ctrlrelay 0.16.2__tar.gz → 0.16.4__tar.gz

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/CHANGELOG.md

@@ -7,6 +7,53 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.4] - 2026-11-01
+
+Fixes for runs whose work could not be published. **No config edit is
+required.** `poller_state.json` gains a `publish_failures` count, added
+automatically.
+
+### Fixed
+
+- A failed publish no longer strands the issue. `poll()` marks an issue seen
+  before handing it to the handler, so a run whose agent finished but whose
+  branch the relay could not publish stayed in `seen_issues` forever: the
+  claim was retracted, the automation label was still on it, and the relay
+  never came back. The issue is now un-marked for the next poll, up to 3
+  runs, counted in `publish_failures` in `poller_state.json` (saved together
+  with the un-mark) so a restart does not reset the limit. After the third
+  the relay says on the issue that it has stopped, with the error scrubbed,
+  and says so in chat if that comment cannot be posted. A *refused* push is
+  not retried at all: the relay reaches the same refusal every time (#278,
+  closes #268)
+- The retraction comment no longer advises a retry that cannot work. It said
+  to re-assign the issue or re-apply its automation label, but the skip
+  decision reads the issue number alone, so neither did anything. It now
+  says that while the poller is running the relay tries again a limited
+  number of times and says so if it stops, and otherwise names the one route
+  that works (#278, closes #268)
+- A failed push says why. The rejected ref and git's reason (a stale lease,
+  a non-fast-forward, a protection rule) lead the error, the remote's own
+  `remote:` lines follow, and the reason reaches `dev.publish.failed` as its
+  own `push_rejection` field. Before, only git's summary line naming the URL
+  survived. Every failing git command now reports both of its output
+  streams, scrubbed of credential shapes (#277, closes #269)
+
+## [0.16.3] - 2026-11-01
+
+A security fix: **upgrade every machine.** No config edit is required.
+
+### Fixed
+
+- Only issues the operator assigned to themselves are taken, as intended.
+  The check read `actor` on GitHub's `assigned` events, which is the account
+  assigned (the operator), not the one who assigned it (`assigner`), so an
+  issue anyone else assigned to the operator was taken too. It now reads
+  `assigner`, refuses an event without one, refuses an unnamed assignment
+  after the operator's last one, and reads every page of an issue's events.
+  The status page's "assigned by someone else" uses the same check (#275,
+  closes #274)
+
 ## [0.16.2] - 2026-11-01
 
 Status page changes only. **No config edit is required.**
@@ -2001,7 +2048,9 @@ pipeline).
   per-phase implementation plans (Phase 0 through Phase 4).
 - `docs/Claude_Code_Project_Guide.md` — project development guide.
 
-[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.2...HEAD
+[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.4...HEAD
+[0.16.4]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.3...v0.16.4
+[0.16.3]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.2...v0.16.3
 [0.16.2]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.1...v0.16.2
 [0.16.1]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.0...v0.16.1
 [0.16.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.15.0...v0.16.0

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ctrlrelay
-Version: 0.16.2
+Version: 0.16.4
 Summary: Local-first orchestrator for headless coding agents across multiple GitHub repos
 Project-URL: Homepage, https://github.com/AInvirion/ctrlrelay
 Project-URL: Documentation, https://ainvirion.github.io/ctrlrelay/

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/docs/configuration.md

@@ -133,7 +133,21 @@ private git dir with hooks off and only ctrlrelay's own git config, pushes the
 commit it checked rather than the ref name, and uses `--force-with-lease`
 against the head this session last pushed (recorded in the state DB). An
 open PR found for the branch is reused only if its head repo is this repo and
-its base is the default branch. Text the agent wrote is posted with `@`-mentions and
+its base is the default branch.
+
+A push git rejects for a ref is a different thing, logged as
+`publish.push.rejected` with the per-ref reason git gave. Some are decided by
+git itself before the remote is asked (a stale lease, a non-fast-forward:
+`[rejected]`), others by the remote (a branch-protection or repository-rule
+refusal: `[remote rejected]`). That reason
+comes from the `!` line of `git push --porcelain`, which git writes to
+**stdout**; stderr carries only `error: failed to push some refs to '<url>'`.
+Both streams of any failing git command now reach the error it raises (stderr
+whole, stdout capped, both scrubbed of credential shapes), and the reason
+reaches `dev.publish.failed` as its own `push_rejection` field, so a
+rejection is not reported as a URL and nothing else.
+
+Text the agent wrote is posted with `@`-mentions and
 issue-closing keywords disabled and its length capped (20,000 characters);
 the PR's own `Closes #N` is added by ctrlrelay.
 

