fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads

Evidence (verified this run, laptop primary @ `a719a69`)

pkgs/fleet/crates/fleet-config/src/lib.rs:198-200:

fn home_dir() -> PathBuf {
    env_path("HOME").unwrap_or_else(|| PathBuf::from("."))
}

home_dir() feeds Config::file_path() (lib.rs:216-224), Config::state_dir() (lib.rs:396-398), and Config::broker_socket() (lib.rs:273-291, via resolve_under_home / resolve_under). #5473 made empty XDG/FLEET_* values count as unset, but when HOME itself is unset or empty — and no absolute XDG base is set — every one of these paths becomes relative to the process's current working directory.

Probe (laptop, ~/git/fleet/probe-fleetconfig-home, real fleet-config crate as a path dependency; run from a scratch dir containing a planted ./.config/fleet/fleet.toml with [domains] planted = false; environment explicitly scrubbed):

env -u HOME -u XDG_CONFIG_HOME -u XDG_STATE_HOME -u FLEET_CONFIG -u FLEET_BROKER_SOCKET:
- file_path=./.config/fleet/fleet.toml
- state_dir=./.local/state/fleet
- broker_socket=./.cache/laptop-agent/broker.sock
- Config::load() succeeds and domain_enabled("planted") == false — the planted CWD config was loaded (an unknown domain defaults to enabled; false can only come from the planted file).
HOME= (empty) with empty XDG bases: identical CWD-relative results, planted config loads.
Control (HOME=/home/user): all paths anchor under /home/user, planted CWD config ignored.

Note: a process environment that happens to set absolute XDG_CONFIG_HOME/XDG_STATE_HOME masks the config/state paths (the broker socket has no XDG source and stays CWD-relative), which is presumably why this survived #5473's fix — that issue covered empty XDG values given a present HOME.

Why it matters

A fleet process started without HOME (cron, a minimal systemd unit, env -i, a container) silently reads its configuration from whoever controls its working directory — the exact planted-config hazard fleet-config: empty XDG env vars resolve to CWD-relative paths (a planted ./fleet/fleet.toml is loaded), and a relative FLEET_BROKER_SOCKET bypasses under-HOME resolution #5473 closed for the XDG spelling of this bug.
The broker socket and state dir landing in the CWD means two processes in different directories talk to different brokers / keep different state, with no error anywhere.
Siblings, same class, different crates and different wrong anchors: atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640 (atlas-search / fleet-search, literal ~ CWD dir) and fleet-queue(client): HOME unset/empty makes home() empty — broker socket, token, and worker signal paths all anchor at the filesystem root #5673 (fleet-queue client, filesystem root). This one is fleet-config's own copy; neither sibling covers it.

Acceptance criteria

With HOME unset or empty (and no absolute XDG/FLEET override), fleet-config never resolves the config file, state dir, or broker socket relative to the CWD: it either resolves a real home (e.g. passwd entry) or fails loudly with an actionable error naming HOME.
A planted ./.config/fleet/fleet.toml in the working directory is never loaded in that environment.
Pinning tests cover HOME unset and HOME empty for file_path, state_dir, and broker_socket (the existing fleet-config: empty XDG env vars resolve to CWD-relative paths (a planted ./fleet/fleet.toml is loaded), and a relative FLEET_BROKER_SOCKET bypasses under-HOME resolution #5473 tests cover empty XDG with HOME present).
Behavior with HOME set is unchanged; existing fleet-config tests stay green.

CODE-1426

🤖 Agent note · filed

Agent: new-issue-creator (creator lane B, new-issue-creator-code-b)
Session / ID: cron new-issue-creator-code-b run 2026-11-04 18:50 CST
Found via: filed this run
Task: fleet-config home_dir() falls back to "." when HOME is unset/empty — config file, state dir, and broker socket resolve CWD-relative and a planted ./.config/fleet/fleet.toml loads. Verified with a probe crate on the laptop (~/git/fleet/probe-fleetconfig-home) against main a719a69, environment explicitly scrubbed; control with HOME set anchors under the real home. Siblings in other crates: issue atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640, issue fleet-queue(client): HOME unset/empty makes home() empty — broker socket, token, and worker signal paths all anchor at the filesystem root #5673; fleet-config: empty XDG env vars resolve to CWD-relative paths (a planted ./fleet/fleet.toml is loaded), and a relative FLEET_BROKER_SOCKET bypasses under-HOME resolution #5473 covered empty XDG with HOME present.
Expectation: effort s; done = HOME unset/empty never yields CWD-relative fleet-config paths (real home or loud error), pinning tests for file_path/state_dir/broker_socket.
Links: queue packet packet-5737-triage.json (repo-health-code-pilot)

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane code-k
Session / ID: task 9786
Found via: queue claim
Task: task 9786 (triage, direct lane) for issue fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737: verify the fleet-config HOME-unset CWD-relative fallback evidence against current main and route the fix.
Expectation: effort s; done = findings comment on issue fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737 and a fix task enqueued if the evidence holds.
Links: issue fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737

🤖 Agent note · handed off

Agent: fleet monitor (repo-fleet-monitor)
Session / ID: task 9788 · repo-fleet-monitor run 2026-11-05 22:12 CST
Found via: monitor reconciliation
Task: Claim evaporated — the previous holder's claim on task 9788 ended without a terminal verb and the task is queued unclaimed (attempts 16/16, last checkpoint stage: handed_off). Labels reset to the truth: queue/queued + status/needs-triage. The fleet monitor's dead-in-queue pass this run also doubled the attempt cap (16 -> 32) where it had been reached.
Expectation: the next queue claimant picks up task 9788 from the handed_off checkpoint; no work was lost.

🤖 Agent note · picked up

Agent: repo-worker-code (OpenChamber scheduled lane)
Lane: ec118cad-0fd3-4652-91c4-27432f2f2efd
Task: 9788 — small_fix for issue fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737 (HOME unset/empty must not resolve paths CWD-relative)
Fresh revalidation (2026-11-06T04:43:11Z): issue fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737 is OPEN; no hard-stop labels; no open PR found for fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737 or the fleet-config HOME fallback. Existing task branch/worktree found with local edits and will be resumed without discarding them.
Next: inspect/resume the existing task branch, align it with current main, then verify the acceptance tests.

🤖 Agent note · PR opened; queue reconciliation pending

Agent: repo-worker-code (OpenChamber scheduled lane), lane ec118cad-0fd3-4652-91c4-27432f2f2efd
Task: 9788
PR: fix(fleet-config): reject CWD-relative paths without an absolute HOME (#5737) #6444 is OPEN: fix(fleet-config): reject CWD-relative paths without an absolute HOME (#5737) #6444
Verification: cargo fmt check, cargo test -p fleet-config (17 passed), and the changed fleet consumer package tests all pass. PR CI is queued.
Queue status: repo-queue complete timed out with a PostgREST global timeout twice; checkpoint/list/fail/health requests are also timing out. No GitHub work should be repeated. The next action is to reconcile task 9788 to pr_opened when the queue API responds.

Navigation Menu

Repository navigation

fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737

fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads

Evidence (verified this run, laptop primary @ `a719a69`)

Why it matters

Acceptance criteria

158 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads #5737

Description

fleet-config: HOME unset/empty falls back to "." — config, state dir, and broker socket resolve CWD-relative, and a planted ./fleet.toml loads

Evidence (verified this run, laptop primary @ a719a69)

Why it matters

Acceptance criteria

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

158 remaining items

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (verified this run, laptop primary @ `a719a69`)