@feigi/fleet-ctl 3.23.9 → 3.23.11

package/commands/run-merge-bot.md

@@ -212,7 +212,7 @@ For each labeled PR clearing the hold rule, lowest first:
 
    `--pre` is the head you recorded at **The labelled head**; `--post` is the head step 1's rebase produced — omit it when no rebase ran, which is the same as passing `pre` twice. `pr<N>` is this PR and `merge-bot-<n>` is your own name, so the reading lands under a directory only you write, never in the scratch root by itself: that root is injected into every dispatched member and shared with every sibling. The gate is read-only — it runs the instrument re-check, `gh pr view <pr> --json labels,reviewDecision,headRefOid` and `ci-state.mjs --pr <pr>`, answers their conjunction, and never merges, labels, rebases or waits. Stdout is exactly one JSON line, `{pr, verdict, reason, head, pre, post, behind, instruments, ci}`; stderr is its children's diagnostics, so never fold `2>&1` into the line you read. Read `rc` straight off the call, as above — never through a pipe.
 
-   1. **Run it.** Exit 0 → go to 2. Exit 1 with a `ci:…` `reason`, `ci.runId` set and `ci.status` not `completed` → the run has started but not finished: wait on `ci.runId` (step 2), then run it again. Exit 1 with `ci.runId` **null** (`reason` starts `no CI run whose headSha equals`) → GitHub has not yet registered a run for this head at all — right after `gh pr update-branch --rebase`, the id step 2's wait blocks on does not exist yet, so never route this into step 2's `gh run watch`/`gh run view <run-id>` with a null id. Wait 15s and run the gate again instead, capped at 20 attempts (~5 minutes); no run within that cap → skip the PR and report `<reason>-#<pr>`, the same as any other exit 1. Any other exit 1 → skip the PR, report `<reason>-#<pr>` (`head-moved-after-label-#<pr>`, `label-pulled-#<pr>`, `changes-requested-#<pr>` …), leave the label where it is, and move on. Exit 2 → stop on that PR and report `<reason>-#<pr>`: the gate could not evaluate — a finding about the tree, the tooling or the API, never about the PR. Re-run once only for `rate-limited`, a quota refusal that clears by itself.
+   1. **Run it.** Exit 0 → go to 2. Exit 1 with a `ci:…` `reason`, `ci.runId` set and `ci.status` not `completed` → the run has started but not finished: wait on `ci.runId` (step 2), then run it again. Exit 1 with `ci.runId` **null** (`reason` starts `no CI run whose headSha equals`) → GitHub has not yet registered a run for this head at all — right after `gh pr update-branch --rebase`, the id step 2's wait blocks on does not exist yet, so never route this into step 2's `gh run view <run-id>` poll with a null id. Wait 15s and run the gate again instead, capped at 20 attempts (~5 minutes); no run within that cap → skip the PR and report `<reason>-#<pr>`, the same as any other exit 1. Any other exit 1 → skip the PR, report `<reason>-#<pr>` (`head-moved-after-label-#<pr>`, `label-pulled-#<pr>`, `changes-requested-#<pr>` …), leave the label where it is, and move on. Exit 2 → stop on that PR and report `<reason>-#<pr>`: the gate could not evaluate — a finding about the tree, the tooling or the API, never about the PR. Re-run once only for `rate-limited`, a quota refusal that clears by itself.
    2. **Run it again immediately before `gh pr merge`, and merge only on that second exit 0.** Anything else takes the same arms as 1, and nothing merges.
 
    Each `reason` is a fact the gate now enforces, not a step you run:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.9",
+  "version": "3.23.11",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/recipe-prove.mjs

@@ -148,11 +148,25 @@ function parseArgs(argv) {
 // proof that did not hold. Only a spawn that produced no process counts:
 // spawnSync also sets `error` for a git that ran and was killed — ENOBUFS,
 // when its output outgrows the default maxBuffer — and that is a failed git
-// command like any other, never a git that could not be started.
+// command, never a git that could not be started.
+//
+// A git killed by a signal (that buffer kill, an OOM kill, a timeout wrapper)
+// is still a failed command, never a throw: each caller maps a failed git to
+// its own refusal. But it has no exit status and mostly no stderr, so `err`
+// names the kill, after whatever git did write — a caller quoting `err` would
+// otherwise quote an empty reason.
 function git(args, cwd) {
   const r = spawnSync("git", args, { cwd, env: ENV, encoding: "utf8" });
   if (r.error && !r.pid) throw cannot(`could not start git: ${r.error.message}`);
-  return { ok: r.status === 0, out: (r.stdout ?? "").replace(/\n$/, ""), err: (r.stderr ?? "").trim() };
+  const err = (r.stderr ?? "").trim();
+  const killed = r.signal && `git was killed by ${r.signal}${killCause(r.error)}`;
+  return { ok: r.status === 0, out: (r.stdout ?? "").replace(/\n$/, ""), err: [err, killed].filter(Boolean).join("; ") };
+}
+
+function killCause(error) {
+  if (!error) return "";
+  if (error.code === "ENOBUFS") return " (ENOBUFS: its output outgrew the spawn buffer)";
+  return ` (${error.code ?? error.message})`;
 }
 
