Beagle SCM

BE-011: wtdir SRC_ROOT confinement is a lexical prefix check — .. escapes the root

be.wtdir (core/discover.js:232) confines a nav authority to SRC_ROOT with a LEXICAL prefix compare (repo.wt.indexOf(top+"/")===0), but the URI parser does not normalize ..: a host of .. passes authorityRepo's dotless-typo gate (it contains a dot) and u.path may carry ../. io.stat then resolves the dots PHYSICALLY while the confinement compare stays lexical, so //../name and //name/../../.. adopt any anchored tree OUTSIDE SRC_ROOT. shared/util/path.js safeRel (JS-065's "ONE worktree-confinement guard") is never applied to host/path — the JS twin of native DOG-009. From the 2026-07-07 be/ review (BE/REVIEW), CONFIRMED with a probe. Method Issues.

Input

Context

• Probe (2026-07-07): be.wtdir("//name/../../outside") and be.wtdir("//../outside") both returned a path physically resolving to .../play/outside, OUTSIDE SRC_ROOT=.../play/root.
• const top = root + "/" + host; const dir = top + (u.path||""); ... if (repo.wt !== top && repo.wt.indexOf(top+"/") !== 0) return null; — find()'s walk-up uses lexical dirname, so root/name/.. keeps its prefix and passes the guard while io.stat escapes.
• safeRel is wired only into checkout.materialise / store.readTreeRecursive / stage.isMeta (tree-entry writes), never wtdir; DOG-009 tickets only the native dog/HOME.c escape.

Goals

• A nav authority/path that resolves outside SRC_ROOT is REFUSED (a code-worded throw), not adopted; .. in host or path never escapes.
• Apply the existing confinement guard (safeRel or a normalize-then-prefix check) to the composed wtdir before io.stat.

Constraints

• Repro-first (the two escape URIs above → refusal); no hand-rolled path normalization beyond shared/util/path.js.
• URI slots via the URI class only.

WIP

Design decisions

• UNIFIED resolver, not a point patch. New segment calculator in shared/util/path.js: split/merge + resolveInTree(base,rel) (normalises ./.., THROWS NAVESCAPE on a climb above the tree root) + wtJoin(wtRoot,rel). Confinement is a PROPERTY of the compose step, not a post-hoc prefix compare.
• core/discover.js: resolve(base,ref)→abs (the context_uri+path→filesystem_path resolver, throws NAVESCAPE on escape); wtdir delegates to it and its lexical indexOf(top+"/") check is GONE. srcRoot() memoised on be.srcRootDir.
• Spawned a codebase-wide wt-open audit → THREE more live escapes of this class (BE-026/BE-027/BE-028, all landed) + a universal wtJoin routing pass (P2/P3) across views/verbs/shared.

TODOs

• Repro: //../x and //name/../../x refuse — test/uri011/nav-escape/run.sh.
• Confine wtdir via resolveInTree/resolve; suite green.

Blockers and bummers

• None known.

Outcome

• RED repro test/uri011/nav-escape/run.sh: //root/../../outside + //../outside physically escaped SRC_ROOT; now REFUSED with NAVESCAPE, //root still resolves.
• Landed: shared/util/path.js (split/merge/resolveInTree/wtJoin); core/discover.js (resolve, wtdir delegate, srcRoot cache). Follow-on escapes BE-026/BE-027/BE-028 + P2/P3 wtJoin routing (cat/why/diff/spot, put/delete/get/post/patch, checkout/submount/stage leaf guards).
• Final combined suite: 136 pass / 10 env-skip / 0 fail (bro/view/color are a pre-existing FS-readdir-order golden flake, pager-independent). Working tree left DIRTY — no VC ops.