forgedock 1.49.0 → 1.51.0

package/bin/lean/context.mjs

@@ -212,9 +212,15 @@ const failuresOf = (st) => (Array.isArray(st?.failureClasses) ? [...new Set(st.f
 const recordLine = (body) => oneLine(noComments(body).split("\n").map((l) => l.trim()).find((l) => l && !/^#+\s/.test(l)) ?? "");
 const markerOf = (body) => /^\s*<!--\s*FORGE:([A-Z_]+)\s*-->/.exec(String(body ?? ""))?.[1] ?? null;
 
+/**
+ * #5152: a closed record's result for the builder context. Delivered (`workflow:merged`) or moved (`workflow:decomposed`)
+ * scope reads `completed` whatever its `stateReason`, so a legacy NOT_PLANNED close of delivered work never reads as dropped.
+ */
+export const closedResult = (rec) => (["workflow:merged", "workflow:decomposed"].some((l) => (rec?.labels ?? []).includes(l)) ? "completed" : rec?.stateReason ?? "closed");
 async function readIssue(gh, repo, n) {
   const j = JSON.parse(String(await gh(["api", `repos/${repo}/issues/${n}`])));
-  return { number: Number(j.number ?? n), title: oneLine(j.title, 120), state: String(j.state ?? "").toUpperCase() || null, stateReason: j.state_reason ?? null, body: String(j.body ?? ""), pr: Boolean(j.pull_request) };
+  return { number: Number(j.number ?? n), title: oneLine(j.title, 120), state: String(j.state ?? "").toUpperCase() || null, stateReason: j.state_reason ?? null, body: String(j.body ?? ""), pr: Boolean(j.pull_request),
+    labels: (Array.isArray(j.labels) ? j.labels : []).map((l) => String(l?.name ?? l)) };
 }
 async function readComments(gh, repo, n) {
   return parseLines(await gh(["api", "--paginate", `repos/${repo}/issues/${n}/comments`, "--jq", ".[] | {id, body, author_association, user: {type: .user.type, login: .user.login}} | @json"]));
@@ -324,7 +330,7 @@ export async function gatherContextFacts({ io, repo, issue, iss, comments = [],
       const st = stateOf(rec.body);
       const reason = codeOf(st?.terminalReason), fails = failuresOf(st);
       facts.links.push({ number: n, rel: r, kind: rec.pr ? "pr" : "issue", title: rec.title, state: rec.state, code: outcomeOf(st),
-        result: reason ?? (rec.state === "CLOSED" ? rec.stateReason ?? "closed" : null), ...(fails.length ? { failures: fails } : {}), ...(r === "parent" || r === "depends-on" ? { body: stripComments(rec.body) } : {}) });
+        result: reason ?? (rec.state === "CLOSED" ? closedResult(rec) : null), ...(fails.length ? { failures: fails } : {}), ...(r === "parent" || r === "depends-on" ? { body: stripComments(rec.body) } : {}) });
     }
   });
 

package/bin/lean/context.test.mjs

@@ -3,7 +3,7 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { normaliseFacts, renderFactsRecord, FACTS_MARKER } from "./facts.mjs";
-import { gatherContextFacts, compileContextPack, contextPackFor, contextArm, contextPackCacheKey, linkStateStamp, LINK_STAMP_MAX, parseContextPackConfig, laneType, priorAttempts, issueSymbols, bodyLinks, parentOf, renderContextRecord, DEFAULT_CONTEXT_BYTES, noComments, subjectTerms, subjectHistory, MAX_SUBJECT_ITEMS, MAX_SUBJECT_QUERIES } from "./context.mjs";
+import { closedResult, gatherContextFacts, compileContextPack, contextPackFor, contextArm, contextPackCacheKey, linkStateStamp, LINK_STAMP_MAX, parseContextPackConfig, laneType, priorAttempts, issueSymbols, bodyLinks, parentOf, renderContextRecord, DEFAULT_CONTEXT_BYTES, noComments, subjectTerms, subjectHistory, MAX_SUBJECT_ITEMS, MAX_SUBJECT_QUERIES } from "./context.mjs";
 
 const REPO = "o/r";
 const BOT = { author_association: "NONE", user: { type: "Bot", login: "forge[bot]" } };
@@ -570,3 +570,13 @@ describe("#5085: subject history and recall status", () => {
     assert.equal(compileContextPack({ issue: 1, links: [], attempts: [], ledger: [], facts: [], recall: absent.recall }).recall.present, false, "the empty pack carries it too");
   });
 });
+
+describe("#5152 builder context: delivered or moved scope never reads as dropped", () => {
+  it("a closed workflow:merged or workflow:decomposed dependency is completed whatever its stateReason (legacy not_planned too)", () => {
+    assert.equal(closedResult({ stateReason: "not_planned", labels: ["workflow:merged"] }), "completed");
+    assert.equal(closedResult({ stateReason: "not_planned", labels: ["bug", "workflow:decomposed"] }), "completed");
+    assert.equal(closedResult({ stateReason: "not_planned", labels: ["workflow:invalid"] }), "not_planned", "dropped scope keeps its reason");
+    assert.equal(closedResult({ stateReason: "completed", labels: [] }), "completed");
+    assert.equal(closedResult({ stateReason: null }), "closed");
+  });
+});

