@feigi/fleet-ctl 3.79.1 → 3.79.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.79.1",
+  "version": "3.79.3",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/claim-ticket.sh

@@ -289,9 +289,11 @@ else
   # computes `%(upstream:track)` against the REMOTE ref, and an upstream naming
   # a remote ref that has never existed reads as `[gone]`, not as "no upstream"
   # — measured, a freshly claimed branch was reaped by `reap.sh --apply` before
-  # any work was done in it. The real upstream arrives with the documented first
-  # push, `git push --force-with-lease -u origin HEAD` (skills/next-ticket/SKILL.md
-  # step 7; its no-lease fallback carries `-u` too), and only then can be `[gone]`.
+  # any work was done in it. The real upstream arrives with the first push with `-u`: the documented form,
+  # `git push --force-with-lease -u origin HEAD` (skills/next-ticket/SKILL.md
+  # step 7; its no-lease fallback carries `-u` too), or else when the controller
+  # settles the implementer's report, which writes it. Only then can the branch
+  # be `[gone]`. Until then reap.sh reports it kept.
   #
   # `--no-track` is also why no branch delete uses `-d`: `-d` measures an
   # upstream-less branch against local HEAD, refusing a pristine claim behind

package/scripts/diff-stats.mjs

@@ -131,8 +131,8 @@ export function computeStats(files, changedFiles) {
 // --- CLI (runs only when executed directly, never on import) ---------------
 
 // die()/numArg() shared with the other fleet scripts — see arg.mjs for the
-// fail-open and pipe-safety rationale. `--pr` is
-// the only flag read here, and numArg() rather than arg() because this file
+// fail-open and pipe-safety rationale. `--pr` is the numeric flag read here
+// (`--repo` is the other, a plain string for gh's own `-R`), and numArg() rather than arg() because this file
 // was the live half of a defect: the `if (!pr)` below caught a trailing
 // `--pr` — `undefined` is falsy — but never a non-numeric one, so `--pr abc`
 // reached `gh pr view abc` and printed `{"pr":null,…}` at exit 0. Measured
@@ -140,7 +140,7 @@ export function computeStats(files, changedFiles) {
 // it resolves as a BRANCH, so the stats underneath were genuine and about
 // whatever PR that branch heads, reported under a null id.
 const die = makeDie(NAME);
-const { numArg, sweep, stray } = defineFlags(die, { flags: { pr: "value" } });
+const { arg, numArg, sweep, stray } = defineFlags(die, { flags: { pr: "value", repo: "value" } });
 
 // The one truncation rule for the raw gh value this script quotes into a
 // refusal: clip behind a visible marker, and only when the value was really
@@ -211,7 +211,17 @@ function main() {
   // required, where gh answers it truthfully as no such PR. Absent is this
   // file's own refusal and malformed is numArg()'s, per arg.mjs.
   const pr = numArg("pr");
-  if (pr === null) die("usage: diff-stats.mjs --pr <number>");
+  if (pr === null) die("usage: diff-stats.mjs --pr <number> [--repo <[HOST/]OWNER/REPO | url>]");
+  // Which repository the PR is in. Absent, `gh` resolves it from this process's
+  // working directory — the right answer for a human at their own checkout and
+  // the wrong one for review-core.mjs's snapshot agent, which starts in the
+  // controller's checkout while the PR belongs to the worktree's repository: a
+  // PR in the cwd's repository that shares the number answers instead, exit 0,
+  // a well-formed `files` array and a profile that sizes another change.
+  // `arg()` refuses an empty or flag-shaped value, so a caller whose repository
+  // came back empty gets a refusal here, never the cwd fallback an empty `-R ""`
+  // would be.
+  const repo = arg("repo");
   // The misspelled-flag sweep, weaker here for the same reason as pr-overlap.mjs: `--pr` is
   // required, so a misspelled `--prr 5` already fell through to the usage die
   // above. What was silently ignored at exit 0 is a stray riding along with a
@@ -234,7 +244,7 @@ function main() {
   // fail-closed rule as run() above: a broken response is not an empty diff.
   // `changedFiles` rides the same query for free and is the only thing that
   // reveals the 100-file cap on `files` — see computeStats.
-  const raw = run("gh", ["pr", "view", String(pr), "--json", "files,changedFiles"]);
+  const raw = run("gh", ["pr", "view", String(pr), "--json", "files,changedFiles", ...(repo === null ? [] : ["-R", repo])]);
   let info;
   try {
     info = JSON.parse(raw);

