@polderlabs/bizar-omp 0.7.7 → 0.7.9

package/dist/extension.js

@@ -20,10 +20,14 @@ import { repositoryIdentity, statePath, workingTreeDigest } from "./storage/repo
 import { Journal } from "./storage/journal.js";
 import { nativeSessionReference } from "./omp/context.js";
 import { findOnPath } from "./omp/tmux.js";
-import { acquireOmpSessionLease, indexOmbSessionFile, isOmbSessionName, sameOmpSessionFile } from "./omp/omb-sessions.js";
+import { acquireOmpSessionLease, clearOmbSessionReference, indexOmbSessionFile, isOmbSessionName, readOmbJournalNativeId, sameOmpSessionFile } from "./omp/omb-sessions.js";
+import { clearOmbHostGeneration, rebindOmbHostGeneration } from "./omp/tmux.js";
+import { createSessionTitleController, resolveSessionTitleLabel } from "./omp/terminal-title.js";
 import { bindSession } from "./omp/lifecycle.js";
 import { BIZAR_MODEL_ROLE_AGENT_PROMPT, BIZAR_MODEL_ROLE_TOOL, BIZAR_MODEL_ROLES, BIZAR_MODEL_TAGS, buildAgentEvaluationRequest, clipOperatorNotice, commitRolePlan, diffCatalog, formatCatalogDelta, formatRoleAssignmentPlan, planBizarModelRoles, planFromRecommendations, recordOf, reviewRoleRecommendations, roleAssignmentRoute, snapshotCatalog, isOpaqueOmniRouteCombo, omniRouteFailureGuidance, } from "./omp/model-role-assignment.js";
+import { AGENT_ROLES } from "./omp/model-roles.js";
 import { loadOmbSettings, recordCatalogObservation } from "./omp/omb-settings.js";
+import { isRunPhaseActive } from "./core/types.js";
 const objectiveSchema = (z) => z.object({
     objective: z.string(),
     nonGoals: z.array(z.string()),
@@ -81,6 +85,10 @@ function objectiveOf(value) {
         checkSpecs: raw.checkSpecs,
         reviewSpec: raw.reviewSpec,
         policyRevision: raw.policyRevision,
+        // `integrate()` is fail-closed without an admitted scope, so dropping this
+        // here made controlled integration unreachable through the public tool even
+        // when the caller supplied one.
+        integrationScope: raw.integrationScope,
         authorizationRef: raw.authorizationRef,
         revision: raw.revision,
     });
@@ -97,6 +105,14 @@ function bindingFor(ctx) {
     }
     return bindSession(new Journal(path), ctx);
 }
+/** Readable tab label for the current session; see `resolveSessionTitleLabel`. */
+function sessionTitleLabel(ctx) {
+    return resolveSessionTitleLabel({
+        sessionName: ctx.sessionManager?.getSessionName?.(),
+        ombSessionName: process.env.BIZAR_OMP_SESSION_NAME,
+        cwd: ctx.cwd ?? process.cwd(),
+    });
+}
 function bindingMatches(binding, ctx) {
     const cwd = ctx.cwd ?? process.cwd();
     const owner = nativeSessionReference(ctx) ?? `session:${cwd}`;
@@ -416,34 +432,39 @@ export default function bizarExtension(pi) {
     let binding;
     // Main orchestrator role is opt-in: task children must NEVER see it.
     let orchestratorActive = false;
+    // The tab title is owned here because an extension override is rendered
+    // verbatim: OMP's own run-state spinner would never animate it. A Bizar host
+    // would otherwise show the bare binary name in every tab, with nothing to
+    // tell a working session from an idle one.