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/docs/operations.md

@@ -727,6 +727,30 @@ file, so a restart does not reset it. Each retry posts a fresh claim
 comment and, when it fails, a fresh "nothing is working on this" comment
 on the issue.
 
+A run whose **agent finished but whose branch the relay could not
+publish** is retried the same way, for the same reason: the issue is
+already in `seen_issues`, so without this nothing would ever bring it
+back. Up to 3 runs in all, counted in `publish_failures` in the same
+file, and the retraction comment on the issue says the relay will
+return rather than asking you to re-assign it. After the third run the
+issue stays in `seen_issues` and the relay says so **on the issue** —
+the commits are still on the run branch in the local checkout (on
+GitHub too, if only opening the pull request failed), and the fix is to
+clear the cause and delete the number as above. If that comment cannot
+be posted, the chat line says so.
+
+A push the relay **refuses** (a protected or default branch, a base it
+did not expect, somebody else's commits on the branch) is not retried
+at all: the relay reaches the same refusal every time, so another run
+would spend a whole agent to arrive at it. The issue stays in
+`seen_issues` and the comment names what to do.
+
+Re-assigning an issue, or re-applying its automation label, does **not**
+make the poller look at it again. The skip decision reads the issue
+number only — no assignee and no labels — so the number has to leave
+`seen_issues` (and the relay has to be restarted, since the running
+poller holds the set in memory and rewrites the file from it).
+
 ### A repo whose history was replaced
 
 If the local copy's default branch can no longer fast-forward to GitHub's

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ctrlrelay"
-version = "0.16.2"
+version = "0.16.4"
 description = "Local-first orchestrator for headless coding agents across multiple GitHub repos"
 readme = "README.md"
 requires-python = ">=3.12"

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/src/ctrlrelay/cli.py

@@ -1183,6 +1183,123 @@ def settle_pre_dispatch_failure(poller, repo: str, issue_number: int, result):
     )
 
