omp-conductor 0.15.11 → 0.15.13

package/src/release-policy.ts

@@ -58,7 +58,7 @@ export interface ReleaseBlockContext {
 export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
   project: string;
   source: "worker" | "orchestrator";
-  shape: ReleaseShape;
+  shape: GateShape;
   at: string;
   issue?: number;
   runId?: string;
@@ -66,37 +66,258 @@ export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
 
 export type ReleaseDecision = { block: true; reason: string };
 
+/**
+ * The shared-host heavy-gate shape (#428): whole-package test runs and the
+ * shell suites a worker must be *unable* to run on the operator's shared host,
+ * rather than merely told not to.
+ *
+ * Deliberately **not** a {@link ReleaseShape}: no grant covers it. An operator
+ * is never refused — the operator owns the host, and CI owns the full suite —
+ * and a worker is always, whatever the config says. So it stays out of the
+ * configurable grant vocabulary (`releaseShapeEnum` is drawn straight from
+ * {@link RELEASE_SHAPES}); it only rides the release-policy classifier and the
+ * block ledger so one seam sees it. Its refusals land in the same ledger the
+ * tick reads, but the tick reports them apart from release drift (#562):
+ * a refusal here is the interlock working, never a release-policy violation
+ * and never something a grant could have permitted.
+ */
+export const SHARED_HOST_SHAPE = "shared-host-gate" as const;
+export type SharedHostShape = typeof SHARED_HOST_SHAPE;
+
+/** Every shape the classifier reports, grantable or not. */
+export type GateShape = ReleaseShape | SharedHostShape;
+
 const GIT_PUSH_TAG_SHAPE =
   /(?:--tags\b|--follow-tags\b|refs\/tags\/|(?:^|\s)(?:tag\s+)?v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?=[:\s]|$))/;
 
+/** The separators the original quote-blind splitter divides a command on. Kept
+ *  for the unterminated-quote fallback, which must reproduce today's behaviour
+ *  rather than silently pass a command through. */
+const COMMAND_SEPARATORS = /(?:&&|\|\||[;\n|])/;
+
+/**
+ * Split a shell command on its operators, ignoring ones inside single or
+ * double quotes. The old splitter was quote-blind, so a `|` inside a quoted
+ * argument (a grep alternation's `\|`, a `--jq` filter, a heredoc) shredded
+ * the command into phantom segments and a gated verb inside a string literal
+ * was refused as a release attempt (#526). A small scanner is enough: no shell
+ * parser, no dependency. An unterminated quote falls back to the original
+ * quote-blind split, because a gated command must not slip through merely
+ * because a quote never closed.
+ */
+function splitCommandSegments(command: string): string[] {
+  const segments: string[] = [];
+  let current = "";
+  let quote: "'" | '"' | null = null;
+
+  const push = () => {
+    segments.push(current);
+    current = "";
+  };
+
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+
+    // Inside a quote only its closing quote matters — separators are data. A
+    // `\"` inside double quotes is a literal quote and must not close it.
+    if (quote !== null) {
+      current += ch;
+      if (ch === "\\" && quote === '"') {
+        if (i + 1 < command.length) current += command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+
+    // Outside quotes a backslash escapes the next character, so a literal
+    // `\|`, `\;` or `\"` is data, never an operator or the start of a quote.
+    if (ch === "\\") {
+      current += ch;
+      if (i + 1 < command.length) current += command[++i];
+      continue;
+    }
+
+    if (ch === "'") {
+      quote = "'";
+      current += ch;
+      continue;
+    }
+    if (ch === '"') {
+      quote = '"';
+      current += ch;
+      continue;
+    }
+
+    if ((ch === "&" && command[i + 1] === "&") || (ch === "|" && command[i + 1] === "|")) {
+      push();
+      i++;
+      continue;
+    }
+    if (ch === "|" || ch === ";" || ch === "\n") {
+      push();
+      continue;
+    }
+
+    current += ch;
+  }
+
+  if (quote !== null) return command.split(COMMAND_SEPARATORS);
+
+  push();
+  return segments;
+}
+
 function commandSegments(command: string): string[] {
-  return command
-    .split(/(?:&&|\|\||[;\n|])/)
+  return splitCommandSegments(command)
     .map((segment) => segment.trim())
     .filter((segment) => segment.length > 0);
 }
 
