feat(repos): add an "Initialize mise" option to the add-repo step

Some repos an operator wants to manage don't yet define the `.mise.toml`
`[tasks.test]` task the spawn gate hard-requires — a chicken-and-egg,
since you can't run an agent to author that file without it. This adds a
one-click bootstrap.

Ticking "Initialize mise" on the add step enqueues a `mise_init` command
after the clone. The worker launches a dedicated agent that detects the
repo's stack, writes a `.mise.toml` with a canonical `[tasks.test]` task,
and commits + pushes it. That agent runs with the test-task gate off
(creating the task is the point) and a `HANDLER_MISE_INIT` marker on, so
its hooks enforce a bootstrap contract instead of the normal test gate:

- Stop hook blocks the turn until `.mise.toml` defines `[tasks.test]` and
  the change is committed (clean tree) and pushed (no commits ahead of an
  upstream) — so claude cannot end before the work has actually landed.
- git-push hook lets the bootstrap push through, skipping the test/build
  gate (there may be no working suite yet) so the file reaches the remote.

Backend: `mise_init` command type (+ migration 0006), a shared
`control.mise` helper for the test-task check, `spawn(require_tests=,
mise_init=)`, gitops `is_clean`/`ahead_count`, and `init_mise` on the
project-create API (only acts when a git remote exists to push to).
Frontend: the checkbox, plumbed through the store, following the launch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BxKY28XKCM6o4ag3nmaVsZ

tests/test_control_spawn.py

@@ -68,6 +68,32 @@ def test_spawn_creates_agent_settings_and_session(env, fake_tmux):
     assert call["env"]["DATABASE_URL"] == env["url"]
 
 
+def test_spawn_mise_init_skips_test_gate_and_marks_env(env, fake_tmux):
+    # A repo with no .mise.toml at all: the normal gate would refuse, but the mise-init
+    # bootstrap agent must launch anyway (creating that file is its whole job).
+    root = env["tmp"] / "proj"
+    root.mkdir(parents=True, exist_ok=True)
+    _register_project(root)
+
+    agent = spawn.spawn("proj", "mise-init", require_tests=False, mise_init=True)
+
+    with get_engine().begin() as conn:
+        assert repo.get_agent_by_name(conn, "proj", "mise-init")["id"] == agent["id"]
+    # The launched session carries HANDLER_MISE_INIT so its hooks enforce commit + push.
+    call = fake_tmux["calls"]["new_session"][0]
+    assert call["env"]["HANDLER_MISE_INIT"] == "1"
+
+
+def test_spawn_still_gates_without_mise_init_flag(env, fake_tmux):
+    root = env["tmp"] / "proj"
+    root.mkdir(parents=True, exist_ok=True)
+    _register_project(root)
+    # require_tests defaults on, so a normal spawn against a mise-less repo still refuses.
+    with pytest.raises(spawn.SpawnError, match="no .mise.toml"):
+        spawn.spawn("proj", "api")
+    assert fake_tmux["calls"]["new_session"] == []
+
+
 def test_kill_sets_done_and_kills_session(env, fake_tmux):
     root = env["tmp"] / "proj"
     _write_mise(root, with_test=True)

tests/test_hook_checkpoint.py

@@ -2,15 +2,22 @@
 
 from __future__ import annotations
 
+from handler.control import gitops, mise
 from handler.db import repository as repo
 from handler.hooks import checkpoint, verify
 from handler.hooks.context import HookInput, Identity
 
 
-def _seed(conn):
+def _seed(conn, mise_init=False):
     repo.create_project(conn, "p", "/tmp/p")
     a = repo.create_agent(conn, "p", "a", "/tmp/p/a")
-    return Identity(a["id"], "p", "a", "/tmp/p/a")
+    return Identity(a["id"], "p", "a", "/tmp/p/a", mise_init=mise_init)
+
+
+def _fake_mise_state(monkeypatch, *, has_test, clean, ahead):
+    monkeypatch.setattr(mise, "has_test_task", lambda cwd: has_test)
+    monkeypatch.setattr(gitops, "is_clean", lambda cwd: clean)
+    monkeypatch.setattr(gitops, "ahead_count", lambda cwd: ahead)
 
 
 def test_stop_blocks_on_failing_tests(conn, monkeypatch):
@@ -50,6 +57,62 @@ def test_stop_does_not_reblock_when_already_active(conn, monkeypatch):
     assert repo.get_checkmark(conn, ident.agent_id)["tests_status"] == "fail"
 
