@feigi/fleet-ctl 3.79.2 → 3.79.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.79.2",
+  "version": "3.79.3",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/claim-ticket.sh

@@ -289,9 +289,11 @@ else
   # computes `%(upstream:track)` against the REMOTE ref, and an upstream naming
   # a remote ref that has never existed reads as `[gone]`, not as "no upstream"
   # — measured, a freshly claimed branch was reaped by `reap.sh --apply` before
-  # any work was done in it. The real upstream arrives with the documented first
-  # push, `git push --force-with-lease -u origin HEAD` (skills/next-ticket/SKILL.md
-  # step 7; its no-lease fallback carries `-u` too), and only then can be `[gone]`.
+  # any work was done in it. The real upstream arrives with the first push with `-u`: the documented form,
+  # `git push --force-with-lease -u origin HEAD` (skills/next-ticket/SKILL.md
+  # step 7; its no-lease fallback carries `-u` too), or else when the controller
+  # settles the implementer's report, which writes it. Only then can the branch
+  # be `[gone]`. Until then reap.sh reports it kept.
   #
   # `--no-track` is also why no branch delete uses `-d`: `-d` measures an
   # upstream-less branch against local HEAD, refusing a pristine claim behind

package/scripts/fleet-event.mjs

@@ -49,6 +49,7 @@
 //       not on origin/main, and releases; any other answer, or a detail that
 //       opens with no sha, is a NEED and N is left untouched, claim and all.
 //       The PR a `covered` detail names is never written to.
+//       A `PR#M` outcome also sets the claim branch's upstream when it has none: `reap.sh` keeps a branch with no upstream, and only an upstream's `[gone]` state makes it reapable. It writes `branch.<b>.remote` and `branch.<b>.merge` only while the merge key is unset, and prints `NEED upstream <b> — <why>` when a write fails.
 //   fix-report <fix-pr-M[-x]>
 //       `settle --from-report`, which records the filings and rulings the
 //       report carries. Settled `applied:`/`no-op`, on a PR whose rows carry
@@ -512,8 +513,45 @@ function blocker(r) {
   return said(r);
 }
 
+// One word of a command printed for a human to paste. A branch name git
+// accepts can still carry `;`, `$`, a backtick or `'`, so any word outside a
+// plain charset is single-quoted, its own quotes closed, escaped and reopened.
+const shellWord = (s) => (/^[\w/.@%+=:,-]+$/.test(s) ? s : `'${s.replaceAll("'", "'\\''")}'`);
+
+// The claim branch's upstream, set once a PR is opened from it. Only the merge
+// key being unset triggers the write, so a configured upstream is never touched.
+function claimUpstream(ev, member) {
+  const read = ev.report(member);
+  if (read.state !== "ok") {
+    ev.need(`upstream of ${member}'s claim branch — its report ${read.path} is ${read.state}: set the upstream by hand`);
+    return;
+  }
+  const b = read.report.branch;
+  const want = `run git config ${shellWord(`branch.${b}.remote`)} origin && git config ${shellWord(`branch.${b}.merge`)} ${shellWord(`refs/heads/${b}`)}`;
+  const fail = (r) => ev.need(`upstream ${b} — ${said(r)}; ${want}`);
+  const exists = run("git", ["show-ref", "--verify", "--quiet", `refs/heads/${b}`]);
+  if (exists.status === 1) {
+    ev.note(`upstream ${b} not set: no local branch`);
+    return;
+  }
+  if (exists.status !== 0) return fail(exists);
+  const merge = run("git", ["config", "--get", `branch.${b}.merge`]);
+  if (merge.status === 0) {
+    ev.note(`upstream ${b} already set`);
+    return;
+  }
+  if (merge.status !== 1) return fail(merge);
+  const remote = run("git", ["config", `branch.${b}.remote`, "origin"]);
+  if (remote.status !== 0) return fail(remote);
+  const set = run("git", ["config", `branch.${b}.merge`, `refs/heads/${b}`]);
+  if (set.status !== 0) return fail(set);
+  ev.note(`upstream ${b} set`);
+}
+
 function implReport(ev, member) {
-  if (ev.settle(member) === "bailed") bailed(ev, member);
+  const outcome = ev.settle(member);
+  if (outcome === "bailed") bailed(ev, member);
+  else if (outcome?.startsWith("PR#")) claimUpstream(ev, member);
 }
 
