Skip to content

fix(plugin): harden Windows path boundaries - #55

Open
Mineru98 wants to merge 2 commits into
Ouro-labs:release/bootstrapfrom
Mineru98:fix/windows-path-boundaries
Open

fix(plugin): harden Windows path boundaries#55
Mineru98 wants to merge 2 commits into
Ouro-labs:release/bootstrapfrom
Mineru98:fix/windows-path-boundaries

Conversation

@Mineru98

@Mineru98 Mineru98 commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Problem

Windows path forms can be normalized differently from Unix paths. Without consistent handling, plugin and config paths can look valid while still pointing outside the intended boundary.

Proposed change

  • Normalize Windows-style paths before path boundary checks.
  • Keep plugin entrypoints and config paths inside their expected directories.
  • Update tests to cover portable path behavior across Windows and Unix-style inputs.

Acceptance criteria

  • Windows drive, separator, and traversal cases are handled consistently.
  • Plugin path validation rejects paths that escape the plugin boundary.
  • Existing config and transport tests continue to pass.

Verification

  • git diff --check
  • mix format --check-formatted on changed Elixir files
  • mix test test/ourocode/config/raw_loader_test.exs test/ourocode/plugin/path_policy_test.exs test/ourocode/command/registry/skill_loader_test.exs test/ourocode/mcp/transport/stdio_test.exs test/ourocode/mcp/transport/stdio_cleanup_test.exs test/ourocode/terminal/interview_panel/text_test.exs -> 42 passed

Closes #50

Mineru98 and others added 2 commits July 8, 2026 01:05
Propagated from the v0.1.15 integration branch so these survive the merge:
- test_helper: drive port programs with `erl` directly (not elixir.bat) to
  avoid the Windows stdout-pipe break; operations travel as a base64 term.
- stdio_test: give the timing test's handshake asserts a 15s ceiling to
  tolerate erl cold start on Windows CI (keeps the 5s delivery SLA).
- .gitattributes: eol=lf so CRLF-sensitive fixtures behave on Windows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mineru98 added a commit to Mineru98/ourocode that referenced this pull request Jul 21, 2026
The full-suite windows-ci needs code from sibling PRs (path/CRLF/port test
fixes live in Ouro-labs#52/Ouro-labs#55), so it cannot pass on this branch alone. Keep it on
the v0.1.15 integration branch, where the merged tree is green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mineru98 added a commit to Mineru98/ourocode that referenced this pull request Jul 21, 2026
Both this PR and Ouro-labs#55 carry Ourocode.Test.PortPrograms; Ouro-labs#55 rewrote the
helpers to spawn `erl` directly (Windows stdout-pipe fix). Match that here
so the two copies are byte-identical: the branches then auto-merge with no
test_helper.exs conflict, and this PR is Windows-safe on its own.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Normalize Windows paths without weakening plugin path boundaries

1 participant