Honor --show-paths in optimize previews

TESTING_GUIDE.md

@@ -444,8 +444,8 @@ Candidate-ordered parallel-index recovery tests must prove that the fatal result
   owns the import-staging confidentiality regression. Keep the non-dry-run parent at mode `0755`, set process umask `022` only inside the non-parallel SQLite-sensitive collection, observe the empty staging DB before extraction can write its first byte, and verify owner-only DB/WAL/SHM modes through validation, trust rewriting, `--prune-paths`, rollback-backup creation, cancellation cleanup, collision rejection, and final replacement. POSIX mode assertions must remain platform-conditional while success and `CreateNew` collision behavior continue to run on Windows.
 - `IndexCommandRunnerTests.Run_CancelDuringFreshIndex_ReturnsInterruptedJson`, `Run_CancelDuringDryRunScan_ReturnsInterruptedJson`, and `Run_CancelBeforeFreshScan_ReturnsInterruptedJson`
   exercise the same in-process cancellation paths used after Ctrl-C/SIGINT wiring, including scan-time cancellation, so interrupted index runs keep returning the canonical JSON error contract.
-- `IndexCommandRunnerTests.RunOptimizeFts_DryRunPreviewsWithoutWritingThenOptimizeMutates_Issue4577`, `RunOptimizeFts_LockHeld_ReportsDbLocked`, and `RunOptimizeFts_ReadOnlyUri_ReturnsDbNotWritable`
-  share seeded databases to verify that optimize dry-run reports sizes, readiness, lock state, recommendations, and planned work while preserving the source bytes and creating no lock artifacts; the same fixtures retain the writable optimize and lock/read-only URI mutation guards.
+- `IndexCommandRunnerTests.RunOptimizeFts_DryRunPreviewsWithoutWritingThenOptimizeMutates_Issue4577`, `RunOptimizeFts_DryRunPathDisclosureRequiresShowPaths_Issue5193`, `RunOptimizeFts_LockHeld_ReportsDbLocked`, and `RunOptimizeFts_ReadOnlyUri_ReturnsDbNotWritable`
+  share seeded databases to verify that optimize dry-run reports sizes, readiness, lock state, recommendations, and planned work while preserving the source bytes and creating no lock artifacts; the same fixtures retain the writable optimize and lock/read-only URI mutation guards. The Issue #5193 matrix keeps the standalone command and index-command alias aligned in human/JSON output for relative and absolute inputs with and without `--show-paths`, rejects default resolved-prefix disclosure, and rechecks both database bytes and the optimize write counter.
   `ConsoleUiTests.PrintUsage_WithoutBanner_HidesAsciiArtAndEasterEggFlags` keeps the optimize dry-run flag visible in full CLI usage.
 - Issue #4889 backfill-checkpoint coverage keeps the mutation preflight, folded-value validation, index lock, and artifact decision in one contract. Reuse the completed fixture for default no-op, forced `--checkpoint`, `--no-checkpoint` mutation, human output, a non-NULL drifted fold that requires a protected full repair, and a zero-row pending graph refresh; keep WAL/SHM open during the forced snapshot so Windows sharing semantics and the complete DB/WAL/SHM/manifest file set are exercised. Separate dry-run, invalid-DB, and held-lock assertions must prove that no checkpoint directory is created, while a real pending rewrite or pending graph refresh must retain the automatic checkpoint.
 - Issue #4946 fold-backfill coverage keeps CLI and MCP preflight aligned for a database that simultaneously contains NULL folded values and non-NULL drifted values. Both surfaces must promote that mixed state to one full rewrite and verify successfully in the first invocation. If that promoted rewrite is interrupted, its checkpoint must keep the retry in full-rewrite mode until completion and then be cleared; even an end-of-table checkpoint must be consumed and exactly verified before a later scoped NULL update can use targeted repair. Complete databases without a checkpoint must not pay for an additional present-value scan before their existing exact verification.
@@ -1588,8 +1588,8 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
   import staging の confidentiality 回帰を担当します。non-dry-run の parent を mode `0755` にし、process umask `022` は非並列の SQLite-sensitive collection 内だけで設定し、extraction が最初の byte を書く前の空 staging DB を観測してください。validation、trust rewrite、`--prune-paths`、rollback backup 作成、cancellation cleanup、衝突拒否、最終 replacement を通して DB/WAL/SHM が owner-only であることを検証します。POSIX mode assertion は platform 条件付きに保ちつつ、success と `CreateNew` の衝突挙動は Windows でも実行してください。
 - `IndexCommandRunnerTests.Run_CancelDuringFreshIndex_ReturnsInterruptedJson`、`Run_CancelDuringDryRunScan_ReturnsInterruptedJson`、`Run_CancelBeforeFreshScan_ReturnsInterruptedJson`
   Ctrl-C/SIGINT 配線後に使われる in-process cancellation 経路を、scan 中のキャンセルも含めて検証し、interrupted index run が標準の JSON error contract を返し続けることを固定する。
-- `IndexCommandRunnerTests.RunOptimizeFts_DryRunPreviewsWithoutWritingThenOptimizeMutates_Issue4577`、`RunOptimizeFts_LockHeld_ReportsDbLocked`、`RunOptimizeFts_ReadOnlyUri_ReturnsDbNotWritable`
-  seed 済み database を共有し、optimize dry-run が size、readiness、lock state、推奨、planned work を報告しつつ source byte を保持し、lock artifact を作成しないことを検証する。同じ fixture で、書き込み版 optimize と lock/read-only URI の mutation guard も維持する。
+- `IndexCommandRunnerTests.RunOptimizeFts_DryRunPreviewsWithoutWritingThenOptimizeMutates_Issue4577`、`RunOptimizeFts_DryRunPathDisclosureRequiresShowPaths_Issue5193`、`RunOptimizeFts_LockHeld_ReportsDbLocked`、`RunOptimizeFts_ReadOnlyUri_ReturnsDbNotWritable`
+  seed 済み database を共有し、optimize dry-run が size、readiness、lock state、推奨、planned work を報告しつつ source byte を保持し、lock artifact を作成しないことを検証する。同じ fixture で、書き込み版 optimize と lock/read-only URI の mutation guard も維持する。Issue #5193 の matrix は、standalone command と index-command alias について relative / absolute input と `--show-paths` の有無における human / JSON 出力を同期させ、既定で解決済み prefix が漏れないことを確認し、database byte と optimize write counter の両方を再検証する。
   `ConsoleUiTests.PrintUsage_WithoutBanner_HidesAsciiArtAndEasterEggFlags` は、full CLI usage に optimize dry-run flag が表示され続けることを固定します。
 - Issue #4889 の backfill-checkpoint coverage は、mutation preflight、folded値の検証、index lock、artifact 作成判断を1つの契約として固定します。完了済み fixture を既定no-op、明示 `--checkpoint`、`--no-checkpoint` mutation、human output、保護された全行修復を必要とする非NULLのfold drift、zero-rowのpending graph refreshで再利用し、明示snapshot中は WAL/SHM をopenしたままにしてWindowsの共有 semanticsとDB/WAL/SHM/manifest一式を検証してください。dry-run、無効DB、lock保持中のassertionではcheckpoint directoryが作られないことを個別に証明し、実際にpending rewriteまたはpending graph refreshがある場合はautomatic checkpointを維持してください。
 - Issue #4946 の fold-backfill coverage は、NULL の folded 値と非 NULL だが drift した値が同時に存在する database で CLI と MCP の preflight を同期させます。両 surface はこの混在状態を1回の全行 rewrite に昇格し、最初の invocation で検証成功しなければなりません。昇格した rewrite が中断された場合は、完了まで checkpoint に従って全行 rewrite mode を維持してから checkpoint を消去します。table 末尾に到達した checkpoint も、後続の scoped NULL update が対象修復を使う前に消費して厳密検証してください。checkpoint のない complete database では、既存の厳密検証より前に追加の present-value scan を実行しないでください。

