omp-conductor 0.18.1 → 0.18.2

package/src/host.ts

@@ -187,35 +187,22 @@ export function rssBytesFromHealthz(body: string | undefined): number | undefine
   }
 }
 
-// ------------------------------------------------------- worker identity (#798) --
+// ------------------------------------------------------- worker host state (#894) --
 
 /**
- * The dedicated least-privilege account every worker session runs under.
+ * The dedicated worker account earlier boundary slices created on this host.
  *
- * `setup host` creates it and grants it exactly the paths a worker session
- * needs; the daemon resolves it before every worker launch and refuses to
- * dispatch when it cannot be established. A worker under this uid is a kernel
- * identity, not a stamp: it cannot write the daemon's state (every path it
- * needs is either chowned to it at dispatch or granted read/search-only), and
- * it cannot migrate itself into a daemon-owned cgroup (every cgroup.procs on
- * the host is root-owned, and cgroupfs directory ownership is what v2 gates
- * writes with). This is the closure the rejected cgroup-namespace boundary
- * named as required: kuid 0 with CAP_SYS_ADMIN could re-enter the initial
- * cgroup namespace and fabricate a top-level cgroup, and a different uid is
- * what takes that capability away.
+ * Worker sessions no longer launch under it (#894 restored the fleet-account
+ * runtime v0.18.0 used): the constants below survive only so `setup host` can
+ * keep staging and recognising the units it once installed until #895 retires
+ * that host lifecycle end to end. Nothing on the session-launch path reads
+ * them.
  */
 export const WORKER_ACCOUNT = "omp-worker";
 
 /** The worker account's system home: its harness config, caches and state. */
 export const WORKER_HOME_DIR = "/var/lib/omp-worker";
 
-/**
- * The util-linux launcher worker sessions are spawned through. Pinned to an
- * absolute path, never PATH-resolved: a launcher found later in the search
- * order is a launcher an operator's environment could shadow.
- */
-export const WORKER_SETPRIV_PATH = "/usr/bin/setpriv";
-
 /**
  * The harness package omp-conductor loads a session from. Held here, beside
  * the identity that has to reach it, so `omp.ts` (which imports it) and the
@@ -357,315 +344,3 @@ export function harnessBindingProblem(deps: HarnessBindingDeps = {}): string | u
   return undefined;
 }
 
