@feigi/fleet-ctl 3.79.2 → 3.79.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.79.2",
+  "version": "3.79.4",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/claim-ticket.sh

@@ -289,9 +289,11 @@ else
   # computes `%(upstream:track)` against the REMOTE ref, and an upstream naming
   # a remote ref that has never existed reads as `[gone]`, not as "no upstream"
   # — measured, a freshly claimed branch was reaped by `reap.sh --apply` before
-  # any work was done in it. The real upstream arrives with the documented first
-  # push, `git push --force-with-lease -u origin HEAD` (skills/next-ticket/SKILL.md
-  # step 7; its no-lease fallback carries `-u` too), and only then can be `[gone]`.
+  # any work was done in it. The real upstream arrives with the first push with `-u`: the documented form,
+  # `git push --force-with-lease -u origin HEAD` (skills/next-ticket/SKILL.md
+  # step 7; its no-lease fallback carries `-u` too), or else when the controller
+  # settles the implementer's report, which writes it. Only then can the branch
+  # be `[gone]`. Until then reap.sh reports it kept.
   #
   # `--no-track` is also why no branch delete uses `-d`: `-d` measures an
   # upstream-less branch against local HEAD, refusing a pristine claim behind

package/scripts/fleet-event.mjs

@@ -49,6 +49,7 @@
 //       not on origin/main, and releases; any other answer, or a detail that
 //       opens with no sha, is a NEED and N is left untouched, claim and all.
 //       The PR a `covered` detail names is never written to.
+//       A `PR#M` outcome also sets the claim branch's upstream when it has none: `reap.sh` keeps a branch with no upstream, and only an upstream's `[gone]` state makes it reapable. It writes `branch.<b>.remote` and `branch.<b>.merge` only while the merge key is unset, and prints `NEED upstream <b> — <why>` when a write fails.
 //   fix-report <fix-pr-M[-x]>
 //       `settle --from-report`, which records the filings and rulings the
 //       report carries. Settled `applied:`/`no-op`, on a PR whose rows carry
@@ -512,8 +513,45 @@ function blocker(r) {
   return said(r);
 }
 
+// One word of a command printed for a human to paste. A branch name git
+// accepts can still carry `;`, `$`, a backtick or `'`, so any word outside a
+// plain charset is single-quoted, its own quotes closed, escaped and reopened.
+const shellWord = (s) => (/^[\w/.@%+=:,-]+$/.test(s) ? s : `'${s.replaceAll("'", "'\\''")}'`);
+
+// The claim branch's upstream, set once a PR is opened from it. Only the merge
+// key being unset triggers the write, so a configured upstream is never touched.
+function claimUpstream(ev, member) {
+  const read = ev.report(member);
+  if (read.state !== "ok") {
+    ev.need(`upstream of ${member}'s claim branch — its report ${read.path} is ${read.state}: set the upstream by hand`);
+    return;
+  }
+  const b = read.report.branch;
+  const want = `run git config ${shellWord(`branch.${b}.remote`)} origin && git config ${shellWord(`branch.${b}.merge`)} ${shellWord(`refs/heads/${b}`)}`;
+  const fail = (r) => ev.need(`upstream ${b} — ${said(r)}; ${want}`);
+  const exists = run("git", ["show-ref", "--verify", "--quiet", `refs/heads/${b}`]);
+  if (exists.status === 1) {
+    ev.note(`upstream ${b} not set: no local branch`);
+    return;
+  }
+  if (exists.status !== 0) return fail(exists);
+  const merge = run("git", ["config", "--get", `branch.${b}.merge`]);
+  if (merge.status === 0) {
+    ev.note(`upstream ${b} already set`);
+    return;
+  }
+  if (merge.status !== 1) return fail(merge);
+  const remote = run("git", ["config", `branch.${b}.remote`, "origin"]);
+  if (remote.status !== 0) return fail(remote);
+  const set = run("git", ["config", `branch.${b}.merge`, `refs/heads/${b}`]);
+  if (set.status !== 0) return fail(set);
+  ev.note(`upstream ${b} set`);
+}
+
 function implReport(ev, member) {
-  if (ev.settle(member) === "bailed") bailed(ev, member);
+  const outcome = ev.settle(member);
+  if (outcome === "bailed") bailed(ev, member);
+  else if (outcome?.startsWith("PR#")) claimUpstream(ev, member);
 }
 
