fix(duplicatedcontent): hash rootDir in corpusIndexKey

Pass 2 of code review on PR #732 found that corpusIndexKey joined
rootDir into the cache key with the same 0x1f/0x1e control-byte
separators used for include/exclude, but unlike those (YAML-parsed
strings that cannot contain these bytes), rootDir is a raw filesystem
path — most filesystems permit any byte but NUL and '/' in a path
component. A pathological directory name containing a literal
0x1f/0x1e could bleed into the fields that follow it, colliding two
different scopes onto the same RunCache.DuplicateContentIndex slot.

Hash rootDir to a fixed-length hex digest before writing it into the
key: the digest's length and alphabet (0-9a-f) never depend on
rootDir's content, so it can never absorb or be absorbed by an
adjacent field. TestCorpusIndexKey_RootDirControlBytesCannotBleedIntoOtherFields
pins this — confirmed red against the prior unhashed scheme (the
fixed-length assertion failed: 11 vs 26 chars for two different-length
rootDirs) before the fix.

Author: claude

internal/rules/duplicatedcontent/rule.go

@@ -393,13 +393,19 @@ func (r *Rule) corpusIndex(f *lint.File, corpus fs.FS, minChars int, sharedRoot
 // besides the corpus FS and selfName (selfName is intentionally
 // excluded — see corpusIndex). 0x1f/0x1e separators avoid collisions
 // between adjacent fields the way config.EffectiveSignature's key
-// does; rule settings are YAML-parsed strings, so they cannot contain
-// these control bytes.
+// does; rule settings (include/exclude) are YAML-parsed strings, so
+// they cannot contain these control bytes. rootDir is not YAML-parsed
+// — it is a filesystem path, and most filesystems permit any byte but
+// NUL and '/' in a path component — so it is hashed to a fixed-length
+// hex string first: a pathological directory name that happened to
+// contain a literal 0x1f/0x1e could otherwise bleed into the fields
+// that follow it and collide two different scopes onto one cache slot.
 func corpusIndexKey(
 	rootDir string, maxBytes int64, minChars int, stripFrontMatter bool, include, exclude []string,
 ) string {
 	var b strings.Builder
-	b.WriteString(rootDir)
+	rootSum := sha256.Sum256([]byte(rootDir))
+	b.WriteString(hex.EncodeToString(rootSum[:]))
 	b.WriteByte(0x1f)
 	b.WriteString(strconv.FormatInt(maxBytes, 10))
 	b.WriteByte(0x1f)

internal/rules/duplicatedcontent/rule_test.go

@@ -1034,6 +1034,34 @@ func TestCorpusIndexKey_DistinctInputsProduceDistinctKeys(t *testing.T) {
 	assert.Equal(t, a, b, "identical inputs must produce identical keys")
 }
 
+// TestCorpusIndexKey_RootDirControlBytesCannotBleedIntoOtherFields pins
+// the fix for a review finding: unlike include/exclude (YAML-parsed
+// strings that cannot contain 0x1f/0x1e), rootDir is a raw filesystem
+// path — most filesystems permit any byte but NUL and '/' in a path
+// component, including the key's own 0x1f/0x1e separators. Writing
+// rootDir raw into the key would let a pathological directory name
+// bleed into the fields that follow it. Hashing rootDir to a
+// fixed-length hex digest first closes that: the digest is always the
+// same length and alphabet (0-9a-f) regardless of rootDir's byte
+// content, so it can never absorb or be absorbed by an adjacent field.
+func TestCorpusIndexKey_RootDirControlBytesCannotBleedIntoOtherFields(t *testing.T) {
+	poisoned := "root" + string(rune(0x1f)) + "999" + string(rune(0x1f)) + "sneaky" + string(rune(0x1e))
+
+	// A pathological rootDir must still produce a key where every
+	// other field keeps distinguishing power — changing maxBytes with
+	// the exact same poisoned rootDir must still change the key.
+	a := corpusIndexKey(poisoned, 1, 200, false, nil, nil)
+	b := corpusIndexKey(poisoned, 2, 200, false, nil, nil)
+	assert.NotEqual(t, a, b, "maxBytes must still distinguish keys when rootDir embeds the key's own separator bytes")
+
+	// The hashed rootDir segment (64 hex chars) has fixed length
+	// regardless of the raw rootDir's length or content.
+	short := corpusIndexKey("x", 1, 200, false, nil, nil)
+	long := corpusIndexKey(poisoned, 1, 200, false, nil, nil)
+	assert.Equal(t, len(short), len(long),
+		"the hashed rootDir segment must be a fixed length independent of the raw rootDir's length")
+}
+
 func newLintFileWithRoot(t *testing.T, path, root string) *lint.File {
 	t.Helper()
 	data, err := os.ReadFile(path)