omp-conductor 0.15.5 → 0.15.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.15.5",
+  "version": "0.15.6",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/board.ts

@@ -4,6 +4,7 @@ import { emitKeypressEvents } from "node:readline";
 import { findProject, loadConfig, resolveCaps } from "./config.ts";
 import { statusSnapshotFromStore, type StatusSnapshot } from "./daemon.ts";
 import {
+  classifyDaemonProjectHealth,
   codeGraphFromHealthz,
   fleetLayers,
   probeTelegramHealth,
@@ -926,39 +927,16 @@ export function renderBoard(
 async function probeBoardHealth(project: ProjectConfig): Promise<BoardHealthProbe> {
   const layers = fleetLayers(project.name);
   const record = livingDaemon();
+  // Same gate as status (#379): never health-check a record pinned to another
+  // project, and never invent a second membership convention beside
+  // classifyDaemonProjectHealth.
   const wrongRecord = record?.project !== undefined && record.project !== project.name;
   const [telegram, health] = await Promise.all([
     probeTelegramHealth(project.name),
     record === undefined || wrongRecord ? undefined : healthCheck(record.port),
   ]);
-  let daemon: DaemonBoardState;
-  if (record === undefined) daemon = "stopped";
-  else if (wrongRecord) daemon = "other-project";
-  else if (health?.ok !== true) daemon = "unreachable";
-  else {
-    try {
-      const payload = JSON.parse(health.body ?? "null") as unknown;
-      if (payload === null || typeof payload !== "object") {
-        daemon = "unreachable";
-      } else if (Reflect.get(payload, "project") === project.name) {
-        daemon = "ok";
-      } else {
-        const projects = Reflect.get(payload, "projects");
-        daemon =
-          Array.isArray(projects) &&
-          projects.some(
-            (entry) =>
-              entry !== null &&
-              typeof entry === "object" &&
-              Reflect.get(entry, "project") === project.name,
-          )
-            ? "ok"
-            : "other-project";
-      }
-    } catch {
-      daemon = "unreachable";
-    }
-  }
+  const classified = classifyDaemonProjectHealth(record, health, project.name);
+  const daemon: DaemonBoardState = classified.kind;
   const cachedGraph = daemon === "ok" ? codeGraphFromHealthz(health?.body, project.name) : undefined;
   return {
     health: {

package/src/fleet.ts

@@ -55,8 +55,10 @@ import {
   healthCheck,
   isAlive,
   livingDaemon,
+  probeUnit,
   stopDaemon,
   type StopResult,
+  type UnitOwnership,
   SYSTEMD_UNIT,
 } from "./lifecycle.ts";
 import { formatRss, rssBytesFromHealthz } from "./host.ts";
@@ -99,7 +101,7 @@ export const ARM_CHALLENGE_TIMEOUT_MS = 300_000;
 const LEGACY_HERDR_SESSION = "fleet";
 
 export const LEGACY_HERDR_SESSION_HINT =
-  'herdr session "fleet" found — rename it to "conductor" or set HERDR_SESSION=fleet (remove this bridge next minor)';
+  'herdr session "fleet" found — rename it to "conductor" or run omp-conductor setup host to pin HERDR_SESSION=fleet (remove this bridge next minor)';
 
 let legacyHerdrSessionHintPrinted = false;
 
@@ -1270,10 +1272,132 @@ export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()):
 }
 
