omp-conductor 0.17.1 → 0.18.1

package/src/gitops.ts

@@ -17,7 +17,8 @@
  * branch cannot disagree.
  */
 
-import { existsSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { parseChainSource, type ChainEntry } from "./chain-check.ts";
@@ -75,6 +76,98 @@ export function credentialedEnv(
   return { ...env, ...extra };
 }
 
+/**
+ * The exact per-run dubious-ownership exemption for a daemon git call against
+ * a worker-owned run repository (#816).
+ *
+ * Every daemon-side invocation whose cwd (or opening) is the run repository
+ * carries the run's own path as a command-line `-c safe.directory=<path>` —
+ * never a wildcard, and never an entry in the daemon's global config, which
+ * would grow one line per run forever. Git 2.35+ refuses to open a repository
+ * owned by another uid ("dubious ownership"); the run repository was handed
+ * to the worker identity at dispatch, so the daemon's own `rev-parse`,
+ * salvage, lane probe and cleanup calls are exactly that shape.
+ */
+export function runRepoSafeDirectoryExemption(runRepoPath: string): [string, string] {
+  return ["-c", `safe.directory=${runRepoPath}`];
+}
+
+/**
+ * A daemon-owned, per-call global git config granting the *source-side*
+ * ownership exemption for a local-path fetch out of one worker-owned run
+ * repository.
+ *
+ * `git fetch <runRepo>` from the mirror is the one daemon git call whose
+ * *source* is worker-owned, and the one shape command-line config cannot
+ * reach: git spawns `upload-pack` against the source — `.git` dubious-ownership
+ * check included — and that subprocess sees none of the destination process's
+ * `-c` options. The only real config file the subprocess reads that this side
+ * controls is the global one, so the run's exemption is materialised there,
+ * for exactly this call: a temp file (0700, daemon's own) naming precisely the
+ * run's repo path and its gitdir, never a wildcard, with the daemon's existing
+ * global config replayed through `include.path` so nothing else about the
+ * caller's git behavior changes. The file is removed when the call is done.
+ */
+export interface ScopedSafeDirectory {
+  /** The env additions for one git call; the caller's own use of it is what
+   *  scopes the exemption to that call. */
+  env: Record<string, string>;
+  /** Remove the daemon-owned temp file. The call must not outlive it. */
+  close: () => void;
+}
+
+/** A config value: git's quoting accepts C escapes in double quotes. */
+function quoteGitConfigValue(value: string): string {
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+
+export function scopedSafeDirectoryEnv(...runRepos: readonly string[]): ScopedSafeDirectory {
+  const dir = mkdtempSync(join(tmpdir(), "omp-conductor-safe-"));
+  try {
+    // The global-config chain the daemon normally reads, replayed: setting
+    // GIT_CONFIG_GLOBAL would otherwise replace those files rather than
+    // augmenting them, dropping e.g. credential helpers and `insteadOf` rules
+    // for the duration of this one call.
+    const globals: string[] = [];
+    const globalOverride = process.env["GIT_CONFIG_GLOBAL"];
+    if (globalOverride !== undefined && globalOverride !== "") {
+      globals.push(globalOverride);
+    } else {
+      const xdgHome = process.env["XDG_CONFIG_HOME"];
+      const xdgConfig = xdgHome === undefined || xdgHome === ""
+        ? join(homedir(), ".config", "git", "config")
+        : join(xdgHome, "git", "config");
+      if (existsSync(xdgConfig)) globals.push(xdgConfig);
+      const home = homedir();
+      if (home !== "") {
+        const gitconfig = join(home, ".gitconfig");
+        if (existsSync(gitconfig)) globals.push(gitconfig);
+      }
+    }
+    const lines = [
+      ...globals.flatMap((file) => ["[include]", `\tpath = ${quoteGitConfigValue(file)}`]),
+      "[safe]",
+      // Both spellings git actually checks (2.43 and later use the gitdir
+      // path for a local-path source; a direct open names the worktree path).
+      // Both are exact, never a wildcard.
+      ...runRepos.flatMap((repo) => [
+        `\tdirectory = ${quoteGitConfigValue(repo)}`,
+        `\tdirectory = ${quoteGitConfigValue(join(repo, ".git"))}`,
+      ]),
+      "",
+    ];
+    const file = join(dir, "gitconfig");
+    writeFileSync(file, lines.join("\n"));
+    return {
+      env: { ...credentialedEnv(), GIT_CONFIG_GLOBAL: file },
+      close: () => rmSync(dir, { recursive: true, force: true }),
+    };
+  } catch (err) {
+    rmSync(dir, { recursive: true, force: true });
+    throw err;
+  }
+}
+
 // ------------------------------------------------- the privileged publish path
 
