From 3bfe7d759735a256a05b64d1b910294ecffad233 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 28 Sep 2026 16:34:35 +0000
Subject: [PATCH] Reject a blank inspect output root as a usage error.

A whitespace --root was accepted and then failed as a missing directory.
---
 CHANGELOG.md        | 3 +++
 bin/case-review.mjs | 2 +-
 test/stack.test.mjs | 8 ++++++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a214dd..5d0c0d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,9 @@ project adheres to [Semantic Versioning](https://semver.org/).
 - Playwright setup note in the Quick start section of `README.md`.
 
 ### Fixed
+- `aas inspect --root` now rejects a blank path, matching the other saved-case
+  commands. A whitespace root used to be treated as a directory and failed
+  with a filesystem error.
 - The act stage now reads the rail bundle file with the same byte cap and
   symlink refusal as a saved case. The previous read followed a link and
   accepted a file larger than the child stdout cap.
diff --git a/bin/case-review.mjs b/bin/case-review.mjs
index f51471b..f10848c 100644
--- a/bin/case-review.mjs
+++ b/bin/case-review.mjs
@@ -118,7 +118,7 @@ export function parseInspectArgs(args) {
   for(let index=0;index<args.length;index++) {
     const token=args[index];
     if(token==='--root') {
-      if(seenRoot || !args[index+1] || args[index+1].startsWith('--')) throw new UsageError('inspect requires one output root path.');
+      if (seenRoot || !args[index + 1]?.trim() || args[index + 1].startsWith("--")) throw new UsageError("inspect requires one output root path.");
       seenRoot=true;outputRoot=args[++index];
     } else if(token==='--json'||token==='--markdown') {
       if(format!==null) throw new UsageError('Choose one inspect output format.');
diff --git a/test/stack.test.mjs b/test/stack.test.mjs
index 0c93dab..adb80e8 100644
--- a/test/stack.test.mjs
+++ b/test/stack.test.mjs
@@ -1983,6 +1983,14 @@ test('saved-case commands use an explicit output root without component setup',
   }
 });
 
+test("inspect rejects a blank output root", async () => {
+  for (const root of ["   ", "\t"]) {
+    const result = await captureMain(["inspect", "case-a", "--root", root]);
+    assert.equal(result.exitCode, 2, result.stderr);
+    assert.match(result.stderr, /output root/);
+  }
+});
+
 test('human history reports damaged entries and continuation even on empty pages', async () => {
   const outputRoot = tempRoot(); writeCase(outputRoot, 'case-a');
   mkdirSync(join(outputRoot, 'runs', 'case-z'), {recursive:true});