kettle-family 1.3.1 → 1.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce61863e305027b86eef8097ce594d8a9b77ba0e9e043ecb1617be9722a5ae38
-  data.tar.gz: 2b61292cbe3fcabb567c8f47ab7bac6170782dcedf75366452bb171b29b5a96a
+  metadata.gz: 2fd15138050afedb68be9d6d294f7e3a01dc1554949c8607b1176ddf8d061581
+  data.tar.gz: 272997658ef8c5a96b14fbc1dcc8d124b545abe50d5bc0ca423823c8dffc3ad8
 SHA512:
-  metadata.gz: 47d6f2b5ebe4cbb0480c75037f702aba4eacf8185758df0724922d5cf2780d15a6c742d92e4d0bbdb55e64d3272c41a9ee3db8d46ad4e3bb39fedcc82427c25e
-  data.tar.gz: 1b0db917fd48cfe90aee4f6d00909ea667b9aab0bd9ac13704039a0117878f0f46d6ef6a5f1ef3f7e23a81858ef6f3aa2966d219127826a664c7c640f15da160
+  metadata.gz: a5bac59bea82eec800e67069ae00f8810c54a29a7fe3119b4c9ef93f94924af677b0da411635928841d9c0df47d4bfb11853d622cccaf1c72faf6f6419a552d6
+  data.tar.gz: c4d9b06b6fed1f0822bdc62ec6d22b3cb379bc1fe7b49e388038e58780c567ecbe3f589e11faa7845e92b2b6b7d365499271f17d0ad8e942636d632f25dbf950

data/CHANGELOG.md

@@ -30,6 +30,90 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.3.3] - 2026-09-28
+
+- TAG: [v1.3.3][1.3.3t]
+- COVERAGE: 93.25% -- 6538/7011 lines in 37 files
+- BRANCH COVERAGE: 77.76% -- 2660/3421 branches in 37 files
+- 33.57% documented
+
+### Fixed
+
+- Compare filesystem paths by canonical identity throughout family workflows.
+
+## [1.3.2] - 2026-09-28
+
+- TAG: [v1.3.2][1.3.2t]
+- COVERAGE: 93.25% -- 6537/7010 lines in 37 files
+- BRANCH COVERAGE: 77.77% -- 2659/3419 branches in 37 files
+- 33.57% documented
+
+### Added
+
+- kettle-jem-template-20260913-001 - Templating now also surfaces a review
+  entry in `dependency_conflicts.resolve` when a direct development
+  dependency doesn't support one or more of this project's declared
+  `engines:` and has no template-managed modular home (e.g. `sqlite3` on
+  `jruby`). Review each entry and pick a resolution per the project's own
+  engine support needs.
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 13 project files:
+  - dependencies (13)
+
+- [kc] kettle-jem/template: updated 14 project files:
+  - code and tests (2)
+  - dependencies (2)
+  - other (1)
+  - workflows (9)
+
+### Fixed
+
+- Run local Kettle Jem through a prepared member bundle so local StructuredMerge dependencies are activated during templating.
+
+- Pin bupb to an installed stable Bundler version, including its managed child updates.
+
+- [kc] nomono-self-upgrade-bundler-env: Preserve RUBYOPT bundle activation for local Kettle Jem execution, but omit eager setup from nomono self-upgrade lockfile updates so the stale self-version can be reconciled without falling back from the local template stack.
+
+- Recover template lockfiles with Bundler's valid bundle lock --update GEM syntax instead of passing gem names as invalid positional arguments.
+
+- Template preparation now starts local Kettle Jem from its own bundle when the destination lockfile path-locks Nomono, allowing bootstrap repair before the destination bundle loads.
+
+- Refresh dependent lockfiles before committing newly raised family dependency floors.
+
+- Handle macOS canonical temp paths, Unix socket limits, and PTY EOF during family workflows.
+
+- Canonicalize Windows system temporary paths for Git-based specs, launch the Mise integration fixture on Windows, and include WEBrick for local registry specs.
+
+- Readiness checks accept existing binstub files on Windows, where Unix executable-bit checks are not portable.
+
+- Make family specs portable on Windows and use valid generated gemspec fixtures.
+
+- Support Windows pipe-driven interactive commands, absolute local-path lockfile remotes, and equivalent filesystem path spellings in family workflows.
+
+- Apply workflow environment overrides portably after mise and normalize Windows filesystem paths in discovery and branch configuration.
+
+- Normalize filesystem glob separators across supported platforms so family discovery, installs, and workflow asset lookup find paths on Windows.
+
+- Normalize Windows path aliases and subprocess line endings in family workflows.
+
+- Close the child input stream when a configured OTP provider returns no code, preventing interactive release commands from hanging.
+
+- Start the Windows environment wrapper without inherited RUBYOPT so Bundler cannot activate the parent bundle before wrapper overrides are applied.
+
+- Windows family workflows now reset lockfiles without relying on the POSIX env utility, terminate failed interactive child processes, and apply member exclusion patterns case-insensitively.
+
+- Windows family workflow specs now preserve command arguments and handle case-insensitive checkout paths.
+
+- Detect Windows drive-absolute local paths when preparing release lockfile normalization.
+
+- Delegate canonical, identity, and containment path checks to kettle-dev so family workflows consistently handle symlink aliases and platform path semantics.
+
+- Windows family discovery now applies exclusion globs across path separators, and branch-target config lookup uses shared path normalization.
+
+- Resolve family-relative paths by filesystem identity so discovery exclusions and branch-stack configs work with Windows path aliases.
+
 ## [1.3.1] - 2026-09-10
 
