omp-conductor 0.15.6 → 0.15.8

package/src/setup-wizard.ts

@@ -21,6 +21,7 @@ import {
   resolveCaps,
   saveConfig,
 } from "./config.ts";
+import { claimedTelegramTopics } from "./escalate.ts";
 import { hostRamBytes, recommendedMaxWorkers, workerOvercommit } from "./host.ts";
 import {
   prepareConductor,
@@ -42,6 +43,11 @@ import {
 } from "./setup-host.ts";
 import { runGraphInstall, runHostInstall } from "./setup-install.ts";
 import { probeGates, probeProse, probeRepoMap, type ProbedGate, type ProbeTarget } from "./setup-probe.ts";
+import {
+  discoverFacts,
+  type DiscoveredFacts,
+  type DiscoveryTarget,
+} from "./setup-discover.ts";
 import {
   AMEND_AREAS,
   BASE_FRESHNESS_CHOICES,
@@ -459,10 +465,12 @@ async function askAuthority(
  * shape cannot be added without a question to ask about it — an unasked shape
  * would silently take the deny default and read as a decision afterwards.
  *
- * No fleet vocabulary here on purpose (#122): every one of these is an act the
- * package can recognise anywhere, not a step in one project's release topology.
+ * No fleet-specific vocabulary here (#122): these are generic release acts.
+ * Version preparation becomes executable only when a repo declares its version
+ * file; package names, suite pins and deployment topology still stay in policy.
  */
 const RELEASE_SHAPE_QUESTIONS: { readonly [K in (typeof RELEASE_SHAPES)[number]]: string } = {
+  "version-bump-pr": "open and land an exact version-only pull request before tagging",
   "git-tag": "create git tags (`git tag v1.2.3`)",
   "git-push-tags": "push tags to the remote (`git push --follow-tags`)",
   "package-publish": "publish packages (`npm publish` and equivalents)",
@@ -489,14 +497,26 @@ async function askJudgment(
   ui: WizardUi,
   grants: ResolvedGrants,
   prior: OperatorJudgment,
+  roadmapChoices: readonly string[] = [],
 ): Promise<OperatorJudgment> {
   // Always asked. A tracker shows what is open, never what matters, and an
   // orchestrator that cannot rank work grooms by recency — which is how a stale
   // issue outranks the thing being shipped this month.
+  let roadmapSeed = prior.roadmap ?? "";
+  if (roadmapSeed === "" && roadmapChoices.length > 0) {
+    const other = "Type a different roadmap or priority";
+    const picked = await ui.select(
+      "Roadmap candidates found in GitHub",
+      [...roadmapChoices.map((label) => ({ label })), { label: other }],
+      { initialIndex: 0 },
+    );
+    if (picked === undefined) throw new Cancelled();
+    roadmapSeed = picked === other ? "" : picked;
+  }
   const roadmap = await ask(
     ui,
     "Where does the roadmap live, and what is the current priority?",
-    prior.roadmap ?? "",
+    roadmapSeed,
   );
   const judgment: OperatorJudgment = { ...prior, ...(roadmap.length === 0 ? {} : { roadmap }) };
 
@@ -735,7 +755,12 @@ function priorProject(existing: ConductorConfig | undefined, name: string | unde
  * prompts or the defaults they pre-fill from: the value shown is always the value
  * that would otherwise be carried through.
  */
-type AreaAsker = (ui: WizardUi, a: SetupAnswers, probes: SetupProbes) => Promise<SetupAnswers>;
+type AreaAsker = (
+  ui: WizardUi,
+  a: SetupAnswers,
+  probes: SetupProbes,
+  discovered?: DiscoveredFacts,
+) => Promise<SetupAnswers>;
 
