fix(paths): keep IsSubpath case-sensitive; fold only for exclusion

Review found that making the shared IsSubpath case-insensitive on
Windows/macOS weakened fail-closed containment gates. IsSubpath is used
both for protected-path EXCLUSION and for allow/containment checks
(rewind.legacyFallbackTranscriptPath, utils.openAllowedRoot). Folding is
safe only for exclusion (over-match => over-exclude); for a fail-closed
gate it fails open. On a case-sensitive volume under GOOS=darwin, a
crafted `.Entire/metadata` trailer would pass containment yet resolve to
a different on-disk directory than the strict check intended.

Revert IsSubpath to case-sensitive (the correct primitive for
containment) and add IsProtectedSubpath, which applies the OS-based
case fold and is documented as exclusion-only. Route the exclusion
callers through it (IsInfrastructurePath, the protected-dir loops in
state.go/ephemeral.go/common.go); leave the rewind/utils containment
gates on strict IsSubpath.

Tests: IsSubpath is asserted case-sensitive on all OSes; folding moves
to IsProtectedSubpath; add a legacyFallbackTranscriptPath case proving a
case-variant metadata dir fails closed on every platform.

Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Entire-Checkpoint: 01KXK5A53886X5ZEZHQFPGBEJ0

Author: pjbgf

cmd/entire/cli/checkpoint/ephemeral.go

@@ -1217,7 +1217,7 @@ func isProtectedCheckpointPath(relPath string) bool {
 		}
 	}
 	for _, dir := range agent.AllProtectedDirs() {
-		if paths.IsSubpath(filepath.Clean(filepath.FromSlash(dir)), cleanPath) {
+		if paths.IsProtectedSubpath(filepath.Clean(filepath.FromSlash(dir)), cleanPath) {
 			return true
 		}
 	}

cmd/entire/cli/paths/paths.go

@@ -134,48 +134,65 @@ func AbsPath(ctx context.Context, relPath string) (string, error) {
 }
 
 // IsInfrastructurePath returns true if the path is part of CLI infrastructure
-// (i.e., inside the .entire directory)
+// (i.e., inside the .entire directory). It is used only to EXCLUDE infra paths
+// from checkpoints/tracking, so it matches case-insensitively on
+// case-insensitive filesystems via IsProtectedSubpath. Do not use it as a
+// containment/allow gate.
 func IsInfrastructurePath(path string) bool {
-	return IsSubpath(EntireDir, path)
+	return IsProtectedSubpath(EntireDir, path)
 }
 
 // IsSubpath reports whether child is lexically under parent (or equal to it).
 // It uses filepath.Rel, which cleans both inputs and is traversal-resistant:
 // a crafted child like "/a/b/../../../etc/passwd" that escapes parent will
 // produce a relative path starting with ".." and be rejected.
 //
-// Matching honors the host OS's case sensitivity (see CaseInsensitiveFS): on
-// Windows/macOS ".Claude/x" is under ".claude" because they name the same
-// directory there, while on case-sensitive Linux they remain distinct. Folding
-// only ever widens containment to case variants of the same on-disk path; real
-// traversal escapes are still rejected regardless of case, so this cannot be
-// used to slip past a containment check.
+// Matching is case-SENSITIVE. This is the correct primitive for fail-closed
+// containment/allow checks (e.g. validating an attacker-influenced path stays
+// under an Entire-owned dir): on a case-sensitive volume a differently-cased
+// path names a different directory, so folding it in would fail open. For
+// EXCLUSION decisions that must also catch case variants on Windows/macOS, use
+// IsProtectedSubpath instead.
 func IsSubpath(parent, child string) bool {
-	if CaseInsensitiveFS() {
-		parent = strings.ToLower(parent)
-		child = strings.ToLower(child)
-	}
 	rel, err := filepath.Rel(parent, child)
 	if err != nil {
 		return false
 	}
 	return !IsRelativeTraversal(rel)
 }
 
+// IsProtectedSubpath reports whether child is under parent for the purpose of
+// EXCLUDING protected/infrastructure content from checkpoints and tracking.
+// Unlike IsSubpath it honors OS case-insensitivity (see CaseInsensitiveFS), so
+// a case variant of a protected dir (".Claude" vs ".claude") is still excluded
+// on Windows/macOS.
+//
+// SECURITY: never use this for allow/containment decisions. Case-folding widens
+// what counts as "inside" parent, which is safe only when the effect is to
+// exclude more. On a case-sensitive volume under a case-insensitive GOOS it
+// over-matches; for a fail-closed gate that would fail open. Use IsSubpath there.
+func IsProtectedSubpath(parent, child string) bool {
+	if CaseInsensitiveFS() {
+		return IsSubpath(strings.ToLower(parent), strings.ToLower(child))
+	}
+	return IsSubpath(parent, child)
+}
+
 // CaseInsensitiveFS reports whether path comparisons should be case-insensitive
 // on the host OS. This is OS-based, not volume-based: Windows and macOS default
 // to case-insensitive filesystems, Linux to case-sensitive. Keying on GOOS keeps
-// the result deterministic; on an atypical volume (e.g. a case-sensitive macOS
-// APFS volume) the only effect is that the exclusion/containment checks treat a
-// differently-cased path as matching, which merely over-excludes — the safe
-// direction for filters whose job is to keep sensitive paths out.
+// the result deterministic. It must only influence EXCLUSION decisions (see
+// IsProtectedSubpath / Equal): on an atypical volume (e.g. a case-sensitive
+// macOS APFS volume) it treats a differently-cased path as matching, which is
+// safe only when the effect is to exclude more, never to widen an allow gate.
 func CaseInsensitiveFS() bool {
 	return runtime.GOOS == osWindows || runtime.GOOS == osDarwin
 }
 
