brnch-cli 0.20.0 → 0.20.1

package/README.md

@@ -1,4 +1,4 @@
-# brnch 0.20.0
+# brnch 0.20.1
 
 Command-line client for [Brnch](https://brnch.io) — Git hosting for humans and agents. Single file, no runtime dependencies, Node 20 or newer.
 

package/brnch.mjs

@@ -31729,6 +31729,9 @@ var DELEGATION_MATRIX = Object.freeze({
 // packages/domain/src/claims.ts
 var PERSON_CLAIM_TTL_MS = 7 * 864e5;
 
+// packages/domain/src/hosted-machine.ts
+var MACHINE_CALIBRATION_MS = 1e3;
+
 // packages/domain/src/plans.ts
 var GB = 1024 ** 3;
 var PLANS = Object.freeze({
@@ -35516,7 +35519,10 @@ function runnerProtocolGroup(t) {
       completeCacheSave: (job2, entry, body, o) => t.json({ method: "POST", path: path2`/v1/actions/runner/jobs/${job2}/cache/${entry}/complete`, json: validate2(CompleteUploadRequest, body, "CompleteUploadRequest"), replayable: true, options: o }),
       /** Isolated previews (M6-DEPLOY-CF-16): the upload job's copy of its run's build bundle. */
       deployBundle: (job2, o) => t.bytes({ method: "GET", path: path2`/v1/actions/runner/jobs/${job2}/deploy-bundle`, options: o }),
-      /** The machine before the first step (M6-HOSTED-11), so a job the platform ends itself still names it. */
+      /**
+       * The machine before the first step (M6-HOSTED-11), so a job the platform ends itself still names it. A replay after
+       * the platform gave the job back (`given_back`, M6-HOSTED-12) is refused: its token was revoked.
+       */
       machine: (job2, body, o) => t.json({ method: "POST", path: path2`/v1/actions/runner/jobs/${job2}/machine`, json: validate2(MachineStartReport, body, "MachineStartReport"), replayable: true, options: o }),
       complete: (job2, body, o) => t.json({ method: "POST", path: path2`/v1/actions/runner/jobs/${job2}/complete`, json: validate2(CompleteJobRequest, body, "CompleteJobRequest"), replayable: true, options: o }),
       release: (job2, reason, cause, o) => t.json({ method: "POST", path: path2`/v1/actions/runner/jobs/${job2}/release`, json: cause ? { reason, cause } : { reason }, options: o }),
@@ -37498,7 +37504,7 @@ function invalidAgentToolFlag(flag2) {
 }
 
 // packages/cli/package.json
-var version2 = "0.20.0";
+var version2 = "0.20.1";
 
 // packages/cli/src/brand.ts
 var BRAND = {
@@ -53453,7 +53459,7 @@ ${(await c8.actions.jobs.logs(j.id)).trimEnd()}`);
     })
   );
   run4.command("cancel <run>").description("Cancel a run (running jobs are stopped on their runners)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").actions.runs.cancel(id2), renderRun2)));
-  run4.command("rerun <run>").description("Re-run a completed run (all jobs, or --failed and their dependents)").option("--failed", "only failed/cancelled jobs and jobs that depend on them").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").actions.runs.rerun(id2, { failed_only: !!o.failed }), renderRun2)));
+  run4.command("rerun <run>").description("Re-run a completed run (all jobs, or --failed and their dependents)").option("--failed", "only failed, cancelled and timed-out jobs (in a matrix, only the matrix jobs that failed) and jobs that depend on them").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").actions.runs.rerun(id2, { failed_only: !!o.failed }), renderRun2)));
 }
 function registerSecret(program2, rt) {
   const secret = program2.command("secret").description("Actions secrets of --repo (default) or the organization (--org-level). Values are write-only");
@@ -53515,7 +53521,7 @@ import { arch, platform } from "node:os";
 import { spawn as spawn5, spawnSync as spawnSync4 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { chmodSync as chmodSync3, existsSync as existsSync5, lchownSync as lchownSync2, lstatSync as lstatSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync5, realpathSync as realpathSync5, renameSync, rmSync as rmSync4 } from "node:fs";
-import { gzipSync as gzipSync3 } from "node:zlib";
+import { gunzipSync as gunzipSync2, gzipSync as gzipSync3 } from "node:zlib";
 import { dirname as dirname21, isAbsolute as isAbsolute12, join as join37, normalize, relative as relative6, resolve as resolve15 } from "node:path";
 