package/scripts/fleet-event.mjs

@@ -49,6 +49,7 @@
 //       not on origin/main, and releases; any other answer, or a detail that
 //       opens with no sha, is a NEED and N is left untouched, claim and all.
 //       The PR a `covered` detail names is never written to.
+//       A `PR#M` outcome also sets the claim branch's upstream when it has none: `reap.sh` keeps a branch with no upstream, and only an upstream's `[gone]` state makes it reapable. It writes `branch.<b>.remote` and `branch.<b>.merge` only while the merge key is unset, and prints `NEED upstream <b> — <why>` when a write fails.
 //   fix-report <fix-pr-M[-x]>
 //       `settle --from-report`, which records the filings and rulings the
 //       report carries. Settled `applied:`/`no-op`, on a PR whose rows carry
@@ -512,8 +513,45 @@ function blocker(r) {
   return said(r);
 }
 
+// One word of a command printed for a human to paste. A branch name git
+// accepts can still carry `;`, `$`, a backtick or `'`, so any word outside a
+// plain charset is single-quoted, its own quotes closed, escaped and reopened.
+const shellWord = (s) => (/^[\w/.@%+=:,-]+$/.test(s) ? s : `'${s.replaceAll("'", "'\\''")}'`);
+
+// The claim branch's upstream, set once a PR is opened from it. Only the merge
+// key being unset triggers the write, so a configured upstream is never touched.
+function claimUpstream(ev, member) {
+  const read = ev.report(member);
+  if (read.state !== "ok") {
+    ev.need(`upstream of ${member}'s claim branch — its report ${read.path} is ${read.state}: set the upstream by hand`);
+    return;
+  }
+  const b = read.report.branch;
+  const want = `run git config ${shellWord(`branch.${b}.remote`)} origin && git config ${shellWord(`branch.${b}.merge`)} ${shellWord(`refs/heads/${b}`)}`;
+  const fail = (r) => ev.need(`upstream ${b} — ${said(r)}; ${want}`);
+  const exists = run("git", ["show-ref", "--verify", "--quiet", `refs/heads/${b}`]);
+  if (exists.status === 1) {
+    ev.note(`upstream ${b} not set: no local branch`);
+    return;
+  }
+  if (exists.status !== 0) return fail(exists);
+  const merge = run("git", ["config", "--get", `branch.${b}.merge`]);
+  if (merge.status === 0) {
+    ev.note(`upstream ${b} already set`);
+    return;
+  }
+  if (merge.status !== 1) return fail(merge);
+  const remote = run("git", ["config", `branch.${b}.remote`, "origin"]);
+  if (remote.status !== 0) return fail(remote);
+  const set = run("git", ["config", `branch.${b}.merge`, `refs/heads/${b}`]);
+  if (set.status !== 0) return fail(set);
+  ev.note(`upstream ${b} set`);
+}
+
 function implReport(ev, member) {
-  if (ev.settle(member) === "bailed") bailed(ev, member);
+  const outcome = ev.settle(member);
+  if (outcome === "bailed") bailed(ev, member);
+  else if (outcome?.startsWith("PR#")) claimUpstream(ev, member);
 }
 