-/** One resolved worker identity: the account exactly as the host knows it. */
-export interface WorkerIdentity {
-  account: string;
-  uid: number;
-  gid: number;
-  /** The account's passwd home. */
-  home: string;
-  /** Absolute path of the identity-transition launcher. */
-  setpriv: string;
-  /** The harness agent dir for this identity: `<home>/.omp/agent`. */
-  agentDir: string;
-}
-
-export type WorkerIdentityResolution =
-  | { ok: true; identity: WorkerIdentity }
-  | { ok: false; reason: string };
-
-export interface WorkerIdentityDeps {
-  /** The resolving process's own uid; injected so tests pin the verdict. */
-  daemonUid?: number;
-  /** Whether the transition launcher exists; injected so tests pin the verdict. */
-  setprivInstalled?: boolean;
-  /** The contents of /etc/passwd; injected so tests pin the verdict. */
-  passwd?: string;
-  /**
-   * Why the worker harness binding is unusable, or `undefined` when it is
-   * live. Injected so tests pin the verdict without a real mount; production
-   * reads the host through {@link harnessBindingProblem}.
-   */
-  harnessProblem?: () => string | undefined;
-}
-
-/** Is a process uid "unprivileged" for the worker identity's purposes — never
- *  the daemon's uid, and never root: an account that keeps uid 0 is not a
- *  boundary, it is a costume. */
-function usableWorkerUid(uid: number, daemonUid: number): string | undefined {
-  if (uid === 0) return "the worker account must not be uid 0 (root) — an identity transition to root is not a boundary";
-  if (uid === daemonUid) return `the worker account must not share the daemon's uid ${daemonUid}`;
-  return undefined;
-}
-
-/**
- * Resolve the worker identity the daemon launches worker sessions under.
- *
- * This is the launch gate's input, resolved before every worker launch and at
- * daemon startup for the banner. Every failure mode is a *reason*, never a
- * throw: dispatch turns a missing account into a failed closed run (with this
- * reason in the report and the escalation), so the operator hears exactly
- * which host change is missing. A daemon that cannot transition — not running
- * as root, or a host without setpriv — refuses to launch workers rather than
- * running them unbound.
- */
-export function resolveWorkerIdentity(deps: WorkerIdentityDeps = {}): WorkerIdentityResolution {
-  const daemonUid = deps.daemonUid ?? process.getuid?.() ?? 0;
-  if (daemonUid !== 0) {
-    return {
-      ok: false,
-      reason:
-        `the daemon runs as uid ${daemonUid}; only root can transition a child to another uid, ` +
-        "so worker sessions cannot be launched under the dedicated identity",
-    };
-  }
-  const setpriv = WORKER_SETPRIV_PATH;
-  const setprivInstalled = deps.setprivInstalled ?? existsSync(setpriv);
-  if (!setprivInstalled) {
-    return {
-      ok: false,
-      reason: `${setpriv} (util-linux setpriv) is not installed on this host — worker sessions cannot be launched under the dedicated identity`,
-    };
-  }
-  let passwd: string;
-  try {
-    passwd = deps.passwd ?? readFileSync("/etc/passwd", "utf8");
-  } catch {
-    return { ok: false, reason: `cannot read /etc/passwd while resolving the ${WORKER_ACCOUNT} identity` };
-  }
-  // `user:passwd:uid:gid:gecos:home:shell` — the whole line, never a prefix
-  // match, so a friendly lookalike account cannot satisfy the resolution.
-  const line = passwd.split("\n").find((entry) => entry.startsWith(`${WORKER_ACCOUNT}:`));
-  if (line === undefined) {
-    return {
-      ok: false,
-      reason:
-        `the ${WORKER_ACCOUNT} account does not exist on this host — run \`omp-conductor setup host\` ` +
-        "to create the dedicated worker identity",
-    };
-  }
-  const fields = line.split(":");
-  const uid = Number(fields[2]);
-  const gid = Number(fields[3]);
-  const home = fields[5] ?? "";
-  if (!Number.isInteger(uid) || uid < 0) {
-    return { ok: false, reason: `the ${WORKER_ACCOUNT} account has an unusable uid in /etc/passwd` };
-  }
-  if (!Number.isInteger(gid) || gid < 0) {
-    return { ok: false, reason: `the ${WORKER_ACCOUNT} account has an unusable gid in /etc/passwd` };
-  }
-  const problem = usableWorkerUid(uid, daemonUid);
-  if (problem !== undefined) return { ok: false, reason: problem };
-  if (home === "" || !home.startsWith("/")) {
-    return { ok: false, reason: `the ${WORKER_ACCOUNT} account has no absolute home in /etc/passwd` };
-  }
-  // Last, because it is the check the operator can only act on once the
-  // account is there: without a live bind of the operator's install, a worker
-  // child resolves its harness from Bun's auto-install cache instead — a
-  // different build whose native addon does not load (#828). Refusing here
-  // fails the launch closed with the fix, rather than letting every dispatch
-  // die inside a session it already paid to start.
-  const harnessProblem = deps.harnessProblem === undefined ? harnessBindingProblem() : deps.harnessProblem();
-  if (harnessProblem !== undefined) return { ok: false, reason: harnessProblem };
-  return {
-    ok: true,
-    identity: {
-      account: WORKER_ACCOUNT,
-      uid,
-      gid,
-      home,
-      setpriv,
-      agentDir: join(home, ".omp", "agent"),
-    },
-  };
-}
-
-/**
- * The argv that launches a payload under the worker identity — the transition
- * happens in the kernel at setpriv, BEFORE the first byte of any payload code
- * runs, and setpriv does not exec the payload unless the transition succeeded
- * (a failure exits non-zero with the reason on stderr, and the calling run
- * settles failed with no live child). `--` protects a payload argv[0] that
- * starts with `-`.
- *
- * A payload whose target uid/gid already equal this process's is returned
- * unchanged: the identity is already in force, and spawning setpriv would
- * only fail needlessly on a host without setuid privileges. That is also the
- * only way the parity suite can drive the full spawn path as a non-root CI
- * user.
- */
-export function workerLaunchArgv(
-  payloadArgv: readonly string[],
-  identity: WorkerIdentity | undefined,
-  currentUid: number = process.getuid?.() ?? 0,
-  currentGid: number = process.getgid?.() ?? 0,
-): string[] {
-  if (identity === undefined) return [...payloadArgv];
-  if (identity.uid === currentUid && identity.gid === currentGid) return [...payloadArgv];
-  // `--init-groups` initialises the supplementary groups from the identity
-  // being dropped to. It deliberately takes NO account operand (util-linux
-  // 2.39; newer versions accept an optional one): appending the account after
-  // it would be parsed as the program to exec on 2.39 and the launch would