 // packages/cli/src/runner/archive.ts
@@ -55315,7 +55321,7 @@ import { createHash as createHash11 } from "node:crypto";
 import { readFileSync as readFileSync6 } from "node:fs";
 import { availableParallelism, cpus } from "node:os";
 import { join as join34 } from "node:path";
-var CALIBRATION_MS = 1e3;
+var CALIBRATION_MS = MACHINE_CALIBRATION_MS;
 function parseProcStat(text2) {
   const line2 = text2.split("\n").find((l) => /^cpu\s/.test(l));
   if (!line2) return null;
@@ -56125,8 +56131,9 @@ async function runSecurityScan(spec, host) {
 var CHECKOUT_RETRY_DELAYS_MS = [15e3, 3e4, 6e4, 12e4, 24e4];
 var RPC_FAILED = /\bRPC failed; (?:HTTP (?:429|5\d\d)\b|curl (?:6|7|16|18|28|35|52|55|56|92)\b)/;
 var UNABLE_TO_ACCESS = /\bunable to access '[^']*': (?:The requested URL returned error: (?:429|5\d\d)\b|Failed to connect|Could not resolve host|Connection timed out|Operation timed out|Recv failure|Send failure|Empty reply from server|OpenSSL SSL_)/;
+var CUT_OFF = /^error: \d+ bytes of (?:body are still expected|length header were received)$|^fatal: early EOF$/;
 function transientGitFailure(line2) {
-  return RPC_FAILED.test(line2) || UNABLE_TO_ACCESS.test(line2);
+  return RPC_FAILED.test(line2) || UNABLE_TO_ACCESS.test(line2) || CUT_OFF.test(line2);
 }
 var GONE = /\bRPC failed; HTTP 410\b|\bunable to access '[^']*': The requested URL returned error: 410\b/;
 function jobGoneGitFailure(line2) {
@@ -56261,9 +56268,13 @@ var JobExecution = class {
   killedAt = null;
   /** The job given back to the queue, once (`release`). */
   released = null;
+  /** No step runs any more and none will start: the job's result is known (review of M6-HOSTED-REV-12). */
+  stepsOver = false;
   /** The job ended and its result was reported (or it was given back): nothing more may be sent for it. */
   done = false;
   machine;
+  /** The calibration of the start reading, which steps see (`BRNCH_MACHINE_CALIBRATION`); null until read, or none. */
+  startCalibration = null;
   /**
    * Aborted when the job is cancelled while a step runs: stops that step's transfers and tar processes. A fresh one for
    * every step, so a step that still runs after a cancel or timeout (`if: always()`, e.g. uploading test reports) can
@@ -56312,8 +56323,8 @@ var JobExecution = class {
     }
   }
   /**
-   * The platform is replacing the hosted runner: a runner rollout's SIGTERM, then SIGKILL 15 minutes later (ADR-0066 §6
-   * and its addendum 2026-10-22). The signal reaches every process in the container, the steps' too, and most tools
+   * The platform is replacing the hosted runner: a runner rollout's SIGTERM, then the container stops, minutes later
+   * (ADR-0066 §6 and its addenda 2026-10-22 and 2026-10-23). The signal reaches every process in the container, the steps' too, and most tools
    * (pnpm, vitest, bash) die of it. So the job keeps running only while nothing fails: a failure no step had before the
    * signal is the rollout's, and the job goes back to the queue (`platform_shutdown`: it runs again on a new runner,
    * uncharged) instead of failing. A job still running after `releaseAfterMs` goes back too.
@@ -56323,7 +56334,7 @@ var JobExecution = class {
     this.drainingSince = Date.now();
     this.notice(`the hosted runner is being replaced by a platform update; the job keeps running for up to ${Math.round(releaseAfterMs / 6e4)} minutes, and runs again on a new runner if a step stops or it is not done by then`);
     void this.client.runner.job.drain(this.jobId).catch(() => void 0);
