Beagle SCM

BE-062: every curlRun call loses its first flag — io.spawn consumes argv[0], so curl never sees -sSf (no --fail, no silence)

io.spawn(bin, argv) takes argv WITH argv[0]: io.spawn("/bin/echo", ["AAA","BBB"]) runs echo with argv0 AAA and prints BBB. Every other spawn site obeys that — classify() builds argv: [keeperBin, verb, sp] and [sshBin, dest, cmd], bin repeated. curlRun does not: be/shared/wire.js:252 calls io.spawn(CURL_BIN, argv) where all four callers pass ["-sSf", "-A", "git/2.0", …]. So -sSf becomes argv0 and is DROPPED. curl therefore runs without -f: an HTTP 404/500 is written to stdout as a body and returned as success, and without -sS its progress meter goes to stderr on every fetch. Visible in any http clone. Found by the TEST-004 treadmill; method Issues.

Input

Context

• be/shared/wire.js:252 io.spawn(CURL_BIN, argv) — the only spawn site in be/ whose argv omits the binary.
• The four callers all lead with the lost flag: curlPost (:287), fetchHttp (:349), pushHttp (:638), advertRefs (:681) — each ["-sSf", "-A", "git/2.0", …].
• Convention confirmed 2026-07-27 against jab 22bec7d6: io.spawn("/bin/echo", ["AAA","BBB"]) → busybox reports AAA: applet not found; ["echo","CCC"] → prints CCC.
• Live evidence: TEST-004's treadmill output carries curl's % Total % Received … progress meter on every http clone — exactly what -sS exists to suppress.
• Consequence of the missing -f: curlRun only throws on a non-zero curl EXIT. An HTTP error page returns exit 0, so the error body is handed to the pkt-line parser and fails later as a malformed advertisement instead of "the server said 404".
• -A git/2.0 and everything after it DO reach curl — only the first element is eaten, so the bug is silent rather than fatal.

Goals

curl receives every flag its caller passed, and an HTTP error surfaces as an HTTP error.

• curlRun spawns with argv[0] present: io.spawn(CURL_BIN, [CURL_BIN].concat(argv)), matching classify()'s shape.
• -f actually applies, so a 4xx/5xx becomes a plain-words failure naming the URL and the status, not a parse error three layers down.
• A test pins it: a server returning 404 makes jab get http://… fail with a transport error, not a pkt-line complaint.
• Audit the rest of be/ for the same slip — io.spawnFds sites (verbs/vim/vim.js:55) already pass the name, but confirm.

Constraints

• be/ JS only — io.spawn's convention is correct and jab/ is not in scope.
• Do not change what the callers pass; the argv lists are right, only the spawn call is wrong.
• Keep the fix separate from BE-013's child/fd lifecycle rework of the same function, or land them together deliberately.

WIP

Design decisions

• One-line fix at the spawn site rather than four caller edits: the callers already follow the documented convention for every other spawn.

TODOs

• Repro test first: a 404-returning stub server; assert today's failure mode, then the fixed one.
• io.spawn(CURL_BIN, [CURL_BIN].concat(argv)) in curlRun.
• Check the error message a failed -f produces reads in plain words with the URL and status.
• Grep be/ for any other io.spawn/io.spawnFds whose argv omits argv[0].
• Confirm the progress meter is gone from an http clone's stderr.

Blockers and bummers

• Touches the same function BE-013 rewrites for child/fd lifecycle — coordinate so one does not clobber the other.

Outcome

Not started — filed 2026-07-27 from a TEST-004 treadmill finding.