 
+def test_mise_init_stop_blocks_when_no_test_task(conn, monkeypatch):
+    ident = _seed(conn, mise_init=True)
+    # The normal test gate must NOT run for a mise-init agent.
+    monkeypatch.setattr(
+        verify, "run_test", lambda cwd: (_ for _ in ()).throw(AssertionError("test gate ran"))
+    )
+    _fake_mise_state(monkeypatch, has_test=False, clean=True, ahead=0)
+
+    result = checkpoint.handle_stop(conn, ident, HookInput({"session_id": "s1"}, "stop"))
+    assert result["decision"] == "block"
+    assert "[tasks.test]" in result["reason"]
+    assert repo.get_agent_by_name(conn, "p", "a")["status"] == "blocked"
+
+
+def test_mise_init_stop_blocks_on_uncommitted_changes(conn, monkeypatch):
+    ident = _seed(conn, mise_init=True)
+    _fake_mise_state(monkeypatch, has_test=True, clean=False, ahead=0)
+    result = checkpoint.handle_stop(conn, ident, HookInput({"session_id": "s1"}, "stop"))
+    assert result["decision"] == "block"
+    assert "uncommitted" in result["reason"]
+
+
+def test_mise_init_stop_blocks_when_no_upstream(conn, monkeypatch):
+    ident = _seed(conn, mise_init=True)
+    _fake_mise_state(monkeypatch, has_test=True, clean=True, ahead=None)
+    result = checkpoint.handle_stop(conn, ident, HookInput({"session_id": "s1"}, "stop"))
+    assert result["decision"] == "block"
+    assert "upstream" in result["reason"]
+
+
+def test_mise_init_stop_blocks_on_unpushed_commits(conn, monkeypatch):
+    ident = _seed(conn, mise_init=True)
+    _fake_mise_state(monkeypatch, has_test=True, clean=True, ahead=2)
+    result = checkpoint.handle_stop(conn, ident, HookInput({"session_id": "s1"}, "stop"))
+    assert result["decision"] == "block"
+    assert "not been pushed" in result["reason"]
+
+
+def test_mise_init_stop_allows_when_committed_and_pushed(conn, monkeypatch):
+    ident = _seed(conn, mise_init=True)
+    _fake_mise_state(monkeypatch, has_test=True, clean=True, ahead=0)
+    result = checkpoint.handle_stop(conn, ident, HookInput({"session_id": "s1"}, "stop"))
+    assert result == {}  # contract met — the turn may end
+    cm = repo.get_checkmark(conn, ident.agent_id)
+    assert cm["status"] == "done"
+    assert repo.get_agent_by_name(conn, "p", "a")["status"] == "done"
+
+
+def test_mise_init_stop_does_not_reblock_when_already_active(conn, monkeypatch):
+    ident = _seed(conn, mise_init=True)
+    _fake_mise_state(monkeypatch, has_test=False, clean=True, ahead=0)
+    hi = HookInput({"session_id": "s1", "stop_hook_active": True}, "stop")
+    result = checkpoint.handle_stop(conn, ident, hi)
+    assert result == {}  # recorded, but not an infinite block
+
+
 def test_session_end_records_without_gate(conn, monkeypatch):
     ident = _seed(conn)
     # Even if tests would fail, SessionEnd must not run the gate or block.

tests/test_hook_gate.py

@@ -2,15 +2,16 @@
 
 from __future__ import annotations
 
+from handler.control import gitops
 from handler.db import repository as repo
 from handler.hooks import gate, verify
 from handler.hooks.context import HookInput, Identity
 
 
-def _seed(conn):
+def _seed(conn, mise_init=False):
     repo.create_project(conn, "p", "/tmp/p")
     a = repo.create_agent(conn, "p", "a", "/tmp/p/a")
-    return Identity(a["id"], "p", "a", "/tmp/p/a")
+    return Identity(a["id"], "p", "a", "/tmp/p/a", mise_init=mise_init)
 
 
 def _decision(result):
@@ -73,6 +74,26 @@ def test_git_push_allowed_when_both_pass(conn, monkeypatch):
     assert _decision(result) == "allow"
 
 
+def test_mise_init_push_bypasses_test_gate(conn, monkeypatch):
+    ident = _seed(conn, mise_init=True)
+    # The mise-init agent pushes the .mise.toml it just wrote; the test/build gate must
+    # not run (there may be no working suite yet), and the push is recorded + allowed.
+    monkeypatch.setattr(
+        verify, "run_test", lambda cwd: (_ for _ in ()).throw(AssertionError("test gate ran"))
+    )
+    monkeypatch.setattr(gitops, "head_sha", lambda cwd: "sha123456789")
+    hi = HookInput(
+        {"tool_name": "Bash", "tool_input": {"command": "git push -u origin main"},
+         "session_id": "s1"},
+        "pre_tool_use",
+    )
+    result = gate.handle_git_push(conn, ident, hi)
+    assert _decision(result) == "allow"
+    # The push is recorded in the log so the run shows it landed.
+    entries = repo.get_log(conn, ident.agent_id, limit=10, offset=0)
+    assert any(e["push_sha"] == "sha123456789" for e in entries)
+
+
 def test_non_push_bash_is_ignored(conn):
     ident = _seed(conn)
     hi = HookInput({"tool_name": "Bash", "tool_input": {"command": "ls -la"}}, "pre_tool_use")

tests/test_project_from_server.py

@@ -50,6 +50,46 @@ def test_create_project_from_server_with_ssh_key(client, auth, env, secret_key):
     assert cmd["project_id"] == "coolproj"
 
