Validate access to derived host roots

internal/engine/acquisition.go

@@ -137,7 +137,7 @@ func acquireStandaloneInput(input assembledInput, request inputAcquisitionReques
 		input.document = processing.payload
 	}
 	if request.resolved != nil {
-		if diagnostic := validateResolvedFilesystemDirectories(*request.resolved); diagnostic != nil {
+		if diagnostic := validateResolvedFilesystemContext(*request.resolved); diagnostic != nil {
 			return input, []Diagnostic{*diagnostic}
 		}
 		input.resolvedFilesystem = request.resolved

internal/engine/filesystem.go

@@ -17,23 +17,30 @@ func validateFilesystemContext(source Source, context *FilesystemContext, main p
 		}
 		return resolvedFilesystemContext{}, diagnostic
 	}
-	if diagnostic := validateResolvedFilesystemDirectories(resolved); diagnostic != nil {
+	if diagnostic := validateResolvedFilesystemContext(resolved); diagnostic != nil {
 		return resolvedFilesystemContext{}, diagnostic
 	}
+	return resolved, nil
+}
+
+func validateResolvedFilesystemContext(resolved resolvedFilesystemContext) *Diagnostic {
+	if diagnostic := validateResolvedFilesystemDirectories(resolved); diagnostic != nil {
+		return diagnostic
+	}
 	if resolved.native != nil {
-		return resolved, nil
+		return nil
 	}
 	root, err := os.OpenRoot(resolved.rootPath)
 	if err != nil {
 		value := globFilesystemDiagnostic(err, "configuration root could not be opened", Location{})
 		value.Primary = nil
-		return resolvedFilesystemContext{}, &value
+		return &value
 	}
 	if err := root.Close(); err != nil {
 		value := importDiagnostic(CodeImportRead, "configuration root could not be closed", nil)
-		return resolvedFilesystemContext{}, &value
+		return &value
 	}
-	return resolved, nil
+	return nil
 }
 
 func filesystemOptionDiagnostics(source Source, context *FilesystemContext) []Diagnostic {