fix(demo): refuse to seed over a directory that is not a previous demo (#20)

`flightdeck demo --dir` pointed at an existing org silently overwrote
flightdeck.yaml/models.yaml/usecases.yaml, rmtree'd workflows/ and
deleted the run store and the audit ledger — the whole evidence trail.
seed() now refuses any non-empty target that is not a previous demo
(recognized by the demo org name in flightdeck.yaml); the CLI maps the
refusal to exit 2. Re-seeding a demo dir in place keeps working.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: sturlese

src/flightdeck/cli.py

@@ -26,7 +26,7 @@
 from flightdeck import __version__, scaffold
 from flightdeck import backlog as backlog_mod
 from flightdeck.config import ConfigError, Org, load_org
-from flightdeck.demo import seed
+from flightdeck.demo import DemoSeedError, seed
 from flightdeck.feedback import FeedbackError, record_feedback
 from flightdeck.integrations import slack
 from flightdeck.integrations.slack import SlackError
@@ -108,7 +108,11 @@ def demo(
     html: Annotated[Path | None, typer.Option(help="Where to write the dashboard.")] = None,
 ) -> None:
     """Seed a 13-week fictional org (offline, deterministic) and report on it."""
-    summary = seed(dir)
+    try:
+        summary = seed(dir)
+    except DemoSeedError as exc:
+        err.print(f"[red]{exc}[/red]")
+        raise typer.Exit(2) from None
     org = _org(dir)
     with Store(org.db_path) as store:
         ledger = Ledger(org.ledger_path)

src/flightdeck/demo.py

@@ -26,6 +26,8 @@
 from pathlib import Path
 from random import Random
 
+import yaml
+
 from flightdeck.config import load_org
 from flightdeck.ledger import Ledger
 from flightdeck.runner import record  # the same evidence path real runs take
@@ -116,6 +118,12 @@ class _Profile:
 )
 
 
+class DemoSeedError(Exception):
+    """Seeding would destroy files that are not a previous flightdeck demo. The
+    CLI maps this to a usage error (exit 2); callers that mean it pass a fresh
+    directory."""
+
+
 @dataclass
 class DemoSummary:
     root: Path
@@ -139,10 +147,36 @@ def _business_moment(rng: Random, week_start: date, max_day: int = 4) -> datetim
     )
 
 
+def _refuse_to_destroy(root: Path, source) -> None:
+    """Allow seeding only into a new/empty directory or a previous demo org,
+    recognized by the demo org's name in ``flightdeck.yaml``. Re-seeding a demo
+    in place is routine (the dir accumulates dashboards and runtime state);
+    silently wiping a REAL org's workflows, store and audit ledger is not."""
+    if not root.exists() or not any(root.iterdir()):
+        return
+    demo_name = yaml.safe_load((source / "flightdeck.yaml").read_text(encoding="utf-8"))["name"]
+    org_file = root / "flightdeck.yaml"
+    if org_file.is_file():
+        try:
+            existing = yaml.safe_load(org_file.read_text(encoding="utf-8"))
+        except yaml.YAMLError:
+            existing = None
+        if isinstance(existing, dict) and existing.get("name") == demo_name:
+            return
+    raise DemoSeedError(
+        f"refusing to seed the demo into {root}: the directory is not empty and is not a "
+        f"previous flightdeck demo — seeding would overwrite the org files and delete "
+        f"workflows/, the run store and the audit ledger. Pass a new or empty --dir."
+    )
+
+
 def seed(target: Path | str, weeks: int = WEEKS, rng_seed: int = SEED) -> DemoSummary:
-    """Create the demo org at ``target`` and seed its store and ledger."""
+    """Create the demo org at ``target`` and seed its store and ledger. ``target``
+    must be new, empty, or a previous demo: seeding overwrites the org files and
+    deletes workflows/, the store and the ledger (see ``_refuse_to_destroy``)."""
     root = Path(target)
     source = files("flightdeck") / "demo_org"
+    _refuse_to_destroy(root, source)
     root.mkdir(parents=True, exist_ok=True)
     for item in ("flightdeck.yaml", "models.yaml", "usecases.yaml"):
         (root / item).write_text((source / item).read_text(encoding="utf-8"), encoding="utf-8")

tests/test_backlog_demo.py

@@ -1,9 +1,12 @@
+import pytest
+
 from flightdeck.backlog import ranked, score
 from flightdeck.config import load_org
-from flightdeck.demo import seed
+from flightdeck.demo import DemoSeedError, seed
 from flightdeck.ledger import Ledger
 from flightdeck.metrics import build_report
 from flightdeck.store import Store
+from tests.conftest import write_org
 
 
 def test_demo_seeds_a_full_believable_program(tmp_path):
@@ -38,6 +41,44 @@ def test_demo_is_deterministic_for_a_given_day(tmp_path):
     )
 
 
+def test_demo_refuses_to_seed_over_a_real_org(tmp_path):
+    # Pointing --dir at a REAL org must refuse loudly and touch nothing: seeding
+    # overwrites the org files and deletes workflows/, the store and the ledger.
+    root = write_org(tmp_path / "org")  # TestCo, with its own workflows
+    workflow = root / "workflows" / "support-reply.yaml"
+    before = workflow.read_text(encoding="utf-8")
+
+    with pytest.raises(DemoSeedError, match="refusing to seed"):
+        seed(root)
+
+    assert workflow.read_text(encoding="utf-8") == before  # nothing deleted or rewritten
+    assert "TestCo" in (root / "flightdeck.yaml").read_text(encoding="utf-8")
+
+
+def test_demo_refuses_a_nonempty_non_org_directory(tmp_path):
+    # No flightdeck.yaml at all (say, a project root): still refuse — seeding
+    # would delete an unrelated workflows/ directory without warning.
+    target = tmp_path / "project"
+    (target / "workflows").mkdir(parents=True)
+    (target / "workflows" / "deploy.yaml").write_text("keep me", encoding="utf-8")
+
+    with pytest.raises(DemoSeedError):
+        seed(target)
+
+    assert (target / "workflows" / "deploy.yaml").read_text(encoding="utf-8") == "keep me"
+
+
+def test_demo_reseeds_its_own_directory(tmp_path):
+    # A previous demo (recognized by the demo org name) refreshes in place — the
+    # dir legitimately accumulates dashboards and runtime state between runs.
+    target = tmp_path / "demo"
+    seed(target)
+    (target / "dashboard.html").write_text("<html>", encoding="utf-8")
+
+    summary = seed(target)
+    assert summary.runs_completed > 800
+
+
 def test_backlog_ranking_orders_by_score(tmp_path):
     org = load_org(seed(tmp_path / "demo").root)
     scored = ranked(org)

tests/test_cli_and_html.py

@@ -43,6 +43,15 @@ def test_init_refuses_to_overwrite(tmp_path):
     assert result.exit_code == 2
 
 
+def test_demo_refuses_a_real_org_with_exit_2(tmp_path):
+    root = _init(tmp_path)
+    result = invoke("demo", "--dir", str(root))
+    assert result.exit_code == 2
+    assert "refusing to seed" in result.output
+    org = load_org(root)  # the org still loads: nothing was overwritten
+    assert "meeting-minutes" in org.workflows
+
+
 def test_run_feedback_report_loop_offline(tmp_path):
     root = _init(tmp_path)