Refuse a Windows Drive Component Anywhere in a Tree Path

[ptr727]

escapes_repo_root in spec/validate.py matched a Windows drive only at the start of a value, and relative_root in scripts/carry.py matched none. Both tools walk a tree path one component at a time with current /= part, and on Windows joining a component that carries a drive, such as C:x, discards everything joined before it. A value such as real/C:x passed both.

• escapes_repo_root now refuses a component whenever PureWindowsPath(part).drive is non-empty. That is wider than a letter, since Windows reads any character followed by a colon as a drive (1:x, _:x).
• relative_root refuses a component whenever PureWindowsPath(part).anchor is non-empty, which also covers a leading backslash. That spelling resets the walk to the drive root in the same way, and escapes_repo_root already refuses it.
• Each suite has a test refusing these values. Both tests fail when the fix is reverted.

The local review pass also found that relative_root still accepts a backslash in the middle of a component. That gap predates this change and is filed as #2246.

Closes on promotion: #2244

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: ptr727/ProjectTemplate/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 0e1493dd-f0d5-4266-86ff-f221d1638010

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@fbaa528). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #2247   +/-   ##
==========================================
  Coverage           ?   56.69%           
==========================================
  Files              ?       16           
  Lines              ?     7495           
  Branches           ?        0           
==========================================
  Hits               ?     4249           
  Misses             ?     3246           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	56.69% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The change tightens security-adjacent path validation across two fleet tools and the shared spec, so final human review is warranted despite the change being small and well-tested.

Review effort: Balanced
Findings: None

What changed in this PR

This PR hardens path validation in two fleet tools so a Windows drive-shaped component is refused anywhere in a declared tree path, not only at the start. On Windows, joining a drive-relative component such as C:x onto a path discards everything joined before it, so a value like real/C:x could previously slip past validation and, in spec/validate.py, trigger an uncaught ValueError crash in the downstream symlink walk. The change closes that gap in both the spec validator and the carrier, keeping their refusal behavior aligned.

Changes:

• escapes_repo_root in spec/validate.py now refuses a component whenever PureWindowsPath(part).drive is non-empty (any character followed by a colon), replacing the start-only ^[A-Za-z]: regex.
• relative_root in scripts/carry.py refuses a component whenever PureWindowsPath(part).anchor is non-empty, covering both a drive and a leading-backslash root, before the path is joined or walked.
• Added tests in both suites asserting these values are refused; both fail if the fix is reverted.

File	Description
spec/​validate.py	Refuse a drive-shaped component in any position of a tree path and reuse the parsed parts, preventing a later crash.
scripts/​carry.py	Reject a Windows drive or root in any component before joining/walking the path.
tests/​test_spec_validate.py	Extend the drive-letter refusal test with mid-path and digit-colon components.
tests/​test_carry.py	Add a test covering drive, root, and backslash components refused by relative_root.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.