@sous-io/sous 0.2.28 → 0.2.29

package/docs/markdown/_sidebar.md

@@ -26,4 +26,5 @@
   - [0005: Follow-ups from the first project on the hand-off](adrs/0005-first-project-follow-ups.md)
   - [0006: `sous repo init` follows `sous-recipes`](adrs/0006-repo-init-model-home.md)
   - [0007: Frozen index entries and tolerant readers](adrs/0007-frozen-index-dependencies.md)
+  - [0008: One ref parser, told where the ref came from](adrs/0008-one-ref-parser.md)
   - [0009: One whole build, everywhere](adrs/0009-whole-build-everywhere.md)

package/docs/markdown/repositories-authoring.md

@@ -151,19 +151,23 @@ depends:
   - workflow/qa-helper                                       # a sibling, released alongside me
   - workflow/qa-helper@^1.1                                  # a sibling with a range; uncommon
   - github://sous-io/sous-recipes/workflow/sat@^1.0          # another repository
-  - gitlab://gitlab.example.com/group/subgroup/proj/qa/lint  # a self-hosted host, with subgroups
+  - gitlab://gitlab.example.com/group/subgroup/proj/-/qa/lint  # a self-hosted host, with subgroups
+  - https://github.com/acme/recipes/tree/main/recipes/lint     # a URL copied from the browser
 subscribes:
   - quality/code-review                                      # co-subscribed: its files land too
 ```
 
 A **bare ref** is a sibling in this repository; with no range it means "the version released alongside me", since
-one run cuts both tags and records the exact version in the index. A locator URL names another repository,
-and its last two segments are always the namespace and the recipe, which is the recipe's published **identity and
-never a path on disk**: a recipe stored at `recipes/shared/sat/` and published as `workflow/sat` is written
-`github://owner/repo/workflow/sat`. Everything before them is the repository, a dotted first segment naming the
-host. The optional range after `@` follows npm's rules. `local://` locators and `repo:` short names are refused:
-a local repository is a consumer's convenience, and a short name is one project's private label. See
-[Dependencies named by location](repositories-file-formats.md#dependencies-named-by-location).
+one run cuts both tags and records the exact version in the index. A location names another repository: a
+locator, an HTTPS or SSH URL, or a URL copied from the browser. A ref is stored and printed as its published
+**identity** (namespace and recipe), never as a folder path. Any spelling that settles to one identity is
+accepted, including a folder path or a pasted browser URL: a recipe stored at `recipes/shared/sat/` and
+published as `workflow/sat` may be written `github://owner/repo/workflow/sat` or
+`https://github.com/owner/repo/tree/main/recipes/shared/sat`, and the release settles the second through the
+other repository's index. The optional range after `@` follows npm's rules. `local://` locators and `repo:`
+short names are refused: a local repository is a consumer's convenience, and a short name is one project's
+private label. See [Dependencies named by location](repositories-file-formats.md#dependencies-named-by-location)
+and every accepted spelling in [Ref forms](repositories-file-formats.md#ref-forms).
 
 ## Cut a release
 

package/docs/markdown/repositories-consuming.md

@@ -87,15 +87,22 @@ $ sous recipe show workflow/qa-variables
 sous subscription add workflow/qa-variables
 sous subscription add workflow/qa-variables@^1.2.0
 sous subscription add workflow          # a whole namespace
+sous subscription add https://github.com/acme/recipes/tree/main/recipes/workflow/alpha
 ```
 
+A ref may be written in any form sous reads ([Ref forms](repositories-file-formats.md#ref-forms)),
+including a URL copied from the browser. A location is matched to the trusted repository at it,
+whatever this project calls that repository; one the project does not trust yet goes through the
+trust question first, and nothing is fetched from it before the answer. The subscription is
+recorded in its canonical form, `namespace/recipe`.
+
 The whole dependency closure resolves before anything is downloaded, and only then is anything
 written; an install is whole or not at all.
 
 | Flag | What it does |
 |------|--------------|
 | `-y, --yes` | Answer yes to both questions this command can ask: the subscribe confirmation, and the trust question for a repository it has to add |
-| `--accept-first` | When a one-word ref matches several things, take the first one listed |
+| `--accept-first` | When a ref matches several things, take the first one listed |
 | `--answer <name>=<value>` | Answer one question ahead of time. Repeat it per answer, or read a whole file of them with `--answers-file <path>` |
 | `--always-pull` | Install a newer in-range version whenever one exists, rather than holding the locked one |
 | `--dry-run` | Print what would be installed, writing and downloading nothing |

package/docs/markdown/repositories-file-formats.md

@@ -104,15 +104,60 @@ release itself is never restricted, so whatever publishes the recipe still relea
 
