From c1f686c8c1080287183b79fbfb263f136397de90 Mon Sep 17 00:00:00 2001
From: 0xJeff <jeff@gopluslabs.io>
Date: Wed, 16 Sep 2026 10:32:46 +0800
Subject: [PATCH] fix: normalize Windows threat feed glob paths

---
 src/feed/selfcheck.ts            | 6 +++---
 src/tests/feed-selfcheck.test.ts | 9 ++++++++-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/feed/selfcheck.ts b/src/feed/selfcheck.ts
index 997b236..b3cc8be 100644
--- a/src/feed/selfcheck.ts
+++ b/src/feed/selfcheck.ts
@@ -407,10 +407,10 @@ function firstExisting(paths: string[]): string | null {
   return null;
 }
 
-function expandHomeDir(path: string): string {
+export function expandHomeDir(path: string, homeDir = homedir()): string {
   if (!path.startsWith('~')) return path;
-  if (path === '~') return homedir();
-  if (path.startsWith('~/')) return join(homedir(), path.slice(2));
+  if (path === '~') return homeDir;
+  if (path.startsWith('~/')) return join(homeDir, path.slice(2)).replace(/\\/g, '/');
   return path;
 }
 
diff --git a/src/tests/feed-selfcheck.test.ts b/src/tests/feed-selfcheck.test.ts
index 0202dad..395fab8 100644
--- a/src/tests/feed-selfcheck.test.ts
+++ b/src/tests/feed-selfcheck.test.ts
@@ -4,7 +4,7 @@ import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
-import { globMatch, runSelfCheckForAdvisory, safeRegexTest } from '../feed/selfcheck.js';
+import { expandHomeDir, globMatch, runSelfCheckForAdvisory, safeRegexTest } from '../feed/selfcheck.js';
 import type { Advisory } from '../feed/types.js';
 
 function makeSkillDir(parent: string, name: string, body: string): string {
@@ -38,6 +38,13 @@ function makeAdvisory(partial: Partial<Advisory>): Advisory {
 }
 
 describe('feed/selfcheck', () => {
+  it('normalizes Windows home-directory separators in glob patterns', () => {
+    assert.equal(
+      expandHomeDir('~/.codex/skills/*', 'C:\\Users\\alice'),
+      'C:/Users/alice/.codex/skills/*',
+    );
+  });
+
   it('globMatch handles literal names', () => {
     assert.equal(globMatch('slack-webhook', 'slack-webhook'), true);
     assert.equal(globMatch('slack-webhook', 'discord-webhook'), false);