+    const sessionTitle = createSessionTitleController({
+        write: title => extensionUi?.setTitle?.(title),
+        label: process.env.BIZAR_OMP_SESSION_NAME,
+    });
+    let extensionUi;
     let currentNativeFile;
     let nativeLease;
-    let pendingNativeFile;
-    let pendingNativeLease;
     const omniRouteResponses = new Map();
     const releaseNativeLease = () => {
-        try {
-            pendingNativeLease?.release();
-        }
-        catch { /* teardown remains best-effort */ }
         try {
             nativeLease?.release();
         }
         catch { /* teardown remains best-effort */ }
-        pendingNativeLease = undefined;
         nativeLease = undefined;
-        pendingNativeFile = undefined;
         currentNativeFile = undefined;
     };
+    /** Records which journal this host writes. Returns false when it could not. */
     const registerNativeFile = async (ctx, file) => {
         if (!file || !existsSync(file))
-            return;
+            return false;
         const ombName = process.env.BIZAR_OMP_SESSION_NAME;
-        if (ombName && isOmbSessionName(ombName)) {
-            const indexed = await indexOmbSessionFile(ombName, file, ctx.cwd ?? process.cwd());
-            if (!indexed.ok)
-                ctx.ui?.notify(`Bizar could not expose this conversation in OMP /resume: ${indexed.reason}. The private journal remains available through OMB.`, "warning");
+        if (!ombName || !isOmbSessionName(ombName))
+            return true;
+        const indexed = await indexOmbSessionFile(ombName, file, ctx.cwd ?? process.cwd());
+        if (!indexed.ok) {
+            ctx.ui?.notify(`Bizar could not expose this conversation in OMP /resume: ${indexed.reason}. The private journal remains available through OMB.`, "warning");
+            return false;
         }
+        return true;
     };
     const currentBinding = (ctx) => {
         if (!binding || !bindingMatches(binding, ctx))
@@ -468,6 +489,12 @@ export default function bizarExtension(pi) {
         binding = undefined;
         orchestratorActive = false;
         releaseNativeLease();
+        extensionUi = ctx.ui;
+        // The tab should name the conversation. OMP's own session name is the bare
+        // binary and the Bizar host name is a hashed directory id, so neither is
+        // readable; OMP's session name is its generated title once one exists, and
+        // the project directory is the sensible fallback before that.
+        sessionTitle.setLabel(sessionTitleLabel(ctx));
         const file = ctx.sessionManager?.getSessionFile?.();
         if (file && existsSync(file)) {
             try {
@@ -494,15 +521,18 @@ export default function bizarExtension(pi) {
             return;
         if (currentNativeFile && sameOmpSessionFile(currentNativeFile, target))
             return;
-        const ombName = process.env.BIZAR_OMP_SESSION_NAME;
-        if (ombName && isOmbSessionName(ombName)) {
-            ctx.ui?.notify("This OMB host is bound to its original conversation. Close the host before resuming that journal from standalone OMP.", "warning");
-            return { cancel: true };
-        }
+        // Point-in-time conflict probe, not ownership. OMP 18.4.2 emits
+        // `session_switch` only when the switch commits, and offers no cancel or
+        // failure event for it: a rejected cwd change or a failed load returns or
+        // throws with nothing to observe. A lease retained across that gap would
+        // therefore lock the target journal until shutdown, and a timer is not an
+        // option — a slow but valid load could outlive it and reopen the very
+        // two-writer race the lease exists to prevent. So the probe is taken and
+        // dropped immediately, and exclusivity is re-established for real in
+        // `session_switch`. This proves the target was free a moment ago; it does
+        // not hold it for the duration of the switch.