 /**
  * The repo-reading half of onboarding, injected rather than called directly.
@@ -747,6 +772,8 @@ type AreaAsker = (ui: WizardUi, a: SetupAnswers, probes: SetupProbes) => Promise
  * peer, a private repo, or a model that answered in prose.
  */
 export interface SetupProbes {
+  /** Finds exact checkout/GitHub facts. `{}` seeds nothing. */
+  discover(target: DiscoveryTarget): Promise<DiscoveredFacts>;
   /** Proposes a repo's pre-push gates by reading its CI. `[]` seeds nothing. */
   gates(ui: WizardUi, target: ProbeTarget): Promise<ProbedGate[]>;
   /**
@@ -758,12 +785,77 @@ export interface SetupProbes {
 
 /** Reads each repo to propose answers. */
 export const DEFAULT_PROBES: SetupProbes = {
+  discover: (target) => discoverFacts(target),
   gates: (ui, target) => probeGates(ui, target),
   prose: (ui, a) => proseFromRepos(ui, a),
 };
 
 /** `--no-ai`, and every wizard test: nothing is read, nothing is proposed. */
-export const NO_PROBES: SetupProbes = { gates: async () => [], prose: async () => ({}) };
+export const NO_PROBES: SetupProbes = {
+  discover: async () => ({}),
+  gates: async () => [],
+  prose: async () => ({}),
+};
+
+/** Exact facts replace only fresh defaults; saved operator answers always win. */
+function seedFromDiscovery(seed: SetupAnswers, found: DiscoveredFacts): SetupAnswers {
+  const labels = new Map((found.labels ?? []).map((name) => [name.toLowerCase(), name]));
+  const trackerRepo = seed.trackerRepo || found.trackerRepo || "";
+  const targetRepos =
+    seed.targetRepos.length > 0 ||
+    found.routingKey === undefined ||
+    found.cloneUrl === undefined
+      ? seed.targetRepos
+      : [
+          {
+            name: found.routingKey,
+            cloneUrl: found.cloneUrl,
+            defaultBranch: found.defaultBranch ?? SETUP_DEFAULTS.defaultBranch,
+            gates: [],
+          },
+        ];
+  return {
+    ...seed,
+    trackerRepo,
+    queueLabel: labels.get(seed.queueLabel.toLowerCase()) ?? seed.queueLabel,
+    stateLabels: {
+      inProgress: labels.get(seed.stateLabels.inProgress.toLowerCase()) ?? seed.stateLabels.inProgress,
+      blocked: labels.get(seed.stateLabels.blocked.toLowerCase()) ?? seed.stateLabels.blocked,
+      failed: labels.get(seed.stateLabels.failed.toLowerCase()) ?? seed.stateLabels.failed,
+    },
+    targetRepos,
+    policy: {
+      merge: {
+        ...seed.policy.merge,
+        requiredChecks: found.requiredChecks ?? seed.policy.merge.requiredChecks,
+      },
+      release: {
+        ...seed.policy.release,
+        artefacts: found.artefacts ?? seed.policy.release.artefacts,
+        environments: found.environments ?? seed.policy.release.environments,
+      },
+    },
+  };
+}
+
+function showDiscovery(ui: WizardUi, found: DiscoveredFacts): void {
+  if ((found.evidence?.length ?? 0) > 0) {
+    ui.notify(
+      [
+        "Discovered setup defaults:",
+        ...(found.evidence ?? []).map((line) => `  ${line}`),
+        "Every value remains editable at its prompt.",
+      ].join("\n"),
+      "info",
+    );
+  }
+  if ((found.skipped?.length ?? 0) > 0) {
+    ui.notify(
+      ["Some setup discovery was skipped; today's typed defaults remain:", ...(found.skipped ?? []).map((line) => `  ${line}`)].join("\n"),
+      "warning",
+    );
+  }
+}
 
 /**
  * The brief's two prose halves, drafted against **every** configured repo.
@@ -1047,14 +1139,14 @@ const askWorkerModel: AreaAsker = async (ui, a) => {
 