 ### Dependencies named by location
 
-`depends` and `subscribes` share one grammar in two spellings: `workflow/qa-helper` is a sibling in this
+`depends` and `subscribes` name their targets by where they live: `workflow/qa-helper` is a sibling in this
 same repository, and `github://sous-io/sous-recipes/workflow/sub-agent-delegation@^1.0` is a recipe in
-another one. A locator URL's scheme is the provider's identifier (`github` and `gitlab` ship today), and its
-path is read from the RIGHT: the last two segments are the namespace and the recipe, and everything before
-them names the repository, whose first segment is the host when it carries a dot and otherwise the
-provider's public host, so `gitlab://gitlab.example.com/group/subgroup/project/workflow/task-files`
-resolves. A trailing `.git` is dropped and at most one `@` range may follow. A manifest may write no `repo:`
-qualifier, no `local://` locator (a local repository is a convenience, not a published location) and no
-filesystem path such as `../qa-helper`.
+another one. Every spelling in [Ref forms](#ref-forms) that names a namespace or a recipe is accepted here,
+except a `repo:` qualifier (one project's private name for a repository), a local path or `local://`
+locator (a convenience, not a published location), and a location naming a whole repository with nothing
+inside it. Names are recorded lowercase.
+
+A ref is stored and printed as its published identity (namespace and recipe), never as a folder path. Any
+spelling that settles to one identity is accepted, including a folder path or a pasted browser URL. Two
+spellings need the other repository's index to settle: a GitLab URL with nested groups, which does not say
+where the project path ends (`gitlab.com/a/b/c/d` may be project `a/b` naming the recipe `c/d`, or project
+`a/b/c` naming the namespace `d`), and a browser URL, which names a folder. `sous repo release` settles each
+by fetching the index of every candidate repository and keeping the reading whose index publishes what was
+named, then records the repository it settled on in the index, beside each key the dependency reached. A
+consumer reads that record and never probes. A network failure fails the release rather than guessing, and
+two readings that both publish what is named fail it too, naming the spellings that read one way:
+`gitlab://a/b/c/-/d/*` for the namespace, `gitlab://a/b/-/c/d` for the recipe.
+
+### Ref forms
+
+Every place a ref is written reads it with one parser, told where the ref came from. These forms are
+recognized everywhere; the table after them says which each place allows. A refused form is an error saying
+what to write there instead.
+
+| Form | Example | Names |
+| --- | --- | --- |
+| A bare name | `workflow` | a namespace (on the command line, also a recipe or anything else by that name) |
+| Namespace and recipe | `workflow/alpha` | a recipe |
+| Namespace, spelled out | `workflow/*` | a namespace |
+| Repository-qualified | `sous-recipes:workflow/alpha` | a recipe in the repository this project calls `sous-recipes` |
+| With a range | `workflow/alpha@^1.2` | a recipe, within an npm-style range |
+| Provider-scheme locator | `github://owner/repo/workflow`, `.../workflow/*`, `.../workflow/alpha` | a namespace or a recipe in that repository |
+| A host other than the provider's own | `gitlab://gitlab.example.com/group/proj/-/workflow/alpha` | the same, on a self-hosted instance |
+| HTTPS URL | `https://github.com/owner/repo/workflow/alpha` | the same as the locator |
+| URL with no scheme | `github.com/owner/repo/workflow/alpha` | the same |
+| SSH remote | `git@github.com:owner/repo.git`, `ssh://git@github.com/owner/repo.git/workflow` | the repository, or something inside it |
+| Browser URL | `https://github.com/owner/repo/tree/main/recipes/workflow/alpha` | the recipe whose index `path` holds that folder (or a file in it); a folder holding one namespace's recipes names the namespace |
+| GitLab separator | `https://gitlab.com/group/sub/proj/-/tree/main/recipes/workflow/alpha` | the same, with `/-/` marking where the project path ends |
+| GitLab nested group | `gitlab://group/sub/proj/workflow/alpha` | every reading the path allows, settled as described above |
+
+A `.git` suffix on the repository is dropped in every URL form. GitLab's canonical locator always marks the
+end of the project path with `/-/`, so it reads one way.
+
+| Place | Allows |
+| --- | --- |
+| The command line | every form; names in any case |
+| A config file's subscription keys | `namespace` or `namespace/recipe`, lowercase; the repository is recorded in the lockfile and a range in the entry's `range` field |
+| A recipe manifest's `depends` and `subscribes` | every form naming a namespace or a recipe, except `repo:` and a local location |
+| A key sous stores (the lockfile, the index, the store) | `namespace` or `namespace/recipe`, lowercase |
+
+Matching tries the exact spelling first, then ignores case; a name that still matches several things is a
+question, answered by `--accept-first` or by choosing. What sous writes (config layers, the lockfile, the
+index) and prints is always the canonical form: `namespace/recipe`, qualified with the repository's short
+name where one is needed.
 
