@feigi/fleet-ctl 3.19.4 → 3.19.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.19.4",
+  "version": "3.19.6",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/recipe-prove.mjs

@@ -45,8 +45,9 @@
 // Exit 1: NOT PROVEN — no cache written; the reason on stderr.
 // Exit 2: no verdict on the proof — it could not be attempted (usage, not a
 //         repository, origin/main missing, the worktree could not be made), or
-//         a filesystem fault stopped it before the cache was settled (the
-//         cache or its temp file could not be written).
+//         a git or filesystem fault stopped it before the cache was settled
+//         (a git command could not be started; the cache or its temp file
+//         could not be written).
 
 import { spawnSync } from "node:child_process";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -108,8 +109,16 @@ function parseArgs(argv) {
   };
 }
 
+// A git that cannot be started is no verdict, as for `sh` below: read as a
+// failed git command, it would surface as whatever that command's failure
+// means to its caller — a missing repository, an unfetched origin/main, a
+// proof that did not hold. Only a spawn that produced no process counts:
+// spawnSync also sets `error` for a git that ran and was killed — ENOBUFS,
+// when its output outgrows the default maxBuffer — and that is a failed git
+// command like any other, never a git that could not be started.
 function git(args, cwd) {
   const r = spawnSync("git", args, { cwd, env: ENV, encoding: "utf8" });
+  if (r.error && !r.pid) throw cannot(`could not start git: ${r.error.message}`);
   return { ok: r.status === 0, out: (r.stdout ?? "").replace(/\n$/, ""), err: (r.stderr ?? "").trim() };
 }
 
@@ -231,9 +240,19 @@ function writeCache(cache, recipe, repo) {
 // is the usual one; the repo ignores them) makes both git's removal and a
 // plain recursive delete fail, so the fallback makes the tree writable first.
 // The prune always runs: it is what drops the registration of a worktree
-// whose directory is gone.
+// whose directory is gone. A git that cannot be started is reported and
+// skipped here, since this runs in the proof's `finally`.
 function removeWorktree(wt, repo) {
-  if (!git(["worktree", "remove", "--force", wt], repo).ok) {
+  const tryGit = (args) => {
+    try {
+      return git(args, repo).ok;
+    } catch (e) {
+      if (!(e instanceof Refusal)) throw e;
+      process.stderr.write(`${NAME}: skipped git ${args.join(" ")}: ${e.message}\n`);
+      return false;
+    }
+  };
+  if (!tryGit(["worktree", "remove", "--force", wt])) {
     spawnSync("chmod", ["-R", "u+w", wt], { stdio: "ignore" });
     try {
       rmSync(wt, { recursive: true, force: true });
@@ -241,7 +260,7 @@ function removeWorktree(wt, repo) {
       process.stderr.write(`${NAME}: could not remove the throwaway worktree ${wt}: ${e.message}\n`);
     }
   }
-  git(["worktree", "prune"], repo);
+  tryGit(["worktree", "prune"]);
 }
 
 function main(argv) {

package/scripts/recipe-prove.test.mjs

@@ -1,7 +1,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { execFileSync, spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tempDir } from "./temp-dir.mjs";
 import { writeExecStub } from "./exec-stub.mjs";
@@ -371,13 +371,75 @@ test("a proof that cannot be attempted exits 2, distinct from a Recipe that is n
     "a refusal at the argument boundary creates no worktree");
 });
 
