@feigi/fleet-ctl 3.17.5 → 3.17.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.17.5",
+  "version": "3.17.7",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/review-core.mjs

@@ -755,7 +755,7 @@ export async function runReview(host, args) {
     mkdir -p "${runRootParent}" || { echo SNAPSHOT_RUNROOT_FAILED; exit 1; }
     RUN=$(mktemp -d "${runRootPrefix}XXXXXXXX") || { echo SNAPSHOT_RUNROOT_FAILED; exit 1; }
     echo SNAPSHOT_RUN_ROOT="$RUN"
-    find "${runRootParent}" -maxdepth 1 -type d -name 'run-*' -mtime +7 -exec sh -c 'rc=0; for d; do chmod -R u+rwx "$d" 2>/dev/null; if command -v chflags >/dev/null 2>&1; then chflags -R nouchg "$d" 2>/dev/null; chmod -R u+rwx "$d" 2>/dev/null; fi; rm -rf "$d" || rc=1; done; exit $rc' sh {} + || echo SNAPSHOT_PRUNE_FAILED
+    find "${runRootParent}" -maxdepth 1 -type d -name 'run-*' -mtime +7 -exec sh -c 'rc=0; ph="{""}"; for d; do chmod -R u+rwx "$d" 2>/dev/null; m=$?; if command -v chflags >/dev/null 2>&1; then [ $m -eq 0 ] || { chflags nouchg,nouappnd "$d"; chmod u+rwx "$d"; find "$d" -type d -exec chflags nouchg,nouappnd "$ph" ";" -exec chmod u+rwx "$ph" ";"; }; chflags -R nouchg,nouappnd "$d" 2>/dev/null; fi; rm -rf "$d" || rc=1; done; exit $rc' sh {} + || echo SNAPSHOT_PRUNE_FAILED
     SHA=$(git -C ${worktree} rev-parse --short HEAD) || { echo SNAPSHOT_REVPARSE_FAILED; exit 1; }
     SNAP="$RUN/snapshot-$SHA"
     echo SNAPSHOT_DEST="$SNAP"

package/scripts/snapshot-repo.test.mjs

@@ -164,31 +164,48 @@ const renderPrune = (path, runRootParent) =>
 
 /**
  * A `run-` root under `parent` holding a `locked` directory with no permission
- * bits at all, aged `days`. On darwin, optionally, the file inside it carries
- * `uchg` (`immutableFile`), or `locked` itself does (`immutableDir`) — set
- * after the mode, so the directory's mode cannot be changed back until the
- * flag is gone. Aged last: creating children sets the root's mtime to now.
+ * bits at all, aged `days`. `nested` puts a second such directory, `deeper`,
+ * inside `locked`, and the file moves into it. On darwin, optionally, the file
+ * carries `fileFlag` (`uchg` or `uappnd`), and every locked directory carries
+ * `dirFlag` — set after the mode, so a directory's mode cannot be changed back
+ * until the flag is gone. `rootFlag` locks the run root itself the same way,
+ * with no permission bits and that flag. `fileMode` is the file's own mode:
+ * one that already grants owner rwx leaves `chmod -R u+rwx` nothing to change
+ * on the file, so that pass exits 0 over a flagged file. Aged before the root
+ * is locked: creating children sets the root's mtime to now, and a flagged
+ * root refuses `utimes`.
  */
-function lockedRunRoot(parent, name, days, { immutableFile = false, immutableDir = false } = {}) {
+function lockedRunRoot(parent, name, days, { fileFlag = null, fileMode = 0o644, dirFlag = null, rootFlag = null, nested = false } = {}) {
   const root = join(parent, name);
   const locked = join(root, "locked");
-  mkdirSync(locked, { recursive: true });
-  writeFileSync(join(locked, "inner.txt"), "");
-  if (immutableFile) execFileSync("chflags", ["uchg", join(locked, "inner.txt")]);
-  chmodSync(locked, 0);
-  if (immutableDir) execFileSync("chflags", ["uchg", locked]);
+  const dirs = nested ? [join(locked, "deeper"), locked] : [locked];
+  mkdirSync(dirs[0], { recursive: true });
+  const file = join(dirs[0], "inner.txt");
+  writeFileSync(file, "");
+  chmodSync(file, fileMode);
+  if (fileFlag) execFileSync("chflags", [fileFlag, file]);
+  // Deepest first: once a directory is 000, nothing below it can be reached.
+  for (const dir of dirs) {
+    chmodSync(dir, 0);
+    if (dirFlag) execFileSync("chflags", [dirFlag, dir]);
+  }
   const when = (Date.now() - days * DAY) / 1000;
   utimesSync(root, when, when);
+  if (rootFlag) {
+    chmodSync(root, 0);
+    execFileSync("chflags", [rootFlag, root]);
+  }
   return root;
 }
 
