omp-conductor 0.13.0 → 0.15.0

package/src/graph.ts

@@ -214,7 +214,7 @@ export function reindexScript(p: ProjectConfig): string {
     "#!/usr/bin/env bash",
     `# Refresh and reindex the code graphs for omp-conductor project "${p.name}".`,
     "#",
-    "# Generated by \`omp-conductor graph-setup\`. Regenerate it rather than editing:",
+    "# Generated by \`omp-conductor setup graph\`. Regenerate it rather than editing:",
     "# the repo list, branches and paths all come from that project's config.json.",
     "#",
     "# Every clone below is conductor's own, index-only and never edited by a human,",
@@ -437,7 +437,7 @@ export function formatGraphSetup(
   const script = reindexScriptPath();
   const { service, timer } = unitPaths(stateDir());
   lines.push(
-    `   \`graph-setup --write\` writes these three files for you, all under`,
+    `   \`omp-conductor setup graph\` writes these three files for you, all under`,
     `   ${stateDir()}. Run it as the account the fleet runs as — never under`,
     "   sudo, which would resolve the config, the state directory and the unit's",
     "   own User= as root and quietly build indexes no worker can read.",
@@ -453,7 +453,7 @@ export function formatGraphSetup(
   return lines.join("\n");
 }
 
-/** What `graph-setup --write` did, and the root-only steps it deliberately left. */
+/** What staging wrote, and the root-only steps it deliberately left. */
 export interface GraphSetupWrite {
   written: string[];
   next: string;

package/src/host.ts

@@ -62,6 +62,22 @@ export function recommendedMaxWorkers(ramBytes: number | undefined): number {
   return ramBytes < SMALL_HOST_RAM_BYTES ? 1 : DEFAULT_CAPS.maxConcurrentWorkers;
 }
 
+/**
+ * Warning shown when all configured projects can outgrow this host together.
+ *
+ * Omitting `ram` probes the host. Passing `undefined` explicitly means "RAM is
+ * unknown" and must NOT fall through to a host probe — a default parameter would
+ * treat that `undefined` as "use the default", which is how CI on a small box
+ * made `workerOvercommit(2, undefined)` warn about capacity 1.
+ */
+export function workerOvercommit(total: number, ram?: number | undefined): string | undefined {
+  const effective = arguments.length < 2 ? hostRamBytes() : ram;
+  const recommended = recommendedMaxWorkers(effective);
+  return total > recommended
+    ? `Configured worker capacity ${total} exceeds this host's recommended maximum of ${recommended}.`
+    : undefined;
+}
+
 /** Compact binary units for status lines (`3.2 GB`, `430 MB`). */
 export function formatRss(bytes: number): string {
   if (!Number.isFinite(bytes) || bytes < 0) return "?";

package/src/omp.ts

@@ -18,7 +18,7 @@ import { createServer, type Server, type Socket } from "node:net";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 
-import { worktreeConfinement } from "./confinement.ts";
+import { readOnlySession, worktreeConfinement } from "./confinement.ts";
 import { releasePolicyTripwire, type ReleaseBlockContext } from "./release-policy.ts";
 import type {
   HostToParent,
@@ -168,6 +168,15 @@ export async function createLocalSession(opts: {
    * leave the model to improvise `git push` instead.
    */
   verbSocketPath?: string;
+  /**
+   * Deny every tool but reading and searching (#307).
+   *
+   * For sessions asked to *read* a repository and answer a question — the setup
+   * probes. Distinct from {@link worktreeConfinement}, which scopes where writes
+   * may land: this removes the shell, the editors and the verbs entirely, so the
+   * session has no route to a mutation to scope in the first place.
+   */
+  readOnly?: boolean;
 }): Promise<AgentSessionLike> {
   let loaded: unknown;
   try {
@@ -205,6 +214,9 @@ export async function createLocalSession(opts: {
   // transcript is the only record of what the worker actually did.
   const sessionManager = await openSessionManager(mod, opts);
   const extensions = [
+    // Read-only sessions get the deny-by-default gate *first*, so an unknown tool
+    // is refused before any later extension can form an opinion about it.
+    ...(opts.readOnly === true ? [readOnlySession()] : []),
     // Workers only. The orchestrator runs unconfined by operator ruling
     // (#143): the gate could only ever be installed in sessions this daemon
     // spawns, so an external orchestrator — the supported shape — never had it,
@@ -430,6 +442,13 @@ export interface CreateSessionOptions {
    * without a live harness or a model bill.
    */
   hostModule?: string;
+  /**
+   * Deny every tool but reading and searching (#307).
+   *
+   * Forwarded to the child, because that is where the session — and therefore the
+   * gate — actually lives.
+   */
+  readOnly?: boolean;
 }
 
 /**
@@ -499,6 +518,7 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
     ...(opts.resume === undefined ? {} : { resume: opts.resume }),
     ...(opts.releaseGrants === undefined ? {} : { releaseGrants: opts.releaseGrants }),
     ...(opts.verbSocketPath === undefined ? {} : { verbSocketPath: opts.verbSocketPath }),
+    ...(opts.readOnly === undefined ? {} : { readOnly: opts.readOnly }),
   };
 
   const log = opts.onChildLog ?? ((line: string) => process.stderr.write(`${line}\n`));