+/** A leading wrapper command, matched and consumed in a chain (#558). `env`
+ *  was already stripped; `timeout`, `nice`, `stdbuf` and a shell `-c` were
+ *  not, so a whole-package run became allowed the moment it picked up a
+ *  wrapper — the incident ran `timeout 300 bun test` and the guard never
+ *  fired. Each alternative owns the arguments that belong to it (the
+ *  duration, the niceness, the option run), so stripping never swallows the
+ *  command's own words. Ordered longest-first so `timeout` is consumed
+ *  before `time` and `env` before a bare `VAR=…` chain. */
+const COMMAND_WRAPPER_PREFIX = new RegExp(
+  [
+    "^sudo(?:\\s+-[a-z][a-z0-9-]*)*\\s+",
+    "^env\\s+",
+    "^(?:[A-Za-z_][A-Za-z0-9_]*=\\S+\\s+)+",
+    "^timeout(?:\\s+--?[a-z][a-z0-9-]*(?:=\\S+|\\s+\\S+)?)*\\s+(?:inf|infinity|\\d+(?:\\.\\d+)?[smhd]?)\\s+",
+    "^nice(?:\\s+-n\\s+-?\\d+|\\s+-\\d+|\\s+--adjustment\\s*=\\s*-?\\d+)?\\s+",
+    "^ionice(?:\\s+--?[a-z][a-z0-9-]*(?:\\s+\\d+)?)*\\s+",
+    "^stdbuf(?:\\s+--?[a-z][a-z0-9-]*(?:=\\S+|[A-Za-z0-9]+|\\s+[A-Za-z0-9])?)*\\s+",
+    "^xargs(?:\\s+--?[A-Za-z][A-Za-z0-9-]*(?:=\\S+|\\s+\\S+)?)*\\s+",
+    "^time\\s+",
+  ].join("|"),
+);
+
+/** `bash -c`, `sh -c`, `zsh -c` with optional preceding flags — `-lc` and
+ *  friends parse as combined short options, so the `c` may ride in the same
+ *  token as the flags before it. A `bash -n` parse check is deliberately not
+ *  one: it executes nothing. */
+const SHELL_DASH_C = /^(?:bash|sh|zsh)\s+(?:-\S+\s+)*?-[A-Za-z]*c\b\s+/;
+
+/**
+ * The command a `bash -c '<cmd>'` / `sh -c "<cmd>"` segment executes is the
+ * quoted string, not the `bash` invocation, so a wrapper command that reaches
+ * for a shell must be resolved to the string inside the quotes before
+ * classifying. Extra `$0`.. arguments after the closing quote are ignored:
+ * they are not the command.
+ */
+function shellCommandInner(segment: string): string | undefined {
+  const shell = SHELL_DASH_C.exec(segment);
+  if (shell === null) return undefined;
+  const rest = segment.slice(shell[0].length);
+  const quote = rest[0];
+  if (quote !== "'" && quote !== '"') return undefined;
+  const close = rest.indexOf(quote, 1);
+  if (close < 0) return undefined;
+  return rest.slice(1, close);
+}
+
+/** Normalise a segment before classification: consume every leading wrapper
+ *  command (#558). The old stripper recognised `env` and `sudo` and nothing
+ *  else, so a whole-package `bun test` became allowed the moment a worker
+ *  wrapped it in `timeout`/`nice`/`bash -c`. Chains matter — `timeout 300
+ *  nice bun test` is one command with two wrappers — so the table is matched
+ *  repeatedly until the leading word belongs to the command itself.
+ */
 function stripCommandPrefix(segment: string): string {
-  return segment
-    .replace(/^env\s+/, "")
-    .replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*/, "")
-    .replace(/^sudo\s+/, "");
+  let stripped = segment;
+  let match: RegExpExecArray | null;
+  while ((match = COMMAND_WRAPPER_PREFIX.exec(stripped)) !== null) {
+    stripped = stripped.slice(match[0].length);
+  }
+  return stripped;
 }
 
