@gotgenes/pi-permission-system 23.0.0 → 23.0.2

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [23.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v23.0.1...pi-permission-system-v23.0.2) (2026-07-26)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** create forwarding request files owner-only ([8c77c72](https://github.com/gotgenes/pi-packages/commit/8c77c7228a52d3b57397c7d53d301d002087d92f)), closes [#647](https://github.com/gotgenes/pi-packages/issues/647)
+* **pi-permission-system:** create permission logs owner-only ([6043cf8](https://github.com/gotgenes/pi-packages/commit/6043cf81bbe6332290d2d6bc8882ba1eadf181cc)), closes [#647](https://github.com/gotgenes/pi-packages/issues/647)
+* **pi-permission-system:** mask sensitive-keyed values in permission logs ([05cb12a](https://github.com/gotgenes/pi-packages/commit/05cb12a1c85e3030f6de3a4ed20cf1cd150e2d56)), closes [#647](https://github.com/gotgenes/pi-packages/issues/647)
+* **pi-permission-system:** redact generic tool input in the review log ([2035fb2](https://github.com/gotgenes/pi-packages/commit/2035fb2276efd75daa8d1f4e6e2af8e67763a9f8)), closes [#647](https://github.com/gotgenes/pi-packages/issues/647)
+
+
+### Documentation
+
+* **pi-permission-system:** link ADR 0010 by absolute URL from shipped docs ([0384af6](https://github.com/gotgenes/pi-packages/commit/0384af6483bd1a2d7f00a5a91efbe241c6d6898f)), closes [#647](https://github.com/gotgenes/pi-packages/issues/647)
+* **pi-permission-system:** record ADR 0010 on permission-log secret exposure ([c13b48a](https://github.com/gotgenes/pi-packages/commit/c13b48a9a14635d25af18a2c0f70bf765141a623)), closes [#647](https://github.com/gotgenes/pi-packages/issues/647)
+
+## [23.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v23.0.0...pi-permission-system-v23.0.1) (2026-07-25)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** fold separators on both sides of a win32 path match ([50e2ac0](https://github.com/gotgenes/pi-packages/commit/50e2ac0dd66b4b308a676849a09e3fff59e754be)), closes [#653](https://github.com/gotgenes/pi-packages/issues/653)
+
+
+### Documentation
+
+* **pi-permission-system:** record the symmetric win32 separator fold ([e2eea21](https://github.com/gotgenes/pi-packages/commit/e2eea21e0aac1212f46be9680fb59146b90c68f7)), closes [#653](https://github.com/gotgenes/pi-packages/issues/653)
+
 ## [23.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v22.0.0...pi-permission-system-v23.0.0) (2026-07-24)
 
 

package/docs/configuration.md

@@ -98,16 +98,16 @@ This clamp is deny-preserving and, like `yoloMode`, applied at composition; when
 
