fix: use path.sep for wiki path-traversal check on Windows

[drewperd1000]

Summary

readWikiArticle hardcoded a POSIX forward-slash when verifying that the resolved article path stays inside the wiki directory:

if (!resolved.startsWith(wikiDir + "/") && resolved !== wikiDir) return null;

On Windows, path.resolve() returns backslash-delimited paths, so this check always returned false and every wiki article lookup fell through to return null. Both codesight_get_wiki_index and codesight_get_wiki_article MCP tools were broken for Windows users. Other tools (codesight_get_summary, codesight_lint_wiki, etc.) were unaffected because they don't route through readWikiArticle.

Fix

Use path.sep so the boundary check works cross-platform:

const { resolve, sep } = await import("node:path");
...
if (!resolved.startsWith(wikiDir + sep) && resolved !== wikiDir) return null;

Two-line change in src/generators/wiki.ts.

Tests

Added tests/wiki.test.ts with three regression tests:

• readWikiArticle returns content for an existing article (with and without .md extension, covering both index and a regular article)
• readWikiArticle rejects path-traversal attempts (../../../etc/passwd, ../package.json)
• readWikiArticle returns null for nonexistent articles

Updated package.json test script to include the new file:

"test": "pnpm build && tsx --test tests/detectors.test.ts tests/wiki.test.ts"

All three new tests pass on Windows. Repro locally with pnpm test.

Manual repro on Windows

1. codesight scan in any project
2. Call codesight_get_wiki_index via the MCP tool
3. Before: returns null (tool reports "wiki not found")
4. After: returns the index content

Scope note

While running the suite I hit three pre-existing failures in tests/detectors.test.ts on main for Python workspace subdirectory detection. They are the same class of Windows path-separator issue but on the test-assertion side — they compare hardcoded services/foo strings against actual services\foo results. I deliberately left them out of this PR to keep it surgical and happy to send a follow-up if you'd like.

🤖 Generated with Claude Code

[Houseofmvps]

Applied manually in commit a0d9d97 alongside fixes for issues #21, #22, and #24. The fix is identical — path.sep instead of hardcoded "/" in the path-traversal guard. Also added the test suite from this PR (tests/wiki.test.ts), all 3 tests pass. Thanks for the clean, surgical fix and the note about the pre-existing Windows test failures — those are on the radar for a follow-up.