fix: separate headless editor reports from document and script paths

Author: futhr

Cargo.lock

@@ -57,6 +57,7 @@ thiserror.workspace = true
 tracing = "0.1"
 
 [dev-dependencies]
+tempfile.workspace = true
 masonry_testing = { version = "0.4.0", git = "https://github.com/refpath/xilem.git", rev = "1b96eb8db3f88f85db1a3594d80d3480b29392fb" }
 nuif-testing = { version = "0.0.1", path = "../../crates/nuif-testing" }
 

apps/editor/Cargo.toml

@@ -39,3 +39,10 @@ File saves and exports use the shared
 [output replacement contract](../../crates/nuif-cli/README.md#output-replacement).
 A failed staged write preserves the existing destination. The document and its
 fidelity report remain separate file replacements.
+
+The headless editor rejects a report path that resolves to a document input,
+output, script or expected document. Document output may replace its document
+input, but cannot replace the script or expected document. Path checks resolve
+existing ancestors and normalize missing descendants before creating report
+directories. Reports use staged single-file replacement. These checks do not
+coordinate concurrent directory changes.

apps/editor/README.md

@@ -111,8 +111,44 @@ fn load_initial_document(options: &HeadlessOptions) -> Result<EditorFile, String
     }
 }
 
+fn validate_output_paths(options: &HeadlessOptions) -> Result<(), String> {
+    let identity = |path: &Path| {
+        nuif_codec::filesystem::output_path_identity(path).map_err(|error| error.to_string())
+    };
+    let inputs = [
+        Some(&options.script),
+        options.document.as_ref(),
+        options.expected_document.as_ref(),
+    ];
+    if let Some(report) = &options.report {
+        let report = identity(report)?;
+        for path in inputs.into_iter().flatten().chain(options.output.iter()) {
+            if report == identity(path)? {
+                return Err(
+                    "--report must be separate from document output and input files".to_owned(),
+                );
+            }
+        }
+    }
+    if let Some(output) = &options.output {
+        let output = identity(output)?;
+        for path in [Some(&options.script), options.expected_document.as_ref()]
+            .into_iter()
+            .flatten()
+        {
+            if output == identity(path)? {
+                return Err(
+                    "--output must be separate from the script and expected document".to_owned(),
+                );
+            }
+        }
+    }
+    Ok(())
+}
+
 fn run() -> Result<(), String> {
     let options = parse_options()?;
+    validate_output_paths(&options)?;
     let opened = load_initial_document(&options)?;
     let document = opened.document;
     let mut package = opened.package;
@@ -304,9 +340,9 @@ fn write_json(path: &Path, value: &impl Serialize) -> Result<(), String> {
     if let Some(parent) = path.parent() {
         fs::create_dir_all(parent).map_err(|error| error.to_string())?;
     }
-    fs::write(
+    nuif_codec::filesystem::write_atomic(
         path,
-        serde_json::to_vec_pretty(value).map_err(|error| error.to_string())?,
+        &serde_json::to_vec_pretty(value).map_err(|error| error.to_string())?,
     )
     .map_err(|error| error.to_string())
 }

apps/editor/src/main.rs

@@ -0,0 +1,68 @@
+use std::{fs, process::Command};
+
+#[test]
+fn headless_report_aliases_leave_document_and_script_bytes_unchanged() {
+    let directory = tempfile::tempdir().unwrap();
+    let input = directory.path().join("input.nuif");
+    let output = directory.path().join("output.nuif");
+    let script = directory.path().join("script.jsonl");
+    let expected = directory.path().join("expected.nuif");
+    for path in [&input, &output, &script, &expected] {
+        fs::write(path, b"sentinel").unwrap();
+    }
+    let indirect = directory
+        .path()
+        .join("missing")
+        .join("..")
+        .join("output.nuif");
+    for report in [&input, &output, &script, &expected, &indirect] {
+        let result = Command::new(env!("CARGO_BIN_EXE_nuif-editor"))
+            .arg("--headless")
+            .arg("--document")
+            .arg(&input)
+            .arg("--script")
+            .arg(&script)
+            .arg("--expect-document")
+            .arg(&expected)
+            .arg("--output")
+            .arg(&output)
+            .arg("--report")
+            .arg(report)
+            .output()
+            .unwrap();
+        assert!(!result.status.success());
+        assert!(String::from_utf8_lossy(&result.stderr).contains("--report must be separate"));
+        for path in [&input, &output, &script, &expected] {
+            assert_eq!(fs::read(path).unwrap(), b"sentinel");
+        }
+        assert!(!directory.path().join("missing").exists());
+    }
+}
+
+#[test]
+fn headless_document_output_cannot_overwrite_the_script_or_expectation() {
+    let directory = tempfile::tempdir().unwrap();
+    let script = directory.path().join("script.jsonl");
+    let expected = directory.path().join("expected.nuif");
+    for path in [&script, &expected] {
+        fs::write(path, b"sentinel").unwrap();
+    }
+    for output in [&script, &expected] {
+        let result = Command::new(env!("CARGO_BIN_EXE_nuif-editor"))
+            .arg("--headless")
+            .args(["--new-document", "00000000000000000000000000000001"])
+            .arg("--script")
+            .arg(&script)
+            .arg("--expect-document")
+            .arg(&expected)
+            .arg("--output")
+            .arg(output)
+            .output()
+            .unwrap();
+        assert!(!result.status.success());
+        assert!(String::from_utf8_lossy(&result.stderr).contains("--output must be separate"));
+        for path in [&script, &expected] {
+            assert_eq!(fs::read(path).unwrap(), b"sentinel");
+        }
+    }
+}

