@feigi/fleet-ctl 3.21.3 → 3.21.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.21.3",
+  "version": "3.21.5",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/fix-applier-result-file-prose.test.mjs

@@ -72,6 +72,22 @@ test("the crash populations are told apart off refutersDispatched in the recipes
   assert.match(recipes, /select\(\.refutersDispatched == 0\)/);
 });
 
+// The recipes' comments are prose no ruling paragraph's pin reads. The one on
+// the testEnvironment recipe says what that field is evidence about: the
+// review's one shared test run, which no specialist returns a copy of, so no
+// recipe comment names a specialist `test_run` field that no longer exists.
+test("the testEnvironment recipe calls it evidence about the shared test run, and no recipe comment names a test_run field", () => {
+  const recipes = section().match(/^jq .*$/gm) ?? [];
+  const line = recipes.find((l) => l.startsWith("jq -r '.testEnvironment' "));
+  assert.ok(line, "the result-file section no longer has a `jq -r '.testEnvironment'` recipe");
+  assert.match(line, phrase("# what the shared test run is evidence about"), "the testEnvironment recipe's comment no longer names the shared test run");
+  // Every line of every fenced recipe block, not only the `jq ` ones: the `R=`
+  // line and any other line the block grows carry comments too.
+  const fenced = [...section().matchAll(/^```bash\n([\s\S]*?)^```$/gm)].flatMap((m) => m[1].split("\n"));
+  assert.ok(fenced.length > 0, "the result-file section lost its fenced recipe block");
+  for (const l of fenced) assert.doesNotMatch(l, /test_run/i, `a recipe line names the retired test_run field: ${l}`);
+});
+
 test("the fix-applier owns the mutual-exclusion scan, run twice, with a single refuter for a conflicting pair", () => {
   const p = ruling("**Scan the findings against each other for MUTUAL EXCLUSION");
   assert.match(p, phrase("run it twice"));

package/scripts/recipe-prove.mjs

@@ -38,16 +38,18 @@
 // — <workspace> being the directory holding the repository's common git dir,
 // the place derive-testcmd.sh reads it from — and then read back through
 // derive-testcmd.sh for both fields. A cache the reader refuses is rolled
-// back to whatever stood before, so the reader stays the one authority on
-// what a usable cache is. A failed proof never touches an existing cache.
+// back to whatever stood before, as is one whose read-back is no verdict, so
+// the reader stays the one authority on what a usable cache is. A failed
+// proof never touches an existing cache.
 //
 // Exit 0: proven, cache written (its path and contents on stdout).
 // Exit 1: NOT PROVEN — no cache written; the reason on stderr.
 // Exit 2: no verdict on the proof — it could not be attempted (usage, not a
 //         repository, origin/main missing, the worktree could not be made), or
 //         a git or filesystem fault stopped it before the cache was settled
-//         (a git command could not be started; the cache or its temp file
-//         could not be written).
+//         (a git command could not be started, the reader's own git
+//         included, or the reader's `sh`; the cache or its temp file could
+//         not be written).
 
 import { spawnSync } from "node:child_process";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -212,7 +214,11 @@ function prove(o, wt, logs) {
 }
 
 // Write, then read back through the one reader. A cache it refuses is undone:
-// the prior bytes restored, or the file removed when none stood before.
+// the prior bytes restored, or the file removed when none stood before. The
+// cache is undone just the same when the read-back is no verdict: an `sh` that
+// could not be started read nothing, and the reader runs git itself and reads
+// a git that will not start as no repository at all, so its refusal is a
+// verdict on what was proven only while git still starts.
 function writeCache(cache, recipe, repo) {
   mkdirSync(dirname(cache), { recursive: true });
   const prior = existsSync(cache) ? readFileSync(cache) : null;
@@ -226,11 +232,17 @@ function writeCache(cache, recipe, repo) {
   }
   for (const field of ["install", "test"]) {
     const r = spawnSync("sh", [READER, repo, field], { env: ENV, encoding: "utf8" });
-    if (r.status !== 0 || r.stdout.replace(/\n$/, "") !== recipe[field]) {
-      if (prior === null) unlinkSync(cache);
-      else writeFileSync(cache, prior);
-      throw notProven(`the Recipe cache reader refuses what was proven: ${(r.stderr || r.stdout).trim()}`);
+    if (r.status === 0 && r.stdout.replace(/\n$/, "") === recipe[field]) continue;
+    if (prior === null) unlinkSync(cache);
+    else writeFileSync(cache, prior);
+    if (r.error && !r.pid) throw cannot(`could not start sh to read the Recipe cache back: ${r.error.message}`);
+    try {
+      git(["--version"]);
+    } catch (e) {
+      if (!(e instanceof Refusal)) throw e;
+      throw cannot(`${e.message} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`);
     }
+    throw notProven(`the Recipe cache reader refuses what was proven: ${(r.stderr || r.stdout).trim()}`);
   }
 }
 

package/scripts/recipe-prove.test.mjs

@@ -442,6 +442,54 @@ test("a git that stops starting during cleanup does not replace the proof's own
   assert.match(r.err, /skipped git worktree prune: could not start git/);
 });
 
