@openrig/cli 0.6.4 → 0.6.5

package/daemon/dist/domain/restore-orchestrator.js

@@ -4,10 +4,14 @@ import { NativePermissionStore } from "./native-permission-store.js";
 import { permissionBindingOverride } from "./native-permission-selection.js";
 import { resolvePermissionPolicyAttachment } from "./permission-policy/policy-ref.js";
 import { assessNativeResumeProbe } from "./native-resume-probe.js";
+import { verifyClaudePaneProcess } from "./native-process-lineage.js";
 import { reanchorBuiltinStartupFile, reanchorShippedProjectionEntry } from "./builtin-startup-files.js";
 import { AppliedLaunchObservationStore } from "./applied-launch-observation-store.js";
+import { classifyPaneRuntimeMatch } from "./seat-identity-reconciler.js";
+import { isShellForeground } from "./shell-classifier.js";
 import { rebindAndVerifyPaneIdentity } from "./seat-attention-reconciler.js";
 import { SeatIdentityStore } from "./seat-identity-store.js";
+import { validatePreRestore } from "./restore-preconditions.js";
 import { resolveSnapshotRestoreTopology } from "./restore-topology.js";
 // Only these edge kinds constrain launch order
 const LAUNCH_DEPENDENCY_KINDS = new Set(["delegates_to", "spawned_by"]);
@@ -57,6 +61,7 @@ export class RestoreOrchestrator {
     claudeResume;
     codexResume;
     piResume;
+    ompResume;
     transcriptStore;
     serviceOrchestrator;
     listProcesses;
@@ -94,6 +99,7 @@ export class RestoreOrchestrator {
         this.claudeResume = deps.claudeResume;
         this.codexResume = deps.codexResume;
         this.piResume = deps.piResume ?? null;
+        this.ompResume = deps.ompResume ?? null;
         this.transcriptStore = deps.transcriptStore ?? null;
         this.serviceOrchestrator = deps.serviceOrchestrator ?? null;
         this.listProcesses = deps.listProcesses;
@@ -133,7 +139,7 @@ export class RestoreOrchestrator {
         }
         this.activeRestores.add(rigId);
         try {
-            const validation = this.validatePreRestore(snapshot.data, {
+            const validation = validatePreRestore(snapshot.data, {
                 fsOps: opts?.fsOps,
                 servicesRecord: this.rigRepo.getServicesRecord(rigId),
                 freshLogicalIds: opts?.freshLogicalIds,
@@ -412,203 +418,6 @@ export class RestoreOrchestrator {
             },
         };
     }
-    validatePreRestore(data, opts) {
-        const blockers = [];
-        const warnings = [];
-        const exists = opts.fsOps?.exists ?? (() => true);
-        const add = (blocker) => blockers.push(blocker);
-        const nodes = Array.isArray(data.nodes) ? data.nodes : null;
-        const sessions = Array.isArray(data.sessions) ? data.sessions : null;
-        const edges = Array.isArray(data.edges) ? data.edges : null;
-        const checkpoints = data.checkpoints && typeof data.checkpoints === "object" ? data.checkpoints : null;
-        if (!data.rig || typeof data.rig.id !== "string") {
-            add({
-                code: "invalid_snapshot_data",
-                severity: "critical",
-                target: "snapshot.rig",
-                message: "Snapshot is missing the rig record needed for restore.",
-                remediation: "Capture a new snapshot or restore from a structurally valid snapshot.",
-            });
-        }
-        if (!nodes) {
-            add({
-                code: "invalid_snapshot_data",
-                severity: "critical",
-                target: "snapshot.nodes",
-                message: "Snapshot is missing the node list needed for restore.",
-                remediation: "Capture a new snapshot or restore from a structurally valid snapshot.",
-            });
-        }
-        if (!sessions) {
-            add({
-                code: "invalid_snapshot_data",
-                severity: "critical",
-                target: "snapshot.sessions",
-                message: "Snapshot is missing session records needed for restore.",
-                remediation: "Capture a new snapshot or restore from a structurally valid snapshot.",
-            });
-        }
-        if (!edges) {
-            add({
-                code: "invalid_snapshot_data",
-                severity: "critical",
-                target: "snapshot.edges",
-                message: "Snapshot is missing topology edges needed for restore planning.",
-                remediation: "Capture a new snapshot or restore from a structurally valid snapshot.",
-            });
-        }
-        if (!checkpoints) {
-            add({
-                code: "invalid_snapshot_data",
-                severity: "critical",
-                target: "snapshot.checkpoints",
-                message: "Snapshot is missing the checkpoint map needed for restore.",
-                remediation: "Capture a new snapshot or restore from a structurally valid snapshot.",
-            });
-        }
-        if (!nodes || !checkpoints) {
-            return { blockers, warnings };
-        }
-        const topology = resolveSnapshotRestoreTopology(data);
