Enhance path sanitization to normalize and block git directory variations

- Update `apps/editor/src/utils/path-sanitizer.ts` to prevent RCE via git config overrides by making the `.git` segment check in `sanitize_file_name` case-insensitive while stripping trailing dots/spaces, and update `create_safe_path` to strictly reject any `realpath` that contains a `.git` directory.

└── apps
    └── editor
        └── src
            ├── commands
            │   ├── apply-response-command
            │   │   ├── apply-response-command.ts
            │   │   ├── response-processor
            │   │   │   └── handlers
            │   │   │       └── diff-handler.ts
            │   │   └── utils
            │   │       └── file-operations
            │   │           └── create-file-if-needed.ts
            │   ├── generate-commit-message-commands
            │   │   └── actions
            │   │       └── run-generate-action.ts
            │   └── history-command
            │       ├── actions
            │       │   └── restore-checkpoint.ts
            │       └── history-command.ts
            ├── features
            │   └── checkpoints
            │       ├── actions
            │       │   └── create-checkpoint.ts
            │       └── utils
            │           ├── copy-optimised-recursively.ts
            │           └── git-utils.ts
            └── utils
                ├── normalize-path.ts
                └── path-sanitizer.ts

Author: robertpiosik

apps/editor/src/utils/path-sanitizer.ts

@@ -15,7 +15,12 @@ export const sanitize_file_name = (name: string): string => {
   }
 
   const segments = name.split(/[/\\]/)
-  if (segments.some((seg) => seg === '.git')) {
+  if (
+    segments.some((seg) => {
+      const normalized = seg.replace(/[\s.]+$/, '').toLowerCase()
+      return normalized == '.git'
+    })
+  ) {
     return ''
   }
 
@@ -39,7 +44,7 @@ export const create_safe_path = (
 ): string | null => {
   const sanitized_name = sanitize_file_name(file_name)
   if (!sanitized_name) {
-    return null // Return null if sanitization results in empty string
+    return null
   }
 
   let resolved_parent: string
@@ -55,6 +60,16 @@ export const create_safe_path = (
   while (true) {
     try {
       const real_path = fs.realpathSync(current_path)
+
+      const real_path_segments = real_path.split(/[/\\]/)
+      if (
+        real_path_segments.some(
+          (seg) => seg.replace(/[\s.]+$/, '').toLowerCase() == '.git'
+        )
+      ) {
+        return null
+      }
+
       const prefix = resolved_parent.endsWith(path.sep)
         ? resolved_parent
         : resolved_parent + path.sep