fix/windows path normalization(#21441)

[chenyy9527]

Closes #21441

Summary

• Server: extract Filesystem.posixPath() and apply to all API responses and session read/write paths for consistent POSIX-style output
• Server: fix contains() and overlaps() to return false for cross-drive paths on Windows
• Client: use workspaceKey() for all internal map keys to prevent duplicate caches from mixed path formats (D:/foo vs D:\foo)
• Client: replace duplicated normalizeDirectory in Session with Filesystem.posixPath
• Test: add unit tests for posixPath, contains, overlaps; update existing tests for path format consistency

Issue for this PR

Closes #21441

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

On Windows, the same directory can have different path formats (D:/foo vs D:\foo), causing:

1. Path traversal bypass — path.relative() returns the target as-is for cross-drive paths, so contains() incorrectly returned true for arbitrary paths like /etc/passwd.
2. Cache key mismatches — Internal maps (booting, sdkCache, sessionMeta, etc.) used raw directory as keys, creating duplicate entries and causing session data loss on store eviction.
3. API format inconsistency — Server responses mixed backslash and forward-slash paths.

Fix: Add isAbsolute guard to contains()/overlaps() for cross-drive detection. Extract posixPath() as single normalization function. Apply it consistently at server API boundaries and client cache keys.

How did you verify your code works?

• bun typecheck passes (13/13 packages)
• Path-traversal tests pass (15/15), including cross-drive checks on Windows
• App tests: 301/301 pass. Opencode tests: 585/589 pass (3 pre-existing failures unrelated)
• Verified posixPath() edge cases: drive roots, trailing slashes, mixed separators
• Traced the full data flow: page refresh → two loadSessions call paths → API requests → store writes → render, confirming the normalization unifies all paths.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Hey! Your PR title fix/windows path normalization(#21441) doesn't follow conventional commit format.

Please update it to start with one of:

• feat: or feat(scope): new feature
• fix: or fix(scope): bug fix
• docs: or docs(scope): documentation changes
• chore: or chore(scope): maintenance tasks
• refactor: or refactor(scope): code refactoring
• test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Based on my search, I found several potentially related PRs addressing Windows path handling issues:

Related/Potentially Duplicate PRs:

1. PR fix: normalize directory paths for session list queries on Windows #17067 - "fix: normalize directory paths for session list queries on Windows"

   • fix: normalize directory paths for session list queries on Windows #17067
   • Related: Also addresses Windows path normalization for sessions, may overlap with the session path consistency fixes in this PR.

2. PR fix(windows): keep project paths stable across aliases #18709 - "fix(windows): keep project paths stable across aliases"

   • fix(windows): keep project paths stable across aliases #18709
   • Related: Addresses path stability on Windows which relates to the cache key mismatch issue mentioned in this PR (different formats like D:/foo vs D:\foo creating duplicates).

3. PR fix(patch): parse Windows drive-letter paths #10808 - "fix(patch): parse Windows drive-letter paths"

   • fix(patch): parse Windows drive-letter paths #10808
   • Related: Handles Windows drive-letter path parsing, relevant to the cross-drive path detection logic.

Note: The primary results all return PR #21852 (the current PR being checked), so these are the only distinct related PRs found in the search results.