 function fixReport(ev, member) {

package/scripts/reap.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Delete local branches whose upstream is gone, and their worktrees.
+# Delete local branches whose upstream is gone, and their worktrees. A branch with no upstream is reported as kept and never deleted.
 #
 # Dry-run by default; --apply mutates. Every precondition is recomputed inside
 # this invocation, because a branch list from an earlier call is already false:
@@ -683,12 +683,15 @@ null_head_why() {
 # away from them. %(refname) is always refs/heads/<name>, so the strip yields
 # the bare name for every branch, ambiguous or not.
 #
-# The $2=="[gone]" field test is deliberately untouched, and it still selects
-# the same branches: a space is not legal in a branch name (measured — git
-# refuses `has space` as invalid), so the name is always the whole of $1, and a
-# branch with no upstream leaves $2 empty rather than matching. The tracking
-# forms that DO carry a space, `[ahead 1]` and its siblings, split so that $2
-# holds `[ahead` — not `[gone]` either way.
+# The [gone] test reads $3 and the no-upstream test reads $2: a space is not
+# legal in a branch name (measured — git refuses `has space` as invalid), so
+# the name is always the whole of $1, and $2 is `upstream=` followed by
+# %(upstream)'s ref — exactly `upstream=` when the branch has none. The
+# tracking forms that DO carry a space, `[ahead 1]` and its siblings, split so
+# that $3 holds `[ahead` — not `[gone]` either way. That layout holds only
+# while the upstream ref carries no whitespace: %(upstream) is built from the
+# branch.<b>.merge value, which git does not validate, and a space there moves
+# the track out of $3 (measured, git 2.50.1).
 # A command substitution inside a `for ... in` word list discards its own
 # exit status entirely, in every shell measured here (bash, dash, macOS
 # /bin/sh): `for x in $(false); do …; done` completes at the loop's own end,
@@ -713,9 +716,13 @@ null_head_why() {
 # the same reason — dying here would also abort the second sweep and the
 # final `worktree prune`, neither of which this enumeration failing has
 # anything to do with, over a failure that only defers reaping to a later pass.
-if ! git_probe for-each-ref --format='%(refname) %(upstream:track)' refs/heads; then
+# `upstream=` makes an unset %(upstream) a field of its own. Without it the
+# whitespace split drops the empty field, and `$2` reads the track instead, so
+# `$2=="upstream="` is exactly the no-upstream case and `$3` the [gone] test.
+if ! git_probe for-each-ref --format='%(refname) upstream=%(upstream) %(upstream:track)' refs/heads; then
   keep "" "could not enumerate [gone] branches — none reaped, and none reported reapable either$(gp_why)"
   gone_branches=""
+  no_upstream=""
 else
   # git_probe captures git's stderr into $gp_err instead of leaving it on the
   # real fd — the whole reason it exists — and every OTHER call site in this
@@ -726,11 +733,20 @@ else
   # `git … | awk …` pipeline with git's stderr inherited, and now reaches no
   # one unless forwarded here explicitly.
   [ -z "$gp_err" ] || printf '%s' "$gp_err" >&2
-  if ! gone_branches=$(printf '%s\n' "$gp_out" | awk '$2=="[gone]"{sub(/^refs\/heads\//,"",$1); print $1}'); then
+  if ! gone_branches=$(printf '%s\n' "$gp_out" | awk '$3=="[gone]"{sub(/^refs\/heads\//,"",$1); print $1}'); then
     keep "" "could not enumerate [gone] branches — none reaped, and none reported reapable either"
     gone_branches=""
   fi
+  if ! no_upstream=$(printf '%s\n' "$gp_out" | awk '$2=="upstream="{sub(/^refs\/heads\//,"",$1); print $1}'); then
+    keep "" "could not enumerate branches with no upstream — none reported kept"
+    no_upstream=""
+  fi
 fi
+# A branch with no upstream has no [gone] state to act on. It is reported and
+# never selected for deletion, and no other guard runs on it.
+for b in $no_upstream; do
+  keep "$b" "no upstream — never selected"
+done
 for b in $gone_branches; do
 