 function fixReport(ev, member) {

package/scripts/ledger.mjs

@@ -134,10 +134,14 @@ function cause(...candidates) {
 // one stall can EXCEED it — up to GIT_TIMEOUT_MS + 20 s — when `gh` still
 // runs (measured). `check`'s worst case is the sum of whichever of its
 // children actually stall, not a single fixed term. That is three children
-// normally; in those layouts it is three git children, and `gh` is a fourth
-// only where the ledger's repository still has a work tree (a submodule) —
-// in the `.bare`, bare and `--separate-git-dir` layouts repoCheck() fails
-// and `gh` never runs (measured).
+// normally; in those layouts it is three git children and `gh` is a fourth.
+// Where the ledger's repository has no work tree (the `.bare` layout, a bare
+// repository, a `--separate-git-dir` clone; not a submodule) repoCheck()'s
+// `--show-toplevel` is refused and it asks the same directory for
+// `--git-common-dir` to bind `gh` to, so there it is four git children and
+// `gh` a fifth. `gh` runs in every one of those layouts. With `--file` the
+// fleetFile() children drop out: two children normally, three where the
+// repository has no work tree.
 //
 // `LEDGER_GIT_TIMEOUT` is this script's OWN override, in seconds, and it can
 // only ever SHORTEN. The rule and the reasons for it are net_budget's, in
@@ -156,6 +160,13 @@ function gitBudget(defaultSeconds, override) {
 }
 const GIT_TIMEOUT_MS = gitBudget(10, process.env.LEDGER_GIT_TIMEOUT);
 
