fix(scripts): resolve editable file:// URLs with url2pathname

[SanHsien]

Fixes #485.

Problem

In _RUNTIME_IDENTITY_PROBE, an editable dependency's direct_url.json file:// URL is converted to a local path with Path(urllib.parse.unquote(parsed.path)).

A Windows file URL is file:///C:/Users/.../pkg, so urlsplit(...).path is /C:/Users/.../pkg. Path() reads that leading slash as a root, so the result is C:\C:\Users\...\pkg and resolve(strict=True) raises:

OSError: [WinError 123] The filename, directory name, or volume label syntax is incorrect:
'C:\C:\Users\...\editable-dependency'

On POSIX both forms give the same string, so CI never sees it.

Change

One line, plus the import:

-editable_root = Path(urllib.parse.unquote(parsed.path)).resolve(strict=True)
+editable_root = Path(urllib.request.url2pathname(parsed.path)).resolve(strict=True)

urllib.request.url2pathname is the stdlib conversion for URL path to local path. It strips the leading slash before a drive letter on Windows and is a no-op relative to the previous behavior on POSIX, where there is no drive letter to double. It also still percent-decodes, so no separate unquote is needed.

Verification

tests/unit/test_compare_scan_accuracy.py::test_runtime_probe_hashes_installed_and_editable_dependency_bytes already covers this path — it just never runs on a Windows host in CI. No test changes in this PR.

On Windows 11 (native, not WSL) / Python 3.13.14 / uv 0.12.8, from this branch:

• without the change: 1 failed with the WinError 123 above
• with the change: 1 passed
• ruff check scripts/compare_scan_accuracy.py — clean
• ruff format --check scripts/compare_scan_accuracy.py — already formatted

I did not add a regression test: on Linux url2pathname("/C:/x") and unquote("/C:/x") return the same string, so no cross-platform test can distinguish the two implementations. The existing test is the real guard, and it only bites on a Windows runner.

Notes

Found while getting the suite green on a native Windows host. This is the only product-code bug among the failures there — the other 22 were POSIX assumptions in the tests themselves.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The change is minimal, uses the appropriate stdlib API for cross-platform URL-path conversion, and directly addresses the documented Windows failure mode without altering broader logic.

Pull request overview

This PR fixes a Windows-specific path conversion bug in the runtime identity probe used by scripts/compare_scan_accuracy.py when hashing editable dependencies discovered via direct_url.json. It replaces a naive unquote + Path(...) conversion with the stdlib’s url2pathname, which correctly handles Windows drive-letter paths that appear with a leading slash in file:// URLs.

Changes:

• Import urllib.request in the embedded _RUNTIME_IDENTITY_PROBE.
• Convert file:// URL paths to local filesystem paths using urllib.request.url2pathname (fixing /C:/... → C:\... handling on Windows).
• Add inline rationale comments explaining the Windows drive-letter/leading-slash behavior.

File summaries

File	Description
scripts/compare_scan_accuracy.py	Fixes Windows editable file:// URL-to-path conversion inside _RUNTIME_IDENTITY_PROBE by using url2pathname.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rng1995]

[SkillSpector Review]

Changes requested at head 7ae7d20cf9c6ae60017bf98a0bebcd6f7f001502.

• scripts/compare_scan_accuracy.py:184: the behavior change has no regression-detecting test. On Linux, the existing editable-dependency test behaves the same with or without url2pathname, and CI has no Windows job, so reverting the fix would still pass. Add a platform-independent test (for example by exercising a factored URL-to-path helper with a controlled converter) that proves a Windows /C:/... file URL is routed to the correct local path, including error handling and leading-slash boundary cases.

Required CI is green, but missing regression coverage and the BEHIND merge state block merge. #490 appears intended to supersede this PR; land one corrected implementation, not both.