@gotgenes/pi-permission-system 26.2.1 → 26.2.2

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [26.2.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.2.1...pi-permission-system-v26.2.2) (2026-08-18)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** derive session-approval patterns through the injected PathFlavor ([cf561de](https://github.com/gotgenes/pi-packages/commit/cf561de4c19895ed9495d82f22280fe3ba215aa5)), closes [#655](https://github.com/gotgenes/pi-packages/issues/655)
+
 ## [26.2.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.2.0...pi-permission-system-v26.2.1) (2026-08-17)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "26.2.1",
+  "version": "26.2.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/handlers/gates/bash-external-directory.ts

@@ -1,8 +1,8 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
+import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { GateResult } from "./descriptor";
 import { selectUncoveredExternalPaths } from "./external-directory-policy";
 import { accessFactsFromPath } from "./helpers";
@@ -25,6 +25,7 @@ export function describeBashExternalDirectoryGate(
   tcc: ToolCallContext,
   bashProgram: BashProgram | null,
   resolver: ScopedPermissionResolver,
+  normalizer: PathNormalizer,
 ): GateResult {
   if (!bashProgram) return null;
   const command = bashProgram.commandText();
@@ -94,7 +95,9 @@ export function describeBashExternalDirectoryGate(
     matchedPattern: preCheck.matchedPattern,
   });
 
-  const patterns = uncoveredPaths.map((p) => deriveApprovalPattern(p));
+  const patterns = uncoveredEntries.map(({ path }) =>
+    normalizer.approvalPatternFor(path),
+  );
 
   return {
     surface: "external_directory",

package/src/handlers/gates/bash-path.ts

@@ -1,9 +1,9 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
+import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { PermissionCheckResult } from "#src/types";
 import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
@@ -33,6 +33,7 @@ export function describeBashPathGate(
   tcc: ToolCallContext,
   bashProgram: BashProgram | null,
   resolver: ScopedPermissionResolver,
+  normalizer: PathNormalizer,
 ): GateResult {
   if (!bashProgram) return null;
   const command = bashProgram.commandText();
@@ -120,7 +121,7 @@ export function describeBashPathGate(
   // Derive the pattern from the lexical absolute form (the cd-aware resolved
   // path), so it matches the values a later call produces. For an unknown base
   // (`forLiteral`) `value()` is the raw token.
-  const pattern = deriveApprovalPattern(worstEntry.path.value());
+  const pattern = normalizer.approvalPatternFor(worstEntry.path);
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,
     pathValue: worstToken,

package/src/handlers/gates/external-directory.ts

@@ -3,7 +3,6 @@ import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateResult } from "./descriptor";
 import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
@@ -78,7 +77,7 @@ export function describeExternalDirectoryGate(
     resolver,
     tcc.agentName ?? undefined,
   );
-  const pattern = deriveApprovalPattern(accessPath.value());
+  const pattern = normalizer.approvalPatternFor(accessPath);
 
   const payload = buildExternalDirectoryAskPayload({
     toolName: tcc.toolName,

package/src/handlers/gates/path.ts

@@ -3,7 +3,6 @@ import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateDescriptor, GateResult } from "./descriptor";
 import { accessFactsFromPath } from "./helpers";
@@ -46,7 +45,7 @@ export function describePathGate(
 
   // Derive the approval pattern from the lexical absolute form so it matches
   // the policy values a later call produces.
-  const pattern = deriveApprovalPattern(accessPath.value());
+  const pattern = normalizer.approvalPatternFor(accessPath);
 
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -1,4 +1,3 @@
-import type { AccessPath } from "#src/access-intent/access-path";
 import { BashProgram } from "#src/access-intent/bash/program";
 import { getPathBearingToolPath } from "#src/access-intent/tool-input-path";
 import {
@@ -24,7 +23,7 @@ import { describeExternalDirectoryGate } from "./external-directory";
 import { describePathGate } from "./path";
 import type { GateRunner } from "./runner";
 import { describeSkillReadGate } from "./skill-read";
-import { describeToolGate } from "./tool";
+import { describeToolGate, type ToolPathAccess } from "./tool";
 import type { GateOutcome, ToolCallContext } from "./types";
 