+// What `git rev-parse --show-toplevel` says (exit 128, under LC_ALL=C) in a
+// repository that has no work tree to name. NOT fleet-dir.mjs's
+// NOT_A_WORK_TREE, which also matches "not a git repository": that one is
+// "there is nothing here", this one is "there is a repository, and it has no
+// work tree", and only the second leaves a repository for `gh` to bind to.
+const NO_WORK_TREE = /must be run in a work tree/;
+
 // There is ONE ledger per run, and it lives in the main checkout. Members run
 // from their own worktrees, where a cwd-relative `.fleet/ledger.md` does not
 // exist — `check` then warns and reports every subject as safe to file, which
@@ -1144,10 +1155,12 @@ function runCheck() {
     // the repo) the two agree, but an explicit --file naming a ledger
     // outside the caller's repo diverges silently: the query searches the
     // wrong tracker and reports a confident, empty result. Bind gh's
-    // cwd to the ledger's OWN repository instead of leaving it implicit. No
-    // --repo flag needed — gh's remote-based resolution does the rest once it
-    // is pointed at the right directory, and a worktree ledger (shared .git,
-    // own working tree) still resolves to the same repo either way.
+    // cwd to the ledger's OWN repository instead of leaving it implicit —
+    // its work tree's root, or its common git dir where it has no work tree
+    // (see the probe below). No --repo flag needed — gh's remote-based
+    // resolution does the rest once it is pointed at the right directory,
+    // and a worktree ledger (shared .git, own working tree) still resolves
+    // to the same repo either way.
     //
     // cwd is not the whole story: inherited git vars outrank it, so an
     // ambient GIT_DIR/GIT_WORK_TREE retargets BOTH the probe below and gh's
@@ -1181,7 +1194,27 @@ function runCheck() {
     // the missing directory instead reported every first `check` as not being
     // in a repository and dropped the tracker query outright.
     while (!existsSync(ledgerDir) && dirname(ledgerDir) !== ledgerDir) ledgerDir = dirname(ledgerDir);
-    const repoCheck = spawnSync("git", ["-C", ledgerDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", env: queryEnv, timeout: GIT_TIMEOUT_MS });
+    // LC_ALL=C on this probe alone: the no-work-tree refusal below is told
+    // apart from every other failure by git's own wording, which a translated
+    // git would otherwise spell differently. gh keeps `queryEnv` untouched.
+    const probeEnv = { ...queryEnv, LC_ALL: "C" };
+    let repoCheck = spawnSync("git", ["-C", ledgerDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", env: probeEnv, timeout: GIT_TIMEOUT_MS });
+    // A repository with no work tree — the `.bare` layout and its linked
+    // worktrees, a bare repository, a `--separate-git-dir` clone — is where
+    // fleetFile() puts the ledger INSIDE the git dir or beside it, and git
+    // refuses `--show-toplevel` there ("must be run in a work tree", exit
+    // 128). That is not "no repository": the same directory answers
+    // `--git-common-dir`, and `gh` resolves its remote from a git dir just as
+    // it does from a checkout (measured on a bare repository with a remote).
+    // Bind to the common git dir — the very repository fleetFile() resolved
+    // the ledger against — never to this process's cwd. ONLY that refusal
+    // gets this: "not a git repository", git missing, a dubious-ownership
+    // refusal, an unreadable gitfile and a probe killed at its bound all stay
+    // on the failure branch below, and so does a second probe that fails.
+    const noWorkTree = repoCheck.status === 128 && NO_WORK_TREE.test(repoCheck.stderr);
+    if (noWorkTree) {
+      repoCheck = spawnSync("git", ["-C", ledgerDir, "rev-parse", "--git-common-dir"], { encoding: "utf8", env: probeEnv, timeout: GIT_TIMEOUT_MS });
+    }
     if (repoCheck.status !== 0) {
       // More than one cause lands here: a ledger path genuinely outside any
       // repository, but also git missing entirely (spawn ENOENT, so `status`
@@ -1225,7 +1258,13 @@ function runCheck() {
       const why = cause(repoCheck.error && repoCheck.error.message, repoCheck.stderr);
       tracker = { ok: false, query, error: `cannot resolve the ledger's repository (${ledgerDir})${why ? `: ${why}` : ""}` };
     } else {
-      const ghCwd = repoCheck.stdout.trim();
+      // The work tree's root, or the common git dir where the repository has
+      // no work tree. `--git-common-dir` may answer relative to the directory
+      // it ran in (`.` when that is the git dir itself) or absolute, and
+      // resolve() takes either. Read only past the status check above: a
+      // probe that never spawned (git missing) leaves `stdout` undefined.
+      const probed = repoCheck.stdout.trim();
+      const ghCwd = noWorkTree ? resolve(ledgerDir, probed) : probed;
       try {
         const out = execFileSync(
           "gh",

