From 583c343d0824e9f4e1694e86bf19d9cabc00e57c Mon Sep 17 00:00:00 2001
From: Hare <kei.hiracchi.0928@gmail.com>
Date: Sun, 30 Aug 2026 21:57:50 +0900
Subject: [PATCH] fix: reject duplicate backend selectors

---
 crates/yoi/src/main.rs | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/crates/yoi/src/main.rs b/crates/yoi/src/main.rs
index 05dfe3f4..903486e4 100644
--- a/crates/yoi/src/main.rs
+++ b/crates/yoi/src/main.rs
@@ -270,6 +270,11 @@ fn parse_top_level_target_selection(
                 i += 1;
             }
             "--backend" => {
+                if selection.backend_url.is_some() {
+                    return Err(ParseError(
+                        "--backend must not be provided more than once".to_string(),
+                    ));
+                }
                 if selection.explicit_local {
                     return Err(ParseError(
                         "--local and --backend are mutually exclusive".to_string(),
@@ -295,6 +300,11 @@ fn parse_top_level_target_selection(
                 i += 2;
             }
             arg if arg.starts_with("--backend=") => {
+                if selection.backend_url.is_some() {
+                    return Err(ParseError(
+                        "--backend must not be provided more than once".to_string(),
+                    ));
+                }
                 if selection.explicit_local {
                     return Err(ParseError(
                         "--local and --backend are mutually exclusive".to_string(),
@@ -1289,6 +1299,11 @@ fn parse_login_args<R: CliConnectionResolver + ?Sized>(
     while i < args.len() {
         match args[i].as_str() {
             "--backend" => {
+                if backend_url.is_some() {
+                    return Err(ParseError(
+                        "--backend must not be provided more than once".to_string(),
+                    ));
+                }
                 let value = args
                     .get(i + 1)
                     .ok_or_else(|| ParseError("--backend requires a URL".to_string()))?;
@@ -1299,6 +1314,11 @@ fn parse_login_args<R: CliConnectionResolver + ?Sized>(
                 i += 2;
             }
             arg if arg.starts_with("--backend=") => {
+                if backend_url.is_some() {
+                    return Err(ParseError(
+                        "--backend must not be provided more than once".to_string(),
+                    ));
+                }
                 let value = arg.trim_start_matches("--backend=");
                 if value.is_empty() {
                     return Err(ParseError("--backend requires a URL".to_string()));
@@ -2046,6 +2066,27 @@ backend = "shared"
         }
     }
 
+    #[test]
+    fn parse_login_rejects_repeated_backend_selectors_in_each_scope() {
+        for args in [
+            vec![
+                "--backend",
+                "http://127.0.0.1:8787",
+                "--backend=http://127.0.0.1:8788",
+                "login",
+            ],
+            vec![
+                "login",
+                "--backend",
+                "http://127.0.0.1:8787",
+                "--backend=http://127.0.0.1:8788",
+            ],
+        ] {
+            let error = parse_args_from(args).unwrap_err().to_string();
+            assert!(error.contains("must not be provided more than once"));
+        }
+    }
+
     #[test]
     fn parse_login_rejects_non_backend_or_duplicate_target_selectors() {
         assert!(