Function resolveCwdReentry

src/tools/PowerShellTool/gitSafety.ts:23–38

* If a normalized path starts with `../ /`, it re-enters cwd * via the parent — resolve it to the cwd-relative form. posix.normalize * preserves leading `..` (no cwd context), so `../project/hooks` with * cwd=/x/project stays `../project/hooks` and misses the `hooks/` prefix * match

(normalized: string)

 * resolves against cwd to `hooks`.
 */
function resolveCwdReentry(normalized: string): string {
  if (!normalized.startsWith('../')) return normalized
  const cwdBase = basename(getCwd()).toLowerCase()
  if (!cwdBase) return normalized
  // Iteratively strip `../<cwd-basename>/` pairs (handles `../../p/p/hooks`
  // when cwd has repeated basename segments is unlikely, but one-level is
  // the common attack).
  const prefix = '../' + cwdBase + '/'
  let s = normalized
  while (s.startsWith(prefix)) {
    s = s.slice(prefix.length)
  }
  // Also handle exact `../<cwd-basename>` (no trailing slash)
  if (s === '../' + cwdBase) return '.'
  return s
}

/**
 * Normalize PS arg text → canonical path for git-internal matching.