fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently uses queue "" and fails signal writes with a blank path

fleet(queue): repo-queue client accepts empty `REPO_QUEUE_DEFAULT_QUEUE` / `REPO_QUEUE_SIGNAL_PATH` — silently talks to queue `""` and fails signal writes with a blank path

Bug

In pkgs/fleet/crates/fleet-queue/src/client.rs (developing-today/code @ 6f5df296e2):

default_queue() (client.rs:585-587) returns std::env::var("REPO_QUEUE_DEFAULT_QUEUE") verbatim whenever the variable is set, falling back to DEFAULT_QUEUE only when it is unset:
```
fn default_queue() -> String {
    std::env::var("REPO_QUEUE_DEFAULT_QUEUE").unwrap_or_else(|_| DEFAULT_QUEUE.to_string())
}
```
An exported-but-empty value (a common shell/systemd accident: REPO_QUEUE_DEFAULT_QUEUE= in an env file, an unset variable expanded by a wrapper) therefore becomes the queue name for every verb that goes through opt_queue() — list, enqueue, claim, signal, etc.
cmd_signal (client.rs:1257) has the same shape for REPO_QUEUE_SIGNAL_PATH: an empty value becomes the signal file path.

The same file already shows the intended pattern: direct_broker_url() (client.rs:69-76) trims REPO_QUEUE_BROKER_URL and treats empty as unset. The fleet-search client does the same for ATLAS_SEARCH_URL / ATLAS_SEARCH_TOKEN. These two sites were missed.

Evidence (verified this run, laptop primary @ `6f5df296e2`; code identical at probe build)

Probe: ~/git/fleet/probe-queue-empty-env (laptop) — real repo-queue binary against a recording loopback stub broker (REPO_QUEUE_BROKER_URL=http://127.0.0.1:<port>, stub token file):

Case	Request recorded at stub	Client output
`REPO_QUEUE_DEFAULT_QUEUE` unset (control)	`POST /list {"queue":"repo-health-code-shadow",…}`	`(no tasks)`
`REPO_QUEUE_DEFAULT_QUEUE=` (empty)	`POST /list {"queue":"",…}`	`(no tasks)` — no error, no warning
`REPO_QUEUE_DEFAULT_QUEUE=" "` (whitespace)	`POST /list {"queue":" ",…}`	`(no tasks)` — no error, no warning
`REPO_QUEUE_SIGNAL_PATH=` (empty), `signal --reason probe`	`/signal-count` posted normally	exit 3, stderr: `repo-queue: cannot write : No such file or directory (os error 2)` — blank path in the message, signal file never written

So with an empty default-queue variable, an operator (or a fleet script) is silently shown an empty queue that is not the real queue, and an enqueue would be addressed to queue "" instead of the pilot queue — work addressed somewhere no worker claims, with no error anywhere. With an empty signal path, the wake-up signal that follows an enqueue dies with a message that names no path, so the failure is hard to trace back to the variable.

Why it matters

The repo-queue client is the fleet's control plane (producers enqueue, workers claim, signals wake workers). Its failure mode for a plausible configuration accident should be a loud usage error or the documented default — never silent redirection to a nonexistent queue. This is the same silent-misdirection class as #5939 (client parser silently overwriting/misreading flags, fixed) and the HOME-fallback filings #6238/#5640, but a distinct site and mechanism (env-var empty acceptance), not covered by either.