 /** One run's own repository, as the daemon addresses it. */
@@ -163,7 +256,11 @@ export async function probeRunLane(
     for (const line of stdout.split("\n")) add(line.trim(), source);
   };
   if (input.worktree !== "") {
-    const status = await exec(["git", "-C", input.worktree, "status", "--porcelain"], {});
+    // The live run's worktree is owned by the worker identity (#798), so
+    // every daemon-side read of it carries the exact per-run exemption — no
+    // wildcard, no global safe.directory (#816).
+    const exemption = runRepoSafeDirectoryExemption(input.worktree);
+    const status = await exec(["git", ...exemption, "-C", input.worktree, "status", "--porcelain"], {});
     if (status.code === 0) {
       const { untracked, tracked } = parsePorcelain(status.stdout);
       // Untracked files are authored by construction: a merge stages the files
@@ -183,12 +280,12 @@ export async function probeRunLane(
         // resolution. An unreadable divergence read fails open — no tracked
         // occupancy is claimed while the merge makes the read ambiguous.
         const merge = await exec(
-          ["git", "-C", input.worktree, "rev-parse", "-q", "--verify", "MERGE_HEAD"],
+          ["git", ...exemption, "-C", input.worktree, "rev-parse", "-q", "--verify", "MERGE_HEAD"],
           {},
         );
         if (merge.code === 0) {
           const diverged = await exec(
-            ["git", "-C", input.worktree, "diff", "--name-only", input.baseRef],
+            ["git", ...exemption, "-C", input.worktree, "diff", "--name-only", input.baseRef],
             {},
           );
           if (diverged.code === 0) {
@@ -203,7 +300,7 @@ export async function probeRunLane(
       }
     }
     const diff = await exec(
-      ["git", "-C", input.worktree, "diff", "--name-only", `${input.baseRef}...HEAD`],
+      ["git", ...exemption, "-C", input.worktree, "diff", "--name-only", `${input.baseRef}...HEAD`],
       {},
     );
     if (diff.code === 0) addDiff(diff.stdout, "branch");
@@ -311,91 +408,101 @@ export async function pushRunBranch(
   const ref = `refs/heads/${run.branch}`;
   const tracked = `refs/remotes/origin/${run.branch}`;
   const env = credentialedEnv();
+  // The run repository is worker-owned (#798): the direct read below carries
+  // the exact-path exemption on the command line, and the local-path fetch's
+  // source (upload-pack) needs it as a scoped global config for the one call
+  // (#816). Both are exact per-run entries, never a wildcard, and the scoped
+  // file dies with the call.
+  const scoped = scopedSafeDirectoryEnv(run.runRepoPath);
 
-  // Copy the run's branch into the mirror, fast-forward only.
-  const fetched = await exec(["git", "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `${ref}:${ref}`], { env });
+  try {
+    // Copy the run's branch into the mirror, fast-forward only.
+    const fetched = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `${ref}:${ref}`], { env: scoped.env });
+
+    // The proposed head is read from the run repo itself: when the copy above
+    // was refused, the mirror's copy of the branch is exactly the stale one.
+    const proposedRun = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", run.runRepoPath, "rev-parse", ref], { env: scoped.env });
+    if (proposedRun.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(proposedRun.stderr.trim() || `git rev-parse ${ref} exited ${String(proposedRun.code)}`) };
+    }
+    const proposed = proposedRun.stdout.trim();
+
+    // Reconcile with the live remote before enforcing anything: the ancestry
+    // that decides a fast-forward is the live remote's, not the mirror's copy's
+    // (see the docstring above). ls-remote answers "is the branch published at
+    // all" and "what does GitHub hold" in one call.
+    const liveListed = await exec(["git", "-C", mirror, "ls-remote", "origin", ref], { env });
+    if (liveListed.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(liveListed.stderr.trim() || `git ls-remote origin ${ref} exited ${String(liveListed.code)}`) };
+    }
+    const live = liveListed.stdout
+      .split("\n")
+      .map((line) => line.trimEnd())
+      .find((line) => line.endsWith(`\t${ref}`))
+      ?.split(/\s+/, 1)[0];
+
+    if (live !== undefined && live !== proposed) {
+      // The branch is published and the run proposes something different. Pull
+      // the live branch's history into the mirror once (which also keeps the
+      // tracked ref a reattach reads fresh), then prove the fast-forward.
+      const reconciled = await exec(["git", "-C", mirror, "fetch", "--no-tags", "origin", `+${ref}:${tracked}`], { env });
+      if (reconciled.code !== 0) {
+        return { ok: false, stderr: scrubUserinfo(reconciled.stderr.trim() || reconciled.stdout.trim() || `git fetch origin exited ${String(reconciled.code)}`) };
+      }
 