 - TAG: [v1.3.1][1.3.1t]
@@ -2746,7 +2830,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.1...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.3...HEAD
+[1.3.3]: https://github.com/kettle-dev/kettle-family/compare/v1.3.2...v1.3.3
+[1.3.3t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.3
+[1.3.2]: https://github.com/kettle-dev/kettle-family/compare/v1.3.1...v1.3.2
+[1.3.2t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.2
 [1.3.1]: https://github.com/kettle-dev/kettle-family/compare/v1.3.0...v1.3.1
 [1.3.1t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.1
 [1.3.0]: https://github.com/kettle-dev/kettle-family/compare/v1.2.100...v1.3.0

data/README.md

@@ -1186,7 +1186,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.795-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-7.011-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/branch_target_config.rb

@@ -2,6 +2,7 @@
 
 require "open3"
 require "yaml"
+require_relative "paths"
 
 module Kettle
   module Family
@@ -54,7 +55,7 @@ module Kettle
         return false if left.to_s.empty? || right.to_s.empty?
         return false unless File.file?(left) && File.file?(right)
 
-        File.realpath(left) == File.realpath(right)
+        Paths.same?(left, right)
       end
 
       def member_local_release_config_from_branch(member)
@@ -75,20 +76,22 @@ module Kettle
         raise Error, "could not determine git root for #{member.root}: #{stderr}" unless status.success?
 
         File.realpath(stdout.strip)
+      rescue SystemCallError
+        raise Error, "could not determine git root for #{member.root}: invalid Git root response"
       end
 
       def member_relative_root(member, root)
-        member_root = File.realpath(member.root)
-        return "." if member_root == root
-        return member_root.delete_prefix("#{root}/") if member_root.start_with?("#{root}/")
+        relative = Paths.relative(member.root, root)
+        raise Error, "member root #{member.root} is outside git root #{root}" unless relative
 
-        raise Error, "member root #{member.root} is outside git root #{root}"
+        relative
       end
 
       def member_local_config_paths(root, relative_root)
         branches = local_branches(root)
         candidates = Config::DEFAULT_PATHS.map do |path|
-          (relative_root == ".") ? path : File.join(relative_root, path)
+          candidate = (relative_root == ".") ? path : File.join(relative_root, path)
+          candidate.tr("\\", "/")
         end
         branches.each_with_object([]) do |branch, memo|
           candidates.each do |path|

data/lib/kettle/family/command_runner.rb

@@ -11,6 +11,17 @@ module Kettle
         "KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE"
       ].freeze
       MISE_SESSION_ENV_PREFIX = "__MISE_"
+      WINDOWS_ENV_EXEC_SCRIPT = <<~RUBY
+        unset_count = Integer(ARGV.shift)
+        unset_count.times { ENV.delete(ARGV.shift) }
+        assignment_count = Integer(ARGV.shift)
+        assignment_count.times do
+          key, value = ARGV.shift.split("=", 2)
+          ENV[key] = value
+        end
+        abort "missing command after environment arguments" if ARGV.shift != "--"
+        exec(*ARGV)
+      RUBY
 
