fix(cli): theme evidence paths read as files, not platform spellings

[Tyagiquamar]

Fixes the Windows failure in packages/vendo/tests/cli/theme/extract-theme.test.ts ("reads a fully conventional shadcn sheet exactly..."):

AssertionError: expected [ 'app/layout.tsx', 'app\globals.css' ] to deeply equal ArrayContaining{…}

Problem

collectCss built each ContextFile.path with path.relative(targetDir, absolute), which emits platform separators. On Windows the collected CSS paths came out backslash-separated (app\globals.css), while every consumer spells these paths POSIX:

• the test asserts them beside conventional entry names (app/layout.tsx, a literal from ENTRY_FILE_CANDIDATES),
• they surface as ThemeSummary.evidencePaths — extraction evidence seeded as hints for the staged model pass, where they are matched as written.

So on any non-POSIX checkout the exact pass reported its own evidence under a spelling nothing else uses, and the suite's allowlist test failed. Verified red on pristine main on this machine before the fix (1 failed / 20).

Fix

Normalize at the single construction site: path.relative(...).split(path.sep).join("/"). No other site produces these paths (layout.path/tailwindConfig.path are POSIX literals from ENTRY_FILE_CANDIDATES and the fixed config-name list), and no consumer re-reads disk from them — they flow to provenance, evidencePathsOf, and parseCssVars' provenance field only. On Linux the normalization is a no-op, so CI behavior is bit-identical.

Testing

• pnpm --filter @vendoai/vendo exec vitest run tests/cli/theme/extract-theme.test.ts → 20 passed on Windows (was 19 passed / 1 failed on main); unchanged assertions, no test edits.
• Scoped gate: pnpm --filter @vendoai/vendo build clean; pnpm --filter @vendoai/vendo typecheck (3 tsconfigs) clean; pnpm lint:packages clean. (Ran via direct package scripts — turbo's platform binary is broken on this machine with STATUS_DLL_NOT_FOUND.)

---

Summary by cubic

Normalizes theme evidence paths in the CLI extractor to POSIX slashes so comparisons are consistent across platforms. Old behavior used platform separators (e.g., app\globals.css on Windows) and broke evidence matching; new behavior always emits repo‑relative POSIX paths (e.g., app/globals.css).

• Only the collected CSS evidence/provenance paths are affected; no filesystem reads use these values.
• No rollout steps; POSIX platforms see no change, and Windows allowlist tests now pass.

^{Written for commit 14b16bb. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[Tyagiquamar]

Hi, friendly ping for review on this PR when you have a moment. Happy to address any feedback. Thanks!

[Tyagiquamar]

Hi, just following up on this when you get a chance. The branch is up to date and checks are green. If it looks good from your side, it should be ready to merge. Happy to make any changes if needed. Thanks!