@feigi/fleet-ctl 3.23.26 → 3.23.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.26",
+  "version": "3.23.28",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/recipe-prove.mjs

@@ -57,10 +57,11 @@
 //         repository, origin/main missing, the worktree could not be made), or
 //         a git or filesystem fault stopped it before the cache was settled
 //         (a git command could not be started, the reader's own git
-//         included; the reader's `sh`, `node`, `mktemp` or `cat` could not be
-//         started, or its `node` died mid-read — a `cat` that ran and failed
-//         stays the reader's refusal, exit 1; the cache or its temp file
-//         could not be written). The log directory under $TMPDIR is removed.
+//         included, or that git started and could not run; the reader's `sh`,
+//         `node`, `mktemp` or `cat` could not be started, or its `node` died
+//         mid-read — a `cat` that ran and failed stays the reader's refusal,
+//         exit 1; the cache or its temp file could not be written). The log
+//         directory under $TMPDIR is removed.
 
 import { spawnSync } from "node:child_process";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -287,9 +288,12 @@ function prove(o, wt, logs) {
 // cache is undone just the same when the read-back is no verdict: an `sh` that
 // could not be started read nothing; a reader that exits READER_COULD_NOT_RUN
 // could not start its `node`, `mktemp` or `cat`, or lost its `node` mid-read;
-// and the reader runs git itself and reads a git that will not start as no
+// and the reader runs git itself and reads a git that will not run as no
 // repository at all, so its refusal is a verdict on what was proven only while
-// git still starts.
+// git still runs. `git --version` is the probe: a working git always passes
+// it, so a git that cannot be started fails it, and so does one that starts
+// and cannot run — a wrapper whose target is gone exits 126 or 127, a killed
+// git has no exit status at all.
 function writeCache(cache, recipe, repo) {
   mkdirSync(dirname(cache), { recursive: true });
   const prior = existsSync(cache) ? readFileSync(cache) : null;
@@ -308,12 +312,15 @@ function writeCache(cache, recipe, repo) {
     else writeFileSync(cache, prior);
     if (r.error && !r.pid) throw cannot(`could not start sh to read the Recipe cache back: ${r.error.message}`);
     if (r.status === READER_COULD_NOT_RUN) throw cannot(`${r.stderr.trim()} — the Recipe cache reader could not run a tool it needs, so its refusal is no verdict on what was proven`);
+    const noVerdict = (why) => cannot(`${why} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`);
+    let probe;
     try {
-      git(["--version"]);
+      probe = git(["--version"]);
     } catch (e) {
       if (!(e instanceof Refusal)) throw e;
-      throw cannot(`${e.message} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`);
+      throw noVerdict(e.message);
     }
+    if (!probe.ok) throw noVerdict(`git started but does not run: \`git --version\` did not exit 0${probe.err ? `: ${probe.err}` : " and wrote nothing to stderr"}`);
     throw notProven(`the Recipe cache reader refuses what was proven: ${(r.stderr || r.stdout).trim()}`);
   }
 }

package/scripts/recipe-prove.test.mjs

@@ -665,6 +665,35 @@ test("a git that stops starting before the cache is read back is no verdict, nev
   assert.equal(readFileSync(cachePath(dir), "utf8"), "prior bytes", "a cache the reader never settled is rolled back");
 });
 
+// A git that starts and cannot run fails the reader's own `git rev-parse` just
+// as a git that will not start does, so its refusal is no verdict either. Each
+// stub stands in for one such git: a wrapper whose target is gone exits 126 or
+// 127, and a killed git has no exit status at all. The stubs differ in what
+// they write to stderr, which the message quotes when there is anything to
+// quote. The control — the same PATH with git left in place proves — is the
+// unstartable-git test's. The Test entrypoint rewrites the stub's body, never
+// the stub: that is a hard link to exec-stub.mjs's shared, read-only
+// trampoline.
+const GIT_THAT_CANNOT_RUN = [
+  { name: "exits 126 and writes nothing", body: "exit 126", cause: " and wrote nothing to stderr" },
+  { name: "exits 127 and writes to stderr", body: "echo boom >&2; exit 127", cause: ": boom" },
+  { name: "is killed by a signal", body: "kill -9 $$", cause: ": git was killed by SIGKILL" },
+];
+for (const c of GIT_THAT_CANNOT_RUN) {
+  test(`a git that starts but ${c.name} before the cache is read back is no verdict, never NOT PROVEN — and the prior cache is restored`, () => {
+    const { dir } = repo(MAVEN_FILES);
+    mkdirSync(join(dir, ".fleet"));
+    writeFileSync(cachePath(dir), "prior bytes");
+    const bin = readerPath();
+    const r = prove(dir, ["--install", "true", "--test", `printf '#!/bin/sh\\n${c.body}\\n' > '${join(bin, ".stub-git")}'; echo 'tests 1'`, "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: bin } });
+    assert.equal(r.status, 2, r.err);
+    assert.ok(r.err.includes(`recipe-prove: git started but does not run: \`git --version\` did not exit 0${c.cause} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`), r.err);
+    assert.doesNotMatch(r.err, /NOT PROVEN/);
+    assert.doesNotMatch(r.err, /not a git repository/);
+    assert.equal(readFileSync(cachePath(dir), "utf8"), "prior bytes", "a cache the reader never settled is rolled back");
+  });
+}
+
 // The reader's own `sh`, taken away the same way: a read-back that never ran
 // read nothing, so it is no verdict either.
 test("an sh that stops starting before the cache is read back is no verdict, never NOT PROVEN — and no cache is left", () => {