 /**
@@ -115,10 +114,16 @@ export class ToolCallGatePipeline {
           normalizer,
           this.customExtractors,
         ),
-      () => describeBashExternalDirectoryGate(tcc, bashProgram, this.resolver),
-      () => describeBashPathGate(tcc, bashProgram, this.resolver),
+      () =>
+        describeBashExternalDirectoryGate(
+          tcc,
+          bashProgram,
+          this.resolver,
+          normalizer,
+        ),
+      () => describeBashPathGate(tcc, bashProgram, this.resolver, normalizer),
       () => {
-        const { toolCheck, accessPath } = this.resolvePerToolCheck(
+        const { toolCheck, pathAccess } = this.resolvePerToolCheck(
           tcc,
           shell,
           bashProgram,
@@ -128,7 +133,7 @@ export class ToolCallGatePipeline {
           tcc,
           toolCheck,
           formatter,
-          accessPath,
+          pathAccess,
           shell,
         );
         toolDescriptor.preCheck = toolCheck;
@@ -153,15 +158,16 @@ export class ToolCallGatePipeline {
    * #502); every other tool (and a path-bearing tool with no path) keeps the
    * raw `tool` intent the manager normalizes.
    *
-   * Returns the `AccessPath` alongside the check so `describeToolGate` derives
-   * the session-approval value from `accessPath.value()`.
+   * Returns the resolved path alongside the check, already paired with the
+   * session scope approving it grants — derived here, where the normalizer
+   * lives, rather than inside the gate (#655).
    */
   private resolvePerToolCheck(
     tcc: ToolCallContext,
     shell: ShellInvocation | null,
     bashProgram: BashProgram | null,
     normalizer: PathNormalizer,
-  ): { toolCheck: PermissionCheckResult; accessPath?: AccessPath } {
+  ): { toolCheck: PermissionCheckResult; pathAccess?: ToolPathAccess } {
     if (shell) {
       if (bashProgram) {
         return {
@@ -190,7 +196,10 @@ export class ToolCallGatePipeline {
     if (filePath !== null) {
       const accessPath = normalizer.forPath(filePath);
       return {
-        accessPath,
+        pathAccess: {
+          path: accessPath,
+          approvalPattern: normalizer.approvalPatternFor(accessPath),
+        },
         toolCheck: this.resolver.resolve({
           kind: "access-path",
           surface: tcc.toolName,

package/src/handlers/gates/tool.ts

@@ -5,7 +5,10 @@ import {
   classifyToolKind,
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
-import { suggestSessionPattern } from "#src/pattern-suggest";
+import {
+  suggestPathSessionPattern,
+  suggestSessionPattern,
+} from "#src/pattern-suggest";
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
@@ -18,18 +21,30 @@ import {
 } from "./helpers";
 import type { ToolCallContext } from "./types";
 
+/**
+ * A path-bearing tool call's resolved path, paired with the session scope
+ * approving it would grant.
+ *
+ * The pattern is derived by the pipeline's `PathNormalizer`, which owns the
+ * session's `PathFlavor`, rather than re-derived here from `path.value()` — so
+ * the gate carries the platform's separator semantics without holding them
+ * (#655).
+ */
+export interface ToolPathAccess {
+  readonly path: AccessPath;
+  readonly approvalPattern: string;
+}
+
 /**
  * Derive the value used for session-approval pattern suggestions.
  *
- * Bash → command string; MCP → qualified target;
- * path-bearing tools → the `AccessPath`'s lexical absolute form (`value()`),
- * so the suggested pattern matches the policy values a later call produces;
- * others (or a path-bearing tool with no path) → catch-all wildcard.
+ * Bash → command string; MCP → qualified target; everything else → catch-all
+ * wildcard. A path-bearing tool that resolved a path never reaches here — its
+ * suggestion comes from the already-derived {@link ToolPathAccess} pattern.
  */
 function deriveSuggestionValue(
   toolName: string,
   check: PermissionCheckResult,
-  accessPath?: AccessPath,
 ): string {
   switch (classifyToolKind(toolName)) {
     case "bash":
@@ -37,7 +52,7 @@ function deriveSuggestionValue(
     case "mcp":
       return check.target ?? "mcp";
     default:
-      return accessPath ? accessPath.value() : "*";
+      return "*";
   }
 }
 
