashTokenShape(token: string): BashTokenShape {
+    return this.windows ? classifyWin32BashToken(token) : { kind: "plain" };
+  }
+}
+
+export const posixPathFlavor: PathFlavor = new PlatformPathFlavor(
+  posixPath,
+  false,
+);
+export const win32PathFlavor: PathFlavor = new PlatformPathFlavor(
+  winPath,
+  true,
+);
+
+/** The one win32-vs-POSIX platform decision in the package. */
+export function pathFlavorForPlatform(platform: NodeJS.Platform): PathFlavor {
+  return platform === "win32" ? win32PathFlavor : posixPathFlavor;
+}

package/src/{pi-infrastructure-read.ts → path/pi-infrastructure-read.ts}

@@ -1,9 +1,9 @@
 import { join } from "node:path";
 
-import { expandHomePath } from "./expand-home";
-import { isPathWithinDirectory } from "./path-containment";
-import { READ_ONLY_PATH_BEARING_TOOLS } from "./path-surfaces";
-import { wildcardMatch } from "./wildcard-matcher";
+import { expandHomePath } from "#src/expand-home";
+import type { PathFlavor } from "#src/path/path-flavor";
+import { READ_ONLY_PATH_BEARING_TOOLS } from "#src/path-surfaces";
+import { wildcardMatch } from "#src/wildcard-matcher";
 
 function containsGlobChars(value: string): boolean {
   return value.includes("*") || value.includes("?");
@@ -29,35 +29,30 @@ export function isPiInfrastructureRead(
   normalizedPath: string,
   infrastructureDirs: readonly string[],
   cwd: string,
-  platform: NodeJS.Platform,
+  flavor: PathFlavor,
 ): boolean {
   if (!READ_ONLY_PATH_BEARING_TOOLS.has(toolName)) {
     return false;
   }
 
-  // On Windows the path value is canonicalized + lowercased; fold case (and
-  // separators) so mixed-case infra dirs and glob patterns still match.
-  const matchOptions =
-    platform === "win32"
-      ? { caseInsensitive: true, windowsSeparators: true }
-      : undefined;
-
+  // On Windows the path value is canonicalized + lowercased; the flavor's match
+  // options fold case (and separators) so mixed-case infra dirs and glob
+  // patterns still match.
   for (const dir of infrastructureDirs) {
     if (containsGlobChars(dir)) {
-      if (wildcardMatch(dir, normalizedPath, matchOptions)) return true;
+      if (wildcardMatch(dir, normalizedPath, flavor.matchOptions)) return true;
     } else {
-      if (isPathWithinDirectory(normalizedPath, expandHomePath(dir), platform))
-        return true;
+      if (flavor.isWithin(normalizedPath, expandHomePath(dir))) return true;
     }
   }
 
   // Project-local Pi packages — checked fresh every call so CWD changes work.
   const projectNpmDir = join(cwd, ".pi", "npm");
   const projectGitDir = join(cwd, ".pi", "git");
-  if (isPathWithinDirectory(normalizedPath, projectNpmDir, platform)) {
+  if (flavor.isWithin(normalizedPath, projectNpmDir)) {
     return true;
   }
-  if (isPathWithinDirectory(normalizedPath, projectGitDir, platform)) {
+  if (flavor.isWithin(normalizedPath, projectGitDir)) {
     return true;
   }
 

package/src/path-normalizer.ts

@@ -1,17 +1,13 @@
-import { posix as posixPath, win32 as winPath } from "node:path";
+import type { PathFlavor } from "#src/path/path-flavor";
 
 import { AccessPath } from "./access-intent/access-path";
-import { classifyWin32BashToken } from "./access-intent/bash/msys-bash-tokens";
 import {
   canonicalNormalizePathForComparison,
   normalizePathForComparison,
   normalizePathPolicyLiteral,
 } from "./access-intent/path-normalization";
-import {
-  isPathOutsideWorkingDirectory,
-  isPathWithinDirectory,
-} from "./path-containment";
-import { isPiInfrastructureRead } from "./pi-infrastructure-read";
+import { isPathOutsideWorkingDirectory } from "./path/path-containment";
+import { isPiInfrastructureRead } from "./path/pi-infrastructure-read";
 