-        for (const invalidNodeId of topology.invalidRosterIds) {
-            add({
-                code: "invalid_topology_roster",
-                severity: "critical",
-                nodeId: invalidNodeId,
-                target: "snapshot.topologyRoster",
-                message: `Intended topology roster names node ${invalidNodeId}, which is absent from snapshot.nodes.`,
-                remediation: "Capture a new snapshot from the authoritative materialized topology.",
-            });
-        }
-        for (const node of topology.intendedNodes) {
-            const checkpoint = checkpoints[node.id] ?? null;
-            if (checkpoint && !node.cwd) {
-                add({
-                    code: "checkpoint_missing_node_cwd",
-                    severity: "critical",
-                    nodeId: node.id,
-                    logicalId: node.logicalId,
-                    target: "checkpoint",
-                    message: `Checkpoint exists for ${node.logicalId}, but the node has no cwd to receive it.`,
-                    remediation: "Update the rig spec to include a cwd for this node, then capture a new snapshot or restore manually.",
-                });
-            }
-            const startupCtx = data.nodeStartupContext?.[node.id] ?? null;
-            if (!startupCtx)
-                continue;
-            // OPR.0.5.7.1 D6a — validate replay files IFF the node will CONSUME
-            // replay (desk static ruling on e42420990): none => fresh path,
-            // validate; ambiguity => the node stops loudly and consumes nothing,
-            // skip; explicit fresh or a non-resume policy => deliberate fresh,
-            // validate; resume_if_possible with no token => stop-and-ask, consumes
-            // nothing, skip; usable type + token => exact resume, skip; a token
-            // WITHOUT a usable resume type follows the current fresh path,
-            // validate.
-            const resolution = resolveActiveSnapshotSession(data, node.id);
-            const freshListed = opts.freshLogicalIds?.includes(node.logicalId) ?? false;
-            let consumesReplay;
-            if (resolution.kind === "ambiguous") {
-                consumesReplay = false;
-            }
-            else if (resolution.kind === "none") {
-                consumesReplay = true;
-            }
-            else {
-                const sess = resolution.session;
-                const policy = sess.restorePolicy ?? "resume_if_possible";
-                if (freshListed || policy !== "resume_if_possible")
-                    consumesReplay = true;
-                else if (!sess.resumeToken)
-                    consumesReplay = false;
-                else if (!!sess.resumeType && sess.resumeType !== "none")
-                    consumesReplay = false;
-                else
-                    consumesReplay = true;
-            }
-            for (const storedFile of consumesReplay ? startupCtx.resolvedStartupFiles ?? [] : []) {
-                // Validate the file replay will actually deliver (#261: built-ins follow the running install).
-                const file = reanchorBuiltinStartupFile(storedFile, undefined, undefined, exists);
-                if (!file.required) {
-                    if (this.pathLike(file.absolutePath) && !exists(file.absolutePath)) {
-                        warnings.push(`Restore pre-validation: optional startup file missing for ${node.logicalId}: ${file.absolutePath}`);
-                    }
-                    continue;
-                }
-                if (this.pathLike(file.ownerRoot) && !exists(file.ownerRoot)) {
-                    add({
-                        code: "startup_owner_root_missing",
-                        severity: "critical",
-                        nodeId: node.id,
-                        logicalId: node.logicalId,
-                        target: file.path,
-                        path: file.ownerRoot,
-                        message: `Required startup file owner root is missing for ${node.logicalId}: ${file.ownerRoot}`,
-                        remediation: "Restore the agent/source root or capture a new snapshot with reachable startup context.",
-                    });
-                }
-                if (this.pathLike(file.absolutePath) && !exists(file.absolutePath)) {
-                    add({
-                        code: "required_startup_file_missing",
-                        severity: "critical",
-                        nodeId: node.id,
-                        logicalId: node.logicalId,
-                        target: file.path,
-                        path: file.absolutePath,
-                        message: `Required startup file is missing for ${node.logicalId}: ${file.absolutePath}`,
-                        remediation: "Restore the missing startup file or capture a new snapshot before retrying restore.",
-                    });
-                }
-            }
-            // OPR.0.3.4.5 (behavior 09): projection-validity != session continuity.
