omp-conductor 0.15.9 → 0.15.10

package/README.md

@@ -1499,8 +1499,9 @@ orchestrator floor now says to name **neither** target or **both**, and the
 dispatcher refuses `chat_id` without `thread_id` for a project that configured
 `escalation.telegramTopicId`. A flat-chat project is unaffected. When a pinned
 topic id has gone stale — the bridge re-claims pane topics across restarts — the
-live claim named for the project is used instead, so a restart does not quietly
-move every page into the main chat (#407).
+live claim for the project's herdr space is used instead, falling back to a
+claim titled for the project, so a restart does not quietly move every page into
+the main chat (#407, #412).
 
 A locally injected tick has no inbound message to inherit a topic from, so a
 bare `telegram_send` there has nothing to preserve. That turn addresses the
@@ -1927,7 +1928,7 @@ Field notes:
 | `migrations` | Optional, per repo: `{ "dir": "backend/alembic/versions" }`. Names the repo-relative directory of an Alembic-style ordered migration chain (`revision` / `down_revision` in `*.py`). When set, `conductor_pr_merge` **refuses** a merge that would corrupt the chain at the base tip: reusing a revision id another file already declares, deleting a published migration, or a merge that would leave the combined graph with more than one head (so a stale parent is refused, and a fork-repair merge migration that unifies the heads passes). Absent means the repo opts out of the chain check entirely. Repo-relative only: a leading `/` or `..` is an error. |
 | `caps` | Per-project overrides; omit it or pin only the fields you want to change. |
 | `escalation.fallbackToIssueComment` | Defaults to `true`. Absent means "yes, still tell me". |
-| `escalation.telegramTopicId` | Optional forum topic for everything conductor sends: tier-2 pages, reports, digests, arm challenges, `omp-conductor message`. Setup offers the topics omp-telegram has claimed. The bridge re-claims a pane's topic across restarts — including the restarts `upgrade` and `restart` perform — so a pinned id that is no longer claimed is replaced at send time by the live claim whose name matches the project, logged without ids (#407). A pin that is still claimed always wins, so a deliberately separate topic is never hijacked. Absent keeps flat-chat behaviour. |
+| `escalation.telegramTopicId` | Optional forum topic for everything conductor sends: tier-2 pages, reports, digests, arm challenges, `omp-conductor message`. Setup offers the topics omp-telegram has claimed, naming each one's herdr space. The bridge re-claims a pane's topic across restarts — including the restarts `upgrade` and `restart` perform — so a pinned id that is no longer claimed is replaced at send time by the live claim whose **herdr space** is this project, falling back to one titled for the project, logged without ids (#407, #412). The space is read first because the bridge titles a topic `ownAgentName ?? basename(cwd)`, and a multi-project host whose panes sit under one state directory gives every claim the same title. An identity two claims share is treated as no match at all rather than a guess. A pin that is still claimed always wins, so a deliberately separate topic is never hijacked. Absent keeps flat-chat behaviour. |
 | `escalation.orchestrator` | Optional; `"embedded"` (default) or `"external"`. `external` means an orchestrator session already runs elsewhere: the daemon starts none, and tier-1 escalations post as issue comments for that session to drain. Any other value is an error. |
 | `authority` | Optional; `{ "merge": …, "release": … }`, each `"human"` (default) or `"orchestrator"`. It grants nothing to the daemon — it words the orchestrator's standing orders and the Releases paragraph of the rendered brief, so the config and the prompt cannot disagree about who holds the merge button. Unknown keys and any other value are errors, never folded to the default. |
 | `releasePolicy` | Optional; a per-shape map whose values are `"human"` (default) or `"orchestrator"`. Shapes are `version-bump-pr`, `git-tag`, `git-push-tags`, `package-publish`, `github-release`, and `deploy`. The legacy `"none"` denies every shape; legacy `"operator-brief"` grants the artifact-producing shapes, including reviewed version preparation, but keeps deploy human-owned. The in-session tripwire blocks recognised raw release/deploy calls before execution. Every rejection is written to `release-policy-blocks.jsonl`; the heartbeat carries that day's count into the daily digest. This is the mechanical gate; `authority.release` still says who owns the decision. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.15.9",
+  "version": "0.15.10",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/escalate.ts

@@ -350,6 +350,15 @@ export function readTelegramToken(): string | undefined {
   return undefined;
 }
 