-  // die with "failed to execute <account>" before any identity was dropped.
-  return [
-    identity.setpriv,
-    "--reuid",
-    identity.account,
-    "--regid",
-    identity.account,
-    "--init-groups",
-    "--",
-    ...payloadArgv,
-  ];
-}
-
-/**
- * The environment a worker session child runs with: the daemon's, with the
- * worker's own HOME (a worker under /root's HOME would try to write the
- * daemon's home), its own harness agent dir (so config discovery is
- * deterministic whatever the parent's environment says), and its own
- * conductor state root (the worker's `omp-conductor` CLI reads its own empty
- * store instead of the daemon's — the daemon's DB is daemon state, not
- * worker input).
- */
-export function workerSessionEnv(
-  base: Record<string, string | undefined>,
-  identity: WorkerIdentity,
-): Record<string, string | undefined> {
-  return {
-    ...base,
-    HOME: identity.home,
-    PI_CODING_AGENT_DIR: identity.agentDir,
-    OMP_CONDUCTOR_HOME: join(identity.home, ".omp", "conductor"),
-  };
-}
-
-export interface WorkerHarnessImportOptions {
-  bun?: string;
-  moduleDir?: string;
-  bindingRoot?: string;
-  identity?: WorkerIdentity;
-  timeoutMs?: number;
-}
-
-/**
- * Run the anchored harness loader through the worker's real HOME and setpriv
- * transition. Setup uses this after the inode checks: a mount can be current
- * while ambient Bun resolution still chooses its install cache (#828).
- */
-export function workerHarnessImportProblem(
-  options: WorkerHarnessImportOptions = {},
-): string | undefined {
-  const bun = options.bun ?? process.execPath;
-  const moduleDir = options.moduleDir ?? import.meta.dir;
-  const bindingRoot = options.bindingRoot ?? WORKER_HARNESS_NODE_MODULES;
-  const timeoutMs = options.timeoutMs ?? 10_000;
-  const packageRoot = packageNodeModulesRoot(moduleDir);
-  if (packageRoot === undefined) {
-    return `cannot probe the worker harness import because ${moduleDir} is not inside a node_modules install root`;
-  }
-  let identity = options.identity;
-  if (identity === undefined) {
-    const resolved = resolveWorkerIdentity({ harnessProblem: () => undefined });
-    if (!resolved.ok) return resolved.reason;
-    identity = resolved.identity;
-  }
-
-  let sourceHarness: string;
-  let sourceNative: string;
-  let expectedVersion: string;
-  try {
-    sourceHarness = Bun.resolveSync(OMP_HARNESS_PACKAGE, moduleDir);
-    sourceNative = Bun.resolveSync(OMP_NATIVES_PACKAGE, dirname(sourceHarness));
-    const parsed: unknown = JSON.parse(
-      readFileSync(join(packageRoot, OMP_HARNESS_PACKAGE, "package.json"), "utf8"),
-    );
-    if (parsed === null || typeof parsed !== "object") throw new Error("package metadata is not an object");
-    const version = Reflect.get(parsed, "version");
-    if (typeof version !== "string" || version === "") throw new Error("package version is absent");
-    expectedVersion = version;
-  } catch (cause) {
-    return `cannot resolve the operator's installed harness for the worker probe: ${cause instanceof Error ? cause.message : String(cause)}`;
-  }
-
-  const probe = workerHarnessPath(join(moduleDir, "harness-loader.ts"), packageRoot, bindingRoot);
-  const expectedHarness = workerHarnessPath(sourceHarness, packageRoot, bindingRoot);
-  const expectedNative = workerHarnessPath(sourceNative, packageRoot, bindingRoot);
-  if (probe === undefined || expectedHarness === undefined || expectedNative === undefined) {
-    return "cannot map the installed harness probe through the worker binding";
-  }
-  const argv = workerLaunchArgv([bun, "--no-install", probe], identity);
-  const command = argv[0];
-  if (command === undefined) return "cannot launch the worker harness probe: its argv is empty";
-  const ran = spawnSync(command, argv.slice(1), {
-    cwd: identity.home,
-    env: workerSessionEnv(process.env, identity),
-    encoding: "utf8",
-    timeout: timeoutMs,
-    killSignal: "SIGKILL",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  const errorCode = ran.error === undefined ? undefined : Reflect.get(ran.error, "code");
-  if (errorCode === "ETIMEDOUT") {
-    return `the worker harness import probe timed out after ${timeoutMs} ms`;
-  }
-  if (ran.status !== 0) {
-    const detail =
-      `${ran.error?.message ?? ""}\n${ran.stderr ?? ""}${ran.stdout ?? ""}`.trim();
-    return (
-      "the worker identity cannot import the operator's harness and native addon through the binding" +
-      (detail === "" ? "" : `: ${detail}`)
-    );
-  }
-
-  let report: unknown;
-  try {
-    const line = (ran.stdout ?? "").trim().split("\n").at(-1);
-    report = JSON.parse(line ?? "");
-  } catch {
-    return "the worker harness import probe returned no readable attestation";
-  }
-  if (report === null || typeof report !== "object") {
-    return "the worker harness import probe returned no readable attestation";
-  }
-  const loadedPath = Reflect.get(report, "path");
-  const loadedVersion = Reflect.get(report, "version");
-  const nativePath = Reflect.get(report, "nativePath");
-  if (
-    loadedPath !== expectedHarness ||
-    loadedVersion !== expectedVersion ||
-    nativePath !== expectedNative
-  ) {
-    return (
-      `the worker harness import resolved ${String(loadedPath)} at version ${String(loadedVersion)} ` +
-      `with native addon ${String(nativePath)}, expected ${expectedHarness} at version ${expectedVersion} ` +
-      `with ${expectedNative}`
-    );
-  }
-  return undefined;
-}
-
-/**
- * Why the current process does not satisfy the identity its launch spec
- * required, or `undefined` when it does. The session child's first act, as
- * early as there is a socket to report over: a child whose kernel identity is
- * not the one it was launched for proves the boundary did not hold and must
- * refuse to run worker code. The uid/gid getters default to this process's
- * own, and are parameters so the check is testable without spawning.
- */
-export function identityMismatch(
-  expected: { uid: number; gid: number } | undefined,
-  getuid: () => number = () => process.getuid?.() ?? 0,
-  getgid: () => number = () => process.getgid?.() ?? 0,
-): string | undefined {
-  if (expected === undefined) return undefined;
-  const uid = getuid();
-  const gid = getgid();
-  if (uid !== expected.uid || gid !== expected.gid) {
-    return (
-      `worker identity mismatch: running as uid ${uid} gid ${gid}, but this session was launched ` +
-      `for uid ${expected.uid} gid ${expected.gid} — the identity transition did not hold, refusing to start`
-    );
-  }
-  return undefined;
-}

