@gotgenes/pi-permission-system 26.2.0 → 26.2.2

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [26.2.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.2.1...pi-permission-system-v26.2.2) (2026-08-18)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** derive session-approval patterns through the injected PathFlavor ([cf561de](https://github.com/gotgenes/pi-packages/commit/cf561de4c19895ed9495d82f22280fe3ba215aa5)), closes [#655](https://github.com/gotgenes/pi-packages/issues/655)
+
+## [26.2.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.2.0...pi-permission-system-v26.2.1) (2026-08-17)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** accept pasted text in the denial-reason field ([8b33c38](https://github.com/gotgenes/pi-packages/commit/8b33c38084689dbb356fa0a0b7069bc610140736)), closes [#760](https://github.com/gotgenes/pi-packages/issues/760)
+
+
+### Documentation
+
+* **pi-permission-system:** document the delegated denial-reason editor ([e7329f5](https://github.com/gotgenes/pi-packages/commit/e7329f5e81fc66e5317e958c9928262aaf433173)), closes [#760](https://github.com/gotgenes/pi-packages/issues/760)
+
 ## [26.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.1.0...pi-permission-system-v26.2.0) (2026-08-17)
 
 

package/docs/configuration.md

@@ -135,6 +135,10 @@ It expands both the prompt itself — to the complete request, unbounded by `pro
 It only toggles the display — it never resolves, commits, or arms the pending decision.
 While you are typing a denial reason it is not intercepted, so a rebound printable key still reaches the reason editor.
 
+The reason editor is Pi's own line editor, so it behaves like the chat input: pasting works, as do cursor movement, word and line deletion, the kill ring, and undo.
+The reason is a single line — a pasted line break becomes a space, and a long reason scrolls sideways rather than growing the dialog.
+`enter` submits it, and `esc` (or `Ctrl+C`) returns to the decision list without denying.
+
 ### What a prompt shows
 
 The prompt renders one fact per line, with the requesting agent (and, for a forwarded subagent ask, its session), the tool, the gate surface, the matched rule, the decision-relevant value, and — for a wrapper such as `xargs` — the command that will actually run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "26.2.0",
+  "version": "26.2.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/bracketed-paste.ts

@@ -0,0 +1,35 @@
+/**
+ * Bracketed-paste normalization for the inline permission dialog's reason field.
+ *
+ * A terminal in bracketed-paste mode wraps pasted text in these markers, and
+ * the TUI hands the wrapped chunk to the focused component in a single call.
+ */
+
+const PASTE_START = "\u001b[200~";
+const PASTE_END = "\u001b[201~";
+const NEWLINE_RUN = /[\r\n]+/g;
+
+/**
+ * Collapse newline runs inside a bracketed-paste chunk to single spaces.
+ *
+ * The framework line editor deletes newlines outright, which joins the words
+ * on either side of a line break; a reason pasted from a multi-line source
+ * should stay readable in the single-line field. The markers are preserved so
+ * the editor still recognizes the chunk as a paste, and anything that is not
+ * a complete paste chunk is returned unchanged.
+ */
+export function collapsePastedNewlines(data: string): string {
+  const start = data.indexOf(PASTE_START);
+  if (start === -1) {
+    return data;
+  }
+  const contentStart = start + PASTE_START.length;
+  const contentEnd = data.indexOf(PASTE_END, contentStart);
+  if (contentEnd === -1) {
+    return data;
+  }
+  const content = data
+    .slice(contentStart, contentEnd)
+    .replace(NEWLINE_RUN, " ");
+  return data.slice(0, contentStart) + content + data.slice(contentEnd);
+}

package/src/authority/permission-prompt-component.ts

@@ -3,7 +3,8 @@ import type {
   ExtensionUIContext,
   KeybindingsManager,
 } from "@earendil-works/pi-coding-agent";
-import { type Component, matchesKey } from "@earendil-works/pi-tui";
+import { type Component, Input, matchesKey } from "@earendil-works/pi-tui";
+import { collapsePastedNewlines } from "#src/authority/bracketed-paste";
 import type {
   DecisionSource,
   UserDecisionSurface,
@@ -188,7 +189,8 @@ function handleToolsExpandAction(
 
 class PermissionPromptComponent implements Component {
   private state: PromptViewState;
-  private reasonBuffer = "";
+  /** The denial-reason line editor, rebuilt each time the step is entered. */
+  private reason: Input;
   /** Whether the operator asked to see the complete request (ADR 0011 §4). */
   private expanded = false;
 
