@feigi/fleet-ctl 3.91.0 → 3.91.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.91.0",
+  "version": "3.91.2",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/board-gather.mjs

@@ -412,10 +412,11 @@ export function mapCi(ciJson, pr) {
 // A receipt with no session to give is `{ error }`, which the panel shows:
 // the board names no session rather than guessing one. So is a recorded
 // session whose NAME is not an omp `<ISO>_<uuid>` session directory:
-// phase0.mjs accepts any existing directory as the session, so a `--session`
-// naming the encoded-cwd project dir instead of its own session child lands in
-// the receipt, and readOmpSpend would book every session under it — the
-// controller's own main-session transcript included — as this run's agents.
+// phase0.mjs refuses a directory with no `<dir>.jsonl` beside it, but a
+// receipt it wrote before that refusal, or one written by hand, can record the
+// encoded-cwd project dir instead of its own session child, and readOmpSpend
+// would book every session under it — the controller's own main-session
+// transcript included — as this run's agents.
 // A recorded directory that does not exist yet is not an error — that is
 // gatherSpend()'s quiet `null`, below.
 export function receiptSpendDir(stateDir) {

package/scripts/ledger.mjs

@@ -1984,7 +1984,8 @@ function checkReaders(where) {
   // A `gh pr view --json <fields>` answer: an object whose every requested
   // field has the type that field has. Anything else was not what was asked
   // for, so it could not look.
-  const prFieldOk = { state: (v) => typeof v === "string", labels: Array.isArray, closingIssuesReferences: Array.isArray };
+  const isString = (v) => typeof v === "string";
+  const prFieldOk = { state: isString, labels: Array.isArray, closingIssuesReferences: Array.isArray, url: isString };
   const prView = (pr, fields) => {
     const what = `gh pr view ${pr} --json ${fields}`;
     const { r, v } = lookJson(what, ["pr", "view", String(pr), "--json", fields]);
@@ -1997,6 +1998,34 @@ function checkReaders(where) {
     }
     return v;
   };
+  // PR `pr`'s prView() answer to `fields`, which name closingIssuesReferences
+  // and url, as `view`, with the issue numbers, unique, of its closing
+  // references that are in the PR's own repository: its url less
+  // `/pull/<pr>`. A reference is in it when its url is that repository's
+  // `/issues/<number>`, or, carrying no url, when its repository's
+  // `<owner>/<name>` ends that repository's url. A reference with no integer
+  // number, or with neither a url nor a repository to place it by, could not
+  // look: it is never taken for the PR's own repository's.
+  const prViewClosing = (pr, fields) => {
+    const view = prView(pr, fields);
+    const what = `gh pr view ${pr} --json ${fields}`;
+    const suffix = `/pull/${pr}`;
+    if (!view.url.endsWith(suffix)) die(`${where}: could not look — ${what} answered url ${view.url}, not PR #${pr}'s; nothing written`);
+    const own = view.url.slice(0, -suffix.length);
+    const str = (v) => typeof v === "string" && v !== "";
+    const numbers = new Set();
+    for (const ref of view.closingIssuesReferences) {
+      const n = ref?.number;
+      if (!Number.isInteger(n)) die(`${where}: could not look — ${what} answered a reference with no issue number; nothing written`);
+      const repo = ref.repository;
+      let isOwn;
+      if (str(ref.url)) isOwn = ref.url === `${own}/issues/${n}`;
+      else if (str(repo?.name) && str(repo?.owner?.login)) isOwn = own.endsWith(`/${repo.owner.login}/${repo.name}`);
+      else die(`${where}: could not look — ${what} answered a reference to #${n} with neither a url nor a repository; nothing written`);
+      if (isOwn) numbers.add(n);
+    }
+    return { view, numbers: [...numbers] };
+  };
   // The title of issue `n`, as `gh issue view <n> --json title` answers it.
   const issueTitle = (n) => {
     const what = `gh issue view ${n} --json title`;
@@ -2006,28 +2035,27 @@ function checkReaders(where) {
     }
     return v.title;
   };
-  return { repoDir, look, verifyShaOf, prView, issueTitle };
+  return { repoDir, look, verifyShaOf, prView, prViewClosing, issueTitle };
 }
 
