Hermes Agent
f8d04d1bf4
ci/woodpecker/pr/ci Pipeline failed
Four blockers from adversarial review, and three are one defect wearing three hats: a test over the WHOLE command text deciding an ALLOW. That is the fail-open shape this file keeps rediscovering, and it had reached the break-glass itself. - Break-glass read POSITIONALLY. `case $CMD in *MOSAIC_WRAPPER_OVERRIDE=1*)` cleared the entire command if that string appeared anywhere in it, so quoting the override in a note, naming a variable after it, or writing =10 disabled the guard for the call sitting beside it. Now only leading NAME=value assignments count, exactly where the shell would honour one. Cost, pinned as a fixture: an override after `&&` no longer arms. - $HOME resolved once, and unset / empty / "/" refused. This was filed as a checkout-arm defect and is larger: under `set -u` the old file died at line 62 on EVERY command with HOME unset, exit 1, before the API arms or the APPROVE trap ran. A seat with no HOME (systemd unit, container, env -i) had no guard at all. A checkout whose question cannot be asked now blocks; the blast radius is asserted to be that one command shape and not the session. - Subresource refinement inverted. It asked whether a subresource appears anywhere in the command, so `gh api -X PATCH .../issues/1 -f body=cf-/pulls/2/files` was cleared on the strength of text in its own body. It now clears only when EVERY numbered-object occurrence carries a subresource. - -K/--config refused. curl reads the method, body, headers and URL from that file, so none of them are in the command: every write test read 0 and the call went through. An unreadable request is not a cleared one. mosaic-worktree: never close a git pipe early resolve_repo took the first porcelain line with `awk ... exit`, which closes the read end while git is still writing. git takes SIGPIPE, pipefail returns 141, and the function aborts SILENTLY — no message, no path, exit 141. It fires as a function of REPO SIZE: fine on three worktrees, reliable on seventy. Measured at 73 worktrees (10 KB of porcelain): rc=141, no output. The file already removed a `head -200` for this exact reason; the rule is now uniform. Evidence — every new case run against029af418, the tree before these fixes: test-wrapper-guard.sh 130/130 pass here; 15 FAIL against029af418test-mosaic-worktree-large-repo.sh 2/2 pass here; 2 FAIL against029af418(got rc=141 and empty output, the signature) No pre-existing fixture changed behaviour on the old guard, so the new cases are the whole delta. The size dependence is stubbed out rather than inherited: a test that ran against whatever repo it sits in would have PASSED on the broken tree.