+// A PATH holding exactly what the proof and the Recipe cache reader run — `sh`,
+// a `git` that execs the real one, `node`, and the reader's `mktemp`, `cat`
+// and `rm` — so the Test entrypoint can take git away by deleting it. With the
+// count proof no proof step runs git after the Test entrypoint, so the first
+// thing to meet the missing git is the reader, during the read-back.
+function readerPath() {
+  const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf8" }).trim();
+  const bin = tempDir("recipe-prove-path-");
+  writeExecStub(join(bin, "git"), `#!/bin/sh\nexec '${realGit}' "$@"\n`);
+  symlinkSync("/bin/sh", join(bin, "sh"));
+  symlinkSync(process.execPath, join(bin, "node"));
+  for (const tool of ["mktemp", "cat", "rm"]) {
+    symlinkSync(execFileSync("sh", ["-c", `command -v ${tool}`], { encoding: "utf8" }).trim(), join(bin, tool));
+  }
+  return bin;
+}
+
+test("a git that stops starting before the cache is read back is no verdict, never NOT PROVEN — and the prior cache is restored", () => {
+  // The control: the same PATH with git left in place is a proof that holds.
+  const kept = repo(MAVEN_FILES);
+  const ok = prove(kept.dir, ["--install", "true", "--test", "echo 'tests 1'", "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: readerPath() } });
+  assert.equal(ok.status, 0, ok.err);
+  assert.match(ok.out, /^recipe-prove: PROVEN/);
+
+  const { dir } = repo(MAVEN_FILES);
+  mkdirSync(join(dir, ".fleet"));
+  writeFileSync(cachePath(dir), "prior bytes");
+  const bin = readerPath();
+  const r = prove(dir, ["--install", "true", "--test", `rm '${join(bin, "git")}'; echo 'tests 1'`, "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /^recipe-prove: could not start git: .*ENOENT — the Recipe cache reader runs git, so its refusal is no verdict/m);
+  assert.doesNotMatch(r.err, /NOT PROVEN/);
+  assert.doesNotMatch(r.err, /not a git repository/);
+  assert.equal(readFileSync(cachePath(dir), "utf8"), "prior bytes", "a cache the reader never settled is rolled back");
+});
+
+// The reader's own `sh`, taken away the same way: a read-back that never ran
+// read nothing, so it is no verdict either.
+test("an sh that stops starting before the cache is read back is no verdict, never NOT PROVEN — and no cache is left", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const bin = readerPath();
+  const r = prove(dir, ["--install", "true", "--test", `rm '${join(bin, "sh")}'; echo 'tests 1'`, "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /^recipe-prove: could not start sh to read the Recipe cache back: .*ENOENT/m);
+  assert.doesNotMatch(r.err, /NOT PROVEN/);
+  assert.equal(existsSync(cachePath(dir)), false, "a cache the reader never read is rolled back");
+});
+
 // Whether the process ignores file modes: root writes into a 0555 directory.
 const IGNORES_MODES = process.getuid?.() === 0 && "root ignores file modes";
 

