@gotgenes/pi-permission-system 23.0.0 → 23.0.1

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [23.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v23.0.0...pi-permission-system-v23.0.1) (2026-07-25)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** fold separators on both sides of a win32 path match ([50e2ac0](https://github.com/gotgenes/pi-packages/commit/50e2ac0dd66b4b308a676849a09e3fff59e754be)), closes [#653](https://github.com/gotgenes/pi-packages/issues/653)
+
+
+### Documentation
+
+* **pi-permission-system:** record the symmetric win32 separator fold ([e2eea21](https://github.com/gotgenes/pi-packages/commit/e2eea21e0aac1212f46be9680fb59146b90c68f7)), closes [#653](https://github.com/gotgenes/pi-packages/issues/653)
+
 ## [23.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v22.0.0...pi-permission-system-v23.0.0) (2026-07-24)
 
 

package/docs/configuration.md

@@ -618,15 +618,18 @@ Infrastructure directories include:
 Write tools (`write`, `edit`) to infrastructure paths are **not** auto-allowed and still go through the gate.
 
 On Windows, path matching for `external_directory`, `path`, and the path-bearing tools is case-insensitive and tolerant of either separator (`\` or `/`), matching the case-insensitive filesystem.
-A mixed-case allow override such as `~/AppData/Roaming/npm/node_modules/@earendil-works/pi-coding-agent/*` therefore matches a lowercased, backslash-normalized path value.
-POSIX matching remains case-sensitive.
+The separator folding applies to the rule pattern **and** to the value it is matched against, so either side may be written with either separator.
+A mixed-case allow override such as `~/AppData/Roaming/npm/node_modules/@earendil-works/pi-coding-agent/*` therefore matches a lowercased, backslash-normalized path value, and a forward-slash rule such as `"/dev/null"` matches a value that is also spelled with forward slashes.
+POSIX matching remains case-sensitive and does not fold separators.
 
 #### Git Bash / MSYS paths on Windows
 
 On Windows, Pi executes bash commands through Git Bash, so a bash token that looks like a POSIX absolute path carries MSYS mount semantics rather than native `node:path.win32` semantics.
 The `external_directory` and `path` gates interpret bash tokens accordingly (tool-input paths for `read`/`write`/`edit` keep native Windows semantics, since those tools resolve them through Node's filesystem):
 
-- The safe device paths (`/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`) are recognized as MSYS devices and never trigger the gate — the same exclusion that holds on POSIX, so `echo hi > /dev/null` does not prompt.
+- The safe device paths (`/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`) are recognized as MSYS devices rather than filesystem paths, so they never trigger the `external_directory` gate — the same exclusion that holds on POSIX.
+  The cross-cutting `path` surface still governs them on both platforms: if a `path` rule matches the token, it decides.
+  A device is therefore allow-listed the way any other path is, written as typed — `path: { "/dev/null": "allow" }`.
 - MSYS drive mounts (`/c/…`, `/d/…`) are translated to their Windows equivalent (`C:\…`), so a project file referenced through a mount is matched against its real Windows path and an in-CWD mount is not flagged.
 - Every other POSIX-absolute token (`/tmp/foo`, `/usr/bin`) has an install-dependent target this extension cannot resolve deterministically (Git Bash mounts `/tmp` to `%TEMP%`, MSYS2 to its own root), so it is treated as an external path matched and displayed exactly as typed, never rewritten to `C:\tmp\foo`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "23.0.0",
+  "version": "23.0.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/access-path.ts

@@ -120,20 +120,12 @@ export class AccessPath {
    * unknown (a relative bash token after a non-literal `cd`).
    *
    * Carries no canonical alias and no absolute resolution — `matchValues()` is
-   * `[literal, ...matchAliases]` (or `[]` when empty) and `boundaryValue()` is
-   * `""` — so no spurious absolute or symlink-resolved rule can match (#393).
-   *
-   * `matchAliases` supplies extra match-only forms that do not change the
-   * display value: a win32 Git Bash POSIX absolute carries a backslash-separated
-   * alias so the separator-folding path matcher can match a `/tmp/*` rule (#533).
+   * `[literal]` (or `[]` when empty) and `boundaryValue()` is `""` — so no
+   * spurious absolute or symlink-resolved rule can match (#393).
    */
-  static forLiteral(
-    literal: string,
-    matchAliases: readonly string[] = [],
-  ): AccessPath {
+  static forLiteral(literal: string): AccessPath {
     if (!literal) return new AccessPath("", [], "");
-    const aliases = [...new Set([literal, ...matchAliases.filter(Boolean)])];
-    return new AccessPath(literal, aliases, "");
+    return new AccessPath(literal, [literal], "");
   }
 
   /**

package/src/path-normalizer.ts

@@ -62,8 +62,8 @@ export class PathNormalizer {
   }
 
   /** Build a literal-only AccessPath (unknown base after a non-literal `cd`). */
-  forLiteral(literal: string, matchAliases?: readonly string[]): AccessPath {
-    return AccessPath.forLiteral(literal, matchAliases);
+  forLiteral(literal: string): AccessPath {
+    return AccessPath.forLiteral(literal);
   }
 
