fix(editors): stage external edits per-remote-file to avoid clobbering (#76)

[macnev2013]

Problem

Refs #76.

"Edit in editor" downloaded every remote file to a flat temp/anyscp-edit/<filename>. Two remote files sharing a basename — a/compose.yml and b/compose.yml — therefore mapped to the same local path. With both open in an editor, saving one re-uploaded its contents to the other's remote path, silently overwriting it. The flaw was duplicated across all three transports: sftp_edit_external, scp_edit_external, and s3_edit_external.

Fix

Namespace every edit session under a unique staging directory:

anyscp-edit/<group>/<unique>/<filename>

• <group> — a stable DefaultHasher digest of key (session_id + "\0" + remote_path/key), so all edits of one remote file share a readable group dir. The same path on different servers also stays separate.
• <unique> — a fresh UUID per call. This isolates every edit session, which closes two gaps a per-file hash alone couldn't:
  • Two distinct keys colliding in the 64-bit group hash still never share a file.
  • A second edit of the same remote file gets its own dir, so one save-watcher's 30-min cleanup can't delete the file out from under another live editor session.
• The original filename is kept innermost so the editor keeps the correct name and syntax highlighting.

Teardown is centralized in a shared edit_temp_cleanup(local_path) (replacing the three duplicated cleanup blocks). It removes the file and prunes empty per-edit dirs, walking up but stopping at — and never removing — the anyscp-edit root. A still-live concurrent edit's staging dir is non-empty, so the walk halts there and leaves it intact.

Implementation

• editors/mod.rs — edit_temp_path(key, file_name) now appends the per-invocation UUID; new edit_temp_cleanup(path) helper.
• SFTP / SCP / S3 callers — build key, create the per-edit parent dir, and call edit_temp_cleanup on teardown.

Trade-off

This intentionally drops the determinism the first cut had (same key → same path) — that property was the cause of the concurrent-edit race, and nothing relied on it (each caller captures the returned local_path directly and never reconstructs it).

Testing

• cargo test --lib editors:: — 10 passed, including:
  • edit_temp_path_separates_same_basename — distinct dirs even for the same key, while sharing a group dir.
  • edit_temp_cleanup_prunes_dirs_but_keeps_root — pruning stops at the root.
  • edit_temp_cleanup_halts_at_nonempty_group — cleaning up edit A doesn't touch concurrent edit B's live file.
• cargo check --lib — clean.