       class OtpCoordinator
         def initialize(input: $stdin, output: $stdout, queue_total: nil, secrets_provider: nil, event_handler: nil)
@@ -371,7 +382,7 @@ module Kettle
                 end
               end
             end
-          rescue Errno::EIO
+          rescue Errno::EIO, EOFError
             # PTY raises EIO when the child process exits after closing the slave.
           rescue Error => error
             stderr << "#{error.message}\n"
@@ -386,6 +397,19 @@ module Kettle
       end
 
       def run_interactive_open3(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:, log_io: nil, passthrough_output: true)
+        if Gem.win_platform?
+          return run_interactive_open3_threads(
+            env: env,
+            argv: argv,
+            chdir: chdir,
+            member_name: member_name,
+            process_options: process_options,
+            stdout_line_handler: stdout_line_handler,
+            log_io: log_io,
+            passthrough_output: passthrough_output
+          )
+        end
+
         captured_stdout = +""
         captured_stderr = +""
         stdout_line_buffer = +""
@@ -431,6 +455,62 @@ module Kettle
         [captured_stdout, captured_stderr, status]
       end
 
+      def run_interactive_open3_threads(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:, log_io: nil, passthrough_output: true)
+        captured_stdout = +""
+        captured_stderr = +""
+        stdout_line_buffer = +""
+        prompt_buffer = +""
+        status = nil
+        Open3.popen3(env, *argv, chdir: chdir, **process_options) do |input, output, stderr_stream, wait_thread|
+          streams = [output, stderr_stream]
+          streams << $stdin if $stdin.tty? && !otp_coordinator
+          queue = Queue.new
+          readers = streams.map do |stream|
+            Thread.new do # rubocop:disable ThreadSafety/NewThread -- Windows pipes are not selectable with IO.select.
+              loop { queue << [stream, stream.readpartial(1024)] }
+            rescue IOError
+              queue << [stream, nil]
+            end
+          end
+          input_reader = readers[streams.index($stdin)] if streams.include?($stdin)
+          active_streams = streams.dup
+          begin
+            until active_streams.empty?
+              stream, chunk = queue.pop
+              unless chunk
+                active_streams.delete(stream)
+                next
+              end
+              if stream.equal?($stdin)
+                input.write(chunk)
+                next
+              end
+              if stream.equal?(output)
+                captured_stdout << chunk
+                transcript_write(log_io, chunk)
+                stdout_line_buffer = print_interactive_stdout(stdout_line_buffer, chunk, stdout_line_handler, passthrough_output: passthrough_output)
+              else
+                captured_stderr << chunk
+                transcript_write(log_io, chunk)
+                $stderr.print(chunk) if passthrough_output
+              end
+              prompt_buffer = handle_interactive_prompt(input, chunk, member_name: member_name, prompt_buffer: prompt_buffer)
+            end
+            status = wait_thread.value
+          rescue Error => exception
+            captured_stderr << "#{exception.message}\n"
+            transcript_write(log_io, "#{exception.message}\n")
+            terminate_process(wait_thread.pid)
+            status = failure_status
+          ensure
+            input_reader&.kill if input_reader&.alive?
+            readers.each(&:join)
+          end
+          flush_interactive_stdout(stdout_line_buffer, stdout_line_handler, passthrough_output: passthrough_output)
+        end
+        [captured_stdout, captured_stderr, status]
+      end
+
       def read_interactive_stream(
         reader,
         output,
@@ -562,7 +642,10 @@ module Kettle
 
       def write_otp_response(input, chunk, member_name:)
         response = otp_coordinator.request(member_name: member_name || "release", chunk: chunk)
-        return if response.to_s.empty?
+        if response.to_s.empty?
+          input.close unless input.closed?
+          return
+        end
 
         input.write("#{response}\n")
         input.flush
@@ -586,7 +669,7 @@ module Kettle
       end
 
       def normalize_output(output)
-        output.to_s.encode("UTF-8", invalid: :replace, undef: :replace, replace: "")
+        output.to_s.encode("UTF-8", invalid: :replace, undef: :replace, replace: "").gsub("\r\n", "\n")
       end
 
       def failure_status
@@ -594,8 +677,8 @@ module Kettle
       end
 
       def terminate_process(pid)
-        Process.kill("TERM", pid)
-      rescue Errno::ESRCH, Errno::EPERM
+        Process.kill(Gem.win_platform? ? "KILL" : "TERM", pid)
+      rescue Errno::ESRCH, Errno::EPERM, Errno::EINVAL
         nil
       end
 