 /**
  * Undoes `lockedRunRoot` so the scratch teardown can remove what a prune left.
- * The second `chmod` is for `immutableDir`: its mode is only changeable once
- * `chflags` has cleared the flag.
+ * A flagged directory's mode is only changeable once its flag is gone, and a
+ * directory below it only reachable once that mode is back, so each directory
+ * is unlocked before `find` descends into it.
  */
 function unlock(parent) {
-  spawnSync("sh", ["-c", 'chmod -R u+rwx "$1"; if command -v chflags >/dev/null; then chflags -R nouchg "$1"; chmod -R u+rwx "$1"; fi; :', "sh", parent], { env: ENV });
+  spawnSync("sh", ["-c", 'chmod -R u+rwx "$1"; if command -v chflags >/dev/null; then find "$1" -type d -exec chflags nouchg,nouappnd {} ";" -exec chmod u+rwx {} ";"; chflags -R nouchg,nouappnd "$1"; fi; :', "sh", parent], { env: ENV });
 }
 
 /**
@@ -596,8 +613,8 @@ for (const [name, path] of SOURCES) {
   // #2322. A fixture that drops its own read bit, or a darwin file carrying the
   // user-immutable flag, made the plain `rm -rf` fail on that root — so it
   // stayed forever and every later review of the PR printed
-  // SNAPSHOT_PRUNE_FAILED. The prune now restores owner rwx and clears `uchg`
-  // on the roots it SELECTED, then removes them.
+  // SNAPSHOT_PRUNE_FAILED. The prune now restores owner rwx and clears darwin's
+  // user flags on the roots it SELECTED, then removes them.
   test(`${name}: the prune removes an aged run root a chmod 000 directory used to wedge`, (t) => {
     const parent = join(scratch(t, "snapshot-repo-prune-perm-"), "pr7");
     const stale = lockedRunRoot(parent, "run-staleaa", 9);
@@ -640,31 +657,75 @@ for (const [name, path] of SOURCES) {
     }
   });
 
-  test(`${name}: on darwin the prune removes an aged run root holding a uchg file inside a chmod 000 directory`, { skip: process.platform !== "darwin" && "chflags/uchg is darwin's" }, (t) => {
-    const parent = join(scratch(t, "snapshot-repo-prune-uchg-"), "pr7");
-    const stale = lockedRunRoot(parent, "run-staleaa", 9, { immutableFile: true });
-    try {
-      const r = spawnSync("sh", ["-c", renderPrune(path, parent)], { env: ENV, encoding: "utf8" });
-
-      assert.doesNotMatch(r.stdout ?? "", /SNAPSHOT_PRUNE_FAILED/, `the prune named a failure on a root it can normalise: ${r.stderr}`);
-      assert.ok(!existsSync(stale), "an aged run root holding a uchg file survived the prune — the immutable flag wedges `rm -rf` (EPERM) and the root stays forever");
-    } finally {
-      unlock(parent);
-    }
-  });
+  // #2322, #2370. On darwin a user flag wedges the removal too: `uchg` refuses
+  // every change and `uappnd` refuses the unlink, and on a directory either
+  // one also refuses the `chmod` that makes a `000` directory readable again —
+  // while `chflags -R` cannot read a `000` directory it has just unflagged. So
+  // a directory's flag and mode have to come off together, before anything
+  // inside it is read, at every depth and on the run root itself. The `uappnd`
+  // file whose mode already grants owner rwx is the shape where `chmod -R`
+  // exits 0 over a flag.
+  for (const [shape, opts] of [
+    ["a uchg file inside a chmod 000 directory", { fileFlag: "uchg" }],
+    ["a uappnd file whose own mode leaves chmod nothing to change", { fileFlag: "uappnd", fileMode: 0o700 }],
+    ["a directory that is both uchg and chmod 000", { dirFlag: "uchg" }],
+    ["a directory that is both uappnd and chmod 000", { dirFlag: "uappnd" }],
+    ["a uchg file inside a directory that is both uchg and chmod 000", { fileFlag: "uchg", dirFlag: "uchg" }],
+    ["a uchg, chmod 000 directory inside another", { dirFlag: "uchg", nested: true }],
+    ["its own uchg and chmod 000 bits", { rootFlag: "uchg" }],
+    ["its own uappnd and chmod 000 bits", { rootFlag: "uappnd" }],
+    ["its own uchg and chmod 000 bits over a uchg, chmod 000 directory", { rootFlag: "uchg", dirFlag: "uchg" }],
+  ]) {
+    test(`${name}: on darwin the prune removes an aged run root with ${shape}`, { skip: process.platform !== "darwin" && "chflags/uchg/uappnd are darwin's" }, (t) => {
+      const parent = join(scratch(t, "snapshot-repo-prune-flags-"), "pr7");
+      const stale = lockedRunRoot(parent, "run-staleaa", 9, opts);
+      try {
+        const r = spawnSync("sh", ["-c", renderPrune(path, parent)], { env: ENV, encoding: "utf8" });
+
+        assert.doesNotMatch(r.stdout ?? "", /SNAPSHOT_PRUNE_FAILED/, `the prune named a failure on a root it can normalise: ${r.stderr}`);
+        assert.equal(r.status, 0, `the prune exited non-zero: ${r.stderr}`);
+        assert.ok(!existsSync(stale), `an aged run root with ${shape} survived the prune — it now stays forever and every later review prints SNAPSHOT_PRUNE_FAILED`);
+      } finally {
+        unlock(parent);
+      }
+    });
+  }
 