@@ -51,7 +66,7 @@ export function describeToolGate(
   tcc: ToolCallContext,
   check: PermissionCheckResult,
   formatter: ToolPreviewFormatter,
-  accessPath?: AccessPath,
+  pathAccess?: ToolPathAccess,
   shell?: ShellInvocation | null,
 ): GateDescriptor {
   // A shell invocation (native `bash` or an aliased shell tool) is gated on the
@@ -67,10 +82,12 @@ export function describeToolGate(
   );
 
   // Compute session approval suggestion for the "for this session" option.
-  const suggestion = suggestSessionPattern(
-    gateSurface,
-    deriveSuggestionValue(gateSurface, check, accessPath),
-  );
+  const suggestion = pathAccess
+    ? suggestPathSessionPattern(gateSurface, pathAccess.approvalPattern)
+    : suggestSessionPattern(
+        gateSurface,
+        deriveSuggestionValue(gateSurface, check),
+      );
 
   const payload = buildToolAskPayload({
     check,
@@ -89,8 +106,8 @@ export function describeToolGate(
 
   // A path-bearing tool carries the AccessPath's alias set; every other surface
   // (bash command, MCP target, plain tool) carries its already-portable value.
-  const accessIntent = accessPath
-    ? accessFactsFromPath(gateSurface, accessPath)
+  const accessIntent = pathAccess
+    ? accessFactsFromPath(gateSurface, pathAccess.path)
     : accessFactsFromValue(gateSurface, decisionValue);
 
   return {

package/src/path/approval-pattern.ts

@@ -0,0 +1,27 @@
+import type { PathFlavor } from "#src/path/path-flavor";
+
+/**
+ * Derive the wildcard glob to record when a user approves an accessed path for
+ * the session: the path's directory scope, with `*` appended.
+ *
+ * The scope is the value up to and including its last path separator, so the
+ * pattern is spelled with the separator the value itself carries. That matters
+ * on a win32 host, where Git Bash tokens are POSIX-shaped while Node's own
+ * `sep` is a backslash: deriving `/tmp/logs\*` from `/tmp/logs/` widens the
+ * grant to the parent directory once the `windowsSeparators` fold (#653)
+ * normalizes both operands. A value carrying no separator falls back to the
+ * current directory, which is what callers see only if they skipped resolving
+ * the path to its absolute form first (#438).
+ *
+ * The platform's separator alphabet arrives as an injected {@link PathFlavor},
+ * never an ambient `node:path` read, so win32 derivation is decidable — and
+ * testable — on a POSIX host (#655).
+ */
+export function deriveApprovalPattern(
+  pathValue: string,
+  flavor: PathFlavor,
+): string {
+  const lastSeparator = flavor.lastSeparatorIndex(pathValue);
+  if (lastSeparator < 0) return `.${flavor.impl.sep}*`;
+  return `${pathValue.slice(0, lastSeparator + 1)}*`;
+}

