fix(scripts): make the specifier audit path-separator agnostic

[waleedlatif1]

Summary

Follow-up to #6351. Cursor Bugbot raised this on that PR after it had already merged, so it lands separately.

isGeneratedPath split the repo-relative path on /, but path.relative returns backslashes on Windows — so .source and node_modules never matched a segment and generated output was treated as scannable source. The repo does support Windows development (scripts/setup/* branches on win32).

The finding named one site; there were three

• isGeneratedPath — the reported one.
• isCompiledSource compared against 'apps/sim/scripts/' with the same assumption, so the test/script exclusions silently stopped applying.
• workspaceFor matched `${w.dir}/` against an absolute path. On Windows that never matches, dropping every file out of its own workspace — which disables tsconfig paths resolution entirely rather than erroring, so @/… specifiers would be reported as unverifiable instead of being checked. That is the worst of the three: a guard that quietly stops guarding.

Changes

All path comparisons go through a repoPath() helper that normalizes to /; workspaceFor uses path.sep against absolute paths. Reported paths use it too, so output is byte-identical on either platform.

spec.split('/') is deliberately left alone — import specifiers are always /-separated regardless of host.

Type of Change

• Bug fix

Testing

• Simulated win32 separators through the same predicates:

"apps\docs\.source\server.ts"        -> generated: true
"apps\sim\lib\x.ts"                  -> generated: false
"packages\utils\node_modules\y.ts"   -> generated: true
scripts filter on "apps\sim\scripts" -> true

• posix behaviour unchanged: 37,437 first-party specifiers across 11,243 files still resolve clean
• biome check clean

No Windows machine was available to run this end-to-end, so the verification is at the predicate level rather than a real win32 run.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Relevant tests are passing
• No new warnings introduced

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 7, 2026 12:19am

[cursor]

PR Summary

Low Risk
Changes are limited to the dev-only import-specifier audit script; no runtime app, auth, or data paths are affected.

Overview
On Windows, path.relative uses backslashes while the audit script compared paths with /, so several guards behaved incorrectly or silently stopped working.

A repoPath() helper normalizes repo-relative paths to forward slashes. isGeneratedPath and isCompiledSource now use it so generated output (e.g. .source, node_modules) and script exclusions match on win32. Violation output uses the same helper so reported paths stay consistent across platforms.

workspaceFor now checks file.startsWith(w.dir + sep) instead of a hardcoded /, so files stay tied to the correct workspace and tsconfig paths resolution (including @/…) still runs on Windows instead of failing quietly.

^{Reviewed by Cursor Bugbot for commit d15cf1d. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[greptile-apps]

Greptile Summary

This PR makes the import-specifier audit path-separator agnostic.

• Normalizes repository-relative paths to forward slashes for classification and reporting.
• Uses the host separator when associating absolute file paths with workspaces.
• Restores Windows handling for generated paths, script exclusions, and tsconfig path resolution.

Confidence Score: 5/5

The PR appears safe to merge with no actionable regressions identified.

The changed path comparisons preserve POSIX behavior while correctly normalizing Windows-relative paths and using the native separator for absolute workspace matching.

Important Files Changed

Filename	Overview
scripts/check-import-specifiers.ts	The path normalization and workspace-boundary changes consistently handle native absolute paths and normalized repository-relative paths without an identified regression.

_{Reviews (1): Last reviewed commit: "fix(scripts): make the specifier audit p..." | Re-trigger Greptile}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d15cf1d. Configure here.}