From e7e9b4caea779d2f24be8f213d45b5fa6282db00 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Tue, 6 Jan 2026 17:46:12 +0900
Subject: [PATCH] internal/pkg: exec nil path check during cure

This results in os.ErrInvalid instead of a panic, which hopefully improves user experience.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 internal/pkg/exec.go      | 25 +++++++++++++++++++------
 internal/pkg/exec_test.go | 12 ++++++++++++
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/internal/pkg/exec.go b/internal/pkg/exec.go
index c51cd70..539bd93 100644
--- a/internal/pkg/exec.go
+++ b/internal/pkg/exec.go
@@ -84,9 +84,17 @@ func (a *execArtifact) Kind() Kind { return KindExec }
 func (a *execArtifact) Params() []byte {
 	var buf bytes.Buffer
 	for _, p := range a.paths {
-		buf.WriteString(p.P.String())
-		id := Ident(p.A)
-		buf.Write(id[:])
+		if p.P != nil {
+			buf.WriteString(p.P.String())
+		} else {
+			buf.WriteString("invalid P\x00")
+		}
+		if p.A != nil {
+			id := Ident(p.A)
+			buf.Write(id[:])
+		} else {
+			buf.WriteString("invalid A\x00")
+		}
 	}
 	buf.WriteByte(0)
 	buf.WriteString(a.dir.String())
@@ -106,9 +114,11 @@ func (a *execArtifact) Params() []byte {
 // Dependencies returns a slice of all artifacts collected from caller-supplied
 // [ExecContainerPath].
 func (a *execArtifact) Dependencies() []Artifact {
-	artifacts := make([]Artifact, len(a.paths))
-	for i, p := range a.paths {
-		artifacts[i] = p.A
+	artifacts := make([]Artifact, 0, len(a.paths))
+	for _, p := range a.paths {
+		if p.A != nil {
+			artifacts = append(artifacts, p.A)
+		}
 	}
 	return artifacts
 }
@@ -123,6 +133,9 @@ func (a *execArtifact) Cure(c *CureContext) (err error) {
 
 	paths := make([][2]*check.Absolute, len(a.paths))
 	for i, p := range a.paths {
+		if p.P == nil || p.A == nil {
+			return os.ErrInvalid
+		}
 		paths[i][1] = p.P
 	}
 
diff --git a/internal/pkg/exec_test.go b/internal/pkg/exec_test.go
index e718b26..25fe889 100644
--- a/internal/pkg/exec_test.go
+++ b/internal/pkg/exec_test.go
@@ -96,6 +96,18 @@ func TestExec(t *testing.T) {
 						},
 					}),
 				), nil, pkg.Checksum{}, errors.Join(stub.UniqueError(0xcafe))},
+
+				{"invalid paths", pkg.NewExec(
+					t.Context(),
+					msg,
+					0,
+					check.MustAbs("/work"),
+					[]string{"HAKUREI_TEST=1"},
+					check.MustAbs("/opt/bin/testtool"),
+					[]string{"testtool"},
+
+					pkg.ExecContainerPath{},
+				), nil, pkg.Checksum{}, os.ErrInvalid},
 			})
 
 			// check init failure passthrough