fix(canary): preserve exact changed Git paths

loopx/canary/premerge.py

@@ -303,14 +303,14 @@ def _path_matches(path: str, tokens: tuple[str, ...]) -> bool:
 
 
 def _dedupe(values: list[str]) -> list[str]:
+    """Deduplicate path identities without rewriting Git-provided values."""
     seen: set[str] = set()
     deduped: list[str] = []
     for value in values:
-        normalized = _norm_path(value)
-        if not normalized or normalized in seen:
+        if not value or value in seen:
             continue
-        seen.add(normalized)
-        deduped.append(normalized)
+        seen.add(value)
+        deduped.append(value)
     return deduped
 
 

loopx/cli_commands/canary.py

@@ -70,6 +70,18 @@ def _dedupe_preserving_order(values: list[str]) -> list[str]:
     return deduped
 
 
+def _dedupe_exact_paths(values: list[str]) -> list[str]:
+    """Deduplicate Git-derived paths without rewriting their identity."""
+    seen: set[str] = set()
+    deduped: list[str] = []
+    for value in values:
+        if not value or value in seen:
+            continue
+        seen.add(value)
+        deduped.append(value)
+    return deduped
+
+
 def _run_git_name_only(repo_root: Path, args: list[str]) -> dict[str, Any]:
     # `-z` frames each pathname on NUL. LF framing is only unambiguous while
     # `core.quotePath` escapes non-ASCII pathnames, and a repository may turn
@@ -79,17 +91,31 @@ def _run_git_name_only(repo_root: Path, args: list[str]) -> dict[str, Any]:
     completed = subprocess.run(
         command,
         check=False,
-        text=True, encoding="utf-8", errors="replace",
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
+        capture_output=True,
     )
-    files = [name for name in completed.stdout.split("\0") if name]
+    records = [record for record in completed.stdout.split(b"\0") if record]
+    files: list[str] = []
+    undecodable_count = 0
+    for record in records:
+        try:
+            files.append(record.decode("utf-8"))
+        except UnicodeDecodeError:
+            undecodable_count += 1
+
+    path_error = None
+    if undecodable_count:
+        path_error = (
+            f"Git returned {undecodable_count} changed pathname(s) that are not valid UTF-8; "
+            "canary cannot preserve their identity in the selector output"
+        )
     return {
-        "ok": completed.returncode == 0,
+        "ok": completed.returncode == 0 and path_error is None,
         "returncode": completed.returncode,
         "command": command,
-        "changed_files": files,
-        "stderr_tail": completed.stderr[-800:],
+        "changed_files": files if path_error is None else [],
+        "undecodable_path_count": undecodable_count,
+        "path_error": path_error,
+        "stderr_tail": completed.stderr.decode("utf-8", "replace")[-800:],
     }
 
 
@@ -121,7 +147,7 @@ def collect_git_diff_changed_files(
         "unstaged": _run_git_name_only(repo_root, ["diff", "--name-only"]),
         "untracked": _run_git_name_only(repo_root, ["ls-files", "--others", "--exclude-standard"]),
     }
-    changed_files = _dedupe_preserving_order(
+    changed_files = _dedupe_exact_paths(
         [
             file
             for source in sources.values()
@@ -138,36 +164,84 @@ def collect_git_diff_changed_files(
             "source": name,
             "returncode": source.get("returncode"),
             "stderr_tail": source.get("stderr_tail"),
+            **({"error": source["path_error"]} if source.get("path_error") else {}),
         }
         for name, source in sources.items()
         if not source.get("ok")
     ]
+    undecodable_path_count = sum(
+        int(source.get("undecodable_path_count") or 0)
+        for source in sources.values()
+    )
+    path_error = (
+        "Git returned changed pathnames that are not valid UTF-8; canary "
+        "cannot preserve their identity in the selector output"
+        if undecodable_path_count
+        else None
+    )
     return {
-        "ok": bool(successful_sources),
+        "ok": bool(successful_sources) and path_error is None,
         "base_ref": base_ref,
         "repo_root": str(repo_root),
-        "changed_files": changed_files,
+        "changed_files": [] if path_error is not None else changed_files,
         "changed_file_count": len(changed_files),
         "successful_sources": successful_sources,
+        "undecodable_path_count": undecodable_path_count,
+        **({"error": path_error} if path_error else {}),
         "warnings": warnings,
     }
 