 ## Runtime Knobs
 
-| Key                         | Default | Description                                                                                                                                                                |
-| --------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `debugLog`                  | `false` | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                                              |
-| `permissionReviewLog`       | `true`  | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`                                                                    |
-| `yoloMode`                  | `false` | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                                                 |
-| `doublePressToConfirm`      | `true`  | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.                          |
-| `toolInputPreviewMaxLength` | `200`   | Max characters of inline JSON shown in permission prompts for tool inputs. Omit to use the default. Set to a large value to disable truncation.                            |
-| `toolTextSummaryMaxLength`  | `80`    | Max characters of inline pattern/path summaries (grep patterns, find globs, ls paths) in permission prompts. Omit to use the default.                                      |
-| `piInfrastructureReadPaths` | `[]`    | Extra directories to auto-allow for reads, bypassing the `external_directory` gate. Supports `~`/`$HOME` expansion and wildcard patterns (`*`, `?`).                       |
-| `authorizerChain`           | `[]`    | Ordered names of registered live-authority chain links to consult before the terminal authorizer (see [Authorizer chain](#authorizer-chain--case-by-case-decision-links)). |
+| Key                         | Default | Description                                                                                                                                                                                        |
+| --------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `debugLog`                  | `false` | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                                                                      |
+| `permissionReviewLog`       | `true`  | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`. Records bash command strings verbatim — see [Log file sensitivity](#log-file-sensitivity) |
+| `yoloMode`                  | `false` | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                                                                         |
+| `doublePressToConfirm`      | `true`  | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.                                                  |
+| `toolInputPreviewMaxLength` | `200`   | Max characters of inline JSON shown in permission prompts for tool inputs. Omit to use the default. Set to a large value to disable truncation.                                                    |
+| `toolTextSummaryMaxLength`  | `80`    | Max characters of inline pattern/path summaries (grep patterns, find globs, ls paths) in permission prompts. Omit to use the default.                                                              |
+| `piInfrastructureReadPaths` | `[]`    | Extra directories to auto-allow for reads, bypassing the `external_directory` gate. Supports `~`/`$HOME` expansion and wildcard patterns (`*`, `?`).                                               |
+| `authorizerChain`           | `[]`    | Ordered names of registered live-authority chain links to consult before the terminal authorizer (see [Authorizer chain](#authorizer-chain--case-by-case-decision-links)).                         |
 
 Both logs write to `~/.pi/agent/extensions/pi-permission-system/logs/`.
 No debug output is printed to the terminal.
@@ -618,15 +618,18 @@ Infrastructure directories include:
 Write tools (`write`, `edit`) to infrastructure paths are **not** auto-allowed and still go through the gate.
 
 On Windows, path matching for `external_directory`, `path`, and the path-bearing tools is case-insensitive and tolerant of either separator (`\` or `/`), matching the case-insensitive filesystem.
-A mixed-case allow override such as `~/AppData/Roaming/npm/node_modules/@earendil-works/pi-coding-agent/*` therefore matches a lowercased, backslash-normalized path value.
-POSIX matching remains case-sensitive.
+The separator folding applies to the rule pattern **and** to the value it is matched against, so either side may be written with either separator.
+A mixed-case allow override such as `~/AppData/Roaming/npm/node_modules/@earendil-works/pi-coding-agent/*` therefore matches a lowercased, backslash-normalized path value, and a forward-slash rule such as `"/dev/null"` matches a value that is also spelled with forward slashes.
+POSIX matching remains case-sensitive and does not fold separators.
 
 #### Git Bash / MSYS paths on Windows
 
 On Windows, Pi executes bash commands through Git Bash, so a bash token that looks like a POSIX absolute path carries MSYS mount semantics rather than native `node:path.win32` semantics.
 The `external_directory` and `path` gates interpret bash tokens accordingly (tool-input paths for `read`/`write`/`edit` keep native Windows semantics, since those tools resolve them through Node's filesystem):
 
-- The safe device paths (`/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`) are recognized as MSYS devices and never trigger the gate — the same exclusion that holds on POSIX, so `echo hi > /dev/null` does not prompt.
+- The safe device paths (`/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`) are recognized as MSYS devices rather than filesystem paths, so they never trigger the `external_directory` gate — the same exclusion that holds on POSIX.
+  The cross-cutting `path` surface still governs them on both platforms: if a `path` rule matches the token, it decides.
+  A device is therefore allow-listed the way any other path is, written as typed — `path: { "/dev/null": "allow" }`.
 - MSYS drive mounts (`/c/…`, `/d/…`) are translated to their Windows equivalent (`C:\…`), so a project file referenced through a mount is matched against its real Windows path and an in-CWD mount is not flagged.
 - Every other POSIX-absolute token (`/tmp/foo`, `/usr/bin`) has an install-dependent target this extension cannot resolve deterministically (Git Bash mounts `/tmp` to `%TEMP%`, MSYS2 to its own root), so it is treated as an external path matched and displayed exactly as typed, never rewritten to `C:\tmp\foo`.
 