-  // The proposed head is read from the run repo itself: when the copy above
-  // was refused, the mirror's copy of the branch is exactly the stale one.
-  const proposedRun = await exec(["git", "-C", run.runRepoPath, "rev-parse", ref], { env });
-  if (proposedRun.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(proposedRun.stderr.trim() || `git rev-parse ${ref} exited ${String(proposedRun.code)}`) };
-  }
-  const proposed = proposedRun.stdout.trim();
-
-  // Reconcile with the live remote before enforcing anything: the ancestry
-  // that decides a fast-forward is the live remote's, not the mirror's copy's
-  // (see the docstring above). ls-remote answers "is the branch published at
-  // all" and "what does GitHub hold" in one call.
-  const liveListed = await exec(["git", "-C", mirror, "ls-remote", "origin", ref], { env });
-  if (liveListed.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(liveListed.stderr.trim() || `git ls-remote origin ${ref} exited ${String(liveListed.code)}`) };
-  }
-  const live = liveListed.stdout
-    .split("\n")
-    .map((line) => line.trimEnd())
-    .find((line) => line.endsWith(`\t${ref}`))
-    ?.split(/\s+/, 1)[0];
-
-  if (live !== undefined && live !== proposed) {
-    // The branch is published and the run proposes something different. Pull
-    // the live branch's history into the mirror once (which also keeps the
-    // tracked ref a reattach reads fresh), then prove the fast-forward.
-    const reconciled = await exec(["git", "-C", mirror, "fetch", "--no-tags", "origin", `+${ref}:${tracked}`], { env });
-    if (reconciled.code !== 0) {
-      return { ok: false, stderr: scrubUserinfo(reconciled.stderr.trim() || reconciled.stdout.trim() || `git fetch origin exited ${String(reconciled.code)}`) };
+      const isAncestor = await exec(["git", "-C", mirror, "merge-base", "--is-ancestor", live, proposed], { env });
+      if (isAncestor.code === 128) {
+        // git could not perform the check at all (an object it was asked to
+        // resolve is missing, not merely unrelated). That is a failed
+        // verification, not a divergence verdict: refuse with git's own words,
+        // still naming both SHAs so the report carries the mismatch.
+        return {
+          ok: false,
+          stderr: scrubUserinfo(
+            isAncestor.stderr.trim() ||
+              isAncestor.stdout.trim() ||
+              `git merge-base --is-ancestor ${live} ${proposed} exited ${String(isAncestor.code)}`,
+          ),
+        };
+      }
+      if (isAncestor.code !== 0) {
+        // A real divergence: no fast-forward exists, and the mirror is left
+        // exactly where it was. Both SHAs are named so the mismatch is
+        // diagnosable instead of a bare "non-fast-forward".
+        return {
+          ok: false,
+          stderr:
+            `refusing non-fast-forward push of ${run.branch}: the live remote tip ${live} is not an ancestor of ` +
+            `the proposed head ${proposed}. Fetch the live branch and rebase or merge it before pushing again.`,
+        };
+      }
     }
 
