fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring

Problem

fleet serve <broker-role> <anything> silently discards every argument after the role and starts the daemon anyway. The broker entry points take no arguments at all, so there is nothing for a stray argument to bind to — a typo'd flag or an extra word does not produce an error, it produces a running queue-broker / secrets-broker.

This is the un-fixed remainder of #5488: that fix intercepted a help flag in the one position after the role (wants_domain_help), but any non-help argument in the same position — and any argument at all through the argv0 aliases — still flows straight into the daemon entry point.

Evidence (verified this run, laptop primary at `e844ed1`)

Code:

pkgs/fleet/crates/fleet/src/main.rs — run_domain: for serve + queue-broker it calls fleet_queue::queue_broker::run() and for secrets-broker fleet_queue::secrets_broker::run(), never inspecting args[1..]. The argv0-alias route (queue-broker / secrets-broker as argv0) lands in the same run_domain after the implied role arg is prepended, so it has the same hole.
pkgs/fleet/crates/fleet-queue/src/queue_broker.rs:589 — pub fn run() -> i32 (no args).
pkgs/fleet/crates/fleet-queue/src/secrets_broker.rs:189 — pub fn run() -> i32 (no args).

Probe (fleet binary rebuilt on the laptop from e844ed1, Source rev: e844ed152dd1; HOME pointed at an empty dir so the daemon dies at its first startup step — the token-file read — proving which path was entered):

invocation	result
`fleet serve queue-broker --help`	domain help, exit 0 (control — #5488 fix works)
`fleet serve queue-broker`	`queue-broker: cannot read token file …`, exit 3 (daemon startup)
`fleet serve queue-broker --bogus-junk`	identical token-file error, exit 3
`fleet serve queue-broker frobnicate`	identical token-file error, exit 3
`fleet serve secrets-broker --bogus-junk`	`secrets-broker: cannot read token file …`, exit 3
`queue-broker --bogus-junk` (argv0 alias)	identical token-file error, exit 3

With the real token files present the same invocations proceed past the token read to binding the broker port (observed with the pre-fix binary: cannot bind 100.99.113.103:4801: Address already in use — it had entered run() far enough to attempt the bind).

Why it matters

These brokers hold the queue's service-role credentials path and the secrets resolver. A systemd unit, wrapper script, or operator invocation with a typo'd or stale flag (e.g. a removed --bind option, exactly the shape #5488's test comment worries about) silently starts a daemon with default bind/token settings instead of failing loudly — the same fail-open shape the fleet has been stamping out in #5560 (dispatch status), #5460 (fleet-config) and the deploy-script series (#3287/#3297/#3296).

Acceptance criteria

fleet serve queue-broker <any extra arg> and fleet serve secrets-broker <any extra arg> exit 2 with a usage error naming the unexpected argument, before any daemon startup (no token-file read, no bind attempt).
The argv0 aliases behave identically: queue-broker <extra> / secrets-broker <extra> exit 2.
fleet serve <role> --help / -h / help still prints domain help with exit 0 (fleet: serve <role> --help (and the queue-broker/secrets-broker argv0 aliases) starts the daemon instead of printing help #5488 behavior preserved), and a bare fleet serve <role> still starts the daemon.
A pinning unit test covers the rejection (in the style of the existing wants_domain_help tests in crates/fleet/src/main.rs).
cargo test -p fleet passes on the laptop or in CI.

CODE-1376

🤖 Agent note · filed

Agent: new-issue-creator job (new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-11-04T15:35Z (cron job new-issue-creator-code-a)
Found via: filed this run
Task: fleet serve broker roles (queue-broker / secrets-broker) silently ignore all trailing arguments and start the daemon; verified by code read + laptop probe at e844ed1 (see issue body). Remainder of fleet: serve <role> --help (and the queue-broker/secrets-broker argv0 aliases) starts the daemon instead of printing help #5488, same fail-open class as fleet dispatch status silently ignores all arguments — --help performs a live GET /health and typos are swallowed #5560.
Expectation: effort/xs — reject extra args with a usage error (exit 2) before daemon startup, pinning test included; "done" = acceptance criteria in the issue body met.
Links: evidence + probe table in the issue body; body file hidden_files/issue-fleet-serve-broker-args.md

