@feigi/fleet-ctl 3.21.4 → 3.21.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.21.4",
+  "version": "3.21.5",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/recipe-prove.mjs

@@ -38,16 +38,18 @@
 // — <workspace> being the directory holding the repository's common git dir,
 // the place derive-testcmd.sh reads it from — and then read back through
 // derive-testcmd.sh for both fields. A cache the reader refuses is rolled
-// back to whatever stood before, so the reader stays the one authority on
-// what a usable cache is. A failed proof never touches an existing cache.
+// back to whatever stood before, as is one whose read-back is no verdict, so
+// the reader stays the one authority on what a usable cache is. A failed
+// proof never touches an existing cache.
 //
 // Exit 0: proven, cache written (its path and contents on stdout).
 // Exit 1: NOT PROVEN — no cache written; the reason on stderr.
 // Exit 2: no verdict on the proof — it could not be attempted (usage, not a
 //         repository, origin/main missing, the worktree could not be made), or
 //         a git or filesystem fault stopped it before the cache was settled
-//         (a git command could not be started; the cache or its temp file
-//         could not be written).
+//         (a git command could not be started, the reader's own git
+//         included, or the reader's `sh`; the cache or its temp file could
+//         not be written).
 
 import { spawnSync } from "node:child_process";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -212,7 +214,11 @@ function prove(o, wt, logs) {
 }
 
 // Write, then read back through the one reader. A cache it refuses is undone:
-// the prior bytes restored, or the file removed when none stood before.
+// the prior bytes restored, or the file removed when none stood before. The
+// cache is undone just the same when the read-back is no verdict: an `sh` that
+// could not be started read nothing, and the reader runs git itself and reads
+// a git that will not start as no repository at all, so its refusal is a
+// verdict on what was proven only while git still starts.
 function writeCache(cache, recipe, repo) {
   mkdirSync(dirname(cache), { recursive: true });
   const prior = existsSync(cache) ? readFileSync(cache) : null;
@@ -226,11 +232,17 @@ function writeCache(cache, recipe, repo) {
   }
   for (const field of ["install", "test"]) {
     const r = spawnSync("sh", [READER, repo, field], { env: ENV, encoding: "utf8" });
-    if (r.status !== 0 || r.stdout.replace(/\n$/, "") !== recipe[field]) {
-      if (prior === null) unlinkSync(cache);
-      else writeFileSync(cache, prior);
-      throw notProven(`the Recipe cache reader refuses what was proven: ${(r.stderr || r.stdout).trim()}`);
+    if (r.status === 0 && r.stdout.replace(/\n$/, "") === recipe[field]) continue;
+    if (prior === null) unlinkSync(cache);
+    else writeFileSync(cache, prior);
+    if (r.error && !r.pid) throw cannot(`could not start sh to read the Recipe cache back: ${r.error.message}`);
+    try {
+      git(["--version"]);
+    } catch (e) {
+      if (!(e instanceof Refusal)) throw e;
+      throw cannot(`${e.message} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`);
     }
+    throw notProven(`the Recipe cache reader refuses what was proven: ${(r.stderr || r.stdout).trim()}`);
   }
 }
 

package/scripts/recipe-prove.test.mjs

@@ -442,6 +442,54 @@ test("a git that stops starting during cleanup does not replace the proof's own
   assert.match(r.err, /skipped git worktree prune: could not start git/);
 });
 
+// A PATH holding exactly what the proof and the Recipe cache reader run — `sh`,
+// a `git` that execs the real one, `node`, and the reader's `mktemp`, `cat`
+// and `rm` — so the Test entrypoint can take git away by deleting it. With the
+// count proof no proof step runs git after the Test entrypoint, so the first
+// thing to meet the missing git is the reader, during the read-back.
+function readerPath() {
+  const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf8" }).trim();
+  const bin = tempDir("recipe-prove-path-");
+  writeExecStub(join(bin, "git"), `#!/bin/sh\nexec '${realGit}' "$@"\n`);
+  symlinkSync("/bin/sh", join(bin, "sh"));
+  symlinkSync(process.execPath, join(bin, "node"));
+  for (const tool of ["mktemp", "cat", "rm"]) {
+    symlinkSync(execFileSync("sh", ["-c", `command -v ${tool}`], { encoding: "utf8" }).trim(), join(bin, tool));
+  }
+  return bin;
+}
+
+test("a git that stops starting before the cache is read back is no verdict, never NOT PROVEN — and the prior cache is restored", () => {
+  // The control: the same PATH with git left in place is a proof that holds.
+  const kept = repo(MAVEN_FILES);
+  const ok = prove(kept.dir, ["--install", "true", "--test", "echo 'tests 1'", "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: readerPath() } });
+  assert.equal(ok.status, 0, ok.err);
+  assert.match(ok.out, /^recipe-prove: PROVEN/);
+
+  const { dir } = repo(MAVEN_FILES);
+  mkdirSync(join(dir, ".fleet"));
+  writeFileSync(cachePath(dir), "prior bytes");
+  const bin = readerPath();
+  const r = prove(dir, ["--install", "true", "--test", `rm '${join(bin, "git")}'; echo 'tests 1'`, "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /^recipe-prove: could not start git: .*ENOENT — the Recipe cache reader runs git, so its refusal is no verdict/m);
+  assert.doesNotMatch(r.err, /NOT PROVEN/);
+  assert.doesNotMatch(r.err, /not a git repository/);
+  assert.equal(readFileSync(cachePath(dir), "utf8"), "prior bytes", "a cache the reader never settled is rolled back");
+});
+
+// The reader's own `sh`, taken away the same way: a read-back that never ran
+// read nothing, so it is no verdict either.
+test("an sh that stops starting before the cache is read back is no verdict, never NOT PROVEN — and no cache is left", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const bin = readerPath();
+  const r = prove(dir, ["--install", "true", "--test", `rm '${join(bin, "sh")}'; echo 'tests 1'`, "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: bin } });
+  assert.equal(r.status, 2, r.err);
+  assert.match(r.err, /^recipe-prove: could not start sh to read the Recipe cache back: .*ENOENT/m);
+  assert.doesNotMatch(r.err, /NOT PROVEN/);
+  assert.equal(existsSync(cachePath(dir)), false, "a cache the reader never read is rolled back");
+});
+
 // Whether the process ignores file modes: root writes into a 0555 directory.
 const IGNORES_MODES = process.getuid?.() === 0 && "root ignores file modes";