@@ -203,6 +205,28 @@ class PermissionPromptComponent implements Component {
     private readonly done: (decision: UnattributedDecision) => void,
   ) {
     this.state = initialPromptState(config);
+    this.reason = this.createReasonEditor();
+  }
+
+  /**
+   * A fresh editor per visit to the reason step.
+   *
+   * The framework editor carries an undo stack and a kill ring, so reusing one
+   * instance would let a reason the operator backed out of be restored into a
+   * later ask.
+   */
+  private createReasonEditor(): Input {
+    const editor = new Input();
+    // Emits pi-tui's zero-width cursor marker, which positions the hardware
+    // cursor for IME composition.
+    editor.focused = true;
+    editor.onSubmit = (draft) => {
+      this.apply({ type: "submitReason", draft });
+    };
+    editor.onEscape = () => {
+      this.apply({ type: "cancel" });
+    };
+    return editor;
   }
 
   invalidate(): void {
@@ -278,25 +302,18 @@ class PermissionPromptComponent implements Component {
     }
   }
 
+  /**
+   * Hand the keystroke to the framework line editor.
+   *
+   * Delegating is what makes the field accept a paste: a paste arrives as one
+   * multi-character chunk wrapped in bracketed-paste markers, which the editor
+   * understands and a per-character reader cannot. Submit and cancel come back
+   * through the editor's callbacks, so the decision model still owns them.
+   */
   private handleReasonInput(data: string): void {
-    if (matchesKey(data, "enter")) {
-      this.apply({ type: "submitReason", draft: this.reasonBuffer });
-      return;
-    }
-    if (matchesKey(data, "escape")) {
-      this.reasonBuffer = "";
-      this.apply({ type: "cancel" });
-      return;
-    }
-    if (matchesKey(data, "backspace")) {
-      this.reasonBuffer = this.reasonBuffer.slice(0, -1);
-      this.requestRender();
-      return;
-    }
-    if (isPrintable(data)) {
-      this.reasonBuffer += data;
-      this.requestRender();
-    }
+    this.reason.handleInput(collapsePastedNewlines(data));
+    // The editor mutates its own buffer silently; only the dialog can repaint.
+    this.requestRender();
   }
 
   private toEvent(data: string): PromptEvent | undefined {
@@ -328,7 +345,7 @@ class PermissionPromptComponent implements Component {
       return;
     }
     if (outcome.state.step === "reason" && this.state.step !== "reason") {
-      this.reasonBuffer = "";
+      this.reason = this.createReasonEditor();
     }
     this.state = outcome.state;
     this.requestRender();
@@ -354,7 +371,9 @@ class PermissionPromptComponent implements Component {
       this.theme.fg("accent", this.title),
       ...this.renderAsk(width).lines,
       "",
-      `Reason (required): ${this.reasonBuffer}\u2588`,
+      "Reason (required):",
+      // Exactly one row, whatever its length: the editor scrolls horizontally.
+      ...this.reason.render(width),
     ];
     if (this.state.reasonError) {
       lines.push(this.theme.fg("error", this.state.reasonError));
@@ -388,11 +407,3 @@ class PermissionPromptComponent implements Component {
     return lines;
   }
 }
-
-function isPrintable(data: string): boolean {
-  if (data.length !== 1) {
-    return false;
-  }
-  const code = data.charCodeAt(0);
-  return code >= 0x20 && code !== 0x7f;
-}