         try {
-            pendingNativeLease?.release();
-            pendingNativeLease = acquireOmpSessionLease(target);
-            pendingNativeFile = target;
+            acquireOmpSessionLease(target).release();
         }
         catch (error) {
             ctx.ui?.notify(`Cannot resume this conversation while another OMP/OMB process owns it: ${error instanceof Error ? error.message : String(error)}`, "warning");
@@ -518,47 +548,146 @@ export default function bizarExtension(pi) {
             catch { /* best-effort */ }
             nativeLease = undefined;
             currentNativeFile = undefined;
-            pendingNativeLease = undefined;
-            pendingNativeFile = undefined;
             return;
         }
-        if (pendingNativeLease && pendingNativeFile && sameOmpSessionFile(pendingNativeFile, file)) {
-            try {
-                nativeLease?.release();
-            }
-            catch { /* best-effort */ }
-            nativeLease = pendingNativeLease;
-            pendingNativeLease = undefined;
-            pendingNativeFile = undefined;
+        // Exclusivity is re-established here rather than held from the preflight:
+        // OMP offers no switch-cancel event, so a lease kept across that gap would
+        // lock the target until shutdown. The new journal is claimed *before* the
+        // old one is let go, so this host is never briefly unowned, and a race
+        // that another process won between the two events fails here instead of
+        // leaving two writers on one journal.
+        let claimed;
+        try {
+            claimed = acquireOmpSessionLease(file);
         }
-        else if (!currentNativeFile || !sameOmpSessionFile(currentNativeFile, file)) {
-            try {
-                const nextLease = acquireOmpSessionLease(file);
-                try {
-                    nativeLease?.release();
-                }
-                catch { /* best-effort */ }
-                nativeLease = nextLease;
-            }
-            catch (error) {
-                ctx.ui?.notify(`This OMP session could not claim its conversation journal: ${error instanceof Error ? error.message : String(error)}`, "error");
-                ctx.shutdown?.();
+        catch (error) {
+            currentNativeFile = file;
+            ctx.ui?.notify(`This OMP session could not claim its conversation journal: ${error instanceof Error ? error.message : String(error)}`, "error");
+            ctx.shutdown?.();
+            return;
+        }
+        try {
+            nativeLease?.release();
+        }
+        catch { /* best-effort */ }
+        nativeLease = claimed;
+        const previousFile = currentNativeFile;
+        currentNativeFile = file;
+        // A host that switched conversations must move two records together: the
+        // tmux generation binding (what a dead-pane respawn is checked against) and
+        // the journal manifest (what the hub reads). OMP has already switched by
+        // this point, so leaving both on the old journal would make the respawn
+        // check *pass* against a conversation this host no longer writes — a silent
+        // divergence. Every failure below therefore ends by clearing the binding,
+        // which makes that check refuse. Restoring the old generation is never the
+        // safe move here.
+        const ombName = process.env.BIZAR_OMP_SESSION_NAME;
+        const hosted = Boolean(ombName && isOmbSessionName(ombName) && process.env.TMUX);
+        const switched = Boolean(previousFile && !sameOmpSessionFile(previousFile, file));
+        const failClosed = async (reason) => {
+            // Two independent authorities gate a respawn: the tmux generation binding
+            // and the owner link manifest. Invalidate at least one, so a respawn can
+            // never pass against the conversation this host has left. A tombstone is
+            // deliberately not used here: it hides a live host instead of poisoning
+            // its recovery, and this host is still running.
+            const cleared = await clearOmbHostGeneration(ombName, ctx.cwd ?? process.cwd());
+            const delinked = clearOmbSessionReference(ombName);
+            if (cleared || delinked) {
+                ctx.ui?.notify(`This host resumed the conversation, but ${reason} Its recovery was invalidated, so a dead pane will refuse to respawn rather than resume a different conversation. Restart this host to continue working.`, "warning");
                 return;
             }
+            // Neither authority could be invalidated, so the old generation and the
+            // old manifest still agree and a respawn would pass against the
+            // conversation this host has left. There is no honest way to describe
+            // that as fail-closed, so the host is stopped rather than left running on
+            // records that no longer describe it.