@@ -900,7 +903,38 @@ Additional behaviors:
 - The narrowed prompt is recomputed and returned on every turn but is byte-stable for a stable policy/agent, so the provider's prompt cache (tools + system prefix) is preserved rather than rewritten each turn
 - Extension-provided tools like `task`, `mcp`, and third-party tools are handled by exact registered name
 - Generic extension-tool approval prompts include a bounded input preview; built-in file tools use concise human-readable summaries
-- Permission review logs include bounded `toolInputPreview` values for non-bash/non-MCP tool calls
+- Permission review logs include bounded `toolInputPreview` values for non-bash/non-MCP tool calls, with sensitive-keyed values masked (see [Log file sensitivity](#log-file-sensitivity))
+
+---
+
+## Log file sensitivity
+
+The review log is enabled by default and records what the agent actually did, which means it records payload as well as decisions: the complete bash command string for every bash decision, and a bounded JSON preview of the tool input for other tools.
+The debug log carries the same payload when `debugLog` is on.
+
+Two protections apply.
+
+Both logs are created **owner-only** (`0600`, in a `0700` directory), and a log created by an earlier version is tightened on the next write.
+The permission-forwarding request and response files are written the same way.
+This closes the shared-host case: another user on the same machine cannot read them.
+
+Values bound to a **sensitive key name** — `authorization`, `token`, `secret`, `password`, `credential`, `cookie`, `api_key`, `private_key`, matched case-insensitively — are masked as `[redacted]` before anything is written.
+So a tool called with `{"authorization": "Bearer …"}` records `{"authorization": "[redacted]"}`.
+
+The boundary is worth stating exactly, because it is easy to over-read:
+
+> A value bound to a sensitive key name is masked; a secret embedded in a bash command string is not.
+
+A command string has no keys, so `deploy --token abc123` is logged verbatim.
+The extension deliberately does not try to guess which parts of a command look secret-shaped — see [ADR 0010] for the measured reasoning.
+
+Practical guidance:
+
+- Treat both log files as sensitive when sharing them: scrub before pasting into an issue or a chat.
+- Set `"permissionReviewLog": false` (and leave `debugLog` off) for a session that will handle credentials on the command line.
+- Owner-only modes do not protect against anything running as you, including a backup or cloud-sync agent that copies your home directory.
+
+[ADR 0010]: https://github.com/gotgenes/pi-packages/blob/main/packages/pi-permission-system/docs/decisions/0010-permission-log-secret-exposure.md
 
 ---
 

package/docs/troubleshooting.md

@@ -51,3 +51,8 @@ This makes it easy to verify which files the extension actually loaded:
 
 - If a dangerous action is possible via an allowed tool, policy must explicitly restrict it
 - This is a permission decision layer, not a sandbox — for true isolation see [Agent Sandboxes](https://engine.build/lab/agent-sandboxes)
+- The review log records bash command strings verbatim.
+  Log files are created owner-only (`0600`), and values bound to a sensitive key name (`authorization`, `token`, `password`, …) are masked — but a secret embedded in a command string is not.
+  See [Log file sensitivity](configuration.md#log-file-sensitivity) and [ADR 0010].
+
+[ADR 0010]: https://github.com/gotgenes/pi-packages/blob/main/packages/pi-permission-system/docs/decisions/0010-permission-log-secret-exposure.md

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "23.0.0",
+  "version": "23.0.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/access-path.ts