   # The tip is read ONCE, here, and everything after it measures that frozen

package/scripts/review-core.mjs

@@ -115,6 +115,11 @@ export const SNAPSHOT_SCHEMA = {
     // printed instead of SNAPSHOT_TREE_MATCH. Optional, because a verified
     // snapshot has nothing to say here.
     repoError: { type: "string" },
+    // Only when the PR-capture block printed SNAPSHOT_REPO_UNRESOLVED: the
+    // error `gh` gave for the worktree's repository, verbatim. Optional, so a
+    // resolved repository has nothing to say here; present, it is the one
+    // record of why the review then runs with no diff and no sizing.
+    repoUnresolved: { type: "string" },
     diffStats: { type: "string" },
     diffPath: { type: "string" },
     diffLines: { type: "integer" },
@@ -1071,17 +1076,41 @@ bare \`git\` — reads or writes THERE. Add nothing relative to it, and
 chain a \`cd\` into "$RUN" or "$SNAP" for anything you run beyond it.
 
 Then capture the PR's diff for the specialists, plus the three facts the caller
-needs to judge whether it is usable:
-
-    gh pr diff ${pr} > "$RUN"/pr.diff
-    crossRepo=$(gh pr view ${pr} --json isCrossRepository -q .isCrossRepository)
-    branch=$(gh pr view ${pr} --json headRefName -q .headRefName)
-    ref=""
-    [ "$crossRepo" = "true" ] || ref=$(git -C ${worktree} ls-remote origin "refs/heads/$branch" | cut -f1)
-    [ -n "$ref" ] || ref=$(git -C ${worktree} ls-remote origin "refs/pull/${pr}/head" | cut -f1)
-    echo "$ref"
-    gh pr view ${pr} --json headRefOid -q .headRefOid
-    wc -l < "$RUN"/pr.diff
+needs to judge whether it is usable. Every 'gh' call here names the repository
+with -R, and that repository is the one 'gh repo view' resolves from inside the
+worktree: this dispatch starts in the controller's checkout, which may be a
+different repository from the worktree's, and a 'gh' with no -R reads whichever
+PR in THAT repository shares the number — a diff, a branch and a head that
+belong to another PR entirely, with nothing in the output saying so. It is
+gh's answer rather than the raw 'origin' URL because gh resolves a checkout's
+remotes through ssh-config host aliases ('git@my-alias:owner/repo.git') and -R
+does not: handed that URL raw, every read below fails. It is also the remote gh
+would pick for any command run in that checkout — 'origin', unless an
+'upstream' remote or 'gh repo set-default' names another:
+
+    REPO=$( { cd ${worktree} && gh repo view --json url -q .url; } 2>"$RUN"/repo.err )
+    if [ -n "$REPO" ]; then
+      gh pr diff ${pr} -R "$REPO" > "$RUN"/pr.diff
+      crossRepo=$(gh pr view ${pr} -R "$REPO" --json isCrossRepository -q .isCrossRepository)
+      branch=$(gh pr view ${pr} -R "$REPO" --json headRefName -q .headRefName)
+      ref=""
+      [ "$crossRepo" = "true" ] || ref=$(git -C ${worktree} ls-remote origin "refs/heads/$branch" | cut -f1)
+      [ -n "$ref" ] || ref=$(git -C ${worktree} ls-remote origin "refs/pull/${pr}/head" | cut -f1)
+      echo "$ref"
+      gh pr view ${pr} -R "$REPO" --json headRefOid -q .headRefOid
+      wc -l < "$RUN"/pr.diff
+    else
+      echo SNAPSHOT_REPO_UNRESOLVED
+      cat "$RUN"/repo.err
+    fi
+
+If the block printed SNAPSHOT_REPO_UNRESOLVED, no 'gh pr' read ran: gh could not
+name the worktree's repository, and the controller's own repository is never a
+substitute. Report \`repoUnresolved\` = every line the block printed after
+SNAPSHOT_REPO_UNRESOLVED, verbatim — gh's own reason, such as no remote, or no
+remote on a GitHub host it is logged in to — or 'no error output' if it printed
+none. Omit \`diffPath\`, \`diffLines\`, \`refHead\` and \`prHead\`, and run
+nothing else against the PR yourself.
 
