fix(windows): port acq provider-input path to Windows/MSYS

acq.backends/kit-translate.sh

@@ -166,19 +166,31 @@ kit_translate_fetch() {
       # url.<x>.insteadOf rewrite — `gh auth login` authenticates the gh CLI,
       # not plain git. See docs/KNOWN_FAILURE_MODES.md.
       #
-      # Attempt 1 (anonymous): prompts disabled + inherited credential helper and
-      # github.com insteadOf rewrite neutralized, so an unauthenticated fetch
-      # proceeds without prompting.
+      # Attempt 1 (anonymous): prompts disabled + inherited (system/global) git
+      # config isolated, so no url.<x>.insteadOf rewrite (e.g. an enterprise
+      # mirror) or credential helper can redirect or authenticate the fetch.
       # Attempt 2 (authed retry): if attempt 1 genuinely fails (a source that
       # needs auth / egress-restricted enterprise mirror that needs the rewrite),
       # retry with the system git config intact but STILL prompt-disabled, so a
       # configured credential helper can supply creds without ever hanging.
       _kit_git_fetch() {
         # $1 = extra git -c flags (as a single string, word-split intentionally)
-        local _cfg="$1"
+        # $2 = non-empty to isolate git from inherited (system + global) config.
+        local _cfg="$1" _isolate="${2:-}"
         (
           cd "$destdir" || exit 1
           export GIT_TERMINAL_PROMPT=0 GIT_ASKPASS=/bin/echo GCM_INTERACTIVE=never
+          if [ -n "$_isolate" ]; then
+            # A command-line identity insteadOf rewrite does NOT shadow an
+            # inherited equal-length url.*.insteadOf (git's longest-prefix match
+            # keeps the inherited rewrite winning), and an empty insteadOf value
+            # makes git prepend the URL to itself. Isolate git from system and
+            # global config so only the fresh repo's .git/config applies; the
+            # authed retry below restores inherited config when it is required.
+            export GIT_CONFIG_NOSYSTEM=1
+            export GIT_CONFIG_GLOBAL="$destdir/.gitconfig-empty"
+            : > "$GIT_CONFIG_GLOBAL"
+          fi
           rm -rf .git 2>/dev/null
           git init -q
           git remote add origin "$url" 2>/dev/null || git remote set-url origin "$url"
@@ -195,8 +207,10 @@ kit_translate_fetch() {
         )
       }
       local _ferr _anon_cfg
-      _anon_cfg="-c credential.helper= -c url.https://github.com/.insteadOf="
-      if _ferr=$(_kit_git_fetch "$_anon_cfg"); then
+      # Attempt 1 runs with inherited git config isolated (see _kit_git_fetch);
+      # the credential helper is also explicitly emptied for defense-in-depth.
+      _anon_cfg="-c credential.helper="
+      if _ferr=$(_kit_git_fetch "$_anon_cfg" isolate); then
         :
       elif _ferr=$(_kit_git_fetch ""); then
         # authed retry (system config) succeeded

acq.backends/msb.sh

@@ -1292,8 +1292,11 @@ _acq_msb_fetch_kit() {
       git+*|*://*) printf '%s\n' "$ACQ_MSB_KIT_LOCAL_DIR"; return 0 ;;
     esac
   fi
-  # Derive a stable cache subdir from the ref (sha + dir tail).
-  slug=$(printf '%s' "$kitref" | tr -c 'A-Za-z0-9._-' '_' )
+  # Derive a stable, SHORT cache subdir from the ref. The full sanitized ref
+  # (URL + sha + dir) can exceed Windows MAX_PATH once git materializes
+  # .git/objects/pack/* under it ("Filename too long" on fetch), so key the
+  # cache by a hash of the ref instead — deterministic and collision-resistant.
+  slug=$(printf '%s' "$kitref" | git hash-object --stdin)
   dest="${ACQ_MSB_KIT_CACHE}/${slug}"
   if [ -d "$dest/.git" ]; then
     # Already fetched — recompute the kit subdir path from the ref's dir=.

docs/BACKEND_GUIDE.md

@@ -401,6 +401,26 @@ otherwise corrupt colon-delimited mounts and guest-only paths. See
 [ADR-0029](adr/0029-windows-host-guest-path-forms.md). On macOS/Linux the two
 forms are identical.
 
