omp-conductor 0.15.9 → 0.15.11

package/src/release-policy.ts

@@ -39,6 +39,19 @@ export const RELEASE_POLICY_AUDIT_FILE = "release-policy-blocks.jsonl";
 export interface ReleaseBlockContext {
   tool: string;
   reason: string;
+  /**
+   * What the shape matcher fired on: the offending command segment for a shell
+   * call, the deciding token for a tool name. Present on every record written
+   * from #491 on, so a fixture hit is visible as one; absent only on older
+   * lines, which the digest still renders.
+   */
+  matched?: string;
+  /**
+   * The blocked shell command itself, with anything credential-shaped redacted
+   * and the whole string bounded. Only a `bash` call sets it — every other
+   * tool's redacted {@link args} already name the invocation.
+   */
+  invocation?: string;
   args: Record<string, string>;
 }
 
@@ -72,26 +85,41 @@ function stripCommandPrefix(segment: string): string {
 
 /** Recognise the explicit release/deploy command shapes this policy promises to gate. */
 export function releaseShapeFromCommand(command: string): ReleaseShape | undefined {
+  return releaseCommandMatch(command)?.shape;
+}
+
+/**
+ * Classify a shell command and the segment that fired. The segment is what a
+ * triager reads: `bun test src/foo.test.ts && npm publish` matches on its
+ * `npm publish` half, and the record says so instead of folding the whole
+ * command into the shape.
+ */
+function releaseCommandMatch(command: string): { shape: ReleaseShape; matched: string } | undefined {
   for (const raw of commandSegments(command)) {
     const segment = stripCommandPrefix(raw);
-    if (/^git(?:\s+-[Cc]\s+\S+)*\s+tag(?:\s|$)/.test(segment)) return "git-tag";
+    // Patching the running conductor is gated like a release act: `upgrade`,
+    // the detached `upgrade-install`/`upgrade-rollback` executor entries and
+    // any future spelling under the upgrade family all need the install shape,
+    // and a session without that grant is refused before the shell runs.
+    if (/^omp-conductor\s+upgrade(?:\b|$)/.test(segment)) return { shape: "install", matched: segment };
+    if (/^git(?:\s+-[Cc]\s+\S+)*\s+tag(?:\s|$)/.test(segment)) return { shape: "git-tag", matched: segment };
     if (
       /^git(?:\s+-[Cc]\s+\S+)*\s+push\b/.test(segment) &&
       GIT_PUSH_TAG_SHAPE.test(segment)
     ) {
-      return "git-push-tags";
+      return { shape: "git-push-tags", matched: segment };
     }
     if (/^(?:npm|pnpm|bun)\s+(?:publish|stage\s+publish)\b/.test(segment)) {
-      return "package-publish";
+      return { shape: "package-publish", matched: segment };
     }
-    if (/^yarn\s+npm\s+publish\b/.test(segment)) return "package-publish";
-    if (/^gh\s+release\s+create\b/.test(segment)) return "github-release";
+    if (/^yarn\s+npm\s+publish\b/.test(segment)) return { shape: "package-publish", matched: segment };
+    if (/^gh\s+release\s+create\b/.test(segment)) return { shape: "github-release", matched: segment };
     if (
       /^(?:kubectl\s+(?:apply|create|replace)|helm\s+(?:install|upgrade)|terraform\s+apply|pulumi\s+up|(?:fly|vercel|wrangler)\s+deploy|docker\s+push)\b/.test(
         segment,
       )
     ) {
-      return "deploy";
+      return { shape: "deploy", matched: segment };
     }
   }
   return undefined;
@@ -187,8 +215,11 @@ const RELEASE_ACTIONS: Record<string, true> = {
  * only asks a question — while a read verb *after* the action verb is not:
  * `DeployStackAndWatch` deploys.
  */
-function releaseShapeFromTokens(tokens: readonly string[]): ReleaseShape | undefined {
+function releaseTokenMatch(
+  tokens: readonly string[],
+): { shape: ReleaseShape; matched: string } | undefined {
   if (tokens[tokens.length - 1] === "status") return undefined;
+  let action: string | undefined;
   for (const token of tokens) {
     if (READ_VERBS[token] === true) return undefined;
     if (
@@ -196,31 +227,39 @@ function releaseShapeFromTokens(tokens: readonly string[]): ReleaseShape | undef
       RELEASE_ACTIONS[token] === true ||
       PUBLISH_ACTIONS[token] === true
     ) {
+      action = token;
       break;
     }
   }
+  if (action === undefined) return undefined;
 
