fix(rules): reject delivered paths that collide before writing any of them

Two ways a file set passed assessment and then failed mid-write, leaving the
half-written rule directory this module exists to make impossible.

ONE PATH BEING AN ANCESTOR OF ANOTHER. `check.ts` and `check.ts/nested.ts`
are not duplicates, neither is unsafe, and the set can still be complete — so
every check passed. Then the same name has to be a file and a directory at
once: `mkdir` throws `ENOTDIR` when the parent was already written as a file,
`writeFile` throws `EISDIR` when a recursive `mkdir` got there first. Which
one depends on array order. In the second order the rule ends up with its
captures written and no `check.ts` file, which is the "never blessed, sits in
unknown[]" case the completeness check exists to prevent, reached with debris
on disk instead of a clean refusal.

TWO PATHS DIFFERING ONLY IN CASE. APFS and NTFS are case-insensitive by
default, so `captures/Logs.yml` and `captures/logs.yml` are distinct strings
and one file: the second write clobbers the first and the rule silently loses
a capture. Capture names are arbitrary, unlike `check.ts` and the engine's
config file, so no other check would have caught it. The duplicate check is
now case-folded, and the ancestor check folds too.

Both proven to bite: removing the ancestor check fails both orderings and
nothing else; removing the case folding fails only the case test.

Found by the review on #219.

Author: theCodeDrift

.changeset/generator-payload-alignment.md

@@ -89,7 +89,9 @@ runtime rule with no `check.ts` is never blessed and is held, and a Vale rule
 with no `.vale.ini` has no matcher enabling it and never fires. Both leave
 `check` exiting 0.
 
-Delivered paths are refused before anything is written — absolute paths, `..`
-segments, backslashes, unnormalized segments, duplicates. The whole set is
-assessed as a unit, so a refused delivery leaves no directory behind rather
-than a half-written rule that verifies as broken two steps from the cause.
+Delivered paths are refused before anything is written: absolute paths, `..`
+segments, backslashes, unnormalized segments, duplicates (including two paths
+differing only in case, which are one file on a case-insensitive filesystem),
+and one path being an ancestor of another. The whole set is assessed as a
+unit, so a refused delivery leaves no directory behind rather than a
+half-written rule that verifies as broken two steps from the cause.

packages/cli/src/rules/deliver.ts

@@ -148,16 +148,49 @@ export function assessDelivery(
   }
   const directory = ruleDirectory(cwd, engine, ruleId);
 
-  const seen = new Set<string>();
+  // Case-FOLDED as well as exact. APFS and NTFS are case-insensitive by
+  // default, so `captures/Logs.yml` and `captures/logs.yml` are two distinct
+  // strings that become one file on disk: the second write silently clobbers
+  // the first and the rule is missing a capture nobody was told was dropped.
+  // Capture names are arbitrary, so nothing else would catch it.
+  const folded = new Set<string>();
   for (const file of files) {
     const unsafe = describeUnsafePath(directory, file.path);
     if (unsafe !== undefined) {
       return { ok: false, reason: `delivered a path that ${unsafe}` };
     }
-    if (seen.has(file.path)) {
-      return { ok: false, reason: `delivered ${file.path} twice` };
+    const key = file.path.toLowerCase();
+    if (folded.has(key)) {
+      return {
+        ok: false,
+        reason:
+          key === file.path
+            ? `delivered ${file.path} twice`
+            : `delivered ${file.path} twice, differing only in case, which is one file on a case-insensitive filesystem`,
+      };
+    }
+    folded.add(key);
+  }
+
+  // One delivered path being an ANCESTOR of another is the same file needing
+  // to be a file and a directory at once. It passes every check above — no
+  // path is unsafe, none is a duplicate, the set can still be complete — and
+  // then fails mid-write: `mkdir` throws `ENOTDIR` when the parent was already
+  // written as a file, and `writeFile` throws `EISDIR` when a recursive
+  // `mkdir` got there first. Which one depends on array order, and either way
+  // the rule directory is left half-written, which is precisely the state this
+  // module exists to make impossible.
+  for (const file of files) {
+    const segments = file.path.split("/");
+    for (let index = 1; index < segments.length; index += 1) {
+      const ancestor = segments.slice(0, index).join("/");
+      if (folded.has(ancestor.toLowerCase())) {
+        return {
+          ok: false,
+          reason: `delivered ${ancestor} as both a file and a directory (with ${file.path})`,
+        };
+      }
     }
-    seen.add(file.path);
   }
 
   const incomplete = describeIncompleteSet(engine, ruleId, files);

packages/cli/test/deliver.test.ts

@@ -165,6 +165,47 @@ describe("delivering a rule as a file set", () => {
     ).rejects.toThrow(/twice/);
   });
 
+  it.each([
+    // Either order fails mid-write, differently: `mkdir` throws ENOTDIR when
+    // the parent was already written as a file, `writeFile` throws EISDIR when
+    // a recursive mkdir got there first.
+    ["file before directory", ["check.ts", "check.ts/nested.ts"]],
+    ["directory before file", ["check.ts/nested.ts", "check.ts"]],
+  ])(
+    "refuses a path that is an ancestor of another (%s)",
+    async (_label, [first, second]) => {
+      await expect(
+        writeRuleFile(
+          cwd,
+          delivered("runtime", "logs-abc12345", [
+            { path: first as string, content: "a\n" },
+            { path: second as string, content: "b\n" },
+            { path: "captures/logs.yml", content: CAPTURE },
+          ])
+        )
+      ).rejects.toThrow(/both a file and a directory/);
+
+      expect(existsSync(ruleDirectory(cwd, "runtime", "logs-abc12345"))).toBe(
+        false
+      );
+    }
+  );
+
+  it("refuses two capture paths differing only in case", async () => {
+    // On APFS and NTFS these are one file: the second write clobbers the
+    // first, and the rule loses a capture nobody was told was dropped.
+    await expect(
+      writeRuleFile(
+        cwd,
+        delivered("runtime", "logs-abc12345", [
+          { path: "check.ts", content: "export default async () => [];\n" },
+          { path: "captures/logs.yml", content: CAPTURE },
+          { path: "captures/Logs.yml", content: CAPTURE },
+        ])
+      )
+    ).rejects.toThrow(/differing only in case/);
+  });
+
   it("refuses a payload carrying both files and content", async () => {
     const rule = {
       id: "logs-abc12345",