package/scripts/review-core-unrun.test.mjs

@@ -401,18 +401,57 @@ test("the returned object carries dimensionsUnrun alongside dimensionsRun", () =
 // The note hands every specialist the shared run and tells it not to run the
 // full command itself — and nothing more about the run: the shared run is the
 // single record of it, so no specialist is told to report or copy it anywhere.
-// Every rendering the note has — usable, no counts (NOT usable), and failing
-// tests for the owner and for a non-owner — is checked, because each appends a
-// different paragraph to the same opening one.
+// Every rendering the note has is checked — usable, each reason a run is NOT
+// usable (each reason's own text is interpolated into that paragraph), and
+// failing or cancelled tests for the owner and for a non-owner — because each
+// appends a different paragraph to the same opening one.
+//
+// The no-copy check reads the whole note with its line wrapping flattened, so
+// a request appended after the opening paragraph, or one the hard wrap splits
+// across two lines, is still one sentence to it. It is a bounded word list, not
+// a proof: a request worded with a verb or noun outside the lists passes it.
+// COPY_REQUEST matches three shapes: a copy verb followed within a few words
+// by the run, its counts, its log or its result; a copy verb followed in the
+// same sentence by a destination in the specialist's own output ("in your
+// result", "to the payload"); and the run, counts or log said to "must be"
+// reported, returned, included and the like. The verbs are whole words, so
+// inflected ones never match as written — and must not be widened to
+// inflections, because the "no exit status" rendering's own "reported counts
+// but no exit status" would then match. The word window is what keeps the
+// opening paragraph's "your own copy of the snapshot are still yours to run"
+// green: it uses `copy` as a noun and ends on `run` in the same sentence.
+// Every rendering below must pass it. The run-is-null reason ("returned
+// nothing") is not rendered here: sharedRunNote dereferences run.command, and
+// that text reaches a note only as the "(the test-run agent returned nothing)"
+// error suffix runReview sets.
+const COPY_VERB = "report|copy|echo|record|return|repeat|restate|include|paste|attach|quote|put|add|list";
+const COPY_OBJECT = "run|counts?|logs?|results?";
+const COPY_REQUEST = new RegExp(
+  [
+    String.raw`\b(?:${COPY_VERB})\b(?:\s+[^\s.]+){0,4}?\s+(?:${COPY_OBJECT})\b`,
+    String.raw`\b(?:${COPY_VERB})\b[^.]*\b(?:in|to|into)\s+(?:your|the)\s+(?:\w+\s+)?(?:result|payload|scope_searched|summary|findings?)\b`,
+    String.raw`\b(?:${COPY_OBJECT})\b(?:\s+[^\s.]+){0,3}?\s+(?:must|should|shall)\s+be\s+(?:report|return|includ|record|cop|attach|quot|past|echo|list|add|put)\w*`,
+  ].join("|"),
+  "i",
+);
 test("the shared-run note hands over the run and forbids a rerun, and asks for no copy of it in any rendering", () => {
-  const usable = { command: "node --test", logPath: "/r/test-run.log", exitCode: 0, tests: 5, pass: 5, fail: 0 };
-  const noCounts = { command: "node --test", logPath: "/r/test-run.log", error: "no summary" };
-  const failing = { command: "node --test", logPath: "/r/test-run.log", exitCode: 1, tests: 5, pass: 3, fail: 2 };
+  const base = { command: "node --test", logPath: "/r/test-run.log" };
+  const usable = { ...base, exitCode: 0, tests: 5, pass: 5, fail: 0 };
+  const failing = { ...base, exitCode: 1, tests: 5, pass: 3, fail: 2 };
+  const cancelled = { ...base, exitCode: 1, tests: 5, pass: 4, fail: 0, cancelled: 1 };
+  const unusable = (why) => new RegExp(`This run is NOT usable: \`node --test\` ${why}`);
   for (const [name, run, key, paragraph] of [
     ["usable", usable, "tests", null],
-    ["no counts", noCounts, "tests", /This run is NOT usable: /],
+    ["no counts", { ...base, error: "no summary" }, "tests", unusable("produced no counts")],
+    ["0 tests", { ...base, exitCode: 0, tests: 0, pass: 0, fail: 0 }, "tests", unusable("produced 0 tests")],
+    ["every test skipped", { ...base, exitCode: 0, tests: 5, pass: 0, fail: 0 }, "tests", unusable("passed nothing and failed nothing")],
+    ["most never ran", { ...base, exitCode: 0, tests: 10, pass: 2, fail: 0 }, "tests", unusable("passed 2 and failed 0 of the 10")],
+    ["no exit status", { ...base, tests: 5, pass: 5, fail: 0 }, "tests", unusable("reported counts but no exit status")],
+    ["non-zero exit, nothing failing", { ...base, exitCode: 1, tests: 5, pass: 5, fail: 0 }, "tests", unusable("exited 1 but reported no failing")],
     ["failing, owner", failing, "correctness", /filing them is YOUR job in this review/],
     ["failing, non-owner", failing, "tests", /the correctness dimension files the finding/],
+    ["cancelled, owner", cancelled, "correctness", /cancelled tests, and filing them is YOUR job/],
+    ["cancelled, non-owner", cancelled, "tests", /cancelled tests, and the correctness dimension files/],
   ]) {
     const note = sharedRunNote(run, "correctness", key);
     assert.doesNotMatch(note, /test_run/, `${name}: the note still names test_run`);
@@ -425,6 +464,8 @@ test("the shared-run note hands over the run and forbids a rerun, and asks for n
     // asks the specialist to report the run.
     const first = note.split(/\n(?=This run is NOT usable|It has )/)[0];
     assert.match(first, /Read the log for anything the counts do not say\.$/, `${name}: the opening paragraph says more after the log instruction`);
+    // ...and no paragraph this rendering appends asks for one either.
+    assert.doesNotMatch(note.replace(/\s+/g, " "), COPY_REQUEST, `${name}: the note asks the specialist to report or copy the run`);
     if (paragraph) assert.match(note, paragraph, `${name}: the paragraph this rendering appends is missing`);
   }
 });