fix: harden atlas route status paths

Author: rosuH

scripts/build_atlas_route.py

@@ -240,6 +240,13 @@ def _meta(content: str) -> str:
     return html.escape(content, quote=True)
 
 
+def _display_path(path: Path, root: Path) -> str:
+    try:
+        return path.relative_to(root).as_posix()
+    except ValueError:
+        return path.as_posix()
+
+
 def _share_page_url(site_url: str, stop_id: str) -> str:
     return f"{_normalize_site_url(site_url)}/atlas/share/{quote(stop_id, safe='-._~')}/"
 
@@ -397,17 +404,17 @@ def main() -> int:
 
     if args.check:
         if added_count:
-            print(f"{added_count} downloaded sound file(s) are missing from {route_path.relative_to(root)}.")
+            print(f"{added_count} downloaded sound file(s) are missing from {_display_path(route_path, root)}.")
             return 1
-        print(f"All {len(media)} downloaded sound file(s) are represented in {route_path.relative_to(root)}.")
+        print(f"All {len(media)} downloaded sound file(s) are represented in {_display_path(route_path, root)}.")
         return 0
 
     site_url = args.site_url or _site_url_from_cname(root)
     write_route(output_path, merged)
     write_share_pages(root, merged, site_url)
     write_discovery_files(root, merged, site_url)
     print(
-        f"Wrote {len(merged)} atlas stop(s) to {output_path.relative_to(root)}; "
+        f"Wrote {len(merged)} atlas stop(s) to {_display_path(output_path, root)}; "
         f"{added_count} stop(s) added; generated {len(merged)} share page(s).",
     )
     return 0

tests/test_atlas_route_builder.py

@@ -144,6 +144,62 @@ def test_check_mode_does_not_write_output(tmp_path):
     assert not (tmp_path / "atlas" / "dawn-to-night.draft.json").exists()
 
 
+def test_check_mode_reports_absolute_route_outside_root(tmp_path):
+    root = tmp_path / "site"
+    root.mkdir()
+    route_path = tmp_path / "external-route.json"
+    route_path.write_text("[]\n", encoding="utf-8")
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--root",
+            str(root),
+            "--route",
+            str(route_path),
+            "--check",
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.returncode == 0
+    assert str(route_path) in result.stdout
+    assert "ValueError" not in result.stderr
+
+
+def test_default_cli_reports_absolute_output_outside_root(tmp_path):
+    root = tmp_path / "site"
+    root.mkdir()
+    route_path = root / "atlas" / "dawn-to-night.json"
+    output_path = tmp_path / "external-route.json"
+    route_path.parent.mkdir()
+    route_path.write_text("[]\n", encoding="utf-8")
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--root",
+            str(root),
+            "--route",
+            "atlas/dawn-to-night.json",
+            "--output",
+            str(output_path),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.returncode == 0
+    assert output_path.exists()
+    assert str(output_path) in result.stdout
+    assert "ValueError" not in result.stderr
+
+
 def test_write_share_pages_creates_per_specimen_social_preview_and_redirect(tmp_path):
     stop = {
         "id": "american-coots",