 Report \`diffPath\` = the SNAPSHOT_RUN_ROOT value with '/pr.diff' appended, ONLY
 if 'gh pr diff' exited 0. Report \`refHead\` = the sha the 'echo "$ref"' line
@@ -1120,9 +1149,15 @@ Report \`uncovered\` = its stdout, one line of JSON copied verbatim, ONLY if it
 exited 0. If it exited non-zero, report \`uncoveredError\` = its stderr and omit
 \`uncovered\`. Run none of the steps it lists.
 
-Then size the diff:
+Then size the diff, naming the same repository for the same reason — diff-stats.mjs
+given no --repo reads the PR from the controller's checkout. This block resolves
+it again because it is a separate command; the capture block above already
+reported why when it could not:
 
-    ~/.fleet/bin/fleet-run diff-stats.mjs --pr ${pr}
+    REPO=$(cd ${worktree} && gh repo view --json url -q .url 2>/dev/null)
+    if [ -n "$REPO" ]; then ~/.fleet/bin/fleet-run diff-stats.mjs --pr ${pr} --repo "$REPO"; else echo SNAPSHOT_REPO_UNRESOLVED; fi
+
+If that printed SNAPSHOT_REPO_UNRESOLVED, omit \`diffStats\`.
 
 Report \`runRoot\` = the SNAPSHOT_RUN_ROOT value and \`path\` = the SNAPSHOT_DEST
 value, both copied verbatim. Each ends in a component the shell substituted —
@@ -1135,8 +1170,9 @@ specialists into another run's tree. Report the HEAD sha, and — in
 STDOUT, copied verbatim. Only runRoot, path, head, pathVerified and repoVerified
 are ever required — diffStats, diffPath, diffLines, refHead and prHead are each
 omitted independently when their command failed, repoError only accompanies
-a false repoVerified, installError only replaces installCmd and installExit,
-and uncoveredError only replaces uncovered.`,
+a false repoVerified, repoUnresolved only accompanies SNAPSHOT_REPO_UNRESOLVED,
+installError only replaces installCmd and installExit, and uncoveredError only
+replaces uncovered.`,
     { label: `snapshot${forPr}`, phase: "Snapshot", agentType: SNAPSHOT_AGENT_TYPE, schema: SNAPSHOT_SCHEMA },
   );
 
@@ -1164,7 +1200,7 @@ and uncoveredError only replaces uncovered.`,
   log(
     usable
       ? `diff ${usable} (${snap.diffLines} lines)`
-      : `no diff — diffPath=${snap.diffPath ?? "(absent)"} diffLines=${snap.diffLines ?? "(absent)"} refHead=${snap.refHead ?? "(absent)"} prHead=${snap.prHead ?? "(absent)"} head=${snap.head} — specialists get the fallback read rules`,
+      : `no diff — diffPath=${snap.diffPath ?? "(absent)"} diffLines=${snap.diffLines ?? "(absent)"} refHead=${snap.refHead ?? "(absent)"} prHead=${snap.prHead ?? "(absent)"} head=${snap.head}${typeof snap.repoUnresolved === "string" ? ` — repository unresolved: ${oneLine(snap.repoUnresolved) || "(no reason given)"}` : ""} — specialists get the fallback read rules`,
   );
 
   let stats = null;

package/skills/run-team/references/reaping.md

@@ -20,6 +20,7 @@ Skill is maintainer's to fix. Do not patch it; do reap yourself.
 Every precondition recomputed **inside** same command as delete:
 
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
+- **A branch with no upstream is reported `kept`, never selected.** `%(upstream)` is empty for it, so `%(upstream:track)` has no `[gone]` to match. The sweep reports it with reason `no upstream — never selected` and runs no other guard on it. Its upstream arrives with the first `-u` push, or when the controller settles the implementer's report.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
 - **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
 - **The delete is `git update-ref -d`'s compare-and-swap on a tip read once, authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D`, the delete this replaced. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.