omnilane 0.15.0 → 0.21.0

package/scripts/jobs.sh

@@ -4,14 +4,21 @@ set -euo pipefail
 # Usage: jobs.sh [--json] list | status JOB_ID | result JOB_ID | stats [--last N]
 #        jobs.sh [--json] recommend [--last N] [--lane L] [--min-samples N]
 #        jobs.sh wait JOB_ID [--timeout N]
+#        jobs.sh send JOB_ID TEXT | watch JOB_ID | close JOB_ID
 #        jobs.sh audit [--last N] [--json] | prune [--keep N] [--apply]
 
+# Runtime-relative shared library.
+# shellcheck disable=SC1091
 source "$(dirname "${BASH_SOURCE[0]}")/lib/common.sh"
+# shellcheck disable=SC1091
+source "$OMNILANE_REPO/scripts/lib/live-protocol.sh"
 JOBS="$OMNILANE_HOME/jobs"
 JOB_ID_PATTERN='^[0-9]{8}-[0-9]{6}-[0-9]+-[0-9]+$'
 JSON_MODE=0
 COMMAND="unknown"
 
+# The backslash case pattern is intentional.
+# shellcheck disable=SC1003
 json_escape() {
   local s="$1" out="" ch escaped code i
   for ((i = 0; i < ${#s}; i++)); do
@@ -49,7 +56,7 @@ die() {
   exit "$rc"
 }
 
-USAGE_TEXT="usage: jobs.sh [--json] list [--lane L] [--vendor V] [--status running|done]|status ID|result ID|tail ID [--lines N]|retry ID [--background]|stats [--last N] [--lane L] [--vendor V]|recommend [--last N] [--lane L] [--min-samples N]|wait ID [--timeout N]|cancel ID|rm ID|audit [--last N]|prune [--keep N] [--older-than DAYS] [--apply]|help"
+USAGE_TEXT="usage: jobs.sh [--json] list [--lane L] [--vendor V] [--status running|done]|status ID|result ID|tail ID [--lines N]|send ID TEXT|watch ID|close ID|retry ID [--background]|stats [--last N] [--lane L] [--vendor V]|recommend [--last N] [--lane L] [--min-samples N]|wait ID [--timeout N]|cancel ID|rm ID|audit [--last N]|prune [--keep N] [--older-than DAYS] [--apply]|help"
 
 usage() {
   die 2 "$USAGE_TEXT"
@@ -108,6 +115,14 @@ read_public_metadata() {
   PUBLIC_METADATA="$value"
 }
 
+print_mode_notice() {
+  local path="$JOB_DIR/mode-notice.txt"
+  [[ -e "$path" || -L "$path" ]] || return 0
+  if read_public_metadata "$path"; then
+    printf '%s\n' "$PUBLIC_METADATA"
+  fi
+}
+
 valid_utf8() {
   command -v iconv >/dev/null 2>&1 || return 1
   printf '%s' "$1" | iconv -f UTF-8 -t UTF-8 >/dev/null 2>&1
@@ -131,6 +146,68 @@ read_job_pid() {
   RECORDED_PID="$value"
 }
 
