fix: reject Windows drive-relative paths in normalizeRelativePath

Author: AmanVarshney01

packages/cli/src/lib/app/preview-build-settings.ts

@@ -596,6 +596,11 @@ export function normalizeRelativePath(value: string): string | undefined {
   if (raw.length === 0 || raw.split("/").includes("..")) {
     return undefined;
   }
+  // Windows drive-relative paths ("C:dir") escape the base directory but
+  // are not absolute under either path.win32 or path.posix.
+  if (/^[A-Za-z]:/.test(raw)) {
+    return undefined;
+  }
 
   const normalized = path.posix.normalize(raw);
   const segments = normalized.split("/");

packages/cli/tests/compute-config.test.ts

@@ -144,6 +144,14 @@ describe("normalizeComputeConfig", () => {
     expect(issues.join(" ")).toContain("`apps.web.env.vars.EMPTY` must be a non-empty string.");
   });
 
+  it("rejects roots that escape the config directory, including Windows drive-relative paths", () => {
+    for (const root of ["C:apps", "C:/apps", "/apps", "..\\apps"]) {
+      expect(normalizeIssues({ app: { root } }).join(" ")).toContain(
+        "`app.root` must be a relative path inside the repository.",
+      );
+    }
+  });
+
   it("normalizes build blocks", () => {
     const config = normalizeOrThrow(defineComputeConfig({
       apps: {