.. escapes the root
be.wtdir (core/discover.js:232) confines a nav authority to SRC_ROOT with a LEXICAL prefix compare (repo.wt.indexOf(top+"/")===0), but the URI parser does not normalize ..: a host of .. passes authorityRepo's dotless-typo gate (it contains a dot) and u.path may carry ../. io.stat then resolves the dots PHYSICALLY while the confinement compare stays lexical, so //../name and //name/../../.. adopt any anchored tree OUTSIDE SRC_ROOT. shared/util/path.js safeRel (JS-065's "ONE worktree-confinement guard") is never applied to host/path — the JS twin of native DOG-009. From the 2026-07-07 be/ review (BE/REVIEW), CONFIRMED with a probe. Method Issues.
be.wtdir("//name/../../outside") and be.wtdir("//../outside") both returned a path physically resolving to .../play/outside, OUTSIDE SRC_ROOT=.../play/root.const top = root + "/" + host; const dir = top + (u.path||""); ... if (repo.wt !== top && repo.wt.indexOf(top+"/") !== 0) return null; — find()'s walk-up uses lexical dirname, so root/name/.. keeps its prefix and passes the guard while io.stat escapes.dog/HOME.c escape... in host or path never escapes.shared/util/path.js... segment in host/path pre-compose)//../x and //name/../../x refuse.