 function fixReport(ev, member) {

package/scripts/reap.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Delete local branches whose upstream is gone, and their worktrees.
+# Delete local branches whose upstream is gone, and their worktrees. A branch with no upstream is reported as kept and never deleted.
 #
 # Dry-run by default; --apply mutates. Every precondition is recomputed inside
 # this invocation, because a branch list from an earlier call is already false:
@@ -683,12 +683,15 @@ null_head_why() {
 # away from them. %(refname) is always refs/heads/<name>, so the strip yields
 # the bare name for every branch, ambiguous or not.
 #
-# The $2=="[gone]" field test is deliberately untouched, and it still selects
-# the same branches: a space is not legal in a branch name (measured — git
-# refuses `has space` as invalid), so the name is always the whole of $1, and a
-# branch with no upstream leaves $2 empty rather than matching. The tracking
-# forms that DO carry a space, `[ahead 1]` and its siblings, split so that $2
-# holds `[ahead` — not `[gone]` either way.
+# The [gone] test reads $3 and the no-upstream test reads $2: a space is not
+# legal in a branch name (measured — git refuses `has space` as invalid), so
+# the name is always the whole of $1, and $2 is `upstream=` followed by
+# %(upstream)'s ref — exactly `upstream=` when the branch has none. The
+# tracking forms that DO carry a space, `[ahead 1]` and its siblings, split so
+# that $3 holds `[ahead` — not `[gone]` either way. That layout holds only
+# while the upstream ref carries no whitespace: %(upstream) is built from the
+# branch.<b>.merge value, which git does not validate, and a space there moves
+# the track out of $3 (measured, git 2.50.1).
 # A command substitution inside a `for ... in` word list discards its own
 # exit status entirely, in every shell measured here (bash, dash, macOS
 # /bin/sh): `for x in $(false); do …; done` completes at the loop's own end,
@@ -713,9 +716,13 @@ null_head_why() {
 # the same reason — dying here would also abort the second sweep and the
 # final `worktree prune`, neither of which this enumeration failing has
 # anything to do with, over a failure that only defers reaping to a later pass.
-if ! git_probe for-each-ref --format='%(refname) %(upstream:track)' refs/heads; then
+# `upstream=` makes an unset %(upstream) a field of its own. Without it the
+# whitespace split drops the empty field, and `$2` reads the track instead, so
+# `$2=="upstream="` is exactly the no-upstream case and `$3` the [gone] test.
+if ! git_probe for-each-ref --format='%(refname) upstream=%(upstream) %(upstream:track)' refs/heads; then
   keep "" "could not enumerate [gone] branches — none reaped, and none reported reapable either$(gp_why)"
   gone_branches=""
+  no_upstream=""
 else
   # git_probe captures git's stderr into $gp_err instead of leaving it on the
   # real fd — the whole reason it exists — and every OTHER call site in this
@@ -726,11 +733,20 @@ else
   # `git … | awk …` pipeline with git's stderr inherited, and now reaches no
   # one unless forwarded here explicitly.
   [ -z "$gp_err" ] || printf '%s' "$gp_err" >&2
-  if ! gone_branches=$(printf '%s\n' "$gp_out" | awk '$2=="[gone]"{sub(/^refs\/heads\//,"",$1); print $1}'); then
+  if ! gone_branches=$(printf '%s\n' "$gp_out" | awk '$3=="[gone]"{sub(/^refs\/heads\//,"",$1); print $1}'); then
     keep "" "could not enumerate [gone] branches — none reaped, and none reported reapable either"
     gone_branches=""
   fi
+  if ! no_upstream=$(printf '%s\n' "$gp_out" | awk '$2=="upstream="{sub(/^refs\/heads\//,"",$1); print $1}'); then
+    keep "" "could not enumerate branches with no upstream — none reported kept"
+    no_upstream=""
+  fi
 fi
+# A branch with no upstream has no [gone] state to act on. It is reported and
+# never selected for deletion, and no other guard runs on it.
+for b in $no_upstream; do
+  keep "$b" "no upstream — never selected"
+done
 for b in $gone_branches; do
 
   # The tip is read ONCE, here, and everything after it measures that frozen

package/skills/run-team/references/reaping.md

@@ -20,6 +20,7 @@ Skill is maintainer's to fix. Do not patch it; do reap yourself.
 Every precondition recomputed **inside** same command as delete:
 
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
+- **A branch with no upstream is reported `kept`, never selected.** `%(upstream)` is empty for it, so `%(upstream:track)` has no `[gone]` to match. The sweep reports it with reason `no upstream — never selected` and runs no other guard on it. Its upstream arrives with the first `-u` push, or when the controller settles the implementer's report.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
 - **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
 - **The delete is `git update-ref -d`'s compare-and-swap on a tip read once, authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D`, the delete this replaced. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.