@@ -120,20 +120,12 @@ export class AccessPath {
    * unknown (a relative bash token after a non-literal `cd`).
    *
    * Carries no canonical alias and no absolute resolution — `matchValues()` is
-   * `[literal, ...matchAliases]` (or `[]` when empty) and `boundaryValue()` is
-   * `""` — so no spurious absolute or symlink-resolved rule can match (#393).
-   *
-   * `matchAliases` supplies extra match-only forms that do not change the
-   * display value: a win32 Git Bash POSIX absolute carries a backslash-separated
-   * alias so the separator-folding path matcher can match a `/tmp/*` rule (#533).
+   * `[literal]` (or `[]` when empty) and `boundaryValue()` is `""` — so no
+   * spurious absolute or symlink-resolved rule can match (#393).
    */
-  static forLiteral(
-    literal: string,
-    matchAliases: readonly string[] = [],
-  ): AccessPath {
+  static forLiteral(literal: string): AccessPath {
     if (!literal) return new AccessPath("", [], "");
-    const aliases = [...new Set([literal, ...matchAliases.filter(Boolean)])];
-    return new AccessPath(literal, aliases, "");
+    return new AccessPath(literal, [literal], "");
   }
 
   /**

package/src/authority/forwarding-io.ts

@@ -18,6 +18,10 @@ import {
   type ForwardedSessionApproval,
   type PermissionForwardingLocation,
 } from "#src/authority/permission-forwarding";
+import {
+  OWNER_ONLY_DIRECTORY_MODE,
+  OWNER_ONLY_FILE_MODE,
+} from "#src/log-file-permissions";
 import type { PermissionUiPromptSource } from "#src/permission-events";
 import type { DebugReviewLogger } from "#src/session-logger";
 
@@ -185,7 +189,7 @@ export function ensureDirectoryExists(
   description: string,
 ): boolean {
   try {
-    mkdirSync(path, { recursive: true });
+    mkdirSync(path, { recursive: true, mode: OWNER_ONLY_DIRECTORY_MODE });
     return true;
   } catch (error) {
     logPermissionForwardingError(
@@ -365,7 +369,12 @@ export function writeJsonFileAtomic(
   const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
 
   try {
-    writeFileSync(tempPath, JSON.stringify(value), "utf-8");
+    // `rename` preserves the temp file's mode, so setting it here is enough —
+    // a response overwriting an existing file also comes through a fresh temp.
+    writeFileSync(tempPath, JSON.stringify(value), {
+      encoding: "utf-8",
+      mode: OWNER_ONLY_FILE_MODE,
+    });
     renameSync(tempPath, filePath);
   } catch (error) {
     safeDeleteFile(logger, tempPath, "temporary permission-forwarding");

package/src/extension-config.ts

@@ -1,11 +1,14 @@
 import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-
 import type {
   ShellToolsConfig,
   UnifiedPermissionConfig,
 } from "./config-loader";
+import {
+  OWNER_ONLY_DIRECTORY_MODE,
+  restrictExistingPathToOwner,
+} from "./log-file-permissions";
 
 export const EXTENSION_ID = "pi-permission-system";
 
@@ -94,7 +97,11 @@ export function ensurePermissionSystemLogsDirectory(
   logsDir: string,
 ): string | undefined {
   try {
-    mkdirSync(logsDir, { recursive: true });
+    // `recursive` applies the mode to every directory this creates, so a fresh
+    // install also gets an owner-only extension config dir. Directories that
+    // already exist are untouched by `mkdirSync`, hence the explicit tighten.
+    mkdirSync(logsDir, { recursive: true, mode: OWNER_ONLY_DIRECTORY_MODE });
+    restrictExistingPathToOwner(logsDir, OWNER_ONLY_DIRECTORY_MODE);
     return undefined;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);