 ### Variable definitions
 

package/docs/markdown/repositories-providers.md

@@ -128,12 +128,14 @@ Canonicalizing also produces the two clone URLs sous hands to git, `https://<hos
 and `git@<host>:<owner>/<name>.git`. For the `local` provider the HTTPS slot carries the
 absolute directory, because that is what git is given when a recipe is fetched.
 
-?> A published manifest names a dependency in another repository by a locator URL whose
-scheme is the provider's identifier: `github://sous-io/sous-recipes/workflow/sat@^1.1`. A first
-segment containing a dot is read as the host, so `gitlab://gitlab.example.com/group/project/ns/recipe`
-addresses a self-hosted instance; without one, the provider's public host is assumed. `local://`
-is refused, because a path on your disk is not a published location. The grammar is in
-[Dependencies named by location](repositories-file-formats.md#dependencies-named-by-location).
+?> A published manifest names a dependency in another repository by location, such as a locator
+whose scheme is the provider's identifier: `github://sous-io/sous-recipes/workflow/sat@^1.1`. A
+first segment containing a dot is read as the host, so `gitlab://gitlab.example.com/group/project/-/ns/recipe`
+addresses a self-hosted instance; without one, the provider's public host is assumed. Where a
+repository path ends, and what a browser URL's path looks like, is each provider's own rule (its
+`readLocation`), so a URL copied from either host's file view works too. `local://` is refused,
+because a path on your disk is not a published location. Every form is in
+[Ref forms](repositories-file-formats.md#ref-forms).
 
 ## Private repositories
 

package/docs/markdown/repositories-troubleshooting.md

@@ -108,8 +108,14 @@ providers sous ships named (see [Providers](repositories-providers.md)). The leg
 depends:
   - workflow/sat                                       # a sibling in this repository
   - github://acme/recipes/workflow/sat@^1.1            # a recipe in another repository
+  - https://github.com/acme/recipes/tree/main/sat      # the same, copied from the browser
 ```
 
+Every accepted spelling is in [Ref forms](repositories-file-formats.md#ref-forms). A GitLab URL
+with nested groups, or a browser URL, is settled by `sous repo release` through the other
+repository's index; when that index cannot be read, the release stops and names it, and when two
+readings both publish what was named, it names the `/-/` and `/*` spellings that read one way.
+
 While developing both sides, use
 [`sous repo link`](repositories-authoring.md#edit-a-repository-in-place); it redirects resolution
 at a working copy without changing what you publish.

package/docs/markdown/repositories-variables.md

@@ -241,10 +241,17 @@ sous vars ask SOUS_VAR_TASK_FILE_ROOT           # the same one, by a name in use
 sous vars ask workflow/task-files.taskFileRoot  # the same one, spelled out in full
 sous vars ask task-files                        # every question one recipe asks
 sous vars ask sous-recipes                      # every question that repository's recipes ask
+sous vars ask https://github.com/sous-io/sous-recipes/tree/main/recipes/workflow/task-files
+                                                # the same recipe, as a URL copied from the browser
 ```
 
-Matching is case-sensitive, and an environment variable name resolves when a definition declares it or an
-env file sets it. `--repo`, `--namespace` and `--var` say which kind is meant, each narrowing what the one
+A repository, namespace or recipe may be written in any form in
+[Ref forms](repositories-file-formats.md#ref-forms), including a location: it is matched to the
+trusted repository at it and settled through that repository's cached index, then narrowed to the
+variables it covers. `--repo` and `--namespace` accept a location the same way.
+
+Matching tries the exact spelling first, then ignores case; a name that still matches several things is a
+question. An environment variable name resolves when a definition declares it or an env file sets it. `--repo`, `--namespace` and `--var` say which kind is meant, each narrowing what the one
 before left, so `sous vars ask --namespace workflow apiUrl` asks about that namespace's `apiUrl` alone. When
 a name matches several things, sous lists them and asks; `--accept-first` takes the first, and a run with no
 terminal fails naming it.