 
+def test_create_project_with_init_mise_enqueues_bootstrap(client, auth, env, secret_key):
+    _add_server(client, auth, generate_ssh_key=True)
+    r = client.post(
+        "/projects",
+        json={"git_server": "github.com", "repo": "me/coolproj", "init_mise": True},
+        headers=auth,
+    )
+    assert r.status_code == 201, r.text
+    body = r.json()
+    assert body["sync_command_id"] is not None
+    assert body["mise_init_command_id"] is not None
+    # The clone is queued before the bootstrap so it runs first (FIFO by id).
+    assert body["mise_init_command_id"] > body["sync_command_id"]
+    cmd = client.get(f"/commands/{body['mise_init_command_id']}", headers=auth).json()
+    assert cmd["type"] == "mise_init"
+    assert cmd["project_id"] == "coolproj"
+
+
+def test_create_project_without_init_mise_skips_bootstrap(client, auth, env, secret_key):
+    _add_server(client, auth, generate_ssh_key=True)
+    r = client.post(
+        "/projects", json={"git_server": "github.com", "repo": "me/plain"}, headers=auth
+    )
+    assert r.status_code == 201, r.text
+    assert r.json()["mise_init_command_id"] is None
+
+
+def test_init_mise_without_remote_does_not_enqueue(client, auth, env, tmp_path):
+    # Manual mode with no git_remote: nothing to push to, so no bootstrap is queued.
+    root = tmp_path / "local"
+    root.mkdir()
+    r = client.post(
+        "/projects",
+        json={"id": "local", "root_dir": str(root), "init_mise": True},
+        headers=auth,
+    )
+    assert r.status_code == 201, r.text
+    assert r.json()["mise_init_command_id"] is None
+
+
 def test_create_project_from_server_https_without_key(client, auth, env):
     _add_server(client, auth, hostname="git.corp", forge_type="gitea",
                 base_url="https://git.corp:8443")

tests/test_worker.py

@@ -95,6 +95,53 @@ def test_approve_command_records_operator_verdict_with_head_sha(env, fake_gitops
     assert ap["approved_sha"] == fake_gitops["sha"]  # read from the agent's working dir
 
 
+def test_mise_init_command_spawns_bootstrap_agent(env, monkeypatch):
+    _seed_project()
+    calls = {}
+
+    def fake_spawn(project_id, name, **kw):
+        calls.update(project_id=project_id, name=name, **kw)
+        return {"id": 7, "name": name, "working_dir": "/tmp/p/mise-init"}
+
+    monkeypatch.setattr(spawn, "spawn", fake_spawn)
+    cmd = _enqueue(type="mise_init", project_id="p")
+
+    assert worker.drain("w") == 1
+    done = _get(cmd["id"])
+    assert done["status"] == "done"
+    assert done["result"]["agent_id"] == 7
+    assert done["result"]["name"] == "mise-init"
+    # Launched with the test gate off and the bootstrap marker on, with the default task.
+    assert calls["require_tests"] is False
+    assert calls["mise_init"] is True
+    assert ".mise.toml" in calls["task"]
+
+
+def test_mise_init_command_honors_payload_overrides(env, monkeypatch):
+    _seed_project()
+    calls = {}
+
+    def fake_spawn(project_id, name, **kw):
+        calls.update(name=name, **kw)
+        return {"id": 8, "name": name, "working_dir": "/tmp/p/x"}
+
+    monkeypatch.setattr(spawn, "spawn", fake_spawn)
+    cmd = _enqueue(
+        type="mise_init", project_id="p", payload={"name": "boot", "task": "custom task"}
+    )
+
+    worker.drain("w")
+    assert _get(cmd["id"])["status"] == "done"
+    assert calls["name"] == "boot"
+    assert calls["task"] == "custom task"
+
+
+def test_mise_init_without_project_is_failed(env):
+    cmd = _enqueue(type="mise_init")
+    assert worker.drain("w") == 1
+    assert _get(cmd["id"])["status"] == "failed"
+
+
 def test_poll_ci_command_returns_summary(env, monkeypatch):
     _seed_project()
     summary = {"checked": 0, "resolved": 0, "pending": 0}