package/src/authority/permission-prompt-decision.ts

@@ -52,7 +52,6 @@ export interface PromptViewState {
   armedKey?: PromptKey;
   /** "Press y again to approve." while armed; empty otherwise. */
   hint: string;
-  reasonDraft: string;
   /** Set when an empty reason submit is rejected. */
   reasonError?: string;
   /** Scope step: false = subagent-only (default), true = whole serving session. */
@@ -80,7 +79,6 @@ export function initialPromptState(
     highlightedKey: "y",
     armedKey: undefined,
     hint: "",
-    reasonDraft: "",
     reasonError: undefined,
     scopeServing: false,
   };
@@ -169,7 +167,6 @@ function commit(
         highlightedKey: "r",
         armedKey: undefined,
         hint: "",
-        reasonDraft: "",
         reasonError: undefined,
       });
     case "s":
@@ -200,7 +197,6 @@ function reduceReasonStep(
       step: "decision",
       armedKey: undefined,
       hint: "",
-      reasonDraft: "",
       reasonError: undefined,
     });
   }
@@ -209,7 +205,6 @@ function reduceReasonStep(
     if (reason === undefined) {
       return render({
         ...state,
-        reasonDraft: event.draft,
         reasonError: "A reason is required.",
       });
     }

package/src/handlers/gates/bash-external-directory.ts

@@ -1,8 +1,8 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
+import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { GateResult } from "./descriptor";
 import { selectUncoveredExternalPaths } from "./external-directory-policy";
 import { accessFactsFromPath } from "./helpers";
@@ -25,6 +25,7 @@ export function describeBashExternalDirectoryGate(
   tcc: ToolCallContext,
   bashProgram: BashProgram | null,
   resolver: ScopedPermissionResolver,
+  normalizer: PathNormalizer,
 ): GateResult {
   if (!bashProgram) return null;
   const command = bashProgram.commandText();
@@ -94,7 +95,9 @@ export function describeBashExternalDirectoryGate(
     matchedPattern: preCheck.matchedPattern,
   });
 
-  const patterns = uncoveredPaths.map((p) => deriveApprovalPattern(p));
+  const patterns = uncoveredEntries.map(({ path }) =>
+    normalizer.approvalPatternFor(path),
+  );
 
   return {
     surface: "external_directory",

package/src/handlers/gates/bash-path.ts

@@ -1,9 +1,9 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
+import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { PermissionCheckResult } from "#src/types";
 import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
@@ -33,6 +33,7 @@ export function describeBashPathGate(
   tcc: ToolCallContext,
   bashProgram: BashProgram | null,
   resolver: ScopedPermissionResolver,
+  normalizer: PathNormalizer,
 ): GateResult {
   if (!bashProgram) return null;
   const command = bashProgram.commandText();
@@ -120,7 +121,7 @@ export function describeBashPathGate(
   // Derive the pattern from the lexical absolute form (the cd-aware resolved
   // path), so it matches the values a later call produces. For an unknown base
   // (`forLiteral`) `value()` is the raw token.
-  const pattern = deriveApprovalPattern(worstEntry.path.value());
+  const pattern = normalizer.approvalPatternFor(worstEntry.path);
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,
     pathValue: worstToken,

package/src/handlers/gates/external-directory.ts

@@ -3,7 +3,6 @@ import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateResult } from "./descriptor";
 import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
@@ -78,7 +77,7 @@ export function describeExternalDirectoryGate(
     resolver,
     tcc.agentName ?? undefined,
   );
-  const pattern = deriveApprovalPattern(accessPath.value());
+  const pattern = normalizer.approvalPatternFor(accessPath);
 
   const payload = buildExternalDirectoryAskPayload({
     toolName: tcc.toolName,

package/src/handlers/gates/path.ts

@@ -3,7 +3,6 @@ import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateDescriptor, GateResult } from "./descriptor";
 import { accessFactsFromPath } from "./helpers";
@@ -46,7 +45,7 @@ export function describePathGate(
 
   // Derive the approval pattern from the lexical absolute form so it matches
   // the policy values a later call produces.
-  const pattern = deriveApprovalPattern(accessPath.value());
+  const pattern = normalizer.approvalPatternFor(accessPath);
 