@@ -612,6 +695,23 @@ module Kettle
         mise_argv = ["mise", "exec", "-C", member.root, "--"]
         return [*mise_argv, *argv] if injected_env.empty?
 
+        if Gem.win_platform?
+          return [
+            *mise_argv,
+            "ruby",
+            "--disable=rubyopt",
+            "-e",
+            WINDOWS_ENV_EXEC_SCRIPT,
+            "--",
+            unset_env.length.to_s,
+            *unset_env.map { |key, _value| key.to_s },
+            set_env.length.to_s,
+            *set_env.map { |key, value| "#{key}=#{value}" },
+            "--",
+            *argv
+          ]
+        end
+
         [*mise_argv, "env", *injected_env, *argv]
       end
 

data/lib/kettle/family/config.rb

@@ -402,9 +402,7 @@ module Kettle
       private
 
       def path_within_root?(path)
-        expanded_path = File.expand_path(path)
-        expanded_root = File.expand_path(root)
-        expanded_path == expanded_root || expanded_path.start_with?("#{expanded_root}/")
+        Paths.within?(path, root)
       end
 
       def expand_config_relative_path(value)

data/lib/kettle/family/discovery.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "open3"
+require_relative "paths"
 
 module Kettle
   module Family
@@ -36,7 +37,7 @@ module Kettle
 
         (configured + discovered).each do |member|
           existing = by_name[member.name]
-          raise Error, "duplicate family member #{member.name.inspect}" if existing && existing.root != member.root
+          raise Error, "duplicate family member #{member.name.inspect}" if existing && !same_directory?(existing.root, member.root)
 
           by_name[member.name] = member
         end
@@ -46,7 +47,7 @@ module Kettle
 
       def discover_members
         gemspecs = config.discover_member_roots.flat_map do |root|
-          Dir.glob(File.join(root, "**", "*.gemspec"))
+          Paths.glob(root, "**", "*.gemspec")
         end
         gemspecs.reject! { |path| excluded_gemspec?(path) }
         gemspecs.map { |path| member_from_gemspec(path) }
@@ -82,7 +83,7 @@ module Kettle
       end
 
       def primary_gemspec(root)
-        gemspecs = Dir.glob(File.join(root, "*.gemspec"))
+        gemspecs = Paths.glob(root, "*.gemspec")
         raise Error, "no gemspec found in #{root}" if gemspecs.empty?
         return gemspecs.first if gemspecs.one?
 
@@ -94,9 +95,8 @@ module Kettle
 
         # Selection limits evaluation, not membership in the configuration.
         roots = configured.map(&:root) + config.configured_member_roots + config.explicit_members.map { |entry| entry.fetch("root") }
-        configured_roots = roots.map { |root| normalized_path(root) }
         discovered.each do |member|
-          next if configured_roots.include?(normalized_path(member.root))
+          next if roots.any? { |root| same_directory?(root, member.root) }
 
           warnings << {
             "kind" => "unlisted_discovered_member",
@@ -108,7 +108,11 @@ module Kettle
       end
 
       def normalized_path(path)
-        File.expand_path(path)
+        Paths.canonical(path).tr("\\", "/")
+      end
+
+      def same_directory?(left, right)
+        Paths.same?(left, right)
       end
 
       def member_from_gemspec(path)
@@ -172,7 +176,7 @@ module Kettle
         canonical = File.join(root, "lib", gem_name.tr("-", "_"), "version.rb")
         return canonical if File.file?(canonical)
 
-        candidates = Dir.glob(File.join(root, "lib", "**", "version.rb"))
+        candidates = Paths.glob(root, "lib", "**", "version.rb")
         candidates.min
       end
 