-    setTimeout(() => void this.giveBack("the hosted runner was replaced by a platform update"), releaseAfterMs).unref();
+    setTimeout(() => void (this.stepsOver || this.giveBack("the hosted runner was replaced by a platform update")), releaseAfterMs).unref();
     this.giveBackIfReplaced();
   }
   /** The job's failure came with the rollout (or after it): give the job back rather than report it. */
@@ -56402,6 +56413,10 @@ var JobExecution = class {
       RUNNER_NAME: this.opts.runnerName,
       RUNNER_TEMP: this.temp,
       RUNNER_ENVIRONMENT: this.opts.hosted ? "github-hosted" : "self-hosted",
+      // The hosted container's speed, so a step can give a time limit room on a slower one (Brnch's own migrations
+      // replay budget, M6-QA-06). The start reading, taken as root before any step. The runner never reads it back and
+      // job code may override it like any variable, so nothing trusts it: decisions use the reading the platform stored.
+      ...this.opts.hosted && this.startCalibration !== null ? { BRNCH_MACHINE_CALIBRATION: String(this.startCalibration) } : {},
       ...this.idTokenEnv()
     };
   }
@@ -56553,6 +56568,7 @@ var JobExecution = class {
     for (const n of a.notices ?? []) this.notice(n);
     const machine = this.observe(() => readStart(this.machine));
     if (machine) {
+      this.startCalibration = machine.start.calibration;
       this.notice(startLine(machine));
       await this.reportStart(machine);
     }
@@ -56560,14 +56576,17 @@ var JobExecution = class {
     let outputs = {};
     let error62 = null;
     try {
-      rmSync4(this.runnerHome, { recursive: true, force: true });
-      mkdirSync3(this.runnerHome, { mode: 448 });
-      ({ conclusion, outputs } = await this.runSteps());
+      if (!this.aborted) {
+        rmSync4(this.runnerHome, { recursive: true, force: true });
+        mkdirSync3(this.runnerHome, { mode: 448 });
+        ({ conclusion, outputs } = await this.runSteps());
+      }
     } catch (e) {
       conclusion = "failure";
       error62 = e.message;
       this.log(`##[error]${error62}`);
     }
+    this.stepsOver = true;
     if (this.opts.hosted && conclusion === "failure" && this.killedAt !== null && this.drainingSince === null) await this.pause(this.killedAt + this.drainRaceMs - Date.now());
     if (this.cancelled && !this.aborted) {
       conclusion = "cancelled";
@@ -56607,14 +56626,22 @@ var JobExecution = class {
   /**
    * The start reading goes to the platform before the first step, not only with the completion: a job the platform
    * times out, or cancels past its grace, sends no completion (M6-HOSTED-11). Bounded, and never the job's failure.
+   * The platform may answer that it gave the job back (a slow container, M6-HOSTED-12): it already requeued the job, so
+   * this assignment ends here, with no step, completion or release. The requeue deleted the job's log and revoked its
+   * token, so the reason goes to the runner's own log.
    */
   async reportStart(m) {
     const start = machineStart(this.machine, m);
     if (!start) return;
     try {
-      await this.client.runner.job.machine(this.jobId, { machine: start }, { signal: AbortSignal.timeout(REPORT_START_TIMEOUT_MS) });
+      const r = await this.client.runner.job.machine(this.jobId, { machine: start }, { signal: AbortSignal.timeout(REPORT_START_TIMEOUT_MS) });
+      if (r.given_back) {
+        this.opts.diag(`given back by the platform before the first step: ${r.given_back.message}`);
+        this.abort(`given back by the platform (${r.given_back.reason})`);
+      }
     } catch (e) {
