config: canonicalize existing ancestor for import-path validation

`validate_within_root` rejected valid input-relative imports on macOS,
where `TMPDIR` resolves via the `/var -> /private/var` symlink and the
import path's leaf does not exist yet (`Import path '<name>/...'
resolves outside the git repository`). Resolve the longest existing
ancestor with `canonicalize` and append the remaining components
lexically, so symlinks anywhere up the chain are followed even when the
leaf is absent.

Split out of #2849.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: domenkozar

CHANGELOG.md

@@ -17,6 +17,7 @@
 - Fixed long lines in `devenv shell` getting a hard newline inserted at the wrap point when copying to clipboard. The shell now preserves the soft-wrap when flushing wrapped output into the terminal's scrollback, so clipboard copy keeps the original single line ([#2865](https://github.com/cachix/devenv/issues/2865)).
 - Fixed files declared with the `files` option not being regenerated when an auto-loaded (`devenv allow`) shell reloaded after `devenv update`. enterShell tasks (including `devenv:files`) now re-run on hot-reload, matching a fresh shell entry, instead of only updating environment variables ([#2864](https://github.com/cachix/devenv/issues/2864)).
 - Fixed `devenv test --no-tui` (and any other non-TUI invocation) silently discarding all output from the `enterTest` script, so the test runner's output, traces, and failure messages never reached the terminal or CI logs. Output from commands run in the shell is now printed in non-TUI mode.
+- Fixed import path validation rejecting valid input-relative imports on macOS, where `TMPDIR` resolves via the `/var → /private/var` symlink (`Import path '<name>/...' resolves outside the git repository`). `validate_within_root` now canonicalizes the longest existing ancestor of the path before comparing against the root.
 
 ### Improvements
 

devenv-core/src/config.rs

@@ -1231,21 +1231,13 @@ impl Config {
             && let Some(canonical_root) = canonical_root
         {
             // Import path doesn't exist, but root does.
-            // Canonicalize the parent directory to resolve symlinks
-            // (e.g. /tmp -> /run/user/...), falling back to lexical
-            // normalization only when the parent doesn't exist either.
-            let abs_import = if let Some(parent) = import_path.parent() {
-                if let Ok(canonical_parent) = parent.canonicalize() {
-                    canonical_parent.join(import_path.file_name().unwrap_or_default())
-                } else if import_path.is_absolute() {
-                    Self::normalize_path_components(import_path)
-                } else if let Ok(cwd) = std::env::current_dir() {
-                    Self::normalize_path_components(&cwd.join(import_path))
-                } else {
-                    return Ok(());
-                }
-            } else if import_path.is_absolute() {
-                Self::normalize_path_components(import_path)
+            // Walk up the path looking for an existing ancestor that we can
+            // canonicalize (so symlinks like macOS `/var -> /private/var` get
+            // resolved), then append the remaining components lexically.
+            let abs_import = if import_path.is_absolute() {
+                Self::canonicalize_existing_ancestor(import_path)
+            } else if let Ok(cwd) = std::env::current_dir() {
+                Self::canonicalize_existing_ancestor(&cwd.join(import_path))
             } else {
                 return Ok(());
             };
@@ -1273,6 +1265,35 @@ impl Config {
         Ok(())
     }
 
+    /// Resolve an absolute path by canonicalizing the longest existing prefix
+    /// and appending the remaining components lexically. This handles paths
+    /// whose leaves don't exist yet while still resolving symlinks anywhere
+    /// up the chain (e.g. macOS `/var/folders/...` -> `/private/var/folders/...`).
+    fn canonicalize_existing_ancestor(path: &Path) -> PathBuf {
+        let mut probe = path.to_path_buf();
+        let mut tail: Vec<std::ffi::OsString> = Vec::new();
+        loop {
+            match probe.canonicalize() {
+                Ok(canonical) => {
+                    let mut result = canonical;
+                    for component in tail.iter().rev() {
+                        result.push(component);
+                    }
+                    return result;
+                }
+                Err(_) => {
+                    let file_name = probe.file_name().map(|n| n.to_os_string());
+                    if !probe.pop() || file_name.is_none() {
+                        // Nothing exists along the way; fall back to lexical
+                        // normalization of the original path.
+                        return Self::normalize_path_components(path);
+                    }
+                    tail.push(file_name.unwrap());
+                }
+            }
+        }
+    }
+
     /// Normalizes a path by resolving `.` and `..` components without requiring the path to exist.
     fn normalize_path_components(path: &Path) -> PathBuf {
         let mut components = Vec::new();