iceweasel-oai 34e74fda0e Align deny-read matching with executor path semantics (#41209) ...

## Why

Read-deny policies must use the target executor's path convention so URI-based
policy checks and native filesystem enumeration enforce the same rules.

## What changed

- Prepare deny roots and glob matchers from `PathUri` policy context, including
  executor-relative working directories and home-relative patterns.
- Match Windows globs case-insensitively with normalized separators, while
  preserving byte-oriented POSIX matching for non-UTF-8 paths.
- Fail closed for malformed paths, incompatible path conventions, unresolved
  home-relative patterns, and invalid globs.
- Make Windows deny-read discovery use case-insensitive ripgrep glob matching.

## Testing

Added coverage for Windows URI conventions, executor home expansion,
case-insensitive `.env` discovery, malformed paths, non-UTF-8 names, and
canonical directory-link targets.

GitOrigin-RevId: 36001219a2e9b36acfce8972dc1d3bbc304271c5

2026-08-27 21:15:37 +00:00

..

absolute_path_normalization.rs

path-uri: normalize parent segments in absolute joins (#29903)

2026-06-24 22:33:18 +00:00

api_path_string_tests.rs

Preserve filesystem permission path conventions (#39084)

2026-08-17 21:49:30 +00:00

api_path_string.rs

Preserve special filesystem subpaths as wire strings (#33107)

2026-07-14 16:40:13 +00:00

lib.rs

Align deny-read matching with executor path semantics (#41209)

2026-08-27 21:15:37 +00:00

native_path_bytes.rs

Validate linked worktrees before inheriting project trust (#39616)

2026-08-20 06:29:32 +00:00

tests.rs

Make filesystem policy matching URI-native (#41001)

2026-08-26 23:49:05 +00:00