Beagle SCM

JS-081 MED: views/bro/bro.js fd-1 capture monkey-patch is re-entry-fragile

driveSpell captures the re-entrant loop.cli's fd-1 'H'-record stream by swapping the GLOBAL io.writeAll for the duration of the call (restored in a finally). The loop EDGE is correctly gated (core/loop.js:318 checks both mode!=="tlv" AND !opts2.queuePath), but the bro VERB handler's wantPager check (bro.js:130) is NOT gated on mode==="tlv". So a :bro:foo spell re-enters the handler, which re-evaluates wantPager true, re-patches the already-patched io.writeAll, and tries to launch a NESTED pager; under a /dev/tty-open failure fallthrough (:143-145 falls to fd 1) this can pollute the outer capture. Self-flagged interim (JAB-029). Method: Issues.

Input

Context

• views/bro/bro.js:84 const orig = io.writeAll; then :86-89 swaps the

  GLOBAL io.writeAll to push fd-1 chunks; :96 restores it in finally.

• :94-95 re-enters loop.cli([…, spell, "--tlv"], { queuePath }) — the

  --tlv + per-call queue suppress the loop EDGE pager (core/loop.js:318).

• :130 `const wantPager = io.isatty(1) && (ctx.flags||[]).indexOf("--plain")

  < 0; — NOT gated on ctx.mode!=="tlv"`, unlike the edge.

• core/loop.js:306 sets ctx.mode from the run flags, so the handler CAN

  see --tlv; the gate is just missing here.

• :131-151 the wantPager branch opens pager.Pager; :143-145 the

  /dev/tty open can fail and fall through to fd=1, the fd driveSpell is mid-patching — a nested pager would write into the capture.

Goals

• A :bro:<spell> re-entry takes the plain/tlv dump path (the captured

  branch), NEVER the nested-pager branch — matching the loop edge.

• A repro: drive bro with a bro:-prefixed spell and assert no nested

  pager / no fd-1 capture pollution.

Constraints

• views/bro/bro.js; keep the tty pager behaviour for the OUTER (non-tlv)

  run byte-identical. The fd-1 monkey-patch stays interim (JAB-029).

WIP

Design decisions

• Short fix: add && ctx.mode!=="tlv" to the :130 wantPager (mirror the

  edge gate), so a re-entrant tlv run never re-pages; a re-entry marker on ctx is the alternative if mode is not reliably tlv.

• Long-term (JAB-029): pass an explicit out-sink into loop.cli so the

  capture is a parameter, not a mutation of global io.writeAll.

TODOs

• Repro-first test/js/bro/*: a bro drive whose spell is bro:<x>

  asserts NO nested pager opens and the outer capture is intact.

• Gate :130 wantPager on ctx.mode!=="tlv" (+ note JAB-029 for the

  sink-injection follow-up).

Blockers and bummers

• The explicit-sink refactor is JAB-029-scoped; this ticket is the gate

  only, keep it 1-2 LoC.

• 2026-07-07 audit: STILL OPEN (line refs shifted; partial mitigation added). JSQUE-020

  928aaad5 added an opts2.reentry marker: driveSpell calls loop.cli(argv,{reentry:true}) (views/bro/bro.js:117) and the LOOP edge gates its pager on !opts2.reentry (core/loop.js:353). BUT the bro VERB handler's own gate broRun wantPager = io.isatty(1) && flags.indexOf("--plain")<0 (bro.js:153) is STILL not gated on reentry/mode==="tlv", and the fd-1 io.writeAll global monkey-patch persists (bro.js:106-118). Re-target the fix to bro.js:153 (add the reentry/tlv gate).

Outcome

• (pending)