🤖 Agent note · picked up

Agent: new-issue-creator job (new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-11-04T15:35Z
Found via: self-assigned during new-issue-creator-code-a run (guarded self-solve, lifecycle protocol §4 — filed this run, trivial, no safety labels)
Task: reject trailing args after the queue-broker/secrets-broker roles in run_domain (exit 2 usage error) + pinning test; branch creator-a/5568-serve-broker-args; queue task 9662 cancelled as self-assigned in the same pass.
Expectation: effort/xs — done = PR merged with cargo test -p fleet green on the laptop and the fixed binary re-probed (junk → exit 2, --help → exit 0, bare role → daemon path).
Links: task 9662 (cancelled, self-assigned)

🤖 Agent note · handed off

Agent: new-issue-creator job (new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-11-04T15:35Z
Found via: filed this run
Task: Stand-down correction to my "picked up" note above: the guarded self-solve takeover raced a queue claim — task 9662 was already claimed by the queue worker when the cancel ran (cancel_repo_task: task 9662 is not queued or parked). Per lifecycle protocol §6 Duty 4, the first holder keeps the item: the queue worker holds task 9662; I am NOT self-solving. Labels reset to the claimed state (queue/claimed + work/assigned + status/in-progress).
Expectation: effort/xs — the claiming worker implements the acceptance criteria in the issue body.
Links: task 9662 (claimed, repo-health-code-pilot)

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-i
Session / ID: task 9662
Found via: queue claim
Task: Work issue fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568 (small_fix) — assigned to the opencode execution lane; handing off to the opencode claimant, which launches the bound session. Fresh check: issue fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568 OPEN, no held / user/owned / do-not-merge / do-not-auto-edit labels.
Expectation: claimant session drives the work to its terminal state.
Links: issue fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-s
Session / ID: task 9662
Found via: queue claim
Task: Fix for issue fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568 (fleet serve broker roles reject trailing arguments) — assigned to the opencode execution lane; parked 20m after handoff checkpoint. The laptop claimant launches the bound opencode session, which drives task 9662 to its terminal state. Attempts 18/32.

Cross-link from the creator run that filed #6212: the standalone queue-broker / secrets-broker [[bin]] artifacts in fleet-queue bypass this issue's run_domain route entirely (their main()s call run() directly), so they are filed separately as #6212 with the boundary stated in both bodies. This issue's scope (fleet serve + argv0 aliases) is unchanged.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-s
Session / ID: task 9662
Found via: queue claim
Task: Small fix for issue fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568 (fleet serve broker roles reject trailing arguments) — execution-lane assignment returned opencode again (attempts 18/32), so this task is handed off; the laptop claimant launches the bound opencode session which drives it to its terminal state.
Expectation: Claimant session implements the arg rejection + pinning test per task 9662 packet and opens the PR.
Links: task 9662 · issue fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568

Agent note - handed off

Agent: opencode claimant (opencode-claimant)
Session / ID: queue task 9662; bound session ses_e5e5353d6deffeAyOvxCtuJn55
Found via: queue task handoff on the opencode execution lane
Task: Small-fix fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568: fleet serve broker roles reject trailing arguments instead of starting the daemon
Expectation: the bound worker session works task 9662 to a terminal queue state and must not claim another task. It revalidates the issue/PR before acting.
Links: fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568

Navigation Menu

Repository navigation

fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568

Problem

Evidence (verified this run, laptop primary at `e844ed1`)

Why it matters

Acceptance criteria

37 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fleet: serve <broker-role> silently ignores all trailing arguments — a typo'd flag starts the daemon instead of erroring #5568

Description

Problem

Evidence (verified this run, laptop primary at e844ed1)

Why it matters

Acceptance criteria

Activity

developing-today commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

37 remaining items

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (verified this run, laptop primary at `e844ed1`)