-// Equal reports whether two paths refer to the same location, honoring the
-// host OS's case sensitivity (see CaseInsensitiveFS). Both inputs are cleaned
-// and slash-normalized before comparison.
+// Equal reports whether two paths refer to the same location, honoring the host
+// OS's case sensitivity (see CaseInsensitiveFS). Both inputs are cleaned and
+// slash-normalized before comparison. Like IsProtectedSubpath, this is intended
+// for EXCLUSION matching (e.g. protected files), not fail-closed containment.
 func Equal(a, b string) bool {
 	a = filepath.Clean(filepath.FromSlash(a))
 	b = filepath.Clean(filepath.FromSlash(b))

cmd/entire/cli/paths/paths_test.go

@@ -104,24 +104,39 @@ func TestCaseInsensitiveFS(t *testing.T) {
 	}
 }
 
-// TestIsSubpath_CaseSensitivity and TestEqual_CaseSensitivity assert the
-// OS-based folding: case variants of a protected path are matched on
-// Windows/macOS (where they name the same file) and remain distinct on
-// case-sensitive Linux.
-func TestIsSubpath_CaseSensitivity(t *testing.T) {
+// TestIsSubpath_AlwaysCaseSensitive locks in that IsSubpath — the fail-closed
+// containment primitive used by allow gates (rewind/utils) — never folds case
+// on any OS. A differently-cased path must not count as contained, or a
+// crafted, attacker-influenced value could fail open on a case-sensitive volume.
+func TestIsSubpath_AlwaysCaseSensitive(t *testing.T) {
 	t.Parallel()
-	// On a case-insensitive FS these name the same dir, so containment holds.
-	got := IsSubpath(".claude", ".Claude/marker.txt")
-	if got != CaseInsensitiveFS() {
-		t.Errorf("IsSubpath(.claude, .Claude/marker.txt) = %v, want %v (GOOS=%s)",
-			got, CaseInsensitiveFS(), runtime.GOOS)
+	if IsSubpath(".entire/metadata", ".Entire/metadata") {
+		t.Error("IsSubpath must be case-sensitive (fail-closed); .Entire/metadata must not be under .entire/metadata")
 	}
-	// Same case is always a subpath; traversal is always rejected, regardless of case.
 	if !IsSubpath(".claude", ".claude/marker.txt") {
 		t.Error("IsSubpath(.claude, .claude/marker.txt) = false, want true")
 	}
-	if IsSubpath(".claude", ".Claude/../../etc/passwd") {
-		t.Error("IsSubpath must reject traversal even when case-folding")
+	if IsSubpath(".claude", ".claude/../../etc/passwd") {
+		t.Error("IsSubpath must reject traversal")
+	}
+}
+
+// TestIsProtectedSubpath_CaseSensitivity asserts OS-based folding for the
+// EXCLUSION helper: case variants match on Windows/macOS (where they name the
+// same on-disk path), stay distinct on case-sensitive Linux, and traversal is
+// always rejected.
+func TestIsProtectedSubpath_CaseSensitivity(t *testing.T) {
+	t.Parallel()
+	got := IsProtectedSubpath(".claude", ".Claude/marker.txt")
+	if got != CaseInsensitiveFS() {
+		t.Errorf("IsProtectedSubpath(.claude, .Claude/marker.txt) = %v, want %v (GOOS=%s)",
+			got, CaseInsensitiveFS(), runtime.GOOS)
+	}
+	if !IsProtectedSubpath(".claude", ".claude/marker.txt") {
+		t.Error("IsProtectedSubpath(.claude, .claude/marker.txt) = false, want true")
+	}
+	if IsProtectedSubpath(".claude", ".Claude/../../etc/passwd") {
+		t.Error("IsProtectedSubpath must reject traversal even when case-folding")
 	}
 }
 

cmd/entire/cli/rewind_test.go

@@ -75,6 +75,15 @@ func TestLegacyFallbackTranscriptPath(t *testing.T) {
 			metadataDir: ".entire",
 			want:        "",
 		},
+		{
+			// Containment is a fail-closed allow gate: it must stay case-SENSITIVE
+			// on every OS. A case variant names a different on-disk dir on a
+			// case-sensitive volume (which exists under GOOS=darwin), so folding it
+			// in would fail open. Must return "" regardless of platform.
+			name:        "case-variant of metadata dir fails closed on all OSes",
+			metadataDir: ".Entire/metadata/sess-123",
+			want:        "",
+		},
 	}
 
 	for _, tt := range tests {

cmd/entire/cli/state.go

@@ -245,7 +245,7 @@ func shouldIgnoreSessionTrackingPath(relPath string) bool {
 
 	for _, dir := range agent.AllProtectedDirs() {
 		cleanDir := filepath.Clean(filepath.FromSlash(dir))
-		if paths.IsSubpath(cleanDir, cleanPath) {
+		if paths.IsProtectedSubpath(cleanDir, cleanPath) {
 			return true
 		}
 	}

cmd/entire/cli/strategy/common.go

@@ -352,7 +352,7 @@ const (
 // registered agent config directories.
 func isProtectedPath(relPath string) bool {
 	for _, dir := range protectedDirs() {
-		if paths.IsSubpath(dir, relPath) {
+		if paths.IsProtectedSubpath(dir, relPath) {
 			return true
 		}
 	}