 /** The two ownership questions, then the mechanical gate one shape at a time:
  *  together they are what decides what an unattended fleet may do unasked. */
-const askAuthorityArea: AreaAsker = async (ui, a) => {
+const askAuthorityArea: AreaAsker = async (ui, a, _probes, discovered) => {
   const authority = await askAuthority(ui, a.authority);
   const releaseGrants = await askReleaseGrants(ui, a.releaseGrants);
   // Asked here because it is the same decision one layer down: the grants say
   // who may act, and these say where that permission stops. Amending authority
   // therefore re-asks the boundary, which is the point — a grant widened without
   // restating the boundary is how a delegated release loses its end.
-  const judgment = await askJudgment(ui, releaseGrants, a.judgment ?? {});
+  const judgment = await askJudgment(ui, releaseGrants, a.judgment ?? {}, discovered?.roadmaps);
   return { ...a, authority, releaseGrants, judgment };
 };
 
@@ -1117,7 +1209,7 @@ async function askTelegramTopicId(
   stateDir: string,
   prior: number | undefined,
 ): Promise<number | undefined> {
-  const claimed = readClaimedTelegramTopics(stateDir);
+  const claimed = claimedTelegramTopics(stateDir);
   const manual = "Enter thread id manually";
   const none = "None — flat chat (0.13 behaviour)";
   if (claimed.length > 0) {
@@ -1155,29 +1247,6 @@ async function askTelegramTopicId(
   return n;
 }
 
-function readClaimedTelegramTopics(stateDir: string): Array<{ threadId: number; name: string }> {
-  try {
-    const raw: unknown = JSON.parse(readFileSync(join(stateDir, "threads.json"), "utf8"));
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return [];
-    if (!("threads" in raw)) return [];
-    const threads = raw.threads;
-    if (typeof threads !== "object" || threads === null || Array.isArray(threads)) return [];
-    const out: Array<{ threadId: number; name: string }> = [];
-    for (const [id, entry] of Object.entries(threads)) {
-      const threadId = Number(id);
-      if (!Number.isFinite(threadId) || !Number.isSafeInteger(threadId)) continue;
-      let name = id;
-      if (typeof entry === "object" && entry !== null && "name" in entry) {
-        const candidate = entry.name;
-        if (typeof candidate === "string" && candidate.trim() !== "") name = candidate.trim();
-      }
-      out.push({ threadId, name });
-    }
-    return out;
-  } catch {
-    return [];
-  }
-}
 
 /** How loud the orchestrator is and when the operator permits interruptions. */
 const askReporting: AreaAsker = async (ui, a) => {
@@ -1432,12 +1501,17 @@ async function collectAnswers(
   probes: SetupProbes,
   opts: { added?: boolean } = {},
 ): Promise<SetupAnswers> {
+  // Discovery is a fresh-interview default only. Re-runs start from the saved
+  // project, so an operator-edited value is never re-guessed.
+  const discovered = prior === undefined ? await probes.discover({ cwd: process.cwd() }) : {};
+  showDiscovery(ui, discovered);
   // Added projects seed under projects/<name>/; a first install and a re-interview
   // of an existing project keep the flat (or already-on-disk) roots.
-  const seed =
+  const baseSeed =
     prior === undefined
       ? defaultAnswers(projectArg ?? "", { added: opts.added === true })
       : answersFromProject(prior);
+  const seed = prior === undefined ? seedFromDiscovery(baseSeed, discovered) : baseSeed;
 
   const projectName = await askValid(
     ui,
@@ -1462,8 +1536,8 @@ async function collectAnswers(
   // routed repo, under one root.
   a = await askGraph(ui, a, probes);
   a = await askCaps(ui, a, probes);
-  a = await askAuthorityArea(ui, a, probes);
-  a = await askPolicy(ui, a, probes);
+  a = await askAuthorityArea(ui, a, probes, discovered);
+  a = await askPolicy(ui, a, probes, discovered);
   a = await askWorkerModel(ui, a, probes);
   a = await askEscalation(ui, a, probes);
   a = await askReporting(ui, a, probes);