 /** Recognise the explicit release/deploy command shapes this policy promises to gate. */
-export function releaseShapeFromCommand(command: string): ReleaseShape | undefined {
+export function releaseShapeFromCommand(command: string): GateShape | undefined {
   return releaseCommandMatch(command)?.shape;
 }
 
+/**
+ * A whole-package `bun test`: `bun test` with no positional naming a specific
+ * test file. Flags alone — or nothing at all — still run the whole project,
+ * which is the gate (#428), and so do the path spellings of "everything":
+ * `bun test .`, `bun test ./`, `bun test src`. A command whose positional
+ * targets are test files — basename carrying the `*.test.*` / `*_test.*`
+ * marker bun itself keys on — is a focused run, a worker's proof path, and
+ * must stay available. A flag's own value is not a focused target: a
+ * `--preload x.ts` run with no file runs the whole package with a preload,
+ * while `--preload ./setup.ts src/daemon.test.ts` is still a test-file run.
+ */
+function wholePackageBunTest(segment: string): boolean {
+  const head = /^bun\s+test\b/.exec(segment);
+  if (head === null) return false;
+  const rest = segment.slice(head[0].length);
+  return !rest
+    .split(/\s+/)
+    .filter((token) => token.length > 0)
+    .filter((token) => !token.startsWith("-"))
+    .some((token) => /\.test\.|_test\./.test(token.slice(token.lastIndexOf("/") + 1)));
+}
+
+/**
+ * The shared-host run/shell suites a worker must not execute on the operator's
+ * host (#428): `herdr/test/recover-test.sh`, `test/setup-test.sh` and
+ * `setup.sh`, each under the invocation prefixes a worker actually uses —
+ * plain `bash`/`sh`/`zsh`, POSIX `. ` and `source` (all so the script loads),
+ * and a bare or `./` path. Returns the script path that fired, for the
+ * matched-segment ledger record.
+ *
+ * `bash -n` is deliberately not a match: parsing a script never executes it,
+ * and the pre-push parse gate every worker brief runs is
+ * `bash -n herdr/bin/recover.sh herdr/test/recover-test.sh setup.sh
+ * test/setup-test.sh` — blocking that would make the gate unfollowable without
+ * buying a single byte of protection. A flag beyond `-n` (`bash -x`, `-e`) is
+ * a real execution and is not covered either: the incidents that overloaded
+ * the host were all plain invocations, and refusing the sanctioned parse check
+ * would teach workers to skip it rather than stop the load.
+ */
+const SHARED_HOST_SCRIPTS = [
+  "herdr/test/recover-test.sh",
+  "test/setup-test.sh",
+  "setup.sh",
+];
+
+const SHARED_HOST_PREFIX = /^(?:(?:bash|sh|zsh|source)\s+|\.\s+)?\.?\/?/;
+
+function sharedHostScriptMatch(segment: string): string | undefined {
+  const path = segment.replace(SHARED_HOST_PREFIX, "");
+  for (const script of SHARED_HOST_SCRIPTS) {
+    if (path === script || path.startsWith(`${script} `) || path.startsWith(`${script}\t`)) {
+      return script;
+    }
+  }
+  return undefined;
+}
+
 /**
  * Classify a shell command and the segment that fired. The segment is what a
  * triager reads: `bun test src/foo.test.ts && npm publish` matches on its
  * `npm publish` half, and the record says so instead of folding the whole
  * command into the shape.
  */
-function releaseCommandMatch(command: string): { shape: ReleaseShape; matched: string } | undefined {
+function releaseCommandMatch(command: string): { shape: GateShape; matched: string } | undefined {
   for (const raw of commandSegments(command)) {
     const segment = stripCommandPrefix(raw);
+    // A `bash -c '<cmd>'` / `sh -c "<cmd>"` wrapper executes the quoted
+    // string, so classify that string as a command of its own: a whole
+    // package inside the quotes is refused (#558), a focused run inside
+    // the quotes stays a focused run, and a harmless `-c` script body
+    // (the pre-push `bash -n` parse gate) never unwraps to begin with.
+    const inner = shellCommandInner(segment);
+    if (inner !== undefined) {
+      const nested = releaseCommandMatch(inner);
+      if (nested !== undefined) return nested;
+      continue;
+    }
     // Patching the running conductor is gated like a release act: `upgrade`,
     // the detached `upgrade-install`/`upgrade-rollback` executor entries and
     // any future spelling under the upgrade family all need the install shape,
@@ -121,6 +342,13 @@ function releaseCommandMatch(command: string): { shape: ReleaseShape; matched: s
     ) {
       return { shape: "deploy", matched: segment };
     }
+    // The shared-host gate (#428). Disjoint from every release shape above, so
+    // it is checked last without disturbing any of them. `matched` names the
+    // script path for a suite and the offending segment for a whole-package
+    // `bun test`, so the ledger and the digest say exactly which one fired.
+    if (wholePackageBunTest(segment)) return { shape: SHARED_HOST_SHAPE, matched: segment };
+    const script = sharedHostScriptMatch(segment);
+    if (script !== undefined) return { shape: SHARED_HOST_SHAPE, matched: script };
   }
   return undefined;
 }
@@ -256,7 +484,7 @@ function releaseTokenMatch(
 export function releaseToolMatch(
   toolName: string,
   input: Record<string, unknown> | undefined,
-): { shape: ReleaseShape; matched: string } | undefined {
+): { shape: GateShape; matched: string } | undefined {
   if (input === undefined) return undefined;
   if (toolName === "bash") {
     return typeof input.command === "string" ? releaseCommandMatch(input.command) : undefined;
@@ -278,10 +506,31 @@ export function releaseToolMatch(
 export function releaseShapeFromTool(
   toolName: string,
   input: Record<string, unknown> | undefined,
-): ReleaseShape | undefined {
+): GateShape | undefined {
   return releaseToolMatch(toolName, input)?.shape;
 }
 