 
+/**
+ * Project-scoped reading of a living daemon record + `/healthz` body.
+ *
+ * Board and `status` share this so a host running one daemon for several
+ * projects cannot be called healthy for a project it does not serve (#379).
+ * A third interpretation convention is forbidden.
+ */
+export type DaemonProjectHealth =
+  | { kind: "stopped" }
+  | { kind: "ok" }
+  | { kind: "unreachable" }
+  | { kind: "other-project"; serves?: string };
+
+/**
+ * Facts `formatFleetStatus` needs about the living daemon. Pure input — the
+ * caller probes; the formatter never shells out (#379).
+ */
+export type FleetDaemonProbe = {
+  project: DaemonProjectHealth;
+  /** `/healthz` body when the probe is project-ok (rss / overlays). */
+  body?: string;
+  /** systemd ownership of the living record pid; omit when unprobed. */
+  unit?: UnitOwnership;
+};
+
+/**
+ * Decide whether a living record + optional `/healthz` answer serve `project`.
+ *
+ * Mirrors the board gate: a record pinned to another project is never probed
+ * further; a multi-project payload is ok only when `project` appears in
+ * `projects[]` (or as the top-level single-project `project` field).
+ */
+export function classifyDaemonProjectHealth(
+  record: { project?: string } | undefined,
+  health: { ok: boolean; body?: string } | undefined,
+  project: string,
+): DaemonProjectHealth {
+  if (record === undefined) return { kind: "stopped" };
+  // Record project is authoritative when set — a single-project leftover from
+  // #376 must not be presented as this project's daemon just because its port
+  // still answers.
+  if (record.project !== undefined && record.project !== project) {
+    return { kind: "other-project", serves: record.project };
+  }
+  if (health?.ok !== true) return { kind: "unreachable" };
+  try {
+    const payload = JSON.parse(health.body ?? "null") as unknown;
+    if (payload === null || typeof payload !== "object") {
+      return { kind: "unreachable" };
+    }
+    if (Reflect.get(payload, "project") === project) return { kind: "ok" };
+    const projects = Reflect.get(payload, "projects");
+    if (
+      Array.isArray(projects) &&
+      projects.some(
+        (entry) =>
+          entry !== null &&
+          typeof entry === "object" &&
+          Reflect.get(entry, "project") === project,
+      )
+    ) {
+      return { kind: "ok" };
+    }
+    return { kind: "other-project", serves: servedProjectName(payload) };
+  } catch {
+    return { kind: "unreachable" };
+  }
+}
+
+/** Best-effort name of who a foreign `/healthz` payload is actually serving. */
+function servedProjectName(payload: object): string | undefined {
+  const top = Reflect.get(payload, "project");
+  if (typeof top === "string" && top.length > 0) return top;
+  const projects = Reflect.get(payload, "projects");
+  if (!Array.isArray(projects)) return undefined;
+  for (const entry of projects) {
+    if (entry === null || typeof entry !== "object") continue;
+    const name = Reflect.get(entry, "project");
+    if (typeof name === "string" && name.length > 0) return name;
+  }
+  return undefined;
+}
+
+function formatDaemonHealthz(probe: FleetDaemonProbe | undefined): string {
+  if (probe === undefined) return "unprobed";
+  switch (probe.project.kind) {
+    case "stopped":
+      return "stopped";
+    case "ok":
+      return "ok";
+    case "unreachable":
+      return "unreachable — the process is up but not serving";
+    case "other-project":
+      return probe.project.serves === undefined
+        ? "other-project"
+        : `other-project — serves ${probe.project.serves}`;
+  }
+}
+
+/**
+ * Unit line for a living record. The bare unit name alone used to imply
+ * systemd ownership that was never checked (#379); every branch states the
+ * probe result, and `unknown` is never rendered as owned.
+ */
+function formatDaemonUnit(unit: UnitOwnership | undefined, recordPid: number): string {
+  if (unit === undefined) return `  unit      ${SYSTEMD_UNIT}  unprobed`;
+  switch (unit.kind) {
+    case "active":
+      if (unit.pid === recordPid) {
+        return `  unit      ${SYSTEMD_UNIT}  systemd-owned`;
+      }
+      // Live unit, different MainPID — the record pid is not systemd's.
+      return `  unit      ${SYSTEMD_UNIT}  unmanaged — MainPID ${unit.pid}`;
+    case "failed":
+      return `  unit      ${SYSTEMD_UNIT}  unmanaged — unit failed`;
+    case "inactive":
+      return `  unit      ${SYSTEMD_UNIT}  inactive`;
+    case "unknown":
+      return `  unit      ${SYSTEMD_UNIT}  unknown — ${unit.reason}`;
+  }
+}
+
 export function formatFleetStatus(
   s: StatusSnapshot,
   layers: FleetLayers,
-  daemonHealth?: { ok: boolean; body?: string },
+  daemon: FleetDaemonProbe | undefined = undefined,
   telegram: TelegramHealth = { kind: "unprobed" },
   now = Date.now(),
   codeGraph: CodeGraphHealth = { configured: false },
@@ -1315,20 +1439,17 @@ export function formatFleetStatus(
   if (!layers.daemon.running || layers.daemon.pid === undefined) {
     daemonBlock = "daemon    not running";
   } else {
-    const hz =
-      daemonHealth === undefined
-        ? "unprobed"
-        : daemonHealth.ok
-          ? "ok"
-          : "unreachable — the process is up but not serving";
-    const rss = rssBytesFromHealthz(daemonHealth?.body);
+    // Only trust rss from a project-ok body — a foreign payload's bytes are
+    // not this project's daemon facts (#379).
+    const rss =
+      daemon?.project.kind === "ok" ? rssBytesFromHealthz(daemon.body) : undefined;
     daemonBlock = [
       "daemon",
       `  pid       ${layers.daemon.pid}`,
       `  port      ${layers.daemon.port ?? "?"}`,
       ...(rss === undefined ? [] : [`  rss       ${formatRss(rss)}`]),
-      `  healthz   ${hz}`,
-      `  unit      ${SYSTEMD_UNIT}`,
+      `  healthz   ${formatDaemonHealthz(daemon)}`,
+      formatDaemonUnit(daemon?.unit, layers.daemon.pid),
     ].join("\n");
   }
 
