Fix sourcePath leak of absolute filesystem path in frontmatter parser

Assisted-by: GitHub Copilot (model: claude-sonnet-5, autonomous)

Co-authored-by: nicolehaugen <10600161+nicolehaugen@users.noreply.github.com>

Author: Copilot

src/specify_cli/core/__init__.py

@@ -154,7 +154,9 @@ def _package_relative(path: str) -> str:
     return path
 
 
-def _read_leading_frontmatter(md_path: Path, *, kind: str, name: str) -> dict[str, Any]:
+def _read_leading_frontmatter(
+    md_path: Path, *, kind: str, name: str, source_path: str
+) -> dict[str, Any]:
     """Parse the ``---``-fenced YAML block at the head of ``md_path``.
 
     Returns ``{}`` if the file has no frontmatter block. Raises
@@ -166,10 +168,10 @@ def _read_leading_frontmatter(md_path: Path, *, kind: str, name: str) -> dict[st
     except OSError as exc:
         raise CoreInventoryError(
             error="core_inventory.read_failed",
-            message=f"Could not read {kind} file: {exc}",
+            message=f"Could not read {kind} file: {exc.strerror or exc}",
             kind=kind,
             name=name,
-            source_path=str(md_path),
+            source_path=source_path,
         ) from exc
 
     if not text.startswith("---"):
@@ -190,7 +192,7 @@ def _read_leading_frontmatter(md_path: Path, *, kind: str, name: str) -> dict[st
             ),
             kind=kind,
             name=name,
-            source_path=str(md_path),
+            source_path=source_path,
         )
 
     import yaml  # lazy import per constitution IV
@@ -206,7 +208,7 @@ def _read_leading_frontmatter(md_path: Path, *, kind: str, name: str) -> dict[st
             ),
             kind=kind,
             name=name,
-            source_path=str(md_path),
+            source_path=source_path,
         ) from exc
 
     if parsed is None:
@@ -220,7 +222,7 @@ def _read_leading_frontmatter(md_path: Path, *, kind: str, name: str) -> dict[st
             ),
             kind=kind,
             name=name,
-            source_path=str(md_path),
+            source_path=source_path,
         )
     return parsed
 
@@ -293,7 +295,9 @@ def _build_command_entry(name: str, layout: _CoreLayout) -> dict[str, Any]:
             name=name,
             source_path=source_path,
         )
-    frontmatter = _read_leading_frontmatter(file_path, kind="command", name=name)
+    frontmatter = _read_leading_frontmatter(
+        file_path, kind="command", name=name, source_path=source_path
+    )
     description = _normalize_description(
         frontmatter.get("description"),
         kind="command",
@@ -345,7 +349,9 @@ def _extract_template_description(md_path: Path, *, name: str, source_path: str)
     ``# `` H1 heading. Raises :class:`CoreInventoryError` if neither yields
     a non-empty string.
     """
-    frontmatter = _read_leading_frontmatter(md_path, kind="template", name=name)
+    frontmatter = _read_leading_frontmatter(
+        md_path, kind="template", name=name, source_path=source_path
+    )
     fm_desc = frontmatter.get("description")
     if isinstance(fm_desc, str):
         candidate = fm_desc.strip()

tests/test_core_inventory.py

@@ -136,30 +136,41 @@ def test_package_relative_rejects_absolute() -> None:
 def test_parse_command_frontmatter_success(tmp_path: Path) -> None:
     md = tmp_path / "cmd.md"
     md.write_text("---\ndescription: hi\nartifact: foo\n---\nbody\n", encoding="utf-8")
-    parsed = core_pkg._read_leading_frontmatter(md, kind="command", name="cmd")
+    parsed = core_pkg._read_leading_frontmatter(
+        md, kind="command", name="cmd", source_path="commands/cmd.md"
+    )
     assert parsed == {"description": "hi", "artifact": "foo"}
 
 
 def test_parse_command_frontmatter_raises_on_unclosed_fence(tmp_path: Path) -> None:
     md = tmp_path / "cmd.md"
     md.write_text("---\ndescription: hi\n\nbody with no close\n", encoding="utf-8")
     with pytest.raises(CoreInventoryError) as excinfo:
-        core_pkg._read_leading_frontmatter(md, kind="command", name="cmd")
+        core_pkg._read_leading_frontmatter(
+            md, kind="command", name="cmd", source_path="commands/cmd.md"
+        )
     assert excinfo.value.error == "core_inventory.frontmatter_parse"
     assert excinfo.value.kind == "command"
 
 
 def test_parse_command_frontmatter_returns_empty_when_absent(tmp_path: Path) -> None:
     md = tmp_path / "cmd.md"
     md.write_text("# just markdown, no frontmatter\n", encoding="utf-8")
-    assert core_pkg._read_leading_frontmatter(md, kind="command", name="cmd") == {}
+    assert (
+        core_pkg._read_leading_frontmatter(
+            md, kind="command", name="cmd", source_path="commands/cmd.md"
+        )
+        == {}
+    )
 
 
 def test_parse_command_frontmatter_rejects_non_mapping(tmp_path: Path) -> None:
     md = tmp_path / "cmd.md"
     md.write_text("---\n- one\n- two\n---\nbody\n", encoding="utf-8")
     with pytest.raises(CoreInventoryError):
-        core_pkg._read_leading_frontmatter(md, kind="command", name="cmd")
+        core_pkg._read_leading_frontmatter(
+            md, kind="command", name="cmd", source_path="commands/cmd.md"
+        )
 
 
 # ---------------------------------------------------------------------------