96 lines
4.1 KiB
Bash
96 lines
4.1 KiB
Bash
#!/usr/bin/env bash
|
|
# test-mosaic-worktree-large-repo.sh — the helper must work on the repos it exists for.
|
|
#
|
|
# resolve_repo() took the first line of `git worktree list --porcelain` with
|
|
# `awk '/^worktree /{print substr($0,10); exit}'`. The `exit` closes the read end
|
|
# of the pipe while git is still writing, git takes SIGPIPE, and under
|
|
# `set -euo pipefail` the command substitution returns 141 — so the assignment
|
|
# fails, `set -e` aborts the function, and the script dies printing NOTHING. No
|
|
# message, no path, no worktree, exit 141.
|
|
#
|
|
# What makes it worth a dedicated test rather than a fixture line is WHEN it
|
|
# fires. If git finishes writing before awk leaves, there is no SIGPIPE and
|
|
# everything works. So the failure is a function of how much porcelain the repo
|
|
# produces: invisible on a three-worktree repo, reliable on a seventy-worktree
|
|
# one. It was measured on a repo with 73 worktrees (10 KB of porcelain) — rc=141,
|
|
# no output — and it had passed every hand-check before that, on small repos.
|
|
#
|
|
# A test that ran `git worktree list` against whatever repo it happens to sit in
|
|
# would inherit that same size dependence and would have PASSED on the tree that
|
|
# was broken. So git is stubbed on PATH and made to emit a large porcelain
|
|
# stream, which turns "depends on the repo you are standing in" into "always".
|
|
#
|
|
# Exit: 0 = the helper resolved the repo · 1 = it did not
|
|
|
|
set -uo pipefail
|
|
|
|
HERE="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
TOOL="${1:-$HERE/mosaic-worktree.sh}"
|
|
[ -x "$TOOL" ] || { printf 'test-mosaic-worktree-large-repo: not executable: %s\n' "$TOOL" >&2; exit 2; }
|
|
|
|
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
|
|
mkdir -p "$TMP/bin"
|
|
|
|
# The stub answers exactly the two calls resolve_repo makes, and answers the
|
|
# porcelain one with ~450 KB — comfortably past a 64 KB pipe buffer, so the
|
|
# writer is still writing when a reader that quits early goes away. Anything
|
|
# else exits non-zero rather than pretending to be git.
|
|
cat > "$TMP/bin/git" <<'STUB'
|
|
#!/bin/sh
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in -C) shift 2 ;; *) break ;; esac
|
|
done
|
|
case "$*" in
|
|
"rev-parse --git-dir")
|
|
echo .git; exit 0 ;;
|
|
"worktree list --porcelain")
|
|
# The first entry is the main worktree. That single line is all the helper
|
|
# needs, and it is exactly what it stopped receiving.
|
|
printf 'worktree /src/fakerepo\nHEAD %040d\nbranch refs/heads/main\n\n' 0
|
|
awk 'BEGIN{ for (i = 0; i < 4000; i++)
|
|
printf "worktree /src/fakerepo-worktrees/w%d\nHEAD %040d\nbranch refs/heads/topic-%d\n\n", i, 0, i }'
|
|
# NOT `exit 0`. Real git dies of SIGPIPE here and reports 141, and pipefail
|
|
# in the caller is what turns that into the silent abort. A stub that exits 0
|
|
# regardless hands the caller a clean status and the probe passes on the
|
|
# broken tree — which is how this test failed to be a test on its first run.
|
|
exit $? ;;
|
|
esac
|
|
exit 1
|
|
STUB
|
|
chmod +x "$TMP/bin/git"
|
|
|
|
fail=0
|
|
check() {
|
|
local why="$1" want="$2" got="$3"
|
|
if [ "$want" = "$got" ]; then
|
|
printf 'ok %s\n' "$why"
|
|
else
|
|
printf 'FAIL %s\n want: %s\n got: %s\n' "$why" "$want" "$got"
|
|
fail=1
|
|
fi
|
|
}
|
|
|
|
out="$(PATH="$TMP/bin:$PATH" "$TOOL" path feat/workspace-hygiene 2>&1)"
|
|
rc=$?
|
|
|
|
# Both halves are asserted. rc alone would pass if the helper started printing a
|
|
# usage error, and output alone would miss a non-zero exit — and the defect's
|
|
# signature is precisely a non-zero exit with no output, which only the pair
|
|
# distinguishes from every other way this could go wrong.
|
|
check 'resolving a repo with a large worktree list exits 0' 0 "$rc"
|
|
check 'and derives the path from the main worktree' /src/fakerepo-worktrees/feat-workspace-hygiene "$out"
|
|
|
|
printf '\n'
|
|
if [ "$fail" -eq 0 ]; then
|
|
printf 'mosaic-worktree: resolves against a large porcelain stream.\n'
|
|
else
|
|
cat <<'EOF'
|
|
mosaic-worktree could not resolve the repository.
|
|
|
|
An empty output with a non-zero exit is the SIGPIPE signature: a reader that
|
|
quits early (`awk ... exit`, `head -n`) kills the producer, and pipefail turns
|
|
that into a silent abort. Nothing in this script may close a git pipe early.
|
|
EOF
|
|
fi
|
|
exit "$fail"
|