[toprameen]

bend page.html -o <dir> can overwrite the page it bundles: directly (-o is the page's own directory), through a symlink, or through a hard link at <dir>/page.html.

In a Bun bundle only the page keeps its own name; chunks, CSS and assets are content-hashed. So the page is the one input an -o can overwrite by accident. cli_bundle now:

• builds from the page's real path (path_real), so the output name is known and a symlinked page builds to <dir>/<target>.html instead of <dir>/_.._/<target>.html;
• refuses the build when <dir>/<page> is already the page by device and inode (same_file), which covers the direct, symlink, hard-link and case-alias cases;
• keeps Bun's outdir writing, so a non-directory -o and a missing page still get Bun's own errors.

Not covered on purpose: a link planted at an output path that points at another input (main behaves the same).

tests/io/bundle_page_input covers the refused cases, the symlinked build (its chunk runs) and the missing-page error; it fails on main. bend2/main.ts +172 ttok (11,871). Gates on ed186a4: repo 54/54, test 1683/1683, ping 63/63, perf 123/124, safe 0 false rejects.

🤖 Generated with Claude Code

[Lorenzobattistela]

Thanks for this. The direct and symlink collisions are refused now, and all gates pass merged onto main d194597 (repo 54/54, test 1663/1663, perf 124/124, ping 65/65 with your checks, safe 0 false rejects). A few things before merge:

1. A hard link to the page still gets overwritten. The guard compares realpath strings, and a hard link has a path of its own:

   ln a/page.html h/page.html
   bend a/page.html -o h
   

   This exits 0, and a/page.html now holds the bundle, so the source is lost. Comparing dev+ino from fs.statSync (when the output exists) catches symlinks, hard links and case-aliased paths in one check.

2. Only the entry page is checked. 1364d73 refuses an -o that resolves to any file the program reads. Here, an entry in the -o dir that is named like an output and points at a source .ts/.css/.bend (a stale symlink, say) is followed by Bun.write and overwritten. Could the check cover every file the build read, not just the page?

3. Dropping outdir loses Bun's directory check. touch gf; bend g.html -o gf used to print Failed to create output directory "gf" is a file. Now it prints a raw ENOTDIR: not a directory, open '.../gf/chunk-....js', and only after the full build. Please keep a clear error for a non-directory -o. Also, writes that fail partway (EACCES, a read-only page.html) leave a half-written bundle.

4. The cause looks like Bun naming a symlinked entry after its target, which is where dir/_.._/safe.html comes from. Passing path_real(page) as the entrypoint (or setting root) should give plain output names. The direct check then covers the symlink cases without the in-memory build and the second write loop. Could you try that?

5. The "page symlink can bundle beside its link" check asserts the _.._/safe.html layout. That layout predates this PR, but the check would fail a fix that puts the page at dir/.html, so please don't pin it.

6. gates/ping.ts is maintained by Taelin, and gate changes need his sign-off, so we can't merge the new checks as they are. Please move them out of gates/ (into tests/, if a test there can drive the CLI), or leave them out and we'll raise it with him.

[toprameen]

1. Switched to device/inode checks so hard links are caught too.
2. Expanded protection to imported files and assets, plus tsconfig.json, jsconfig.json, extended configs and package package.json files used for resolution.
3. Added a clear error when -o names a file, and staged publication with rollback so failed writes restore the previous outputs.
4. Canonicalized the entry path and root as suggested. I kept the actual output checks because a generated JS chunk can still point to an input through a symlink.
5. Removed the _.._/safe.html assumption. The test now finds the generated HTML and runs its referenced chunk.
6. Moved the regressions to tests/io, so there are no gate changes left in the PR.