fix(media): normalize Windows inbound paths case-insensitively

* fix Windows inbound media path casing

* test: cover Windows inbound path casing

* test(plugin-sdk): cover media runtime inbound path casing

packages/media-core/src/inbound-path-policy.test.ts

@@ -47,6 +47,15 @@ describe("inbound-path-policy", () => {
     expectInboundPathAllowedCase(filePath, expected);
   });
 
+  it("matches Windows drive roots case-insensitively", () => {
+    expect(
+      isInboundPathAllowed({
+        filePath: "C:\\Users\\Alice\\Library\\Messages\\Attachments\\12\\34\\ABCDEF\\IMG_0001.jpeg",
+        roots: ["c:/users/*/library/messages/attachments"],
+      }),
+    ).toBe(true);
+  });
+
   it.each([
     {
       name: "normalizes and de-duplicates merged roots",

packages/media-core/src/inbound-path-policy.ts

@@ -21,7 +21,9 @@ function normalizePosixAbsolutePath(value: string): string | undefined {
   if (WINDOWS_DRIVE_ROOT_RE.test(withoutTrailingSlash)) {
     return undefined;
   }
-  return withoutTrailingSlash;
+  return WINDOWS_DRIVE_ABS_RE.test(withoutTrailingSlash)
+    ? withoutTrailingSlash.toLowerCase()
+    : withoutTrailingSlash;
 }
 
 function splitPathSegments(value: string): string[] {

src/plugin-sdk/media-runtime.test.ts

@@ -0,0 +1,19 @@
+/**
+ * Tests media runtime SDK barrel behavior.
+ */
+import { describe, expect, it } from "vitest";
+import { isInboundPathAllowed, normalizeInboundPathRoots } from "./media-runtime.js";
+
+describe("media-runtime SDK barrel", () => {
+  it("exposes Windows drive inbound path matching case-insensitively", () => {
+    const roots = ["d:/users/*/library/messages/attachments"];
+
+    expect(normalizeInboundPathRoots(["D:/Users/*/Library/Messages/Attachments"])).toEqual(roots);
+    expect(
+      isInboundPathAllowed({
+        filePath: "D:\\Users\\Alice\\Library\\Messages\\Attachments\\12\\34\\ABCDEF\\IMG_0001.jpeg",
+        roots,
+      }),
+    ).toBe(true);
+  });
+});