MGS1047: a spell import resolves outside the workspace

A spell import is searched from the workspace root down to the directory of the magusfile that imports it. A ../ import joined onto a shallow level can point above the root, and magus never loads a file from there:

[error] [MGS1047] import "../spells/lint" resolves outside the workspace: from /repo
it reaches above the workspace root /repo, and an import never loads a file outside
the root; import a path inside the workspace

A candidate above the root is skipped without being probed. The error fires only when no candidate inside the root is left.

A plain module import is held to the same root. A file the search resolves above the root is refused with this code and never read. The remote-spell view is a declared root and stays allowed, and -L or BUZZ_INCLUDE_PATH for magus buzz scripts stay a deliberate escape.

Why

The workspace is the unit magus loads, caches and sandboxes. A worktree sits beside other checkouts of the same repository, and an import that reached past its root would load a sibling checkout's spell, so two checkouts of one commit could run different code. Keeping the search inside the root is what makes a load answer for its own tree.

What to do

Import the spell by a path that stays inside the workspace, relative to the magusfile or to the workspace root. A spell that lives outside the repository is declared through magus.yaml instead; see Remote spells.