-            // A stale/missing projected skill/artifact must NOT abort a restore that
-            // has a valid native resume. Demoted from critical blockers to warnings
-            // flagged as projection_drift (compose slice-03's drift reporting shape).
-            // The existing post-launch filter (:855-885) already skips missing
-            // entries with a "(skipped)" warning; here we prevent the pre-restore
-            // gate from blocking the attempt entirely. Missing REQUIRED startup
-            // files and genuinely-fatal blockers (malformed snapshot, missing nodes)
-            // stay critical above.
-            for (const storedEntry of startupCtx.projectionEntries ?? []) {
-                const entry = reanchorShippedProjectionEntry(storedEntry, undefined, exists);
-                if (this.pathLike(entry.sourcePath) && !exists(entry.sourcePath)) {
-                    warnings.push(`projection_drift: source root missing for ${node.logicalId}: ${entry.sourcePath} (projection will be skipped at startup; session continuity is unaffected)`);
-                }
-                if (this.pathLike(entry.absolutePath) && !exists(entry.absolutePath)) {
-                    warnings.push(`projection_drift: entry missing for ${node.logicalId}: ${entry.absolutePath} (projection will be skipped at startup; session continuity is unaffected)`);
-                }
-            }
-        }
-        const servicesRecord = opts.servicesRecord ?? null;
-        if (servicesRecord) {
-            if (this.pathLike(servicesRecord.rigRoot) && !exists(servicesRecord.rigRoot)) {
-                add({
-                    code: "service_rig_root_missing",
-                    severity: "critical",
-                    target: "services.rigRoot",
-                    path: servicesRecord.rigRoot,
-                    message: `Service rig root is missing: ${servicesRecord.rigRoot}`,
-                    remediation: "Restore the service rig root or update the services record before retrying restore.",
-                });
-            }
-            if (this.pathLike(servicesRecord.composeFile) && !exists(servicesRecord.composeFile)) {
-                add({
-                    code: "service_compose_file_missing",
-                    severity: "critical",
-                    target: "services.composeFile",
-                    path: servicesRecord.composeFile,
-                    message: `Service compose file is missing: ${servicesRecord.composeFile}`,
-                    remediation: "Restore the compose file or update the services record before retrying restore.",
-                });
-            }
-        }
-        return { blockers, warnings };
-    }
-    pathLike(value) {
-        return typeof value === "string" && value.trim().length > 0 && (value.startsWith("/")
-            || value.startsWith("./")
-            || value.startsWith("../")
-            || value.startsWith("~"));
-    }
     captureNodeState(nodeId, rigId) {
         const binding = this.sessionRegistry.getBindingForNode(nodeId);
         const sessions = this.sessionRegistry.getSessionsForRig(rigId)
@@ -967,7 +776,7 @@ export class RestoreOrchestrator {
                 return { nodeId: node.id, logicalId: node.logicalId, status: "awaiting-decision", error: `Original session unresumable: resume requested but no token available. No session is running. Re-run with --fresh ${node.logicalId} for a deliberate fresh-primed seat, or restore the original session manually.` };
             }
             else {
-                const resumeOutcome = await this.attemptResume(node.id, sessionName, resumeType, resumeToken, node.cwd ?? "/", node.codexConfigProfile, node.model, this.resolveRestorePosture(node.id, rigId));
+                const resumeOutcome = await this.attemptResume(node.id, sessionName, resumeType, resumeToken, node.cwd ?? "/", node.codexConfigProfile, node.model, this.resolveRestorePosture(node.id, rigId), node.effort);
                 if (resumeOutcome.kind === "resumed") {
                     baseStatus = "resumed";
                 }
@@ -1128,6 +937,7 @@ export class RestoreOrchestrator {
                         // found" on every resumed Pi seat). Claude/Codex silently lost
                         // their -m/--model on restore the same way.