 // The finisher gate's closing-reference checks for the PR `member` finishes,
-// read off the PR's closingIssuesReferences and the titles of the issues it
-// names; its second argument is rulingOf()'s answer, which let the PR
-// through. Check 1, when a settled implementer's token names the PR: each
-// ticket it names is closed by the body when the PR's ruling is
-// closed_own_ticket=yes, and is not when the ruling is no. Check 2, for every
-// PR: no reference may be the suggestion-band record of this PR's review — an
-// issue whose title, trimmed, is recordTitle(), as dispositions-check.mjs
-// finds the record. Returns one line per failure. A read the checks need
-// dies, naming the read, and writes nothing.
+// read off the PR's closingIssuesReferences in its own repository — a
+// reference into another repository closes no issue here, whatever its
+// number — and the titles of the issues they name; its second argument is
+// rulingOf()'s answer, which let the PR through. Check 1, when a settled
+// implementer's token names the PR: each ticket it names is closed by the
+// body when the PR's ruling is closed_own_ticket=yes, and is not when the
+// ruling is no. Check 2, for every PR: no reference may be the
+// suggestion-band record of this PR's review — an issue whose title, trimmed,
+// is recordTitle(), as dispositions-check.mjs finds the record. Returns one
+// line per failure. A read the checks need dies, naming the read, and writes
+// nothing.
 async function closingRefusals(member, { tickets, ruling, tsv }) {
   const pr = member.number;
   const where = `dispatch ${member.name}`;
   const { recordTitle } = await import("./dispositions-check.mjs");
-  const { prView, issueTitle } = checkReaders(where);
-  const refs = [...new Set(prView(pr, "closingIssuesReferences").closingIssuesReferences.map((r) => r?.number))];
-  if (!refs.every(Number.isInteger)) {
-    die(`${where}: could not look — gh pr view ${pr} --json closingIssuesReferences answered a reference with no issue number; nothing written`);
-  }
+  const { prViewClosing, issueTitle } = checkReaders(where);
+  const refs = prViewClosing(pr, "closingIssuesReferences,url").numbers;
   const failures = [];
   if (tickets.length > 0) {
     const verdict = ruling.closed_own_ticket;
@@ -2491,7 +2519,8 @@ function recordFiled(id, subject) {
 // checked before anything is written:
 //
 //   impl-N=PR#M               verify-sha.sh <branch> <head> exits 0; PR M
-//                             reads OPEN and its closingIssuesReferences name N;
+//                             reads OPEN and its closingIssuesReferences in its
+//                             own repository name N;
 //                             the Check-step record (below) holds for <head>
 //   impl-N=bailed             bailCause is not null; the receipt names it
 //   fix-pr-M=applied:<head>   origin's refs/heads/<branch> is <head>, fetched
@@ -2603,7 +2632,7 @@ async function runSettleFromReport() {
   if (report.member !== member) invalid(`$.member: ${JSON.stringify(report.member)} is not ${member}`);
 
   // The gh and git reads this check makes, shared with the finisher gate.
-  const { repoDir, look, verifyShaOf, prView } = checkReaders(where);
+  const { repoDir, look, verifyShaOf, prView, prViewClosing } = checkReaders(where);
   // origin's head of `branch`, or null when origin has no such branch.
   const remoteHead = (branch) => {
     const ref = `refs/heads/${branch}`;
@@ -2653,9 +2682,9 @@ async function runSettleFromReport() {
       const sha = verifyShaOf(report.branch, report.head);
       check(`verify-sha.sh ${report.branch} ${report.head} exits 0`, sha.status === 0);
       recipeGate(report.head);
-      const pr = prView(report.pr, "state,closingIssuesReferences");
+      const { view: pr, numbers } = prViewClosing(report.pr, "state,closingIssuesReferences,url");
       check(`PR #${report.pr} reads OPEN`, pr.state === "OPEN");
-      check(`PR #${report.pr} closes #${live.number}`, pr.closingIssuesReferences.some((c) => c?.number === live.number));
+      check(`PR #${report.pr} closes #${live.number}`, numbers.includes(live.number));
     } else {
       outcome = "bailed";
       check(`bailCause: ${report.bailCause}`, report.bailCause !== null);

