@@ -19,7 +19,7 @@
  *  What is refused, and why:
  *    - outside the workspace folders                          (a mount is the boundary)
  *    - repository / tool metadata and instruction files       (a script can hide `rm -rf .git`, or write
- *                                                              .vscode/settings.json or AGENTS.md, which later
+ *      (in any letter case: .GIT is .git on most disks)        .vscode/settings.json or AGENTS.md, which later
  *                                                              steer the agent with the user's authority)
  *    - binary, non-UTF-8, BOM or over 1 MiB                   (the review snapshots text; Undo would write
  *                                                              mangled bytes back)
@@ -37,7 +37,8 @@
 'use strict';
 
 /**
- * Never changed by a command, in either direction. Matched against the path RELATIVE to its workspace folder.
+ * Never changed by a command, in either direction. Matched against the path RELATIVE to its workspace folder, folded
+ * (foldCase): written in lower case, they match every spelling a disk that ignores case takes for the same name.
  * The user's own terminal is not held to this (it is the user typing); an agent's command is.
  */
 const PROTECTED = [
@@ -114,8 +115,20 @@ function reviewPathFor(abs, folders) {
 	return { rel, review: folders.length > 1 ? best.name + '/' + rel : rel };
 }
 
+/**
+ * A name as a disk that ignores case sees it. The usual folder from the computer is on one (APFS on a Mac, NTFS on
+ * Windows), and there `.GIT/config` IS `.git/config`: matched as typed, a command wrote the repository's config by
+ * spelling it in capitals. NFC first, as the shell folds names in its own commit (web/shell/src/commit.js); then
+ * upper case before lower case, so that the letters lower-casing alone leaves as they are — U+017F (long s) and U+0131
+ * (dotless i), which upper-case to S and I — land on the plain letter too (U+212A, the Kelvin sign, is K once
+ * normalised). Wider than any one disk, which only ever refuses a name nobody would choose. Letter case and Unicode
+ * form only: a name a disk treats as another for some other reason is not folded here.
+ * @param {string} s
+ */
+function foldCase(s) { return s.normalize('NFC').toUpperCase().toLowerCase(); }
+
 /** @param {string} rel */
-function isProtected(rel) { return PROTECTED.some((re) => re.test(rel)); }
+function isProtected(rel) { const folded = foldCase(rel); return PROTECTED.some((re) => re.test(folded)); }
 
 /**
  * @typedef {import('./host').Change} Change
 
@@ -161,6 +161,28 @@ const ids = (out) => out.failed.map((f) => f.c.path).sort();
 		for (const p of ['gitlab.md', 'src/vscode.js', 'docs/AGENTS.txt', '.github/ISSUE_TEMPLATE/bug.md', 'README.md']) { assert.ok(!isProtected(p), p + ' is not protected'); }
 	});
 
+	await test('protected paths are refused in any letter case: on a disk that ignores case (the usual folder from the computer) .GIT/config IS .git/config', async () => {
+		// The reported command: printf '[core]\n\tfsmonitor = sh evil.sh\n' > .GIT/config — it was applied.
+		const r = rig({ '/ws/.GIT/config': '[core]\n' });
+		const out = await commitShellChanges([W('/ws/.GIT/config', '[core]\n\tfsmonitor = sh evil.sh\n', '[core]\n')], r.ctx, r.io);
+		assert.strictEqual(out.refused, true);
+		assert.deepStrictEqual(r.edits, []);
+		assert.match(out.notes[0], /refused: \.GIT\/config — repository metadata/);
+		const folded = ['.Git/hooks/pre-commit', 'sub/.GIT/config', '.VSCODE/tasks.json', '.VsCode/settings.json', '.LevelCode/mcp.json', '.CURSOR/rules/x.mdc',
+			'.Husky/pre-commit', '.GITHUB/WORKFLOWS/ci.yml', '.github/Workflows/ci.yml', '.CursorRules', '.WINDSURFRULES',
+			'.v\u017Fcode/settings.json',         // U+017F, the long s: S in upper case
+			'.github/wor\u212Aflows/ci.yml',      // U+212A, the Kelvin sign: K once normalised
+			'.g\u0131t/config'];                   // U+0131, the dotless i: I in upper case
+		for (const p of folded) {
+			assert.ok(isProtected(p), JSON.stringify(p) + ' should be protected');
+			const w = rig();
+			assert.strictEqual((await commitShellChanges([W('/ws/' + p, 'x')], w.ctx, w.io)).refused, true, p);
+			const d = rig({ ['/ws/' + p]: 'x' });
+			assert.strictEqual((await commitShellChanges([D('/ws/' + p, 'x')], d.ctx, d.io)).refused, true, p + ' (delete)');
+		}
+		for (const p of ['GIT/config', 'src/Git.js', '.GITIGNORE', '.Gitattributes', 'VSCODE/x', '.github/WORKFLOW.md', 'my.GIT/x', 'Agents.txt']) { assert.ok(!isProtected(p), p + ' is not protected'); }
+	});
+
 	await test('outside the workspace folders: refused', async () => {
 		const r = rig();
 		const out = await commitShellChanges([W('/etc/passwd', 'x')], r.ctx, r.io);