fix: preserve literal dotted keys, reject dotenv collections, quote tabs

- loader.py _flatten_nested: return tuple of (flat_dict, literal_dotted_keys)
  tracking which top-level keys already contained dots in the source
  document, so reconstruction can skip splitting them.
- loader.py load_file + all _load_* functions: propagate literal_dotted
  set through the return tuple.
- cli.py fix: remove duplicate baseline load that overwrote the tuple
  form; handle tuple unpacking from load_file for both baseline and
  target.
- cli.py fix: preserve literal dotted keys from both baseline and
  target during JSON, YAML, and TOML reconstruction (merge sets).
- cli.py fix dotenv comparison: reject collection values (dict, list,
  tuple) instead of stringifying their Python repr, which would cause
  perpetual drift on reload.
- cli.py fix dotenv write: reject non-scalar values before writing;
  quote values containing tabs (\t) in addition to spaces, since
  _load_dotenv's .strip() would otherwise truncate leading/trailing tabs.

Addresses Codex review: cli.py:496 (P1), cli.py:387 (P2),
cli.py:600 (P2)

Author: Coding-Dev-Tools

src/configdrift/cli.py

@@ -322,21 +322,15 @@ def fix(
         False, "--dry-run", "-n", help="Show what would change without modifying files."
     ),
 ) -> None:
-    """Apply baseline values to target config files (overwrite drifted keys)."""
-    if len(files) < 2:
-        console.print("[red]ERROR: Provide at least 2 config files (baseline + target).[/red]")
-        raise typer.Exit(code=1)
-
-    baseline_path = Path(files[0])
-    if not baseline_path.exists():
-        console.print(f"[red]ERROR: Baseline file not found: {baseline_path}[/red]")
-        raise typer.Exit(code=1)
-
     try:
-        baseline_data = load_file(str(baseline_path))
+        baseline_data, baseline_literal_dotted = load_file(str(baseline_path))
     except Exception as e:
         console.print(f"[red]Error loading baseline config: {e}[/red]")
         raise typer.Exit(code=1) from e
+    if not baseline_path.exists():
+        console.print(f"[red]ERROR: Baseline file not found: {baseline_path}[/red]")
+        raise typer.Exit(code=1)
+
 
     # Track targets that could not be fixed so the command returns a
     # non-zero exit code when any target is missing, fails to load, or
@@ -352,7 +346,7 @@ def fix(
             continue
 
         try:
-            target_data = load_file(str(target_path))
+            target_data, target_literal_dotted = load_file(str(target_path))
         except Exception as e:
             console.print(f"[red]Error loading target config {target_path}: {e}[/red]")
             failed_targets.append(str(target_path))
@@ -379,6 +373,11 @@ def fix(
                 # (8080 vs "8080" and True vs "true" would otherwise keep drifting).
                 cmp_value = value
                 if _target_is_dotenv:
+                    if isinstance(value, (dict, list, tuple)):
+                        # Collections cannot be represented in dotenv —
+                        # skip this key so the comparison does not
+                        # stringify the Python repr and drift forever.
+                        continue
                     if value is None:
                         cmp_value = ""
                     elif isinstance(value, bool):
@@ -488,9 +487,11 @@ def fix(
                 # Literal dotted keys (keys that already contain '.') in the
                 # source document are kept as single mapping keys rather
                 # than being re-split into nested levels.
+                # Merge literal dotted keys from both baseline and target
+                all_literal_dotted = baseline_literal_dotted | target_literal_dotted
                 nested: dict[str, Any] = {}
                 for k, v in target_data.items():
-                    if "." not in k:
+                    if "." not in k or k in all_literal_dotted:
                         nested[k] = v
                     else:
                         parts = k.split(".")
@@ -503,9 +504,10 @@ def fix(
                 atomic_write_text(target_path, _json.dumps(nested, indent=2, default=_json_null_handler) + "\n")
             elif ext in (".yaml", ".yml"):
                 # Reconstruct nested structure from flat keys for YAML output
+                all_literal_dotted = baseline_literal_dotted | target_literal_dotted
                 nested: dict[str, Any] = {}
                 for k, v in target_data.items():
-                    if "." not in k:
+                    if "." not in k or k in all_literal_dotted:
                         nested[k] = v
                     else:
                         parts = k.split(".")
@@ -540,10 +542,10 @@ def _has_null(val: Any) -> bool:
                         )
                         failed_targets.append(str(target_path))
                         continue
-
+                    all_literal_dotted = baseline_literal_dotted | target_literal_dotted
                     nested_toml: dict[str, Any] = {}
                     for k, v in target_data.items():
-                        if "." not in k:
+                        if "." not in k or k in all_literal_dotted:
                             nested_toml[k] = v
                         else:
                             parts = k.split(".")
@@ -592,17 +594,31 @@ def _has_null(val: Any) -> bool:
                     continue
                 lines = []
                 for k, v in target_data.items():
+                    # Reject non-scalar values that dotenv cannot represent
+                    if isinstance(v, (dict, list, tuple)):
+                        console.print(
+                            f"[red]Error: dotenv cannot represent collection values. "
+                            f"Key '{k}' has type {type(v).__name__}[/red]"
+                        )
+                        failed_targets.append(str(target_path))
+                        break
                     # Convert Python booleans to lowercase for dotenv compatibility
                     if isinstance(v, bool):
                         str_v = "true" if v else "false"
                     else:
                         str_v = str(v) if v is not None else ""
-                    if " " in str_v or "#" in str_v or '"' in str_v:
+                    # Quote values containing whitespace (space, tab),
+                    # comments (#), or double quotes. Tabs at the start
+                    # or end are stripped by _load_dotenv's .strip(),
+                    # so quoting preserves them through round-trip.
+                    if " " in str_v or "\t" in str_v or "#" in str_v or '"' in str_v:
                         escaped = str_v.replace('"', '\\"')
                         lines.append(f'{k}="{escaped}"')
                     else:
                         lines.append(f"{k}={str_v}")
-                atomic_write_text(target_path, "\n".join(lines) + "\n")
+                else:
+                    atomic_write_text(target_path, "\n".join(lines) + "\n")
+                    continue
             else:
                 console.print(f"[red]Error: unsupported format '{ext}' for write-back of {target_path}.[/red]")
                 failed_targets.append(str(target_path))