package/bin/lean/credentials.mjs

@@ -27,3 +27,21 @@ export function resolveCredential(name, { env = process.env, keychain = defaultK
   if (v !== undefined && v !== null && String(v) !== "") return String(v);
   try { const k = keychain(String(name), platform); return k === undefined || k === null || String(k) === "" ? null : String(k); } catch { return null; }
 }
+
+/**
+ * #5159: a keychain lookup memoised per name for `ttlMs` (a miss or a failure is cached as null too), so a resolver run
+ * on every request (#5144) spawns `secret-tool`/`security` at most once per TTL instead of on every HTTP call.
+ */
+export function memoKeychain({ keychain = defaultKeychain, ttlMs = 60000, now = Date.now } = {}) {
+  const cache = new Map();
+  return (name, platform) => {
+    const key = `${platform ?? ""}\u0000${name}`;
+    const hit = cache.get(key);
+    const t = now();
+    if (hit && t - hit.at < ttlMs) return hit.value;
+    let value = null;
+    try { const k = keychain(name, platform); value = k === undefined || k === null || String(k) === "" ? null : String(k); } catch { value = null; }
+    cache.set(key, { at: t, value });
+    return value;
+  };
+}

package/bin/lean/execution.mjs

@@ -58,7 +58,7 @@ import { isLaneAlive, launchLane, writeAtomic } from "./batch.mjs";
 import { schedDir } from "./sched.mjs";
 import { dockerLabels, safeSegment } from "./ledger.mjs";
 import { OUTCOME_CODES } from "../engine/outcome-codes.mjs";
-import { resolveCredential } from "./credentials.mjs";
+import { resolveCredential, memoKeychain, defaultKeychain } from "./credentials.mjs";
 import { httpTransport, isActionsEndpoint, remoteProvider } from "./sandbox-remote.mjs";
 import { ADMISSION_DEFAULTS } from "./admission.mjs";
 import { classifyStep, heavyConfig, memAvailableMb } from "./heavy.mjs";
@@ -515,17 +515,22 @@ export function poolCredential(exec = {}, { env = process.env, router = null, ke
 /**
  * The remote transport for forge.yaml `execution` settings: `opts.transport` when injected, else `httpTransport` on
  * `exec.endpoint` with the credential `exec.tokenEnv` from `credentials`, or by default poolCredential (#5131: env,
- * keychain, `token_file`, the matching local router's token). `fetchFn` is a test seam. Throws `execution.provider.misconfigured`
+ * keychain, `token_file`, the matching local router's token; #5159: the keychain lookup is memoised per transport, `keychain`
+ * is its seam). `fetchFn` is a test seam. Throws `execution.provider.misconfigured`
  * without an endpoint, `execution.provider.actions_refused` for a GitHub Actions endpoint without `allow_actions`.
  */
-export function remoteTransportFor(exec = {}, { transport = null, env = process.env, credentials = null, router, fetchFn } = {}) {
+export function remoteTransportFor(exec = {}, { transport = null, env = process.env, credentials = null, router, fetchFn, keychain } = {}) {
   if (transport) return transport;
   if (!exec?.endpoint) throw typedError("execution.provider.misconfigured", "execution.provider remote needs execution.endpoint");
   if (isActionsEndpoint(exec.endpoint) && exec.allowActions !== true) {
     throw typedError("execution.provider.actions_refused", "execution.endpoint is a GitHub Actions API; set execution.allow_actions: true to spend Actions minutes");
   }
-  const token = credentials ? (exec.tokenEnv ? credentials(exec.tokenEnv) : null)
-    : poolCredential({ provider: "remote", ...exec }, { env, router: router !== undefined ? router : poolRouterConfig({ env }) }).token;
+  // #5144: a getter, so the bearer is resolved on every request (a token fixed or rotated mid-batch is picked up), not once here.
+  const rt = credentials ? null : (router !== undefined ? router : poolRouterConfig({ env }));
+  // #5159: the env and token files are re-read per request; the sync keychain lookup is memoised (misses too) for its TTL.
+  const kc = credentials ? null : memoKeychain({ keychain: keychain ?? defaultKeychain });
+  const token = credentials ? () => (exec.tokenEnv ? credentials(exec.tokenEnv) : null)
+    : () => poolCredential({ provider: "remote", ...exec }, { env, router: rt, keychain: kc }).token;
   return httpTransport({ endpoint: exec.endpoint, token, ...(fetchFn ? { fetchFn } : {}) });
 }
 
