Beagle SCM

JS-097 MED: jab get ABORTS the whole checkout on a committed .be/.git tree entry (should skip it silently, like native POST-015)

A jab get (any transport) of a source tree that carries a committed .be entry dies with JS exception: checkout: unsafe path .be and checks out NOTHING — not even the sibling real files. .be/.git/..be.idx are the store-anchor names; native's keeper walk SKIPS them silently (POST-015, fixed the SPAM half in beagle/test/get/48), but the JS leaf raises a hard, uncaught exception that aborts the entire reconcile. Strictly worse than the native bug it mirrors. Found splitting JS-096 (the 48 port is xfail). Method Issues.

Input

Context

• Repro (live 2026-06-28, prebuilt jab): a git init repo with a committed

  .be (git add -f real.txt .be), cloned via jab get ssh://localhost/<rel>?/g → stdout empty, stderr JS exception: checkout: unsafe path .be, exit 1, real.txt NOT materialised. A clean sibling tree (no .be) clones fine.

• Site: shared/checkout.js::materialise (line 96) throws

  "checkout: unsafe path " + rel via safeRel (shared/util/path.js:45-53, which rejects .git/.be/..be.idx segments — the JS-065 traversal guard). The get fan-out leaf (verbs/get/get.js::leaf, ~line 644) calls materialise with no try/catch, so the exception propagates out of the whole jab get.

• shared/store.js::readTreeRecursive (line 509) has the SAME hazard — it

  throws store: unsafe tree path on a .be leaf — but the get path hits the materialise guard first.

• The JS-065 guard correctly rejects a path-traversal ESCAPE (../evil — see

  test/get/traversal). A literal .be/.git entry is NOT an escape; it is a store-meta name to skip, like scanWt already skips (checkout.js:37-38).

Goals

• jab get of a tree carrying .be/.git/..be.idx entries SKIPS those

  entries SILENTLY and checks out every other path; the get exits 0.

• The path-traversal guard (../, absolute, NUL) STILL refuses (loudly) —

  distinguish "store-meta name to skip" from "escape to reject".

• Un-xfail be-js-get-walk-dot-be-quiet (the JS-096 port asserting real.txt

  lands and the get exits 0); keep test/get/traversal green.

Constraints

• No hand-rolled URI/path parsing beyond the existing safeRel segment check.
• Fix at the reconcile/leaf level (skip the .be/.git/..be.idx ENTRY)

  rather than relaxing safeRel (which guards the traversal case too).

WIP

Design decisions

• (open) Likely: split the guard — a new safeRel-style predicate that

  classifies a leaf as SKIP (store-meta .be/.git/..be.idx) vs REJECT (escape) vs OK; the reconcile/leaf drops SKIP entries before materialise, keeps the loud throw for REJECT. The dir-reconcile (reconcileDir) and the recursive tree readers (readTreeRecursive) must drop the entry symmetrically so no del-leaf is emitted for a skipped name either.

TODOs

• Repro-first: a port-arm jab get of a .be-bearing tree FAILS today.

  NB the be-js-get-walk-dot-be-quiet case was never added (JS-096 port didn't land) and _BE_WILL_FAIL is now empty — write the case first (be/test/get/walk-dot-be-quiet/run.sh), xfail or land it red-then-green.

• Skip .be/.git/..be.idx entries in the get reconcile/leaf (`get.js

  reconcileDir/treeMap and leaf() before checkout.materialise) + the tree readers (store.js readTreeRecursive:509); keep the escape (../, absolute, NUL) refusal loud in safeRel (shared/util/path.js:44-56`).

• Land the case green; confirm test/get/traversal still green.

Blockers and bummers

• A real-world clone of any tree that ever committed a .be/.git (common

  for store-in-store fixtures) is unusable via jab get.

Outcome

• (open) Split off JS-096 (the 48 port), filed 2026-06-28.
• Re-verified OPEN 2026-07-07 by code read: checkout.js:98 still throws

  "checkout: unsafe path" via safeRel (which still rejects .be/.git/ ..be.idx segments); get.js reconcileDir/leaf() add no meta-name skip and call materialise uncaught (:775/:789); store.js readTreeRecursive:509 still throws on the same names.