 /**
  * The interpreted effect of a literal `cd` target on the effective base, under
@@ -31,28 +27,27 @@ export type BashCdTarget =
 
 /**
  * Path-interpretation collaborator, constructed once at the session edge with
- * the two ambient inputs — the host `platform` and the session `cwd` — baked
- * in, and handed raw path tokens thereafter.
+ * the two ambient inputs — the resolved {@link PathFlavor} and the session
+ * `cwd` — baked in, and handed raw path tokens thereafter.
  *
  * The bash path pipeline and the per-tool/external-directory gates ask this
  * object the platform-dependent questions ("is this path absolute *under our
- * platform*?", "resolve this `cd` offset *against our cwd*") and receive
- * prepared {@link AccessPath} values, instead of reading `process.platform`
- * ambiently or threading `cwd` through every call. Internally it selects the
- * `win32`/`posix` path flavor once and delegates to the platform-parameterized
+ * flavor*?", "resolve this `cd` offset *against our cwd*") and receive prepared
+ * {@link AccessPath} values, instead of reading `process.platform` ambiently or
+ * threading `cwd` through every call. All platform semantics live on the
+ * injected `flavor`; this class holds no platform discriminator and no
+ * `win32`/`posix` branch — it delegates to `flavor` and the flavor-parameterized
  * `path-containment` / `path-normalization` / `AccessPath` primitives.
  */
 export class PathNormalizer {
-  private readonly impl: typeof posixPath;
   /** Canonical form of the baked cwd, resolved once (the symlink target is stable per session). */
   private readonly canonicalCwd: string;
 
   constructor(
-    private readonly platform: NodeJS.Platform,
+    readonly flavor: PathFlavor,
     private readonly cwd: string,
   ) {
-    this.impl = platform === "win32" ? winPath : posixPath;
-    this.canonicalCwd = canonicalNormalizePathForComparison(cwd, cwd, platform);
+    this.canonicalCwd = canonicalNormalizePathForComparison(cwd, cwd, flavor);
   }
 
   /** Build an AccessPath for a token, resolved against `resolveBase` (default cwd). */
@@ -60,7 +55,7 @@ export class PathNormalizer {
     return AccessPath.forPath(pathValue, {
       cwd: this.cwd,
       resolveBase: options?.resolveBase,
-      platform: this.platform,
+      flavor: this.flavor,
     });
   }
 
@@ -74,18 +69,16 @@ export class PathNormalizer {
    * semantics on a win32 host.
    *
    * Pi core always executes bash through Git Bash on Windows, so a POSIX-shaped
-   * absolute token carries MSYS semantics, not `node:path.win32` semantics. On
-   * win32 the recognized safe device paths (`/dev/null`, `/dev/std{in,out,err}`)
-   * are preserved verbatim as devices instead of being resolved into
-   * `c:\dev\null`, and MSYS drive mounts (`/c/…`) are translated to their
-   * Windows equivalent (`C:\…`) before resolution; every other token delegates
-   * to {@link forPath}. On POSIX this is a straight delegation to
-   * {@link forPath}.
+   * absolute token carries MSYS semantics, not `node:path.win32` semantics. The
+   * flavor classifies the token's shape: on win32 the recognized safe device
+   * paths (`/dev/null`, `/dev/std{in,out,err}`) are preserved verbatim as
+   * devices instead of being resolved into `c:\dev\null`, and MSYS drive mounts
+   * (`/c/…`) are translated to their Windows equivalent (`C:\…`) before
+   * resolution; every other token delegates to {@link forPath}. On POSIX every
+   * token is `plain`, so this is a straight delegation to {@link forPath}.
    */
   forBashToken(token: string, options?: { resolveBase?: string }): AccessPath {
-    if (this.platform !== "win32") return this.forPath(token, options);
-
-    const shape = classifyWin32BashToken(token);
+    const shape = this.flavor.bashTokenShape(token);
     switch (shape.kind) {
       case "device":
         return AccessPath.forDevice(token);
@@ -109,19 +102,7 @@ export class PathNormalizer {
 
