fix(filesystem): normalizePath returns 'C:.' for bare Windows drive letters

[olaservo]

Bug

normalizePath('C:') returns C:. instead of C:\ on Windows. This can break path validation when fs.realpath() returns a bare drive letter without a trailing separator.

Reproduction

import { normalizePath } from './path-utils.js';

normalizePath('C:');   // Returns "C:."  — WRONG
normalizePath('C:/');  // Returns "C:\"  — correct
normalizePath('C:\'); // Returns "C:\"  — correct

This happens because path.normalize('C:') returns C:. (current directory on the C: drive), and normalizePath doesn't account for this edge case.

Impact

When a user configures a drive root (e.g., D:\) as an allowed directory, fs.realpath() may return the path without a trailing separator. This flows through normalizePath → C:. → path validation fails → "access denied" even though the path should be allowed.

Originally reported in PR #1709 (now closed due to stale conflicts), with screenshot evidence of the bug in production.

Suggested Fix

Handle bare drive letters in normalizePath() in path-utils.ts — detect the X: pattern (single letter + colon, no path after) and append path.sep before normalizing:

// In normalizePath(), before path.normalize():
if (process.platform === 'win32' && /^[a-zA-Z]:$/.test(p)) {
  p = p + path.sep;
}

Related

• PR Solve the issue of FileSystem when the requestedPath is similar to 'X:\' on Windows which causes an exception #1709 (closed, had the right idea but targeted the old architecture)
• Issue was confirmed reproducible on current main via normalizePath('C:') test