package/docs/markdown/repositories.md

@@ -101,9 +101,9 @@ subscribes:
   - quality/code-review
 ```
 
-Both name their targets by location, written as a **locator URL**
-([the grammar](repositories-file-formats.md#dependencies-named-by-location)) when the target lives
-in another repository, never by a short name a consuming project chose; a curated bundle is simply
+Both name their targets by location, written as a **locator URL** or any other URL form
+([the forms](repositories-file-formats.md#ref-forms)) when the target lives in another repository,
+never by a short name a consuming project chose; a curated bundle is simply
 a recipe made mostly of `subscribes` entries. Because both lists are
 declarative YAML rather than code, sous can read the whole dependency closure before fetching any
 of it, which is what makes the trust decision answerable up front.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sous-io/sous",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "description": "Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates",
   "type": "module",
   "license": "Apache-2.0",

package/recipes/core/sous-skills/skills/about-sous-recipes/SKILL.tpl.md

@@ -138,13 +138,17 @@ Both lists name other recipes, and they do different things:
 - `subscribes` is a **co-subscription**. The other recipe's files land and its questions are asked,
   as if the project had subscribed to it too.
 
-Each entry names its target by where it lives, in one of two forms:
-
-- a bare `namespace/recipe` for a sibling in the same repository. With no range it means the
-  version released alongside this one; an `@` range (npm's rules) is allowed but uncommon.
-- a locator URL for a recipe in another repository, such as
-  `github://example-org/team-recipes/review/wording@^1.0`. The scheme is the provider, and the last
-  two segments are always the recipe's namespace and name, never a path on disk.
+Each entry names its target by where it lives:
+
+- a bare `namespace/recipe` (or `namespace` for all of it) for a sibling in the same repository.
+  With no range it means the version released alongside this one; an `@` range (npm's rules) is
+  allowed but uncommon.
+- a location for a recipe in another repository, such as
+  `github://example-org/team-recipes/review/wording@^1.0`, an HTTPS or SSH URL, or a URL copied
+  from the browser. A ref is stored and printed as its published identity (namespace and recipe),
+  never as a folder path. Any spelling that settles to one identity is accepted, including a
+  folder path or a pasted browser URL; `sous repo release` settles one that needs the other
+  repository's index, and fails rather than guess.
 
 `local://` locators and `repo:` short names are refused: both are one project's private view of a
 repository, and a published manifest is read everywhere.

package/recipes/core/sous-skills/sous.recipe.yaml

@@ -11,7 +11,7 @@ formatVersion: 1
 
 namespace: core
 name: sous-skills
-version: 0.2.28
+version: 0.2.29
 
 description: >-
   The skills that teach an agent what sous is and how it works: which files sous

package/src/commands/lock/rebuild.ts

@@ -24,7 +24,7 @@ import { recipeFilesDirectory } from "../../lib/repos/catalog-inputs.js";
 import { readRecipeManifestIn } from "../../lib/repos/locked-recipes.js";
 import { createEmptyLockfile } from "../../lib/repos/formats/lockfile.js";
 import type { LockRepoInput } from "../../lib/repos/lock-service.js";
-import { parseRef } from "../../lib/repos/ref.js";
+import { RefSource, parseShortRef } from "../../lib/refs/index.js";
 import {
   PROJECT_REQUESTER,
   resolveRefs,
@@ -133,7 +133,7 @@ export default class LockRebuild extends BaseCommand {
       .sort()
       .map((key) => {
         const entry = subscriptions[key]!;
-        const parsed = parseRef(key);
+        const parsed = parseShortRef(key, RefSource.Config);
         return {
           ref: {
             ...parsed,

package/src/commands/repo/contribute.ts

@@ -6,7 +6,6 @@ import {
   SousScope,
   findReference,
   pickReference,
-  referenceReposFromIndexes,
   type ReferenceRepo,
 } from "../../lib/refs/index.js";
 import {
@@ -374,15 +373,7 @@ export default class RepoContribute extends BaseCommand {
       shellEnv: this.shellEnv,
     });
 
-    const trusted = service.currentRepos();
-    const repos: ReferenceRepo[] = Object.keys(trusted).map((name) => {
-      const url = trusted[name]?.url;
-      const index = service.cachedIndex(name);
-      if (index === undefined) {