changelog.d/unreleased/5193.security.md

@@ -0,0 +1,22 @@
+---
+category: security
+issues:
+  - 5193
+affected:
+  - src/CodeIndex/Cli/IndexCommandRunner.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.Parse.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.Maintenance.cs
+  - tests/CodeIndex.Tests/IndexCommandRunnerTests.cs
+  - tests/CodeIndex.Tests/IndexCommandRunnerIssue5193Tests.cs
+  - tests/CodeIndex.Tests/CommandErrorWriterTests.cs
+  - DEVELOPER_GUIDE.md
+  - TESTING_GUIDE.md
+---
+
+## English
+
+- **Optimize previews now honor `--show-paths` (#5193)** — standalone and index-command-alias human/JSON dry-run output preserve safe relative database spelling or redact absolute paths by default, while `--show-paths` explicitly reveals the resolved absolute path without changing internal database operations.
+
+## 日本語
+
+- **optimize preview が `--show-paths` を遵守するようになりました (#5193)** — standalone と index-command alias の human / JSON dry-run 出力は既定で安全な相対 database 表記を維持するか absolute path を伏せ、`--show-paths` 指定時だけ解決済み absolute path を明示的に表示し、内部 database 操作は変更しません。

src/CodeIndex/Cli/IndexCommandRunner.Maintenance.cs

@@ -274,12 +274,15 @@ private static int RunOptimizeFtsPreviewForDb(
             var ftsOptimization = status.MaintenanceGuidance.FtsOptimization;
             var writesSinceOptimize = ftsOptimization.ObservedWrites;
             stopwatch.Stop();
+            var displayDbPath = showPaths
+                ? dbPath
+                : MaintenanceDatabaseErrorClassifier.FormatPathForOutput(errorDbPath, showPaths: false);
 