@@ -556,13 +561,22 @@ export function providerByName(name, opts) {
     let forgeYaml = null;
     if (pool) { try { forgeYaml = opts?.cwd ? readFileSync(join(opts.cwd, "forge.yaml"), "utf8") : null; } catch { forgeYaml = null; } }
     const endpoint = exec.endpoint ?? (pool ? router?.endpoint : undefined);
-    const resolve = () => poolCredential({ ...exec, provider: name, ...(endpoint ? { endpoint } : {}) }, { env, router });
-    const resolved = resolve();
+    // #5144: the router's token file is re-read per call (a rotated or newly written token), its endpoint stays as at construction.
+    const routerEligible = !(opts?.transport || (pool && exec.endpoint));
+    const routerNow = () => {
+      if (!routerEligible) return null;
+      const c = poolRouterConfig({ env, ...(opts?.poolConfigPath ? { path: opts.poolConfigPath } : {}) });
+      return c ? { endpoint: router?.endpoint ?? c.endpoint, token: c.token } : router;
+    };
+    // #5159: one memoised keychain per provider, so a `token_env` absent from the env does not spawn the keychain per request.
+    const keychain = memoKeychain({ keychain: opts?.keychain ?? defaultKeychain });
+    const resolve = () => poolCredential({ ...exec, provider: name, ...(endpoint ? { endpoint } : {}) }, { env, router: routerNow(), keychain });
     // A token read from a file is resolved under a fixed name so remoteProvider redacts it like any `token_env` credential.
+    // #5144: set even when no token exists yet, so one that appears later is still resolved per call (and redacted).
     const fixed = pool ? "FORGEDOCK_POOL_TOKEN" : "FORGEDOCK_REMOTE_TOKEN";
-    const tokenEnv = exec.tokenEnv ?? (resolved.token ? fixed : undefined);
+    const tokenEnv = exec.tokenEnv ?? fixed;
     // #4685/#5131: an empty env/keychain lookup of `token_env` falls back to `token_file`, then the (matching) router's token file.
-    const credentials = (n) => (n === tokenEnv ? resolve().token : resolveCredential(n, { env })); // per call, like resolveCredential
+    const credentials = (n) => (n === tokenEnv ? resolve().token : resolveCredential(n, { env, keychain })); // per call, keychain memoised (#5159)
     const settings = { ...exec, ...(endpoint ? { endpoint } : {}), ...(tokenEnv ? { tokenEnv } : {}), ...(forgeYaml ? { forgeYaml } : {}),
       ...(typeof opts?.prefetch === "function" ? { prefetch: opts.prefetch } : {}) }; // #4778: dispatch-time relay pre-fetch
     return remoteProvider({ batch: opts.batch, repo: opts.repo, settings, ...(pool ? { name: "pool" } : {}), env, credentials,

package/bin/lean/execution.test.mjs

@@ -399,6 +399,27 @@ describe("runBatch wiring (#4253)", () => {
       assert.deepEqual(prov.calls, []);
     }
   });
+
+  it("#5138: a live --set-placement local makes the next lane of a remote batch a detached host lane", async () => {
+    const work = tmpDir("exec-cli-live-");
+    const stub = join(work, "stub.mjs");
+    writeFileSync(stub, `import { writeFileSync } from "node:fs"; const a = process.argv.slice(2); writeFileSync(a[a.indexOf("--result-file") + 1], JSON.stringify({ terminalReason: "merged", pr: 9 }));\n`);
+    const root = join(work, "batches");
+    let recorded = null;
+    const prov = fakeProvider({ finish: (n) => {
+      const b = openBatch(root, "blive");
+      recorded = b.readExecution();
+      if (n === 1) b.setExecution({ mode: "local" }); // the operator's --set-placement before #2 is admitted
+      return { terminalReason: "merged", pr: 100 + n, cost_usd: 0 };
+    } });
+    const res = await quiet(() => orchestrateFromCli(["1", "2", "--repo", "o/r", "--no-prefilter", "--parallel", "1"], base(work, { batchId: "blive", laneScript: stub,
+      execution: parseExecution({ mode: "remote", max_remote: "1" }), sandboxProvider: prov,
+      sandboxLedger: (n) => makeLedger({ root: join(work, "ledger"), batch: "blive", lane: `sandbox-${n}`, owner: "t", issue: n }) })));
+    assert.deepEqual(recorded, { provider: true });
+    assert.deepEqual(res.rows.map((r) => [r.issue, r.outcome, r.pr, r.placement?.where]), [[1, "merged", 101, "remote"], [2, "merged", 9, "local"]]);
+    assert.match(res.rows[1].placement.reason, /live placement/);
+    assert.deepEqual(prov.calls.filter((c) => c[0] === "start").map((c) => c[1]), [1]);
+  });
 });
 
 describe("execution budget and sandbox cost (#4255)", () => {
@@ -960,6 +981,78 @@ describe("remote/pool credential resolver (#5131)", () => {
     assert.equal(hit.seen[0].auth, "Bearer file-tok");
   });
 