+load_job_vendor() {
+  local session_mode_re='"session_mode":"(live|single-shot)"'
+  if ! read_public_metadata "$JOB_DIR/meta.json" || ! parse_stats_metadata "$PUBLIC_METADATA"; then
+    die 1 "job metadata is not safely readable"
+  fi
+  JOB_VENDOR="$STATS_VENDOR"
+  JOB_SESSION_MODE=""
+  if [[ "$PUBLIC_METADATA" =~ $session_mode_re ]]; then
+    JOB_SESSION_MODE="${BASH_REMATCH[1]}"
+  elif [[ "$JOB_VENDOR" == "claude" ]]; then
+    # Compatibility with live jobs created before session_mode metadata.
+    JOB_SESSION_MODE="live"
+  else
+    JOB_SESSION_MODE="single-shot"
+  fi
+}
+
+require_live_job() {
+  load_job_vendor
+  live_vendor_capable "$JOB_VENDOR" ||
+    die 1 "job vendor '$JOB_VENDOR' is not live-capable (live vendors: $(live_capable_vendors)); it runs in single-shot mode"
+  [[ "$JOB_SESSION_MODE" == "live" ]] ||
+    die 1 "job vendor '$JOB_VENDOR' was dispatched in single-shot mode"
+}
+
+wait_for_live_ready() {
+  local deadline=$((SECONDS + 5))
+  while [[ ! -f "$JOB_DIR/inbox.ready" ]]; do
+    if [[ -e "$JOB_DIR/exit" || -L "$JOB_DIR/exit" ]]; then
+      die 1 "job is no longer accepting live messages"
+    fi
+    if [[ "$SECONDS" -ge "$deadline" ]]; then
+      die 124 "live inbox did not become ready within 5s"
+    fi
+    sleep 0.1
+  done
+  [[ ! -L "$JOB_DIR/inbox.ready" ]] || die 1 "unsafe live inbox readiness path"
+  [[ -p "$JOB_DIR/inbox.fifo" && ! -L "$JOB_DIR/inbox.fifo" ]] || die 1 "live inbox FIFO is unavailable"
+}
+
+write_fifo_with_timeout() {
+  local fifo="$1" payload="$2" writer_pid deadline rc
+  (
+    printf '%s\n' "$payload" > "$fifo"
+  ) &
+  writer_pid=$!
+  deadline=$((SECONDS + 5))
+  while kill -0 "$writer_pid" 2>/dev/null; do
+    if [[ "$SECONDS" -ge "$deadline" ]]; then
+      kill -TERM "$writer_pid" 2>/dev/null || true
+      wait "$writer_pid" 2>/dev/null || true
+      return 124
+    fi
+    sleep 0.1
+  done
+  set +e
+  wait "$writer_pid"
+  rc=$?
+  set -e
+  return "$rc"
+}
+
 parse_stats_metadata() {
   local value="$1"
   local metadata_re='^\{"lane":"([a-z][a-z0-9-]*)","vendor":"('"$OMNILANE_VENDOR_ALT"')"(,|})'
@@ -142,10 +219,11 @@ parse_stats_metadata() {
 }
 
 parse_audit_metadata() {
-  local value="$1" metadata_re
+  local value="$1" current_re legacy_re
   local json_string='([^"\\]|\\["\\/bfnrt]|\\u[0-9a-fA-F]{4})*'
-  metadata_re="^\\{\"lane\":\"[a-z][a-z0-9-]*\",\"vendor\":\"(${OMNILANE_VENDOR_ALT})\",\"model\":\"${json_string}\",\"effort\":\"${json_string}\",\"timeout\":(0|[1-9][0-9]*),\"job_timeout\":(null|0|[1-9][0-9]*),\"mode\":\"(advise|work)\",\"workdir\":\"${json_string}\",\"candidate\":\"[1-9][0-9]*/[1-9][0-9]*\",\"started\":\"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z\"\\}$"
-  [[ "$value" =~ $metadata_re ]]
+  current_re="^\\{\"lane\":\"[a-z][a-z0-9-]*\",\"vendor\":\"(${OMNILANE_VENDOR_ALT})\",\"session_mode\":\"(live|single-shot)\",\"idle_timeout\":(0|[1-9][0-9]*),\"model\":\"${json_string}\",\"effort\":\"${json_string}\",\"timeout\":(0|[1-9][0-9]*),\"job_timeout\":(null|0|[1-9][0-9]*),\"mode\":\"(advise|work|sysops)\",\"workdir\":\"${json_string}\",\"foreman_session\":\"${json_string}\",\"candidate\":\"[1-9][0-9]*/[1-9][0-9]*\",\"started\":\"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z\"\\}$"
+  legacy_re="^\\{\"lane\":\"[a-z][a-z0-9-]*\",\"vendor\":\"(${OMNILANE_VENDOR_ALT})\",\"model\":\"${json_string}\",\"effort\":\"${json_string}\",\"timeout\":(0|[1-9][0-9]*),\"job_timeout\":(null|0|[1-9][0-9]*),\"mode\":\"(advise|work|sysops)\",\"workdir\":\"${json_string}\",(\"foreman_session\":\"${json_string}\",)?\"candidate\":\"[1-9][0-9]*/[1-9][0-9]*\",\"started\":\"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z\"\\}$"
+  [[ "$value" =~ $current_re || "$value" =~ $legacy_re ]]
 }
 
