fix: anchor context dir walk to git root to prevent cross-project resolution

When a non-ctx-initialized repo lives inside a ctx-initialized parent
workspace, walkForContextDir walked upward and found the parent's
.context, then the boundary check rejected it. Now the walk validates
candidates against the git root: if a .context is found outside the
git root, it belongs to a different project and is discarded. Git is
a hint, not a requirement — when no .git exists, the walk falls back
to CWD.

Changes:
- Add findGitRoot helper to walk.go
- Update walkForContextDir to validate candidates against git root
- Add DotDir constant to config/git, consolidate Diff into subcommands block
- Add walk_test.go with 9 edge-case tests (nested repos, worktrees, no git)
- Update existing UpwardWalkFromSubdir test to include .git directory

Spec: specs/walk-boundary-git-anchor.md
Signed-off-by: Jose Alekhinne <jose@ctx.ist>

Author: josealekhine

internal/config/git/git.go

@@ -9,36 +9,35 @@ package git
 // Binary is the git executable name.
 const Binary = "git"
 
-// Git subcommands.
+// DotDir is the name of the git metadata directory (or file in worktrees).
+const DotDir = ".git"
+
+// Subcommand names passed as the first argument to git.
 const (
 	Branch   = "branch"
+	Diff     = "diff"
 	DiffTree = "diff-tree"
 	Log      = "log"
 	Remote   = "remote"
 	RevParse = "rev-parse"
 )
 
-// Git hook names.
+// Hook names used in .git/hooks/.
 const (
 	HookPrepareCommitMsg = "prepare-commit-msg"
 	HookPostCommit       = "post-commit"
 	HooksDir             = "hooks"
 )
 
-// Git subcommands (additional).
-const (
-	Diff = "diff"
-)
-
-// Git rev-parse flags.
+// Rev-parse flags.
 const (
 	FlagShort        = "--short"
 	FlagShowCurrent  = "--show-current"
 	FlagShowToplevel = "--show-toplevel"
 	FlagGitDir       = "--git-dir"
 )
 
-// Git flags.
+// Common flags and format strings for git commands.
 const (
 	FlagCached         = "--cached"
 	FlagChangeDir      = "-C"
@@ -63,13 +62,13 @@ const (
 	FlagLastN = "-%d"
 )
 
-// Git ref constants.
+// Ref constants for addressing commits and branches.
 const (
 	// RefHead is the symbolic reference for the current commit.
 	RefHead = "HEAD"
 )
 
-// Git remote subcommands and arguments.
+// Remote subcommands and arguments.
 const (
 	RemoteGetURL = "get-url"
 	RemoteOrigin = "origin"
@@ -78,7 +77,7 @@ const (
 // PathSeparator is the separator git uses in file paths (always forward slash).
 const PathSeparator = "/"
 
-// Git commit trailers.
+// Commit trailer keys for structured metadata in commit messages.
 const (
 	// TrailerSpec is the commit trailer for spec references.
 	TrailerSpec = "Spec: specs/"

internal/rc/rc_test.go

@@ -881,17 +881,18 @@ func TestContextDir_UpwardWalkFromSubdir(t *testing.T) {
 	tempDir := t.TempDir()
 
 	// Project root layout:
+	//   <tempDir>/project/.git/
 	//   <tempDir>/project/.context/
 	//   <tempDir>/project/deep/nested/
 	projectRoot := filepath.Join(tempDir, "project")
+	gitPath := filepath.Join(projectRoot, ".git")
 	contextPath := filepath.Join(projectRoot, dir.Context)
 	deepSubdir := filepath.Join(projectRoot, "deep", "nested")
 