   // `release` first: `PublishRelease` cuts a GitHub release, it does not publish
-  // a package, and both vocabularies claim `publish`.
+  // a package, and both vocabularies claim `publish`. `matched` names the token
+  // the shape was read off, so a name that only grazes a vocabulary shows it.
   if (
     tokens.some((t) => t === "release" || t === "releases") &&
     tokens.some((t) => RELEASE_ACTIONS[t] === true)
   ) {
-    return "github-release";
+    return { shape: "github-release", matched: "release" };
   }
-  if (tokens.some((t) => PUBLISH_ACTIONS[t] === true)) return "package-publish";
-  if (tokens.some((t) => DEPLOY_ACTIONS[t] === true)) return "deploy";
+  if (tokens.some((t) => PUBLISH_ACTIONS[t] === true)) return { shape: "package-publish", matched: action };
+  if (tokens.some((t) => DEPLOY_ACTIONS[t] === true)) return { shape: "deploy", matched: action };
   return undefined;
 }
 
-/** Release-shaped device/tool invocations that do not pass through a shell. */
-export function releaseShapeFromTool(
+/**
+ * Classify a release-shaped tool call and what matched, like
+ * {@link releaseShapeFromTool} plus the substring the shape was read off. One
+ * classifier sits behind decisions, audit records and tick prompts, so they
+ * cannot disagree about which call was blocked.
+ */
+export function releaseToolMatch(
   toolName: string,
   input: Record<string, unknown> | undefined,
-): ReleaseShape | undefined {
+): { shape: ReleaseShape; matched: string } | undefined {
   if (input === undefined) return undefined;
   if (toolName === "bash") {
-    return typeof input.command === "string" ? releaseShapeFromCommand(input.command) : undefined;
+    return typeof input.command === "string" ? releaseCommandMatch(input.command) : undefined;
   }
 
   // An MCP tool reached through the device path: the path *is* the tool name, so
@@ -228,11 +267,19 @@ export function releaseShapeFromTool(
   // `write` to `src/deploy.ts` is source code, not a deploy.
   const path = typeof input.path === "string" ? input.path : "";
   if (toolName === "write" && path.startsWith("xd://")) {
-    const viaDevice = releaseShapeFromTokens(releaseTokens(path));
+    const viaDevice = releaseTokenMatch(releaseTokens(path));
     if (viaDevice !== undefined) return viaDevice;
   }
 
-  return releaseShapeFromTokens(releaseTokens(toolName));
+  return releaseTokenMatch(releaseTokens(toolName));
+}
+
+/** Release-shaped device/tool invocations that do not pass through a shell. */
+export function releaseShapeFromTool(
+  toolName: string,
+  input: Record<string, unknown> | undefined,
+): ReleaseShape | undefined {
+  return releaseToolMatch(toolName, input)?.shape;
 }
 
 /**
@@ -272,11 +319,11 @@ export function releaseDecision(
   role: SessionRole,
   toolName: string,
   input: Record<string, unknown>,
-): { shape: ReleaseShape; decision: ReleaseDecision } | undefined {
-  const shape = releaseShapeFromTool(toolName, input);
-  if (shape === undefined) return undefined;
-  const decision = releaseRefusal(grants, role, shape);
-  return decision === undefined ? undefined : { shape, decision };
+): { shape: ReleaseShape; matched: string; decision: ReleaseDecision } | undefined {
+  const match = releaseToolMatch(toolName, input);
+  if (match === undefined) return undefined;
+  const decision = releaseRefusal(grants, role, match.shape);
+  return decision === undefined ? undefined : { shape: match.shape, matched: match.matched, decision };
 }
 
 const RELEASE_ARG_ALLOWLIST = new Set([
@@ -305,6 +352,64 @@ export function redactReleaseArgs(input: Record<string, unknown>): Record<string
   return redacted;
 }
 
