Merge pull request #958 from quarto-dev/feature/bd-7328beha-url-space-config-paths

Resolve the reveal.js logo and listing leading-/ images in URL space (bd-7328beha, bd-epk8cmdl)

Author: cscheid

claude-notes/designs/path-resolution-model.md

@@ -206,15 +206,16 @@ Update this table when adding keys or migrating sites.
 | `project/book/render_item.rs` (`find_inputs`) | `book.chapters` / `appendices` / `references` | (5) with `project_dir` as both bases (`_quarto.yml`-only keys); leading `/` = project root; stored project-relative (bd-lwvumpfk) |
 | `stage/stages/include_resolve.rs` (`read_include_file`) | `include-*` | (3) marking + (5) at the read (bd-lwvumpfk; was a bare `doc_dir.join` on the marked value) |
 | `transforms/format_css.rs`, `transforms/components_resolve.rs` + `components/config.rs` (`ComponentSource::File(ConfigPath)`) | `css`, `components[].src` | (3) marking + (5) at the consumer (bd-lwvumpfk) |
+| `revealjs/footer_logo.rs` (`resolve_logo`) | revealjs `logo` | (5) for the file, then the URL-space exit: `page_url_for` for the `src`, `ResourceCopyIntent` for the copy (bd-7328beha; tests `tests/integration/config_path_consumers.rs`) |
 
 ### VIOLATIONS (each tracked by a strand — do not fix one without checking its siblings)
 
 | Site | Keys | Defect | Strand |
 |---|---|---|---|
 | ~~`filter_resolve.rs:255-273`~~ | `filters` | ~~same~~ **FIXED 2026-10-28** (bd-nqq41zgx): mechanism 5 | ~~bd-rdcvjy2s~~ (filters half) |
 | `project_resources.rs:705-722,827-836` | engine/filter-declared resources | doc-dir join — runtime output, not YAML; out of this class unless a key is added | bd-hjv5o scope |
-| `revealjs/footer_logo.rs:168-176` | revealjs `logo` | raw string emitted, no `page_url_for`, no copy (URL space) | bd-7328beha |
-| `project/listing/item.rs:285-291,431-465`, `project/listing/helpers.rs:70-73,96-102`, `transforms/listing_generate.rs:503-507` | front-matter `image`, `listing-item.image` | hand-written external-prefix list; `/` treated as external (URL space) | bd-epk8cmdl |
+| ~~`revealjs/footer_logo.rs`~~ | revealjs `logo` | ~~raw string emitted, no `page_url_for`, no copy (URL space)~~ **FIXED 2026-10-28**: `resolve_logo` = (5) for the file, then `page_url_for` + a `ResourceCopyIntent` (skipped in VFS-root mode) | ~~bd-7328beha~~ |
+| ~~`project/listing/item.rs`, `project/listing/helpers.rs`, `transforms/listing_generate.rs`, `listing/post_render_upgrade/substitute.rs`~~ | front-matter `image`, `listing-item.image`, sibling preview `src` | ~~hand-written external-prefix list; `/` treated as external (URL space)~~ **FIXED 2026-10-28**: one classifier (`is_remote_src` = `quarto_util::is_external_url`); a leading `/` rebases to the bare project-relative path at hydration, so relativization, the copy intent and the feed all see one spelling; `resolve_preview_url` anchors `/x` at the output root | ~~bd-epk8cmdl~~ |
 | ~~`pampa/src/citeproc_filter.rs:133,151`~~ | `csl`, `bibliography` | ~~**process-CWD** read (no base at all)~~ **FIXED 2026-09-24** (book-projects P2): declaration-site base dir threaded into `apply_citeproc_filter` from both call paths (`UserFiltersStage` = document dir; book single-file merge = first file-chapter's dir); both keys added to `FORMAT_PATH_KEYS` (`ExistenceSilent` — URLs stay scalar) | ~~bd-oqoozmtr~~ (closed) |
 