package/src/setup.ts

@@ -131,7 +131,14 @@ export interface SetupAnswers {
   queueLabel: string;
   stateLabels: { inProgress: string; blocked: string; failed: string };
   routingLabelPrefix: string;
-  targetRepos: { name: string; cloneUrl: string; defaultBranch: string; gates: { cmd: string; cwd: string }[] }[];
+  targetRepos: {
+    name: string;
+    cloneUrl: string;
+    defaultBranch: string;
+    gates: { cmd: string; cwd: string }[];
+    migrations?: { dir: string };
+    release?: { versionFile: string };
+  }[];
   caps: Partial<Caps>;
   /**
    * Model pattern for worker sessions, in omp's model/role syntax. Absent means
@@ -170,6 +177,13 @@ export interface SetupAnswers {
    * leave one to be defaulted by whichever reader gets there first.
    */
   policy: ProjectPolicy;
+  /**
+   * Hand-edited recovery merge authorizations carried through setup unchanged.
+   * The wizard never grants one; forgetting them during an unrelated amend
+   * would strand an in-progress recovery, while inventing one would weaken the
+   * merge provenance gate.
+   */
+  recoveryMerges?: ProjectConfig["recoveryMerges"];
   /**
    * Whether to render `ORCHESTRATOR.md` into the project's workspace root. Not
    * part of the config — the brief is the operator's file, and the conductor
@@ -702,6 +716,8 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
       ...(graphRoot === undefined || graphRoot.length === 0
         ? {}
         : { graphProject: graphProjectPath(graphRoot, r.name) }),
+      ...(r.migrations === undefined ? {} : { migrations: { ...r.migrations } }),
+      ...(r.release === undefined ? {} : { release: { ...r.release } }),
     };
   }
 
@@ -749,6 +765,9 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // Written out in full for the same reason: the file then says what a merge
     // and a release require without anyone having to know a default (#129).
     policy: clonePolicy(a.policy),
+    ...(a.recoveryMerges === undefined
+      ? {}
+      : { recoveryMerges: a.recoveryMerges.map((entry) => ({ ...entry })) }),
     // Written out even when it is the default, so an operator amending the
     // volume has a line in the file to point at. Opting into availability makes
     // the schedule explicit and daily; omitting it preserves the preset's
@@ -918,6 +937,8 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
       cloneUrl: r.cloneUrl,
       defaultBranch: r.defaultBranch,
       gates: r.gates.map((g) => ({ cmd: g.cmd, cwd: g.cwd })),
+      ...(r.migrations === undefined ? {} : { migrations: { ...r.migrations } }),
+      ...(r.release === undefined ? {} : { release: { ...r.release } }),
     })),
     caps: { ...p.caps },
     fallbackToIssueComment: p.escalation.fallbackToIssueComment,
@@ -938,6 +959,9 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
   if (p.workerModel !== undefined) answers.workerModel = p.workerModel;
   if (p.escalation.telegramChatId !== undefined) answers.telegramChatId = p.escalation.telegramChatId;
   if (p.escalation.telegramTopicId !== undefined) answers.telegramTopicId = p.escalation.telegramTopicId;
+  if (p.recoveryMerges !== undefined) {
+    answers.recoveryMerges = p.recoveryMerges.map((entry) => ({ ...entry }));
+  }
   if (p.reporting?.digest.at !== undefined) answers.dailyDigestAt = p.reporting.digest.at;
   if (p.reporting?.digest.timezone !== undefined) {
     answers.reportingTimezone = p.reporting.digest.timezone;

package/src/store.ts

@@ -864,11 +864,15 @@ export function openStore(dbPath: string): Store {
 
   const db = new Database(dbPath, { create: true });
 
