* fix(console): accept Windows paths in the autopilot envelope
#4434 added Windows path parity across the console, but the autopilot
envelope's own path validator still rejected any `\`, and the downstream
`isProtectedPath` and `pathAllowed` guards compared with POSIX-only string
ops. The code is unreachable today because autopilot start is still gated
off on Windows (ap-windows-gate.spec.ts), but it is the next thing a
Windows user will trip on when that gate is lifted — the natural
`C:\work\app` form, and every UNC path, is refused with the opaque "is
not an absolute folder below the root with no .." error.
Four narrow fixes in `hooks/data/ap-envelope.ts`, driven by the
separator-aware helpers already in `hooks/data/paths.ts`:
- `isProtectedPath`: fold `\` to `/` on a drive-lettered or UNC path
before the protected-dir compare.
- `validateEnvelope` path check: drop the unconditional
`path.includes('\')` reject (it contradicted `isAbsolutePath` which
already accepts `C:\x` and `\srv\share`), and tighten the drive-root
regex `/^[A-Za-z]:\/?$/` → `/^[A-Za-z]:[\/]?$/` so `C:\` is still
refused explicitly (was previously caught by the backslash reject).
- `validateEnvelope` output canonicalisation: use `trimTrailing` instead
of `/\/+$/` replace, so a trailing `\` on a Windows path is stripped
the way `/` already is on POSIX.
- `pathAllowed`: use `hasParentSegment`, `samePath` and `below` from
paths.ts. A file at `C:\work\app\file.ts` is now inside envelope path
`C:\work\app` (and `c:\WORK\app\file.ts` is too), while
`C:\work\application\file.ts` still is not.
Semantics on a POSIX envelope are unchanged — the new helpers degrade
exactly to their old string ops when neither side is a Windows path.
New `tests/ap-envelope-windows-paths.spec.ts` pins what should and should
not be accepted (13 cases: backslash drive, forward-slash drive, UNC,
trailing-separator strip, `..`, bare-drive-root, protected-folder,
pathAllowed under case + separator variation, prefix-match rejection).
Verified on Windows 11: new spec 13/13, ap-core.spec.ts 31/31 (no POSIX
regression), 5 envelope-adjacent specs 64/64 combined, full console suite
3444 total · 3399 pass · 13 fail — same pre-existing baseline as #4434's
own run, zero regressions.
Follow-up to #4434 R1 (https://github.com/ruvnet/ruflo/pull/4434#issuecomment-6371423874).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix: keep the backslash reject for POSIX-rooted envelope paths
#4436 review (@ruvnet): dropping `path.includes('\')` outright also
dropped the refusal for a POSIX-rooted path with backslashes smuggled
in. `/work/app\..\..\other` passes `isAbsolutePath` (POSIX form), and
`hasParentSegment` splits POSIX-only when `isWindowsPath` says the path
is not Windows, so the `..` segments are invisible to it. On a Windows
host, that leading-`/` path then resolves to `\other`, outside the
folder the user named. Unreachable today because autopilot is still
gated off on Windows, but it is the guard that gate's removal depends
on.
Keep the backslash reject, but only for non-Windows paths (POSIX
should never have `\` in its path). The native Windows forms
`C:\work\app` and `\srv\share\app` continue to pass; the mixed
`/work/app\..\..\other` form is refused as before.
Added case to tests/ap-envelope-windows-paths.spec.ts.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: RuFlo <ruv@ruv.net>
