fix(schema)!: reject Windows-style path traversal + skills_link paths

Security hardening for manifest path validation. Two P1s flagged
post-merge:

1. Windows traversal bypass: the existing guard tokenized only on `/`
   and treated only `/`-prefixed paths as absolute. Inputs like
   `..\..\outside`, `\\server\share`, `C:\temp\x`, or `C:foo` slipped
   through and would let install/remove touch arbitrary filesystem
   locations when run on Windows. New `_check_path_safe` helper
   normalizes both separators and rejects every common absolute-path
   form (POSIX root, Windows root, UNC, drive-letter, drive-relative).

2. skills_link unchecked: `target` and `dst` fields were only
   validated for presence, then joined with target_root in
   `_resolve_skills_link`. A manifest with `../../outside` or `/tmp/x`
   in either field could redirect symlink/rsync into arbitrary paths
   on any platform. Same `_check_path_safe` helper now applies.

13-case smoke test covers POSIX traversal, Windows traversal,
forward-slash and backslash absolute, UNC, drive-absolute,
drive-relative, and the lowercase-drive variant.

Tests: 40 passed, 1 skipped.

Author: codejunkie99

CHANGELOG.md

@@ -46,6 +46,20 @@ and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.
   Thanks to @palamp for the report and the proposal that shaped the
   larger feature.
 
+### Security
+- **Manifest path-safety hardening (`harness_manager/schema.py`).** The
+  pre-existing path-traversal guard only tokenized on `/` and only
+  treated `/`-prefixed paths as absolute, so Windows-style inputs
+  (`..\..\outside`, `\\server\share`, `C:\temp\x`, `C:foo`) bypassed
+  validation and could let install/remove read or write outside the
+  adapter/project roots when run on Windows. Also extended the same
+  validation to `skills_link.target` and `skills_link.dst`, which were
+  previously only checked for presence — a manifest could otherwise
+  point the symlink/rsync into arbitrary filesystem locations on any
+  platform. Both POSIX and Windows separators are now normalized
+  before traversal detection, and every common absolute-path form
+  (POSIX root, Windows root, UNC, drive-letter) is rejected.
+
 ### Changed
 - `install.sh` shrinks from 175 lines of bash case-statements to 35
   lines of dispatcher. All install logic moved to `harness_manager/`.

harness_manager/schema.py

@@ -51,6 +51,39 @@ def _check_optional(d: dict, key: str, types: tuple, source: str) -> Any:
     return val
 
 
+def _check_path_safe(p: str, source: str, field: str) -> None:
+    """Reject path traversal and absolute paths on POSIX AND Windows.
+
+    Manifests are read by an installer that joins these paths with
+    target_root and writes/symlinks the result. A malicious or buggy
+    manifest with `../../outside`, `..\\..\\outside`, `/tmp/x`,
+    `\\\\server\\share`, or `C:\\temp\\x` would otherwise let install
+    or remove touch arbitrary filesystem locations. The original guard
+    only tokenized on `/` and only treated `/`-prefixed paths as
+    absolute, so Windows-style inputs slipped through. Tokenize on
+    both separators and reject every common absolute-path form.
+    """
+    parts = p.replace("\\", "/").split("/")
+    if ".." in parts:
+        raise ManifestError(
+            source,
+            f"'{field}': '..' path components not allowed (path traversal)",
+        )
+    # POSIX absolute (/foo) or Windows root/UNC (\foo, \\server\share).
+    if p.startswith("/") or p.startswith("\\"):
+        raise ManifestError(
+            source,
+            f"'{field}': absolute paths not allowed; use repo-relative paths",
+        )
+    # Windows drive prefix: C:foo (drive-relative), C:\foo / C:/foo
+    # (absolute). Catches every X:... form regardless of separator.
+    if len(p) >= 2 and p[1] == ":" and p[0].isalpha():
+        raise ManifestError(
+            source,
+            f"'{field}': drive-letter paths not allowed; use repo-relative paths",
+        )
+
+
 def _validate_files(files: list, source: str) -> None:
     if not files:
         raise ManifestError(source, "'files' must contain at least one entry")
@@ -62,10 +95,8 @@ def _validate_files(files: list, source: str) -> None:
         dst = _require(entry, "dst", (str,), es)
         if not src or not dst:
             raise ManifestError(es, "'src' and 'dst' must be non-empty strings")
-        if ".." in src.split("/") or ".." in dst.split("/"):
-            raise ManifestError(es, "'..' path components not allowed (path traversal)")
-        if src.startswith("/") or dst.startswith("/"):
-            raise ManifestError(es, "absolute paths not allowed; use repo-relative paths")
+        _check_path_safe(src, es, "src")
+        _check_path_safe(dst, es, "dst")
         policy = _check_optional(entry, "merge_policy", (str,), es)
         if policy is not None and policy not in VALID_MERGE_POLICIES:
             raise ManifestError(
@@ -78,11 +109,19 @@ def _validate_files(files: list, source: str) -> None:
 def _validate_skills_link(link: dict, source: str) -> None:
     if not isinstance(link, dict):
         raise ManifestError(source, "'skills_link' must be an object")
-    target = _require(link, "target", (str,), f"{source} skills_link")
-    dst = _require(link, "dst", (str,), f"{source} skills_link")
+    sl_source = f"{source} skills_link"
+    target = _require(link, "target", (str,), sl_source)
+    dst = _require(link, "dst", (str,), sl_source)
     if not target or not dst:
-        raise ManifestError(f"{source} skills_link", "'target' and 'dst' must be non-empty")
-    fallback = _check_optional(link, "fallback", (str,), f"{source} skills_link")
+        raise ManifestError(sl_source, "'target' and 'dst' must be non-empty")
+    # Same path-safety check as file entries: skills_link.target and
+    # skills_link.dst are joined with target_root in _resolve_skills_link
+    # without normalization, so a manifest with `..\..\outside` or
+    # `/tmp/x` here would let install/remove symlink or rsync into
+    # arbitrary filesystem locations on either POSIX or Windows.
+    _check_path_safe(target, sl_source, "target")
+    _check_path_safe(dst, sl_source, "dst")
+    fallback = _check_optional(link, "fallback", (str,), sl_source)
     if fallback is not None and fallback not in VALID_FALLBACKS:
         raise ManifestError(
             f"{source} skills_link",