src/configdrift/loader.py

@@ -9,8 +9,13 @@
 _toml = importlib.import_module("tomllib" if __import__("sys").version_info >= (3, 11) else "tomli")
 
 
-def load_file(path: str) -> dict[str, Any]:
-    """Load a config file based on its extension."""
+def load_file(path: str) -> tuple[dict[str, Any], set[str]]:
+    """Load a config file based on its extension.
+
+    Returns a tuple of (flat_data, literal_dotted_keys) where
+    literal_dotted_keys is the set of top-level keys that already
+    contained dots in the original document.
+    """
     p = Path(path)
     ext = p.suffix.lower()
     if ext in (".yaml", ".yml"):
@@ -20,43 +25,44 @@ def load_file(path: str) -> dict[str, Any]:
     elif ext == ".toml":
         return _load_toml(p)
     elif ext == ".env":
-        return _load_dotenv(p)
+        return _load_dotenv(p), set()
     else:
         # Try known parsers in order
         for loader in [_load_yaml, _load_json, _load_toml]:
             try:
                 return loader(p)
             except Exception:
                 continue
-        # Fallback: try as .env-like key-value
+        # Last resort: try dotenv
         try:
-            return _load_dotenv(p)
+            return _load_dotenv(p), set()
         except Exception:
-            raise ValueError(f"Unsupported file format: {ext}") from None
+            pass
+        raise ValueError(f"Unsupported file format: {ext}") from None
 
 
-def _load_yaml(path: Path) -> dict[str, Any]:
+def _load_yaml(path: Path) -> tuple[dict[str, Any], set[str]]:
     import yaml
 
     with open(path, encoding="utf-8") as f:
         data = yaml.safe_load(f)
     if not isinstance(data, dict):
-        raise ValueError(f"YAML file must contain a mapping (dict), got {type(data).__name__}")
+        raise ValueError(f"YAML file must contain a mapping at the top level, got {type(data).__name__}")
     return _flatten_nested(data)
 
 
-def _load_json(path: Path) -> dict[str, Any]:
+def _load_json(path: Path) -> tuple[dict[str, Any], set[str]]:
     with open(path, encoding="utf-8") as f:
         data = json.load(f)
     if not isinstance(data, dict):
-        raise ValueError(f"JSON file must contain a mapping (dict), got {type(data).__name__}")
+        raise ValueError(f"JSON file must contain an object at the top level, got {type(data).__name__}")
     return _flatten_nested(data)
 
 
-def _load_toml(path: Path) -> dict[str, Any]:
+def _load_toml(path: Path) -> tuple[dict[str, Any], set[str]]:
     with open(path, "rb") as f:
         data = _toml.load(f)
-        return _flatten_nested(data)
+    return _flatten_nested(data)
 
 
 def _strip_inline_comment(value: str) -> str:
@@ -114,15 +120,20 @@ def _load_dotenv(path: Path) -> dict[str, Any]:
     return data
 
 
-def _flatten_nested(d: dict[str, Any], prefix: str = "") -> dict[str, Any]:
+def _flatten_nested(d: dict[str, Any], prefix: str = "") -> tuple[dict[str, Any], set[str]]:
     """Flatten nested dicts into dot-separated keys.
 
     Preserves non-dict collection values (lists, tuples) and scalar values
     without converting them to strings.  Keys that are already dotted in
     the source document are kept literal — they are never re-split on
     ``.`` during reconstruction.
+
+    Returns a tuple of (flat_dict, literal_dotted_keys) where
+    literal_dotted_keys is the set of top-level keys in the original
+    document that already contained dots.
     """
     result: dict[str, Any] = {}
+    literal_dotted: set[str] = set()
     for key, value in d.items():
         full_key = f"{prefix}.{key}" if prefix else key
         if isinstance(value, dict):
@@ -131,7 +142,9 @@ def _flatten_nested(d: dict[str, Any], prefix: str = "") -> dict[str, Any]:
                 # silently drop them when other keys need fixing.
                 result[full_key] = {}
             else:
-                result.update(_flatten_nested(value, full_key))
+                sub, sub_literal = _flatten_nested(value, full_key)
+                result.update(sub)
+                literal_dotted.update(sub_literal)
         elif value is None:
             # Preserve null as None so the fix cycle can distinguish
             # "baseline is null" from "baseline is empty string".
@@ -140,4 +153,8 @@ def _flatten_nested(d: dict[str, Any], prefix: str = "") -> dict[str, Any]:
         else:
             # Preserve lists, tuples, ints, floats, bools, and strings as-is
             result[full_key] = value
-    return result
+        # Track keys that already contained dots in the ORIGINAL document
+        # (not from flattening) so reconstruction can skip splitting them.
+        if not prefix and isinstance(key, str) and "." in key:
+            literal_dotted.add(key)
+    return result, literal_dotted