-        return { name, ...(url === undefined ? {} : { url }), namespaces: [], recipes: [] };
-      }
-      return referenceReposFromIndexes([name], new Map([[name, index]]), { [name]: url })[0]!;
-    });
+    const repos: ReferenceRepo[] = service.cachedReferenceRepos();
 
     const matches = findReference(
       ref,

package/src/commands/repo/gc.ts

@@ -17,6 +17,7 @@ import { subscriptionServiceFor } from "../../lib/repos/subscription-service.js"
 import { resolveStoreSettings } from "../../lib/repos/store/settings.js";
 import type { StoreKey } from "../../lib/repos/store/contract.js";
 import { renderTable, type TableColumn } from "../../utils/table.js";
+import { splitRecipeKey } from "../../lib/refs/parse.js";
 import {
   blankLine,
   dryRunNotice,
@@ -120,12 +121,12 @@ export default class RepoGc extends BaseCommand {
     const keep: StoreKey[] = Object.entries(lock.recipes).flatMap(([key, entry]) => {
       const identity = lock.repos[entry.repo]?.identity;
       if (identity === undefined) return [];
-      const namespace = key.slice(0, key.indexOf("/"));
+      const { namespace, name } = splitRecipeKey(key);
       return [
         {
           identity,
           namespace,
-          name: key.slice(namespace.length + 1),
+          name,
           version: entry.version,
         },
       ];

package/src/commands/repo/release.ts

@@ -30,6 +30,7 @@ import {
   releaseScope,
   remoteUrl,
   scopeProblems,
+  settleDependencyLocations,
   uncommittedChanges,
   validateRepo,
   warningsIn,
@@ -38,6 +39,7 @@ import {
   type ReleasePlan,
   type ReleaseScope,
   type RepoValidation,
+  type SettledDependency,
   type ValidationProblem,
 } from "../../lib/repos/release/index.js";
 import {
@@ -195,7 +197,14 @@ export default class RepoRelease extends Command {
     }
     log(`  Read ${describeCount(validation.recipes.length, "recipe")}.`);
 
-    if (flags.check) return await this.runCheck(rootDir, validation);
+    // A dependency that reads more than one way is settled before anything is
+    // planned or written, so a repository that cannot be reached stops the run
+    // with nothing changed.
+    const settling = await settleDependencyLocations(validation);
+    reportProblems(settling.problems);
+    if (hasErrors(settling.problems)) return this.stopForErrors(settling.problems);
+
+    if (flags.check) return await this.runCheck(rootDir, validation, settling.settled);
 
     // --- Plan -------------------------------------------------------------
 
@@ -284,6 +293,7 @@ export default class RepoRelease extends Command {
       existing,
       sousVersion: SOUS_VERSION,
       publishing,
+      settled: settling.settled,
     });
     reportProblems(rebuilt.problems);
     if (hasErrors(rebuilt.problems)) return this.stopForErrors(rebuilt.problems);
@@ -365,15 +375,22 @@ export default class RepoRelease extends Command {
    *
    * @param rootDir - The repository's root directory.
    * @param validation - The validated repository.
+   * @param settled - The dependencies that read more than one way, as settled.
    */
   private async runCheck(
     rootDir: string,
-    validation: RepoValidation
+    validation: RepoValidation,
+    settled: Map<string, SettledDependency>
   ): Promise<void> {
     section("Checking the index");
 
     const existing = readExistingIndex(rootDir);
-    const result = await buildIndex({ validation, existing, sousVersion: SOUS_VERSION });
+    const result = await buildIndex({
+      validation,
+      existing,
+      sousVersion: SOUS_VERSION,
+      settled,
+    });
     reportProblems(result.problems);
     if (hasErrors(result.problems)) return this.stopForErrors(result.problems);
 

package/src/commands/repo/search.ts

@@ -21,6 +21,7 @@ import {
 } from "../../lib/repos/catalog-display.js";
 import { readEffectiveLinks } from "../../lib/repos/links.js";
 import { renderTable, type TableColumn } from "../../utils/table.js";
+import { namespaceOfKey } from "../../lib/refs/parse.js";
 import { browsingFlags } from "../../utils/flags.js";
 import {
   blankLine,
@@ -142,7 +143,7 @@ export default class RepoSearch extends BaseCommand {
         const installed = locked?.repo === repo ? locked.version : undefined;
         if (flags.installed && installed === undefined) continue;
 
-        const namespace = key.slice(0, key.indexOf("/"));
+        const namespace = namespaceOfKey(key);
         const haystack = [
           key,
           recipe.description ?? "",

package/src/commands/vars/ask.ts

@@ -48,7 +48,9 @@ import {