+/** One live omp-telegram topic claim, as much of it as conductor reads. */
+export interface ClaimedTopic {
+  threadId: number;
+  /** The bridge's own title for the claim. */
+  name: string;
+  /** The herdr space the claiming pane sits in, when the bridge captured one. */
+  workspaceLabel?: string;
+}
+
 /**
  * The forum topic a project's Telegram actually lives in *now*.
  *
@@ -362,12 +371,19 @@ export function readTelegramToken(): string | undefined {
  *
  * The operator's pin still wins whenever it is live. Only a pin that is
  * *provably* absent from the current claims is replaced, and only by the claim
- * whose name is this project's — so a deliberately separate alerts topic is
- * never hijacked by the pane's own thread. Unreadable bridge state changes
+ * this project can be identified with — so a deliberately separate alerts topic
+ * is never hijacked by the pane's own thread. Unreadable bridge state changes
  * nothing, and #318's stale-topic retry remains the last line of defence.
  *
- * The substitution is logged, naming the project and the claim's name. Never an
- * id: a log line is a place these leak from.
+ * Identity is read from the herdr space first, and only then from the claim's
+ * title. The bridge titles a topic `ownAgentName ?? basename(cwd)`, and both
+ * halves of that fall down on a real multi-project host: the agent-name lookup
+ * is best-effort, and a fleet whose panes live under one state directory gives
+ * every pane the same basename. `workspaceLabel` is the herdr space, which is
+ * one-to-one with the project, so it is the identity that survives a re-claim.
+ *
+ * The substitution is logged, naming the project and which identity answered.
+ * Never an id: a log line is a place these leak from.
  */
 export function resolveProjectTopicId(project: ProjectConfig): number | undefined {
   const pinned = project.escalation.telegramTopicId;
@@ -375,24 +391,42 @@ export function resolveProjectTopicId(project: ProjectConfig): number | undefine
   const claims = claimedTelegramTopics();
   if (claims.length === 0) return pinned;
   if (claims.some((claim) => claim.threadId === pinned)) return pinned;
-  const named = claims.find((claim) => claim.name === project.name);
-  if (named === undefined) return pinned;
+  const bySpace = soleClaim(claims, (claim) => claim.workspaceLabel === project.name);
+  const match = bySpace ?? soleClaim(claims, (claim) => claim.name === project.name);
+  if (match === undefined) return pinned;
   warn(
     `escalation.telegramTopicId for ${project.name} is no longer a claimed topic; ` +
-      `following omp-telegram's current "${named.name}" claim instead`,
+      `following omp-telegram's current "${project.name}" ` +
+      `${bySpace === undefined ? "claim" : "herdr space claim"} instead`,
   );
-  return named.threadId;
+  return match.threadId;
+}
+
+/**
+ * The one claim answering to `predicate`, or nothing when none or several do.
+ *
+ * Ambiguity is not a coin toss: two claims wearing the same identity means the
+ * bridge cannot say which pane belongs to this project, and paging the wrong
+ * project's topic is worse than the flat-chat degrade #318 already handles.
+ */
+function soleClaim(
+  claims: readonly ClaimedTopic[],
+  predicate: (claim: ClaimedTopic) => boolean,
+): ClaimedTopic | undefined {
+  const hits = claims.filter(predicate);
+  return hits.length === 1 ? hits[0] : undefined;
 }
 
 /**
- * omp-telegram's live topic claims: `{ threads: { "<threadId>": { name } } }`.
- * Borrowed exactly as the token is, and tolerant of every shape it might not
- * be — a bridge that has never run a forum pane has no file at all.
+ * omp-telegram's live topic claims, from
+ * `{ threads: { "<threadId>": { name, workspaceLabel } } }`. Borrowed exactly as
+ * the token is, and tolerant of every shape it might not be — a bridge that has
+ * never run a forum pane has no file at all.
  *
  * `stateDir` is passed by the setup wizard, which has already probed for the
  * bridge; send-time callers let it resolve the same way the token does.
  */
-export function claimedTelegramTopics(stateDir?: string): Array<{ threadId: number; name: string }> {
+export function claimedTelegramTopics(stateDir?: string): ClaimedTopic[] {
   const override = stateDir?.trim() ?? process.env.OMP_TELEGRAM_STATE_DIR?.trim();
   const dir = override ? override : join(homedir(), ".omp", "agent", "telegram");
   let raw: unknown;
@@ -404,16 +438,23 @@ export function claimedTelegramTopics(stateDir?: string): Array<{ threadId: numb
   if (typeof raw !== "object" || raw === null || Array.isArray(raw) || !("threads" in raw)) return [];
   const threads = raw.threads;
   if (typeof threads !== "object" || threads === null || Array.isArray(threads)) return [];
-  const out: Array<{ threadId: number; name: string }> = [];
+  const out: ClaimedTopic[] = [];
   for (const [id, entry] of Object.entries(threads)) {
     const threadId = Number(id);
     if (!Number.isFinite(threadId) || !Number.isSafeInteger(threadId)) continue;
     let name = id;
-    if (typeof entry === "object" && entry !== null && "name" in entry) {
-      const candidate = entry.name;
-      if (typeof candidate === "string" && candidate.trim() !== "") name = candidate.trim();
+    let workspaceLabel: string | undefined;
+    if (typeof entry === "object" && entry !== null) {
+      if ("name" in entry) {
+        const candidate = entry.name;
+        if (typeof candidate === "string" && candidate.trim() !== "") name = candidate.trim();
+      }
+      if ("workspaceLabel" in entry) {
+        const candidate = entry.workspaceLabel;
+        if (typeof candidate === "string" && candidate.trim() !== "") workspaceLabel = candidate.trim();
+      }
     }
-    out.push({ threadId, name });
+    out.push(workspaceLabel === undefined ? { threadId, name } : { threadId, name, workspaceLabel });
   }
   return out;
 }

package/src/setup-wizard.ts

@@ -1216,7 +1216,12 @@ async function askTelegramTopicId(
     const options = [
       ...claimed.map((t) => ({
         label: `${t.name} — ${t.threadId}`,
-        description: `message_thread_id ${t.threadId}`,
+        // Two panes under one state directory claim the same title, so the
+        // herdr space is the only thing that tells the operator which is which.
+        description:
+          t.workspaceLabel === undefined || t.workspaceLabel === t.name
+            ? `message_thread_id ${t.threadId}`
+            : `herdr space ${t.workspaceLabel} · message_thread_id ${t.threadId}`,
       })),
       { label: manual, description: "type a numeric forum topic id" },
       { label: none, description: "send to the chat root, not a topic" },