-    const isAncestor = await exec(["git", "-C", mirror, "merge-base", "--is-ancestor", live, proposed], { env });
-    if (isAncestor.code === 128) {
-      // git could not perform the check at all (an object it was asked to
-      // resolve is missing, not merely unrelated). That is a failed
-      // verification, not a divergence verdict: refuse with git's own words,
-      // still naming both SHAs so the report carries the mismatch.
-      return {
-        ok: false,
-        stderr: scrubUserinfo(
-          isAncestor.stderr.trim() ||
-            isAncestor.stdout.trim() ||
-            `git merge-base --is-ancestor ${live} ${proposed} exited ${String(isAncestor.code)}`,
-        ),
-      };
+    if (fetched.code !== 0 && live === undefined) {
+      // The mirror refused the plain copy and there is no published branch to
+      // validate the run's head against: a rewritten branch that was never
+      // published must not rewrite the mirror either. Refuse with git's words.
+      return { ok: false, stderr: scrubUserinfo(fetched.stderr.trim() || fetched.stdout.trim() || `git fetch exited ${String(fetched.code)}`) };
     }
-    if (isAncestor.code !== 0) {
-      // A real divergence: no fast-forward exists, and the mirror is left
-      // exactly where it was. Both SHAs are named so the mismatch is
-      // diagnosable instead of a bare "non-fast-forward".
-      return {
-        ok: false,
-        stderr:
-          `refusing non-fast-forward push of ${run.branch}: the live remote tip ${live} is not an ancestor of ` +
-          `the proposed head ${proposed}. Fetch the live branch and rebase or merge it before pushing again.`,
-      };
+    if (fetched.code !== 0) {
+      // The proposed head is a legitimate fast-forward over the live remote (it
+      // equals the live head or the ancestor test above passed), so the only
+      // thing the plain copy refused on was the mirror's own stale copy.
+      // Refresh it; the push below still re-checks against the live remote.
+      const refreshed = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `+${ref}:${ref}`], { env: scoped.env });
+      if (refreshed.code !== 0) {
+        return { ok: false, stderr: scrubUserinfo(refreshed.stderr.trim() || refreshed.stdout.trim() || `git fetch exited ${String(refreshed.code)}`) };
+      }
     }
-  }
 
-  if (fetched.code !== 0 && live === undefined) {
-    // The mirror refused the plain copy and there is no published branch to
-    // validate the run's head against: a rewritten branch that was never
-    // published must not rewrite the mirror either. Refuse with git's words.
-    return { ok: false, stderr: scrubUserinfo(fetched.stderr.trim() || fetched.stdout.trim() || `git fetch exited ${String(fetched.code)}`) };
-  }
-  if (fetched.code !== 0) {
-    // The proposed head is a legitimate fast-forward over the live remote (it
-    // equals the live head or the ancestor test above passed), so the only
-    // thing the plain copy refused on was the mirror's own stale copy.
-    // Refresh it; the push below still re-checks against the live remote.
-    const refreshed = await exec(["git", "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `+${ref}:${ref}`], { env });
-    if (refreshed.code !== 0) {
-      return { ok: false, stderr: scrubUserinfo(refreshed.stderr.trim() || refreshed.stdout.trim() || `git fetch exited ${String(refreshed.code)}`) };
+    const pushed = await exec(["git", "-C", mirror, "push", "origin", `${ref}:${ref}`], { env });
+    if (pushed.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(pushed.stderr.trim() || pushed.stdout.trim() || `git push exited ${String(pushed.code)}`) };
     }
+    return { ok: true, sha: proposed };
+  } finally {
+    scoped.close();
   }
-
-  const pushed = await exec(["git", "-C", mirror, "push", "origin", `${ref}:${ref}`], { env });
-  if (pushed.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(pushed.stderr.trim() || pushed.stdout.trim() || `git push exited ${String(pushed.code)}`) };
-  }
-  return { ok: true, sha: proposed };
 }
 
 /**

package/src/graph-health.ts

@@ -1,12 +1,21 @@
 import { existsSync } from "node:fs";
-import { graphRepos, REINDEX_UNIT, resolvePrereqs, type GraphPrereqs } from "./graph.ts";
+import { graphRepos, reindexUnitName, resolvePrereqs, type GraphPrereqs } from "./graph.ts";
 import type { ProjectConfig } from "./types.ts";
 
 export const GRAPH_PROBE_TIMEOUT_MS = 1_000;
 export const GRAPH_FRESHNESS_MS = 45 * 60_000;
 
+/** Existence findings: the check observed the host (PATH, a directory, an index). */
 type CheckState = "present" | "missing" | "unknown";
 