 
+# Runs of one issue whose branch the relay may fail to publish before
+# the poller stops retrying it (#268). Same shape and same reason as
+# PRE_DISPATCH_ATTEMPTS: a blip deserves another poll, a permanent cause
+# must not spend one full agent run per poll forever.
+PUBLISH_ATTEMPTS = 3
+
+
+def publish_failure_message(
+    repo: str, issue_number: int, error: str, *, attempts: int, retrying: bool,
+) -> str:
+    """The chat line for a run whose branch the relay could not publish."""
+    why = (error.strip().splitlines() or ["no error recorded"])[0][:200]
+    if retrying:
+        return (
+            f"\u23f3 #{issue_number} in {repo}: the agent finished but the "
+            f"relay could not publish the branch (try {attempts} of "
+            f"{PUBLISH_ATTEMPTS}): {why}. Will retry on the next poll."
+        )
+    return (
+        f"\u274c #{issue_number} in {repo}: could not publish the branch "
+        f"{attempts} times; not retrying. Last error: {why}. The commits "
+        "are on the run branch locally; fix the cause, then remove the "
+        "issue number from seen_issues in poller_state.json to try again."
+    )
+
+
+async def settle_publish_failure(
+    github, poller, repo: str, issue_number: int, result,
+):
+    """Decide what a failed publish means for retrying its issue (#268).
+
+    `poll()` marks an issue seen BEFORE handing it to the handler, so a
+    publish failure nobody un-marks drops the issue forever: the claim
+    is retracted, the automation label is still on it, and the relay
+    never comes back. Nothing in the logs says why, because from the
+    relay's own point of view nothing is wrong.
+
+    So: the agent finished and only the publish failed, and the push was
+    not refused -> count it, and below ``PUBLISH_ATTEMPTS`` un-mark the
+    issue so the next poll runs it again. At the limit the issue stays
+    seen, the count is dropped, and the relay says on the ISSUE that it
+    has stopped — the retraction already there promised a retry, and a
+    promise silently abandoned is the original defect one step on.
+
+    A refused push is not retried at all: the relay re-reaches that
+    refusal every time, so another attempt costs a whole agent run to
+    arrive at the same answer. Returns the chat line, or ``None`` for
+    any result this is not about.
+
+    Writing the issue comment is best-effort: this runs after a run that
+    has already failed, and a `gh` error here must not replace the run's
+    real failure with a different one.
+    """
+    from ctrlrelay.pipelines.dev import (
+        publish_failure_is_retryable,
+        publish_retries_exhausted_comment,
+    )
+
+    outputs = result.outputs or {}
+    if result.success or result.blocked or not outputs.get("publish_failed"):
+        poller.clear_publish_failures(repo, issue_number)
+        return None
+    if not publish_failure_is_retryable(result):
+        # Refused, not failed. Left seen deliberately; the pipeline's
+        # retraction on the issue already names the operator action.
+        poller.clear_publish_failures(repo, issue_number)
+        log_event(
+            _logger, "publish.refused_not_retried", repo=repo,
+            issue_number=issue_number, error=(result.error or "")[:200],
+        )
+        return (
+            f"\u26d4 #{issue_number} in {repo}: the relay refused to push "
+            f"the branch, so it is not retrying. {result.error or ''}".strip()
+        )
+
+    # The count and the un-mark are saved together, in one write.
+    attempts = poller.publish_failure_count(repo, issue_number) + 1
+    retrying = attempts < PUBLISH_ATTEMPTS
+    poller.count_publish_failure(repo, issue_number, unmark=retrying)
+    notice_failed = False
+    if not retrying:
+        poller.clear_publish_failures(repo, issue_number)
+        try:
+            await github.comment_on_issue(
+                repo=repo,
+                issue_number=issue_number,
+                body=publish_retries_exhausted_comment(
+                    result.session_id,
+                    repo=repo,
+                    issue_number=issue_number,
+                    attempts=attempts,
+                    error=result.error or "",
+                ),
+            )
+        except asyncio.CancelledError:
+            raise
+        except Exception as e:
+            log_event(
+                _logger, "publish.exhausted_notice_failed", repo=repo,
+                issue_number=issue_number,
+                error=f"{type(e).__name__}: {str(e)[:200]}",
+            )
+            notice_failed = True
+    message = publish_failure_message(
+        repo, issue_number, result.error or "",
+        attempts=attempts, retrying=retrying,
+    )
+    if notice_failed:
+        # The issue's last word is still the retraction promising a
+        # retry; chat is now the only place that says it stopped.
+        message += (
+            " The note saying so could not be posted on the issue, which "
+            "still promises a retry."
+        )
+    return message
+
+
 def reclone_message(repo: str, set_aside: Path) -> str:
     """The chat line for a clone that was set aside and cloned again
     (#234). Names where the old copy went, because nothing deletes it."""
@@ -3168,6 +3285,23 @@ def poller_start(
                             pass
                     return
 
+                # The agent finished and the relay could not publish the
+                # branch (#268). Un-marked so the next poll runs it
+                # again, bounded, because the issue is already marked
+                # seen and nothing else would ever bring it back. No
+                # early return: a fix round that failed to push still
+                # has a pull request below that needs its merge watcher.
+                publish_note = await settle_publish_failure(
+                    github, poller, repo, issue_number, result,
+                )
+                if publish_note is not None:
+                    console.print(f"[yellow]{publish_note}[/yellow]")
+                    if connected_transport is not None:
+                        try:
+                            await connected_transport.send(publish_note)
+                        except Exception:
+                            pass
+
                 # Lock-contended DURING PR verification (issue #29): the
                 # PR already exists AND verification decided it wasn't
                 # ready (_verify_and_fix_pr only returns this error from

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/src/ctrlrelay/core/github.py

@@ -424,17 +424,21 @@ class GitHubCLI:
     ) -> list[dict[str, Any]]:
         """List ``assigned`` events for an issue in chronological order.
 