@@ -1504,8 +1625,11 @@ export async function renderStatus(projectName?: string): Promise<string> {
   const layers = fleetLayers(projectName);
   const project = findProject(loadConfig(), projectName);
   const rec = livingDaemon();
-  const [health, telegram, planUsage, github] = await Promise.all([
-    rec === undefined ? undefined : healthCheck(rec.port),
+  // Gate the port probe on record membership first — a leftover single-project
+  // daemon from #376 must not be health-checked as if it served us (#379).
+  const wrongRecord = rec?.project !== undefined && rec.project !== project.name;
+  const [rawHealth, telegram, planUsage, github] = await Promise.all([
+    rec === undefined || wrongRecord ? undefined : healthCheck(rec.port),
     probeTelegramHealth(projectName),
     // Read here rather than in `statusSnapshot`, which is synchronous and used
     // by callers that must not shell out. An unmetered project never spawns
@@ -1516,13 +1640,27 @@ export async function renderStatus(projectName?: string): Promise<string> {
     // broken report (#188).
     fetchRateLimit(),
   ]);
-  const cached = codeGraphFromHealthz(health?.body, project.name);
+  const projectHealth = classifyDaemonProjectHealth(rec, rawHealth, project.name);
+  // Ownership is probed, never assumed from the unit name constant (#379).
+  const unit = rec === undefined ? undefined : probeUnit();
+  const daemon: FleetDaemonProbe | undefined =
+    rec === undefined
+      ? undefined
+      : {
+          project: projectHealth,
+          ...(projectHealth.kind === "ok" && rawHealth?.body !== undefined
+            ? { body: rawHealth.body }
+            : {}),
+          ...(unit === undefined ? {} : { unit }),
+        };
+  const healthBody = projectHealth.kind === "ok" ? rawHealth?.body : undefined;
+  const cached = codeGraphFromHealthz(healthBody, project.name);
   const codeGraph = cached ?? (await probeCodeGraph(project));
-  const workerPhases = workerPhasesFromHealthz(health?.body, project.name);
+  const workerPhases = workerPhasesFromHealthz(healthBody, project.name);
   return formatFleetStatus(
     { ...s, planUsage, github },
     layers,
-    health,
+    daemon,
     telegram,
     Date.now(),
     codeGraph,

package/src/setup-host.ts

@@ -4,7 +4,7 @@ import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
 import { configPath, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { isPaused, runDaemon, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
-import { DEFAULT_FLEET_AGENT_NAME } from "./fleet.ts";
+import { DEFAULT_FLEET_AGENT_NAME, DEFAULT_HERDR_SESSION, resolveHerdrSessionWithBridge } from "./fleet.ts";
 import {
   DEFAULT_PORT,
   healthCheck,
@@ -65,6 +65,12 @@ export interface ServiceRuntime {
   packageCli: string;
   conductorHome: string;
   telegramStateDir: string;
+  /**
+   * Non-default Herdr session to pin into the unit (#394). Omitted when the
+   * host uses {@link DEFAULT_HERDR_SESSION}: an always-present line would show
+   * as drift on every existing host and add a redundant default.
+   */
+  herdrSession?: string;
 }
 
 function systemdQuote(value: string): string {
@@ -237,7 +243,12 @@ function refusal(
 }
 
 
-function defaultServiceRuntime(telegramStateDir: string): ServiceRuntime {
+function defaultServiceRuntime(
+  telegramStateDir: string,
+  // Bridge-resolved session name. Passed in so tests stay hermetic (no herdr
+  // spawn) and the renderer never shells out — same threading as telegramStateDir.
+  herdrSession: string = resolveHerdrSessionWithBridge(),
+): ServiceRuntime {
   const home = homedir();
   const bun = process.execPath;
   const globalCli = Bun.which("omp-conductor");
@@ -253,6 +264,9 @@ function defaultServiceRuntime(telegramStateDir: string): ServiceRuntime {
     packageCli: join(import.meta.dir, "cli.ts"),
     conductorHome: dirname(configPath()),
     telegramStateDir,
+    // Only pin a non-default session. Default hosts keep a unit with no
+    // HERDR_SESSION line so setup/upgrade do not invent drift (#394).
+    ...(herdrSession !== DEFAULT_HERDR_SESSION ? { herdrSession } : {}),
   };
 }
 
@@ -283,6 +297,11 @@ export function renderDaemonService(runtime: ServiceRuntime, totalWorkers: numbe
     `Environment=${systemdQuote(`PATH=${runtime.path}`)}`,
     `Environment=${systemdQuote(`OMP_CONDUCTOR_HOME=${runtime.conductorHome}`)}`,
     `Environment=${systemdQuote(`OMP_TELEGRAM_STATE_DIR=${runtime.telegramStateDir}`)}`,
+    // Escape hatch for hosts still on the pre-#320 "fleet" session (#394). Only
+    // when set: an always-on line would drift every default host on every setup.
+    ...(runtime.herdrSession === undefined
+      ? []
+      : [`Environment=${systemdQuote(`HERDR_SESSION=${runtime.herdrSession}`)}`]),
     `WorkingDirectory=${systemdPath(stateDir())}`,
     `ExecStart=${command.map(systemdQuote).join(" ")}`,
     "Restart=on-failure",