+// Every temp dir the proof made, scanned for the throwaway worktree it names `wt`.
+function assertNoWorktreeLeft(tmp) {
+  for (const d of readdirSync(tmp)) {
+    assert.deepEqual(readdirSync(join(tmp, d)).filter((n) => n === "wt"), [], `${d} still holds the throwaway worktree`);
+  }
+}
+
 test("the proof leaves no worktree directory behind in its temp dir", () => {
   const { dir } = repo(MAVEN_FILES);
   const r = prove(dir, MAVEN_PROOF);
   assert.equal(r.status, 0, r.err);
-  for (const d of readdirSync(r.tmp)) {
-    assert.deepEqual(readdirSync(join(r.tmp, d)).filter((n) => n === "wt"), [], `${d} still holds the throwaway worktree`);
-  }
+  assertNoWorktreeLeft(r.tmp);
+});
+
+test("a git that cannot be started is named as such, not reported as a missing repository", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const r = prove(dir, MAVEN_PROOF, { env: { PATH: "/nonexistent" } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /^recipe-prove: could not start git: .*ENOENT/);
+  assert.doesNotMatch(r.err, /not a git repository/);
+});
+
+// A PATH holding only `sh` and a `git` that execs the real one, so the Install
+// step can take git away by deleting it: every later git call then
+// fails to start, in the proof and in the worktree cleanup alike.
+test("a git that stops starting during the Install step is no verdict, never NOT PROVEN — and the worktree is still removed", () => {
+  const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf8" }).trim();
+  const { dir } = repo(MAVEN_FILES);
+  const bin = tempDir("recipe-prove-path-");
+  writeExecStub(join(bin, "git"), `#!/bin/sh\nexec '${realGit}' "$@"\n`);
+  symlinkSync("/bin/sh", join(bin, "sh"));
+  const install = `'${process.execPath}' -e 'require("fs").rmSync(process.argv[1])' '${join(bin, "git")}'`;
+  const r = prove(dir, ["--install", install, "--test", "true", "--count-line", "x 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /could not start git: .*ENOENT/);
+  assert.match(r.err, /skipped git worktree remove/);
+  assert.doesNotMatch(r.err, /NOT PROVEN/);
+  assertNoWorktreeLeft(r.tmp);
+});
+
+// A git that started and ran is never "could not start": here its status
+// output outgrows spawnSync's default 1 MiB buffer, which kills it and sets
+// `error` (ENOBUFS) on a process that did run. The tree the Install step left
+// is unreadable, so the proof does not hold — NOT PROVEN, exit 1.
+test("a git whose output outgrows the spawn buffer is a failed command, not a git that could not be started", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const flood = 'const fs = require("fs"); for (let i = 0; i < 7000; i++) fs.writeFileSync("f".repeat(200) + i, "")';
+  const install = `'${process.execPath}' -e '${flood}'`;
+  const r = prove(dir, ["--install", install, "--test", "true", "--count-line", "x 1", "--test-count", "1"]);
+  assert.equal(r.status, 1, r.err);
+  assert.match(r.err, /NOT PROVEN — could not read the tree state in the throwaway worktree/);
+  assert.doesNotMatch(r.err, /could not start git/);
+});
+
+// A git that starts for the worktree removal and not for the prune after it:
+// the stub deletes itself once `worktree remove` has run. The proof's own
+// outcome is NOT PROVEN (the Install step fails), and the prune that cannot
+// start must not replace it.
+test("a git that stops starting during cleanup does not replace the proof's own NOT PROVEN", () => {
+  const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf8" }).trim();
+  const { dir } = repo(MAVEN_FILES);
+  const bin = tempDir("recipe-prove-path-");
+  const stub = join(bin, "git");
+  writeExecStub(stub, `#!/bin/sh\n'${realGit}' "$@"\nrc=$?\nif [ "$2" = remove ]; then /bin/rm -f '${stub}'; fi\nexit $rc\n`);
+  symlinkSync("/bin/sh", join(bin, "sh"));
+  const r = prove(dir, ["--install", "false", "--test", "true", "--count-line", "x 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 1, r.err);
+  assert.match(r.err, /NOT PROVEN/);
+  assert.match(r.err, /skipped git worktree prune: could not start git/);
 });
 
 // Whether the process ignores file modes: root writes into a 0555 directory.
@@ -393,9 +455,7 @@ test("read-only install output cannot turn a proof that held into a crash", { sk
   const r = prove(dir, ["--install", READ_ONLY_INSTALL, ...MAVEN_PROOF.slice(2)]);
   assert.equal(r.status, 0, r.err);
   assert.equal(JSON.parse(readFileSync(cachePath(dir), "utf8")).derivedAt, head);
-  for (const d of readdirSync(r.tmp)) {
-    assert.deepEqual(readdirSync(join(r.tmp, d)).filter((n) => n === "wt"), [], `${d} still holds the throwaway worktree`);
-  }
+  assertNoWorktreeLeft(r.tmp);
   assert.equal(git(dir, "worktree", "list", "--porcelain").split("\n").filter((l) => l.startsWith("worktree ")).length, 1);
 });