package/src/json-safe-stringify.ts

@@ -0,0 +1,54 @@
+/**
+ * JSON serialization that survives the values a permission log actually
+ * carries: `Error` instances, `bigint`s, and object graphs with cycles.
+ *
+ * Lives apart from the JSONL writer because both the log path and the
+ * permission-prompt path serialize tool input, and only one of them redacts.
+ */
+
+/**
+ * Rewrites a value before the standard JSON-safe handling runs.
+ * Returning a replacement short-circuits nothing — the replacement itself
+ * flows through the `Error` / `bigint` / cycle handling below.
+ */
+export type JsonValueTransform = (key: string, value: unknown) => unknown;
+
+/**
+ * Build a `JSON.stringify` replacer. Each call owns a fresh `seen` set, so a
+ * replacer must not be reused across `stringify` calls.
+ */
+export function createJsonSafeReplacer(
+  transform?: JsonValueTransform,
+): (key: string, value: unknown) => unknown {
+  const seen = new WeakSet<object>();
+
+  return (key: string, rawValue: unknown): unknown => {
+    const value = transform ? transform(key, rawValue) : rawValue;
+
+    if (value instanceof Error) {
+      return {
+        name: value.name,
+        message: value.message,
+        stack: value.stack,
+      };
+    }
+
+    if (typeof value === "bigint") {
+      return value.toString();
+    }
+
+    if (typeof value === "object" && value !== null) {
+      if (seen.has(value)) {
+        return "[Circular]";
+      }
+      seen.add(value);
+    }
+
+    return value;
+  };
+}
+
+/** Serialize `value` to JSON, tolerating errors, bigints, and cycles. */
+export function safeJsonStringify(value: unknown): string | undefined {
+  return JSON.stringify(value, createJsonSafeReplacer());
+}

package/src/log-file-permissions.ts

@@ -0,0 +1,34 @@
+import { chmodSync } from "node:fs";
+
+/**
+ * Owner-only POSIX modes for the extension's on-disk artifacts.
+ *
+ * The permission logs record bash command strings and tool-input previews, and
+ * the forwarding files carry the same text between sessions. Left to the
+ * process umask they are created world-readable (0644 / 0755 under the common
+ * default), which is only acceptable on a single-user host.
+ */
+
+export const OWNER_ONLY_FILE_MODE = 0o600;
+export const OWNER_ONLY_DIRECTORY_MODE = 0o700;
+
+/**
+ * Best-effort tightening of an existing path's mode.
+ *
+ * Creation-time modes cover new files, but an installation that predates this
+ * hardening already has a world-readable log that no `mode` option will fix —
+ * hence the explicit `chmod`.
+ *
+ * Never throws, and never reports. On Windows `chmod` only toggles the
+ * read-only bit and can reject a directory outright; warning about that every
+ * session would be noise, since the file there is governed by NTFS ACL
+ * inheritance rather than POSIX modes. A hardening failure must also never
+ * break the gate, which is the caller's real work.
+ */
+export function restrictExistingPathToOwner(path: string, mode: number): void {
+  try {
+    chmodSync(path, mode);
+  } catch {
+    // Intentionally ignored — see above.
+  }
+}

package/src/log-redaction.ts

@@ -0,0 +1,44 @@
+import { createJsonSafeReplacer } from "./json-safe-stringify";
+
+/**
+ * Key-name redaction for the permission logs.
+ *
+ * The technique is deliberately structural rather than predictive: a value is
+ * masked because of the *name* it is bound to, never because of what it looks
+ * like. Value-shape secret detection (provider prefixes, entropy heuristics)
+ * was measured against a real 6.7 MB review log and declined — see
+ * `docs/decisions/0010-permission-log-secret-exposure.md`.
+ *
+ * The boundary that follows from this, stated once: a value bound to a
+ * sensitive key name is masked; a secret embedded in a bash command string is
+ * not, because a command string has no keys.
+ */
+
+export const REDACTED_PLACEHOLDER = "[redacted]";
+
+const SENSITIVE_KEY_PATTERN =
+  /authorization|api[-_]?key|secret|token|password|passwd|credential|cookie|private[-_]?key/i;
+
+/** True when a log key names a credential-bearing value. */
+export function isSensitiveLogKey(key: string): boolean {
+  return SENSITIVE_KEY_PATTERN.test(key);
+}
+
+/**
+ * `safeJsonStringify` with sensitive-keyed values masked.
+ *
+ * Masking runs inside the replacer, so the structure beneath a sensitive key
+ * is never visited and the traversal's existing cycle guard is reused — one
+ * walk, not two. A `null` or `undefined` value is left alone so an absent
+ * field does not read as a suppressed one.
+ */
+export function redactedJsonStringify(value: unknown): string | undefined {
+  return JSON.stringify(
+    value,
+    createJsonSafeReplacer((key, currentValue) =>
+      currentValue != null && isSensitiveLogKey(key)
+        ? REDACTED_PLACEHOLDER
+        : currentValue,
+    ),
+  );
+}