package/src/path/path-flavor.ts

@@ -17,7 +17,8 @@ import type { WildcardMatchOptions } from "#src/wildcard-matcher";
  * fold or separator fold is a silent bypass (the #382 / #508 class). `PathFlavor`
  * captures that mapping once so the leaves consume the resolved capability
  * instead of re-interpreting a raw `NodeJS.Platform` string. It owns platform
- * **semantics** — syntax ({@link hasPathSeparator}), token shape
+ * **semantics** — syntax ({@link hasPathSeparator} /
+ * {@link lastSeparatorIndex}), token shape
  * ({@link bashTokenShape}), and the equivalence relation ({@link fold} /
  * {@link comparable} / {@link isWithin} / {@link matchOptions}); domain policy
  * (lexical cleanup, alias generation, safe-system-path exclusions, rule
@@ -50,6 +51,15 @@ export interface PathFlavor {
    * POSIX; `/` or `\` on win32 (where a backslash is a separator, #520).
    */
   hasPathSeparator(token: string): boolean;
+  /**
+   * Index of the last path separator in `value`, or `-1` when it holds none.
+   *
+   * Reads the same separator alphabet as {@link hasPathSeparator}, so a caller
+   * that must split a path at its directory boundary uses the separator the
+   * value was written with rather than this platform's default `sep` — the two
+   * differ for a Git Bash token on a win32 host (`/dev/null`, `/tmp/logs/`).
+   */
+  lastSeparatorIndex(value: string): number;
   /**
    * The MSYS/Git-Bash interpretation of a bash-command token. On win32 this
    * carries device / drive-mount / posix-absolute / plain semantics; on POSIX
@@ -60,6 +70,8 @@ export interface PathFlavor {
 
 class PlatformPathFlavor implements PathFlavor {
   readonly matchOptions: WildcardMatchOptions | undefined;
+  /** Every separator spelling this platform recognizes, the one alphabet both separator answers read. */
+  private readonly separators: readonly string[];
 
   constructor(
     readonly impl: PlatformPath,
@@ -68,6 +80,7 @@ class PlatformPathFlavor implements PathFlavor {
     this.matchOptions = windows
       ? { caseInsensitive: true, windowsSeparators: true }
       : undefined;
+    this.separators = windows ? ["/", "\\"] : ["/"];
   }
 
   fold(value: string): string {
@@ -91,7 +104,14 @@ class PlatformPathFlavor implements PathFlavor {
   }
 
   hasPathSeparator(token: string): boolean {
-    return token.includes("/") || (this.windows && token.includes("\\"));
+    return this.lastSeparatorIndex(token) >= 0;
+  }
+
+  lastSeparatorIndex(value: string): number {
+    return this.separators.reduce(
+      (last, separator) => Math.max(last, value.lastIndexOf(separator)),
+      -1,
+    );
   }
 
   bashTokenShape(token: string): BashTokenShape {

package/src/path-normalizer.ts

@@ -8,6 +8,7 @@ import {
   normalizePathForComparison,
   normalizePathPolicyLiteral,
 } from "./access-intent/path-normalization";
+import { deriveApprovalPattern } from "./path/approval-pattern";
 import { isPathOutsideWorkingDirectory } from "./path/path-containment";
 import { isPiInfrastructureRead } from "./path/pi-infrastructure-read";
 
@@ -99,6 +100,20 @@ export class PathNormalizer {
     }
   }
 
+  /**
+   * The session-approval glob for an accessed path: its directory scope plus
+   * `*`, derived through the baked flavor.
+   *
+   * Takes the already-built {@link AccessPath} — the lexical form is what a
+   * later tool call is matched on, so the pattern must be derived from the
+   * same representation the decision displayed (#438). Deriving it here rather
+   * than at each gate keeps the platform's separator alphabet with the object
+   * that owns the flavor, instead of an ambient `node:path` read (#655).
+   */
+  approvalPatternFor(accessPath: AccessPath): string {
+    return deriveApprovalPattern(accessPath.value(), this.flavor);
+  }
+
   /** Platform-aware absoluteness (`win32` vs `posix` rules). */
   isAbsolute(pathValue: string): boolean {
     return this.flavor.impl.isAbsolute(pathValue);

package/src/pattern-suggest.ts

@@ -1,6 +1,5 @@
 import { PATH_BEARING_TOOLS } from "./access-intent/path-surfaces";
 import { prefix, stripBashCommentLines } from "./bash-arity";
-import { deriveApprovalPattern } from "./session-rules";
 
 /** The suggestion returned for a "Yes, for this session" dialog option. */
 export interface SessionApprovalSuggestion {
@@ -115,14 +114,16 @@ function buildLabel(pattern: string, surface: string): string {
 }
 
