fix(nvim): refuse fs-root/home index at Lua level before FFI (#745) (#748)

* fix(nvim): refuse fs-root/home index at Lua level before FFI (#745)

Opening nvim at `/` with lazy=false crashed the whole neovim process on
CI-cross-compiled aarch64 .so binaries: the init_file_picker FFI call
SIGSEGVs instead of returning Error::FilesystemRoot cleanly. A SIGSEGV
is a hardware signal that the pcall around init_file_picker cannot catch.

Mirror the Rust refusal (file_picker.rs:862) in Lua and bail before
crossing the FFI boundary, so the crashing path is never reached. Same
guard added to change_indexing_directory for the :cd-into-root case.
Honors enable_fs_root_scanning / enable_home_dir_scanning overrides.

* chore(nvim): trim comments in fs-root/home refusal guard

---------

Co-authored-by: gustav-fff <286169375+gustav-fff@users.noreply.github.com>

lua/fff/core.lua

@@ -3,6 +3,8 @@ if not fuzzy then error('Failed to load fff.fuzzy module. Ensure the Rust backen
 
 local M = {}
 
+local fs_scanning_refusal
+
 ---@class fff.core.State
 local state = {
   ---@type boolean
@@ -111,6 +113,13 @@ M.change_indexing_directory = function(new_path)
 
   local fff_rust = M.ensure_initialized()
   local config = require('fff.conf').get()
+
+  local refusal = fs_scanning_refusal(vim.tbl_extend('force', config, { base_path = expanded_path }))
+  if refusal then
+    vim.notify('FFF: ' .. refusal, vim.log.levels.WARN)
+    return false
+  end
+
   local ok, err = pcall(fff_rust.restart_index_in_path, expanded_path, {
     follow_symlinks = config.follow_symlinks,
     enable_fs_root_scanning = config.enable_fs_root_scanning,
@@ -128,9 +137,19 @@ end
 
 M.ensure_initialized = function()
   if state.initialized then return fuzzy end
-  state.initialized = true
 
   local config = require('fff.conf').get()
+
+  -- Some folks are complaining that neovim instance is closing if ffi returns error on startup (via lazy=false)
+  -- I can't repro so just precheck on lua side to prevent crashing neovim instance
+  local refusal = fs_scanning_refusal(config)
+  if refusal then
+    state.initialized = true
+    vim.notify('FFF: ' .. refusal, vim.log.levels.WARN)
+    return fuzzy
+  end
+
+  state.initialized = true
   if config.logging.enabled then
     local log_success, log_error =
       pcall(fuzzy.init_tracing, config.logging.log_file, config.logging.log_level, config.logging.retain_runs)
@@ -173,4 +192,21 @@ M.ensure_initialized = function()
   return fuzzy
 end
 
+function fs_scanning_refusal(config)
+  local path = vim.fn.fnamemodify(vim.fn.expand(config.base_path), ':p'):gsub('/+$', '')
+
+  if not config.enable_fs_root_scanning and (path == '' or path:match('^%a:$')) then
+    return 'Refusing to index filesystem root. Set enable_fs_root_scanning = true to override.'
+  end
+
+  if not config.enable_home_dir_scanning then
+    local home = (vim.fn.expand('$HOME') or ''):gsub('/+$', '')
+    if home ~= '' and path == home then
+      return 'Refusing to index home directory. Set enable_home_dir_scanning = true to override.'
+    end
+  end
+
+  return nil
+end
+
 return M