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -1,4 +1,3 @@
-import type { AccessPath } from "#src/access-intent/access-path";
 import { BashProgram } from "#src/access-intent/bash/program";
 import { getPathBearingToolPath } from "#src/access-intent/tool-input-path";
 import {
@@ -24,7 +23,7 @@ import { describeExternalDirectoryGate } from "./external-directory";
 import { describePathGate } from "./path";
 import type { GateRunner } from "./runner";
 import { describeSkillReadGate } from "./skill-read";
-import { describeToolGate } from "./tool";
+import { describeToolGate, type ToolPathAccess } from "./tool";
 import type { GateOutcome, ToolCallContext } from "./types";
 
 /**
@@ -115,10 +114,16 @@ export class ToolCallGatePipeline {
           normalizer,
           this.customExtractors,
         ),
-      () => describeBashExternalDirectoryGate(tcc, bashProgram, this.resolver),
-      () => describeBashPathGate(tcc, bashProgram, this.resolver),
+      () =>
+        describeBashExternalDirectoryGate(
+          tcc,
+          bashProgram,
+          this.resolver,
+          normalizer,
+        ),
+      () => describeBashPathGate(tcc, bashProgram, this.resolver, normalizer),
       () => {
-        const { toolCheck, accessPath } = this.resolvePerToolCheck(
+        const { toolCheck, pathAccess } = this.resolvePerToolCheck(
           tcc,
           shell,
           bashProgram,
@@ -128,7 +133,7 @@ export class ToolCallGatePipeline {
           tcc,
           toolCheck,
           formatter,
-          accessPath,
+          pathAccess,
           shell,
         );
         toolDescriptor.preCheck = toolCheck;
@@ -153,15 +158,16 @@ export class ToolCallGatePipeline {
    * #502); every other tool (and a path-bearing tool with no path) keeps the
    * raw `tool` intent the manager normalizes.
    *
-   * Returns the `AccessPath` alongside the check so `describeToolGate` derives
-   * the session-approval value from `accessPath.value()`.
+   * Returns the resolved path alongside the check, already paired with the
+   * session scope approving it grants — derived here, where the normalizer
+   * lives, rather than inside the gate (#655).
    */
   private resolvePerToolCheck(
     tcc: ToolCallContext,
     shell: ShellInvocation | null,
     bashProgram: BashProgram | null,
     normalizer: PathNormalizer,
-  ): { toolCheck: PermissionCheckResult; accessPath?: AccessPath } {
+  ): { toolCheck: PermissionCheckResult; pathAccess?: ToolPathAccess } {
     if (shell) {
       if (bashProgram) {
         return {
@@ -190,7 +196,10 @@ export class ToolCallGatePipeline {
     if (filePath !== null) {
       const accessPath = normalizer.forPath(filePath);
       return {
-        accessPath,
+        pathAccess: {
+          path: accessPath,
+          approvalPattern: normalizer.approvalPatternFor(accessPath),
+        },
         toolCheck: this.resolver.resolve({
           kind: "access-path",
           surface: tcc.toolName,

package/src/handlers/gates/tool.ts

@@ -5,7 +5,10 @@ import {
   classifyToolKind,
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
-import { suggestSessionPattern } from "#src/pattern-suggest";
+import {
+  suggestPathSessionPattern,
+  suggestSessionPattern,
+} from "#src/pattern-suggest";
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
@@ -18,18 +21,30 @@ import {
 } from "./helpers";
 import type { ToolCallContext } from "./types";
 
+/**
+ * A path-bearing tool call's resolved path, paired with the session scope
+ * approving it would grant.
+ *
+ * The pattern is derived by the pipeline's `PathNormalizer`, which owns the
+ * session's `PathFlavor`, rather than re-derived here from `path.value()` — so
+ * the gate carries the platform's separator semantics without holding them
+ * (#655).
+ */
+export interface ToolPathAccess {
+  readonly path: AccessPath;
+  readonly approvalPattern: string;
+}
+
 /**
  * Derive the value used for session-approval pattern suggestions.
  *
- * Bash → command string; MCP → qualified target;
- * path-bearing tools → the `AccessPath`'s lexical absolute form (`value()`),
- * so the suggested pattern matches the policy values a later call produces;
- * others (or a path-bearing tool with no path) → catch-all wildcard.
+ * Bash → command string; MCP → qualified target; everything else → catch-all
+ * wildcard. A path-bearing tool that resolved a path never reaches here — its
+ * suggestion comes from the already-derived {@link ToolPathAccess} pattern.
  */
 function deriveSuggestionValue(
   toolName: string,
   check: PermissionCheckResult,
-  accessPath?: AccessPath,
 ): string {
   switch (classifyToolKind(toolName)) {
     case "bash":
@@ -37,7 +52,7 @@ function deriveSuggestionValue(
     case "mcp":
       return check.target ?? "mcp";
     default:
-      return accessPath ? accessPath.value() : "*";
+      return "*";
   }
 }
 
