omp-conductor 0.17.1 → 0.18.1

package/src/session-host.ts

@@ -21,7 +21,9 @@
 
 import { connect } from "node:net";
 
+import { identityMismatch } from "./host.ts";
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
+import type { GraphToolsObservation } from "./types.ts";
 import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
 import type { ResolvedGrants, SessionRole } from "./types.ts";
 
@@ -34,6 +36,16 @@ export interface SessionHostSpec {
   socket: string;
   cwd: string;
   role: SessionRole;
+  /**
+   * The kernel identity this session was launched under (#798): the uid/gid
+   * setpriv dropped to before this process started. The child asserts
+   * `process.getuid()/getgid()` against it as its first act, and refuses to
+   * build a session when they differ — a worker session whose kernel identity
+   * is not the one its parent established must not run worker code. Absent,
+   * the session runs as the daemon's own uid, which is what every
+   * non-worker surface (orchestrator, tests) wants.
+   */
+  identity?: { uid: number; gid: number };
   sessionDir?: string;
   model?: string;
   resume?: boolean;
@@ -55,6 +67,19 @@ export interface SessionHostSpec {
    *  Carried as a plain scalar like the other fields; absent, nothing is staged
    *  on the far side either. */
   ompSettingsFile?: string;
+  /**
+   * The structured-settlement contract (#540): a JSON Schema the session's
+   * `yield` tool validates its `data` payload against. Carried as plain JSON
+   * through the spec, like everything else; absent, the far side passes nothing
+   * to the harness.
+   */
+  outputSchema?: unknown;
+  /** Enforcement policy for {@link outputSchema} — the worker contract is
+   *  `"permissive"`: a schema violation settles with whatever the worker
+   *  produced, never a lost report. */
+  outputSchemaMode?: "permissive" | "strict";
+  /** Force the hidden `yield` tool into this session's toolset (#540). */
+  requireYieldTool?: boolean;
 }
 
 /** Parent → child. */
@@ -66,7 +91,35 @@ export type ParentToHost =
 
 /** Child → parent. */
 export type HostToParent =
-  | { t: "ready"; sessionFile?: string; modelFallbackMessage?: string }
+  | {
+      t: "ready";
+      sessionFile?: string;
+      modelFallbackMessage?: string;
+      /**
+       * The omp-conductor version this child process loaded, attested at the
+       * ready handshake (#832): the session host's `ready` is the exact-session
+       * handoff the upgrade verifies against, so the live process's own loaded
+       * module version travels with it instead of being read off disk later.
+       * Absent only when the version cannot be read — absence is "not
+       * attested", never "the newest".
+       */
+      extensionVersion?: string;
+      /** Exact peer entry and package version loaded by this child (#828). */
+      harnessPath?: string;
+      harnessVersion?: string;
+    }
+  | {
+      t: "graph-tools";
+      /**
+       * The code-graph session observation (#726): whether the graph MCP tools
+       * were in this session's registry. Sent once the session's tool registry
+       * settles (it finalises after creation, so the ready handshake never
+       * waits for it). Absent value never travels — no message means no
+       * observation was recorded, never "graph tools absent", which is the
+       * `present: false` truth value.
+       */
+      graphTools: GraphToolsObservation;
+    }
   | { t: "start-error"; message: string }
   | { t: "event"; event: unknown }
   | { t: "session-file"; path: string }
@@ -159,11 +212,17 @@ export interface SessionHostDeps {
  * into the same `Error` the in-process path would have raised, so a missing
  * peer dependency still reads as a deployment mistake rather than as an
  * unexplained child exit.
+ *
+ * Returns `false` when the session refused to start because the identity it
+ * was launched for does not match the kernel identity this process actually
+ * runs under — that refusal is the fail-closed arm of the worker boundary,
+ * and the caller turns it into a non-zero exit so nothing downstream can read
+ * it as a clean session.
  */
 export async function runSessionHost(
   spec: SessionHostSpec,
   deps: SessionHostDeps = { createSession: createLocalSession },
-): Promise<void> {
+): Promise<boolean> {
 
   const socket = connect(spec.socket);
   socket.setNoDelay(true);
@@ -171,6 +230,26 @@ export async function runSessionHost(
     if (!socket.writableEnded) socket.write(encodeFrame(message));
   };
 