+            ctx.ui?.notify(`This host resumed the conversation, but ${reason} Its recovery records could not be invalidated, so it still describes the previous conversation. Stopping this host; close and reopen it before continuing.`, "error");
+            ctx.shutdown?.();
+        };
+        if (switched && hosted) {
+            const generation = await readOmbJournalNativeId(file);
+            if (!generation)
+                await failClosed("the resumed journal has no readable session header.");
+            else {
+                const rebound = await rebindOmbHostGeneration(ombName, generation, ctx.cwd ?? process.cwd());
+                if (!rebound.ok)
+                    await failClosed(`its generation binding could not follow (${rebound.reason}).`);
+                else if (await registerNativeFile(ctx, file)) {
+                    ctx.ui?.notify(`This host now writes the conversation you selected; its generation binding moved from ${rebound.previous ?? "unset"} to ${generation}.`, "info");
+                }
+                else
+                    await failClosed("its journal manifest could not be updated.");
+            }
+        }
+        else {
+            await registerNativeFile(ctx, file);
         }
-        currentNativeFile = file;
     });
-    pi.on("session_shutdown", async () => { releaseNativeLease(); binding = undefined; orchestratorActive = false; });
-    pi.on("before_agent_start", event => ({
-        systemPrompt: appendUserIdentityInvariant(orchestratorActive
-            ? applyOrchestratorPolicy(appendBizarInvariant(paramsOf(event).systemPrompt))
-            : appendBizarInvariant(paramsOf(event).systemPrompt)),
-    }));
+    pi.on("session_shutdown", async () => {
+        releaseNativeLease();
+        binding = undefined;
+        orchestratorActive = false;
+        sessionTitle.dispose();
+        extensionUi = undefined;
+    });
+    pi.on("before_agent_start", (event, ctx) => {
+        extensionUi = ctx?.ui ?? extensionUi;
+        sessionTitle.setState("working");
+        return {
+            systemPrompt: appendUserIdentityInvariant(orchestratorActive
+                ? applyOrchestratorPolicy(appendBizarInvariant(paramsOf(event).systemPrompt))
+                : appendBizarInvariant(paramsOf(event).systemPrompt)),
+        };
+    });
+    pi.on("agent_end", (event, ctx) => {
+        extensionUi = ctx?.ui ?? extensionUi;
+        // A scheduled continuation is not a user-visible settle, so the spinner
+        // keeps running across an automatic retry instead of flickering idle.
+        if (paramsOf(event).willContinue === true)
+            return;
+        // Re-read the label: OMP generates the conversation title during the turn,
+        // so the tab should pick it up as soon as it exists.
+        if (ctx)
+            sessionTitle.setLabel(sessionTitleLabel(ctx));
+        sessionTitle.setState("idle");
+    });
     // A002: managed task isolation/admission pre-execution gate.
-    const BIZAR_PACKAGED_AGENTS = new Set([
-        "bizar_planner", "bizar_researcher", "bizar_implementer", "bizar_reviewer",
-        "bizar_verifier", "bizar_architect", "bizar_docs", "bizar_security_reviewer",
-    ]);
+    //
+    // `AGENT_ROLES` is the canonical list of packaged specialists and is written
+    // with the hyphens the `agents/*.md` front matter actually uses. The gate
+    // previously carried its own underscored copy, so every valid call to a real
+    // packaged specialist was refused as a non-packaged agent.
+    const BIZAR_PACKAGED_AGENTS = Object.fromEntries(AGENT_ROLES.map(name => [name, true]));
+    /**
+     * Every task in one call, in the shape the model sent it.
+     *
+     * Bizar configures OMP with `task.batch=true`, so a valid call carries
+     * `tasks: [{ agent, isolated, ... }]` with no top-level `agent`/`isolated`.
+     * Reading only the flat shape rejected every batch call before OMP could run
+     * it, and treated a batch of individually-valid tasks as unadmitted because
+     * the top-level fields were absent.
