fix(paths): replace path.sep with normalizePath across codebase

Replace platform-specific path.sep usage with normalized paths for consistent
cross-platform behavior:

- bootstrap.mts: Use path.join(...segments).replace(/\\/g, '/') for tarball paths
- bootstrap.mts: Normalize path.relative() result and use '../' instead of path.sep
- home-path.mts: Normalize cwd before regex matching, simplify pattern to '/'

All paths now use forward slashes consistently regardless of platform.

Author: jdalton

packages/cli/src/stub/bootstrap.mts

@@ -81,8 +81,8 @@ function sanitizeTarballPath(filePath: string): string {
   const segments = withoutPrefix
     .split('/')
     .filter(seg => seg && seg !== '.' && seg !== '..')
-  // Normalize path separators for the current platform.
-  return segments.join(path.sep)
+  // Use path.join for proper path construction, then normalize to forward slashes.
+  return path.join(...segments).replace(/\\/g, '/')
 }
 
 /**
@@ -106,11 +106,11 @@ async function remove(
     }
 
     // Check if trying to delete outside SOCKET_HOME (catastrophic delete protection).
-    const relation = path.relative(SOCKET_HOME, absolutePath)
+    const relation = path.relative(SOCKET_HOME, absolutePath).replace(/\\/g, '/')
     const isInside = Boolean(
       relation &&
         relation !== '..' &&
-        !relation.startsWith(`..${path.sep}`) &&
+        !relation.startsWith('../') &&
         !path.isAbsolute(relation),
     )
 

packages/cli/src/utils/fs/home-path.mts

@@ -11,18 +11,16 @@
  * - Common Unix convention for home directory
  */
 
-import path from 'node:path'
-
 import { escapeRegExp } from '@socketsecurity/lib/regexps'
+import { normalizePath } from '@socketsecurity/lib/path'
 
 import { homePath } from '../../constants/paths.mts'
 
 export function tildify(cwd: string) {
-  // On Windows, accept both forward and back slashes as separators
-  // since paths can be mixed (Git Bash, WSL, etc.).
-  const sepPattern = path.sep === '\\' ? '[\\\\/]' : '/'
-  return cwd.replace(
-    new RegExp(`^${escapeRegExp(homePath)}(?:${sepPattern}|$)`, 'i'),
+  // Normalize to forward slashes for consistent matching across platforms.
+  const normalizedCwd = normalizePath(cwd)
+  return normalizedCwd.replace(
+    new RegExp(`^${escapeRegExp(homePath)}(?:/|$)`, 'i'),
     '~/',
   )
 }