@@ -51,7 +66,7 @@ export function describeToolGate(
   tcc: ToolCallContext,
   check: PermissionCheckResult,
   formatter: ToolPreviewFormatter,
-  accessPath?: AccessPath,
+  pathAccess?: ToolPathAccess,
   shell?: ShellInvocation | null,
 ): GateDescriptor {
   // A shell invocation (native `bash` or an aliased shell tool) is gated on the
@@ -67,10 +82,12 @@ export function describeToolGate(
   );
 
   // Compute session approval suggestion for the "for this session" option.
-  const suggestion = suggestSessionPattern(
-    gateSurface,
-    deriveSuggestionValue(gateSurface, check, accessPath),
-  );
+  const suggestion = pathAccess
+    ? suggestPathSessionPattern(gateSurface, pathAccess.approvalPattern)
+    : suggestSessionPattern(
+        gateSurface,
+        deriveSuggestionValue(gateSurface, check),
+      );
 
   const payload = buildToolAskPayload({
     check,
@@ -89,8 +106,8 @@ export function describeToolGate(
 
   // A path-bearing tool carries the AccessPath's alias set; every other surface
   // (bash command, MCP target, plain tool) carries its already-portable value.
-  const accessIntent = accessPath
-    ? accessFactsFromPath(gateSurface, accessPath)
+  const accessIntent = pathAccess
+    ? accessFactsFromPath(gateSurface, pathAccess.path)
     : accessFactsFromValue(gateSurface, decisionValue);
 
   return {

package/src/path/approval-pattern.ts

@@ -0,0 +1,27 @@
+import type { PathFlavor } from "#src/path/path-flavor";
+
+/**
+ * Derive the wildcard glob to record when a user approves an accessed path for
+ * the session: the path's directory scope, with `*` appended.
+ *
+ * The scope is the value up to and including its last path separator, so the
+ * pattern is spelled with the separator the value itself carries. That matters
+ * on a win32 host, where Git Bash tokens are POSIX-shaped while Node's own
+ * `sep` is a backslash: deriving `/tmp/logs\*` from `/tmp/logs/` widens the
+ * grant to the parent directory once the `windowsSeparators` fold (#653)
+ * normalizes both operands. A value carrying no separator falls back to the
+ * current directory, which is what callers see only if they skipped resolving
+ * the path to its absolute form first (#438).
+ *
+ * The platform's separator alphabet arrives as an injected {@link PathFlavor},
+ * never an ambient `node:path` read, so win32 derivation is decidable — and
+ * testable — on a POSIX host (#655).
+ */
+export function deriveApprovalPattern(
+  pathValue: string,
+  flavor: PathFlavor,
+): string {
+  const lastSeparator = flavor.lastSeparatorIndex(pathValue);
+  if (lastSeparator < 0) return `.${flavor.impl.sep}*`;
+  return `${pathValue.slice(0, lastSeparator + 1)}*`;
+}

