fix: make provider runtime help successful and bounded

[seonghobae]

Purpose

Provide bounded, fail-closed operational CLI contracts for disksage-provider-client-runtime and disksage-cloud-local-inventory without weakening provider, filesystem, or publication authority.

Exact current state

• Exact head: 70168b9c3a0c978f03b1b887f866a65611eedb66.
• Independently resolved protected main: 79067c1160ddedf7fc962cbf8067ce7e83c4564a.
• Open, Ready for review, mergeable, and directly based on current main.
• Current delta is 11 files: the two operational binaries/library boundary plus focused executable/coverage tests.
• The previous exact head 3659198bec439ab288091787be0f835914473053 failed Test run 33170377504 because resolving every output-parent symlink contradicted the existing arbitrary-symlink fail-closed contract while trying to support macOS /var.

Current repair

The provider-runtime output boundary preserves both contracts:

• arbitrary caller-controlled symlink parents/ancestors remain fail-closed and cannot redirect audit publication;
• only macOS's fixed root compatibility aliases /var, /tmp, and /etc may be remapped, and only when the live alias canonicalizes to its expected /private/... target;
• after that narrow platform remap, every lexical ancestor of the actual publication parent is still checked with symlink_metadata, so a nested or attacker-controlled symlink remains rejected;
• argument admission and publication-time validation both use the same resolver; create-new publication and Unix 0600 remain unchanged;
• duplicate --output is intentionally rejected before reading/probing a second parent, while the first accepted output remains fully resolved and validated;
• write_create_new re-runs output-path authority validation immediately before create_new, preserving the parse-to-write fail-closed boundary.

Exact-head evidence

For unchanged exact head 70168b9c3a0c978f03b1b887f866a65611eedb66:

• Test 33179007406 — SUCCESS.
• Security Scan 33179007401 — SUCCESS.
• SAST Semgrep 33179007442 — SUCCESS.
• Release 33179007431 — FAILURE only in download-artifact-pr-compat job 98879035034, step Verify downloaded release artifact contract; Linux/macOS/Windows builds, operational CLI staging, artifact upload, and exact v8 artifact download all succeeded. This shared verifier boundary is not repaired locally in this owner.
• All current inline review threads are resolved; the two latest Devin observations were revalidated as informational on this exact head before resolution.

Ownership / non-duplication

This line owns only provider-runtime/cloud-local-inventory CLI behavior and focused tests. It does not absorb provider/cloud follow-up semantics, repository-wide exact coverage #156, canonical acquisition documentation #149, or shared release-verifier ownership #264.

Merge rule

Do not merge unless one unchanged exact head satisfies the live inherited ruleset and every applicable required CI/security/coverage/package/SBOM/provenance/release gate, all valid current findings are resolved, and a qualifying independent formal approval exists where required. Pending, queued, skipped-required, cancelled, failed, stale, predecessor, synthetic, diagnostic-only, status-only, model-only, author-only, no-source, or infrastructure-only evidence is not passing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cf7bff73-3e4d-4770-bbb0-1a4c9e0f61be

📥 Commits

Reviewing files that changed from the base of the PR and between 87f95b0 and 70168b9.

📒 Files selected for processing (1)

• src-tauri/src/bin/disksage-provider-client-runtime.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

두 CLI가 커버리지 빌드에서도 실제 실행 경로를 유지합니다. 인자 중복, 범위, 비-UTF-8 값, 도움말 동작을 검증합니다. 클라우드 인벤토리는 하위 경로를 검증합니다. Provider client-runtime은 출력 경로의 권한과 심볼릭 링크를 검증합니다.

Changes

CLI 경계 계약

Layer / File(s)	Summary
클라우드 로컬 인벤토리 CLI 검증 src-tauri/src/bin/disksage-cloud-local-inventory.rs, src-tauri/src/cloud_local_inventory.rs	옵션 상한과 중복 인자를 거부합니다. OS 인자를 사용하고 비-UTF-8 값을 오류로 처리합니다. 단독 도움말은 성공 처리합니다. validate_options를 공개 함수로 변경합니다.
클라우드 인벤토리 프로세스 계약 src-tauri/tests/cloud_local_inventory_*.rs	도움말, 고정 오류 코드, 인자 수용 규칙, 옵션 상한, 커버리지 실행, 빈 홈, 합성 OneDrive 루트 및 상대 하위 경로 동작을 검증합니다.
Provider client-runtime 출력 검증 src-tauri/src/bin/disksage-provider-client-runtime.rs	OS 인자를 사용합니다. 출력 부모와 Unix 조상 디렉터리의 존재, 디렉터리 유형, 심볼릭 링크 및 쓰기 권한을 검증합니다. 파일 생성 직전에 검증을 다시 수행합니다.
Provider client-runtime 프로세스 계약 src-tauri/tests/provider_client_runtime_*.rs	도움말, 알 수 없는 인자, 감사 JSON, 새 파일 생성, 중복 출력 인자, 비-UTF-8 경로, 타인 쓰기 가능 디렉터리와 심볼릭 링크 경로를 검증합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to 70168

The change makes both operational CLI paths bounded and fail closed, but the current commit is not merge-ready because required release verification is failing. Concurrent filesystem mutation could still redirect publication or inventory traversal, and an interrupted provider write could leave a partial artifact that prevents retry, so owner follow-up is required before merging.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 30.68% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 88 functions across 11 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 provider runtime의 도움말 성공 처리와 입력 범위 제한을 정확히 설명합니다. PR의 cloud inventory 및 추가 fail-closed 검증까지 모두 포함하지는 않지만, 변경의 중요한 부분과 직접 관련됩니다.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/provider-client-runtime-help-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@OpenCode review current head 1f2def5 (fix non-UTF-8 CLI argument panic in both sibling binaries)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[devin-ai-integration]

Devin Review found 0 new potential issues.