@@ -220,8 +224,36 @@ module Kettle
 
       def path_matches_pattern?(path, pattern)
         relative_candidates(path).any? do |relative|
-          File.fnmatch?(pattern, relative, File::FNM_DOTMATCH | File::FNM_EXTGLOB)
+          path_glob_match?(pattern, relative)
+        end
+      end
+
+      def path_glob_match?(pattern, path)
+        pattern_parts = pattern.tr("\\", "/").split("/")
+        path_parts = path.tr("\\", "/").split("/")
+        if Gem.win_platform?
+          pattern_parts.map!(&:downcase)
+          path_parts.map!(&:downcase)
         end
+
+        path_glob_parts_match?(pattern_parts, path_parts, {})
+      end
+
+      def path_glob_parts_match?(pattern_parts, path_parts, memo)
+        key = [pattern_parts.length, path_parts.length]
+        return memo[key] if memo.key?(key)
+        return memo[key] = path_parts.empty? if pattern_parts.empty?
+
+        pattern_part = pattern_parts.first
+        matched = if pattern_part == "**"
+          path_glob_parts_match?(pattern_parts.drop(1), path_parts, memo) ||
+            (!path_parts.empty? && path_glob_parts_match?(pattern_parts, path_parts.drop(1), memo))
+        else
+          !path_parts.empty? &&
+            File.fnmatch?(pattern_part, path_parts.first, File::FNM_DOTMATCH | File::FNM_EXTGLOB) &&
+            path_glob_parts_match?(pattern_parts.drop(1), path_parts.drop(1), memo)
+        end
+        memo[key] = matched
       end
 
       def relative_candidates(path)
@@ -231,12 +263,7 @@ module Kettle
       end
 
       def relative_path(path, root)
-        expanded_path = File.expand_path(path)
-        expanded_root = File.expand_path(root)
-        prefix = "#{expanded_root}/"
-        return unless expanded_path.start_with?(prefix)
-
-        expanded_path.delete_prefix(prefix)
+        Paths.relative(path, root)
       end
 
       class GemfileDependencyCollector

data/lib/kettle/family/local_install.rb

@@ -7,6 +7,7 @@ require "open3"
 require "time"
 
 require_relative "concurrency"
+require_relative "paths"
 
 module Kettle
   module Family
@@ -140,7 +141,7 @@ module Kettle
 
         raise Error, "install local dependency does not exist: #{path}" unless Dir.exist?(expanded)
 
-        gemspecs = Dir.glob(File.join(expanded, "*.gemspec"))
+        gemspecs = Paths.glob(expanded, "*.gemspec")
         raise Error, "no gemspec found for install local dependency: #{path}" if gemspecs.empty?
         raise Error, "multiple gemspecs found for install local dependency: #{path}" if gemspecs.size > 1
 
@@ -163,7 +164,7 @@ module Kettle
         canonical = File.join(root, "lib", gem_name.tr("-", "_"), "version.rb")
         return canonical if File.file?(canonical)
 
-        Dir.glob(File.join(root, "lib", "**", "version.rb")).min
+        Paths.glob(root, "lib", "**", "version.rb").min
       end
 
       def required_ruby_version(spec)

data/lib/kettle/family/nomono_bootstrap.rb

@@ -3,6 +3,8 @@
 require "rubygems"
 require "kettle/dev"
 
+require_relative "paths"
+
 module Kettle
   module Family
     class NomonoBootstrap
@@ -91,7 +93,7 @@ module Kettle
       end
 
       def local_gemfile_edits(member)
-        Dir.glob(File.join(member.root, "gemfiles/modular/**/*_local.gemfile")).sort.flat_map do |path|
+        Paths.glob(member.root, "gemfiles/modular/**/*_local.gemfile").sort.flat_map do |path|
           source = File.read(path)
           parse_result = Kettle::Dev::VersionBump.parse_source(source, path)
           Kettle::Dev::VersionBump.each_node(parse_result.value).filter_map do |node|

