Fix trash restore regressions from path hardening

[jnhu76]

Summary

This follow-up fixes two compatibility regressions introduced by the trash path hardening change:

1. Nested entries returned by List() could use OS-native separators in TrashEntry.Name. On Windows this produced names like org\demo, which were then rejected by Restore() because validateTrashName() correctly rejects backslashes.
2. Restoring into the current directory, such as source: . / agents_source: ., was incorrectly rejected by the previous string-prefix containment check.

Changes

• Added trashLogicalName(parentRel, name) to build slash-separated logical trash names.
• Updated List() to use slash-separated logical names like org/demo for TrashEntry.Name.
• Kept TrashEntry.Path as an OS-native filesystem path.
• Reworked ensureUnderBase / ensureStrictlyUnderBase to use filepath.Abs + filepath.Rel containment checks instead of string-prefix checks.
• Kept validateTrashName() backslash rejection unchanged.

Tests

Added regression and guard coverage:

• TestRestoreAllowsCurrentDirectoryDestination
• TestEnsureUnderBaseAllowsChildOfDotButRejectsEscapes
• TestRestoreNestedEntryReturnedByList
• TestTrashLogicalNameNormalizesOSNativeSeparators
• TestTrashLogicalNameDoesNotTranslateLiteralUnixBackslashes
• TestEnsureUnderBaseRejectsSiblingPrefix
• TestValidateTrashNameRejectsBackslash

Security boundary

This patch preserves the original hardening semantics:

• Backslash remains invalid trash-name input.
• Escaping paths are still rejected.
• Shared-prefix sibling paths such as skills-evil are rejected.
• Cleanup() still refuses to operate on the trash base itself.
• Logical trash names and filesystem paths remain separate.
• Unix literal backslashes are not translated into logical path separators.

Validation

gofmt -l internal/trash/trash.go internal/trash/trash_security_test.go
go test ./internal/trash/... -count=1
go test ./internal/trash/... -race
go vet ./internal/trash/...
grep -R "filepath.Join(parentRel, name)" -n internal/trash
git diff --check

go test ./... reaches pre-existing integration failures that require a built CLI binary in PATH. The trash package tests pass, and the observed full-suite failure is unrelated to this patch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b07ed4c6d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Leave Unix backslashes invalid instead of separators

On Unix, backslash is a legal filename character, not an OS separator. Replacing it here means a malformed or legacy trash parent such as ..\outside is emitted by List() as ../outside/<name>, violating the existing invariant that listed names can be joined under a destination without escaping; filepath.ToSlash already handles real Windows separators when running on Windows, so literal Unix backslashes should remain invalid rather than being translated into logical path separators.

Useful? React with 👍 / 👎.

[jnhu76]

Good catch — fixed. I removed the literal backslash replacement and now only rely on filepath.ToSlash() for OS-native separators. Added a Unix guard test to ensure literal backslashes are not translated into /, while validateTrashName() still rejects backslash input.

[runkids]

Thanks! LGTM.