                         model: node.model ?? undefined,
+                        effort: node.effort ?? undefined,
                     };
                     try {
                         const { StartupOrchestrator } = await import("./startup-orchestrator.js");
@@ -1175,7 +985,7 @@ export class RestoreOrchestrator {
                                 ? ((startupResult.continuityOutcome === "resumed" || nativeContinuityProved) ? "resumed" : baseStatus)
                                 : baseStatus;
                             if (finalStatus === "resumed") {
-                                return this.finishJoinedResume(node, sessionName, resumeToken, launchResult?.session.id);
+                                return this.finishJoinedResume(node, sessionName, resumeToken, launchResult?.session.id, isPodAware && node.runtime === "claude-code");
                             }
                             return { nodeId: node.id, logicalId: node.logicalId, status: finalStatus };
                         }
@@ -1247,7 +1057,7 @@ export class RestoreOrchestrator {
     }
     /** A native resume is only a full success after the restored terminal is
      * rebound and its process identity agrees with the declared seat runtime. */
-    async finishJoinedResume(node, sessionName, resumeToken, sessionId) {
+    async finishJoinedResume(node, sessionName, resumeToken, sessionId, managedClaudeResume = false) {
         const identity = await rebindAndVerifyPaneIdentity({
             db: this.db,
             sessionRegistry: this.sessionRegistry,
@@ -1259,7 +1069,18 @@ export class RestoreOrchestrator {
             requireExactResumeLineage: true,
             ...(this.listProcesses ? { listProcesses: this.listProcesses } : {}),
         });
+        const markManagedResumeAttention = () => {
+            if (!managedClaudeResume || !sessionId)
+                return;
+            // The join awaits native observations. Only the exact launched row, still
+            // current and running, owns this readiness write after those awaits.
+            const current = this.db.prepare("SELECT id, session_name, status FROM sessions WHERE node_id = ? ORDER BY created_at DESC, id DESC LIMIT 1").get(node.id);
+            if (current?.id === sessionId && current.session_name === sessionName && current.status === "running") {
+                this.sessionRegistry.updateStartupStatus(sessionId, "attention_required");
+            }
+        };
         if (!identity.ok) {
+            markManagedResumeAttention();
             return {
                 nodeId: node.id,
                 logicalId: node.logicalId,
@@ -1269,12 +1090,20 @@ export class RestoreOrchestrator {
         }
         // Legacy resume adapters do not write native metadata. Fill only the
         // launched row's empty token after proof; never overwrite a hook/operator.
-        if (node.runtime === "codex" && sessionId && resumeToken) {
+        const provedClaudeWrapper = node.runtime === "claude-code"
+            && classifyPaneRuntimeMatch(identity.command, node.runtime) === "mismatch"
+            && isShellForeground(identity.command?.trim().toLowerCase() ?? "");
+        if ((node.runtime === "codex" || provedClaudeWrapper || managedClaudeResume) && sessionId && resumeToken) {
             const current = this.db.prepare("SELECT node_id, session_name, status, resume_token FROM sessions WHERE id = ?").get(sessionId);
             const sameSession = current?.node_id === node.id && current.session_name === sessionName && current.status === "running";
-            const retained = sameSession && (current.resume_token === resumeToken
-                || (!current.resume_token && this.sessionRegistry.updateResumeToken(sessionId, "codex_id", resumeToken, "scrape")));
+            // Startup already retained the managed token. Recheck after the awaited
+            // join; a hook/operator may have changed it meanwhile. Never backfill here.
+            const retained = sameSession && (managedClaudeResume
+                ? this.sessionRegistry.resumeTokenMatches(sessionId, "claude_id", resumeToken)
+                : current.resume_token === resumeToken
+                    || (!current.resume_token && this.sessionRegistry.updateResumeToken(sessionId, node.runtime === "codex" ? "codex_id" : "claude_id", resumeToken, "scrape")));
             if (!retained) {
+                markManagedResumeAttention();
                 const store = new SeatIdentityStore(this.db);
                 const proof = store.getForNode(node.id);
                 if (proof)
@@ -1373,7 +1202,7 @@ export class RestoreOrchestrator {
     async attemptResume(nodeId, sessionName, resumeType, resumeToken, cwd, codexConfigProfile, model, 
     // OPR.0.4.8.3 Seam B: the seat's restored launch posture (persisted provenance,
     // custom policies re-validated when readable). Absent = env decision.