package/src/omp-settings.ts

@@ -36,6 +36,25 @@ import type { ProjectConfig } from "./types.ts";
 /** The overlay filename inside a run's session directory. */
 export const OMP_SETTINGS_FILE = "omp-settings.yml";
 
+/**
+ * The OMP model-role names one settings map declares — the keys of its
+ * `modelRoles` stanza (#875). This is the one grammar every surface that
+ * names an adjudicator role reads: omp's own `modelRoles` config, whether it
+ * sits in the daemon account's global settings, a project's overlay, or both.
+ * Anything that is not a flat string-map names no roles at all — an overlay
+ * whose `modelRoles` is, say, a YAML list is omp's to reject, and offering
+ * garbage role names here would only train the setup dialog on values OMP
+ * would refuse. `null` and any other non-object input — including an empty
+ * or comments-only settings file whose YAML parses to `null` — is zero
+ * roles, never a fault.
+ */
+export function modelRolesIn(settings: unknown): readonly string[] {
+  if (settings === null || typeof settings !== "object" || Array.isArray(settings)) return [];
+  const roles = (settings as Record<string, unknown>)["modelRoles"];
+  if (roles === null || typeof roles !== "object" || Array.isArray(roles)) return [];
+  return Object.keys(roles as Record<string, unknown>);
+}
+
 /**
  * The effective overlay map for a project: the opaque `ompSettings` map plus
  * the retry keys (`retry.modelFallback`, `retry.fallbackChains.default`)

package/src/omp.ts

@@ -8,20 +8,13 @@
  * `createAgentSession`, `subscribe` or `abort`, exactly one file breaks.
  */
 
