Deepen gate cache identity and carve out non-path key suffixes

Authorize-time relative and execution-time rewritten nested paths shared no cache identity, so nested in-bounds calls re-decided at execution. Query-language keys ending in path also over-blocked foreign tool contracts.

Author: TheGreatAxios

src/permission/gate.ts

@@ -22,7 +22,7 @@ import {
 } from "./auto-shell-policy.js";
 import { commandReferencesSensitivePath } from "../plugins/secret-guard-plugin.js";
 import {
-  looksLikePath,
+  normalizePathArguments,
   pathEscapeBlockReason,
 } from "../plugins/path-escape-plugin.js";
 import { runShellAuthzBlockReason } from "../shell/run-shell-authz.js";
@@ -38,10 +38,7 @@ import {
   tokenize,
   stripCommentLines,
 } from "./command.js";
-import {
-  createPathRestriction,
-  resolveWorkspacePath,
-} from "./path-restriction.js";
+import { createPathRestriction } from "./path-restriction.js";
 import {
   createWorktreeRootsProvider,
   type RootsProvider,
@@ -475,23 +472,15 @@ function canSafelyMintPerSegment(pattern: string): boolean {
 }
 
 // posix pathEscapePlugin rewrites path-like args to resolveWorkspacePath before
-// gateToolCall. Cache identity must use that same resolution so an authorizeCall
-// allow is not treated as a different call (and re-decided) at execution.
+// gateToolCall. Cache identity must use that same resolution — deep, like the
+// plugin's escapeValue walk — so an authorizeCall allow is not treated as a
+// different call (and re-decided) at execution.
 function identityArguments(
   args: ToolCall["arguments"],
   cwd: string,
   rootsProvider: RootsProvider,
 ): string {
-  const normalized: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(args)) {
-    if (typeof value === "string" && looksLikePath(key)) {
-      normalized[key] =
-        resolveWorkspacePath(cwd, value, rootsProvider) ?? value;
-    } else {
-      normalized[key] = value;
-    }
-  }
-  return JSON.stringify(normalized);
+  return JSON.stringify(normalizePathArguments(args, cwd, rootsProvider));
 }
 
 export function createPermissionGate(

src/permission/permission.test.ts

@@ -1069,6 +1069,47 @@ describe("gate denies path tools path-escape will reject", () => {
   });
 });
 
+describe("gate cache identity matches the plugin rewrite for nested paths", () => {
+  // authorizeCall caches by identityArguments; executionVerdict must hit that
+  // cache when execution hands it the plugin-rewritten (workspace-absolute)
+  // arguments. A grant seeded after authorize changes what a fresh decide
+  // would say, so a miss visibly flips to allow while a hit reuses the ask.
+  test("nested in-bounds call authorizes once and executes without re-decide", async () => {
+    const cwd = realpathSync(mkdtempSync(join(tmpdir(), "corbits-identity-")));
+    const gate = createPermissionGate({
+      approvals: [],
+      cwd,
+      requestApproval: async () => ({ allow: false }),
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: true,
+    });
+    const call: ToolCall = {
+      id: "c",
+      name: "write_file",
+      arguments: {
+        path: "notes.txt",
+        options: { path: "notes.txt" },
+        content: "x",
+      },
+    };
+    const authorized = await gate.authorizeCall(call);
+    expect(authorized.effect).toBe("ask");
+    gate.setSeededApprovals([
+      { tool: "write_file", pattern: join(cwd, "notes.txt") },
+    ]);
+    const executed = await gate.executionVerdict({
+      ...call,
+      arguments: {
+        path: join(cwd, "notes.txt"),
+        options: { path: join(cwd, "notes.txt") },
+        content: "x",
+      },
+    });
+    expect(executed.effect).toBe("ask");
+  });
+});
+
 describe("createPermissionGate", () => {
   test("allow-tier tools pass without asking", async () => {
     let asked = 0;

src/plugins/path-escape-plugin.test.ts

@@ -11,7 +11,11 @@ import { existsSync, realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { pathEscapePlugin } from "./path-escape-plugin.js";
+import {
+  normalizePathArguments,
+  pathEscapeBlockReason,
+  pathEscapePlugin,
+} from "./path-escape-plugin.js";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
 
 function makeCall(name: string, args: Record<string, unknown>): ToolCall {
@@ -334,7 +338,6 @@ describe("pathEscapePlugin", () => {
     });
 