-    resolvedPosture) {
+    resolvedPosture, effort) {
         const launchGeneration = this.sessionRegistry.currentOccupantTenure(nodeId)?.generationUuid;
         let permissionMode;
         try {
@@ -1390,7 +1219,7 @@ export class RestoreOrchestrator {
             return { kind: "failed", message: `Permission selection: ${error.message}` };
         }
         if (this.claudeResume.canResume(resumeType, resumeToken)) {
-            const result = await this.claudeResume.resume(sessionName, resumeType, resumeToken, cwd, resolvedPosture, model, permissionMode, nodeId);
+            const result = await this.claudeResume.resume(sessionName, resumeType, resumeToken, cwd, resolvedPosture, model, permissionMode, nodeId, ...(effort !== undefined ? [effort] : []));
             if (result.ok) {
                 if (result.appliedLaunch && launchGeneration)
                     this.appliedLaunchStore.recordGeneration(launchGeneration, result.appliedLaunch);
@@ -1409,7 +1238,7 @@ export class RestoreOrchestrator {
             return { kind: "failed", message: result.message };
         }
         if (this.codexResume.canResume(resumeType, resumeToken)) {
-            const result = await this.codexResume.resume(sessionName, resumeType, resumeToken, cwd, codexConfigProfile, resolvedPosture, model);
+            const result = await this.codexResume.resume(sessionName, resumeType, resumeToken, cwd, codexConfigProfile, resolvedPosture, model, ...(effort !== undefined ? [effort] : []));
             if (result.ok) {
                 if (result.appliedLaunch && launchGeneration)
                     this.appliedLaunchStore.recordGeneration(launchGeneration, result.appliedLaunch);
@@ -1451,6 +1280,20 @@ export class RestoreOrchestrator {
             }
             return { kind: "failed", message: result.message };
         }
+        if (this.ompResume?.canResume(resumeType, resumeToken)) {
+            const result = await this.ompResume.resume(sessionName, resumeType, resumeToken, cwd, model, resolvedPosture);
+            if (result.ok) {
+                if (result.appliedLaunch && launchGeneration)
+                    this.appliedLaunchStore.recordGeneration(launchGeneration, result.appliedLaunch);
+                return { kind: "resumed" };
+            }
+            if (result.code === "retry_fresh")
+                return { kind: "retry_fresh" };
+            if (result.code === "attention_required") {
+                return { kind: "attention_required", message: result.message, evidence: result.evidence };
+            }
+            return { kind: "failed", message: result.message };
+        }
         return { kind: "failed", message: "No resume adapter available for this runtime/token combination." };
     }
     /**
@@ -1558,7 +1401,21 @@ export class RestoreOrchestrator {
         }
         const paneCommand = await this.tmuxAdapter.getPaneCommand(identity.pane);
         const paneContent = (await this.tmuxAdapter.capturePaneContent(identity.pane, 40)) ?? "";
-        const probe = assessNativeResumeProbe({ runtime, paneCommand, paneContent });
+        const claudeResumeIdentityVerified = runtime === "claude-code" && !!await verifyClaudePaneProcess({
+            target: identity.pane,
+            tmux: this.tmuxAdapter,
+            expectedToken: expectedResumeToken,
+            requireResume: true,
+            ...(this.listProcesses ? { listProcesses: this.listProcesses } : {}),
+        });
+        const probe = assessNativeResumeProbe({
+            runtime,
+            paneCommand,
+            paneContent,
+            // Headerless readiness requires the same stable foreground/argv proof
+            // as the resume adapter; a token-bearing descendant alone is insufficient.
+            ...(runtime === "claude-code" ? { claudeResumeIdentityVerified } : {}),
+        });
         const fgProcess = runtime === "claude-code" ? "claude" : runtime === "codex" ? "codex" : null;
         if (!fgProcess) {
             return { ok: false, code: "fg_process_not_runtime", detail: `Node runtime is ${runtime ?? "unknown"}, not claude/codex.` };