#1882 fix: harden the metafile check and exempt remote sources

[RAprogramm]

Fixes #1882

Three fixes to the metafile check, all reproduced before and after.

Crash on a malformed paths. paths = 42 raised TypeError: 'int' object is not iterable. Non-list values are wrapped, so the type check reports them.

Paths escaping source_root. Each declared path now resolves against the resolved source root and has to stay under it, checked before the glob exemption.

Remote-source entries. A dot declaring source pulls its files from an archive the installer downloads, so its source_root resolves inside the extracted tree. Existence checks are skipped for those; type checks still apply. This is what #1874 needs.

The first two were raised by the reviewer on #1881 after it merged.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• My commit message follows the commit guidelines.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• I have tested my code locally and it works as expected.
• All new and existing tests passed.

Testing

Eight cases through a scratch metafile:

Case	Result
paths = 42	reported as int, no crash
../../etc/passwd	rejected
/etc/passwd	rejected
missing path	rejected
glob	accepted
remote source with a path outside the checkout	accepted
remote source with paths = 7	reported as int
valid local path	accepted

sh tests/run.sh passes, 8 cases.

Summary by CodeRabbit

• Tests

  • Strengthened dot/metafile validation, including stricter checks for declared source_root and that non-glob source/paths exist and stay within the expected repository boundaries.
  • Improved robustness when metafile paths declarations are malformed, preventing crashes and enforcing correct types.
  • Enhanced remote-source handling by exempting remote entries from local filesystem existence/containment checks while still validating path types.

• Documentation

  • Updated the test documentation to reflect the expanded metafile validation rules.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fe879778-daac-440d-a5e0-3b166a569fa6

📥 Commits

Reviewing files that changed from the base of the PR and between c548278 and be38827.

📒 Files selected for processing (2)

• tests/README.md
• tests/python/check_dots.py

🚧 Files skipped from review as they are similar to previous changes (1)

• tests/README.md

---

📝 Walkthrough

Walkthrough

The metafile checker now handles malformed paths and source values, confines local declarations to source_root, and skips checkout existence checks for remote sources. The test matrix documents these rules.

Changes

Metafile validation

Layer / File(s)	Summary
Path and source semantics tests/python/check_dots.py	declared_paths preserves malformed values for type reporting, inside enforces containment, and entries identifies remote sources.
Validation and documentation tests/python/check_dots.py, tests/README.md	Declared sources and path items are type-checked; local entries validate roots and paths, while remote entries skip checkout existence checks. The test matrix records the requirements.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• HyDE-Project/HyDE#1871: Introduces the metafile validation suite extended by this change.
• HyDE-Project/HyDE#1881: Modifies the same source-root and declared-path validation logic.

Suggested labels: enhancement

Poem

A rabbit checked each path with care,
Kept wandering dots within their lair.
Remote archives hopped past the gate,
While malformed paths learned their fate.
The metafile burrow now is sound!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: hardening metafile validation and exempting remote sources.
Linked Issues check	✅ Passed	The code addresses all three reported gaps: malformed paths, source_root containment, and remote-source handling.
Out of Scope Changes check	✅ Passed	The changes stay within the metafile checker and its test/docs updates, with no unrelated functionality.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/python/check_dots.py`:
- Around line 65-68: Update the source classification logic in the body/table
loop so the remote flag is set only when source has a valid supported remote
value, not merely when the key exists. Validate both component-level and
table-level source values, reject malformed values such as numeric source
entries with the checker’s existing invalid-source error path, and retain local
source_root containment and path checks for non-remote entries.
- Around line 41-46: Update inside to catch RuntimeError from Path.resolve()
alongside the existing OSError and ValueError exceptions, returning False when
symlink-loop resolution fails.

In `@tests/README.md`:
- Line 25: Update the test_dots.sh description in tests/README.md to state that
local entries undergo checkout-root and source-path validation, while entries
with a remote source are exempt from all such validation because their files
come from a downloaded archive.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a77d25ad-9106-4431-bd4b-d767cba7b692

📥 Commits

Reviewing files that changed from the base of the PR and between bab9fcf and c548278.

📒 Files selected for processing (2)

• tests/README.md
• tests/python/check_dots.py