 print_stat_counts() {
@@ -280,6 +358,71 @@ case "${1:-}" in
   help|--help|-h)
     [[ "$JSON_MODE" -eq 0 && $# -eq 1 ]] || usage
     echo "$USAGE_TEXT" ;;
+  send)
+    [[ "$JSON_MODE" -eq 0 && $# -eq 3 ]] || usage
+    select_job "$2"
+    require_live_job
+    wait_for_live_ready
+    if [[ "${FOREMAN_SESSION+x}" == "x" ]]; then
+      foreman_value="$FOREMAN_SESSION"
+    else
+      foreman_value="${foreman_session-}"
+    fi
+    payload="$(live_encode_message "$JOB_VENDOR" "$2" "$foreman_value" "$3")"
+    set +e
+    write_fifo_with_timeout "$JOB_DIR/inbox.fifo" "$payload"
+    send_rc=$?
+    set -e
+    [[ "$send_rc" -eq 0 ]] || die "$send_rc" "send timed out or failed; the live worker may be gone"
+    echo "sent $2"
+    ;;
+  watch)
+    [[ "$JSON_MODE" -eq 0 && $# -eq 2 ]] || usage
+    select_job "$2"
+    require_live_job
+    events_path="$JOB_DIR/events.jsonl"
+    watch_deadline=$((SECONDS + 5))
+    while [[ ! -f "$events_path" ]]; do
+      if [[ -e "$JOB_DIR/exit" || -L "$JOB_DIR/exit" ]]; then
+        die 1 "job has no live event stream"
+      fi
+      [[ "$SECONDS" -lt "$watch_deadline" ]] || die 124 "live event stream did not appear within 5s"
+      sleep 0.1
+    done
+    [[ ! -L "$events_path" ]] || die 1 "unsafe live event path"
+    if [[ -e "$JOB_DIR/exit" || -L "$JOB_DIR/exit" ]]; then
+      cat "$events_path"
+    else
+      tail -n +1 -f -- "$events_path"
+    fi
+    ;;
+  close)
+    [[ "$JSON_MODE" -eq 0 && $# -eq 2 ]] || usage
+    select_job "$2"
+    require_live_job
+    if [[ -e "$JOB_DIR/exit" || -L "$JOB_DIR/exit" ]]; then
+      read_exit_code "$JOB_DIR/exit" || die 1 "invalid recorded exit status"
+      echo "already closed (exit $RECORDED_EXIT)"
+      exit "$RECORDED_EXIT"
+    fi
+    holder_path="$JOB_DIR/inbox.holder.pid"
+    read_job_pid "$holder_path" || die 1 "live inbox holder is unavailable"
+    holder_pid="$RECORDED_PID"
+    kill -0 "$holder_pid" 2>/dev/null || die 1 "live inbox holder is gone"
+    kill -USR1 "$holder_pid" 2>/dev/null || die 1 "could not signal live inbox holder"
+    close_deadline=$((SECONDS + 10))
+    while [[ ! -e "$JOB_DIR/exit" && ! -L "$JOB_DIR/exit" ]]; do
+      if [[ "$SECONDS" -ge "$close_deadline" ]]; then
+        die 124 "close signal sent, but the live worker did not terminate within 10s"
+      fi
+      sleep 0.1
+    done
+    read_exit_code "$JOB_DIR/exit" || die 1 "invalid recorded exit status"
+    events_path="$JOB_DIR/events.jsonl"
+    result_count="$(live_count_result_events "$JOB_VENDOR" "$events_path")"
+    echo "closed $2 (result_events=$result_count exit=$RECORDED_EXIT)"
+    exit "$RECORDED_EXIT"
+    ;;
   tail)
     # Peek at the live public output stream of one job (running or done)
     # without touching its exit contract. Only out.txt is shown; stderr and
@@ -427,13 +570,20 @@ case "${1:-}" in
         fi
         for artifact in "$job_dir"/*; do
           [[ -e "$artifact" || -L "$artifact" ]] || continue
-          if [[ -L "$artifact" ]]; then
-            audit_emit "$id" symlink-artifact
-            findings=$((findings + 1)); job_failed=1
-          elif [[ -d "$artifact" ]]; then
-            audit_emit "$id" nested-directory
-            findings=$((findings + 1)); job_failed=1
-          elif [[ -f "$artifact" ]]; then
+      if [[ -L "$artifact" ]]; then
+        audit_emit "$id" symlink-artifact
+        findings=$((findings + 1)); job_failed=1
+      elif [[ -d "$artifact" ]]; then
+        audit_emit "$id" nested-directory
+        findings=$((findings + 1)); job_failed=1
+        elif [[ -p "$artifact" && ( "${artifact##*/}" == "inbox.fifo" ||
+                                    "${artifact##*/}" == "runner-inbox.fifo" ) ]]; then
+        mode="$(path_mode "$artifact" 2>/dev/null || true)"
+        if [[ "$mode" != "600" ]]; then
+          audit_emit "$id" unsafe-fifo-mode
+          findings=$((findings + 1)); job_failed=1
+        fi
+      elif [[ -f "$artifact" ]]; then
             mode="$(path_mode "$artifact" 2>/dev/null || true)"
             if [[ "$mode" != "600" ]]; then
               audit_emit "$id" unsafe-file-mode
@@ -821,6 +971,9 @@ case "${1:-}" in
       else
         echo "running"
       fi
+    fi
+    if [[ "$JSON_MODE" -eq 0 ]]; then
+      print_mode_notice
     fi ;;
   wait)
     [[ "$JSON_MODE" -eq 0 && $# -ge 2 ]] || usage