data/lib/kettle/family/paths.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "kettle/dev"
+
+module Kettle
+  module Family
+    module Paths
+      module_function
+
+      def canonical(path, base: nil)
+        Kettle::Dev::Paths.canonical(path, base: base)
+      end
+
+      def same?(left, right, base: nil)
+        Kettle::Dev::Paths.same?(left, right, base: base)
+      end
+
+      def within?(path, root, base: nil)
+        Kettle::Dev::Paths.within?(path, root, base: base)
+      end
+
+      # Computes a relative path by walking filesystem ancestors. Component
+      # string comparisons are insufficient on Windows, where equivalent
+      # paths may have different drive-letter casing or filesystem aliases.
+      def relative(path, root)
+        candidate = canonical(path)
+        boundary = canonical(root)
+        return "." if same?(candidate, boundary)
+
+        is_directory = File.directory?(candidate)
+        current = is_directory ? candidate : File.dirname(candidate)
+        parts = is_directory ? [] : [File.basename(candidate)]
+
+        until same?(current, boundary)
+          parent = File.dirname(current)
+          return unless parent != current
+
+          parts.unshift(File.basename(current))
+          current = parent
+        end
+
+        File.join(*parts).tr("\\", "/")
+      end
+
+      def glob(*parts)
+        Dir.glob(File.join(*parts).tr("\\", "/"))
+      end
+
+      def local_path_remote?(remote)
+        text = remote.to_s
+        drive_absolute = text.length >= 3 && text[1] == ":" && ["/", "\\"].include?(text[2])
+        drive_absolute || text.start_with?("/", "./", "../", ".\\", "..\\") || Pathname.new(text).absolute?
+      end
+    end
+  end
+end

data/lib/kettle/family/readiness_check.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "paths"
+
 module Kettle
   module Family
     class ReadinessCheck
@@ -43,7 +45,8 @@ module Kettle
       def missing_required_bins
         required_bins.filter_map do |path|
           full_path = File.join(member.root, path)
-          next if File.file?(full_path) && File.executable?(full_path)
+          executable = Gem.win_platform? || File.executable?(full_path)
+          next if File.file?(full_path) && executable
 
           "missing executable binstub #{path}"
         end
@@ -100,7 +103,8 @@ module Kettle
         return [] unless File.file?(lockfile)
 
         File.readlines(lockfile).filter_map.with_index(1) do |line, index|
-          next unless line.start_with?("  remote: /", "  remote: ./", "  remote: ../")
+          next unless line.start_with?("  remote:")
+          next unless Paths.local_path_remote?(line.split("remote:", 2).last.to_s.strip)
           next if allowed_local_path?(line)
 
           "release lockfile has local path remote at Gemfile.lock:#{index}"
@@ -112,17 +116,14 @@ module Kettle
         remote_path = normalized_path(remote, base: member.root)
         return false unless remote_path
 
-        allowed_local_path_roots.any? { |root| remote_path == root || remote_path.start_with?("#{root}/") }
+        allowed_local_path_roots.any? { |root| Paths.within?(remote_path, root) }
       end
 
       def normalized_path(path, base: nil)
         text = path.to_s
         return nil if text.empty? || text.casecmp("false").zero?
 
-        expanded = File.expand_path(text, base)
-        File.realpath(expanded)
-      rescue Errno::ENOENT
-        expanded
+        Paths.canonical(text, base: base)
       end
 
       def required_files

data/lib/kettle/family/release_graph.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require_relative "paths"
 
 module Kettle
   module Family
@@ -57,7 +58,7 @@ module Kettle
         raise Error, "#{name} release graph requires a local path selector" if selector_env.empty?
 
         selector_env.each_value do |value|
-          next if local_path_roots.any? { |root| value == root || value.start_with?("#{root}/") }
+          next if local_path_roots.any? { |root| Paths.within?(value, root) }
 
           raise Error, "#{name} selector #{value.inspect} is outside its declared local path roots"
         end
@@ -66,17 +67,14 @@ module Kettle
 
         raise Error, "monorepo_ci_local release graph requires a CI root" if ci_root.to_s.empty?
         local_path_roots.each do |path|
-          next if path == ci_root || path.start_with?("#{ci_root}/")
+          next if Paths.within?(path, ci_root)
 
           raise Error, "monorepo_ci_local path #{path.inspect} is outside CI root #{ci_root.inspect}"
         end
       end
 
       def canonical_path(path)
-        expanded = File.expand_path(path)
-        File.realpath(expanded)
-      rescue Errno::ENOENT
-        expanded
+        Paths.canonical(path)
       end
     end
   end