package/src/logging.ts

@@ -4,35 +4,11 @@ import {
   EXTENSION_ID,
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
-
-export function safeJsonStringify(value: unknown): string | undefined {
-  const seen = new WeakSet<object>();
-  return JSON.stringify(value, (_key, currentValue) => {
-    if (currentValue instanceof Error) {
-      return {
-        name: currentValue.name,
-        message: currentValue.message,
-        stack: currentValue.stack,
-      };
-    }
-
-    if (typeof currentValue === "bigint") {
-      return currentValue.toString();
-    }
-
-    if (typeof currentValue === "object" && currentValue !== null) {
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- JSON.stringify replacer receives any; currentValue is narrowed to object here
-      if (seen.has(currentValue)) {
-        return "[Circular]";
-      }
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- same as above
-      seen.add(currentValue);
-    }
-
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-return -- JSON.stringify replacer must return any
-    return currentValue;
-  });
-}
+import {
+  OWNER_ONLY_FILE_MODE,
+  restrictExistingPathToOwner,
+} from "./log-file-permissions";
+import { redactedJsonStringify } from "./log-redaction";
 
 export interface PermissionSystemLogger {
   debug: (
@@ -56,6 +32,10 @@ export function createPermissionSystemLogger(
   options: PermissionSystemLoggerOptions,
 ): PermissionSystemLogger {
   const { debugLogPath, reviewLogPath, ensureLogsDirectory } = options;
+  // Per-session, so a log inherited from an earlier version is tightened once
+  // rather than on every line. Lives in the closure because the factory is
+  // re-invoked per session, unlike module scope, which now outlives one.
+  const hardened = new Set<string>();
 
   const writeLine = (
     stream: "debug" | "review",
@@ -69,7 +49,7 @@ export function createPermissionSystemLogger(
     }
 
     try {
-      const line = safeJsonStringify({
+      const line = redactedJsonStringify({
         timestamp: new Date().toISOString(),
         extension: EXTENSION_ID,
         stream,
@@ -79,7 +59,14 @@ export function createPermissionSystemLogger(
       if (!line) {
         return `Failed to write permission-system ${stream} log '${path}': event could not be serialized.`;
       }
-      appendFileSync(path, `${line}\n`, "utf-8");
+      appendFileSync(path, `${line}\n`, {
+        encoding: "utf-8",
+        mode: OWNER_ONLY_FILE_MODE,
+      });
+      if (!hardened.has(path)) {
+        hardened.add(path);
+        restrictExistingPathToOwner(path, OWNER_ONLY_FILE_MODE);
+      }
       return undefined;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);

package/src/path-normalizer.ts

@@ -62,8 +62,8 @@ export class PathNormalizer {
   }
 
   /** Build a literal-only AccessPath (unknown base after a non-literal `cd`). */
-  forLiteral(literal: string, matchAliases?: readonly string[]): AccessPath {
-    return AccessPath.forLiteral(literal, matchAliases);
+  forLiteral(literal: string): AccessPath {
+    return AccessPath.forLiteral(literal);
   }
 
