[trek-e]

Fix PR

Linked Issue

Fixes #5519

What was broken

/gsd-code-review --files reported every file as outside the repository on Windows Git Bash and ended with an empty scope. The Tier 1 containment guard compared git rev-parse --show-toplevel (mixed form, C:/Users/...) against realpath -m output (MSYS POSIX form, /c/Users/...) with a bare "$REPO_ROOT"* prefix test, so no path could ever match. The bare prefix also had no path boundary, so a sibling directory sharing the repository's name prefix was accepted on every platform.

What this fix does

gsd-core/workflows/code-review.md Tier 1 now normalizes both sides through cygpath -m when it exists (a no-op elsewhere), and tests equality-or-root/ boundary instead of a bare prefix. It still fails closed: an empty root, an unresolved .., or a missing realpath (macOS) reports the entry as outside. <platform_notes> documents the cygpath behaviour.

Root cause

Two path forms from two tools compared as strings, plus a prefix test with no boundary. Introduced with the original command (#1630) and recorded as a known unfixed limitation in the #4460 test docblock.

Testing

How I verified the fix

tests/code-review-tier3-files-override-scoping.test.cjs gains a describe "#5519: Tier 1 --files containment guard" that extracts and runs the real fence from code-review.md in bash with stubbed git/realpath/cygpath emitting the Git Bash forms (relative, POSIX-absolute and mixed-absolute accepted; escapes and siblings rejected), a real-bash sibling/escape case, and the fail-closed cases. RED on the test-only commit failed 4 tests (run on 333dfbb81d). GREEN: 54264 tests, 0 failed on 3b8bfe9f59.

Regression test added?

• Yes

Platforms tested

• Linux (gsd-test, linux-node24, head 3b8bfe9, passed)

Runtimes tested

• N/A (not runtime-specific)

Self-test report

{
  "schema": 1,
  "head_sha": "3b8bfe9f593951b9b7003257ed0b49136ebd6ce4",
  "tool": "gsd-test",
  "failing_first": { "test": "tests/code-review-tier3-files-override-scoping.test.cjs (#5519 describe)", "fails_on_base": true, "passes_on_head": true },
  "commands": ["gsd-test --base next --head 3b8bfe9f593951b9b7003257ed0b49136ebd6ce4"],
  "full_suite": { "command": "gsd-test", "result": "passed" },
  "environment": { "os": "darwin driver, linux-node24 bench", "node": "24" },
  "output_excerpt": "verdict passed on linux-node24, head 3b8bfe9f59"
}

Notes for the reviewer

• One separate commit carries the 3-line package-lock.json change (ip-address 10.7.2 to 10.7.4, GHSA-rxp7-6hxx-x8q5): tests/npm-integrity-gate.test.cjs fails every bench run while the old version is locked. The same hunk is in other open PRs; identical hunks merge cleanly.
• The real-bash cases skip when GNU realpath is missing; the Git Bash forms are exercised through stubs, so a live Windows run is still the final confirmation.

Checklist

• Issue linked above with Fixes #NNN
• Linked issue has the confirmed-bug label
• Fix is scoped to the reported bug (lockfile commit called out above)
• Regression test added
• All existing tests pass
• .changeset/ fragment added
• No unnecessary dependencies added

Breaking changes

None.

🤖 Generated with Claude Code