   /** Platform-aware absoluteness (`win32` vs `posix` rules). */
   isAbsolute(pathValue: string): boolean {
-    return this.impl.isAbsolute(pathValue);
-  }
-
-  /**
-   * True when the host platform treats a backslash as a path separator (win32).
-   *
-   * The bash rule-candidate classifier reads this to decide whether a
-   * backslash-relative token (`dir\file`) is path-shaped: on win32 `\` is a
-   * separator, but on POSIX it is a legal filename character (#520). Keeping the
-   * decision here means no bash-layer module re-reads `process.platform`.
-   */
-  usesWindowsSeparators(): boolean {
-    return this.platform === "win32";
+    return this.flavor.impl.isAbsolute(pathValue);
   }
 
   /**
@@ -131,16 +112,11 @@ export class PathNormalizer {
    * (`cd /c/x`) resolves to a translated Windows base (`C:\x`), a non-mount
    * POSIX absolute (`cd /tmp`) is not deterministically resolvable and yields an
    * `unknown` base, and a native/relative target is handled as usual. On POSIX
-   * an absolute target is absolute and everything else is relative.
+   * every token is `plain`, so an absolute target is absolute and everything
+   * else is relative.
    */
   interpretBashCdTarget(target: string): BashCdTarget {
-    if (this.platform !== "win32") {
-      return this.impl.isAbsolute(target)
-        ? { kind: "absolute", value: target }
-        : { kind: "relative" };
-    }
-
-    const shape = classifyWin32BashToken(target);
+    const shape = this.flavor.bashTokenShape(target);
     switch (shape.kind) {
       case "drive-mount":
         return { kind: "absolute", value: shape.windowsPath };
@@ -148,7 +124,7 @@ export class PathNormalizer {
       case "posix-absolute":
         return { kind: "unknown" };
       case "plain":
-        return this.impl.isAbsolute(target)
+        return this.flavor.impl.isAbsolute(target)
           ? { kind: "absolute", value: target }
           : { kind: "relative" };
     }
@@ -156,17 +132,17 @@ export class PathNormalizer {
 
   /** Resolve a `cd`-folded offset against the baked cwd (platform-aware). */
   resolveBase(offset: string): string {
-    return this.impl.resolve(this.cwd, offset);
+    return this.flavor.impl.resolve(this.cwd, offset);
   }
 
   /** Join a `cd` offset with a relative target (platform-aware), for cd-folding. */
   joinBase(offset: string, target: string): string {
-    return this.impl.join(offset, target);
+    return this.flavor.impl.join(offset, target);
   }
 
   /** Containment of `pathValue` within `directory` (platform-aware). */
   isWithinDirectory(pathValue: string, directory: string): boolean {
-    return isPathWithinDirectory(pathValue, directory, this.platform);
+    return this.flavor.isWithin(pathValue, directory);
   }
 
   /** Canonical (symlink-resolved) outside-cwd test against the baked cwd. */
@@ -174,12 +150,12 @@ export class PathNormalizer {
     const canonicalPath = canonicalNormalizePathForComparison(
       pathValue,
       this.cwd,
-      this.platform,
+      this.flavor,
     );
     return isPathOutsideWorkingDirectory(
       canonicalPath,
       this.canonicalCwd,
-      this.platform,
+      this.flavor,
     );
   }
 
@@ -196,7 +172,7 @@ export class PathNormalizer {
     return isPathOutsideWorkingDirectory(
       canonicalPath,
       this.canonicalCwd,
-      this.platform,
+      this.flavor,
     );
   }
 
@@ -206,12 +182,12 @@ export class PathNormalizer {
    * touches no filesystem, unlike {@link forPath}'s canonical alias.
    */
   comparableValue(pathValue: string): string {
-    return normalizePathForComparison(pathValue, this.cwd, this.platform);
+    return normalizePathForComparison(pathValue, this.cwd, this.flavor);
   }
 
   /**
    * Pi infrastructure-read containment for a read-only tool, decided against
-   * the canonical (symlink-resolved) path and the baked cwd/platform. Takes the
+   * the canonical (symlink-resolved) path and the baked cwd/flavor. Takes the
    * already-built {@link AccessPath} so the caller does not re-resolve it.
    */
   isInfrastructureRead(
@@ -224,7 +200,7 @@ export class PathNormalizer {
       accessPath.boundaryValue(),
       infraDirs,
       this.cwd,
-      this.platform,
+      this.flavor,
     );
   }
 }