+/** Credential-shaped text a blocked invocation must not carry into the audit
+ *  file, each with the replacement that takes its place. */
+const CREDENTIAL_PATTERNS: Array<readonly [RegExp, string]> = [
+  // Armoured private keys, in full so a key cannot survive as its own body.
+  [/-----BEGIN [A-Z0-9 ]+PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]+PRIVATE KEY-----/g, "[redacted]"],
+  // GitHub classic and fine-grained PATs.
+  [/gh[pousr]_[A-Za-z0-9]{20,}/g, "[redacted]"],
+  [/github_pat_[A-Za-z0-9_]{20,}/g, "[redacted]"],
+  // Slack tokens.
+  [/xox[baprs]-[A-Za-z0-9-]{10,}/g, "[redacted]"],
+  // AWS access key ids. The secret half is caught by the long-run rule below.
+  [/AKIA[0-9A-Z]{16}/g, "[redacted]"],
+  // OpenAI-style `sk-` secrets.
+  [/sk-[A-Za-z0-9]{16,}/g, "[redacted]"],
+  // `--token x`, `--password=x` and friends. The token word must end at the
+  // separator, so `--author` stays a git flag rather than dying as a
+  // credential. The flag name survives so the record says what kind of
+  // credential rode on the call; only its value is replaced.
+  [
+    /--([a-z0-9-]*(?:token|secret|password|passwd|api-?key|auth(?:orization)?))(?=[\s=])(?:\s+|=)\S+/gi,
+    "--$1 [redacted]",
+  ],
+  // `TOKEN=…`, `NPM_CONFIG_TOKEN=…` style assignments.
+  [/[A-Z][A-Z0-9_]*(?:TOKEN|PASSWORD|PASSWD|SECRET|API_?KEY|CREDENTIAL)[A-Z0-9_]*=\S+/g, "[redacted]"],
+  // `Bearer …` / `Basic …` header values.
+  [/\b(?:Bearer|Basic)\s+\S+/g, "[redacted]"],
+  // Long unbroken runs are token-shaped whatever scheme they belong to. A
+  // commit sha is a stranger in a blocked command worth keeping; a leaked
+  // token is not worth the triage convenience.
+  [/[A-Za-z0-9_-]{32,}/g, "[redacted]"],
+];
+
+/** The bound a recorded invocation is cut to. Long enough to read a heredoc,
+ *  short enough that a fixture dump cannot bloat the audit file. */
+const RELEASE_INVOCATION_MAX = 400;
+
+/** Redact anything credential-shaped in a blocked command, then bound its
+ *  length. Redaction runs before truncation so a cut cannot leak a token
+ *  fragment past its own pattern. */
+export function redactReleaseCommand(command: string): string {
+  let safe = command;
+  for (const [pattern, replacement] of CREDENTIAL_PATTERNS) {
+    safe = safe.replace(pattern, replacement);
+  }
+  return safe.length <= RELEASE_INVOCATION_MAX ? safe : `${safe.slice(0, RELEASE_INVOCATION_MAX)}…`;
+}
+
+/** The invocation a block records: the shell command for a `bash` call, and
+ *  nothing for other tools — their redacted args already name the call. */
+export function releaseBlockedInvocation(
+  toolName: string,
+  input: Record<string, unknown>,
+): string | undefined {
+  return toolName === "bash" && typeof input.command === "string"
+    ? redactReleaseCommand(input.command)
+    : undefined;
+}
+
 interface ReleasePolicyPi {
   on(
     event: "tool_call",
@@ -326,9 +431,12 @@ export function releasePolicyTripwire(
       const blocked = releaseDecision(grants, role, event.toolName, event.input);
       if (blocked === undefined) return undefined;
       try {
+        const invocation = releaseBlockedInvocation(event.toolName, event.input);
         onBlocked(blocked.shape, {
           tool: event.toolName,
           reason: blocked.decision.reason,
+          matched: blocked.matched,
+          ...(invocation === undefined ? {} : { invocation }),
           args: redactReleaseArgs(event.input),
         });
       } catch {
@@ -350,13 +458,15 @@ export function recordReleaseBlock(
   mkdirSync(root, { recursive: true });
   // Redact again at the durable boundary. Callers normally pass the tripwire's
   // already-safe context, but no alternate recorder path gets to rely on that.
-  const { args, ...attribution } = details;
+  const { args, invocation, matched, ...attribution } = details;
   const record: ReleaseBlock = {
     project,
     source,
     shape,
     ...attribution,
     ...(args === undefined ? {} : { args: redactReleaseArgs(args) }),
+    ...(invocation === undefined ? {} : { invocation: redactReleaseCommand(invocation) }),
+    ...(matched === undefined ? {} : { matched: redactReleaseCommand(matched) }),
     at: now.toISOString(),
   };
   appendFileSync(join(root, RELEASE_POLICY_AUDIT_FILE), `${JSON.stringify(record)}\n`, { mode: 0o600 });
@@ -416,6 +526,8 @@ export function releaseDriftDigestLine(
     ...(latest.issue === undefined ? [] : [`issue #${latest.issue}`]),
     ...(latest.runId === undefined ? [] : [`run ${latest.runId}`]),
     ...(latest.tool === undefined ? [] : [`tool ${latest.tool}`]),
+    ...(latest.invocation === undefined ? [] : [`attempted "${latest.invocation}"`]),
+    ...(latest.matched === undefined ? [] : [`matched "${latest.matched}"`]),
   ].join(", ");
   return (
     `Release-policy drift today: ${drift.count} release/deploy tool call(s) were blocked ` +

