[colbymchenry]

Summary

On Windows, a project at the root of a drive indexed nothing: a mapped network drive like Z:\, a subst drive, or the root of a UNC share. Every file was refused as Path traversal blocked in batch reader, codegraph init reported "Indexing failed — all N files had errors", even with --force, and code reads under such a root were refused too.

Root cause

isWithinDir in src/utils.ts decides whether a path lies under a root with child.startsWith(parent + path.sep). A root such as C:\ (or \\server\share\, or POSIX /) already ends with its separator, so the prefix became C:\\, and no path under the root matched. Both halves of validatePathWithinRoot use it, so the indexing reader, getCode and the viewer all refused every file. defaultSourceReader in src/graph/dead-code.ts had its own copy of the same check, so the dead code report treated every file of such a project as unreadable.

Fix

• The containment comparison adds a separator only when the root doesn't already end with one. It's split out as isSameOrUnder, which the sensitive-folder check from fix(security): the sensitive-folder guard refuses links, case variants and \\?\ paths #2929 already used, and isWithinDir keeps its Windows case folding on top of it.
• The dead code report's default reader now calls the shared lexicalPathWithinRoot instead of repeating the check.

Validation

Windows 11. A two-file fixture is mapped with subst R: <fixture>, and the mapping is removed after every run (subst lists none afterwards).

	main	this PR
codegraph init -y --force R:\	"Indexing failed — all 2 files had errors", 2× "Path traversal blocked", 0 files	2 files, 6 nodes, 6 edges
getCode of both functions	nothing indexed	both functions' source
validatePathWithinRoot('R:\\', 'a.ts')	null	R:\a.ts
dead code report on one R:\ index (an unused, unexported function in an imported file)	dropped as unreadable	listed

Tests (security.test.ts, red→green by putting the two source files back to this PR's base):

• a file under the filesystem root (this drive's root here, / on POSIX) is inside it;
• path math under Q:\ and \\server\share\; no drive or share is needed, and another drive or share is still outside;
• read-only realpaths under C:\: validatePathWithinRoot('C:\\', 'Windows'), and a missing path judged by its nearest existing ancestor, the drive root.

All 3 fail on the base and pass with the fix.

Full suite: 760 files passed, 6 skipped; 9,057 tests passed, 0 failed, 85 skipped, with the kernel built (CODEGRAPH_KERNEL_EXPECT=1) and the daemon allowed. It ran on fe007a8f, this change on 5e0c42cb. After rebasing onto 01873666 (#2930, no overlap but CHANGELOG), I reran security.test.ts, dead-code.test.ts and #2930's status-during-rebuild.test.ts on the pushed commit: 100 passed, 4 skipped.

Reported in #415 by @Kamilslaoui93; this reimplements the fix independently. Thanks to them for pinning down the exact root cause; the dead code reader and the tests that need no mapped drive are added here.

🤖 Generated with Claude Code