omp-conductor 0.18.0 → 0.18.1

package/src/verbs/socket.ts

@@ -215,21 +215,40 @@ export function unlinkStaleSocket(path: string): void {
 }
 
 /**
- * Restrict a bound socket to the daemon's own uid.
+ * Restrict a bound socket to the daemon's own uid, or to the worker identity
+ * that owns the channel when `owner` is given.
  *
  * Returns the guarantee in force, because #126 asks the daemon to *state* its
  * mechanism at startup rather than guess: the socket is `0600` under a `0711`
  * daemon-owned parent, so it is one-user, and the unguessable suffix plus that
- * parent are the whole story. Saying so is the difference between an audited
- * boundary and a hopeful one.
+ * parent are the whole story. Under the worker identity the one user is the
+ * worker account — the socket is chowned to it, because the child that must
+ * connect to it runs as that uid and nothing else does. Saying so is the
+ * difference between an audited boundary and a hopeful one.
  */
-export type SocketOwnership = "daemon-user";
+export type SocketOwnership = "daemon-user" | "worker-user";
+
+export interface SecureBoundSocketOptions {
+  /** The chmod call; injected so tests pin the mode without a real socket. */
+  chmod?: (p: string, mode: number) => void;
+  /**
+   * The uid/gid the socket belongs to (the worker identity for a run
+   * channel). Absent, the socket stays daemon-owned and only the daemon's
+   * uid can connect.
+   */
+  owner?: { uid: number; gid: number };
+}
 
 export function secureBoundSocket(
   path: string,
-  chmod: (p: string, mode: number) => void = chmodSync,
+  options: SecureBoundSocketOptions = {},
 ): SocketOwnership {
+  const chmod = options.chmod ?? chmodSync;
   chmod(path, VERB_SOCKET_MODE);
+  if (options.owner !== undefined) {
+    chownSync(path, options.owner.uid, options.owner.gid);
+    return "worker-user";
+  }
   return "daemon-user";
 }
 

package/src/worker.ts

@@ -12,9 +12,10 @@
 
 import { mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import type { WorkerIdentity } from "./host.ts";
 import { createSession, disposeSession, SessionAdmissionClosedError, type AgentSessionLike } from "./omp.ts";
 import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
-import type { Caps, ResolvedGrants, RunState } from "./types.ts";
+import type { Caps, GraphToolsObservation, ResolvedGrants, RunState } from "./types.ts";
 
 /** Structured evidence fields from the worker's final report. */
 const PR_URL_PATTERN = /^pr:\s*(https:\/\/github\.com\/\S+\/pull\/\d+)\s*$/im;
@@ -217,6 +218,17 @@ export interface WorkerOpts {
   onReleaseBlocked?: (shape: GateShape, context: ReleaseBlockContext) => void;
   /** The child's pid, the instant it exists. See {@link VerbListener.bindPid}. */
   onSpawn?: (pid: number) => void;
+  /**
+   * The worker identity this session runs under (#798): the dedicated
+   * least-privilege account the daemon resolved for worker launch. Forwarded
+   * to `createSession`, which launches the child through the identity
+   * transition (setpriv), re-points its environment at the worker's own home,
+   * grants it the control socket, and refuses the session unless its kernel
+   * uid/gid match. The daemon supplies it for every worker launch and refuses
+   * to dispatch a worker without it; absent, the session runs as the
+   * caller's own identity (orchestrator, tests).
+   */
+  workerIdentity?: WorkerIdentity;
   /** Control socket for that child, beside the run's own session directory. */
   socketPath?: string;
   /**
@@ -330,6 +342,15 @@ export interface WorkerResult {
    * is otherwise indistinguishable from a run that was merely unlucky.
    */
   modelFallbackMessage?: string;
+  /**
+   * The code-graph session observation (#726): what the session's own registry
+   * held at start, read off the session exactly like `modelFallbackMessage`.
+   * Absent means the session surface did not record one — never "graph tools
+   * absent", which is the `present: false` truth value. A dispatched run that
+   * records it lets the doctor tell "the model ignored a tool it had" from
+   * "the tool was missing" apart.
+   */
+  graphTools?: GraphToolsObservation;
 }
 
 /**
@@ -550,6 +571,7 @@ export async function runWorker(
       role: "worker",
       ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
       ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
+      ...(o.workerIdentity === undefined ? {} : { identity: o.workerIdentity }),
       ...(o.onSpawn === undefined ? {} : { onSpawn: o.onSpawn }),
       ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
       ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
@@ -613,7 +635,7 @@ export async function runWorker(
   const withSessionFacts = (
     result: Omit<WorkerResult, ReliabilityKeys>,
   ): Omit<WorkerResult, ReliabilityKeys> => {
-    const { sessionFile, modelFallbackMessage } = session;
+    const { sessionFile, modelFallbackMessage, graphTools } = session;
     if (!advisorSpendFolded) {
       advisorSpendFolded = true;
       // Advisor turns live in their own `__advisor*.jsonl` and never surface
@@ -634,6 +656,7 @@ export async function runWorker(
       spendUsd,
       ...(sessionFile === undefined ? {} : { sessionFile }),
       ...(modelFallbackMessage === undefined ? {} : { modelFallbackMessage }),
+      ...(graphTools === undefined ? {} : { graphTools }),
     };
   };
 

package/src/worktree.ts

@@ -27,7 +27,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-import { credentialedEnv, scrubUserinfo } from "./gitops.ts";
+import { credentialedEnv, runRepoSafeDirectoryExemption, scrubUserinfo } from "./gitops.ts";
 import type { RepoTarget } from "./types.ts";
 
