isSameDevice stats non-existent recovery path, falls back to read-only root #164

Bug

recovery_unix.go:isSameDevice calls os.Stat(path2) where path2 is the recovery directory path (~/Library/Caches/devlore/recovery). This directory doesn't exist yet at the time of the check — it gets created later by moveToRecovery via os.MkdirAll.

Since os.Stat fails on a non-existent path, isSameDevice returns false, and getRecoveryBase falls through to the fallback: filepath.Join("/", ".devlore_recovery") → /.devlore_recovery.

On macOS with SIP enabled, creating directories at / is blocked. This causes all recovery-based operations to fail: Remove, Unlink, RemoveAll, and any write that overwrites an existing file.

Reproduction

Any test that calls Remove, Unlink, or WriteText on a file in a temp directory:

--- FAIL: TestUnlink_RemovesSymlink (0.00s)
    provider_test.go:534: Unlink() error = failed to create recovery site: mkdir /.devlore_recovery: read-only file system
--- FAIL: TestRemove_RemovesFile (0.00s)
    provider_test.go:596: Remove() error = failed to create recovery site: mkdir /.devlore_recovery: read-only file system

Suggested Fix

In isSameDevice, when path2 doesn't exist, walk up to the nearest existing ancestor and compare devices against that. Alternatively, in getRecoveryBase, stat cacheDir (which always exists, e.g. ~/Library/Caches) instead of cachePath (which hasn't been created yet).

Files

• pkg/op/provider/file/recovery_unix.go:52-59 — isSameDevice
• pkg/op/provider/file/recovery_unix.go:13-29 — getRecoveryBase