+/**
+ * The refusal wording for the shared-host gate (#428). The whole-package
+ * `bun test` form names the focused alternative (a guard that only denies
+ * teaches nothing and gets worked around); the shell suites get their own
+ * because there is no focused form of a suite script.
+ */
+function sharedHostRefusalReason(matched: string | undefined): string {
+  if (matched !== undefined && /^bun\s+test\b/.test(matched)) {
+    return (
+      "Blocked by sharedHostPolicy: the whole-package `bun test` is not a worker's proof path on this shared " +
+      "host (it overloads the 4-core VPS and, before #399, SIGTERMed the production daemon). " +
+      "Run a focused `bun test <file>.test.ts` instead."
+    );
+  }
+  return (
+    "Blocked by sharedHostPolicy: this shell suite is not a worker's proof path on this shared host " +
+    "(it overloads the 4-core VPS that also runs Langfuse and the fleet). " +
+    "Run focused `bun test <file>.test.ts` unit tests instead."
+  );
+}
+
 /**
  * The refusal a `role` session gets for `shape` under `grants`, or `undefined`
  * when the grant covers it.
@@ -296,8 +545,16 @@ export function releaseShapeFromTool(
 export function releaseRefusal(
   grants: ResolvedGrants,
   role: SessionRole,
-  shape: ReleaseShape,
+  shape: GateShape,
 ): ReleaseDecision | undefined {
+  // The shared-host gate is not a grant anyone holds: a worker is always
+  // refused — the shared operator host cannot absorb a whole-package suite,
+  // which is the exact load that stopped it — and an operator session is
+  // never, because the operator owns the host and CI owns the full suite.
+  if (shape === SHARED_HOST_SHAPE) {
+    if (role !== "worker") return undefined;
+    return { block: true, reason: sharedHostRefusalReason(undefined) };
+  }
   const holder = grants[shape];
   if (holder === role) return undefined;
   return {
@@ -319,11 +576,22 @@ export function releaseDecision(
   role: SessionRole,
   toolName: string,
   input: Record<string, unknown>,
-): { shape: ReleaseShape; matched: string; decision: ReleaseDecision } | undefined {
+): { shape: GateShape; matched: string; decision: ReleaseDecision } | undefined {
   const match = releaseToolMatch(toolName, input);
   if (match === undefined) return undefined;
   const decision = releaseRefusal(grants, role, match.shape);
-  return decision === undefined ? undefined : { shape: match.shape, matched: match.matched, decision };
+  if (decision === undefined) return undefined;
+  // The shared-host gate's wording is matched-specific (name the focused form
+  // for a whole-package `bun test`, name the suite for a script), so it is
+  // read off the offending segment here rather than from `releaseRefusal`.
+  if (match.shape === SHARED_HOST_SHAPE) {
+    return {
+      shape: match.shape,
+      matched: match.matched,
+      decision: { block: true, reason: sharedHostRefusalReason(match.matched) },
+    };
+  }
+  return { shape: match.shape, matched: match.matched, decision };
 }
 