-        Returns the GitHub issue-events payload filtered to ``event == "assigned"``.
-        Each entry includes ``actor`` (who performed the assignment) and
-        ``assignee`` (who was assigned). Used by the poller to verify that the
-        most recent self-assignment was actually performed by the operator.
+        Returns the GitHub issue-events payload filtered to ``event == "assigned"``,
+        every page of it. Each entry includes ``assigner`` (who performed the
+        assignment) and ``assignee`` (who was assigned); its ``actor`` is the
+        assignee too, not who made it (#274). Used by the poller to verify
+        that the most recent self-assignment was actually performed by the
+        operator.
         """
+        # Every page: on an issue with more than one page of events the
+        # latest assignment would otherwise be missed.
         output = await self._run_gh(
-            "api",
+            "api", "--paginate",
             f"/repos/{repo}/issues/{issue_number}/events",
-            "--jq", '[.[] | select(.event=="assigned")]',
+            "--jq", '.[] | select(.event=="assigned")',
         )
-        return json.loads(output) if output.strip() else []
+        return [json.loads(line) for line in output.splitlines() if line.strip()]
 
     async def get_issue(
         self,

{ctrlrelay-0.16.2 → ctrlrelay-0.16.4}/src/ctrlrelay/core/poller.py

@@ -54,12 +54,16 @@ def _is_issues_disabled_error(exc: Exception) -> bool:
     return "has disabled issues" in str(exc).lower()
 
 
-def _read_pre_dispatch_failures(raw: object) -> dict[str, dict[int, int]]:
-    """``pre_dispatch_failures`` from the state file, keeping only
-    entries that are an issue number and a positive whole count (#234).
-    Anything else is dropped rather than trusted: a negative count would
-    lift the retry limit, and a value that cannot convert would stop the
-    poller from loading at all."""
+def _read_failure_counts(raw: object) -> dict[str, dict[int, int]]:
+    """A per-repo, per-issue retry counter from the state file, keeping
+    only entries that are an issue number and a positive whole count
+    (#234). Anything else is dropped rather than trusted: a negative
+    count would lift the retry limit, and a value that cannot convert
+    would stop the poller from loading at all.
+
+    Shared by ``pre_dispatch_failures`` and ``publish_failures`` (#268):
+    one shape, one validator, so a second counter cannot be added with
+    a weaker guard than the first."""
     out: dict[str, dict[int, int]] = {}
     if not isinstance(raw, dict):
         return out
@@ -137,6 +141,11 @@ class IssuePoller:
     # (#234). Persisted with seen_issues so a restart does not reset
     # the limit on a permanent problem.
     pre_dispatch_failures: dict[str, dict[int, int]] = field(default_factory=dict)
+    # Runs whose agent finished but whose branch the relay could not
+    # publish, per repo and issue (#268). Bounds the retry the same way
+    # and for the same reason: the cause may be a blip, and it may be
+    # permanent, and only a counter tells them apart.
+    publish_failures: dict[str, dict[int, int]] = field(default_factory=dict)
     # Issues another machine holds (#245), per repo: when to look again,
     # as an epoch time. In memory only; after a restart the issue is
     # simply checked once more.
@@ -187,9 +196,12 @@ class IssuePoller:
             data = json.loads(self.state_file.read_text())
             raw = data.get("seen_issues", {})
             self.seen_issues = {repo: set(numbers) for repo, numbers in raw.items()}
-            self.pre_dispatch_failures = _read_pre_dispatch_failures(
+            self.pre_dispatch_failures = _read_failure_counts(
                 data.get("pre_dispatch_failures"),
             )
+            self.publish_failures = _read_failure_counts(
+                data.get("publish_failures"),
+            )
         except (ValueError, OSError, AttributeError, TypeError):
             # Corrupt or unreadable state — start fresh. ValueError
             # covers JSONDecodeError and an integer too long to convert;
@@ -197,6 +209,7 @@ class IssuePoller:
             # shape, e.g. a list at the top level or for seen_issues.
             self.seen_issues = {}
             self.pre_dispatch_failures = {}
+            self.publish_failures = {}
 
