[codex] add flavor boundary check

app/src/bin/runseal.rs

@@ -41,7 +41,7 @@ fn main() -> Result<()> {
 
 fn build_runtime_config(cli: Cli) -> Result<RuntimeConfig> {
     let cwd = std::env::current_dir().context("failed to read current directory")?;
-    RuntimeConfig::from_cli_env_and_cwd(
+    RuntimeConfig::from_input(
         CliInput {
             profile: cli.profile,
             command: normalize_command(cli.command),

app/src/core/config.rs

@@ -40,7 +40,7 @@ pub struct RuntimeConfig {
 }
 
 impl RuntimeConfig {
-    pub fn from_cli_env_and_cwd(cli: CliInput, env: RawEnv, cwd: &Path) -> Result<Self> {
+    pub fn from_input(cli: CliInput, env: RawEnv, cwd: &Path) -> Result<Self> {
         let runseal_home = resolve_runseal_home(&env)?;
         let profile_home = env
             .runseal_profile_home
@@ -122,7 +122,3 @@ fn discovery_candidates(cwd: &Path, profile_home: &Path) -> Vec<PathBuf> {
 pub fn profile_extensions() -> &'static [&'static str] {
     &["toml", "yaml", "yml", "json"]
 }
-
-#[cfg(test)]
-#[path = "../../tests/unit/core/config.rs"]
-mod tests;

app/src/core/injections/env.rs

@@ -191,7 +191,3 @@ fn split_parts(value: &str, separator: &str) -> Vec<String> {
         .map(ToString::to_string)
         .collect()
 }
-
-#[cfg(test)]
-#[path = "../../../tests/unit/core/injections/env.rs"]
-mod tests;

app/src/core/injections/mod.rs

@@ -170,7 +170,3 @@ impl RuntimeInjection {
         }
     }
 }
-
-#[cfg(test)]
-#[path = "../../../tests/unit/core/injections/mod.rs"]
-mod tests;

app/src/core/injections/symlink.rs

@@ -92,7 +92,3 @@ impl SymlinkInjection {
         Ok(())
     }
 }
-
-#[cfg(test)]
-#[path = "../../../tests/unit/core/injections/symlink.rs"]
-mod tests;

app/src/core/profile.rs

@@ -141,7 +141,3 @@ fn normalize_path(path: &Path, base_dir: &Path) -> Result<PathBuf> {
     }
     Ok(expanded_path.absolutize_from(base_dir)?.to_path_buf())
 }
-
-#[cfg(test)]
-#[path = "../../tests/unit/core/profile.rs"]
-mod tests;

app/src/core/runtime.rs

@@ -66,7 +66,3 @@ fn run_command(config: &RuntimeConfig, exports: &[(String, String)]) -> Result<i
 
     Ok(1)
 }
-
-#[cfg(test)]
-#[path = "../../tests/unit/core/runtime.rs"]
-mod tests;

app/tests/cli.rs

@@ -7,7 +7,7 @@ fn bin() -> Command {
 }
 
 #[test]
-fn no_command_prints_help() {
+fn help_without_command() {
     let output = bin().output().expect("runseal should run");
 
     assert!(output.status.success());
@@ -17,7 +17,7 @@ fn no_command_prints_help() {
 }
 
 #[test]
-fn explicit_toml_profile_runs_command_with_env_and_context() {
+fn explicit_profile_runs() {
     let temp = TempDir::new().expect("temp dir should be created");
     let profile = temp.path().join("profile.toml");
     std::fs::write(
@@ -50,7 +50,7 @@ RUNSEAL_TEST_VALUE = "from-toml"
 }
 
 #[test]
-fn cwd_profile_beats_runseal_home_default() {
+fn cwd_beats_home() {
     let temp = TempDir::new().expect("temp dir should be created");
     let cwd = temp.path().join("work");
     let runseal_home = temp.path().join("home");
@@ -81,7 +81,7 @@ fn cwd_profile_beats_runseal_home_default() {
 }
 
 #[test]
-fn symlink_is_available_during_command_and_cleaned_afterward() {
+fn symlink_lifecycle() {
     let temp = TempDir::new().expect("temp dir should be created");
     let source = temp.path().join("source.txt");
     let target = temp.path().join("links/source.txt");
@@ -123,7 +123,7 @@ fn symlink_is_available_during_command_and_cleaned_afterward() {
 }
 
 #[test]
-fn propagates_child_exit_code() {
+fn child_exit_code() {
     let temp = TempDir::new().expect("temp dir should be created");
     let profile = temp.path().join("profile.json");
     std::fs::write(&profile, r#"{"injections":[]}"#).expect("profile should be written");
@@ -142,3 +142,50 @@ fn propagates_child_exit_code() {
 
     assert_eq!(output.status.code(), Some(17));
 }
+
+#[test]
+fn toml_beats_yaml() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("work");
+    std::fs::create_dir_all(&cwd).expect("cwd should be created");
+    std::fs::write(
+        cwd.join("runseal.toml"),
+        "[[injections]]\ntype = \"env\"\n[injections.vars]\nPICKED = \"toml\"\n",
+    )
+    .expect("toml profile should be written");
+    std::fs::write(
+        cwd.join("runseal.yaml"),
+        "injections:\n  - type: env\n    vars:\n      PICKED: yaml\n",
+    )
+    .expect("yaml profile should be written");
+
+    let output = bin()
+        .current_dir(&cwd)
+        .args(["bash", "--", "-lc", "printf '%s' \"$PICKED\""])
+        .output()
+        .expect("runseal should run");
+
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).expect("stdout should be UTF-8");
+    assert_eq!(stdout, "toml");
+}
+
+#[test]
+fn missing_profile_paths() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("work");
+    let home = temp.path().join("home");
+    std::fs::create_dir_all(&cwd).expect("cwd should be created");
+
+    let output = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", &home)
+        .args(["bash", "--", "-lc", "true"])
+        .output()
+        .expect("runseal should run");
+
+    assert!(!output.status.success());
+    let stderr = String::from_utf8(output.stderr).expect("stderr should be UTF-8");
+    assert!(stderr.contains("runseal.toml"));
+    assert!(stderr.contains("default.json"));
+}