fix(file-transfer): expand Windows-style tilde globs

VectorPeak · chatgpt-codex-connector[bot] · VectorPeak · commit 48ad39f2d632 · 2026-07-16T18:11:30.000+08:00
Co-authored-by: chatgpt-codex-connector[bot] &lt;199175422+chatgpt-codex-connector[bot]@users.noreply.github.com&gt;
diff --git a/extensions/file-transfer/src/shared/policy.test.ts b/extensions/file-transfer/src/shared/policy.test.ts
@@ -176,6 +176,21 @@ describe("evaluateFilePolicy — denyPaths always wins", () => {
     expectResultFields(r, { ok: false, code: "POLICY_DENIED", askable: false });
   });
 
+  it("expands Windows-style home globs in denyPaths", () => {
+    withConfig({
+      n1: {
+        allowReadPaths: ["~/Downloads/**"],
+        denyPaths: ["~\\Downloads\\**\\*.pem"],
+      },
+    });
+    const r = evaluateFilePolicy({
+      nodeId: "n1",
+      kind: "read",
+      path: path.join(os.homedir(), "Downloads", "key.pem"),
+    });
+    expectResultFields(r, { ok: false, code: "POLICY_DENIED", askable: false });
+  });
+
   it("preserves minimatch brace semantics in denyPaths", () => {
     withConfig({
       n1: {
@@ -284,6 +299,20 @@ describe("evaluateFilePolicy — allow matching", () => {
     );
   });
 
+  it("expands Windows-style home globs before matching", () => {
+    withConfig({
+      n1: { allowReadPaths: ["~\\Downloads\\**"] },
+    });
+    expectResultFields(
+      evaluateFilePolicy({
+        nodeId: "n1",
+        kind: "read",
+        path: path.join(os.homedir(), "Downloads", "shot.png"),
+      }),
+      { ok: true },
+    );
+  });
+
   it("matches Windows node paths without gateway-local path semantics", () => {
     withConfig({
       n1: { allowReadPaths: ["C:/Users/me/**"] },
diff --git a/extensions/file-transfer/src/shared/policy.ts b/extensions/file-transfer/src/shared/policy.ts
@@ -127,7 +127,7 @@ function readFilePolicyConfig(pluginConfig?: Record<string, unknown>): FilePolic
 }
 
 function expandTilde(p: string): string {
-  if (p.startsWith("~/") || p === "~") {
+  if (p.startsWith("~/") || p.startsWith("~\\") || p === "~") {
     return path.join(os.homedir(), p.slice(p === "~" ? 1 : 2));
   }
   return p;

Original file line number	Diff line number	Diff line change
`@@ -127,7 +127,7 @@ function readFilePolicyConfig(pluginConfig?: Record<string, unknown>): FilePolic`
`127`	`127`	`}`
`128`	`128`
`129`	`129`	`function expandTilde(p: string): string {`
`130`		`- if (p.startsWith("~/") \|\| p === "~") {`
	`130`	`+ if (p.startsWith("~/") \|\| p.startsWith("~\\") \|\| p === "~") {`
`131`	`131`	`return path.join(os.homedir(), p.slice(p === "~" ? 1 : 2));`
`132`	`132`	`}`
`133`	`133`	`return p;`