omp-conductor 0.15.11 → 0.15.12

package/src/release-policy.ts

@@ -58,7 +58,7 @@ export interface ReleaseBlockContext {
 export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
   project: string;
   source: "worker" | "orchestrator";
-  shape: ReleaseShape;
+  shape: GateShape;
   at: string;
   issue?: number;
   runId?: string;
@@ -66,12 +66,108 @@ export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
 
 export type ReleaseDecision = { block: true; reason: string };
 
+/**
+ * The shared-host heavy-gate shape (#428): whole-package test runs and the
+ * shell suites a worker must be *unable* to run on the operator's shared host,
+ * rather than merely told not to.
+ *
+ * Deliberately **not** a {@link ReleaseShape}: no grant covers it. An operator
+ * is never refused — the operator owns the host, and CI owns the full suite —
+ * and a worker is always, whatever the config says. So it stays out of the
+ * configurable grant vocabulary (`releaseShapeEnum` is drawn straight from
+ * {@link RELEASE_SHAPES}); it only rides the release-policy classifier and the
+ * block ledger so one seam sees it and its refusals land where the next tick
+ * already reads drift.
+ */
+export const SHARED_HOST_SHAPE = "shared-host-gate" as const;
+export type SharedHostShape = typeof SHARED_HOST_SHAPE;
+
+/** Every shape the classifier reports, grantable or not. */
+export type GateShape = ReleaseShape | SharedHostShape;
+
 const GIT_PUSH_TAG_SHAPE =
   /(?:--tags\b|--follow-tags\b|refs\/tags\/|(?:^|\s)(?:tag\s+)?v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?=[:\s]|$))/;
 
+/** The separators the original quote-blind splitter divides a command on. Kept
+ *  for the unterminated-quote fallback, which must reproduce today's behaviour
+ *  rather than silently pass a command through. */
+const COMMAND_SEPARATORS = /(?:&&|\|\||[;\n|])/;
+
+/**
+ * Split a shell command on its operators, ignoring ones inside single or
+ * double quotes. The old splitter was quote-blind, so a `|` inside a quoted
+ * argument (a grep alternation's `\|`, a `--jq` filter, a heredoc) shredded
+ * the command into phantom segments and a gated verb inside a string literal
+ * was refused as a release attempt (#526). A small scanner is enough: no shell
+ * parser, no dependency. An unterminated quote falls back to the original
+ * quote-blind split, because a gated command must not slip through merely
+ * because a quote never closed.
+ */
+function splitCommandSegments(command: string): string[] {
+  const segments: string[] = [];
+  let current = "";
+  let quote: "'" | '"' | null = null;
+
+  const push = () => {
+    segments.push(current);
+    current = "";
+  };
+
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+
+    // Inside a quote only its closing quote matters — separators are data. A
+    // `\"` inside double quotes is a literal quote and must not close it.
+    if (quote !== null) {
+      current += ch;
+      if (ch === "\\" && quote === '"') {
+        if (i + 1 < command.length) current += command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+
+    // Outside quotes a backslash escapes the next character, so a literal
+    // `\|`, `\;` or `\"` is data, never an operator or the start of a quote.
+    if (ch === "\\") {
+      current += ch;
+      if (i + 1 < command.length) current += command[++i];
+      continue;
+    }
+
+    if (ch === "'") {
+      quote = "'";
+      current += ch;
+      continue;
+    }
+    if (ch === '"') {
+      quote = '"';
+      current += ch;
+      continue;
+    }
+
+    if ((ch === "&" && command[i + 1] === "&") || (ch === "|" && command[i + 1] === "|")) {
+      push();
+      i++;
+      continue;
+    }
+    if (ch === "|" || ch === ";" || ch === "\n") {
+      push();
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote !== null) return command.split(COMMAND_SEPARATORS);
+
+  push();
+  return segments;
+}
+
 function commandSegments(command: string): string[] {
-  return command
-    .split(/(?:&&|\|\||[;\n|])/)
+  return splitCommandSegments(command)
     .map((segment) => segment.trim())
     .filter((segment) => segment.length > 0);
 }
@@ -84,17 +180,74 @@ function stripCommandPrefix(segment: string): string {
 }
 
 /** Recognise the explicit release/deploy command shapes this policy promises to gate. */
-export function releaseShapeFromCommand(command: string): ReleaseShape | undefined {
+export function releaseShapeFromCommand(command: string): GateShape | undefined {
   return releaseCommandMatch(command)?.shape;
 }
 
