fix: correct staging path resolution — tmp/{guid}/in not tmp/in/{guid}

Frontend now passes '{guid}/in/filename' to backend.
Backend extract_if_needed uses STAGING_ROOT (tmp/) as base.
Provisioner staging helpers build tmp/{guid}/in + tmp/{guid}/out.

backend/converter.py

@@ -49,7 +49,7 @@ def extract_if_needed(filename: str) -> Path:
     Accepts both absolute paths and paths relative to STAGING_IN."""
     filepath = Path(filename)
     if not filepath.is_absolute():
-        filepath = STAGING_IN / filename
+        filepath = STAGING_ROOT / filename
     if not filepath.exists():
         raise FileNotFoundError(f"Source not found: {filepath}")
 

backend/provisioner.py

@@ -35,10 +35,12 @@ STAGING_IN = STAGING_ROOT / "in"
 STAGING_OUT = STAGING_ROOT / "out"
 
 def _staging_in(session_id: str = "") -> Path:
-    return STAGING_IN / session_id if session_id else STAGING_IN
+    base = STAGING_ROOT / session_id if session_id else STAGING_ROOT
+    return base / "in"
 
 def _staging_out(session_id: str = "") -> Path:
-    return STAGING_OUT / session_id if session_id else STAGING_OUT
+    base = STAGING_ROOT / session_id if session_id else STAGING_ROOT
+    return base / "out"
 
 # In-memory job tracking — survives as long as the process runs
 _jobs: dict[str, dict] = {}

frontend/app.py

@@ -436,7 +436,8 @@ async def session_analyze(
         return render("_analysis.html", request=request, error=err)
 
     # Prepend session subdirectory to the filename for the backend
-    backend_filename = f"{session_id}/{filename}" if session_id else filename
+    # Files are in tmp/{guid}/in/, so the backend needs {guid}/in/filename
+    backend_filename = f"{session_id}/in/{filename}" if session_id else filename
 
     try:
         analysis = api.analyze(vmid=vmid, filename=backend_filename)