 const RELEASE_ARG_ALLOWLIST = new Set([
@@ -424,7 +692,7 @@ interface ReleasePolicyPi {
 export function releasePolicyTripwire(
   grants: ResolvedGrants,
   role: SessionRole,
-  onBlocked: (shape: ReleaseShape, context: ReleaseBlockContext) => void = () => {},
+  onBlocked: (shape: GateShape, context: ReleaseBlockContext) => void = () => {},
 ): (pi: ReleasePolicyPi) => void {
   return (pi) => {
     pi.on("tool_call", (event) => {
@@ -450,7 +718,7 @@ export function releasePolicyTripwire(
 export function recordReleaseBlock(
   project: string,
   source: ReleaseBlock["source"],
-  shape: ReleaseShape,
+  shape: GateShape,
   details: Omit<ReleaseBlock, "project" | "source" | "shape" | "at"> = {},
   root = stateDir(),
   now = new Date(),
@@ -477,21 +745,21 @@ export interface ReleaseDriftSummary {
   latest: ReleaseBlock;
 }
 
-/** Aggregate today's blocked attempts for the orchestrator's daily digest. */
-export function releaseDriftToday(
-  project: string,
-  root = stateDir(),
-  now = new Date(),
-): ReleaseDriftSummary | undefined {
+/**
+ * The `release-policy-blocks.jsonl` rows recorded for `project` on `now`'s
+ * UTC day, in file order. One scan backs both day summaries, so the release
+ * drift counter and the shared-host counter can never disagree about which
+ * ledger rows are in play (#562).
+ */
+function auditRowsToday(project: string, root: string, now: Date): ReleaseBlock[] {
   let text: string;
   try {
     text = readFileSync(join(root, RELEASE_POLICY_AUDIT_FILE), "utf8");
   } catch {
-    return undefined;
+    return [];
   }
   const day = now.toISOString().slice(0, 10);
-  let count = 0;
-  let latest: ReleaseBlock | undefined;
+  const rows: ReleaseBlock[] = [];
   for (const line of text.split("\n")) {
     if (line.length === 0) continue;
     try {
@@ -503,14 +771,58 @@ export function releaseDriftToday(
         (value.source === "worker" || value.source === "orchestrator") &&
         typeof value.shape === "string"
       ) {
-        count += 1;
-        latest = value as ReleaseBlock;
+        rows.push(value as ReleaseBlock);
       }
     } catch {
       // One torn line does not hide later valid audit records.
     }
   }
-  return latest === undefined ? undefined : { count, latest };
+  return rows;
+}
+
+/**
+ * Aggregate today's blocked release/deploy attempts for the orchestrator's
+ * daily digest. The shared-host gate (#428) is deliberately excluded (#562):
+ * a guard refusal is the interlock working, never a divergence from release
+ * policy, and no grant could ever have permitted the command — so counting a
+ * refusal here would report a success as a violation. {@link
+ * sharedHostRefusalsToday} reads the same ledger and reports those rows on
+ * their own line, so nothing is dropped.
+ */
+export function releaseDriftToday(
+  project: string,
+  root = stateDir(),
+  now = new Date(),
+): ReleaseDriftSummary | undefined {
+  const drift = auditRowsToday(project, root, now).filter((row) => row.shape !== SHARED_HOST_SHAPE);
+  const latest = drift[drift.length - 1];
+  if (latest === undefined) return undefined;
+  return { count: drift.length, latest };
+}
+
+export interface SharedHostGuardSummary {
+  count: number;
+  latest: ReleaseBlock;
+}
+
+/**
+ * Aggregate today's shared-host gate refusals (#562), apart from release
+ * drift. Every row records a worker being correctly stopped — the whole
+ * package runs and host shell suites that once SIGTERMed the production
+ * daemon — so the count and the latest {@link ReleaseBlock#matched matched
+ * command} are the operator's signal when a worker keeps pushing at the gate
+ * (tonight's clustering is how #558's wrapper evasion was found), and they
+ * must never ride the release-policy line.
+ */
+export function sharedHostRefusalsToday(
+  project: string,
+  root = stateDir(),
+  now = new Date(),
+): SharedHostGuardSummary | undefined {
+  const blocked = auditRowsToday(project, root, now).filter((row) => row.shape === SHARED_HOST_SHAPE);
+  const latest = blocked[blocked.length - 1];
+  if (latest === undefined) return undefined;
+  return { count: blocked.length, latest };
 }
 