-import { chmodSync, chownSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { createServer, type Server, type Socket } from "node:net";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import {
-  OMP_HARNESS_PACKAGE,
-  packageNodeModulesRoot,
-  workerHarnessPath,
-  workerLaunchArgv,
-  workerSessionEnv,
-  type WorkerIdentity,
-} from "./host.ts";
+import { OMP_HARNESS_PACKAGE, packageNodeModulesRoot } from "./host.ts";
 import { harnessVersion, resolveHarnessEntry } from "./harness-loader.ts";
 import { readOnlySession, worktreeConfinement } from "./confinement.ts";
 import { observeGraphTools } from "./graph.ts";
@@ -615,18 +608,6 @@ export interface CreateSessionOptions {
   model?: string;
   resume?: boolean;
   role: SessionRole;
-  /**
-   * The worker identity this session must run under (#798): when set, the
-   * child is launched through {@link workerLaunchArgv}'s identity transition
-   * (setpriv) before any of its code runs, its environment is re-pointed at
-   * the worker's own home/agent path, the control socket is granted to that
-   * uid, and the child refuses to build a session unless its kernel uid/gid
-   * match. The daemon resolves this identity once and threads it through every
-   * worker launch; a worker session is never launched without it. Absent, the
-   * session runs as this process's own identity — the orchestrator and every
-   * test surface.
-   */
-  identity?: WorkerIdentity;
   releaseGrants?: ResolvedGrants;
   onReleaseBlocked?: (shape: GateShape, context: ReleaseBlockContext) => void;
   /**
@@ -682,12 +663,6 @@ export interface CreateSessionOptions {
    * without a live harness or a model bill.
    */
   hostModule?: string;
-  /**
-   * Test-only worker binding root. Production always uses
-   * `WORKER_HARNESS_NODE_MODULES`; the Linux privilege regression supplies an
-   * inode-identical temporary binding so it never mutates the live host mount.
-   */
-  harnessNodeModules?: string;
   /**
    * Deny every tool but reading and searching (#307).
    *
@@ -780,23 +755,15 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
       "daemon shutdown began while the session socket was binding",
     );
   }
-  // The socket is the run's own channel, and the daemon's own uid is the only
-  // one that speaks on it — unless this session runs under the worker
-  // identity, in which case the child (and only the child) is the worker uid,
-  // and the socket must be granted to it or the very first connect fails
-  // before the identity could matter.
+  // The socket is the run's own channel, and this process's own uid — the
+  // fleet account every session runs as (#894) — is the only one that speaks
+  // on it.
   chmodSync(socketPath, 0o600);
-  if (opts.identity !== undefined) {
-    chownSync(socketPath, opts.identity.uid, opts.identity.gid);
-  }
 
   const spec: SessionHostSpec = {
     socket: socketPath,
     cwd: opts.cwd,
     role: opts.role,
-    ...(opts.identity === undefined
-      ? {}
-      : { identity: { uid: opts.identity.uid, gid: opts.identity.gid } }),
     ...(opts.sessionDir === undefined ? {} : { sessionDir: opts.sessionDir }),
     ...(opts.model === undefined ? {} : { model: opts.model }),
     ...(opts.resume === undefined ? {} : { resume: opts.resume }),
@@ -811,30 +778,18 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
 
   const log = opts.onChildLog ?? ((line: string) => process.stderr.write(`${line}\n`));
   const hostModule = opts.hostModule ?? SESSION_HOST;
-  // Under the worker identity the child launches from the read-only binding of
-  // the operator's install (#828). The child then resolves the harness from an
-  // explicit root and runs with `--no-install`; the entry remap and resolver
-  // anchor therefore name the same tree, while Bun has no ambient-cache
-  // fallback for either the peer or its transitive/native imports.
-  const packageRoot = packageNodeModulesRoot(hostModule);
-  const boundEntry =
-    opts.harnessNodeModules === undefined
-      ? workerHarnessPath(hostModule, packageRoot)
-      : workerHarnessPath(hostModule, packageRoot, opts.harnessNodeModules);
-  const entryModule = opts.identity === undefined ? hostModule : boundEntry ?? hostModule;
-  const payloadArgv = [process.execPath, "--no-install", entryModule, JSON.stringify(spec)];
-  const argv = workerLaunchArgv(payloadArgv, opts.identity);
+  // The child is the same installed tree this process runs from, launched
+  // under the fleet account (#894). `--no-install` keeps Bun off its ambient
+  // auto-install cache, so the peer and its native addon resolve from the
+  // operator's exact install or fail loudly.
+  const argv = [process.execPath, "--no-install", hostModule, JSON.stringify(spec)];
   // The session's own role is stamped on the child, so a process the agent
   // runs — `omp-conductor report` from its sandbox — can tell a worker session
   // from the operator's shell. Direct CLI runs outside a spawned session
-  // inherit nothing and stay the orchestrator surface. Under the worker
-  // identity, the child's HOME and agent/state roots are re-pointed at the
-  // worker account's own, so the harness it boots writes worker state, never
-  // the daemon's.
+  // inherit nothing and stay the orchestrator surface.
   let env: Record<string, string | undefined> | undefined;
   if (opts.role !== undefined) {
     env = { ...process.env, [SESSION_ROLE_ENV]: opts.role };
-    if (opts.identity !== undefined) env = workerSessionEnv(env, opts.identity);
   }
   const child = Bun.spawn(argv, {
     cwd: opts.cwd,