 /**
@@ -255,7 +255,9 @@ function refreshManagedExclude(worktree: string): void {
   try {
     // `--git-common-dir` is relative for linked worktrees; resolve against the
     // tree so bare-mirror layouts and plain clones both land on info/exclude.
-    const common = Bun.spawnSync(["git", "rev-parse", "--git-common-dir"], {
+    // The tree is worker-owned by the time salvage runs (#798), so the
+    // exact-path exemption rides on the argv (#816).
+    const common = Bun.spawnSync(["git", ...runRepoSafeDirectoryExemption(worktree), "rev-parse", "--git-common-dir"], {
       cwd: worktree,
       stdin: "ignore",
       stdout: "pipe",
@@ -640,11 +642,16 @@ export async function salvageWip(
     // and dies with the next `worktree remove --force` (#44).
     refreshManagedExclude(worktree);
 
-    if ((await git(["status", "--porcelain"], worktree)) === "") return { kind: "nothing" };
+    // The tree is worker-owned by the time salvage runs (#798): every daemon
+    // git call against it carries the exact per-run ownership exemption —
+    // never a wildcard, never a global config entry (#816).
+    const exempt = runRepoSafeDirectoryExemption(worktree);
+
+    if ((await git([...exempt, "status", "--porcelain"], worktree)) === "") return { kind: "nothing" };
 
     // The tree's own branch, not one the caller believes it should be on: this
     // string ends up in an escalation as the place to go looking.
-    const branch = await git(["rev-parse", "--abbrev-ref", "HEAD"], worktree);
+    const branch = await git([...exempt, "rev-parse", "--abbrev-ref", "HEAD"], worktree);
 
     // `-A` on purpose: the losses this exists for were mostly *new* files.
     //
@@ -660,13 +667,13 @@ export async function salvageWip(
     // A literal `:(exclude)<path>` was also an outright bug: git counts it as
     // naming the path, so an already-ignored file made `add` exit 1 and every
     // cap-kill would have reported a salvage *failure*.
-    await git(["add", "-A"], worktree);
+    await git([...exempt, "add", "-A"], worktree);
 
     // The dirty check above ran before git applied its ignores, so a tree whose
     // only changes were ignored scratch had work by that test and none by this.
     // Without this, `commit` exits non-zero on an empty index and a tree
     // holding nothing worth keeping gets reported as a salvage *failure*.
-    const cached = await git(["diff", "--cached", "--name-status"], worktree);
+    const cached = await git([...exempt, "diff", "--cached", "--name-status"], worktree);
     if (cached === "") {
       return { kind: "nothing" };
     }
@@ -674,6 +681,7 @@ export async function salvageWip(
     const msg = salvageCommitMessage(issue, attempt, ending, files, newPaths);
     await git(
       [
+        ...exempt,
         ...SALVAGE_COMMIT_CONFIG,
         "commit",
         "--no-verify",
@@ -684,7 +692,7 @@ export async function salvageWip(
       ],
       worktree,
     );
-    const sha = await git(["rev-parse", "HEAD"], worktree);
+    const sha = await git([...exempt, "rev-parse", "HEAD"], worktree);
     const salvaged = { kind: "salvaged" as const, sha, branch, files, newPaths };
 
     if (branch === "HEAD") {
@@ -784,7 +792,12 @@ async function repairAlternates(
   worktreePath: string,
   mirrorPath: string,
 ): Promise<{ kind: "ok" } | { kind: "quarantine"; detail: string }> {
-  const common = await runGit(["rev-parse", "--git-common-dir"], worktreePath);
+  // The tree is worker-owned by cleanup time (#798); the exact-path exemption
+  // makes this read the daemon's own (#816).
+  const common = await runGit(
+    [...runRepoSafeDirectoryExemption(worktreePath), "rev-parse", "--git-common-dir"],
+    worktreePath,
+  );
   if (common.code !== 0) {
     return {
       kind: "quarantine",
@@ -868,11 +881,15 @@ export async function cleanupRetainedWorktree(
         };
       }
 
-      const dirty = await git(["status", "--porcelain"], worktreePath);
+      // The tree is worker-owned by cleanup time (#798): every daemon git call
+      // against it carries the exact per-run exemption (#816).
+      const exempt = runRepoSafeDirectoryExemption(worktreePath);
+
+      const dirty = await git([...exempt, "status", "--porcelain"], worktreePath);
       if (dirty !== "") {
         return { kind: "retained", reason: "dirty", detail: "worktree has uncommitted changes" };
       }
-      const actual = await git(["rev-parse", "--abbrev-ref", "HEAD"], worktreePath);
+      const actual = await git([...exempt, "rev-parse", "--abbrev-ref", "HEAD"], worktreePath);
       if (actual !== branch) {
         return {
           kind: "retained",
@@ -907,7 +924,7 @@ export async function cleanupRetainedWorktree(
     if (existsSync(worktreePath)) {
       try {
         await git(
-          ["fetch", "--no-tags", mirrorPath, "+refs/remotes/origin/*:refs/remotes/origin/*"],
+          [...runRepoSafeDirectoryExemption(worktreePath), "fetch", "--no-tags", mirrorPath, "+refs/remotes/origin/*:refs/remotes/origin/*"],
           worktreePath,
         );
       } catch (err) {
@@ -917,7 +934,7 @@ export async function cleanupRetainedWorktree(
           detail: `the run repository's remote refs could not be read: ${err instanceof Error ? err.message : String(err)}`,
         };
       }
-      const runUnique = await git(["rev-list", ref, "--not", "--remotes"], worktreePath);
+      const runUnique = await git([...runRepoSafeDirectoryExemption(worktreePath), "rev-list", ref, "--not", "--remotes"], worktreePath);
       if (runUnique !== "") {
         return {
           kind: "retained",