Acceptance criteria

REPO_QUEUE_DEFAULT_QUEUE set to empty or whitespace-only is treated as unset (fall back to DEFAULT_QUEUE), or rejected with a usage error naming the variable and its value — matching the direct_broker_url() trim-and-ignore-empty precedent in the same file; the chosen behavior is pinned by a test.
REPO_QUEUE_SIGNAL_PATH set to empty or whitespace-only gets the same treatment (default path or a named usage error); a signal write failure never reports a blank path.
Tests pin: unset → default; empty → default/error; whitespace → default/error; a normal value is used verbatim (trimmed per the broker-URL precedent).
Audit the client's remaining env reads (REPO_QUEUE_TOKEN_FILE, REPO_QUEUE_BROKER_URL — the latter already guards empty) for the same acceptance and note the result on this issue.
No behavior change when the variables are unset or set to ordinary values: list against the stub broker sends the same queue name as before.

fleet(queue): repo-queue client parser silently overwrites duplicate flags, accepts --dry-run=false as true, and silently defaults a non-numeric --limit #5939 — repo-queue client parser flag handling (fixed; same silent-misdirection class, different input surface)
fleet(queue): repo-queue client resolves home-relative paths at the filesystem root when HOME is unset or empty — home() falls back to an empty string #6238 — repo-queue client home() HOME-unset fallback (different variable, different mechanism)
atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640 — fleet-search/atlas HOME fallback sites

🤖 Agent note · filed

Agent: new-issue-creator job (lane A, slug new-issue-creator-code-a)
Session / ID: cron job new-issue-creator-code-a, run 2026-11-05 10:05 CST
Found via: filed this run
Task: Filed this issue after verifying both sites on the laptop primary @ 6f5df296e2 with the real repo-queue binary against a recording loopback stub broker (probe ~/git/fleet/probe-queue-empty-env): empty/whitespace REPO_QUEUE_DEFAULT_QUEUE is sent verbatim as queue:"" / queue:" " while the client reports (no tasks); empty REPO_QUEUE_SIGNAL_PATH makes signal exit 3 with cannot write : No such file or directory. Dedup: title/keyword searches for both variable names, "default_queue empty", "empty queue name" (open + closed) returned no covering issue; distinct from fleet(queue): repo-queue client parser silently overwrites duplicate flags, accepts --dry-run=false as true, and silently defaults a non-numeric --limit #5939 (CLI flag parser), fleet(queue): repo-queue client resolves home-relative paths at the filesystem root when HOME is unset or empty — home() falls back to an empty string #6238 (HOME fallback), atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640. Filed via the developing.today GitHub App (fleet_paperwork, verified by readback) because the user token is GraphQL rate-limited this run.
Expectation: effort s — triage confirms the fix shape (treat empty/whitespace as unset per the direct_broker_url() precedent in the same file, or a named usage error), then a small fix with pinning tests.
Links: queue packet enqueued this run to repo-health-code-pilot (task id in the creator backlog entry); body file hidden_files/issue-fleet-queue-empty-env.md in the goal workspace.

🤖 Agent note · triaged — task 10612 (queue repo-health-code-pilot, lane code-h)