package/scripts/lib/common.sh

@@ -64,6 +64,94 @@ write_current_pid_file() {
   mv "$tmp" "$path"
 }
 
+process_start_time() { # pid -> stable ps(1) start timestamp
+  local pid="$1" value
+  [[ "$pid" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  value="$(LC_ALL=C ps -o lstart= -p "$pid" 2>/dev/null)" || return 1
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  [[ -n "$value" ]] || return 1
+  printf '%s\n' "$value"
+}
+
+process_parent_pid() {
+  local pid="$1" value
+  [[ "$pid" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  value="$(LC_ALL=C ps -o ppid= -p "$pid" 2>/dev/null)" || return 1
+  value="${value//[[:space:]]/}"
+  [[ "$value" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  printf '%s\n' "$value"
+}
+
+read_session_entry() { # path -> SESSION_ENTRY_{PID,START,ID}
+  local path="$1" fields rest
+  SESSION_ENTRY_PID=""
+  SESSION_ENTRY_START=""
+  SESSION_ENTRY_ID=""
+  [[ -f "$path" && ! -L "$path" ]] || return 1
+  fields="$(perl -MJSON::PP -e '
+    use strict;
+    use warnings;
+    my ($path) = @ARGV;
+    my $size = -s $path;
+    die "invalid size\n" unless defined($size) && $size <= 4096;
+    open my $fh, "<", $path or die $!;
+    local $/;
+    my $entry = decode_json(<$fh>);
+    close $fh or die $!;
+    die "invalid entry\n" unless ref($entry) eq "HASH";
+    my ($pid, $start, $id) = @{$entry}{qw(pid start_time session_id)};
+    die "invalid pid\n" if ref($pid) || !defined($pid) || $pid !~ /\A[1-9][0-9]{0,9}\z/;
+    die "invalid start\n" if ref($start) || !defined($start) ||
+      $start !~ /\A[ -~]{1,128}\z/;
+    die "invalid session\n" if ref($id) || !defined($id) ||
+      $id !~ /\A[A-Za-z0-9._:-]{1,256}\z/;
+    print "$pid\t$start\t$id";
+  ' "$path" 2>/dev/null)" || return 1
+  SESSION_ENTRY_PID="${fields%%$'\t'*}"
+  rest="${fields#*$'\t'}"
+  [[ "$rest" != "$fields" ]] || return 1
+  SESSION_ENTRY_START="${rest%%$'\t'*}"
+  SESSION_ENTRY_ID="${rest#*$'\t'}"
+  [[ "$SESSION_ENTRY_ID" != "$rest" ]] || return 1
+}
+
+prune_stale_session_entries() {
+  local sessions="$OMNILANE_HOME/sessions" entry live_start
+  [[ -d "$sessions" && ! -L "$sessions" ]] || return 0
+  for entry in "$sessions"/*.json; do
+    [[ -f "$entry" && ! -L "$entry" ]] || continue
+    read_session_entry "$entry" || continue
+    if ! live_start="$(process_start_time "$SESSION_ENTRY_PID")" ||
+       [[ "$live_start" != "$SESSION_ENTRY_START" ]]; then
+      rm "$entry" 2>/dev/null || true
+    fi
+  done
+}
+
+find_foreman_session() { # dispatch pid -> nearest live Claude foreman session
+  local pid="$1" sessions="$OMNILANE_HOME/sessions"
+  local parent start entry hops=0
+  [[ "$pid" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  [[ -d "$sessions" && ! -L "$sessions" ]] || return 1
+  prune_stale_session_entries
+
+  while [[ "$hops" -lt 128 ]]; do
+    parent="$(process_parent_pid "$pid")" || return 1
+    [[ "$parent" =~ ^[1-9][0-9]{0,9}$ && "$parent" != "$pid" ]] || return 1
+    start="$(process_start_time "$parent")" || return 1
+    entry="$sessions/$parent.json"
+    if read_session_entry "$entry" &&
+       [[ "$SESSION_ENTRY_PID" == "$parent" && "$SESSION_ENTRY_START" == "$start" ]]; then
+      printf '%s\n' "$SESSION_ENTRY_ID"
+      return 0
+    fi
+    pid="$parent"
+    hops=$((hops + 1))
+  done
+  return 1
+}
+
 # ---- Vendor registry (single source of truth) ---------------------------
 # Two vendor kinds. CLI-agent vendors run a local binary (see vendor_bin).
 # Direct-API vendors are OpenAI-compatible /chat/completions endpoints driven