package/scripts/phase0.mjs

@@ -8,9 +8,11 @@
 // The session directory is `--session`, else `PI_ARTIFACTS_DIR`, which omp
 // exports to its Python eval kernel and the processes that kernel starts (the
 // bash tool's environment does not carry it); with neither, exit 2. It is
-// accepted when it is an existing directory, or when `<dir>.jsonl` exists
-// beside it — omp creates the directory when the session's first subagent
-// writes there.
+// accepted when `<dir>.jsonl` exists beside it and the path is a directory or
+// does not exist yet — omp creates the directory when the session's first
+// subagent writes there. An existing directory with no `<dir>.jsonl` beside
+// it names no session (the directory holding every session of a checkout is
+// one): from either source it exits 2 naming the path, writing no receipt.
 //
 // Reached through the Resolver and run from the MAIN checkout (a linked
 // worktree refuses: the checks below judge the checkout the controller reads
@@ -528,15 +530,19 @@ function main() {
   }
   const source = given === null ? "PI_ARTIFACTS_DIR" : "--session";
   const session = resolve(given ?? fromEnv);
-  // An existing directory, or `<session>.jsonl` beside a path that does not
-  // exist yet: omp creates the directory when the session's first subagent
-  // writes there.
+  // A session is named by its transcript, `<session>.jsonl`, beside the
+  // directory: an existing directory with none beside it — the one holding
+  // every session of a checkout, say — names no session. The directory itself
+  // may not exist yet: omp creates it when the session's first subagent writes
+  // there.
+  const transcript = existsSync(`${session}.jsonl`);
   try {
     if (!statSync(session).isDirectory()) die(`${source} ${session} is not a directory`);
+    if (!transcript) die(`${source} ${session} has no ${session}.jsonl beside it, so it names no session`);
   } catch (e) {
     if (e.code === undefined) throw e;
     if (e.code !== "ENOENT") die(`${source} ${session} is not readable (${e.code})`);
-    if (!existsSync(`${session}.jsonl`)) die(`${source} ${session} does not exist, and no ${session}.jsonl beside it names a session`);
+    if (!transcript) die(`${source} ${session} does not exist, and no ${session}.jsonl beside it names a session`);
   }
   const positive = (name) => {
     const n = F.numArg(name);

package/skills/run-team/references/finisher.md

@@ -117,7 +117,7 @@ and will act on it. Relay everything — reversals too — then dispatch.
   append` command to run. Any row for the PR passes, so a replacement finisher
   is never held once the first passed; a PR no such token names is not gated.
   No flag skips it: a PR `append` refuses is fixed on the ledger, as at close-out.
-- **The PR's closing references match its ruling and exclude its own suggestion-band record** → `ledger.mjs dispatch` reads the PR's `closingIssuesReferences` from `gh pr view <M>` before it dispatches any finisher. When the ruled row says `closed_own_ticket=yes`, each ticket a settled `impl-<N>=PR#<M>` token names must be closed by the body (`Closes #<N>`); when it says `no`, none may be, and no reference may be the PR's own suggestion-band record. A blank verdict is refused until it is set. A refusal names the PR and the ticket. The controller repairs the body itself with `gh pr edit <M> --body-file <file>`, then dispatches the finisher again. A `gh` read that fails refuses the dispatch and writes nothing.
+- **The PR's closing references match its ruling and exclude its own suggestion-band record** → `ledger.mjs dispatch` reads the PR's `closingIssuesReferences` from `gh pr view <M>` before it dispatches any finisher, counting only those in the PR's own repository: a reference into another repository closes none of this repository's tickets, whatever its number. When the ruled row says `closed_own_ticket=yes`, each ticket a settled `impl-<N>=PR#<M>` token names must be closed by the body (`Closes #<N>`); when it says `no`, none may be, and no reference may be the PR's own suggestion-band record. A blank verdict is refused until it is set. A refusal names the PR and the ticket. The controller repairs the body itself with `gh pr edit <M> --body-file <file>`, then dispatches the finisher again. A `gh` read that fails refuses the dispatch and writes nothing.
 
 Gate on the `check` job, **not** on `ci-state --quiet` exit 0: a behind PR never
 reaches full green, so an exit-0 gate strands it unlabelled. The finisher reads

package/skills/run-team/references/phase-0.md

@@ -7,7 +7,12 @@ environment carries `PI_ARTIFACTS_DIR`, this run's own session directory,
 which phase 0 records in its receipt; the bash tool's does not, so there
 phase 0 exits 2. `expanduser` is required: a literal `~/…` fails with
 `FileNotFoundError`. So is the `stderr` redirect: the cell never shows a
-child's stderr. `--session <dir>` overrides the variable.
+child's stderr. `--session <dir>` overrides the variable. Either way the
+directory must have its transcript `<dir>.jsonl` beside it; the directory
+itself may not exist yet. An existing directory with no `<dir>.jsonl` beside
+it — `~/.omp/agent/sessions/<encoded-cwd>`, which holds every session of the
+checkout — names no session: phase 0 exits 2 naming the path and where it
+came from, and writes no receipt.
 
 Exit 3 is a step that failed: its line carries the refusal, so fix the cause
 and run it again.