+  it("5144: a token that appears or rotates after the provider is built is the next request's bearer", async () => {
+    const dir = tmpDir("router-5144-");
+    const tokenFile = join(dir, "forgedock.token");
+    writeFileSync(join(dir, "router.json"), JSON.stringify({ listen: { host: "127.0.0.1", port: 7710 } }));
+    writeFileSync(tokenFile, "\n"); // router config with no token yet
+    const hit = recorder();
+    const env = {};
+    const mk = (name, exec) => providerByName(name, { batch: { id: "b5144" }, repo: "o/r", exec: parseExecution({ mode: "remote", max_remote: "1", provider: name, ...exec }),
+      env, poolConfigPath: join(dir, "router.json"), fetchFn: hit.fetchFn });
+    for (const [name, exec] of [["remote", { endpoint: "http://127.0.0.1:7710" }], ["pool", {}]]) {
+      writeFileSync(tokenFile, "\n");
+      hit.seen.length = 0;
+      const p = mk(name, exec);
+      await p.capacity();
+      assert.equal(hit.seen.at(-1).auth, null, `${name}: no token at construction`);
+      writeFileSync(tokenFile, "router-new\n");
+      await p.capacity();
+      assert.equal(hit.seen.at(-1).auth, "Bearer router-new", `${name}: a token written later is sent`);
+      writeFileSync(tokenFile, "router-rotated\n");
+      await p.capacity();
+      assert.equal(hit.seen.at(-1).auth, "Bearer router-rotated", `${name}: a rotated token is sent`);
+    }
+  });
+
+  it("5144: an env token_env that is set after construction is sent; remoteTransportFor default path resolves per call", async () => {
+    const dir = routerDir();
+    const hit = recorder();
+    const penv = {};
+    const q = providerByName("remote", { batch: { id: "b5144e" }, repo: "o/r", exec: parseExecution({ mode: "remote", max_remote: "1", provider: "remote", endpoint: "https://runner.example.com", token_env: "COMPUTESHARE_TOKEN" }),
+      env: penv, poolConfigPath: join(dir, "router.json"), fetchFn: hit.fetchFn });
+    await q.capacity();
+    assert.equal(hit.seen.at(-1).auth, null);
+    penv.COMPUTESHARE_TOKEN = "env-late";
+    await q.capacity();
+    assert.equal(hit.seen.at(-1).auth, "Bearer env-late");
+    const tenv = {};
+    const t = remoteTransportFor({ endpoint: "https://runner.example.com", tokenEnv: "COMPUTESHARE_TOKEN" }, { env: tenv, router: null, fetchFn: hit.fetchFn });
+    await t.capacity();
+    assert.equal(hit.seen.at(-1).auth, null);
+    tenv.COMPUTESHARE_TOKEN = "env-late-2";
+    await t.capacity();
+    assert.equal(hit.seen.at(-1).auth, "Bearer env-late-2");
+  });
+
+  it("5159: a token_env absent from the env runs the keychain once, not on every request; the token_file bearer and a later env token still apply", async () => {
+    const dir = tmpDir("kc-5159-");
+    const file = join(dir, "explicit.token");
+    writeFileSync(file, "file-tok\n");
+    const hit = recorder();
+    let calls = 0;
+    const keychain = () => { calls++; return null; };
+    const env = {};
+    const p = providerByName("remote", { batch: { id: "b5159" }, repo: "o/r", exec: parseExecution({ mode: "remote", max_remote: "1", provider: "remote", endpoint: "https://runner.example.com", token_env: "COMPUTESHARE_TOKEN", token_file: file }),
+      env, poolConfigPath: join(dir, "none.json"), fetchFn: hit.fetchFn, keychain });
+    for (let i = 0; i < 4; i++) await p.capacity();
+    assert.ok(hit.seen.length >= 4);
+    assert.ok(hit.seen.every((x) => x.auth === "Bearer file-tok"), "every request carries the token_file bearer");
+    assert.ok(calls <= 1, `keychain ran ${calls} times`);
+    env.COMPUTESHARE_TOKEN = "env-late";
+    await p.capacity();
+    assert.equal(hit.seen.at(-1).auth, "Bearer env-late");
+    let tcalls = 0;
+    const tenv = {};
+    const t = remoteTransportFor({ endpoint: "https://runner.example.com", tokenEnv: "COMPUTESHARE_TOKEN", tokenFile: file }, { env: tenv, router: null, fetchFn: hit.fetchFn, keychain: () => { tcalls++; return null; } });
+    for (let i = 0; i < 4; i++) await t.capacity();
+    assert.equal(hit.seen.at(-1).auth, "Bearer file-tok");
+    assert.equal(tcalls, 1, "remoteTransportFor: one keychain lookup across requests");
+    tenv.COMPUTESHARE_TOKEN = "env-late-2";
+    await t.capacity();
+    assert.equal(hit.seen.at(-1).auth, "Bearer env-late-2");
+  });
+
   it("5131: remoteTransportFor's default credentials (gc) fall back to the matching router token", async () => {
     const hit = recorder();
     const t = remoteTransportFor({ endpoint: "http://127.0.0.1:7710" }, { env: {}, router: { endpoint: "http://127.0.0.1:7710", token: "router-tok" }, fetchFn: hit.fetchFn });

