Fix is_child_path: resolve .. segments and use case-insensitive comparison on Windows

Agent-Logs-Url: https://github.com/wp-cli/package-command/sessions/c458f3cb-4cae-4b57-b796-a60a092eea37

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Author: Copilot

src/Package_Command.php

@@ -1201,19 +1201,43 @@ private static function get_package_name_and_version_from_dir_package( $dir_pack
 	/**
 	 * Checks whether a path is inside (or equal to) a given parent directory.
 	 *
-	 * Uses string-based normalisation so it works even when the paths do not
-	 * exist on the filesystem yet.
+	 * Resolves '.' and '..' segments without touching the filesystem so it
+	 * works even when the paths do not exist yet. Uses a case-insensitive
+	 * comparison on Windows where the filesystem is case-insensitive.
 	 *
 	 * @param string $path Path to test.
 	 * @param string $parent_dir Parent directory to test against.
 	 * @return bool True when $path is inside $parent_dir.
 	 */
 	private static function is_child_path( $path, $parent_dir ) {
-		$normalized_path   = rtrim( Path::normalize( $path ), '/' ) . '/';
-		$normalized_parent = rtrim( Path::normalize( $parent_dir ), '/' ) . '/';
+		$normalized_path   = self::resolve_dot_segments( rtrim( str_replace( '\\', '/', $path ), '/' ) ) . '/';
+		$normalized_parent = self::resolve_dot_segments( rtrim( str_replace( '\\', '/', $parent_dir ), '/' ) ) . '/';
+		if ( DIRECTORY_SEPARATOR === '\\' ) {
+			return 0 === stripos( $normalized_path, $normalized_parent );
+		}
 		return 0 === strpos( $normalized_path, $normalized_parent );
 	}
 
+	/**
+	 * Resolves '.' and '..' segments in a path without touching the filesystem.
+	 *
+	 * @param string $path Forward-slash path to resolve.
+	 * @return string Resolved path.
+	 */
+	private static function resolve_dot_segments( $path ) {
+		$is_absolute = isset( $path[0] ) && '/' === $path[0];
+		$result      = [];
+		foreach ( explode( '/', $path ) as $part ) {
+			if ( '..' === $part ) {
+				array_pop( $result );
+			} elseif ( '.' !== $part && '' !== $part ) {
+				$result[] = $part;
+			}
+		}
+		$resolved = implode( '/', $result );
+		return $is_absolute ? '/' . $resolved : $resolved;
+	}
+
 	/**
 	 * Gets the WP-CLI packages composer.json object.
 	 */