+     */
+    const requestedTasks = (input) => {
+        if (!Array.isArray(input.tasks)) {
+            return [{ agent: typeof input.agent === "string" ? input.agent : "", isolated: input.isolated === true }];
+        }
+        return input.tasks.map(entry => {
+            const task = paramsOf(entry);
+            return { agent: typeof task.agent === "string" ? task.agent : "", isolated: task.isolated === true };
+        });
+    };
+    /**
+     * Name the run that closed the gate and how to reopen it.
+     *
+     * A run left mid-flight — a sleep, a kill, a Ctrl-C — keeps the managed gates
+     * engaged for the rest of the session, and the agent has no way to notice
+     * that from the outside. The refusal is the one message it reliably reads at
+     * the moment it is refused, so it carries the run id, its phase, and the
+     * cancel that releases it.
+     */
+    const managedRunNotice = (run) => ` A managed Bizar run (${run?.runId ?? "unknown"}) is active in phase "${run?.phase ?? "unknown"}"; `
+        + "this stays blocked until that run finishes. To release it now, call `bizar_workflow` with action \"cancel\" and runId \""
+        + `${run?.runId ?? "unknown"}\".`;
     pi.on("tool_call", (event, ctx) => {
         try {
             const params = paramsOf(event);
@@ -567,16 +696,15 @@ export default function bizarExtension(pi) {
                 return;
             const active = currentBinding(ctx);
             const run = active.journal.snapshot().run;
-            const managedActive = !!(run && !["complete", "failed", "cancelled"].includes(run.phase));
-            if (!managedActive)
+            if (!isRunPhaseActive(run?.phase))
                 return;
-            const input = paramsOf(params.input);
-            const isolated = input.isolated === true;
-            const agent = typeof input.agent === "string" ? input.agent : "";
-            if (!isolated)
-                return { block: true, reason: "A002: managed workflow is active; native `task` calls must declare `isolated: true`." };
-            if (!BIZAR_PACKAGED_AGENTS.has(agent))
-                return { block: true, reason: `A002: managed workflow refused native \`task\` to non-packaged agent ${agent || "(unspecified)"}; only packaged Bizar specialists are admitted.` };
+            const tasks = requestedTasks(paramsOf(params.input));
+            for (const task of tasks) {
+                if (!task.isolated)
+                    return { block: true, reason: `A002: managed workflow is active; native \`task\` calls must declare \`isolated: true\` on every task.${managedRunNotice(run)}` };
+                if (!BIZAR_PACKAGED_AGENTS[task.agent])
+                    return { block: true, reason: `A002: managed workflow refused native \`task\` to non-packaged agent ${task.agent || "(unspecified)"}; only packaged Bizar specialists are admitted.${managedRunNotice(run)}` };
+            }
         }
         catch {
             return;
@@ -592,14 +720,13 @@ export default function bizarExtension(pi) {
                 return;
             const active = currentBinding(ctx);
             const run = active.journal.snapshot().run;
-            const managedActive = !!(run && !["complete", "failed", "cancelled"].includes(run.phase));
-            if (!managedActive)
+            if (!isRunPhaseActive(run?.phase))
                 return;
             const activeDispatch = active.journal.snapshot().dispatches.find(intent => intent.runId === run.runId && !["settled", "failed", "cancelled", "unknown-outcome", "rejected"].includes(intent.status));
             if (!activeDispatch?.tools || activeDispatch.tools.length === 0)
                 return;
             if (!activeDispatch.tools.includes(toolName))
-                return { block: true, reason: `A004: managed dispatch ${activeDispatch.id} declared tools allowlist; tool "${toolName}" is not permitted (allowed: ${activeDispatch.tools.join(", ")}).` };
+                return { block: true, reason: `A004: managed dispatch ${activeDispatch.id} declared tools allowlist; tool "${toolName}" is not permitted (allowed: ${activeDispatch.tools.join(", ")}).${managedRunNotice(run)}` };
         }
         catch {
             return;
@@ -614,16 +741,25 @@ export default function bizarExtension(pi) {
             return result({ orchestratorActive: true, scope: "main-session-only", note: "Main orchestrator policy will be appended to subsequent agent system prompts in this session. Task children must not invoke this tool." });
         },
     });
-    // A008: operator receipt tool — required before accepting operator-review evidence as "passed".