package/bin/lean/fixclosereasons.mjs

@@ -0,0 +1,52 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * `forgedock fix-close-reasons <owner/repo> [--milestone <m>] [--apply]` (#5177, deferred from #5152). No LLM.
+ * Migration helper: an issue closed `not planned` that carries `workflow:merged` or `workflow:decomposed` was delivered
+ * (or moved to sub-issues), not dropped. It is re-closed as `completed` with a comment. One PATCH changes the reason in place
+ * (no reopen window). A `workflow:invalid` issue is a real drop and is never touched. Dry-run unless `--apply`.
+ */
+const DELIVERED = ["workflow:merged", "workflow:decomposed"];
+const isNotPlanned = (r) => String(r ?? "").toUpperCase().replace(/\s/g, "_") === "NOT_PLANNED";
+
+const commentFor = (label) => label === "workflow:decomposed"
+  ? "Close reason corrected to `completed`: this issue was decomposed and its scope moved to its sub-issues, it was not dropped (`workflow:decomposed`). Re-closed by `forgedock fix-close-reasons` (#5177)."
+  : "Close reason corrected to `completed`: the work was delivered and merged, it was not dropped (`workflow:merged`). Re-closed by `forgedock fix-close-reasons` (#5177).";
+
+/** Closed `not planned` issues that were delivered: [{number, label}], by issue number, once each. */
+export async function findMisclosed({ gh, repo, milestone }) {
+  const found = new Map();
+  for (const label of DELIVERED) {
+    const out = await gh(["issue", "list", "-R", repo, "--state", "closed", "--label", label, ...(milestone ? ["--milestone", milestone] : []), "--limit", "1000", "--json", "number,stateReason,labels"]);
+    for (const i of JSON.parse(String(out || "[]"))) {
+      const names = (i.labels ?? []).map((l) => (typeof l === "string" ? l : l.name));
+      if (!isNotPlanned(i.stateReason) || names.includes("workflow:invalid") || found.has(i.number)) continue;
+      found.set(i.number, { number: i.number, label });
+    }
+  }
+  return [...found.values()].sort((a, b) => a.number - b.number);
+}
+
+export async function runFixCloseReasonsCli(argv, deps = {}) {
+  const val = (n) => { const i = argv.indexOf(n); return i >= 0 ? argv[i + 1] : null; };
+  const repo = argv[0] && !argv[0].startsWith("--") ? argv[0] : (val("--repo") ?? deps.repo ?? null);
+  if (!repo || !/^[^/\s]+\/[^/\s]+$/.test(repo)) throw new Error("usage: forgedock fix-close-reasons <owner/repo> [--milestone <title|number>] [--apply]");
+  const milestone = val("--milestone");
+  if (argv.includes("--milestone") && (!milestone || milestone.startsWith("--"))) throw new Error("--milestone requires a milestone title or number");
+  const apply = argv.includes("--apply");
+  const gh = deps.gh ?? (await import("./effects.mjs")).makeLeanIo({ repo }).gh;
+  const print = deps.print ?? ((t) => console.log(t));
+  const items = await findMisclosed({ gh, repo, milestone });
+  let changed = 0, failed = 0;
+  for (const { number, label } of items) {
+    if (!apply) { print(`would re-close #${number} as completed (${label})`); continue; }
+    try {
+      await gh(["api", "-X", "PATCH", `repos/${repo}/issues/${number}`, "-f", "state=closed", "-f", "state_reason=completed"]);
+      await gh(["issue", "comment", String(number), "-R", repo, "--body", commentFor(label)]);
+      changed++;
+      print(`re-closed #${number} as completed (${label})`);
+    } catch (e) { failed++; print(`#${number}: failed: ${String(e?.message ?? e).slice(0, 160)}`); }
+  }
+  print(`fix-close-reasons: ${items.length} found, ${changed} changed, ${failed} failed${apply ? "" : " (dry run, pass --apply to write)"}`);
+  return failed ? 1 : 0;
+}

