fix(tui): preserve Windows verbatim-path operands through POSIX word split

[aboimpinto]

Summary

Fixes the two Windows CI failures that block FEAT-019 (PR #5609):

• tools::shell::tests::readonly_operands_are_workspace_bounded_and_symlink_aware
• tools::subagent::tests::read_only_inspection_roles_execute_pwd_and_absolute_git_log

Root cause

enforce_readonly_workspace_operands (and hardened_readonly_argv) tokenize the read-only command with shell_words::split, which follows POSIX backslash-escaping. On Windows, Path::canonicalize returns verbatim device paths (\\?\C:\...); the POSIX splitter silently eats the separators of any backslash path (C:\Users\... → C:Users..., \\?\C:\... → \?C:...).

The previous fix (4285710) stripped the \\?\ prefix after the split and only for key=value operands (token.split_once('=')). The failing tests pass the canonical path as a bare space-separated token (cat <path>, git -C <path> log), so the splitter already mangled it before the strip could run — the refusal then happened on the mangled spelling.

Fix

Normalize Windows absolute path spellings before any POSIX-style splitter or glob-charset gate via a shared normalize_windows_command_paths in crates/tui/src/command_safety.rs:

• strips the \\?\ verbatim prefix (Path::canonicalize artifact) whose ? trips the classifiers' glob-charset gate; \\.\ device paths are preserved verbatim;
• doubles the backslashes of Windows-absolute-path-like words (drive letter + :, verbatim, or UNC prefix) so shlex/shell_words round-trip the real path instead of C:\Users\... collapsing to C:Users....

Applied at all judging sites:

• is_agent_readonly_shell_command and is_parallel_readonly_command (command_safety.rs) — the subagent posture gate;
• both shell_words::split sites in shell.rs (enforce_readonly_workspace_operands and hardened_readonly_argv).

Only Windows-absolute-path-like words are touched — POSIX escapes (echo a\ b) and unix hosts are unaffected.

Testing

• cargo fmt --all -- --check
• New unit tests: verbatim/drive/UNC/device operands survive the POSIX split round-trip; the agent classifier admits verbatim-prefixed git -C commands; POSIX escapes and drive-relative spellings untouched
• tools::shell module — 139 passed
• tools::subagent module — 555 passed
• Clippy -D warnings on codewhale-tui — 0 warnings

The definitive validation is the Windows CI job (Linux cannot reproduce verbatim-path canonicalization); a green Test (windows-latest) on this PR unblocks FEAT-019.

Paulo Aboim Pinto

No-Issue: this fix unblocks FEAT-019 (PR #5609); umbrella #5316 must remain open for the remaining decomposition FEATs.

Paulo Aboim Pinto

[Hmbown]

Thank you for this — I verified it and it is doing more work than the title suggests: this PR unblocks the whole open-PR queue.

main (6110159) is currently red on two required checks, and every open PR inherits both:

1. Test (windows-latest) — tools::shell::tests::readonly_operands_are_workspace_bounded_and_symlink_aware and tools::subagent::tests::read_only_inspection_roles_execute_pwd_and_absolute_git_log fail identically on feat(tui): show tool and MCP schema costs (#5603) #5611 and refactor(tui): adopt command shapes in memory group (FEAT-019) #5609. Your diagnosis is right and it is the part feat(runtime): 0.9.12 relay integration — unify managed Chat with native runtime threads #5606 missed: feat(runtime): 0.9.12 relay integration — unify managed Chat with native runtime threads #5606 stripped the \\?\ prefix at classification time, but shell_words::split had already eaten the separators, so the operand arrived as \\?C:UsersrunneradminAppData.... Normalizing before the split is the correct place.
2. Version drift — reproduced against origin/main:

   ::error::Feature commit 6110159bd0bb references #5604, but no release-note receipt exists in CHANGELOG.md docs/CHANGELOG_ARCHIVE.md.
   

   Your (#5589) → (#5604, covers #5589) edit is exactly the right fix, and it is the only PR in the queue carrying it.

Your run is green on both Version drift and Test (windows-latest) (only Test (macos-latest) was still running when I checked).

One non-blocking observation for the record, not a change request: normalize_windows_command_paths runs the \\?\ strip and the backslash-doubling on all platforms, and its output feeds hardened_readonly_argv, which builds the argv that actually executes. So a POSIX operand containing a literal \\?\ or \\ prefix would be rewritten there too. In practice no real POSIX command looks like that, and keeping it platform-independent is what lets the classifier tests run on every runner, which is worth more than the edge case. Flagging it only so the tradeoff is written down.

Nice, well-tested fix — the windows_verbatim_and_drive_operands_survive_posix_split table covering \\?\, drive, UNC, and device spellings is exactly the right shape.

[Hmbown]

Follow-up: every check is now green — Test (macos-latest) came back pass (42m35s), so the full matrix plus Version drift, Lint, Safety gate and the rest are all passing. mergeStateStatus: CLEAN.

For the record on why this one matters more than its diff size suggests — the two gates it fixes are currently red on five other open PRs (#5592, #5593, #5594, #5611, and #5609's Windows lane), all inheriting the breakage from main rather than causing it. This PR is the single change that clears both.

[aboimpinto]

CI is fully green, including the previously failing Test (windows-latest) job (19m53s). The fix normalizes Windows verbatim/backslash path spellings at every judging site (both command_safety classifiers and both shell.rs split sites), so:

• tools::shell::tests::readonly_operands_are_workspace_bounded_and_symlink_aware ✅
• tools::subagent::tests::read_only_inspection_roles_execute_pwd_and_absolute_git_log ✅

Once merged, FEAT-019 (PR #5609) will be rebased and its Windows job should go green as well. Ready for review/merge.

Paulo Aboim Pinto