fix(pm): normalize path separators in CLONE_CACHE keys on Windows

OnceMap dedupes by *target path*, but install.rs and pipeline
workers construct the same logical target with different separators
on Windows:

  install.rs:  `cwd.join("node_modules/foo")` → forward slashes
               (lockfile paths use `/`)
  pipeline:    `cwd.join(PathBuf::from("..."))` → mixed,
               with `\` injected at `Path::join` boundaries

These produce distinct strings (`a/b/c` vs `a/b\c`) and OnceMap
sees them as two unrelated keys. Both clone tasks then race on the
same real directory file-by-file, surfacing as
`ERROR_SHARING_VIOLATION` (os error 32). The parent-wait via
`wait_clone_if_pending` is also defeated for the same reason.

Fix: switch the OnceMap key from `String` to `PathBuf`, and feed
it through `Path::components().collect()`. `components()` parses
both `/` and `\` as separators on Windows, and `collect::<PathBuf>()`
rebuilds with the OS-preferred separator — giving a stable key
without ad-hoc string replace and without an extra crate.

Linux/macOS unchanged (separator is already `/`). Includes a
Windows-only regression test asserting `cache_key("a/b") ==
cache_key("a\\b")`.

Surfaced by the eggjs/egg Windows e2e smoke test, which triggered
the race in `@langchain/core`'s nested node_modules.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: elrrrrrrr

crates/pm/src/util/cloner.rs

@@ -13,8 +13,16 @@ use super::retry::create_retry_strategy;
 use crate::fs;
 
 /// Global clone cache shared between pipeline and install phases.
-/// Key: target path, Value: ()
-static CLONE_CACHE: Lazy<OnceMap<String, ()>> = Lazy::new(OnceMap::new);
+///
+/// Key: normalized target path. Install (`cwd.join("node_modules/foo")` →
+/// forward slashes) and pipeline (`Path::join` injects backslashes on
+/// Windows) produce the same logical target with different separators;
+/// without normalization OnceMap sees them as distinct keys, dedup fails,
+/// and concurrent tasks race on the same destination — manifesting as
+/// `ERROR_SHARING_VIOLATION` (os error 32) on Windows. `PathBuf` from
+/// `Path::components().collect()` parses both separators uniformly and
+/// rebuilds with the OS-preferred one, giving a stable key.
+static CLONE_CACHE: Lazy<OnceMap<PathBuf, ()>> = Lazy::new(OnceMap::new);
 
 /// Number of clones completed.
 static CLONE_COUNT: AtomicUsize = AtomicUsize::new(0);
@@ -24,12 +32,25 @@ pub fn clone_count() -> usize {
     CLONE_COUNT.load(Ordering::Relaxed)
 }
 
+/// Normalize a target path into the canonical key used by `CLONE_CACHE`.
+#[cfg(windows)]
+fn cache_key(target_path: &Path) -> PathBuf {
+    target_path.components().collect()
+}
+
+#[cfg(not(windows))]
+fn cache_key(target_path: &Path) -> PathBuf {
+    target_path.to_path_buf()
+}
+
 /// Wait for a pending clone at the given target path to complete (if any).
 ///
 /// Used by the pipeline clone worker to ensure parent packages are
 /// cloned before their children.
 pub async fn wait_clone_if_pending(target_path: &str) {
-    CLONE_CACHE.wait_if_pending(&target_path.to_string()).await;
+    CLONE_CACHE
+        .wait_if_pending(&cache_key(Path::new(target_path)))
+        .await;
 }
 
 /// Clone a package to target path, downloading to cache first if needed.
@@ -42,7 +63,7 @@ pub async fn clone_package_once(
     tarball_url: &str,
     target_path: &Path,
 ) -> Result<()> {
-    let key = target_path.to_string_lossy().to_string();
+    let key = cache_key(target_path);
     let err_label = format!("{name}@{version}");
     let name = name.to_string();
     let version = version.to_string();
@@ -440,6 +461,20 @@ mod tests {
 
     use super::*;
 
+    #[cfg(windows)]
+    #[test]
+    fn cache_key_normalizes_path_separators() {
+        // install.rs joins lockfile-derived strings (forward slashes) while
+        // pipeline workers go through `Path::join` (backslashes). Both must
+        // produce the same OnceMap key — otherwise concurrent clones race
+        // and Windows raises ERROR_SHARING_VIOLATION.
+        let forward = cache_key(Path::new("node_modules/@scope/pkg/node_modules/dep"));
+        let backward = cache_key(Path::new("node_modules\\@scope\\pkg\\node_modules\\dep"));
+        let mixed = cache_key(Path::new("node_modules/@scope/pkg\\node_modules\\dep"));
+        assert_eq!(forward, backward);
+        assert_eq!(forward, mixed);
+    }
+
     async fn create_test_file(dir: &Path, name: &str, content: &[u8]) -> Result<PathBuf> {
         let path = dir.join(name);
         let mut file = fs::File::create(&path).await?;