   /**
@@ -86,17 +86,14 @@ export class PathNormalizer {
         return AccessPath.forDevice(token);
       case "drive-mount":
         return this.forPath(shape.windowsPath, options);
-      case "posix-absolute": {
+      case "posix-absolute":
         // A non-mount POSIX absolute (`/tmp`, `/usr`) has an install-dependent
         // Windows target this package cannot know, so it is kept literal: always
         // external, matched and displayed as typed, never fabricated into
-        // `c:\tmp` (#533). The win32 path matcher folds a rule's separators
-        // (`/` -> `\`), so a forward-slash value is unmatchable; carry a
-        // backslash match alias so a natural `/tmp/*` external_directory rule
-        // still resolves, while `value()` stays as typed for display.
-        const literal = normalizePathPolicyLiteral(token);
-        return this.forLiteral(literal, [literal.replaceAll("/", "\\")]);
-      }
+        // `c:\tmp` (#533). The win32 path matcher folds separators on both the
+        // rule and the value (#653), so a natural `/tmp/*` rule matches the
+        // as-typed literal directly.
+        return this.forLiteral(normalizePathPolicyLiteral(token));
       case "plain":
         return this.forPath(token, options);
     }

package/src/tool-input-preview.ts

@@ -1,4 +1,5 @@
-import { safeJsonStringify } from "./logging";
+import { safeJsonStringify } from "./json-safe-stringify";
+import { redactedJsonStringify } from "./log-redaction";
 
 export const TOOL_INPUT_PREVIEW_MAX_LENGTH = 200;
 export const TOOL_INPUT_LOG_PREVIEW_MAX_LENGTH = 1000;
@@ -24,8 +25,23 @@ export function formatCount(
   return `${value} ${value === 1 ? singular : plural}`;
 }
 
+/** Serialize tool input for display in a permission prompt, unredacted. */
 export function serializeToolInputPreview(input: unknown): string {
-  const serialized = safeJsonStringify(input);
+  return normalizeSerializedPreview(safeJsonStringify(input));
+}
+
+/**
+ * Serialize tool input for the review log, masking sensitive-keyed values.
+ *
+ * The log path needs its own entry point because the input is flattened to a
+ * string here — by the time it reaches the JSONL writer its keys are gone, so
+ * that boundary's redaction pass can no longer see them.
+ */
+export function serializeRedactedToolInputPreview(input: unknown): string {
+  return normalizeSerializedPreview(redactedJsonStringify(input));
+}
+
+function normalizeSerializedPreview(serialized: string | undefined): string {
   if (!serialized || serialized === "{}" || serialized === "null") {
     return "";
   }

package/src/tool-preview-formatter.ts

@@ -2,6 +2,7 @@ import { classifyToolKind, isMcpCheck } from "./access-intent/tool-kind";
 import type { PermissionSystemExtensionConfig } from "./extension-config";
 import type { ToolInputFormatterLookup } from "./tool-input-formatter-registry";
 import {
+  serializeRedactedToolInputPreview,
   serializeToolInputPreview,
   TOOL_INPUT_LOG_PREVIEW_MAX_LENGTH,
   TOOL_INPUT_PREVIEW_MAX_LENGTH,
@@ -145,9 +146,12 @@ export class ToolPreviewFormatter {
 
   // ── Log formatting ──────────────────────────────────────────────────────
 
-  /** Serialize `input` to inline JSON and truncate at `toolInputLogPreviewMaxLength`. */
+  /**
+   * Serialize `input` to inline JSON and truncate at
+   * `toolInputLogPreviewMaxLength`, masking sensitive-keyed values.
+   */
   formatGenericToolInputForLog(input: unknown): string | undefined {
-    const inline = serializeToolInputPreview(input);
+    const inline = serializeRedactedToolInputPreview(input);
     return inline
       ? `input ${truncateInlineText(inline, this.options.toolInputLogPreviewMaxLength)}`
       : undefined;

package/src/wildcard-matcher.ts

@@ -1,10 +1,20 @@
 import { expandHomePath } from "./expand-home";
 
