From fbceb309e75b26bd6d6d3ac9e6beae31cb7e4e44 Mon Sep 17 00:00:00 2001
From: VectorPeak <garrufariw@gmail.com>
Date: Wed, 1 Jul 2026 18:53:54 +0800
Subject: [PATCH] fix(media): normalize Windows inbound paths
 case-insensitively

* fix Windows inbound media path casing

* test: cover Windows inbound path casing

* test(plugin-sdk): cover media runtime inbound path casing
---
 .../src/inbound-path-policy.test.ts           |  9 +++++++++
 .../media-core/src/inbound-path-policy.ts     |  4 +++-
 src/plugin-sdk/media-runtime.test.ts          | 19 +++++++++++++++++++
 3 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 src/plugin-sdk/media-runtime.test.ts

diff --git a/packages/media-core/src/inbound-path-policy.test.ts b/packages/media-core/src/inbound-path-policy.test.ts
index a5f942bc2bee..e0750214c673 100644
--- a/packages/media-core/src/inbound-path-policy.test.ts
+++ b/packages/media-core/src/inbound-path-policy.test.ts
@@ -47,6 +47,15 @@ describe("inbound-path-policy", () => {
     expectInboundPathAllowedCase(filePath, expected);
   });
 
+  it("matches Windows drive roots case-insensitively", () => {
+    expect(
+      isInboundPathAllowed({
+        filePath: "C:\\Users\\Alice\\Library\\Messages\\Attachments\\12\\34\\ABCDEF\\IMG_0001.jpeg",
+        roots: ["c:/users/*/library/messages/attachments"],
+      }),
+    ).toBe(true);
+  });
+
   it.each([
     {
       name: "normalizes and de-duplicates merged roots",
diff --git a/packages/media-core/src/inbound-path-policy.ts b/packages/media-core/src/inbound-path-policy.ts
index 9bb0a902e48c..c06c6cc9f847 100644
--- a/packages/media-core/src/inbound-path-policy.ts
+++ b/packages/media-core/src/inbound-path-policy.ts
@@ -21,7 +21,9 @@ function normalizePosixAbsolutePath(value: string): string | undefined {
   if (WINDOWS_DRIVE_ROOT_RE.test(withoutTrailingSlash)) {
     return undefined;
   }
-  return withoutTrailingSlash;
+  return WINDOWS_DRIVE_ABS_RE.test(withoutTrailingSlash)
+    ? withoutTrailingSlash.toLowerCase()
+    : withoutTrailingSlash;
 }
 
 function splitPathSegments(value: string): string[] {
diff --git a/src/plugin-sdk/media-runtime.test.ts b/src/plugin-sdk/media-runtime.test.ts
new file mode 100644
index 000000000000..83cacee86486
--- /dev/null
+++ b/src/plugin-sdk/media-runtime.test.ts
@@ -0,0 +1,19 @@
+/**
+ * Tests media runtime SDK barrel behavior.
+ */
+import { describe, expect, it } from "vitest";
+import { isInboundPathAllowed, normalizeInboundPathRoots } from "./media-runtime.js";
+
+describe("media-runtime SDK barrel", () => {
+  it("exposes Windows drive inbound path matching case-insensitively", () => {
+    const roots = ["d:/users/*/library/messages/attachments"];
+
+    expect(normalizeInboundPathRoots(["D:/Users/*/Library/Messages/Attachments"])).toEqual(roots);
+    expect(
+      isInboundPathAllowed({
+        filePath: "D:\\Users\\Alice\\Library\\Messages\\Attachments\\12\\34\\ABCDEF\\IMG_0001.jpeg",
+        roots,
+      }),
+    ).toBe(true);
+  });
+});