package/bin/lean/fixclosereasons.test.mjs

@@ -0,0 +1,64 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { runFixCloseReasonsCli } from "./fixclosereasons.mjs";
+
+const L = (...n) => n.map((name) => ({ name }));
+function fake({ lists, failOn } = {}) {
+  const calls = [], out = [];
+  const gh = async (a) => {
+    calls.push(a);
+    if (a[0] === "issue" && a[1] === "list") return JSON.stringify(lists[a[a.indexOf("--label") + 1]] ?? []);
+    if (a[0] === "api" && failOn === a[3].split("/").pop()) throw new Error("boom");
+    return "";
+  };
+  return { gh, calls, out, print: (t) => out.push(t) };
+}
+const lists = {
+  "workflow:merged": [
+    { number: 1, stateReason: "NOT_PLANNED", labels: L("workflow:merged") },
+    { number: 2, stateReason: "COMPLETED", labels: L("workflow:merged") },
+    { number: 3, stateReason: "NOT_PLANNED", labels: L("workflow:merged", "workflow:invalid") },
+  ],
+  "workflow:decomposed": [
+    { number: 4, stateReason: "NOT_PLANNED", labels: L("workflow:decomposed") },
+    { number: 1, stateReason: "NOT_PLANNED", labels: L("workflow:merged", "workflow:decomposed") },
+  ],
+};
+
+describe("#5177 fix-close-reasons", () => {
+  it("re-closes NOT_PLANNED merged and decomposed issues as completed with a comment; leaves the rest", async () => {
+    const f = fake({ lists });
+    assert.equal(await runFixCloseReasonsCli(["o/r", "--apply"], f), 0);
+    const patches = f.calls.filter((a) => a[0] === "api");
+    assert.deepEqual(patches.map((a) => a[3]), ["repos/o/r/issues/1", "repos/o/r/issues/4"]);
+    for (const p of patches) assert.deepEqual(p.slice(0, 3).concat(p.slice(4)), ["api", "-X", "PATCH", "-f", "state=closed", "-f", "state_reason=completed"]);
+    const comments = f.calls.filter((a) => a[1] === "comment");
+    assert.deepEqual(comments.map((a) => a[2]), ["1", "4"]);
+    assert.match(comments[0][comments[0].indexOf("--body") + 1], /delivered and merged/);
+    assert.match(comments[1][comments[1].indexOf("--body") + 1], /decomposed/);
+    assert.match(f.out.at(-1), /2 found, 2 changed, 0 failed/);
+  });
+  it("is a dry run without --apply: no write", async () => {
+    const f = fake({ lists });
+    assert.equal(await runFixCloseReasonsCli(["o/r"], f), 0);
+    assert.equal(f.calls.filter((a) => a[0] !== "issue" || a[1] !== "list").length, 0);
+    assert.match(f.out.join("\n"), /would re-close #1/);
+  });
+  it("--milestone narrows the list query", async () => {
+    const f = fake({ lists: {} });
+    await runFixCloseReasonsCli(["o/r", "--milestone", "M1"], f);
+    for (const c of f.calls) assert.equal(c[c.indexOf("--milestone") + 1], "M1");
+    assert.equal(f.calls.length, 2);
+  });
+  it("counts a failed write and exits 1, continuing with the next issue", async () => {
+    const f = fake({ lists, failOn: "1" });
+    assert.equal(await runFixCloseReasonsCli(["o/r", "--apply"], f), 1);
+    assert.match(f.out.at(-1), /2 found, 1 changed, 1 failed/);
+  });
+  it("throws usage without a repo", async () => {
+    await assert.rejects(runFixCloseReasonsCli([], fake()), /usage: forgedock fix-close-reasons/);
+    await assert.rejects(runFixCloseReasonsCli(["--apply"], fake()), /usage/);
+  });
+});

package/bin/lean/heavy.mjs

@@ -266,10 +266,16 @@ export function heavyShimScript(name, real, { node = process.execPath, script =
   return `${SHIM_HEADER}export FORGE_HEAVY_SHIM_DIR="$(cd "$(dirname "$0")" && pwd)"\nexec ${q(node)} ${q(script)} run --name ${q(name)} -- ${q(real)} "$@"\n`;
 }
 
-/** True when `text` is a shell-style script that looks `name` up on PATH itself (a pass-through wrapper, #4680). */
+/**
+ * True when `text` is a shell-style script that looks `name` up on PATH itself (a pass-through wrapper, #4680). The lookup
+ * target may be the literal name, or (#5148) a variable/substitution when the script derives that name from `$0`
+ * (a `${0##…}` strip or `basename "$0"`), the shape of a wrapper symlinked under several command names.
+ */
 export function isPassThroughWrapper(text, name) {
   const t = String(text ?? "");
-  return t.startsWith("#!") && t.includes(name) && /\b(command\s+-v|which|type\s+-p)\b/.test(t);
+  if (!t.startsWith("#!") || !/\b(command\s+-v|which|type\s+-p)\b/.test(t)) return false;
+  if (t.includes(name)) return true;
+  return /(?:command\s+-v|which|type\s+-p)\s+(?:-\s+)?["']?\$/.test(t) && /\$\{0##\*\/\}|basename\s+(?:--\s+)?["']?\$\{?0\b/.test(t);
 }
 const head = (p) => { try { return readFileSync(p, "utf8").slice(0, 4096); } catch { return ""; } };
 