-      this.opts.diag(`warning: could not report the machine's facts: ${e.message}`);
+      if (isBrnchApiError(e) && (e.status === 401 || e.status === 412)) this.abort("job token revoked (the job was cancelled, timed out or reassigned)");
+      else this.opts.diag(`warning: could not report the machine's facts: ${e.message}`);
     }
   }
   /** Reading the machine is observability: a failure loses the facts, never the job. */
@@ -56874,6 +56901,7 @@ var JobExecution = class {
       gone = false;
       return this.exec(["git", ...args], { cwd: this.workspace, env, asStepUser: false, timeoutMs: 30 * 6e4, onLine });
     };
+    const delays = this.opts.checkoutRetryDelaysMs ?? CHECKOUT_RETRY_DELAYS_MS;
     const fetchCommit = async (args) => {
       for (let attempt = 0; ; attempt++) {
         const code2 = await git4(["fetch", ...args]);
@@ -56881,13 +56909,13 @@ var JobExecution = class {
           await this.refreshState();
           return this.cancelled ? null : code2;
         }
-        const delay = CHECKOUT_RETRY_DELAYS_MS[attempt];
+        const delay = delays[attempt];
         if (code2 === 0 || code2 === null || !transient) return code2;
         if (delay === void 0 || Date.now() + delay >= this.deadline) {
           this.log("##[error]the server kept failing the fetch; the repository's storage may be busy. Run the job again in a few minutes");
           return code2;
         }
-        this.log(`##[brnch] the server could not answer the fetch; retrying in ${delay / 1e3} s (attempt ${attempt + 2} of ${CHECKOUT_RETRY_DELAYS_MS.length + 1})`);
+        this.log(`##[brnch] the server could not answer the fetch; retrying in ${delay / 1e3} s (attempt ${attempt + 2} of ${delays.length + 1})`);
         if (!await this.pause(delay)) return null;
       }
     };
@@ -56898,8 +56926,9 @@ var JobExecution = class {
       for (const args of [["init", "-q"], ["remote", "add", "origin", this.gitUrl()]]) if (await git4(args) !== 0) return 1;
       let code2;
       if (depth > 0) {
+        const killedBefore = this.killedAt;
         code2 = await fetchCommit(["--no-tags", "--prune", `--depth=${depth}`, "origin", a.head_sha]);
-        if (code2 !== 0 && code2 !== null && !transient && !gone) {
+        if (code2 !== 0 && code2 !== null && !transient && !gone && this.killedAt === killedBefore) {
           this.log("##[brnch] the shallow fetch failed; fetching full history of the commit");
           code2 = await fetchCommit(["--no-tags", "origin", a.head_sha]);
         }
@@ -57469,21 +57498,33 @@ var JobExecution = class {
     }
     if (!files.length) return fail(`no .sarif files found at ${w.sarif_file}`);
     const checkout = w.checkout_path ? resolve15(this.workspace, w.checkout_path) : this.workspace;
+    const readFile15 = (f) => {
+      const shown = relative6(this.workspace, f);
+      const read2 = this.owner ? spawnSync4("cat", ["--", f], { uid: this.owner.uid, gid: this.owner.gid, maxBuffer: MAX_SARIF_FILE_BYTES + 1 }) : null;
+      if (read2 && (read2.error || read2.status !== 0)) return `cannot read ${shown}: ${String(read2.error ?? read2.stderr ?? "").trim() || "too large"}`;
+      const raw = read2 ? new Uint8Array(read2.stdout) : new Uint8Array(readNoFollowBytes(f));
+      if (raw.byteLength > MAX_SARIF_FILE_BYTES) return `${shown} is larger than ${MAX_SARIF_FILE_BYTES} bytes`;
+      return raw;
+    };
     const seen = /* @__PURE__ */ new Map();
+    for (const f of files) {
+      const raw = readFile15(f);
+      if (typeof raw === "string") return fail(raw);
+      for (const key of sarifRunKeys(raw, w.category ?? "")) {