+    // A008: operator receipt — required before an operator-judgment criterion is
+    // covered.
+    //
+    // The operator identity is taken from the environment, not from the call
+    // arguments. A model-callable tool whose caller supplies its own `operatorId`
+    // cannot attest that a human gave a verdict; that made the receipt a content
+    // checksum masquerading as operator authorization. The receipt now records
+    // *who the host attributes the verdict to*, and refuses to issue one at all
+    // when no operator is configured — so a run that demands operator judgment
+    // fails closed instead of being self-approved.
     pi.registerTool({
         name: "bizar_operator_receipt", label: "Bizar Operator Receipt",
-        description: "Record an explicit operator verdict for operator-review criteria. Must be called before accepting an operator-review evidence record.",
+        description: "Record the configured operator's verdict on an operator-judgment criterion. The operator identity comes from the environment, not from this call.",
         parameters: pi.zod.object({
             workItemId: pi.zod.string(),
-            evidenceId: pi.zod.string(),
+            criterionId: pi.zod.string(),
+            evidenceId: pi.zod.string().optional(),
             verdict: pi.zod.enum(["passed", "failed", "blocked"]),
             rationale: pi.zod.string(),
-            operatorId: pi.zod.string(),
         }),
         async execute(_id, raw, _signal, _onUpdate, ctx) {
             try {
@@ -632,20 +768,25 @@ export default function bizarExtension(pi) {
                 const state = active.journal.snapshot();
                 if (!state.run)
                     throw new Error("No active workflow run");
-                const evidence = state.evidence.find(e => e.id === p.evidenceId);
-                if (!evidence)
-                    throw new Error(`Evidence ${p.evidenceId} not found`);
+                // Never taken from the call: a caller must not be able to name itself.
+                const operatorId = process.env.BIZAR_OPERATOR_ID?.trim() || "";
+                if (!operatorId)
+                    throw new Error("No operator is configured; set BIZAR_OPERATOR_ID to the identity that may record operator verdicts");
+                const evidenceId = typeof p.evidenceId === "string" ? p.evidenceId : "";
+                if (evidenceId && !state.evidence.some(record => record.id === evidenceId))
+                    throw new Error(`Evidence ${evidenceId} not found`);
                 const receiptId = `receipt_${randomUUID()}`;
-                const signedContent = JSON.stringify({ workItemId: p.workItemId, evidenceId: p.evidenceId, verdict: p.verdict, operatorId: p.operatorId, issuedAt: new Date().toISOString() });
-                const signedContentHash = createHash("sha256").update(signedContent).digest("hex");
+                const issuedAt = new Date().toISOString();
                 const verdict = String(p.verdict);
+                const signedContent = JSON.stringify({ workItemId: p.workItemId, evidenceId, verdict, operatorId, issuedAt });
+                const signedContentHash = createHash("sha256").update(signedContent).digest("hex");
                 const receipt = {
                     id: receiptId, runId: state.run.runId, workItemId: String(p.workItemId),
-                    evidenceId: String(p.evidenceId), verdict, rationale: String(p.rationale),
-                    operatorId: String(p.operatorId), signedContentHash, issuedAt: new Date().toISOString(),
+                    evidenceId, verdict, rationale: String(p.rationale),
+                    operatorId, signedContentHash, issuedAt,
                 };
                 active.journal.append({ type: "operator.receipt.recorded", runId: state.run.runId, receipt }, `receipt:${receiptId}`, state.revision);
-                return result({ receiptId, verdict: p.verdict, signedContentHash });
+                return result({ receiptId, verdict, operatorId, signedContentHash });
             }
             catch (error) {
                 return failure(error);