package/src/reports.ts

@@ -219,15 +219,22 @@ export function formatOpenReports(
 
 /** Durable rows still owed to a future digest. Always rendered in `status`: a
  * quiet line proves the accumulator is empty, while a non-zero line makes loss
- * or backlog visible without asking the session what it remembers. */
+ * or backlog visible without asking the session what it remembers. Held
+ * notices are split by what releases them: `releaseOnAvailable` rows are
+ * interrupt-worthy notices waiting only for the operator's working window,
+ * everything else is ordinary digest-bound backlog. One noun for both was how
+ * a routine material backlog read as stranded escalations (#492). */
 export function formatDigestBacklog(backlog: DigestBacklog, now: number = Date.now()): string[] {
   const age = (at: number | undefined): string =>
     at === undefined ? "" : ` (oldest ${humanAge(Math.max(0, now - at))})`;
+  const heldForAvailability = backlog.availabilityHeldNoticeCount ?? 0;
+  const heldForDigest = Math.max(0, backlog.heldNoticeCount - heldForAvailability);
   return [
     "",
     "digest backlog",
-    `  material events    ${backlog.materialCount}${age(backlog.materialOldestAt)}`,
-    `  held escalations   ${backlog.heldNoticeCount}${age(backlog.heldNoticeOldestAt)}`,
+    `  material events         ${backlog.materialCount}${age(backlog.materialOldestAt)}`,
+    `  held for digest         ${heldForDigest}${age(backlog.digestHeldNoticeOldestAt ?? backlog.heldNoticeOldestAt)}`,
+    `  held for availability   ${heldForAvailability}${age(backlog.availabilityHeldNoticeOldestAt)}`,
   ];
 }
 
@@ -315,9 +322,16 @@ export function operatorMessageCategory(text: string): InterruptCategory {
 export async function deliverOperatorMessage(
   project: ProjectConfig,
   text: string,
-  deps: { store: Store; at: number; noticeId: string; send?: ReportSend },
+  deps: {
+    store: Store;
+    at: number;
+    noticeId: string;
+    send?: ReportSend;
+    /** Declared escalation category; overrides the `QUESTION:`-prefix read. */
+    category?: InterruptCategory;
+  },
 ): Promise<OperatorMessageOutcome> {
-  const category = operatorMessageCategory(text);
+  const category = deps.category ?? operatorMessageCategory(text);
   const disposition = interruptDisposition(project.reporting, category, deps.at);
   if (disposition !== "interrupt") {
     deps.store.addHeldNotice({