@@ -332,6 +338,8 @@ export function findShimLoops(path, { names = HEAVY_BINS, find = which, read = h
 }
 
 export const SHIM_LOOP_MAX = 4;
+/** #5148: hard bound on shim entries (FORGE_HEAVY_DEPTH) whatever the wrapper shape; far above legitimate `npm run` nesting. */
+export const SHIM_DEPTH_MAX = 32;
 /**
  * Re-entry guard (#4680): FORGE_HEAVY_CHAIN lists `name:cmd` per shim run. A repeat of the same name+cmd where cmd is a
  * pass-through wrapper means it sent the call back to the shim; a repeat of a real binary is a legitimate nested call
@@ -342,15 +350,17 @@ export function guardChain(name, cmd, env, read = head) {
   const chain = String(env.FORGE_HEAVY_CHAIN ?? "").split("|").filter(Boolean);
   const dirs = chain.map((e) => dirname(e.slice(e.indexOf(":") + 1)));
   const loop = (why) => ({ error: `env.shim_loop: ${name} ${why} (PATH dirs: ${[env.FORGE_HEAVY_SHIM_DIR, ...dirs].filter(Boolean).join(", ") || "none"})` });
+  const depth = Math.max(0, Number.parseInt(env.FORGE_HEAVY_DEPTH, 10) || 0);
+  if (depth >= SHIM_DEPTH_MAX) return loop(`re-entered the heavy shim ${depth} levels deep (max ${SHIM_DEPTH_MAX})`);
   const repeat = chain.includes(`${name}:${cmd}`);
-  if (repeat && !isPassThroughWrapper(read(cmd), name)) return { cmd, env };
+  if (repeat && !isPassThroughWrapper(read(cmd), name)) return { cmd, env: { ...env, FORGE_HEAVY_DEPTH: String(depth + 1) } };
   if (chain.length >= SHIM_LOOP_MAX) return loop(`re-entered the heavy shim more than ${SHIM_LOOP_MAX} times`);
   if (repeat) {
     const next = which(name, env.PATH ?? "", [env.FORGE_HEAVY_SHIM_DIR, ...dirs].filter(Boolean));
     if (!next) return loop(`re-entered via ${cmd} and no other ${name} is on PATH`);
     cmd = next;
   }
-  return { cmd, env: { ...env, FORGE_HEAVY_CHAIN: [...chain, `${name}:${cmd}`].join("|") } };
+  return { cmd, env: { ...env, FORGE_HEAVY_DEPTH: String(depth + 1), FORGE_HEAVY_CHAIN: [...chain, `${name}:${cmd}`].join("|") } };
 }
 
