From 94e4b0fbf0b0314e4fcda02e232ed220508bbb96 Mon Sep 17 00:00:00 2001
From: garrytan <garrytan@gmail.com>
Date: Tue, 29 Sep 2026 13:54:23 +0000
Subject: [PATCH] fix(ubicloud): skip retrieval globs that match nothing
 instead of reporting a failed pull

---
 CHANGELOG.md                   |  3 +++
 scripts/ubicloud/ubi-runner.sh | 12 +++++++++---
 test/ubicloud-runner.test.ts   | 29 ++++++++++++++++++++++++++++-
 3 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa14e9bcc..b6967477e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,6 +33,9 @@ The table compares v1.91.6.0 with this branch before it merged v1.91.7.0, which
 - memory-pipeline, ios-qa, ios-qa-swift-build and plan-tune-cathedral make no model calls and now run in the free suite; CI-unrunnable Codex, Aside, outside-voice and iOS-device files are excluded from the weekly lane with a tracked re-entry condition.
 - The plan-count history PTY test waits for its startup marker instead of a fixed 8-second sleep.
 
+### Fixed
+- `bun run test:ubicloud` no longer reports `pull failed` when a run leaves no flake ledger in `/tmp`: a retrieval glob that matches nothing is skipped with a note, and the retained shard logs still land in `.context/ubicloud/<timestamp>/free-test-logs/`.
+
 ### For contributors
 - When a paid eval fails, fix the product or harness and add the captured case as one row in the detector's owner test; `test/test-of-test-ratchet.test.ts` fails on any new test file that imports only `test/` code and names the owner test to extend. `CONTRIBUTING.md` "Test tiers" has an example.
 - Deleted `test/helpers` modules and where their live cases went:
diff --git a/scripts/ubicloud/ubi-runner.sh b/scripts/ubicloud/ubi-runner.sh
index 760eefb33..a1908d21e 100755
--- a/scripts/ubicloud/ubi-runner.sh
+++ b/scripts/ubicloud/ubi-runner.sh
@@ -178,11 +178,17 @@ cmd_sync() {
 }
 
 # pull NAME REMOTE_GLOB LOCAL_DIR: copy matching remote entries into LOCAL_DIR.
-# Relative remote paths start at /home/ubi.
+# Relative remote paths start at /home/ubi. A glob that matches nothing (for
+# example an optional flake ledger) is reported and skipped, not a failure.
 cmd_pull() {
-  local name=$1 from=$2 to=$3
+  local name=$1 from=$2 to=$3 dir
+  dir=$(printf %q "$(dirname "$from")")
+  if ! remote "$name" "cd $dir 2>/dev/null && ls -d -- $(basename "$from") >/dev/null 2>&1"; then
+    log "pull: nothing matches $from"
+    return 0
+  fi
   mkdir -p "$to"
-  remote "$name" "cd $(printf %q "$(dirname "$from")") && tar -czf - $(basename "$from")" | tar -xzf - -C "$to"
+  remote "$name" "cd $dir && tar -czf - $(basename "$from")" | tar -xzf - -C "$to"
 }
 
 cmd_run() {
diff --git a/test/ubicloud-runner.test.ts b/test/ubicloud-runner.test.ts
index dfbf3c829..79959226f 100644
--- a/test/ubicloud-runner.test.ts
+++ b/test/ubicloud-runner.test.ts
@@ -6,7 +6,8 @@
  * call when the token is absent.
  */
 import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 
 const ROOT = resolve(import.meta.dir, '..');
@@ -55,6 +56,32 @@ describe('ubicloud free-suite runner', () => {
     expect(runner).toMatch(/trap 'cmd_down "\$RUN_VM"[^']*' EXIT/);
   });
 
+  test('pull retrieves the retained free-test logs and skips a glob that matches nothing', () => {
+    const root = mkdtempSync(join(tmpdir(), 'ubi-pull-'));
+    try {
+      const remoteHome = join(root, 'remote'), bin = join(root, 'bin'), state = join(root, 'state'), local = join(root, 'local');
+      mkdirSync(join(remoteHome, 'work/gstack/.context/free-test-logs'), { recursive: true });
+      mkdirSync(join(remoteHome, 'tmp'), { recursive: true });
+      writeFileSync(join(remoteHome, 'work/gstack/.context/free-test-logs/gstack-free-test-shard-11.log'), 'shard 11 log\n');
+      mkdirSync(join(state, 'fake-vm'), { recursive: true });
+      writeFileSync(join(state, 'fake-vm/env'), 'IP=192.0.2.1\n');
+      mkdirSync(bin);
+      writeFileSync(join(bin, 'ssh'), `#!/usr/bin/env bash\ncd ${JSON.stringify(remoteHome)} && exec bash -c "\${@: -1}"\n`);
+      chmodSync(join(bin, 'ssh'), 0o755);
+      const env = { ...process.env, PATH: `${bin}:${process.env.PATH}`, UBICLOUD_API_KEY: 'offline', UBI_RUNNER_STATE: state };
+      const pull = (from: string) => Bun.spawnSync(['bash', join(DIR, 'ubi-runner.sh'), 'pull', 'fake-vm', from, local], { env, timeout: 10_000 });
+      const empty = pull(join(remoteHome, 'tmp/gstack-free-test-*'));
+      expect(empty.exitCode).toBe(0);
+      expect(empty.stderr.toString()).toContain('pull: nothing matches');
+      const logs = pull('work/gstack/.context/free-test-logs');
+      expect(logs.exitCode).toBe(0);
+      expect(readFileSync(join(local, 'free-test-logs/gstack-free-test-shard-11.log'), 'utf8')).toBe('shard 11 log\n');
+      expect(existsSync(join(local, 'gstack-free-test-*'))).toBe(false);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
   test('refuses to start without UBICLOUD_API_KEY, before any network call', () => {
     const env = { ...process.env, UBICLOUD_API_URL: 'http://127.0.0.1:9' } as Record<string, string | undefined>;
     delete env.UBICLOUD_API_KEY;