 Related open strands: bd-nqq41zgx (the convergence plan,

crates/quarto-core/src/project/listing/config.rs

@@ -1126,9 +1126,9 @@ pub fn flatten_content_globs(meta: &ConfigValue) -> Vec<ListingContents> {
 fn record_path_as_glob(value: &ConfigValue) -> Option<ListingContents> {
     let path_value = value.get("path")?;
     let raw = path_value.as_plain_text()?;
-    // `is_remote_src`, not `is_external_src`: a leading `/` is the
-    // project root and *is* a dependency (plan §D4). The resolver
-    // re-anchors it, exactly as it does for a `/`-anchored glob.
+    // A leading `/` is the project root and *is* a dependency (plan
+    // §D4). The resolver re-anchors it, exactly as it does for a
+    // `/`-anchored glob.
     if super::helpers::is_remote_src(&raw)
         || crate::glob::has_metacharacters(&raw)
         || !is_markdown_document_path(&raw)

crates/quarto-core/src/project/listing/helpers.rs

@@ -65,20 +65,24 @@ pub fn image_html(item: &ListingItem, listing: &Listing, host_dir: &str) -> Stri
 /// Convert a project-relative URL to a host-page-relative one.
 /// `host_dir` is the host page's project-relative directory
 /// (empty at the project root). Walks up out of the host dir with
-/// `..` segments when the target is not beneath it. Remote URLs,
-/// `data:` URIs, and root-absolute paths pass through unchanged.
+/// `..` segments when the target is not beneath it. Remote URLs and
+/// `data:` URIs pass through unchanged. A leading `/` is
+/// site-root-relative — the same project-relative path (decision 4
+/// of bd-root-relative-paths-design-fc5pvkcv; bd-epk8cmdl) — so it
+/// relativizes like the bare form.
 pub(crate) fn host_relative_url(project_relative: &str, host_dir: &str) -> String {
-    if is_external_src(project_relative) {
+    if quarto_util::is_external_url(project_relative) {
         return project_relative.to_string();
     }
-    if host_dir.is_empty() {
-        return project_relative.to_string();
-    }
-    let host_segs: Vec<&str> = host_dir.split('/').filter(|s| !s.is_empty()).collect();
+    // Dropping empty segments also strips the site-root `/`.
     let target_segs: Vec<&str> = project_relative
         .split('/')
         .filter(|s| !s.is_empty())
         .collect();
+    if host_dir.is_empty() {
+        return target_segs.join("/");
+    }
+    let host_segs: Vec<&str> = host_dir.split('/').filter(|s| !s.is_empty()).collect();
     let common = host_segs
         .iter()
         .zip(target_segs.iter())
@@ -89,31 +93,19 @@ pub(crate) fn host_relative_url(project_relative: &str, host_dir: &str) -> Strin
     out.join("/")
 }
 
-/// True for src values that name no file in the project tree:
-/// remote URLs, `data:` URIs, and root-absolute paths. Shared by
-/// the hydration rebase, host-relativization, and the copy-intent
-/// registration so they agree on what "local" means (bd-qv2lsab0).
-pub(crate) fn is_external_src(src: &str) -> bool {
-    let lower = src.to_ascii_lowercase();
-    lower.starts_with("http://")
-        || lower.starts_with("https://")
-        || lower.starts_with("data:")
-        || src.starts_with('/')
-}
-
-/// True for src values that name somewhere outside this machine:
-/// remote URLs, protocol-relative URLs, and `data:` URIs.
+/// True for src values that name somewhere outside the project tree:
+/// remote URLs, protocol-relative URLs, and `data:` URIs — the
+/// workspace's one classifier, [`quarto_util::is_external_url`].
 ///
-/// Narrower than [`is_external_src`] on purpose: a leading `/` is
-/// *external* for an image `src` but *project-root-relative* for a
-/// config-authored path like a listing record's `path:`
-/// (`claude-notes/designs/path-resolution-model.md`).
+/// A leading `/` is **not** external: in URL space it means the site
+/// root, i.e. the same project-relative path as the bare form, for an
+/// image `src` exactly as for a record's `path:` (decision 4 of
+/// bd-root-relative-paths-design-fc5pvkcv; bd-epk8cmdl). The hydration
+/// rebase, host-relativization, and the copy-intent registration all
+/// share this predicate so they agree on what "local" means
+/// (bd-qv2lsab0).
 pub(crate) fn is_remote_src(src: &str) -> bool {
-    let lower = src.to_ascii_lowercase();
-    lower.starts_with("http://")
-        || lower.starts_with("https://")
-        || lower.starts_with("data:")
-        || src.starts_with("//")
+    quarto_util::is_external_url(src)
 }
 
 /// Build the per-item `data-*` attributes the client-side list reads
@@ -641,7 +633,13 @@ mod tests {
             host_relative_url("https://example.com/x.png", "posts"),
             "https://example.com/x.png"
         );
-        assert_eq!(host_relative_url("/abs.png", "posts"), "/abs.png");
+        // A leading `/` is the site root: relativized like the bare form.
+        assert_eq!(host_relative_url("/abs.png", "posts"), "../abs.png");
+        assert_eq!(host_relative_url("/abs.png", ""), "abs.png");
+        assert_eq!(
+            host_relative_url("data:image/png;base64,AAAA", "posts"),
+            "data:image/png;base64,AAAA"
+        );
     }
 
