cowork-bot: scan command fails loudly when no config files load (silent-green guard)

- exit 1 if zero config files loaded across all environment dirs
- exit 1 if baseline env loaded no keys (empty-baseline diff would flag everything)
- +5 regression tests in TestScanEmptyGuards; suite 148 passed, ruff clean

Author: cowork-bot

src/configdrift/cli.py

@@ -280,6 +280,7 @@ def scan(
         raise typer.Exit(code=1)
 
     env_configs: dict[str, dict[str, Any]] = {}
+    files_loaded = 0
     for env_name, dir_path in dir_mapping.items():
         env_configs[env_name] = {}
         p = Path(dir_path)
@@ -294,9 +295,26 @@ def scan(
                 try:
                     data = load_file(str(f))
                     env_configs[env_name].update(data)
+                    files_loaded += 1
                 except Exception as e:
                     console.print(f"[yellow]Warning: could not load {f}: {e}[/yellow]")
 
+    # Silent-failure guard: if nothing was actually loaded, any "no drift"
+    # result would be a false green. Fail loudly instead.
+    if files_loaded == 0:
+        console.print(
+            "[red]ERROR: No config files could be loaded from any environment "
+            "directory. Refusing to report 'no drift' from an empty scan.[/red]"
+        )
+        raise typer.Exit(code=1)
+    if not env_configs.get(baseline):
+        console.print(
+            f"[red]ERROR: Baseline environment '{baseline}' loaded no config "
+            "keys; comparison against an empty baseline would flag every key "
+            "as drift.[/red]"
+        )
+        raise typer.Exit(code=1)
+
     results = diff_environments(env_configs, baseline_env=baseline)
 
     if output == OutputFormat.JSON:

tests/test_cli.py

@@ -473,3 +473,61 @@ def test_version_output(self):
         assert result.exit_code == 0
         assert "configdrift" in result.stdout
         assert "0.1.0" in result.stdout
+
+
+class TestScanEmptyGuards:
+    """Regression: scan must not report a false-green 'no drift' when nothing loaded."""
+
+    def test_scan_all_dirs_missing_exits_1(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            result = runner.invoke(
+                app, ["scan", str(Path(tmpdir) / "nope1"), str(Path(tmpdir) / "nope2")]
+            )
+            assert result.exit_code == 1
+            # Either the baseline-not-found guard or the empty-scan guard fires.
+            assert (
+                "not found" in result.stdout
+                or "No config files could be loaded" in result.stdout
+            )
+
+    def test_scan_empty_dirs_exits_1(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            dev = Path(tmpdir) / "dev"
+            prod = Path(tmpdir) / "prod"
+            dev.mkdir()
+            prod.mkdir()
+            result = runner.invoke(app, ["scan", str(dev), str(prod)])
+            assert result.exit_code == 1
+            assert "No config files could be loaded" in result.stdout
+
+    def test_scan_baseline_dir_missing_exits_1(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            prod = Path(tmpdir) / "prod"
+            prod.mkdir()
+            (prod / "config.yaml").write_text(yaml.dump({"host": "prod.example.com"}))
+            result = runner.invoke(app, ["scan", str(prod), "--baseline", "dev"])
+            assert result.exit_code == 1
+
+    def test_scan_baseline_loaded_nothing_exits_1(self):
+        """Baseline dir exists but only contains unparseable files -> refuse empty-baseline diff."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            dev = Path(tmpdir) / "dev"
+            prod = Path(tmpdir) / "prod"
+            dev.mkdir()
+            prod.mkdir()
+            (dev / "broken.yaml").write_text(":::: not yaml :::\n")
+            (prod / "config.yaml").write_text(yaml.dump({"host": "prod.example.com"}))
+            result = runner.invoke(app, ["scan", str(dev), str(prod)])
+            assert result.exit_code == 1
+            assert "loaded no config" in result.stdout
+
+    def test_scan_healthy_still_works(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            dev = Path(tmpdir) / "dev"
+            prod = Path(tmpdir) / "prod"
+            dev.mkdir()
+            prod.mkdir()
+            (dev / "config.yaml").write_text(yaml.dump({"host": "localhost"}))
+            (prod / "config.yaml").write_text(yaml.dump({"host": "prod.example.com"}))
+            result = runner.invoke(app, ["scan", str(dev), str(prod)])
+            assert result.exit_code == 0