   referenceContextFromVariables,
   variableReferenceKey,
   type ReferenceMatch,
+  type ReferenceRepo,
 } from "../../lib/refs/index.js";
+import { subscriptionServiceFor } from "../../lib/repos/subscription-service.js";
 import {
   applyProvidedAnswers,
   askForMissing,
@@ -212,7 +214,10 @@ export default class VarsAsk extends BaseCommand {
 
     // What the reference and the flags name, as the fully qualified reference of
     // every variable to ask. Undefined means everything the usual rules pick.
-    const only = await this.resolveSelection(defined, context, selection);
+    // A reference written as a location settles against the trusted
+    // repositories, read from the cached indexes; a definitions file has none.
+    const trusted = flags.file === undefined ? this.trustedRepos() : [];
+    const only = await this.resolveSelection(defined, context, selection, trusted);
 
     const askOptions = {
       sousDir: this.configContext.sousDir,
@@ -257,13 +262,17 @@ export default class VarsAsk extends BaseCommand {
    * @param defined - Every variable definition in play.
    * @param ladder - The environment layers, for resolving environment variable names.
    * @param selection - The reference and the flags, as the caller wrote them.
+   * @param trusted - The trusted repositories, which settle a reference written as a location.
    * @returns The variables to ask, or undefined when nothing narrowed anything.
    */
   private async resolveSelection(
     defined: DefinedVariable[],
     ladder: LadderContext,
-    selection: Selection
+    selection: Selection,
+    trusted: ReferenceRepo[] = []
   ): Promise<string[] | undefined> {
+    const contextOf = (pool: DefinedVariable[]) =>
+      referenceContextFromVariables(pool, ladder, trusted);
     const { name, repo, namespace, vars } = selection;
     if (name === undefined && repo === undefined && namespace === undefined && vars === undefined) {
       return undefined;
@@ -272,13 +281,13 @@ export default class VarsAsk extends BaseCommand {
     let pool = defined;
 
     if (repo !== undefined) {
-      const match = await this.pick(findRepository(repo, contextOf(pool, ladder)), repo, selection);
+      const match = await this.pick(findRepository(repo, contextOf(pool)), repo, selection);
       pool = pool.filter((entry) => entry.recipe.repo === match.repo);
     }
 
     if (namespace !== undefined) {
       const match = await this.pick(
-        findNamespace(namespace, contextOf(pool, ladder)),
+        findNamespace(namespace, contextOf(pool)),
         namespace,
         selection
       );
@@ -287,7 +296,7 @@ export default class VarsAsk extends BaseCommand {
 
     if (name !== undefined) {
       const match = await this.pick(
-        findReference(name, ALL_SCOPES, contextOf(pool, ladder)),
+        findReference(name, ALL_SCOPES, contextOf(pool)),
         name,
         selection
       );
@@ -298,7 +307,7 @@ export default class VarsAsk extends BaseCommand {
       const chosen: DefinedVariable[] = [];
       for (const wanted of vars) {
         const match = await this.pick(
-          findVariable(wanted, contextOf(pool, ladder)),
+          findVariable(wanted, contextOf(pool)),
           wanted,
           selection
         );
@@ -317,6 +326,23 @@ export default class VarsAsk extends BaseCommand {
     return [...new Set(pool.map(variableReferenceKey))];
   }
 
+  /**
+   * The trusted repositories as a reference searches them, from the cached
+   * indexes alone. A project whose repositories cannot be read this way still
+   * answers every other form of reference, so a failure here is an empty list.
+   */
+  private trustedRepos(): ReferenceRepo[] {
+    try {
+      return subscriptionServiceFor({
+        configContext: this.configContext,
+        settings: this.settings,
+        shellEnv: this.shellEnv,
+      }).cachedReferenceRepos();
+    } catch {
+      return [];
+    }
+  }
+
   /**
    * Settles which of the things a reference could have meant this run proceeds
    * with, through the rule every command shares.
@@ -356,10 +382,6 @@ function narrowTo(pool: DefinedVariable[], match: ReferenceMatch): DefinedVariab
   });
 }
 
-/** The reference context for the variables still in the running. */
-function contextOf(pool: DefinedVariable[], ladder: LadderContext) {
-  return referenceContextFromVariables(pool, ladder);
-}
 
 /** What this run is asking about, in the words the header shows. */
 function describeSelection(selection: Selection, all: boolean): string {