     /// A listing with the type defaults applied — the field types

crates/quarto-core/src/project/listing/item.rs

@@ -426,8 +426,8 @@ fn prose_value<'a>(li: &'a ListingItemInfo, key: &str) -> Option<&'a Inlines> {
 
 /// Rebase a document-relative image path onto the document's
 /// project-relative directory, normalizing `.`/`..` segments.
-/// Absolute URLs, `data:` URIs, and root-absolute paths pass
-/// through unchanged.
+/// Absolute URLs and `data:` URIs pass through unchanged; a leading
+/// `/` anchors at the project root (see [`rebase_image_from_dir`]).
 fn rebase_image(src: &str, source_path: &Path) -> String {
     let dir = source_path
         .parent()
@@ -446,11 +446,21 @@ fn rebase_image(src: &str, source_path: &Path) -> String {
 
 /// Rebase a relative image path onto a project-relative directory
 /// (`""` for the project root), normalizing `.`/`..` segments.
-/// Absolute URLs, `data:` URIs, and root-absolute paths pass through.
+/// Absolute URLs and `data:` URIs pass through. A leading `/` is
+/// site-root-relative (decision 4 of
+/// bd-root-relative-paths-design-fc5pvkcv; bd-epk8cmdl): it ignores
+/// `dir` and yields the bare project-relative path, so every later
+/// consumer (host-relativization, the copy intent, the RSS builder)
+/// sees one spelling. Anchoring at the root also keeps `..` from
+/// climbing above the project.
 pub(crate) fn rebase_image_from_dir(src: &str, dir: &str) -> String {
-    if super::helpers::is_external_src(src) {
+    if super::helpers::is_remote_src(src) {
         return src.to_string();
     }
+    let (dir, src) = match src.strip_prefix('/') {
+        Some(rooted) => ("", rooted),
+        None => (dir, src),
+    };
     let mut segments: Vec<&str> = dir.split('/').filter(|s| !s.is_empty()).collect();
     for seg in src.split('/') {
         match seg {
@@ -600,12 +610,12 @@ mod tests {
     }
 
     #[test]
-    fn hydration_image_passes_through_absolute_forms() {
+    fn hydration_image_passes_through_external_forms() {
         for src in [
             "https://example.com/x.png",
             "http://example.com/x.png",
+            "//cdn.example.com/x.png",
             "data:image/png;base64,AAAA",
-            "/site-absolute.png",
         ] {
             let li = ListingItemInfo {
                 image: Some(src.to_string()),
@@ -616,6 +626,19 @@ mod tests {
         }
     }
 
+    // bd-epk8cmdl: a leading `/` is the site root, not an external
+    // location — the item image becomes the bare project-relative
+    // path, ignoring the document's directory.
+    #[test]
+    fn hydration_image_anchors_leading_slash_at_the_project_root() {
+        let li = ListingItemInfo {
+            image: Some("/site-absolute.png".to_string()),
+            ..ListingItemInfo::default()
+        };
+        let item = hydrate_item(&profile_with(li));
+        assert_eq!(item.image.as_deref(), Some("site-absolute.png"));
+    }
+
     // 18. item_extra_present_in_binding (via hydrate_item — the
     // bridge to TemplateValue happens later in the render transform)
     #[test]
@@ -729,7 +752,12 @@ mod tests {
             rebase_image_from_dir("../shared/x.png", "a/b"),
             "a/shared/x.png"
         );
-        assert_eq!(rebase_image_from_dir("/site.png", "posts"), "/site.png");
+        assert_eq!(rebase_image_from_dir("/site.png", "posts"), "site.png");
+        assert_eq!(
+            rebase_image_from_dir("/../../etc/x.png", "posts"),
+            "etc/x.png",
+            "root-anchored `..` cannot climb above the project"
+        );
     }
 