+  // The kernel identity check comes as early as there is a socket to report
+  // over and before the harness (`createSession`) has run a single byte of
+  // worker-controlled code. A child whose uid/gid are not the ones its parent
+  // launched it for proves the boundary did not hold — the daemon would be
+  // supervising a session that is not what it thinks it is.
+  const violation = identityMismatch(spec.identity);
+  if (violation !== undefined) {
+    send({ t: "start-error", message: violation });
+    // The frame must reach the parent before this process exits: `process.exit`
+    // does not flush the socket, and a parent that only observes the exit used
+    // to report a bare exit code instead of the child's own words. The parent
+    // resolves the run as failed with no live child — fail closed.
+    await new Promise<void>((resolve) => {
+      socket.once("finish", () => resolve());
+      socket.once("error", () => resolve());
+      socket.end();
+    });
+    return false;
+  }
+
   const { promise: connected, resolve: onConnect, reject: onConnectFail } = Promise.withResolvers<void>();
   socket.once("connect", () => {
     onConnect();
@@ -192,6 +271,9 @@ export async function runSessionHost(
       ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
       ...(spec.readOnly === undefined ? {} : { readOnly: spec.readOnly }),
       ...(spec.ompSettingsFile === undefined ? {} : { ompSettingsFile: spec.ompSettingsFile }),
+      ...(spec.outputSchema === undefined ? {} : { outputSchema: spec.outputSchema }),
+      ...(spec.outputSchemaMode === undefined ? {} : { outputSchemaMode: spec.outputSchemaMode }),
+      ...(spec.requireYieldTool === undefined ? {} : { requireYieldTool: spec.requireYieldTool }),
       // The release audit lives in the daemon's state directory, which this
       // process may not be able to write and must not be trusted to. It
       // becomes a message; the parent performs the durable write.
@@ -204,12 +286,15 @@ export async function runSessionHost(
     // The frame must reach the parent before this process exits: `process.exit`
     // does not flush the socket, and a parent that only observes the exit used
     // to report a bare exit code instead of the child's own words.
+    // This is a failed start, not an identity refusal: the process still walks
+    // away with a clean exit code, because the parent's verdict comes from the
+    // frame, not the status — 91 is reserved for the boundary refusal above.
     await new Promise<void>((resolve) => {
       socket.once("finish", () => resolve());
       socket.once("error", () => resolve());
       socket.end();
     });
-    return;
+    return true;
   }
 
   const live = session;
@@ -232,8 +317,28 @@ export async function runSessionHost(
     ...(live.modelFallbackMessage === undefined
       ? {}
       : { modelFallbackMessage: live.modelFallbackMessage }),
+    // The loaded-module attestation (#832): what THIS process's session
+    // machinery actually executes, carried in the exact-session handoff the
+    // upgrade verifies against.
+    ...(live.extensionVersion === undefined ? {} : { extensionVersion: live.extensionVersion }),
+    ...(live.harnessPath === undefined ? {} : { harnessPath: live.harnessPath }),
+    ...(live.harnessVersion === undefined ? {} : { harnessVersion: live.harnessVersion }),
   });
 
+  // The code-graph session observation (#726) rides its own frame: the factory
+  // reads the session's tool registry asynchronously (the harness finalises
+  // MCP wiring after creation), so the ready handshake never waits for it. The
+  // child is the session's own process — this is the runtime observation the
+  // config check in `resolvePrereqs` deliberately is not, and an observation
+  // that never resolves simply never travels: no message is "not recorded",
+  // never "graph tools absent".
+  const graphToolsReady = live.graphToolsReady;
+  if (graphToolsReady !== undefined) {
+    void graphToolsReady.then((graphTools) => {
+      if (graphTools !== undefined) send({ t: "graph-tools", graphTools });
+    });
+  }
+
   const { promise: finished, resolve: finish } = Promise.withResolvers<void>();
   let buffer = "";
   socket.on("data", (chunk: Buffer) => {
@@ -300,6 +405,7 @@ export async function runSessionHost(
     // Teardown noise must not become the run's outcome.
   }
   socket.end();
+  return true;
 }
 
 /** Reads the spec the parent handed over. Argv, not stdin: stdin is the harness's. */
@@ -315,6 +421,10 @@ if (import.meta.main) {
   // Exit code is the parent's only signal when the socket never opened, so a
   // spec that will not parse fails loudly here rather than as a silent hang.
   const spec = specFromArgv(process.argv);
-  await runSessionHost(spec);
-  process.exit(0);
+  const started = await runSessionHost(spec);
+  // A refused start — the launched identity did not match this process's
+  // kernel identity — exits 91 (the same code the rejected cgroup-boundary
+  // launcher used) so an operator reading `ps` or the exit status sees a
+  // boundary refusal, never a clean exit.
+  process.exit(started ? 0 : 91);
 }