     def _save_state(self) -> None:
         """Persist seen issues and a ``last_poll`` timestamp to the state file."""
@@ -209,6 +222,11 @@ class IssuePoller:
                 for repo, counts in self.pre_dispatch_failures.items()
                 if counts
             },
+            "publish_failures": {
+                repo: {str(n): c for n, c in sorted(counts.items())}
+                for repo, counts in self.publish_failures.items()
+                if counts
+            },
             "last_poll": datetime.now(timezone.utc).isoformat(),
         }
         self.state_file.parent.mkdir(parents=True, exist_ok=True)
@@ -617,6 +635,25 @@ class IssuePoller:
             return True
 
         events = await self.github.list_assignment_events(repo, issue_number)
+        # An assignment after the operator's last one that names nobody
+        # cannot be ruled out as a newer one by someone else: refuse rather
+        # than skip past it. One before it is overtaken and does not count.
+        last_mine = max(
+            (i for i, e in enumerate(events)
+             if (e.get("assignee") or {}).get("login") == self.username),
+            default=-1,
+        )
+        if any(not (e.get("assignee") or {}).get("login")
+               for e in events[last_mine + 1:]):
+            log_event(
+                _logger,
+                "poll.issue.foreign_assignment",
+                repo=repo,
+                number=issue_number,
+                assigner_login=None,
+                reason="assignment_without_assignee",
+            )
+            return False
         relevant = [
             e
             for e in events
@@ -634,8 +671,12 @@ class IssuePoller:
             return False
 
         # Events endpoint returns chronological order; the last one wins.
+        # Who made the assignment is ``assigner``. On an ``assigned`` event
+        # ``actor`` is the account assigned, which is always the operator
+        # here, so reading it let anyone's assignment through (#274). No
+        # ``assigner`` is treated as foreign.
         latest = relevant[-1]
-        assigner_login = (latest.get("actor") or {}).get("login")
+        assigner_login = (latest.get("assigner") or {}).get("login")
         if assigner_login == self.username:
             return True
 
@@ -793,6 +834,41 @@ class IssuePoller:
             del counts[issue_number]
             self._save_state_best_effort()
 
+    def publish_failure_count(self, repo: str, issue_number: int) -> int:
+        """How many publish failures are counted for ``issue_number``."""
+        return self.publish_failures.get(repo, {}).get(issue_number, 0)
+
+    def count_publish_failure(
+        self, repo: str, issue_number: int, *, unmark: bool,
+    ) -> int:
+        """Count one publish failure and, when ``unmark``, take the issue
+        out of the seen-set, in ONE state write, so a stop between the two
+        cannot leave them disagreeing (#268). Returns the new count."""
+        counts = self.publish_failures.setdefault(repo, {})
+        counts[issue_number] = counts.get(issue_number, 0) + 1
+        if unmark:
+            seen = self.seen_issues.get(repo)
+            if seen:
+                seen.discard(issue_number)
+        self._save_state_best_effort()
+        return counts[issue_number]
+
+    def record_publish_failure(self, repo: str, issue_number: int) -> int:
+        """Count one run of ``issue_number`` whose agent finished but
+        whose branch the relay could not publish, and return how many
+        there have been (#268). Saved best-effort, like ``unmark_seen``."""
+        counts = self.publish_failures.setdefault(repo, {})
+        counts[issue_number] = counts.get(issue_number, 0) + 1
+        self._save_state_best_effort()
+        return counts[issue_number]
+
+    def clear_publish_failures(self, repo: str, issue_number: int) -> None:
+        """Forget the count once a run publishes or is given up."""
+        counts = self.publish_failures.get(repo)
+        if counts and issue_number in counts:
+            del counts[issue_number]
+            self._save_state_best_effort()
+
     async def seed_current(self) -> None:
         """Seed seen_issues with all currently-triggered issues.