+/**
+ * The MCP-mount finding. Its only evidence is the agent's `mcp.json` on disk,
+ * never a live session, so it speaks of configuration rather than presence — a
+ * runtime observation of the mounted toolset must be a *different* state, not
+ * this one relabelled (#738).
+ */
+type McpMountState = "configured" | "unconfigured" | "unknown";
+
 export interface CodeGraphRepoHealth {
   name: string;
   path: string;
@@ -22,7 +31,20 @@ export type CodeGraphHealth =
       checkedAt: string;
       prerequisites: {
         indexer: CheckState;
-        mcpMount: CheckState;
+        mcpMount: McpMountState;
+      };
+      /**
+       * Session-recorded graph-tools observations over this project's runs
+       * (#726): what dispatched sessions' registries actually held at start.
+       * `recorded: 0` means no run has ever recorded the fact — "observed" is
+       * never claimed without one, which is the whole honesty contract of the
+       * state. This is the runtime counterpart to `prerequisites.mcpMount`,
+       * which is deliberately a *config* finding.
+       */
+      session: {
+        recorded: number;
+        present: number;
+        absent: number;
       };
       repos: CodeGraphRepoHealth[];
       timer: {
@@ -52,6 +74,7 @@ export function pendingCodeGraph(project: ProjectConfig, now = Date.now()): Code
     status: "unknown",
     checkedAt: new Date(now).toISOString(),
     prerequisites: { indexer: "unknown", mcpMount: "unknown" },
+    session: { recorded: 0, present: 0, absent: 0 },
     repos: repos.map((repo) => ({
       name: repo.name,
       path: repo.graphProject,
@@ -69,6 +92,12 @@ export interface CodeGraphProbeDeps {
   exists(path: string): boolean;
   run(command: string, args: readonly string[]): Promise<ReadOnlyCommandResult>;
   now(): number;
+  /**
+   * Session-recorded graph-tools observations for the probed project (#726).
+   * Absent, the probe reports no observation — which is exactly what a caller
+   * that has no store must report, and never a claim that tools were absent.
+   */
+  graphToolsObservations?(): { recorded: number; present: number; absent: number };
 }
 
 async function runReadOnly(command: string, args: readonly string[]): Promise<ReadOnlyCommandResult> {
@@ -95,7 +124,7 @@ async function runReadOnly(command: string, args: readonly string[]): Promise<Re
   }
 }
 
-const DEFAULT_DEPS: CodeGraphProbeDeps = {
+export const DEFAULT_DEPS: CodeGraphProbeDeps = {
   prereqs: resolvePrereqs,
   exists: existsSync,
   run: runReadOnly,
@@ -228,19 +257,36 @@ export async function probeCodeGraph(
   let uncertain = false;
 
   const indexer: CheckState = prereqs.indexer === null ? "missing" : "present";
-  const mcpMount: CheckState = prereqs.mounted ? "present" : "missing";
+  const mcpMount: McpMountState = prereqs.mounted ? "configured" : "unconfigured";
   if (indexer === "missing") reasons.push("indexer is not present on PATH");
-  if (mcpMount === "missing") reasons.push("worker MCP configuration does not mount the indexer");
+  if (mcpMount === "unconfigured") reasons.push("worker MCP configuration does not mount the indexer");
+
+  // The runtime half (#726): what dispatched sessions actually had in their
+  // registries. `recorded: 0` (no run ever recorded an observation, or no
+  // store-backed reader) contributes nothing — "observed" is only ever claimed
+  // from a run that recorded it. An observed absence is the signal this
+  // feature exists to surface: config says "mounted" while sessions ran
+  // without the tools, which is exactly the blind spot `mcp.json` alone had.
+  const session = deps.graphToolsObservations?.() ?? { recorded: 0, present: 0, absent: 0 };
+  if (session.recorded > 0 && session.absent > 0) {
+    reasons.push(
+      `graph tools observed absent from the session registry in ${session.absent} of ${session.recorded} runs`,
+    );
+  }
 
+  // The units are per project (`cbm-reindex-<project>.*`): probing the shared
+  // stem would report project B's health against project A's timer, and with
+  // both installed the answer would be whichever the probe guessed (#720).
+  const stem = reindexUnitName(project);
   const [projectsResult, enabledResult, activeResult, serviceResult] = await Promise.all([
     prereqs.indexer === null
       ? Promise.resolve<ReadOnlyCommandResult>({ kind: "unavailable" })
       : deps.run(prereqs.indexer, ["cli", "list_projects", "{}"]),
-    deps.run("systemctl", ["is-enabled", `${REINDEX_UNIT}.timer`]),
-    deps.run("systemctl", ["is-active", `${REINDEX_UNIT}.timer`]),
+    deps.run("systemctl", ["is-enabled", `${stem}.timer`]),
+    deps.run("systemctl", ["is-active", `${stem}.timer`]),
     deps.run("systemctl", [
       "show",
-      `${REINDEX_UNIT}.service`,
+      `${stem}.service`,
       "--property=Result",
       "--property=ExecMainStatus",
       "--property=ExecMainExitTimestamp",
@@ -288,6 +334,7 @@ export async function probeCodeGraph(
     status: uncertain ? "unknown" : reasons.length === 0 ? "healthy" : "degraded",
     checkedAt,
     prerequisites: { indexer, mcpMount },
+    session,
     repos,
     timer: { enabled, active },
     refresh: refresh.health,