apps/editor/tests/output_paths.rs

@@ -631,20 +631,8 @@ fn output_identity(path: &str) -> Result<PathBuf, CliError> {
     if path == "-" {
         return Ok(PathBuf::from("-"));
     }
-    let path = Path::new(path);
-    if let Ok(canonical) = fs::canonicalize(path) {
-        return Ok(canonical);
-    }
-    let parent = path
-        .parent()
-        .filter(|parent| !parent.as_os_str().is_empty())
-        .unwrap_or(Path::new("."));
-    let parent = fs::canonicalize(parent)
-        .map_err(|error| CliError::new(2, "ARGUMENT_INVALID", error.to_string()))?;
-    let name = path
-        .file_name()
-        .ok_or_else(|| CliError::new(2, "ARGUMENT_INVALID", "output requires a filename"))?;
-    Ok(parent.join(name))
+    nuif_codec::filesystem::output_path_identity(Path::new(path))
+        .map_err(|error| CliError::new(2, "ARGUMENT_INVALID", error.to_string()))
 }
 
 fn export_arguments(args: &[String]) -> (&str, &str, Option<&str>) {

crates/nuif-cli/src/main.rs

@@ -2,7 +2,49 @@
 
 use std::fs::{self, File};
 use std::io::{self, Write as _};
-use std::path::Path;
+use std::path::{Component, Path, PathBuf};
+
+/// Resolves an output path through its nearest existing ancestor.
+///
+/// Missing descendants are normalized lexically so a report path can be checked
+/// before its parent directory is created. This does not lock directory entries.
+///
+/// # Errors
+///
+/// Returns an error when the current directory or an existing ancestor cannot
+/// be resolved.
+pub fn output_path_identity(path: &Path) -> io::Result<PathBuf> {
+    let absolute = std::path::absolute(path)?;
+    let mut ancestor = absolute.as_path();
+    let mut suffix = Vec::new();
+    loop {
+        match fs::canonicalize(ancestor) {
+            Ok(mut resolved) => {
+                for component in suffix.into_iter().rev() {
+                    match component {
+                        Component::ParentDir => {
+                            resolved.pop();
+                        }
+                        Component::CurDir => {}
+                        other => resolved.push(other.as_os_str()),
+                    }
+                }
+                return Ok(resolved);
+            }
+            Err(error) if error.kind() == io::ErrorKind::NotFound => {
+                let component = ancestor
+                    .components()
+                    .next_back()
+                    .ok_or_else(|| io::Error::other("output path has no existing ancestor"))?;
+                suffix.push(component);
+                ancestor = ancestor
+                    .parent()
+                    .ok_or_else(|| io::Error::other("output path has no existing ancestor"))?;
+            }
+            Err(error) => return Err(error),
+        }
+    }
+}
 
 /// Writes bytes to a sibling temporary file, then replaces the destination.
 ///
@@ -64,6 +106,27 @@ fn write_atomic_with(
 mod tests {
     use super::*;
 
+    #[test]
+    fn output_identity_resolves_missing_parent_aliases_without_creating_them() {
+        let directory = tempfile::tempdir().unwrap();
+        let direct = directory.path().join("document.nuif");
+        let indirect = directory
+            .path()
+            .join("missing")
+            .join("..")
+            .join("document.nuif");
+        assert_eq!(
+            output_path_identity(&direct).unwrap(),
+            output_path_identity(&indirect).unwrap()
+        );
+        assert_eq!(fs::read_dir(directory.path()).unwrap().count(), 0);
+        fs::write(&direct, b"existing").unwrap();
+        assert_eq!(
+            output_path_identity(&direct).unwrap(),
+            output_path_identity(&indirect).unwrap()
+        );
+    }
+
     #[test]
     fn failed_staged_write_preserves_existing_file_and_cleans_temporary_file() {
         let directory = tempfile::tempdir().unwrap();

crates/nuif-codec/src/filesystem.rs

@@ -63,7 +63,8 @@ planning, a post-import fixpoint, a second edit, byte locality, structural-edit
 refusal and stale-span refusal. The report records case dimensions, document
 hashes, source size, checks, revision and environment. Separate CLI subprocess
 tests check in-place synchronization, unsupported-edit preservation and
-report-path alias rejection. Results are written to
+report-path alias rejection. Headless editor subprocess tests reject report,
+script and expected-document collisions before reading or writing documents. Results are written to
 `target/source-workflow-report.json` and archived by CI.
 
 This is a generated regression corpus. Its dimensions are selected by the