     // ─── bd-listing-description-precedence-x4bh6w3m ─────────────────

crates/quarto-core/src/project/listing/post_render_upgrade/substitute.rs

@@ -253,7 +253,8 @@ fn substitute_images(
 
         let replacement = if let Some(pi) = preview {
             // Engine-rendered preview image found.
-            let resolved = resolve_preview_url(host_path, &sibling_abs, &pi.src);
+            let resolved =
+                resolve_preview_url(host_path, &sibling_abs, &project.output_dir, &pi.src);
             build_thumbnail_img(&resolved, &pi, attrs)
         } else if inner.contains("<img") {
             // The envelope wraps the image L1 derived from the body
@@ -323,25 +324,33 @@ fn escape_attr(s: &str) -> String {
 /// - `host_path`: absolute path of the host page (rendered file
 ///   currently being substituted).
 /// - `sibling_abs`: absolute path of the sibling output file.
+/// - `site_root`: absolute path of the output tree's root, the
+///   anchor for a site-root-relative src.
 /// - `preview_src`: the `src` attribute of the preview `<img>` in
-///   the sibling. May be relative (to sibling's dir), absolute
-///   path-style (`/leading-slash`), absolute URL (`http://...`),
+///   the sibling. May be relative (to sibling's dir), site-root
+///   relative (`/leading-slash`), absolute URL (`http://...`),
 ///   or a `data:` URI.
 ///
 /// Returns the URL to embed in the host page's `<img src=...>`.
-fn resolve_preview_url(host_path: &Path, sibling_abs: &Path, preview_src: &str) -> String {
+/// A leading `/` is site-root-relative (decision 4 of
+/// bd-root-relative-paths-design-fc5pvkcv; bd-epk8cmdl): the target
+/// is `site_root/<rest>` and it relativizes to the host page like a
+/// sibling-relative src, so it survives a deploy subpath.
+fn resolve_preview_url(
+    host_path: &Path,
+    sibling_abs: &Path,
+    site_root: &Path,
+    preview_src: &str,
+) -> String {
     if quarto_util::is_external_url(preview_src) {
         return preview_src.to_string();
     }
     let host_dir = host_path.parent().unwrap_or(Path::new(""));
     let sibling_dir = sibling_abs.parent().unwrap_or(Path::new(""));
-    // For relative `preview_src`, the absolute target is
-    // `sibling_dir/preview_src`. For `/leading-slash`, treat as
-    // already-absolute path (rare in Q2 output; pass through).
-    if preview_src.starts_with('/') {
-        return preview_src.to_string();
-    }
-    let preview_abs = sibling_dir.join(preview_src);
+    let preview_abs = match preview_src.strip_prefix('/') {
+        Some(rooted) => site_root.join(rooted),
+        None => sibling_dir.join(preview_src),
+    };
     pathdiff::diff_paths(&preview_abs, host_dir).map_or_else(
         || preview_src.to_string(),
         |p| {
@@ -445,16 +454,58 @@ mod tests {
     fn resolve_preview_url_passes_any_scheme_through() {
         let host = Path::new("/site/index.html");
         let sibling = Path::new("/site/posts/foo.html");
+        let root = Path::new("/site");
         for src in [
             "positron://settings/x",
             "vscode://schemas/settings",
             "data:image/png;base64,AAAA",
             "https://example.com/x.png",
+            "//cdn.example.com/x.png",
         ] {
-            assert_eq!(resolve_preview_url(host, sibling, src), src);
+            assert_eq!(resolve_preview_url(host, sibling, root, src), src);
         }
     }
 
+    #[test]
+    fn resolve_preview_url_relativizes_sibling_relative_src() {
+        let root = Path::new("/site");
+        let sibling = Path::new("/site/posts/foo.html");
+        assert_eq!(
+            resolve_preview_url(Path::new("/site/index.html"), sibling, root, "cover.png"),
+            "posts/cover.png"
+        );
+        assert_eq!(
+            resolve_preview_url(
+                Path::new("/site/posts/index.html"),
+                sibling,
+                root,
+                "cover.png"
+            ),
+            "cover.png"
+        );
+    }
+
+    // bd-epk8cmdl: a leading `/` is the site root, relativized per
+    // host page instead of passed through as a host-absolute link.
+    #[test]
+    fn resolve_preview_url_anchors_leading_slash_at_the_site_root() {
+        let root = Path::new("/site");
+        let sibling = Path::new("/site/posts/foo.html");
+        assert_eq!(
+            resolve_preview_url(Path::new("/site/index.html"), sibling, root, "/img/c.png"),
+            "img/c.png"
+        );
+        assert_eq!(
+            resolve_preview_url(
+                Path::new("/site/posts/index.html"),
+                sibling,
+                root,
+                "/img/c.png"
+            ),
+            "../img/c.png"
+        );
+    }
+
     /// Build a minimal ProjectContext rooted in a tempdir.
     fn make_project(output_dir: &Path) -> ProjectContext {
         ProjectContext {