-export type CompiledWildcardPattern<TState> = {
-  pattern: string;
-  state: TState;
-  regex: RegExp;
-};
+/**
+ * A pattern compiled once for repeated matching.
+ *
+ * Matching is a method rather than an exposed `RegExp` so that both halves of
+ * the {@link WildcardMatchOptions} fold stay together: the compiled regex
+ * carries the pattern-side folding, and {@link matches} applies the same
+ * folding to the value. A caller holding the raw regex could apply one without
+ * the other, which is exactly the asymmetry that made forward-slash path rules
+ * inert on Windows (#653).
+ */
+export interface CompiledWildcardPattern<TState> {
+  readonly pattern: string;
+  readonly state: TState;
+  matches(value: string): boolean;
+}
 
 export type WildcardPatternMatch<TState> = {
   state: TState;
@@ -17,8 +27,11 @@ export type WildcardPatternMatch<TState> = {
  *
  * - `caseInsensitive` compiles the pattern with the `i` flag so a mixed-case
  *   pattern matches a lowercased (canonicalized) path value.
- * - `windowsSeparators` rewrites `/` to `\` in the expanded pattern so a
- *   forward-slash pattern matches a backslash-separated path value.
+ * - `windowsSeparators` rewrites `/` to `\` in both the expanded pattern and
+ *   the matched value, so two spellings of the same path match regardless of
+ *   which separator either side was written with. Folding only the pattern
+ *   leaves every forward-slash value (a Git Bash device, an as-typed literal)
+ *   unmatchable (#653).
  */
 export interface WildcardMatchOptions {
   caseInsensitive?: boolean;
@@ -34,10 +47,7 @@ export function compileWildcardPattern<TState>(
   state: TState,
   options?: WildcardMatchOptions,
 ): CompiledWildcardPattern<TState> {
-  let expanded = expandHomePath(pattern);
-  if (options?.windowsSeparators) {
-    expanded = expanded.replaceAll("/", "\\");
-  }
+  const expanded = foldSeparators(expandHomePath(pattern), options);
   let escaped = expanded
     .split("*")
     .map((part) => escapeRegExp(part).replaceAll("\\?", "."))
@@ -50,10 +60,15 @@ export function compileWildcardPattern<TState>(
     escaped = `${escaped.slice(0, -3)}( .*)?`;
   }
 
+  const regex = new RegExp(
+    `^${escaped}$`,
+    options?.caseInsensitive ? "si" : "s",
+  );
+
   return {
     pattern,
     state,
-    regex: new RegExp(`^${escaped}$`, options?.caseInsensitive ? "si" : "s"),
+    matches: (value) => regex.test(foldSeparators(value, options)),
   };
 }
 
@@ -75,7 +90,7 @@ export function findCompiledWildcardMatch<TState>(
   patterns: readonly CompiledWildcardPattern<TState>[],
   name: string,
 ): WildcardPatternMatch<TState> | null {
-  const match = patterns.findLast((p) => p.regex.test(name));
+  const match = patterns.findLast((p) => p.matches(name));
   if (match === undefined) return null;
   return {
     state: match.state,
@@ -95,7 +110,17 @@ export function wildcardMatch(
   value: string,
   options?: WildcardMatchOptions,
 ): boolean {
-  return compileWildcardPattern(pattern, null, options).regex.test(value);
+  return compileWildcardPattern(pattern, null, options).matches(value);
+}
+
+/**
+ * Apply the `windowsSeparators` half of the fold to one operand.
+ *
+ * Called for the pattern at compile time and for the value at match time —
+ * the fold is an equivalence relation, so both sides must pass through it.
+ */
+function foldSeparators(value: string, options?: WildcardMatchOptions): string {
+  return options?.windowsSeparators ? value.replaceAll("/", "\\") : value;
 }
 
 export function findCompiledWildcardMatchForNames<TState>(