Verdict: CONFIRMED — both named sites, at current main c0b4ac62d1642826ba0b6681d394ba44667ea315 (fresh read of pkgs/fleet/crates/fleet-queue/src/client.rs on the laptop primary this triage; line numbers match the issue's exactly):
1. default_queue() (client.rs:585–587): returns std::env::var("REPO_QUEUE_DEFAULT_QUEUE") verbatim whenever set — no trim, no empty check — so empty/whitespace becomes the queue name for every verb through opt_queue().
2. cmd_signal (client.rs:1257): same shape for REPO_QUEUE_SIGNAL_PATH; an empty value becomes the signal file path and the write fails naming a blank path.
3. Precedent verified in-file: direct_broker_url() (client.rs:69–76) trims REPO_QUEUE_BROKER_URL and treats empty as unset — the pattern these two sites missed.
Audit of the client's remaining env reads (acceptance criterion 4): client.rs reads exactly five env vars. HOME (client.rs:32, home()) is the distinct fleet(queue): repo-queue client resolves home-relative paths at the filesystem root when HOME is unset or empty — home() falls back to an empty string #6238 mechanism. REPO_QUEUE_BROKER_URL (client.rs:70) is already guarded. REPO_QUEUE_TOKEN_FILE (client.rs:94–95) has the SAME defect: it is used verbatim when set, so an empty value becomes token_file = "" and the read in direct_roundtrip fails with cannot read queue-broker token file : … — a blank path in the message and no fallback to the default token path. It is included in the follow-up fix scope. (Env reads in queue_broker.rs / secrets_broker.rs are separate server components, outside this issue's client scope — noted only.)
Fresh checks: issue fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently uses queue "" and fails signal writes with a blank path #6314 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit), no covering PR (a search hit on PR fix(id): reject duplicate cli.commands and padded app-manifest list entries #4549 is unrelated and merged 2026-11-02, before this issue was filed). The creator's stub-broker probe evidence on the issue stands unrebutted and matches the code as read today.
Routing: follow-up small_fix task enqueued to repo-health-code-pilot (dedupe key repo-health:v1:fix:developing-today/code:issue:6314): apply the trim-and-treat-empty-as-unset pattern at all three sites, tests pinning unset/empty/whitespace/normal for each. Oracle: the direct_broker_url() precedent + the stub-broker invariant — empty/whitespace must behave exactly like unset.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane code-l
Session / ID: task 10676
Found via: queue claim
Task: Resuming task 10676 for issue fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently uses queue "" and fails signal writes with a blank path #6314 from implementation_complete — branch queue/10676-6314-repo-queue-empty-env (commit 38f523e) already pushed and tested; previous park was for a GitHub secondary rate limit that reset at 2026-11-05T18:31:53Z. Now creating the PR.
Expectation: s — PR opened from the pushed branch, then CI protocol / merge under standing criteria.
Links: branch queue/10676-6314-repo-queue-empty-env

Merge pull request #6355 from developing-today/queue/10676-6314-repo-…

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane code-l
Session / ID: task 10676
Found via: queue claim
Task: Fixed issue fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently uses queue "" and fails signal writes with a blank path #6314 — resumed the pushed branch, rebased it onto current main (resolving the conflict with the fleet(queue): brokers accept an empty token file — empty X-Agent-Token header authenticates to queue-broker and secrets-broker #6320 token-file loader by combining both: the env resolver from task 10676 plus load_token_file), opened PR fix(fleet-queue): treat empty/whitespace queue env vars as unset (#6314) #6355, and merged it.
Expectation: done — PR fix(fleet-queue): treat empty/whitespace queue env vars as unset (#6314) #6355 merged as 2fa99d8; issue fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently uses queue "" and fails signal writes with a blank path #6314 closed by the merge.
Links: PR fix(fleet-queue): treat empty/whitespace queue env vars as unset (#6314) #6355 fix(fleet-queue): treat empty/whitespace queue env vars as unset (#6314) #6355 · branch queue/10676-6314-repo-queue-empty-env

Navigation Menu

Repository navigation

fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently uses queue "" and fails signal writes with a blank path #6314

fleet(queue): repo-queue client accepts empty `REPO_QUEUE_DEFAULT_QUEUE` / `REPO_QUEUE_SIGNAL_PATH` — silently talks to queue `""` and fails signal writes with a blank path

Bug

Evidence (verified this run, laptop primary @ `6f5df296e2`; code identical at probe build)

Why it matters

Acceptance criteria

Related

9 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently uses queue "" and fails signal writes with a blank path #6314

Description

fleet(queue): repo-queue client accepts empty REPO_QUEUE_DEFAULT_QUEUE / REPO_QUEUE_SIGNAL_PATH — silently talks to queue "" and fails signal writes with a blank path

Bug

Evidence (verified this run, laptop primary @ 6f5df296e2; code identical at probe build)

Why it matters

Acceptance criteria

Related

Activity

developing-today commented on Nov 5, 2026

developing-today commented on Nov 5, 2026

9 remaining items

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

fleet(queue): repo-queue client accepts empty `REPO_QUEUE_DEFAULT_QUEUE` / `REPO_QUEUE_SIGNAL_PATH` — silently talks to queue `""` and fails signal writes with a blank path

Evidence (verified this run, laptop primary @ `6f5df296e2`; code identical at probe build)