 
-def _resolve_canary_changed_files(args: argparse.Namespace) -> tuple[list[str], dict[str, Any] | None]:
-    changed_files = list(args.changed_file or [])
+def _resolve_canary_changed_files(
+    args: argparse.Namespace,
+    *,
+    normalize_manual: bool = False,
+) -> tuple[list[str], dict[str, Any] | None]:
+    manual_files = list(args.changed_file or [])
+    if normalize_manual:
+        manual_files = [path.strip().replace("\\", "/") for path in manual_files]
+    changed_files = _dedupe_preserving_order(manual_files)
     git_diff_selector = None
     if bool(getattr(args, "from_git_diff", False)):
         repo_root = _resolve_git_repo_root(Path.cwd())
         git_diff_selector = collect_git_diff_changed_files(
             repo_root=repo_root,
             base_ref=str(getattr(args, "git_diff_base", "origin/main") or "origin/main"),
         )
-        changed_files.extend(
+        derived = [
             file
             for file in (git_diff_selector.get("changed_files") or [])
             if isinstance(file, str)
-        )
-    return _dedupe_preserving_order(changed_files), git_diff_selector
+        ]
+        changed_files = _dedupe_exact_paths([*changed_files, *derived])
+    return changed_files, git_diff_selector
+
+
+def _git_diff_selector_error(git_diff_selector: dict[str, Any] | None) -> str | None:
+    if git_diff_selector is None or git_diff_selector.get("ok"):
+        return None
+    return str(
+        git_diff_selector.get("error")
+        or "Git changed-path selection failed; refusing to return an incomplete path set"
+    )
+
+
+def _reject_git_diff_selector(
+    git_diff_selector: dict[str, Any] | None,
+    args: argparse.Namespace,
+    print_payload: PrintPayload,
+    format_selector: FormatSelector,
+) -> bool:
+    error = _git_diff_selector_error(git_diff_selector)
+    if error is None or git_diff_selector is None:
+        return False
+    payload = {
+        "ok": False,
+        "error": error,
+        "selector_sources": {"git_diff": git_diff_selector},
+    }
+    print_payload(payload, format_selector(args), lambda value: str(value["error"]) + "\n")
+    return True
 
 
 def _attach_selector_sources(
@@ -178,6 +252,10 @@ def _attach_selector_sources(
     if git_diff_selector is None:
         return
     payload["selector_sources"] = {"git_diff": git_diff_selector}
+    error = _git_diff_selector_error(git_diff_selector)
+    if error is not None:
+        payload["ok"] = False
+        payload["error"] = error
 
 
 def _print_smoke_suite_progress(event: dict[str, Any]) -> None:
@@ -587,6 +665,10 @@ def handle_canary_command(
         renderer = render_exact_release_commit_qualification_markdown
     elif args.canary_command == "plan":
         changed_files, git_diff_selector = _resolve_canary_changed_files(args)
+        if _reject_git_diff_selector(
+            git_diff_selector, args, print_payload, output_format
+        ):
+            return 1
         payload = build_catalog_canary_plan(
             catalog_path=args.catalog,
             changed_files=changed_files,
@@ -601,6 +683,10 @@ def handle_canary_command(
         renderer = render_catalog_canary_plan_markdown
     elif args.canary_command == "run":
         changed_files, git_diff_selector = _resolve_canary_changed_files(args)
+        if _reject_git_diff_selector(
+            git_diff_selector, args, print_payload, output_format
+        ):
+            return 1
         payload = build_catalog_canary_run(
             repo_root=_resolve_git_repo_root(Path.cwd()),
             catalog_path=args.catalog,
@@ -619,6 +705,10 @@ def handle_canary_command(
         renderer = render_catalog_canary_run_markdown
     elif args.canary_command == "smoke-suite":
         changed_files, git_diff_selector = _resolve_canary_changed_files(args)
+        if _reject_git_diff_selector(
+            git_diff_selector, args, print_payload, output_format
+        ):
+            return 1
         payload = build_canary_smoke_suite_run(
             repo_root=_resolve_git_repo_root(Path.cwd()),
             suite=str(args.suite or "default-public"),
@@ -660,7 +750,13 @@ def handle_canary_command(
         )
         renderer = render_quality_surface_catalog_audit_markdown
     elif args.canary_command == "premerge":
-        changed_files, git_diff_selector = _resolve_canary_changed_files(args)
+        changed_files, git_diff_selector = _resolve_canary_changed_files(
+            args, normalize_manual=True
+        )
+        if _reject_git_diff_selector(
+            git_diff_selector, args, print_payload, output_format
+        ):
+            return 1
         target_repo_root = _resolve_git_repo_root(Path.cwd())
         try:
             catalog_path = resolve_canary_catalog_path(args.catalog, repo_root=target_repo_root)