package/src/path/path-flavor.ts

@@ -17,7 +17,8 @@ import type { WildcardMatchOptions } from "#src/wildcard-matcher";
  * fold or separator fold is a silent bypass (the #382 / #508 class). `PathFlavor`
  * captures that mapping once so the leaves consume the resolved capability
  * instead of re-interpreting a raw `NodeJS.Platform` string. It owns platform
- * **semantics** — syntax ({@link hasPathSeparator}), token shape
+ * **semantics** — syntax ({@link hasPathSeparator} /
+ * {@link lastSeparatorIndex}), token shape
  * ({@link bashTokenShape}), and the equivalence relation ({@link fold} /
  * {@link comparable} / {@link isWithin} / {@link matchOptions}); domain policy
  * (lexical cleanup, alias generation, safe-system-path exclusions, rule
@@ -50,6 +51,15 @@ export interface PathFlavor {
    * POSIX; `/` or `\` on win32 (where a backslash is a separator, #520).
    */
   hasPathSeparator(token: string): boolean;
+  /**
+   * Index of the last path separator in `value`, or `-1` when it holds none.
+   *
+   * Reads the same separator alphabet as {@link hasPathSeparator}, so a caller
+   * that must split a path at its directory boundary uses the separator the
+   * value was written with rather than this platform's default `sep` — the two
+   * differ for a Git Bash token on a win32 host (`/dev/null`, `/tmp/logs/`).
+   */
+  lastSeparatorIndex(value: string): number;
   /**
    * The MSYS/Git-Bash interpretation of a bash-command token. On win32 this
    * carries device / drive-mount / posix-absolute / plain semantics; on POSIX
@@ -60,6 +70,8 @@ export interface PathFlavor {
 
 class PlatformPathFlavor implements PathFlavor {
   readonly matchOptions: WildcardMatchOptions | undefined;
+  /** Every separator spelling this platform recognizes, the one alphabet both separator answers read. */
+  private readonly separators: readonly string[];
 
   constructor(
     readonly impl: PlatformPath,
@@ -68,6 +80,7 @@ class PlatformPathFlavor implements PathFlavor {
     this.matchOptions = windows
       ? { caseInsensitive: true, windowsSeparators: true }
       : undefined;
+    this.separators = windows ? ["/", "\\"] : ["/"];
   }
 
   fold(value: string): string {
@@ -91,7 +104,14 @@ class PlatformPathFlavor implements PathFlavor {
   }
 
   hasPathSeparator(token: string): boolean {
-    return token.includes("/") || (this.windows && token.includes("\\"));
+    return this.lastSeparatorIndex(token) >= 0;
+  }
+
+  lastSeparatorIndex(value: string): number {
+    return this.separators.reduce(
+      (last, separator) => Math.max(last, value.lastIndexOf(separator)),
+      -1,
+    );
   }
 
   bashTokenShape(token: string): BashTokenShape {

package/src/path-normalizer.ts

@@ -8,6 +8,7 @@ import {
   normalizePathForComparison,
   normalizePathPolicyLiteral,
 } from "./access-intent/path-normalization";
+import { deriveApprovalPattern } from "./path/approval-pattern";
 import { isPathOutsideWorkingDirectory } from "./path/path-containment";
 import { isPiInfrastructureRead } from "./path/pi-infrastructure-read";
 
@@ -99,6 +100,20 @@ export class PathNormalizer {
     }
   }
 
+  /**
+   * The session-approval glob for an accessed path: its directory scope plus
+   * `*`, derived through the baked flavor.
+   *
+   * Takes the already-built {@link AccessPath} — the lexical form is what a
+   * later tool call is matched on, so the pattern must be derived from the
+   * same representation the decision displayed (#438). Deriving it here rather
+   * than at each gate keeps the platform's separator alphabet with the object
+   * that owns the flavor, instead of an ambient `node:path` read (#655).
+   */
+  approvalPatternFor(accessPath: AccessPath): string {
+    return deriveApprovalPattern(accessPath.value(), this.flavor);
+  }
+
   /** Platform-aware absoluteness (`win32` vs `posix` rules). */
   isAbsolute(pathValue: string): boolean {
     return this.flavor.impl.isAbsolute(pathValue);

package/src/pattern-suggest.ts

@@ -1,6 +1,5 @@
 import { PATH_BEARING_TOOLS } from "./access-intent/path-surfaces";
 import { prefix, stripBashCommentLines } from "./bash-arity";
-import { deriveApprovalPattern } from "./session-rules";
 