 /**

package/bin/lean/heavy.test.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "node:child_process";
 import { writeFileSync, readFileSync, mkdirSync, chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { guardChain, isPassThroughWrapper, SHIM_LOOP_MAX, classifyStep, heavyConfig, openHeavy, acquireHeavy, writeHeavyShims, heavyShimScript, sumWaits, runWrapped, HEAVY_BINS, isHeavyProcess } from "./heavy.mjs";
+import { guardChain, isPassThroughWrapper, SHIM_LOOP_MAX, SHIM_DEPTH_MAX, classifyStep, heavyConfig, openHeavy, acquireHeavy, writeHeavyShims, heavyShimScript, sumWaits, runWrapped, HEAVY_BINS, isHeavyProcess } from "./heavy.mjs";
 import { checkAdmission, ADMISSION_DEFAULTS, localLaneCap } from "./admission.mjs";
 import { formatAlertLines, formatWaitSummary } from "./orchestrate.mjs";
 import { readHeavy, readAdmission, liveLaneCap } from "../engine-cli.mjs";
@@ -347,3 +347,57 @@ describe("validation steps and the local lane cap (#4777)", () => {
     assert.equal(liveLaneCap(null, { cfg: readAdmission(d), host: { cores: () => 16, memAvailableMb: () => 64000 } })(), 2);
   });
 });
+
+describe("#5148 dynamic-name pass-through wrapper", () => {
+  const WRAP = (log) => `#!/bin/bash\nname=\${0##*/}\necho w >> "${log}"\n[ "$(wc -l < "${log}")" -gt 12 ] && exit 99\nself_dir=$(cd "\${0%/*}" && pwd)\nreal=$(PATH=$(printf '%s' "$PATH" | tr ':' '\\n' | grep -vxF "$self_dir" | paste -sd:) command -v "$name")\nexec "$real" "$@"\n`;
+  const fixture = () => {
+    const d = tmpDir("heavy-5148-"), wrap = join(d, "wrap"), real = join(d, "real"), bin = join(d, "bin"), log = join(d, "log");
+    for (const x of [wrap, real, bin]) mkdirSync(x, { recursive: true });
+    writeFileSync(log, "");
+    writeFileSync(join(wrap, "docker"), WRAP(log));
+    writeFileSync(join(real, "docker"), `#!/bin/sh\necho r >> ${log}\necho real-docker\n`);
+    for (const x of [wrap, real]) chmodSync(join(x, "docker"), 0o755);
+    return { d, wrap, real, bin, log };
+  };
+  const lines = (log) => readFileSync(log, "utf8").split("\n").filter(Boolean);
+
+  it("#5148: a ${0##*/} pass-through wrapper on PATH does not recurse through the heavy shim", async () => {
+    const { wrap, real, bin, log } = fixture();
+    assert.ok(isPassThroughWrapper(readFileSync(join(wrap, "docker"), "utf8"), "docker"));
+    assert.ok(isPassThroughWrapper('#!/bin/sh\nexec "$(command -v "$(basename "$0")")" "$@"', "docker"));
+    assert.ok(!isPassThroughWrapper("#!/bin/sh\necho hi\n", "docker"));
+    assert.ok(!isPassThroughWrapper('#!/bin/sh\nx=git\nexec "$(command -v "$x")" "$@"', "docker"), "dynamic lookup without a $0-derived name is not a wrapper");
+    assert.deepEqual(await writeHeavyShims(bin, { path: `${wrap}:${real}`, warn: () => {} }), ["docker"]);
+    assert.match(readFileSync(join(bin, "docker"), "utf8"), new RegExp(`-- '${real}/docker' "\\$@"`));
+    const env = { ...process.env, PATH: `${bin}:${wrap}:${real}:/usr/bin:/bin`, FORGE_HEAVY_DISABLED: "1" };
+    const r = spawnSync(join(bin, "docker"), ["ps"], { env, encoding: "utf8", timeout: 20000 });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stdout, /real-docker/);
+    assert.deepEqual(lines(log), ["r"], "the wrapper never ran; the real binary ran once");
+  });
+
+  it("#5148: with the shim baking the wrapper, the call reaches the real binary within SHIM_LOOP_MAX levels", () => {
+    const { wrap, real, bin, log } = fixture();
+    writeFileSync(join(bin, "docker"), heavyShimScript("docker", join(wrap, "docker"))); chmodSync(join(bin, "docker"), 0o755);
+    const env = { ...process.env, PATH: `${bin}:${wrap}:${real}:/usr/bin:/bin`, FORGE_HEAVY_DISABLED: "1" };
+    const r = spawnSync(join(bin, "docker"), ["ps"], { env, encoding: "utf8", timeout: 20000 });
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(lines(log).length <= SHIM_LOOP_MAX + 1, lines(log).join(","));
+    assert.equal(lines(log).at(-1), "r");
+  });
+
+  it("#5148: guardChain stops at SHIM_DEPTH_MAX even for a repeat it judges legitimate, and counts each entry", () => {
+    const env = { PATH: "/s:/r", FORGE_HEAVY_SHIM_DIR: "/s", FORGE_HEAVY_CHAIN: "npm:/r/npm", FORGE_HEAVY_DEPTH: String(SHIM_DEPTH_MAX) };
+    assert.match(guardChain("npm", "/r/npm", env, () => "").error, /^env\.shim_loop: npm .*levels deep/);
+    const ok = guardChain("npm", "/r/npm", { ...env, FORGE_HEAVY_DEPTH: String(SHIM_DEPTH_MAX - 1) }, () => "");
+    assert.equal(ok.error, undefined); assert.equal(ok.env.FORGE_HEAVY_DEPTH, String(SHIM_DEPTH_MAX));
+  });
+
+  it("#5148: under systemd-run TasksMax the shimmed call finishes without hitting the limit", { skip: spawnSync("systemd-run", ["--user", "--scope", "-q", "true"], { timeout: 10000 }).status !== 0 && "no systemd --user manager" }, () => {
+    const { wrap, real, bin, log } = fixture();
+    writeFileSync(join(bin, "docker"), heavyShimScript("docker", join(wrap, "docker"))); chmodSync(join(bin, "docker"), 0o755);
+    const r = spawnSync("systemd-run", ["--user", "--scope", "-q", "-p", "TasksMax=64", "env", `PATH=${bin}:${wrap}:${real}:/usr/bin:/bin`, "FORGE_HEAVY_DISABLED=1", join(bin, "docker"), "ps"], { encoding: "utf8", timeout: 30000 });
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(lines(log).length < 13);
+  });
+});