fix(foundation): match Windows system trees by first component only

"Users" was matched the way credential directory names are — against every
path component. On Windows every user's files live under C:\Users\<name>, so
that refused every ordinary project path, including a CI runner's own
workspace. The Windows smoke job on the pull request caught it; the unit
tests could not, because they only ever run compiled on macOS here.

System trees (Windows, ProgramData, Program Files) now match only as the
first component below the drive, which still refuses anything inside them at
any depth. "Users" is handled separately as the tree root only, mirroring
POSIX where "/Users" is refused but "/Users/dev/projects" is not.

Tests cover the regression directly: C:/Users/dev/projects/app and
C:/Users/runneradmin/work/repo are allowed, C:/Users is not, C:/Windows/System32
is refused at depth, and C:/dev/Windows-app — merely named after a system
tree — is allowed.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

src/foundation/workspace.c

@@ -147,12 +147,44 @@ static const char *const WS_CREDENTIAL_NAMES[] = {
     ".authinfo",
 };
 
-/* Windows top-level trees below the drive. Small and stable enough to list,
- * which is what lets Windows use a shallower depth minimum. */
-static const char *const WS_WINDOWS_SYSTEM_DIRS[] = {
-    "Windows", "Users", "ProgramData", "Program Files", "Program Files (x86)",
+/* Windows system trees, matched only as the FIRST component below the drive.
+ * Nothing legitimate is indexed inside them at any depth.
+ *
+ * "Users" is deliberately NOT here. Every Windows user's files live under
+ * C:\Users\<name>, so matching it the way credential names are matched — against
+ * every component — refuses every ordinary Windows project path. It is handled
+ * below as the tree root only, mirroring POSIX where "/Users" is refused but
+ * "/Users/dev/projects" is not. */
+static const char *const WS_WINDOWS_SYSTEM_TREES[] = {
+    "Windows",
+    "ProgramData",
+    "Program Files",
+    "Program Files (x86)",
 };
 
+/* Roots that are the tree itself rather than something inside it. */
+static const char *const WS_WINDOWS_USER_TREE = "Users";
+
+/* Match only the first component below the volume prefix. */
+static bool ws_first_component_matches(const char *path, const char *const *names, size_t count,
+                                       bool fold_case) {
+    const char *p = path + ws_volume_prefix_len(path);
+    while (ws_is_sep(*p)) {
+        p++;
+    }
+    const char *start = p;
+    while (*p && !ws_is_sep(*p)) {
+        p++;
+    }
+    size_t len = (size_t)(p - start);
+    for (size_t i = 0; i < count; i++) {
+        if (ws_component_equals(start, len, names[i], fold_case)) {
+            return true;
+        }
+    }
+    return false;
+}
+
 static bool ws_any_component_matches(const char *path, const char *const *names, size_t count,
                                      bool fold_case) {
     size_t prefix = ws_volume_prefix_len(path);
@@ -257,10 +289,17 @@ cbm_ws_verdict_t cbm_workspace_classify_root(const char *canonical_path, const c
         return CBM_WS_DENY_SENSITIVE;
     }
 
-    if (windows_style &&
-        ws_any_component_matches(canonical_path, WS_WINDOWS_SYSTEM_DIRS,
-                                 sizeof(WS_WINDOWS_SYSTEM_DIRS) / sizeof(WS_WINDOWS_SYSTEM_DIRS[0]),
-                                 true)) {
+    if (windows_style && ws_first_component_matches(canonical_path, WS_WINDOWS_SYSTEM_TREES,
+                                                    sizeof(WS_WINDOWS_SYSTEM_TREES) /
+                                                        sizeof(WS_WINDOWS_SYSTEM_TREES[0]),
+                                                    true)) {
+        return CBM_WS_DENY_SENSITIVE;
+    }
+
+    /* "C:/Users" is the user tree itself — refuse it as a root, but leave the
+     * projects below it alone; that is where Windows users actually work. */
+    if (windows_style && depth == 1 &&
+        ws_first_component_matches(canonical_path, &WS_WINDOWS_USER_TREE, 1, true)) {
         return CBM_WS_DENY_SENSITIVE;
     }
 

tests/test_workspace.c

@@ -107,6 +107,18 @@ TEST(ws_credential_directories_are_sensitive_at_any_depth) {
 TEST(ws_windows_system_trees_are_sensitive) {
     ASSERT_EQ(cbm_workspace_classify_root("C:/Windows", HOME, CACHE), CBM_WS_DENY_SENSITIVE);
     ASSERT_EQ(cbm_workspace_classify_root("C:/Users", HOME, CACHE), CBM_WS_DENY_SENSITIVE);
+    /* THE regression that matters on Windows: every user's work lives under
+     * C:\Users\<name>, so matching "Users" against every component would refuse
+     * every ordinary project path — including a CI runner's own workspace. Only
+     * the tree root is refused. */
+    ASSERT_EQ(cbm_workspace_classify_root("C:/Users/dev/projects/app", HOME, CACHE), CBM_WS_ALLOW);
+    ASSERT_EQ(cbm_workspace_classify_root("C:/Users/runneradmin/work/repo", HOME, CACHE),
+              CBM_WS_ALLOW);
+    /* System trees are refused at any depth inside them, not just at the root. */
+    ASSERT_EQ(cbm_workspace_classify_root("C:/Windows/System32", HOME, CACHE),
+              CBM_WS_DENY_SENSITIVE);
+    /* A project merely named after one is not one. */
+    ASSERT_EQ(cbm_workspace_classify_root("C:/dev/Windows-app", HOME, CACHE), CBM_WS_ALLOW);
     ASSERT_EQ(cbm_workspace_classify_root("C:/ProgramData", HOME, CACHE), CBM_WS_DENY_SENSITIVE);
     ASSERT_EQ(cbm_workspace_classify_root("C:/Program Files/app", HOME, CACHE),
               CBM_WS_DENY_SENSITIVE);