 // Run a Recipe command through `sh -c` from the worktree root, its output to
@@ -338,12 +352,13 @@ function removeLogs(logs) {
 
 function main(argv) {
   const o = parseArgs(argv);
-  if (!git(["rev-parse", "--git-dir"], o.repo).ok) throw cannot(`${o.repo} is not a git repository`);
+  const gitDir = git(["rev-parse", "--git-dir"], o.repo);
+  if (!gitDir.ok) throw cannot(`${o.repo} is not a git repository: ${gitDir.err}`);
   const common = git(["rev-parse", "--path-format=absolute", "--git-common-dir"], o.repo);
   const workspace = common.ok ? workspaceDirFromGitCommonDir(common.out, o.repo) : null;
   if (!workspace) throw cannot(`cannot resolve the common git dir of ${o.repo}: ${common.err}`);
   const sha = git(["rev-parse", "--verify", "origin/main^{commit}"], o.repo);
-  if (!sha.ok) throw cannot("origin/main does not resolve to a commit — fetch it; the proof runs against it");
+  if (!sha.ok) throw cannot(`origin/main does not resolve to a commit (${sha.err}) — fetch it; the proof runs against it`);
 
   const logs = mkdtempSync(join(tmpdir(), `${NAME}-`));
   const cache = join(workspace, ".fleet", "recipe.json");

package/scripts/recipe-prove.test.mjs

@@ -506,6 +506,112 @@ test("a git whose output outgrows the spawn buffer is a failed command, not a gi
   assert.doesNotMatch(r.err, /could not start git/);
 });
 