   /**
@@ -86,17 +86,14 @@ export class PathNormalizer {
         return AccessPath.forDevice(token);
       case "drive-mount":
         return this.forPath(shape.windowsPath, options);
-      case "posix-absolute": {
+      case "posix-absolute":
         // A non-mount POSIX absolute (`/tmp`, `/usr`) has an install-dependent
         // Windows target this package cannot know, so it is kept literal: always
         // external, matched and displayed as typed, never fabricated into
-        // `c:\tmp` (#533). The win32 path matcher folds a rule's separators
-        // (`/` -> `\`), so a forward-slash value is unmatchable; carry a
-        // backslash match alias so a natural `/tmp/*` external_directory rule
-        // still resolves, while `value()` stays as typed for display.
-        const literal = normalizePathPolicyLiteral(token);
-        return this.forLiteral(literal, [literal.replaceAll("/", "\\")]);
-      }
+        // `c:\tmp` (#533). The win32 path matcher folds separators on both the
+        // rule and the value (#653), so a natural `/tmp/*` rule matches the
+        // as-typed literal directly.
+        return this.forLiteral(normalizePathPolicyLiteral(token));
       case "plain":
         return this.forPath(token, options);
     }

package/src/wildcard-matcher.ts

@@ -1,10 +1,20 @@
 import { expandHomePath } from "./expand-home";
 
-export type CompiledWildcardPattern<TState> = {
-  pattern: string;
-  state: TState;
-  regex: RegExp;
-};
+/**
+ * A pattern compiled once for repeated matching.
+ *
+ * Matching is a method rather than an exposed `RegExp` so that both halves of
+ * the {@link WildcardMatchOptions} fold stay together: the compiled regex
+ * carries the pattern-side folding, and {@link matches} applies the same
+ * folding to the value. A caller holding the raw regex could apply one without
+ * the other, which is exactly the asymmetry that made forward-slash path rules
+ * inert on Windows (#653).
+ */
+export interface CompiledWildcardPattern<TState> {
+  readonly pattern: string;
+  readonly state: TState;
+  matches(value: string): boolean;
+}
 
 export type WildcardPatternMatch<TState> = {
   state: TState;
@@ -17,8 +27,11 @@ export type WildcardPatternMatch<TState> = {
  *
  * - `caseInsensitive` compiles the pattern with the `i` flag so a mixed-case
  *   pattern matches a lowercased (canonicalized) path value.
- * - `windowsSeparators` rewrites `/` to `\` in the expanded pattern so a
- *   forward-slash pattern matches a backslash-separated path value.
+ * - `windowsSeparators` rewrites `/` to `\` in both the expanded pattern and
+ *   the matched value, so two spellings of the same path match regardless of
+ *   which separator either side was written with. Folding only the pattern
+ *   leaves every forward-slash value (a Git Bash device, an as-typed literal)
+ *   unmatchable (#653).
  */
 export interface WildcardMatchOptions {
   caseInsensitive?: boolean;
@@ -34,10 +47,7 @@ export function compileWildcardPattern<TState>(
   state: TState,
   options?: WildcardMatchOptions,
 ): CompiledWildcardPattern<TState> {
-  let expanded = expandHomePath(pattern);
-  if (options?.windowsSeparators) {
-    expanded = expanded.replaceAll("/", "\\");
-  }
+  const expanded = foldSeparators(expandHomePath(pattern), options);
   let escaped = expanded
     .split("*")
     .map((part) => escapeRegExp(part).replaceAll("\\?", "."))
@@ -50,10 +60,15 @@ export function compileWildcardPattern<TState>(
     escaped = `${escaped.slice(0, -3)}( .*)?`;
   }
 
+  const regex = new RegExp(
+    `^${escaped}$`,
+    options?.caseInsensitive ? "si" : "s",
+  );
+
   return {
     pattern,
     state,
-    regex: new RegExp(`^${escaped}$`, options?.caseInsensitive ? "si" : "s"),
+    matches: (value) => regex.test(foldSeparators(value, options)),
   };
 }
 
@@ -75,7 +90,7 @@ export function findCompiledWildcardMatch<TState>(
   patterns: readonly CompiledWildcardPattern<TState>[],
   name: string,
 ): WildcardPatternMatch<TState> | null {
-  const match = patterns.findLast((p) => p.regex.test(name));
+  const match = patterns.findLast((p) => p.matches(name));
   if (match === undefined) return null;
   return {
     state: match.state,
@@ -95,7 +110,17 @@ export function wildcardMatch(
   value: string,
   options?: WildcardMatchOptions,
 ): boolean {
-  return compileWildcardPattern(pattern, null, options).regex.test(value);
+  return compileWildcardPattern(pattern, null, options).matches(value);
+}
+
+/**
+ * Apply the `windowsSeparators` half of the fold to one operand.
+ *
+ * Called for the pattern at compile time and for the value at match time —
+ * the fold is an equivalence relation, so both sides must pass through it.
+ */
+function foldSeparators(value: string, options?: WildcardMatchOptions): string {
+  return options?.windowsSeparators ? value.replaceAll("/", "\\") : value;
 }
 
 export function findCompiledWildcardMatchForNames<TState>(