christophevg / yoker / 38403751696

85%

push

github

fix(guardrail): POSIX-normalize candidates, zero-or-more **/ semantics

Path-guardrail glob denylists (blocked_paths, blocked_write_paths)
never matched on Windows: compiled regexes only understand / while the
absolute-path matching candidate kept platform separators, and root-level
files depended on the POSIX abs-candidate accident because **/ compiled
to a regex requiring at least one preceding segment.

- _match_patterns_with_ancestors / is_path_blocked: absolute candidates
  are POSIX-normalized via Path.as_posix()
- _glob_to_regex: leading **/ and mid /**/ compile to (?:.*/)?  — zero
  or more segments; bare ** keeps legacy anything-matching; trailing
  /** still requires content below the directory
- tests: new TestGlobToRegexSemantics class pinning the translator

This is a security fix: on Windows, writes/updates to protected files
(Makefile, pyproject.toml, .git/hooks/*, ...) were allowed.

Verified: make check green (3403 passed, 8 skipped). Windows proof
lands with the next CI run.

🤖 Implemented together with Yoker

3668 of 4642 branches covered (79.02%)

Branch coverage included in aggregate %.

10858 of 12547 relevant lines covered (86.54%)

0.87 hits per line