             var result = new OptimizeFtsPreviewJsonResult
             {
                 Status = "dry_run",
                 DryRun = true,
-                DbPath = dbPath,
+                DbPath = displayDbPath,
                 WritesSinceOptimizeBefore = checked((int)Math.Min(writesSinceOptimize, int.MaxValue)),
                 WritesSinceOptimizeAfter = checked((int)Math.Min(writesSinceOptimize, int.MaxValue)),
                 ElapsedMs = stopwatch.ElapsedMilliseconds,
@@ -336,7 +339,7 @@ private static int RunOptimizeFtsPreviewForDb(
             else
             {
                 CommandOutputWriter.WriteLine("FTS5 optimize preview (read-only; no changes made).");
-                CommandOutputWriter.WriteLine(ConsoleUi.FormatSummaryLine("DB", dbPath, indent: "  "));
+                CommandOutputWriter.WriteLine(ConsoleUi.FormatSummaryLine("DB", displayDbPath, indent: "  "));
                 CommandOutputWriter.WriteLine(ConsoleUi.FormatSummaryLine("DB size", ConsoleUi.FormatBytes(result.DbSizeBytes ?? 0), indent: "  "));
                 CommandOutputWriter.WriteLine(ConsoleUi.FormatSummaryLine("Core size", ConsoleUi.FormatBytes(result.CoreTableSizeBytes ?? 0), indent: "  "));
                 CommandOutputWriter.WriteLine(ConsoleUi.FormatSummaryLine("FTS size", ConsoleUi.FormatBytes(result.FtsSizeBytes ?? 0), indent: "  "));

src/CodeIndex/Cli/IndexCommandRunner.Parse.cs

@@ -371,6 +371,7 @@ public static IndexCommandOptions ParseArgs(string[] args)
             // オプション解析の境界で絶対化し、以降の cwd 変化で相対パス計算が崩れないようにする。
             ProjectPath = AbsolutizePathOption(projectPath),
             DbPath = AbsolutizeDbPathOption(dbPath),
+            DbPathInput = dbPath,
             DataDir = AbsolutizePathOption(dataDir),
             Rebuild = rebuild,
             Verbose = verbose,

src/CodeIndex/Cli/IndexCommandRunner.cs

@@ -205,6 +205,9 @@ internal static int Run(
         var requestedDbPath = dbPath;
         dbPath = DbPathResolver.NormalizeDbPath(dbPath);
         var resolvedDbPath = Path.GetFullPath(dbPath);
+        var diagnosticDbPath = string.IsNullOrWhiteSpace(options.DbPathInput)
+            ? resolvedDbPath
+            : options.DbPathInput;
         var databaseExistedBeforeIndex = File.Exists(LongPath.EnsureWindowsPrefix(resolvedDbPath));
 
         if (!options.Json && !options.Quiet)
@@ -215,9 +218,11 @@ internal static int Run(
                     options.ShowPaths)
                 : Path.GetFullPath(options.ProjectPath!);
             var databaseDisplayPath = options.OptimizeOnly
-                ? MaintenanceDatabaseErrorClassifier.FormatPathForOutput(
-                    resolvedDbPath,
-                    options.ShowPaths)
+                ? options.ShowPaths
+                    ? resolvedDbPath
+                    : MaintenanceDatabaseErrorClassifier.FormatPathForOutput(
+                        diagnosticDbPath,
+                        showPaths: false)
                 : resolvedDbPath;
             ConsoleUi.PrintBanner();
             CommandOutputWriter.WriteLine();
@@ -235,6 +240,7 @@ internal static int Run(
                 options.ProjectPath,
                 options.DryRun,
                 showPaths: options.ShowPaths,
+                diagnosticDbPath: diagnosticDbPath,
                 queryOnlyDbPath: options.DryRun ? requestedDbPath : null);
 
         bool ignoreCase;
@@ -679,6 +685,9 @@ public sealed class IndexCommandOptions
     public bool ShowHelp { get; init; }
     public string? ProjectPath { get; init; }
     public string? DbPath { get; init; }
+    // Retain the exact --db token only for maintenance display; DbPath remains the stable I/O path.
+    // maintenance 表示専用に --db の元表記を保持し、I/O には引き続き安定した DbPath を使う。
+    internal string? DbPathInput { get; init; }
     public string? DataDir { get; init; }
     public bool Rebuild { get; init; }
     public bool Verbose { get; init; }

tests/CodeIndex.Tests/CommandErrorWriterTests.cs

@@ -71,6 +71,7 @@ public void MaintenanceClassifier_PreservesStructuredDatabaseFailures_Issue4856(
     [InlineData("/Users/alice/private/codeindex.db")]
     [InlineData("/Users/alice/private/review-missing.db")]
     [InlineData(@"C:\Users\alice\private\codeindex.db")]
+    [InlineData(@"\\server\share\private\codeindex.db")]
     [InlineData("file:///Users/alice/private/codeindex.db?immutable=1")]
     public void MaintenanceClassifier_RedactsPlatformAbsolutePathsUnlessExplicitlyEnabled_Issue4856(
         string dbPath)