 /**
- * Suggest a session-approval pattern for the given permission surface and value.
+ * Suggest a session-approval pattern from a surface's own value vocabulary —
+ * a bash command, an MCP target, a skill name.
  *
  * Returns a `SessionApprovalSuggestion` with the surface, the wildcard pattern
- * to store in `SessionRules`, and a human-readable dialog label.
+ * to store in `SessionRules`, and a human-readable dialog label. Any surface
+ * with no vocabulary of its own falls back to the catch-all wildcard, which is
+ * also what a path-bearing tool invoked without a path resolves to.
  *
- * `value` is expected to be the canonical (cwd-resolved, absolute) path for
- * path surfaces — callers resolve it before suggesting, so the derived pattern
- * matches the policy values a later tool call produces.
+ * A path surface goes through {@link suggestPathSessionPattern} instead: its
+ * pattern is a path-language product, and this module holds no path semantics.
  */
 export function suggestSessionPattern(
   surface: string,
@@ -140,22 +141,30 @@ export function suggestSessionPattern(
     case "skill":
       pattern = value;
       break;
-    case "external_directory":
-      pattern = deriveApprovalPattern(value);
-      break;
-    case "path":
-      pattern = deriveApprovalPattern(value);
-      break;
     default:
-      // Path-bearing tools: derive a directory-scoped pattern from the path.
-      if (PATH_BEARING_TOOLS.has(surface) && value !== "*") {
-        pattern = deriveApprovalPattern(value);
-        break;
-      }
-      // Extension tools / fallback.
+      // Extension tools, and path-bearing tools invoked without a path.
       pattern = "*";
       break;
   }
 
   return { surface, pattern, label: buildLabel(pattern, surface) };
 }
+
+/**
+ * Build the suggestion for a path surface from a pattern the caller already
+ * derived through its `PathNormalizer` (#655).
+ *
+ * The derivation belongs to the normalizer, which owns the session's
+ * `PathFlavor`; this module labels the result and must not re-interpret the
+ * separators it is handed.
+ */
+export function suggestPathSessionPattern(
+  surface: string,
+  approvalPattern: string,
+): SessionApprovalSuggestion {
+  return {
+    surface,
+    pattern: approvalPattern,
+    label: buildLabel(approvalPattern, surface),
+  };
+}

package/src/session-rules.ts

@@ -1,5 +1,3 @@
-import { dirname, sep } from "node:path";
-
 import type { Ruleset } from "./rule";
 import type { SessionApproval } from "./session-approval";
 import type { SessionApprovalRecorder } from "./session-approval-recorder";
@@ -48,32 +46,3 @@ export class SessionRules implements SessionApprovalRecorder {
     this.rules = [];
   }
 }
-
-/**
- * Derive the wildcard glob pattern to approve from a normalized path.
- *
- * Returns `<parent-dir>/*` so that `evaluate()` / `wildcardMatch()` matches
- * all paths under the approved directory — identical semantics to the former
- * `SessionApprovalCache` prefix matching, using the unified wildcard engine.
- *
- * For paths that already end with a separator (directories), the separator
- * is treated as the directory boundary and `*` is appended directly.
- *
- * The path is expected to be the canonical (cwd-resolved, absolute) form used
- * for policy matching, so the derived pattern matches the same policy values a
- * later tool call produces. Callers that hold a working directory resolve the
- * path to that form first; the function itself stays free of cwd state.
- */
-export function deriveApprovalPattern(normalizedPath: string): string {
-  // If the path already ends with a separator, it's a directory — glob its contents.
-  if (normalizedPath.endsWith(sep)) {
-    return `${normalizedPath}*`;
-  }
-  const dir = dirname(normalizedPath);
-  if (dir === normalizedPath) {
-    // Root path — dirname('/') === '/'
-    return `${dir}*`;
-  }
-  const prefix = dir.endsWith(sep) ? dir : `${dir}${sep}`;
-  return `${prefix}*`;
-}