 export function releaseDriftDigestLine(
@@ -535,3 +847,36 @@ export function releaseDriftDigestLine(
     "Include this divergence from releasePolicy=none in today's digest."
   );
 }
+
+/**
+ * The tick/digest line for the shared-host guard (#562), deliberately apart
+ * from {@link releaseDriftDigestLine}: a shared-host refusal is a worker
+ * being correctly stopped, never a release-policy divergence, and naming a
+ * release grant here would misattribute an event no grant covers (#549). A
+ * working guard reads as a working guard; the guard name and the matched
+ * command are the genuinely useful parts, because a clustering of refusals
+ * is itself a signal.
+ */
+export function sharedHostGuardDigestLine(
+  project: string,
+  root = stateDir(),
+  now = new Date(),
+): string | undefined {
+  const refusal = sharedHostRefusalsToday(project, root, now);
+  if (refusal === undefined) return undefined;
+  const latest = refusal.latest;
+  const attribution = [
+    `${latest.source} ${latest.shape} at ${latest.at}`,
+    ...(latest.issue === undefined ? [] : [`issue #${latest.issue}`]),
+    ...(latest.runId === undefined ? [] : [`run ${latest.runId}`]),
+    ...(latest.tool === undefined ? [] : [`tool ${latest.tool}`]),
+    ...(latest.invocation === undefined ? [] : [`attempted "${latest.invocation}"`]),
+    ...(latest.matched === undefined ? [] : [`matched "${latest.matched}"`]),
+  ].join(", ");
+  return (
+    `The shared-host guard refused ${refusal.count} worker command(s) today ` +
+    `(latest: ${attribution}). ` +
+    "This is the shared-host interlock, not a release-policy divergence: a worker " +
+    "is refused these whatever grants it holds; the operator owns the host and CI owns the full suite."
+  );
+}

package/src/session-host.ts

@@ -22,9 +22,8 @@
 import { connect } from "node:net";
 
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
-import type { ReleaseBlockContext } from "./release-policy.ts";
-
-import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
+import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
+import type { ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
  * Everything the child needs to build the session. Plain JSON on purpose:
@@ -68,7 +67,7 @@ export type HostToParent =
   | { t: "session-file"; path: string }
   | { t: "prompt-result"; id: number; ok: boolean; error?: string }
   | { t: "park-result"; id: number; ok: boolean; error?: string }
-  | ({ t: "release-blocked"; shape: ReleaseShape } & ReleaseBlockContext);
+  | ({ t: "release-blocked"; shape: GateShape } & ReleaseBlockContext);
 
 /**
  * Depth at which a harness event stops being copied for the wire.
@@ -196,7 +195,14 @@ export async function runSessionHost(
     });
   } catch (err) {
     send({ t: "start-error", message: err instanceof Error ? err.message : String(err) });
-    socket.end();
+    // The frame must reach the parent before this process exits: `process.exit`
+    // does not flush the socket, and a parent that only observes the exit used
+    // to report a bare exit code instead of the child's own words.
+    await new Promise<void>((resolve) => {
+      socket.once("finish", () => resolve());
+      socket.once("error", () => resolve());
+      socket.end();
+    });
     return;
   }