fix(capability): detect native Windows private paths in public-safe-outbound

The builtin fail-closed pre-submission scrub only recognized the POSIX spelling
of a private absolute path. On a Windows host the same private path written as
C:\Users\<name>\... or \\server\Users\<name>\... passed the scan with
hit_count 0 while its POSIX spelling was blocked, so the guard was silent on the
platform whose users spell their private paths that way. #6161 repaired the same
spelling class in the public/private boundary scan and named this rule as its
deliberately deferred successor owner.

Extend private_abs_path with drive-letter and UNC arms carrying the same root
keywords, and cover both native spellings plus a non-private drive path in the
scanner tests.

Closes #6220
Follow-up to #6161

Signed-off-by: JasonBuildAI <jasonbuildai@gmail.com>

Author: JasonBuildAI

loopx/capabilities/public_safe_outbound/scanner.py

@@ -27,8 +27,18 @@
     {"id": "aklt_access_key", "label": "AK/SK access key", "pattern": r"\b" + "AKLT" + r"[A-Za-z0-9]{10,}\b"},
     {"id": "private_key_block", "label": "private key block", "pattern": r"-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----"},
     {"id": "api_key_assignment", "label": "api key assignment", "pattern": r"(?i)\b(api[_-]?key|access[_-]?key|secret)\b\s*[=:]\s*['\"][^'\"]{8,}['\"]"},
-    # private absolute paths
-    {"id": "private_abs_path", "label": "private absolute path", "pattern": r"/(Users|home|data00|root)/([A-Za-z0-9_.-]+)/"},
+    # Private absolute paths: the POSIX spellings, plus the native Windows
+    # drive-letter and UNC spellings of the same roots, so a Windows host's own
+    # path form is a hit instead of a silent pass.
+    {
+        "id": "private_abs_path",
+        "label": "private absolute path",
+        "pattern": (
+            r"/(?:Users|home|data00|root)/[A-Za-z0-9_.-]+/"
+            r"|[A-Za-z]:[\\/](?:Users|home|data00|root)[\\/][A-Za-z0-9_.-]+[\\/]"
+            r"|\\\\[A-Za-z0-9_.-]+\\(?:Users|home|data00|root)\\[A-Za-z0-9_.-]+\\"
+        ),
+    },
 )
 
 

loopx/capabilities/public_safe_outbound/tests/test_scanner.py

@@ -34,6 +34,32 @@ def test_detects_private_path() -> None:
     assert any(h.rule_id == "private_abs_path" for h in res.hits)
 
 
+def test_detects_native_windows_private_path() -> None:
+    # The same private path in the spellings a Windows host produces: a drive
+    # letter and an UNC share. Assembled at runtime so the source stays clean of
+    # the literal pattern.
+    separator = "\\"
+    drive = separator.join(["C:", "Users", "example-user", "code-reading", "some_workspace"])
+    unc = (
+        separator
+        + separator.join(["", "fileserver", "Users", "example-user", "code-reading", "some_workspace"])
+    )
+    for label, private in (("drive", drive), ("unc", unc)):
+        res = scan_texts({label: "run from " + private})
+        assert res.ok is False, label
+        assert any(h.rule_id == "private_abs_path" for h in res.hits), label
+
+
+def test_native_windows_path_outside_the_private_roots_stays_clean() -> None:
+    # The Windows arms carry the same root keywords as the POSIX arm, so an
+    # ordinary drive path that is not under a private root must stay clean and
+    # cannot block a submission on its own.
+    separator = "\\"
+    public_path = separator.join(["C:", "Projects", "public-demo", "build"])
+    res = scan_texts({"d": "build output lives under " + public_path})
+    assert res.ok is True
+
+
 def test_clean_text_passes(tmp_path: Path) -> None:
     (tmp_path / "ok.md").write_text(
         "Public-safe note: compare baseline vs treatment on the same model/task/verifier.",