     test("pathEscapeBlockReason agrees with execution time on nested escapes", async () => {
-      const { pathEscapeBlockReason } = await import("./path-escape-plugin.js");
       expect(
         pathEscapeBlockReason(
           { options: { path: "../secret.txt" } },
@@ -351,5 +354,79 @@ describe("pathEscapePlugin", () => {
         ),
       ).toMatch(/escapes working directory/);
     });
+
+    test("nested non-path keys pass through untouched (allowlist policy)", async () => {
+      const plugin = pathEscapePlugin("/project");
+      const { next, seen } = captureNext();
+      const handler = plugin.middleware ? plugin.middleware(next) : next;
+      const result = await handler(
+        makeCall("custom_tool", { options: { command: "../secret.txt" } }),
+        new AbortController().signal,
+      );
+      expect(result.isError).not.toBe(true);
+      expect(seen()).toEqual({ options: { command: "../secret.txt" } });
+      expect(
+        pathEscapeBlockReason(
+          { options: { command: "../secret.txt" } },
+          "/project",
+        ),
+      ).toBeUndefined();
+    });
+
+    test("FILE_PATH and file-path match case- and separator-insensitively", async () => {
+      const plugin = pathEscapePlugin("/project");
+      const handler = plugin.middleware
+        ? plugin.middleware(nextHandler)
+        : nextHandler;
+      for (const key of ["FILE_PATH", "file-path"]) {
+        const result = await handler(
+          makeCall("read_file", { [key]: "../secret.txt" }),
+          new AbortController().signal,
+        );
+        expect(result.isError).toBe(true);
+        expect(result.content).toMatch(/escapes working directory/);
+        expect(
+          pathEscapeBlockReason({ [key]: "../secret.txt" }, "/project"),
+        ).toMatch(/escapes working directory/);
+      }
+    });
+
+    test("xpath, jsonpath, and classpath keys pass through untouched", async () => {
+      const plugin = pathEscapePlugin("/project");
+      const { next, seen } = captureNext();
+      const handler = plugin.middleware ? plugin.middleware(next) : next;
+      const args = {
+        xpath: "../../title",
+        jsonpath: "$.store.book",
+        classpath: "src/Main",
+      };
+      const result = await handler(
+        makeCall("custom_tool", args),
+        new AbortController().signal,
+      );
+      expect(result.isError).not.toBe(true);
+      expect(seen()).toEqual(args);
+      expect(pathEscapeBlockReason(args, "/project")).toBeUndefined();
+    });
+
+    test("normalizePathArguments shares the plugin rewrite identity", () => {
+      expect(
+        normalizePathArguments(
+          { options: { path: "src/index.ts" } },
+          "/project",
+          () => [],
+        ),
+      ).toEqual({ options: { path: "/project/src/index.ts" } });
+      expect(
+        normalizePathArguments(
+          { options: { command: "../secret.txt" } },
+          "/project",
+          () => [],
+        ),
+      ).toEqual({ options: { command: "../secret.txt" } });
+      expect(
+        normalizePathArguments({ xpath: "src/index.ts" }, "/project", () => []),
+      ).toEqual({ xpath: "src/index.ts" });
+    });
   });
 });

src/plugins/path-escape-plugin.ts

@@ -97,12 +97,24 @@ function escapeValue(
 // Explicit allowlist of argument keys treated as filesystem paths. Keys are
 // matched case- and separator-insensitively, so `filePath`, `FILE_PATH`,
 // and `file-path` all count alongside `file_path`; any key ending in
-// `path`/`paths` (e.g. `somepath`, `outputPaths`) counts too. Anything else
+// `path`/`paths` (e.g. `somepath`, `outputPaths`) counts too, except query-
+// language and JVM keys (`xpath`, `jsonpath`, `classpath` and their plurals)
+// whose values are expressions, not filesystem paths. Anything else
 // passes through untouched by design: MCP and custom tools may use arbitrary
 // keys whose values only their server interprets, so unknown keys are that
 // server's contract, not this sandbox's.
 export function looksLikePath(key: string): boolean {
   const normalized = key.toLowerCase().replace(/[-_]/g, "");
+  if (
+    normalized.endsWith("xpath") ||
+    normalized.endsWith("xpaths") ||
+    normalized.endsWith("jsonpath") ||
+    normalized.endsWith("jsonpaths") ||
+    normalized.endsWith("classpath") ||
+    normalized.endsWith("classpaths")
+  ) {
+    return false;
+  }
   return (
     normalized === "path" ||
     normalized === "paths" ||
@@ -134,6 +146,45 @@ export function pathEscapeBlockReason(
   return blockReasonFor(args, cwd, rootsProvider);
 }
 
+// Deep-walk identity for the permission gate's authorize/execution cache.
+// Same key propagation as escapeValue (innermost key wins; array entries
+// inherit the array key), but non-throwing: in-bounds paths resolve to their
+// workspace-absolute form while escapes and non-path values pass through
+// untouched. Both cache sides compute it, so a fail-closed re-decide still
+// agrees — the point is only that authorize-time relative and execution-time
+// rewritten arguments share one identity.
+export function normalizePathArguments(
+  args: Record<string, unknown>,
+  cwd: string,
+  rootsProvider: RootsProvider = () => [],
+): Record<string, unknown> {
+  return normalizeValue(args, cwd, rootsProvider) as Record<string, unknown>;
+}
+
+function normalizeValue(
+  value: unknown,
+  cwd: string,
+  rootsProvider: RootsProvider,
+  key?: string,
+): unknown {
+  if (typeof value === "string") {
+    if (key === undefined || !looksLikePath(key)) return value;
+    if (isToolOutputLike(value) || isArchiveLike(value)) return value;
+    return resolveWorkspacePath(cwd, value, rootsProvider) ?? value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => normalizeValue(entry, cwd, rootsProvider, key));
+  }
+  if (typeof value === "object" && value !== null) {
+    const out: Record<string, unknown> = {};
+    for (const [entryKey, entryValue] of Object.entries(value)) {
+      out[entryKey] = normalizeValue(entryValue, cwd, rootsProvider, entryKey);
+    }
+    return out;
+  }
+  return value;
+}
+
 function blockReasonFor(
   value: unknown,
   cwd: string,