+  // Set the wait before *any* pragma that may need SQLite's writer lock.
+  // journal_mode itself can return SQLITE_BUSY during another connection's
+  // close/checkpoint; setting this afterwards caused load-only CLI flakes
+  // before the schema path ever had a chance to use the timeout (#396).
+  db.exec("PRAGMA busy_timeout = 5000;");
   // WAL lets the plugin read status while the daemon is mid-write; the busy
   // timeout covers the single writer lock they still contend for.
   db.exec("PRAGMA journal_mode = WAL;");
   db.exec("PRAGMA foreign_keys = ON;");
-  db.exec("PRAGMA busy_timeout = 5000;");
   db.exec(SCHEMA);
   // #274: a terminally failed digest did not count as sent, but the old unique
   // index still blocked a replacement under the same daily key. Replace that

package/src/types.ts

@@ -125,6 +125,13 @@ export interface RepoTarget {
    * = no chain check.
    */
   migrations?: { dir: string };
+  /**
+   * Repository-native release preparation. `versionFile` is a repo-relative
+   * JSON file with a top-level string `version` (for example
+   * `omp/package.json`). A delegated tag is refused until that live value
+   * matches the requested tag; `version-bump-pr` is the mediated review path.
+   */
+  release?: { versionFile: string };
 }
 
 /**
@@ -237,6 +244,7 @@ export const DEFAULT_REPORT_POLICY: ReportingPolicy = {
  * dead config nor be asked about them by the wizard.
  */
 export const RELEASE_SHAPES = [
+  "version-bump-pr",
   "git-tag",
   "git-push-tags",
   "package-publish",
@@ -279,6 +287,7 @@ export const LEGACY_RELEASE_POLICIES = ["none", "operator-brief"] as const;
  * and `undefined !== role` is only accidentally safe.
  */
 export const DENIED_RELEASE_GRANTS: ResolvedGrants = {
+  "version-bump-pr": "human",
   "git-tag": "human",
   "git-push-tags": "human",
   "package-publish": "human",
@@ -293,6 +302,7 @@ export const DENIED_RELEASE_GRANTS: ResolvedGrants = {
  * gave — see #122.
  */
 export const OPERATOR_BRIEF_GRANTS: ResolvedGrants = {
+  "version-bump-pr": "orchestrator",
   "git-tag": "orchestrator",
   "git-push-tags": "orchestrator",
   "package-publish": "orchestrator",
@@ -492,6 +502,21 @@ export const MERGE_REASONS = [
 
 export type MergeReason = (typeof MERGE_REASONS)[number];
 
+/**
+ * A one-PR provenance exception an operator placed in config for recovery.
+ *
+ * It replaces broad standing merge authority for this exact request and lets
+ * an orchestrator present an otherwise-unrecorded PR to the ordinary merge
+ * gate, including while dispatch is held. It does not relax the normal merge
+ * checks. Exact URL, head and reason binding keeps the exception narrower
+ * than the action it authorizes (#382).
+ */
+export interface RecoveryMergeAuthorization {
+  prUrl: string;
+  headSha: string;
+  reason: Extract<MergeReason, "operator-instructed">;
+}
+
 /** Why a release is being cut now. Closed for the reason {@link MERGE_REASONS} is. */
 export const RELEASE_REASONS = [
   /** The batching unit the operator described in POLICY.md has been reached. */
@@ -622,6 +647,13 @@ export interface ProjectConfig {
    * reaching for `.merge` on a project some test hand-built.
    */
   policy?: ProjectPolicy;
+  /**
+   * Exact operator-authored exceptions for recovery PRs that no run recorded.
+   * Optional and hand-edited: setup preserves entries but never invents them.
+   * Each entry still passes routing, live-head, checks, migration-chain, and
+   * single-flight gates.
+   */
+  recoveryMerges?: RecoveryMergeAuthorization[];
   /**
    * How loud the orchestrator is, and when the daily rollup happens. Optional
    * on disk — a config written before this key existed loads as
@@ -1836,6 +1868,8 @@ export const VERB_REFUSALS = [
   "open-pr-lookup-error",
   /** The named pull request is not this run's, or not this project's. */
   "pr-not-this-run",
+  /** An unrecorded recovery PR was authorized, but not for these exact inputs. */
+  "recovery-authorization-mismatch",
   /** The run has no pull request to act on. */
   "pr-missing",
   /**