 /** The suggestion returned for a "Yes, for this session" dialog option. */
 export interface SessionApprovalSuggestion {
@@ -115,14 +114,16 @@ function buildLabel(pattern: string, surface: string): string {
 }
 
 /**
- * Suggest a session-approval pattern for the given permission surface and value.
+ * Suggest a session-approval pattern from a surface's own value vocabulary —
+ * a bash command, an MCP target, a skill name.
  *
  * Returns a `SessionApprovalSuggestion` with the surface, the wildcard pattern
- * to store in `SessionRules`, and a human-readable dialog label.
+ * to store in `SessionRules`, and a human-readable dialog label. Any surface
+ * with no vocabulary of its own falls back to the catch-all wildcard, which is
+ * also what a path-bearing tool invoked without a path resolves to.
  *
- * `value` is expected to be the canonical (cwd-resolved, absolute) path for
- * path surfaces — callers resolve it before suggesting, so the derived pattern
- * matches the policy values a later tool call produces.
+ * A path surface goes through {@link suggestPathSessionPattern} instead: its
+ * pattern is a path-language product, and this module holds no path semantics.
  */
 export function suggestSessionPattern(
   surface: string,
@@ -140,22 +141,30 @@ export function suggestSessionPattern(
     case "skill":
       pattern = value;
       break;
-    case "external_directory":
-      pattern = deriveApprovalPattern(value);
-      break;
-    case "path":
-      pattern = deriveApprovalPattern(value);
-      break;
     default:
-      // Path-bearing tools: derive a directory-scoped pattern from the path.
-      if (PATH_BEARING_TOOLS.has(surface) && value !== "*") {
-        pattern = deriveApprovalPattern(value);
-        break;
-      }
-      // Extension tools / fallback.
+      // Extension tools, and path-bearing tools invoked without a path.
       pattern = "*";
       break;
   }
 
   return { surface, pattern, label: buildLabel(pattern, surface) };
 }
+
+/**
+ * Build the suggestion for a path surface from a pattern the caller already
+ * derived through its `PathNormalizer` (#655).
+ *
+ * The derivation belongs to the normalizer, which owns the session's
+ * `PathFlavor`; this module labels the result and must not re-interpret the
+ * separators it is handed.
+ */
+export function suggestPathSessionPattern(
+  surface: string,
+  approvalPattern: string,
+): SessionApprovalSuggestion {
+  return {
+    surface,
+    pattern: approvalPattern,
+    label: buildLabel(approvalPattern, surface),
+  };
+}

package/src/session-rules.ts

@@ -1,5 +1,3 @@
-import { dirname, sep } from "node:path";
-
 import type { Ruleset } from "./rule";
 import type { SessionApproval } from "./session-approval";
 import type { SessionApprovalRecorder } from "./session-approval-recorder";
@@ -48,32 +46,3 @@ export class SessionRules implements SessionApprovalRecorder {
     this.rules = [];
   }
 }
-
-/**
- * Derive the wildcard glob pattern to approve from a normalized path.
- *
- * Returns `<parent-dir>/*` so that `evaluate()` / `wildcardMatch()` matches
- * all paths under the approved directory — identical semantics to the former
- * `SessionApprovalCache` prefix matching, using the unified wildcard engine.
- *
- * For paths that already end with a separator (directories), the separator
- * is treated as the directory boundary and `*` is appended directly.
- *
- * The path is expected to be the canonical (cwd-resolved, absolute) form used
- * for policy matching, so the derived pattern matches the same policy values a
- * later tool call produces. Callers that hold a working directory resolve the
- * path to that form first; the function itself stays free of cwd state.
- */
-export function deriveApprovalPattern(normalizedPath: string): string {
-  // If the path already ends with a separator, it's a directory — glob its contents.
-  if (normalizedPath.endsWith(sep)) {
-    return `${normalizedPath}*`;
-  }
-  const dir = dirname(normalizedPath);
-  if (dir === normalizedPath) {
-    // Root path — dirname('/') === '/'
-    return `${dir}*`;
-  }
-  const prefix = dir.endsWith(sep) ? dir : `${dir}${sep}`;
-  return `${prefix}*`;
-}