+/**
+ * A whole-package `bun test`: `bun test` with no positional naming a specific
+ * test file. Flags alone — or nothing at all — still run the whole project,
+ * which is the gate (#428), and so do the path spellings of "everything":
+ * `bun test .`, `bun test ./`, `bun test src`. A command whose positional
+ * targets are test files — basename carrying the `*.test.*` / `*_test.*`
+ * marker bun itself keys on — is a focused run, a worker's proof path, and
+ * must stay available. A flag's own value is not a focused target: a
+ * `--preload x.ts` run with no file runs the whole package with a preload,
+ * while `--preload ./setup.ts src/daemon.test.ts` is still a test-file run.
+ */
+function wholePackageBunTest(segment: string): boolean {
+  const head = /^bun\s+test\b/.exec(segment);
+  if (head === null) return false;
+  const rest = segment.slice(head[0].length);
+  return !rest
+    .split(/\s+/)
+    .filter((token) => token.length > 0)
+    .filter((token) => !token.startsWith("-"))
+    .some((token) => /\.test\.|_test\./.test(token.slice(token.lastIndexOf("/") + 1)));
+}
+
+/**
+ * The shared-host run/shell suites a worker must not execute on the operator's
+ * host (#428): `herdr/test/recover-test.sh`, `test/setup-test.sh` and
+ * `setup.sh`, each under the invocation prefixes a worker actually uses —
+ * plain `bash`/`sh`/`zsh`, POSIX `. ` and `source` (all so the script loads),
+ * and a bare or `./` path. Returns the script path that fired, for the
+ * matched-segment ledger record.
+ *
+ * `bash -n` is deliberately not a match: parsing a script never executes it,
+ * and the pre-push parse gate every worker brief runs is
+ * `bash -n herdr/bin/recover.sh herdr/test/recover-test.sh setup.sh
+ * test/setup-test.sh` — blocking that would make the gate unfollowable without
+ * buying a single byte of protection. A flag beyond `-n` (`bash -x`, `-e`) is
+ * a real execution and is not covered either: the incidents that overloaded
+ * the host were all plain invocations, and refusing the sanctioned parse check
+ * would teach workers to skip it rather than stop the load.
+ */
+const SHARED_HOST_SCRIPTS = [
+  "herdr/test/recover-test.sh",
+  "test/setup-test.sh",
+  "setup.sh",
+];
+
+const SHARED_HOST_PREFIX = /^(?:(?:bash|sh|zsh|source)\s+|\.\s+)?\.?\/?/;
+
+function sharedHostScriptMatch(segment: string): string | undefined {
+  const path = segment.replace(SHARED_HOST_PREFIX, "");
+  for (const script of SHARED_HOST_SCRIPTS) {
+    if (path === script || path.startsWith(`${script} `) || path.startsWith(`${script}\t`)) {
+      return script;
+    }
+  }
+  return undefined;
+}
+
 /**
  * Classify a shell command and the segment that fired. The segment is what a
  * triager reads: `bun test src/foo.test.ts && npm publish` matches on its
  * `npm publish` half, and the record says so instead of folding the whole
  * command into the shape.
  */
-function releaseCommandMatch(command: string): { shape: ReleaseShape; matched: string } | undefined {
+function releaseCommandMatch(command: string): { shape: GateShape; matched: string } | undefined {
   for (const raw of commandSegments(command)) {
     const segment = stripCommandPrefix(raw);
     // Patching the running conductor is gated like a release act: `upgrade`,
@@ -121,6 +274,13 @@ function releaseCommandMatch(command: string): { shape: ReleaseShape; matched: s
     ) {
       return { shape: "deploy", matched: segment };
     }
+    // The shared-host gate (#428). Disjoint from every release shape above, so
+    // it is checked last without disturbing any of them. `matched` names the
+    // script path for a suite and the offending segment for a whole-package
+    // `bun test`, so the ledger and the digest say exactly which one fired.
+    if (wholePackageBunTest(segment)) return { shape: SHARED_HOST_SHAPE, matched: segment };
+    const script = sharedHostScriptMatch(segment);
+    if (script !== undefined) return { shape: SHARED_HOST_SHAPE, matched: script };
   }
   return undefined;
 }
@@ -256,7 +416,7 @@ function releaseTokenMatch(
 export function releaseToolMatch(
   toolName: string,
   input: Record<string, unknown> | undefined,
-): { shape: ReleaseShape; matched: string } | undefined {
+): { shape: GateShape; matched: string } | undefined {
   if (input === undefined) return undefined;
   if (toolName === "bash") {
     return typeof input.command === "string" ? releaseCommandMatch(input.command) : undefined;
@@ -278,10 +438,31 @@ export function releaseToolMatch(
 export function releaseShapeFromTool(
   toolName: string,
   input: Record<string, unknown> | undefined,
-): ReleaseShape | undefined {
+): GateShape | undefined {
   return releaseToolMatch(toolName, input)?.shape;
 }
 
