Beagle SCM

BE-030: context-confined path resolution — get anchors on context not cwd; resolve() rel can't escape the tree

Beagle commands must compute every fs path from the nav CONTEXT, confined to that context's worktree — a //ABC-123 context can NEVER yield a path outside $SRC_ROOT/ABC-123/. Two gaps break this: (1) discover.resolve honours a //authority swap in its ref slot, so a relative arg escapes into another wt; (2) get anchors its write/clone on raw io.cwd(), so a bare :get under a nav context whose cwd is a SUBMODULE writes the SUBMODULE's wtlog and checks the parent tree out over it. Continues the BE-011 confinement lineage (wtJoin/resolveInTree/resolve).

Input

Context

• Reported: cwd in a submodule, pager context navigated to the parent (//parent); a bare :get appended the parent's ?branch#tip row to the SUBMODULE's .be wtlog (get.js:189-196, seedLocal).
• Mechanism: the pager composer injects the context authority into the arg (:get → get //parent, shared/spell.js:71-98); authorityRepo (core/loop.js:181-211) hoists //parent → be.repo=parent + be.authority, blanks the arg; dispatchRow (verbs/get/get.js:333-335) then clones FROM the context INTO io.cwd()=submod (handleSeed wt=io.cwd(), get.js:348).
• ROOT CAUSE (the entire point): RESOLVING an arg is the VERB's job — only the verb knows what its arg MEANS (a path vs a branch vs a remote vs a message vs a clone source). The pager currently TRIES to resolve (shared/spell.js mergeUri/shapeArg0/bareCtx pre-merge the typed token onto the context URI) and gets it wrong, because a generic merge can't carry per-verb semantics — it injects //parent as if it were an operand. Fix: the pager hands the verb (context, RAW args); each verb resolves its own args via resolve(context, arg).
• resolve leak (verified): resolve("//ABC-123/dir","//OTHER/x") = $SRC_ROOT/OTHER/x; a //authority in the ref slot swaps trees. A .. climb-out already throws NAVESCAPE (shared/util/path.js:85).
• URI-011/Nav: a relative arg resolves against the context and stays within its wt; the context is where-I-am, not an operand — an EXPLICIT //name operand is a different thing from an INJECTED nav scope.

Goals

• Promote discover.resolve to resolve(context, base, rel): context = the //name[/dir] scope, base = the in-repo dir, rel = untrusted relative; return the confined abs fs path, ALWAYS under $SRC_ROOT/<context-name>/.
• rel is AUTHORITY-BLIND: a //x / scheme in rel is refused (a tree swap is the nav layer's job, never the fs resolver's) — this closes the //OTHER escape.
• get anchors its write/clone destination on the CONTEXT wt (be.cwd()/contextCwd, discover.js:315), never raw io.cwd(); a bare :get under a nav context refreshes the CONTEXT tree (inRepoSeed on be.repo), it does NOT clone into a submodule cwd.
• A bare :get (no operand) under a nav context refreshes the CONTEXT tree (inRepoSeed on be.repo), it never clones into a submodule cwd. (The injected-vs-explicit //name ambiguity is a pager PRE-MERGE artifact — see Design decisions — dissolved by moving resolution into the verb, not by a get-side gate.)
• Repro FIRST: (a) unit — resolve confines a //OTHER / ../.. rel to the context tree; (b) get — :get (or get //parent) with cwd in a sub does NOT write the sub's .be.

Constraints

• Pure JS (core/discover.js, verbs/get/get.js, core/loop.js / shared/spell.js as needed); libabc+libdog only; run the repro via jab against the wt shard (NO C rebuild).
• No URI hand-parsing / regex — route through the URI binding (uri._parse/_make) + the shared/util/path.js segment helpers.
• Minimal churn: reuse resolveInTree/wtJoin/safeRel; do NOT sweep the ~14 read-views in this ticket (follow-up).
• No existing test edited — add NEW repro files only. Worktree at $SRC_ROOT/BE-030; do not touch journal/be or journal/todo.

WIP

Design decisions

• The wt-SWAP (which tree) is the nav-merge layer's job (spell.mergeUri / authorityRepo); resolve resolves only WITHIN a fixed context, so rel never carries an authority — that is what makes the confinement a PROPERTY of the one function.
• 3-arg resolve(context, base, rel) supersedes the 2-arg resolve(base, ref); keep a thin shim for wtdir if it still needs the 2-arg shape, or migrate it.
• Verbs resolve args: a verb takes the CONTEXT + the RAW arg and resolves it (paths via resolve(context, base, rel); refs/remotes per the verb's own grammar). The pager is arg-semantics-BLIND — it never merges/pre-resolves; it hands the verb the context + raw tokens. This dissolves the //parent injected-vs-explicit ambiguity: a bare :get arrives with NO operand (→ inRepoSeed on the context repo), get //other arrives WITH one (→ clone-from) — the pager no longer flattens both into arg0.
• get (this ticket's slice): replace io.cwd() (get.js:334,348) with contextCwd(); a bare get (no operand) → inRepoSeed on be.repo, never handleSeed(io.cwd). The pager pre-merge retirement is a SEPARATE follow-up.

TODOs

• Repro tests: resolve-confinement unit + get-submod-wtlog case (NEW files under be/test/).
• resolve(context, base, rel) 3-arg, rel authority-blind, confined to $SRC_ROOT/<name>.
• get.js: anchor write/clone on contextCwd (not io.cwd); a bare get (no operand) → inRepoSeed on be.repo, never handleSeed(io.cwd).
• Verify: repros green; test/uri.js, test/resolve.js, test/submount.js regression-clean.
• Follow-up (own ticket): move arg resolution fully INTO the verbs — retire the pager's pre-merge (spell.mergeUri/shapeArg0/bareCtx, shared/spell.js; views/bro/pager.js:696-711) so the pager hands the verb (context, RAW args); route each verb/view's arg→path through resolve(context, base, rel); correct Nav §Verb-args-context (the verb resolves context+arg; the pager is arg-blind).

Blockers and bummers

• Worktree bring-up (GET-041 note, via BE-029): $HOME/be is the jab locator; do NOT plant be in the worktree; jab get 'file:/home/gritzko/.be?/beagle-ext' from the empty dir then completes.

Outcome

• (pending)