+        const [tool, category] = key.split("\0");
+        if (seen.has(key) && seen.get(key) !== relative6(this.workspace, f)) return fail(`${relative6(this.workspace, f)} and ${seen.get(key)} both have results for ${tool} in category "${category}"; give each file its own category (runAutomationDetails.id)`);
+        seen.set(key, relative6(this.workspace, f));
+      }
+    }
     const ids = [];
     for (const f of files) {
       const shown = relative6(this.workspace, f);
-      const read2 = this.owner ? spawnSync4("cat", ["--", f], { uid: this.owner.uid, gid: this.owner.gid, maxBuffer: MAX_SARIF_FILE_BYTES + 1 }) : null;
-      if (read2 && (read2.error || read2.status !== 0)) return fail(`cannot read ${shown}: ${String(read2.error ?? read2.stderr ?? "").trim() || "too large"}`);
-      const raw = read2 ? new Uint8Array(read2.stdout) : new Uint8Array(readNoFollowBytes(f));
-      if (raw.byteLength > MAX_SARIF_FILE_BYTES) return fail(`${shown} is larger than ${MAX_SARIF_FILE_BYTES} bytes`);
+      const raw = readFile15(f);
+      if (typeof raw === "string") return fail(raw);
       const body = raw[0] === 31 && raw[1] === 139 ? raw : new Uint8Array(gzipSync3(raw));
       try {
         const r = await this.client.runner.job.codeScanning(this.jobId, body, { ...w.category ? { category: w.category } : {}, checkout_path: checkout });
         for (const a of r.analyses) {
-          const key = `${a.tool.name}\0${a.category}`;
-          if (seen.has(key)) return fail(`${shown} and ${seen.get(key)} both have results for ${a.tool.name} in category "${a.category}"; give each file its own category (runAutomationDetails.id)`);
-          seen.set(key, shown);
           this.log(`uploaded ${shown}: ${a.tool.name}${a.category ? ` (${a.category})` : ""}, ${a.finding_count} result${a.finding_count === 1 ? "" : "s"}${a.truncated ? " (truncated)" : ""}, ${a.trust.independence.replace("_", "-")}`);
         }
         ids.push(r.upload_id);
@@ -57496,6 +57537,21 @@ var JobExecution = class {
   }
 };
 var MAX_SARIF_FILE_BYTES = 10 * 1024 * 1024;
+function sarifRunKeys(raw, category) {
+  try {
+    const bytes = raw[0] === 31 && raw[1] === 139 ? gunzipSync2(raw, { maxOutputLength: 32 * 1024 * 1024 }) : raw;
+    const doc = JSON.parse(new TextDecoder().decode(bytes));
+    return (Array.isArray(doc.runs) ? doc.runs : []).flatMap((r) => {
+      const name = r?.tool?.driver?.name;
+      if (typeof name !== "string") return [];
+      const id2 = r.automationDetails?.id;
+      const cat = typeof id2 === "string" && id2 !== "" ? id2.lastIndexOf("/") < 0 ? "" : id2.slice(0, id2.lastIndexOf("/")) : category.trim();
+      return [`${name}\0${cat}`];
+    });
+  } catch {
+    return [];
+  }
+}
 var MAX_SARIF_FILES = 20;
 function sarifFiles(workspace, target) {
   const root = realpathSync5(workspace);
@@ -58656,6 +58712,13 @@ function openUrl(url2) {
     }
   });
 }
+function workingDirectory() {
+  try {
+    return process.cwd();
+  } catch {
+    return process.env.PWD || "/";
+  }
+}
 function nodeDeps() {
   return {
     stdout: process.stdout,
@@ -58665,7 +58728,7 @@ function nodeDeps() {
     stderrIsTTY: !!process.stderr.isTTY,
     stdoutIsTTY: !!process.stdout.isTTY,
     env: process.env,
-    cwd: process.cwd(),
+    cwd: workingDirectory(),
     createClient,
     spawnGit,
     spawnTool,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brnch-cli",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Brnch CLI: Git hosting for humans and agents, from the command line",
   "keywords": [
     "git",