-  // The flag on the DIRECTORY rather than on a file in it: `chmod -R` cannot
-  // restore a `uchg` directory's mode, and `chflags -R` clears the flag but
-  // cannot read the `000` directory it just unflagged — so the mode is only
-  // restorable after the flag step, which is why the prune runs `chmod` again.
-  test(`${name}: on darwin the prune removes an aged run root holding a directory that is both uchg and chmod 000`, { skip: process.platform !== "darwin" && "chflags/uchg is darwin's" }, (t) => {
-    const parent = join(scratch(t, "snapshot-repo-prune-uchgdir-"), "pr7");
-    const stale = lockedRunRoot(parent, "run-staleaa", 9, { immutableDir: true });
+  // GNU find (Linux) refuses an `-exec ... {} +` whose argument list holds the
+  // `{}` placeholder more than once — and counts a `{}` written inside an
+  // `sh -c` script argument as one. BSD find (darwin) does not, so a dev
+  // machine passes a prune that fails every Linux CI run. This shim enforces
+  // GNU's rule over the real `find`, so the case holds on either host.
+  test(`${name}: the prune's find invocation keeps to GNU find's one-placeholder rule for -exec ... +`, (t) => {
+    const parent = join(scratch(t, "snapshot-repo-prune-gnu-"), "pr7");
+    const stale = lockedRunRoot(parent, "run-staleaa", 9);
+    const bin = scratch(t, "snapshot-repo-prune-gnu-bin-");
+    const realFind = execFileSync("sh", ["-c", "command -v find"], { env: ENV, encoding: "utf8" }).trim();
+    writeFileSync(
+      join(bin, "find"),
+      `#!/bin/sh
+# GNU find: with a terminating '+', only one argument may contain {}.
+n=0; plus=0; prev=
+for a in "$@"; do
+  case "$a" in *'{}'*) n=$((n + 1));; esac
+  [ "$a" = "+" ] && [ "$prev" = '{}' ] && plus=1
+  prev=$a
+done
+if [ "$plus" = 1 ] && [ "$n" -gt 1 ]; then
+  echo "find: Only one instance of {} is supported with -exec ... +" >&2
+  exit 1
+fi
+exec "${realFind}" "$@"
+`,
+      { mode: 0o755 },
+    );
+    const env = { ...ENV, PATH: `${bin}:${ENV.PATH}` };
     try {
-      const r = spawnSync("sh", ["-c", renderPrune(path, parent)], { env: ENV, encoding: "utf8" });
+      const r = spawnSync("sh", ["-c", renderPrune(path, parent)], { env, encoding: "utf8" });
 
-      assert.doesNotMatch(r.stdout ?? "", /SNAPSHOT_PRUNE_FAILED/, `the prune named a failure on a root it can normalise: ${r.stderr}`);
-      assert.ok(!existsSync(stale), "an aged run root holding a uchg, chmod 000 directory survived the prune — its mode was never restored after the flag was cleared, so `rm -rf` cannot read it");
+      assert.doesNotMatch(r.stdout ?? "", /SNAPSHOT_PRUNE_FAILED/, `a GNU-rule find rejected the prune: ${r.stderr}`);
+      assert.doesNotMatch(r.stderr ?? "", /Only one instance of \{\}/, "the prune's find tripped GNU's one-placeholder rule");
+      assert.ok(!existsSync(stale), "the aged run root survived a find that enforces GNU's placeholder rule");
     } finally {
       unlock(parent);
     }