package/scripts/reap.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Delete local branches whose upstream is gone, and their worktrees.
+# Delete local branches whose upstream is gone, and their worktrees. A branch with no upstream is reported as kept and never deleted.
 #
 # Dry-run by default; --apply mutates. Every precondition is recomputed inside
 # this invocation, because a branch list from an earlier call is already false:
@@ -683,12 +683,15 @@ null_head_why() {
 # away from them. %(refname) is always refs/heads/<name>, so the strip yields
 # the bare name for every branch, ambiguous or not.
 #
-# The $2=="[gone]" field test is deliberately untouched, and it still selects
-# the same branches: a space is not legal in a branch name (measured — git
-# refuses `has space` as invalid), so the name is always the whole of $1, and a
-# branch with no upstream leaves $2 empty rather than matching. The tracking
-# forms that DO carry a space, `[ahead 1]` and its siblings, split so that $2
-# holds `[ahead` — not `[gone]` either way.
+# The [gone] test reads $3 and the no-upstream test reads $2: a space is not
+# legal in a branch name (measured — git refuses `has space` as invalid), so
+# the name is always the whole of $1, and $2 is `upstream=` followed by
+# %(upstream)'s ref — exactly `upstream=` when the branch has none. The
+# tracking forms that DO carry a space, `[ahead 1]` and its siblings, split so
+# that $3 holds `[ahead` — not `[gone]` either way. That layout holds only
+# while the upstream ref carries no whitespace: %(upstream) is built from the
+# branch.<b>.merge value, which git does not validate, and a space there moves
+# the track out of $3 (measured, git 2.50.1).
 # A command substitution inside a `for ... in` word list discards its own
 # exit status entirely, in every shell measured here (bash, dash, macOS
 # /bin/sh): `for x in $(false); do …; done` completes at the loop's own end,
@@ -713,9 +716,13 @@ null_head_why() {
 # the same reason — dying here would also abort the second sweep and the
 # final `worktree prune`, neither of which this enumeration failing has
 # anything to do with, over a failure that only defers reaping to a later pass.
-if ! git_probe for-each-ref --format='%(refname) %(upstream:track)' refs/heads; then
+# `upstream=` makes an unset %(upstream) a field of its own. Without it the
+# whitespace split drops the empty field, and `$2` reads the track instead, so
+# `$2=="upstream="` is exactly the no-upstream case and `$3` the [gone] test.
+if ! git_probe for-each-ref --format='%(refname) upstream=%(upstream) %(upstream:track)' refs/heads; then
   keep "" "could not enumerate [gone] branches — none reaped, and none reported reapable either$(gp_why)"
   gone_branches=""
+  no_upstream=""
 else
   # git_probe captures git's stderr into $gp_err instead of leaving it on the
   # real fd — the whole reason it exists — and every OTHER call site in this
@@ -726,11 +733,20 @@ else
   # `git … | awk …` pipeline with git's stderr inherited, and now reaches no
   # one unless forwarded here explicitly.
   [ -z "$gp_err" ] || printf '%s' "$gp_err" >&2
-  if ! gone_branches=$(printf '%s\n' "$gp_out" | awk '$2=="[gone]"{sub(/^refs\/heads\//,"",$1); print $1}'); then
+  if ! gone_branches=$(printf '%s\n' "$gp_out" | awk '$3=="[gone]"{sub(/^refs\/heads\//,"",$1); print $1}'); then
     keep "" "could not enumerate [gone] branches — none reaped, and none reported reapable either"
     gone_branches=""
   fi
+  if ! no_upstream=$(printf '%s\n' "$gp_out" | awk '$2=="upstream="{sub(/^refs\/heads\//,"",$1); print $1}'); then
+    keep "" "could not enumerate branches with no upstream — none reported kept"
+    no_upstream=""
+  fi
 fi
+# A branch with no upstream has no [gone] state to act on. It is reported and
+# never selected for deletion, and no other guard runs on it.
+for b in $no_upstream; do
+  keep "$b" "no upstream — never selected"
+done
 for b in $gone_branches; do
 
   # The tip is read ONCE, here, and everything after it measures that frozen

package/skills/run-team/references/reaping.md

@@ -20,6 +20,7 @@ Skill is maintainer's to fix. Do not patch it; do reap yourself.
 Every precondition recomputed **inside** same command as delete:
 
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
+- **A branch with no upstream is reported `kept`, never selected.** `%(upstream)` is empty for it, so `%(upstream:track)` has no `[gone]` to match. The sweep reports it with reason `no upstream — never selected` and runs no other guard on it. Its upstream arrives with the first `-u` push, or when the controller settles the implementer's report.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
 - **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
 - **The delete is `git update-ref -d`'s compare-and-swap on a tip read once, authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D`, the delete this replaced. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.