Use platform-aware clone path containment

[mchwang]

Summary

• evaluate clone containment with the active platform path separator
• cover Windows drive, case, and UNC boundaries with host-independent path.win32 fixtures
• retain real filesystem alias resolution coverage, using a junction when the suite runs on Windows

Tracks issue 36.

Validation

• Focused: npm test -- --run test/agent-clone.test.ts — 23 passed
• Typecheck: npm run typecheck — passed
• Affected non-Docker suite: 71 files, 1,900 tests passed
• Initial affected-suite attempt: 1 unrelated load timeout in test/review.test.ts, 1,899 passed; the timed-out test passed alone in 7.1 seconds, then the full affected suite passed cleanly
• GitHub real-Docker on exact head a6928a4260ffd1472b18540be39896bd0a487798: passed in 18m02s
• Windows filesystem execution: not run; drive/UNC/case coverage uses path.win32, while alias resolution ran on macOS. This PR does not claim full Windows support or Windows filesystem isolation.

Review record

• Self-review, base 396758fff9fb18133586284ad8ef25946b6469eb, head a6928a4260ffd1472b18540be39896bd0a487798: no findings
• Independent agent review, same base/head: no findings; noted the Windows filesystem execution limitation above
• Copilot balanced review, same base/head: approval recommended with 0 open findings
• Declined findings: none
• Regression evidence: the prior predicate failed four new cases (similarly named sibling, same-drive sibling, same-share UNC sibling, different-share UNC path); all pass after using the selected path semantics separator

Review lessons

No review findings required a new operating rule. The platform-aware separator requirement and the prohibition on claiming Windows isolation from lexical-only evidence are already captured in issue 36.

[Copilot]

🟢 Approval recommended

The containment fix is correct, focused, and adequately covered by regression tests.

0 open findings

What changed in this PR

Updates clone-path containment to respect host path semantics.

Changes:

• Adds platform-aware containment logic.
• Covers Windows drive, case, UNC, and junction behavior.

File	Description
git/​clone.ts	Introduces reusable platform-aware path containment.
test/​agent-clone.test.ts	Adds Windows path-boundary and junction coverage.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.