fix(cli): POSIX-normalize docsPaths for cross-platform portability

[amondnet]

Summary

• Re-applies the cubic P2 fix that was pushed to feat(cli): prompt to select docs paths on ask add #101 after it had already been merged, so the change never reached main.
• sanitizeDocsPath in packages/cli/src/commands/add.ts now uses path.posix.normalize(trimmed.replaceAll('\\', '/')) so values persisted in ask.json always use forward slashes. Windows-authored docs\api and POSIX-authored docs/api produce the same stored token docs/api.
• Traversal guard simplified to startsWith('../') — the normalized form is guaranteed POSIX after the fix.
• Captures the pattern in .claude/agent-memory/review-review-cubic-reviewer/ so the cubic-reviewer subagent can recognize it next time. Per CLAUDE.md, agent-memory changes ship with the code change that produced them.

Why this is a separate PR

#101 was merged at 2026-04-17T06:58:55Z but cubic's second-pass review (P2 on path.normalize) completed after the merge, so df95077 landed on main without the POSIX fix. ec15af2 was pushed to the merged branch but never made it to main. This PR brings that fix plus the agent-memory onto main in one commit.

Test plan

• bun run --cwd packages/cli build — clean
• bun run --cwd packages/cli lint — clean
• bun run --cwd packages/cli test — 505 pass, 0 fail (2 new tests: backslash normalization in stored output, ..\escape rejection on POSIX)
• CI green (Cloudflare Pages, Test CLI, codecov, cubic AI reviewer)

---

Summary by cubic

Normalize docsPaths to POSIX forward slashes in the CLI so values in ask.json are consistent across platforms. Also tightens traversal checks and adds tests.

• Bug Fixes
  • In packages/cli/src/commands/add.ts, use path.posix.normalize(trimmed.replaceAll('\\', '/')) to store paths like docs\api and docs/api as docs/api.
  • Simplify traversal guard to normalized === '..' || normalized.startsWith('../') now that output is POSIX.
  • Add tests for backslash→slash normalization and rejecting ..\escape.
  • Capture the normalization pattern in .claude/agent-memory/review-review-cubic-reviewer/ for future reviews.

^{Written for commit 60ee4cc. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying ask-registry with    Cloudflare Pages

Latest commit:	60ee4cc
Status:	✅  Deploy successful!
Preview URL:	https://6190c7c2.ask-registry.pages.dev
Branch Preview URL:	https://amondnet-cubic-agent-memory.ask-registry.pages.dev

View logs

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

No issues found across 4 files

_{Auto-approved: Safe, isolated fix for cross-platform path normalization. Includes tests and documentation updates to ensure consistency in configuration files across OSs.}

Architecture diagram

sequenceDiagram
    participant User as User / CLI Input
    participant CLI as Add Command (packages/cli)
    participant Sanitizer as sanitizeDocsPath()
    participant Config as ask.json (Disk)
    participant Consumer as Read Side (ask docs)

    Note over User,Config: Path Configuration Flow (Write)

    User->>CLI: runAdd(docsPathsArg)
    CLI->>Sanitizer: Validate raw input (e.g., "docs\\api")
    
    Sanitizer->>Sanitizer: Check path.isAbsolute()
    
    rect rgb(240, 245, 255)
        Note right of Sanitizer: NEW: Cross-platform Normalization
        Sanitizer->>Sanitizer: CHANGED: replaceAll('\\', '/')
        Sanitizer->>Sanitizer: CHANGED: path.posix.normalize()
    end

    alt Unsafe Path (Traversal)
        Sanitizer->>Sanitizer: CHANGED: Check startsWith('../')
        Sanitizer-->>CLI: return null
    else Safe Path
        Sanitizer-->>CLI: return "docs/api"
    end

    CLI->>Config: Persist normalized POSIX paths
    Note right of Config: ask.json now contains:<br/>"docsPaths": ["docs/api"]

    Note over Config,Consumer: Path Resolution Flow (Read)

    Consumer->>Config: Load library configuration
    Config-->>Consumer: ["docs/api"]
    
    rect rgb(240, 245, 255)
        Note right of Consumer: Portability Strategy
        Consumer->>Consumer: path.resolve(projectRoot, "docs/api")
        Note over Consumer: path.resolve handles POSIX separators<br/>on both Windows and Linux
    end
    
    Consumer-->>User: Resolved absolute path for docs

Loading