+/**
+ * The refusal wording for the shared-host gate (#428). The whole-package
+ * `bun test` form names the focused alternative (a guard that only denies
+ * teaches nothing and gets worked around); the shell suites get their own
+ * because there is no focused form of a suite script.
+ */
+function sharedHostRefusalReason(matched: string | undefined): string {
+  if (matched !== undefined && /^bun\s+test\b/.test(matched)) {
+    return (
+      "Blocked by sharedHostPolicy: the whole-package `bun test` is not a worker's proof path on this shared " +
+      "host (it overloads the 4-core VPS and, before #399, SIGTERMed the production daemon). " +
+      "Run a focused `bun test <file>.test.ts` instead."
+    );
+  }
+  return (
+    "Blocked by sharedHostPolicy: this shell suite is not a worker's proof path on this shared host " +
+    "(it overloads the 4-core VPS that also runs Langfuse and the fleet). " +
+    "Run focused `bun test <file>.test.ts` unit tests instead."
+  );
+}
+
 /**
  * The refusal a `role` session gets for `shape` under `grants`, or `undefined`
  * when the grant covers it.
@@ -296,8 +477,16 @@ export function releaseShapeFromTool(
 export function releaseRefusal(
   grants: ResolvedGrants,
   role: SessionRole,
-  shape: ReleaseShape,
+  shape: GateShape,
 ): ReleaseDecision | undefined {
+  // The shared-host gate is not a grant anyone holds: a worker is always
+  // refused — the shared operator host cannot absorb a whole-package suite,
+  // which is the exact load that stopped it — and an operator session is
+  // never, because the operator owns the host and CI owns the full suite.
+  if (shape === SHARED_HOST_SHAPE) {
+    if (role !== "worker") return undefined;
+    return { block: true, reason: sharedHostRefusalReason(undefined) };
+  }
   const holder = grants[shape];
   if (holder === role) return undefined;
   return {
@@ -319,11 +508,22 @@ export function releaseDecision(
   role: SessionRole,
   toolName: string,
   input: Record<string, unknown>,
-): { shape: ReleaseShape; matched: string; decision: ReleaseDecision } | undefined {
+): { shape: GateShape; matched: string; decision: ReleaseDecision } | undefined {
   const match = releaseToolMatch(toolName, input);
   if (match === undefined) return undefined;
   const decision = releaseRefusal(grants, role, match.shape);
-  return decision === undefined ? undefined : { shape: match.shape, matched: match.matched, decision };
+  if (decision === undefined) return undefined;
+  // The shared-host gate's wording is matched-specific (name the focused form
+  // for a whole-package `bun test`, name the suite for a script), so it is
+  // read off the offending segment here rather than from `releaseRefusal`.
+  if (match.shape === SHARED_HOST_SHAPE) {
+    return {
+      shape: match.shape,
+      matched: match.matched,
+      decision: { block: true, reason: sharedHostRefusalReason(match.matched) },
+    };
+  }
+  return { shape: match.shape, matched: match.matched, decision };
 }
 
 const RELEASE_ARG_ALLOWLIST = new Set([
@@ -424,7 +624,7 @@ interface ReleasePolicyPi {
 export function releasePolicyTripwire(
   grants: ResolvedGrants,
   role: SessionRole,
-  onBlocked: (shape: ReleaseShape, context: ReleaseBlockContext) => void = () => {},
+  onBlocked: (shape: GateShape, context: ReleaseBlockContext) => void = () => {},
 ): (pi: ReleasePolicyPi) => void {
   return (pi) => {
     pi.on("tool_call", (event) => {
@@ -450,7 +650,7 @@ export function releasePolicyTripwire(
 export function recordReleaseBlock(
   project: string,
   source: ReleaseBlock["source"],
-  shape: ReleaseShape,
+  shape: GateShape,
   details: Omit<ReleaseBlock, "project" | "source" | "shape" | "at"> = {},
   root = stateDir(),
   now = new Date(),

package/src/session-host.ts

@@ -22,9 +22,8 @@
 import { connect } from "node:net";
 
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
-import type { ReleaseBlockContext } from "./release-policy.ts";
-
-import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
+import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
+import type { ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
  * Everything the child needs to build the session. Plain JSON on purpose:
@@ -68,7 +67,7 @@ export type HostToParent =
   | { t: "session-file"; path: string }
   | { t: "prompt-result"; id: number; ok: boolean; error?: string }
   | { t: "park-result"; id: number; ok: boolean; error?: string }
-  | ({ t: "release-blocked"; shape: ReleaseShape } & ReleaseBlockContext);
+  | ({ t: "release-blocked"; shape: GateShape } & ReleaseBlockContext);
 
 /**
  * Depth at which a harness event stops being copied for the wire.
@@ -196,7 +195,14 @@ export async function runSessionHost(
     });
   } catch (err) {
     send({ t: "start-error", message: err instanceof Error ? err.message : String(err) });
-    socket.end();
+    // The frame must reach the parent before this process exits: `process.exit`
+    // does not flush the socket, and a parent that only observes the exit used
+    // to report a bare exit code instead of the child's own words.
+    await new Promise<void>((resolve) => {
+      socket.once("finish", () => resolve());
+      socket.once("error", () => resolve());
+      socket.end();
+    });
     return;
   }