-	if mkErr := os.MkdirAll(contextPath, 0700); mkErr != nil {
-		t.Fatalf("mkdir context: %v", mkErr)
-	}
-	if mkErr := os.MkdirAll(deepSubdir, 0700); mkErr != nil {
-		t.Fatalf("mkdir deep: %v", mkErr)
+	for _, d := range []string{gitPath, contextPath, deepSubdir} {
+		if mkErr := os.MkdirAll(d, 0700); mkErr != nil {
+			t.Fatalf("mkdir %s: %v", d, mkErr)
+		}
 	}
 
 	origDir, _ := os.Getwd()

internal/rc/walk.go

@@ -9,15 +9,24 @@ package rc
 import (
 	"os"
 	"path/filepath"
+	"strings"
+
+	cfgGit "github.com/ActiveMemory/ctx/internal/config/git"
 )
 
 // walkForContextDir walks upward from the current working directory
 // looking for an existing directory whose basename matches name.
 //
+// When a candidate is found above CWD, it is validated against the
+// git root (if any). If the candidate falls outside the git root,
+// it belongs to a different project and is discarded — the git root
+// is used as the anchor instead.
+//
 // Absolute configured names skip the walk entirely. When no matching
-// directory is found upward, returns filepath.Join(cwd, name) as an
-// absolute path so that ctx init can create a fresh context directory at
-// the current location.
+// directory is found upward, returns the context directory anchored
+// to the git root (if found) or filepath.Join(cwd, name) as an
+// absolute path so that ctx init can create a fresh context directory
+// at the current location.
 //
 // Parameters:
 //   - name: Configured context directory name (may be relative or absolute)
@@ -34,11 +43,14 @@ func walkForContextDir(name string) string {
 		return name
 	}
 
+	// Walk upward looking for an existing context directory.
+	var candidate string
 	cur := cwd
 	for {
-		candidate := filepath.Join(cur, name)
-		if info, statErr := os.Stat(candidate); statErr == nil && info.IsDir() {
-			return candidate
+		path := filepath.Join(cur, name)
+		if info, statErr := os.Stat(path); statErr == nil && info.IsDir() {
+			candidate = path
+			break
 		}
 		parent := filepath.Dir(cur)
 		if parent == cur {
@@ -47,5 +59,60 @@ func walkForContextDir(name string) string {
 		cur = parent
 	}
 
-	return filepath.Join(cwd, name)
+	gitRoot := findGitRoot(cwd)
+
+	// No candidate found — anchor to git root or CWD.
+	if candidate == "" {
+		if gitRoot != "" {
+			return filepath.Join(gitRoot, name)
+		}
+		return filepath.Join(cwd, name)
+	}
+
+	// Candidate found in CWD itself — always valid.
+	candidateParent := filepath.Dir(candidate)
+	if candidateParent == cwd {
+		return candidate
+	}
+
+	// Candidate found above CWD — validate against git root.
+	if gitRoot == "" {
+		// No git root to confirm ownership; don't trust the ancestor.
+		return filepath.Join(cwd, name)
+	}
+
+	// Check whether the candidate is within the git root.
+	// Append separator to avoid "/foo/bar" matching "/foo/b".
+	root := gitRoot + string(os.PathSeparator)
+	if candidateParent == gitRoot || strings.HasPrefix(candidateParent, root) {
+		return candidate
+	}
+
+	// Candidate is outside the git root — belongs to a different project.
+	// Anchor to the git root instead.
+	return filepath.Join(gitRoot, name)
+}
+
+// findGitRoot walks upward from start looking for a .git entry
+// (directory or file, to support worktrees). Returns the parent
+// directory of the .git entry, or "" if none is found.
+//
+// Parameters:
+//   - start: Directory to start searching from
+//
+// Returns:
+//   - string: Absolute path to the git root, or "" if not found
+func findGitRoot(start string) string {
+	cur := start
+	for {
+		gitPath := filepath.Join(cur, cfgGit.DotDir)
+		if _, statErr := os.Stat(gitPath); statErr == nil {
+			return cur
+		}
+		parent := filepath.Dir(cur)
+		if parent == cur {
+			return ""
+		}
+		cur = parent
+	}
 }