+// A `git` first on PATH that runs `act` when its arguments match the sh `case`
+// pattern `when`, and otherwise execs the real one.
+function fakeGit(when, act) {
+  const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf8" }).trim();
+  const bin = tempDir("recipe-prove-path-");
+  writeExecStub(join(bin, "git"), `#!/bin/sh\ncase "$*" in ${when}) ${act} ;; esac\nexec '${realGit}' "$@"\n`);
+  return `${bin}:${BIN}:${process.env.PATH}`;
+}
+
+const COUNT_PROOF = ["--install", "true", "--test", "echo 'tests 1'", "--count-line", "tests 1", "--test-count", "1"];
+
+// A git that ran and was killed has no exit status and, mostly, no stderr: its
+// failure must name the kill, or every caller quoting git's reason quotes an
+// empty one. Each caller keeps its own refusal class — NOT PROVEN (1) inside
+// the proof, no verdict (2) for the probes that come before it.
+const KILLED_GIT = [
+  {
+    name: "a git killed by SIGKILL reading the tree state",
+    when: "status*", act: "kill -9 $$",
+    status: 1, reason: /NOT PROVEN — could not read the tree state in the throwaway worktree: git was killed by SIGKILL; install output: /,
+  },
+  {
+    name: "a git killed by SIGTERM reading the tree state",
+    when: "status*", act: "kill -TERM $$",
+    status: 1, reason: /NOT PROVEN — could not read the tree state in the throwaway worktree: git was killed by SIGTERM; install output: /,
+  },
+  {
+    name: "a git killed for outgrowing the spawn buffer reading the tree state",
+    when: "status*", act: "yes | head -c 2000000; exit 0",
+    status: 1, reason: /NOT PROVEN — could not read the tree state in the throwaway worktree: git was killed by SIGTERM \(ENOBUFS: its output outgrew the spawn buffer\); install output: /,
+  },
+  {
+    name: "a git that wrote to stderr and was then killed",
+    when: "status*", act: "echo boom >&2; kill -9 $$",
+    status: 1, reason: /NOT PROVEN — could not read the tree state in the throwaway worktree: boom; git was killed by SIGKILL; install output: /,
+  },
+  {
+    name: "a git killed restoring the tree before the mutation",
+    when: "reset*", act: "kill -9 $$", files: GO_FILES, args: GO_PROOF,
+    status: 1, reason: /NOT PROVEN — could not restore the tree before the mutation: git was killed by SIGKILL; test output: /,
+  },
+  {
+    name: "a git killed reading what the mutation changed",
+    when: "diff*", act: "kill -9 $$", files: GO_FILES, args: GO_PROOF,
+    status: 1, reason: /NOT PROVEN — could not read what the mutation changed: git was killed by SIGKILL; its output: /,
+  },
+  {
+    name: "a git killed probing for the repository",
+    when: '"rev-parse --git-dir"', act: "kill -9 $$",
+    status: 2, reason: /^recipe-prove: .* is not a git repository: git was killed by SIGKILL$/m,
+  },
+  {
+    name: "a git killed resolving the common git dir",
+    when: '"rev-parse --path-format=absolute --git-common-dir"', act: "kill -9 $$",
+    status: 2, reason: /^recipe-prove: cannot resolve the common git dir of .*: git was killed by SIGKILL$/m,
+  },
+  {
+    name: "a git killed resolving origin/main",
+    when: '"rev-parse --verify"*', act: "kill -9 $$",
+    status: 2, reason: /^recipe-prove: origin\/main does not resolve to a commit \(git was killed by SIGKILL\) — fetch it/m,
+  },
+  {
+    name: "a git killed creating the throwaway worktree",
+    when: '"worktree add"*', act: "kill -9 $$",
+    status: 2, reason: /^recipe-prove: could not create the throwaway worktree: git was killed by SIGKILL$/m,
+  },
+];
+
+for (const c of KILLED_GIT) {
+  test(`${c.name} names the signal in its refusal`, () => {
+    const { dir } = repo(c.files ?? MAVEN_FILES);
+    const r = prove(dir, c.args ?? COUNT_PROOF, { env: { PATH: fakeGit(c.when, c.act) } });
+    assert.equal(r.status, c.status, r.err);
+    assert.match(r.err, c.reason);
+    assert.doesNotMatch(r.err, /could not start git/);
+    if (c.status === 2) assert.doesNotMatch(r.err, /NOT PROVEN/);
+  });
+}
+
+// The control: a git that ran and exited non-zero is quoted as it wrote, with
+// no kill named.
+test("a git that exits non-zero is refused with exactly its stderr, naming no signal", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const r = prove(dir, COUNT_PROOF, { env: { PATH: fakeGit("status*", "echo boom >&2; exit 3") } });
+  assert.equal(r.status, 1, r.err);
+  assert.match(r.err, /NOT PROVEN — could not read the tree state in the throwaway worktree: boom; install output: /);
+  assert.doesNotMatch(r.err, /killed/);
+});
+
+// A killed `worktree remove` is a failed one: cleanup falls back to the plain
+// delete, and the proof's own NOT PROVEN — which keeps its log directory,
+// the throwaway worktree's parent — stands.
+test("a git killed removing the throwaway worktree still leaves it deleted", () => {
+  const { dir } = repo(MAVEN_FILES);
+  const r = prove(dir, ["--install", "false", "--test", "true", "--count-line", "x 1", "--test-count", "1"], {
+    env: { PATH: fakeGit('"worktree remove"*', "kill -9 $$") },
+  });
+  assert.equal(r.status, 1, r.err);
+  assert.match(r.err, /NOT PROVEN — the Install step 'false' failed/);
+  assert.doesNotMatch(r.err, /skipped git/);
+  const kept = logDirs(r.tmp);
+  assert.equal(kept.length, 1, `log directories in ${r.tmp}: ${kept}`);
+  assert.equal(existsSync(join(r.tmp, kept[0], "wt")), false, "the throwaway worktree is gone");
+  assert.equal(git(dir, "worktree", "list", "--porcelain").split("\n").filter((l) => l.startsWith("worktree ")).length, 1, "only the main worktree stays registered");
+});
+
 // A git that starts for the worktree removal and not for the prune after it:
 // the stub deletes itself once `worktree remove` has run. The proof's own
 // outcome is NOT PROVEN (the Install step fails), and the prune that cannot

package/scripts/run-merge-bot-prose.test.mjs

@@ -1273,9 +1273,8 @@ test("step 3 waits on an unfinished run instead of skipping the PR, and only the
 // registered a run for the rebased head: `ci.runId` and `ci.status` both read
 // `null`, which the arm above's "`ci.status` not `completed`" condition also
 // matches — collapsed together, a bot reading this prose is sent to wait on
-// `ci.runId` (step 2) with a `null` id, i.e. `gh run watch null` / `gh run
-// view null`. This pins the no-run case as its own arm, never routed through
-// step 2's blocking wait.
+// `ci.runId` (step 2) with a `null` id, i.e. `gh run view null`. This pins
+// the no-run case as its own arm, never routed through step 2's blocking wait.
 test("step 3 waits and re-gates on a null ci.runId instead of routing it into step 2's wait", () => {
   const s = step3();
   assert.match(
@@ -1285,7 +1284,7 @@ test("step 3 waits and re-gates on a null ci.runId instead of routing it into st
   );
   assert.match(
     s,
-    phrase("never route this into step 2's `gh run watch`/`gh run view <run-id>` with a null id"),
+    phrase("never route this into step 2's `gh run view <run-id>` poll with a null id"),
     "step 3 no longer warns against waiting on step 2's blocking call with a null run id",
   );
   assert.match(