The path comparison here is highly vulnerable to bypasses because normalize_path_value only performs basic string replacements and trimming. It does not resolve relative path components (like . or ..), duplicate slashes (like //), or absolute vs. relative path differences.\n\nFor example, if a rule blocks secrets/api_key.txt, an attacker or model can bypass this check by using:\n- ./secrets/api_key.txt\n- secrets//api_key.txt\n- /workspace/secrets/api_key.txt (if the workspace is at /workspace)\n\nTo prevent these bypasses, paths should be resolved to absolute paths (e.g., by joining relative paths with ctx.cwd or the workspace root) and then normalized/cleaned (using path_clean::clean or std::path::Path::canonicalize if the files exist) before comparison.

Proposing a NetworkPolicyAmendment with host set to ctx.cwd (which is a directory path like \"/workspace\") for a matched ask_rule is incorrect. \n\nFirst, ctx.cwd is a local directory path, not a network host.\nSecond, ask_rule can match non-network tools (such as file tools like read_file or edit_file), where proposing any network policy amendment is completely unnecessary and will result in confusing UI prompts.\n\nFor ask_rule matches, proposed_network_policy_amendments should be empty (vec![]).

                    proposed_network_policy_amendments: vec![],

Using manual directory creation with SystemTime and std::process::id() is prone to leaving leftover directories in the temporary folder if the test panics or fails before fs::remove_dir_all is reached.\n\nSince tempfile is already a dependency in the workspace (used in crates/app-server), it is highly recommended to add it as a dev-dependency to crates/config and use tempfile::tempdir() here. This ensures automatic cleanup even on test failures. Note that you should also remove the manual cleanup line let _ = fs::remove_dir_all(dir); at the end of the test.

        let tmp = tempfile::tempdir().expect("tempdir");\n        let config_path = tmp.path().join(CONFIG_FILE_NAME);

Filesystem path used as network policy host

ctx.cwd is a filesystem directory (e.g., /workspace), but NetworkPolicyAmendment.host is documented as a network host. For file-access ask rules (e.g., edit_file with a path field), this proposes an amendment to allow the network host /workspace, which is syntactically invalid and would be presented to the user as a confusing or broken approval prompt. The pre-existing _ fallback also does this, but the ask-rule branch is new and can now be reached by non-shell tools. The proposed_network_policy_amendments field should either be empty (vec![]) for ask-rule matches, or populated with an actual resolved hostname extracted from the tool context.

matched_rule is silently None when Reject { rules: true } wins over a matching ask rule

The Reject { rules, .. } if *rules arm fires before the ask-rule arm, so matched_ask_rule is never set. The resulting ExecPolicyDecision exposes matched_rule: None even though a typed ask rule was the semantic cause of the rejection. This makes it harder to diagnose why a command was blocked. The test reject_rules_mode_still_forbids_matching_ask_rule explicitly asserts this behavior, but consider whether users should see the matching rule label for debuggability.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!