feat(#3640): directory-level fetching for pre/post scripts

[fullsend-ai-coder]

Summary

Extend resolveBaseScripts in compose.go to use directory-level fetching (git sparse checkout) for pre/post scripts resolved from URL bases, ensuring companion files are co-located at the BASH_SOURCE-relative path. This is the systemic fix for the recurring companion-file breakage pattern (#2705, #3182, #3069/PR #3393).

Related Issue

Fixes #3640

Changes

• Added fetchBaseScriptOrDir wrapper that attempts directory-level fetching via TreeFetcher when the URL is a raw.githubusercontent.com URL, with automatic fallback to single-file fetchBaseFile for non-GitHub URLs and backward compatibility
• Added fetchBaseScriptDirTree that uses git sparse checkout (analogous to fetchBaseSkillDir for skills) to fetch the script's containing directory, cache it via CachePutDir, and make all files executable
• Updated resolveBaseScripts to use fetchBaseScriptOrDir for all script fields (pre_script, post_script, validation_loop.script, and forge-level equivalents)
• Directory caching keyed by "scriptdir:<dirURL>" ensures sibling scripts share a single tree fetch (e.g., pre-code.sh and post-code.sh in the same scripts/ directory)
• Non-script fields (validation_loop.schema) continue to use single-file fetchBaseFile

Testing

• 10 new unit tests covering: directory fetch, sibling cache hit, fallback to single-file, no-directory-component, offline cache hit, offline fallback, script-not-found error, token hint, integration with LoadWithBase
• All existing tests pass (0 failures across full harness test suite)
• go vet and go build pass
• Secret scan passes

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• I wrote this contribution myself and can explain all changes in it

---

Closes #3640

Post-script verification

• Branch is not main/master (agent/3640-dir-fetch-scripts)
• Secret scan passed (gitleaks — 675086c5e606fe1ea9c09c22e1aa617aa17afeae..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:32 AM UTC · Completed 7:50 AM UTC
Commit: a9a3df2 · View workflow run →

[rh-hemartin]

This was solved at another point, I requested coding by mistake. Closing.

[github-actions]

Site preview

Preview: https://aba9cb20-site.fullsend-ai.workers.dev

Commit: a9a3df26b9340aa1e4540466449c9b298fcf7143

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 7:35 AM UTC · Completed 7:53 AM UTC
Commit: a9a3df2 · View workflow run →

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open pull requests.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Retro: PR #5443 — Wasted code agent run on already-resolved issue

What happened: On 2026-07-22, a human (rh-hemartin) accidentally triggered /fs-code on issue #3640 ("directory-level fetching for pre/post scripts"). The issue had already been resolved 3 days earlier via script bundling in fullsend-ai/agents PR #38 (merged Jul 19), but issue #3640 was never updated to reflect this. The code agent ran for ~14.5 minutes, spent $4.99, produced 626 lines of working code across 2 files with 10 new tests, and opened PR #5443. The human closed the PR 2 minutes later saying "This was solved at another point, I requested coding by mistake." The review agent also started but the PR was closed before it completed.

Root causes: (1) The human had no way to cancel the in-flight code agent run after realizing the mistake. (2) Issue #3640 had no signal that it was already resolved — the fix landed in a different repo (fullsend-ai/agents) and was never reflected back on the source issue.

Existing issue evidence: This retro provides fresh evidence for several open issues tracking cross-repo visibility gaps:

• #4496 (triage should search sibling repos for solved patterns) — this is exactly the gap: the agents repo fix was invisible to the fullsend repo issue.
• #987 (staleness check before code agent works on aged issues) — issue Harness compose should support directory-level fetching for pre/post scripts to prevent recurring companion-file breakage #3640 was 14 days old when /fs-code was triggered.
• #1647 (code agent should verify linked issue is still open before creating PR) — the issue was still open in this case, but this class of check is related.
• #2285 (auto-flag linked issues for closure when superseded) — had this existed, issue Harness compose should support directory-level fetching for pre/post scripts to prevent recurring companion-file breakage #3640 might have been closed or labeled when agents PR Add operational observability problem document #38 landed.

Novel finding: No existing issue proposes a general-purpose human-initiated slash command to cancel an in-flight agent run. The closest mechanism is /fs-fix-stop (which only prevents future fix dispatches, doesn't cancel running runs). A /fs-cancel command would have directly prevented the $4.99 waste here — the human realized the mistake within minutes but had no recourse.

Proposals filed

• Add /fs-cancel slash command to let humans stop in-flight agent runs (in fullsend-ai/fullsend)

[codecov]

Codecov Report

❌ Patch coverage is 70.11494% with 26 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/harness/compose.go	70.11%	13 Missing and 13 partials ⚠️

📢 Thoughts on this report? Let us know!