+**Windows provider-input boundary:** on macOS/Linux the host-owned provider-input
+tree and the fetched kit are walked with descriptor-relative, no-follow opens, and
+the snapshot reads the very descriptor it validated. Native Windows Python has no
+equivalent, so `acq` falls back to a component-by-component walk that rejects
+symlinks, junctions, and any other reparse point at every level (creating missing
+directories one level at a time), and rejects backslash and drive-qualified
+manifest paths. Git Bash would otherwise convert a POSIX-looking argument to a
+native path before Python sees it, and that conversion resolves an intermediate
+junction or symlink, so the walk would never observe it. `acq` therefore runs
+these helpers with argument conversion disabled and translates the path to its
+native form lexically (only the leading drive or mount component goes through
+`cygpath`; everything below it is appended as a string), so the walk checks the
+literal path the caller passed. That fallback validates by name and then opens by
+name, so it is weaker than the POSIX path: it assumes the staging and projection directories are
+private to the current user. It is exercised on a real Windows runner only by the
+Windows-guarded tests; the Linux suite covers the same walk's symlink handling by
+forcing the portable code path and simulates the argument conversion with a shim.
+That real Git Bash honors the conversion opt-out for this call can only be
+confirmed on Windows.
+
 ### Disposable primary (`--clone`)
 
 msb has no native clone mode, so the neutral `--clone`

test/bats/100-kit-translate.bats

@@ -226,11 +226,11 @@ SPEC
   refute_regex "$spec" "chmod 0755 '/workspace/w\.sh'"
 }
 
-@test "#207: a git+https kit fetch is non-interactive and neutralizes credentials" {
+@test "#207: a git+https kit fetch is non-interactive and isolates inherited git config" {
   local gitlog="$STUBDIR/git-invocations.log"; : >"$gitlog"
   cat >"$STUBDIR/git" <<GITSTUB
 #!/usr/bin/env bash
-printf 'PROMPT=%s ARGS=%s\n' "\${GIT_TERMINAL_PROMPT:-UNSET}" "\$*" >>"$gitlog"
+printf 'PROMPT=%s NOSYS=%s GLOBAL=%s ARGS=%s\n' "\${GIT_TERMINAL_PROMPT:-UNSET}" "\${GIT_CONFIG_NOSYSTEM:-UNSET}" "\${GIT_CONFIG_GLOBAL:-UNSET}" "\$*" >>"$gitlog"
 case "\$*" in
   *fetch*) exit 0 ;;
   *checkout*) mkdir -p "integrations/isolation/acq-kits/usai-provider"; exit 0 ;;
@@ -247,7 +247,42 @@ GITSTUB
   assert_regex "$fetchline" 'PROMPT=0'
   anonline=$(grep -m1 'credential.helper=' "$gitlog" || true)
   assert_regex "$anonline" 'credential\.helper='
-  assert_regex "$anonline" 'insteadOf='
+  assert_regex "$anonline" 'NOSYS=1'
+  assert_regex "$anonline" 'GLOBAL=.*\.gitconfig-empty'
+}
+
+@test "#207: an equal-length global insteadOf mirror rewrite is neutralized for the anonymous attempt" {
+  # A global `url.https://mirror.invalid/.insteadOf=https://github.com/` has the
+  # SAME prefix length as the old command-line identity rewrite, so git's
+  # longest-prefix match kept the inherited mirror rewrite winning and the
+  # anonymous fetch was redirected to the mirror. Isolating git from inherited
+  # config (GIT_CONFIG_NOSYSTEM + empty GIT_CONFIG_GLOBAL) neutralizes it.
+  local realgit="$ACQ_TEST_REAL_GIT" home="$STUBDIR/fakehome" resolved="$STUBDIR/resolved-url"
+  mkdir -p "$home"
+  "$realgit" config --file "$home/.gitconfig" url.https://mirror.invalid/.insteadOf https://github.com/
+
+  # A git that resolves the origin URL (as a fetch would) with the REAL git under
+  # the fetch's own environment, records the result, and fakes a successful fetch.
+  cat >"$STUBDIR/git" <<GITSTUB
+#!/usr/bin/env bash
+original=("\$@")
+while [ "\$#" -gt 0 ]; do case "\$1" in -c) shift 2 ;; *) break ;; esac; done
+case "\${1:-}" in
+  fetch) "$realgit" remote get-url origin > "$resolved"; exit 0 ;;
+  checkout) exit 0 ;;
+  *) "$realgit" "\${original[@]}" ;;
+esac
+GITSTUB
+  chmod +x "$STUBDIR/git"
+
+  run bash -c '
+    export HOME="'"$home"'"
+    . "'"$REPO_ROOT"'/acq.backends/kit-translate.sh"
+    kit_translate_fetch "git+https://github.com/GSA-TTS/agentic-coding-patterns.git#ref=deadbeef&dir=integrations/isolation/acq-kits/usai-provider" "'"$STUBDIR"'/kitdest" >/dev/null 2>&1
+  '
+
+  assert_success
+  assert_equal "$(cat "$resolved" 2>/dev/null || printf 'UNRESOLVED')" "https://github.com/GSA-TTS/agentic-coding-patterns.git"
 }
 
 @test "#207: authenticated retry diagnostics never expose credential-bearing URLs" {