[roomote-roomote]

​Opened on behalf of Daniel Riccio. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

Related issue

Internal deployment-CLI correctness work; no separate issue.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

Backup output paths with missing parents silently collapsed to a directory at the filesystem root. For example, a requested /tmp/new-parent/backups became /backups; an unprivileged operator then got a misleading permission failure, while a privileged operator could write into the wrong location.

The shared deployment path helper now preserves an unresolved absolute path, or prefixes an unresolved relative path with the current directory. Existing directory/parent normalization is retained. Nested backup destinations and custom deployment-state roots stay where requested; option parsing does not create them. The change adds a small fallback to the existing helper, without dependencies, recursive resolution, remote backup changes or new options. Unresolved .. remains lexical rather than canonicalized.

How it was tested

• Develop 73fc55cc7 with the new regressions and original helper: the native helper returns /backups; the actual roomote-deploy backup parser attempts /nested backups and the disposable test safety guard refuses that outside-temp write (exit42). Both focused regressions fail for the expected reasons.
• Exact pushed head f055f2005081064bceb44d7c120994e80171b0ce: identical native stimuli pass; requested relative/absolute nested directories contain the downloaded synthetic bundle. Existing directories/new leaves, spaces, trailing slash, dash-prefixed names, nested state/Terraform helpers and missing passphrase refusal are covered. Five deployment-script tests, Bash syntax, formatting/diff, precommit judgment and full normal pre-push gates pass. A checked-in positional-argument Bash runner replaces both inline shell snippets flagged by CodeQL on the first head; production path behavior is unchanged by that repair.
• Tests invoke the actual Bash CLI/helpers. Only SSH/SCP are disposable transport stubs; a mkdir guard delegates to real /bin/mkdir within the temporary cwd. This proves local path handling and file placement, not SSH authentication, encryption or remote container behavior. Fixtures are removed in finally. Browser proof is not applicable; no screenshots.
• pnpm deployment:validate passed all seven native tests and six Compose-shape validations, then could not adapt Caddy configuration because this sandbox has no Docker daemon. Exact-head hosted Deployment artifacts, full tests, app build, CodeQL, upgrade and fresh-host backup/restore passed; automated re-review is clean. Both addressed CodeQL alert instances report fixed and their threads are resolved. Final metadata judgment is allowed to settle before ready-for-review delivery; normal human-review/protection gates remain.

Related PRs

• Independent Personal profile email availability #3699.
• Independent Pending automation schedule editing #3701.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally (normal broad fast equivalents passed)
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset (bounded path correction)

[roomote-community]

No new code issues found. Reviewed the positional-argument Bash runner and updated path probes. Deployment artifacts, fresh-host backup/restore, test, lint, and typecheck checks passed; Docker build and JavaScript/TypeScript CodeQL analysis were still running at review time. See session

_{Reviewed f055f20}