omp-conductor 0.18.2 → 0.19.0

package/src/host.ts

@@ -187,21 +187,7 @@ export function rssBytesFromHealthz(body: string | undefined): number | undefine
   }
 }
 
-// ------------------------------------------------------- worker host state (#894) --
-
-/**
- * The dedicated worker account earlier boundary slices created on this host.
- *
- * Worker sessions no longer launch under it (#894 restored the fleet-account
- * runtime v0.18.0 used): the constants below survive only so `setup host` can
- * keep staging and recognising the units it once installed until #895 retires
- * that host lifecycle end to end. Nothing on the session-launch path reads
- * them.
- */
-export const WORKER_ACCOUNT = "omp-worker";
-
-/** The worker account's system home: its harness config, caches and state. */
-export const WORKER_HOME_DIR = "/var/lib/omp-worker";
+// ------------------------------------------------------- harness resolution --
 
 /**
  * The harness package omp-conductor loads a session from. Held here, beside
@@ -214,36 +200,14 @@ export const OMP_HARNESS_PACKAGE = "@oh-my-pi/pi-coding-agent";
 export const OMP_NATIVES_PACKAGE = "@oh-my-pi/pi-natives";
 
 /**
- * Where `setup host` binds the operator's install so a worker session can
- * resolve it (#828).
- *
- * Bun's node_modules resolution needs **read** permission — not merely search
- * — on the directory that holds a `node_modules`: it enumerates the directory
- * to decide whether the child is there. The fleet account's home is granted to
- * the worker search-only by design (#798), so a bare `@oh-my-pi/pi-coding-agent`
- * import from `<fleet home>/node_modules/omp-conductor` did not find the
- * operator's install at all and fell through to Bun's auto-install, which
- * downloaded a *different* harness version into the worker's own cache whose
- * native addon then failed to load — every dispatch on the host stopped before
- * session start.
- *
- * The fix is a read-only bind of the operator's `node_modules` at a path whose
- * every ancestor is world-readable. Worker children are launched from it, so
- * the entry module, the peer import and every transitive import resolve inside
- * one tree the worker can enumerate — and, because a bind shares inodes with
- * its source, it is the operator's exact build rather than a copy that can
- * drift.
- *
- * Deliberately **not** under {@link WORKER_HOME_DIR}: the worker owns its home
- * between setups, and a symlink planted where a root-run mount point goes would
- * redirect that mount to an arbitrary target (#816).
+ * The mount point releases 0.18.1-era bound the operator's install at, kept
+ * only as the retirement target `setup host` and `reconcile-units` remove
+ * (#895). Nothing mounts it any more: worker sessions launch under the fleet
+ * account again (#894), so the harness resolves through ordinary Node/Bun
+ * resolution from this package's own install root.
  */
 export const WORKER_HARNESS_DIR = "/var/lib/omp-worker-harness";
 
-/** The bound `node_modules` itself. The leaf name is load-bearing: it is what
- *  Node/Bun resolution looks for walking up from the entry module. */
-export const WORKER_HARNESS_NODE_MODULES = join(WORKER_HARNESS_DIR, "node_modules");
-
 /**
  * The install root a module path sits in — its nearest ancestor named
  * `node_modules` — or `undefined` when it has none, which is this package
@@ -256,91 +220,3 @@ export function packageNodeModulesRoot(modulePath: string): string | undefined {
   const idx = parts.lastIndexOf("node_modules");
   return idx < 0 ? undefined : `/${parts.slice(0, idx + 1).join("/")}`;
 }
-
-/**
- * `path` as a worker session sees it through the harness binding, or
- * `undefined` when it is not inside `packageRoot` — a test seam pointing at a
- * file elsewhere, or a source checkout with no install root at all.
- *
- * Production uses {@link WORKER_HARNESS_NODE_MODULES}; an explicit binding
- * root lets the Linux regression build the same inode-sharing tree under its
- * private temporary directory instead of touching the live host mount.
- */
-export function workerHarnessPath(
-  path: string,
-  packageRoot: string | undefined,
-  bindingRoot: string = WORKER_HARNESS_NODE_MODULES,
-): string | undefined {
-  if (packageRoot === undefined) return undefined;
-  const absolute = resolve(path);
-  const prefix = `${packageRoot}/`;
-  if (!absolute.startsWith(prefix)) return undefined;
-  return join(bindingRoot, absolute.slice(prefix.length));
-}
-
-/** One path's filesystem identity. Identity rather than bytes, because that is
- *  exactly what distinguishes a live bind of the operator's install (same
- *  device and inode) from an empty mount point or a copy that has drifted. */
-function pathIdentity(path: string): string | undefined {
-  try {
-    const st = statSync(path);
-    return `${st.dev}:${st.ino}`;
-  } catch {
-    return undefined;
-  }
-}
-
-/** Read-only facts {@link harnessBindingProblem} decides on; injected by tests. */
-export interface HarnessBindingDeps {
-  /** This module's own directory — the install root is derived from it. */
-  moduleDir?: string;
-  /** `dev:ino` of one path, or `undefined` when it cannot be stat'ed. */
-  identity?: (path: string) => string | undefined;
-  /** Alternate binding root for the isolated Linux currentness regression. */
-  bindingRoot?: string;
-}
-
-/**
- * Why a worker session could not load the operator's harness through the
- * binding, or `undefined` when it can.
- *
- * Both halves of the launch are checked, by filesystem identity: this package's
- * own directory (the child's entry module comes from it) and the harness
- * package directory (its peer import resolves to it). A mount point that is
- * empty, stale, or bound to some other tree fails on the identity comparison
- * rather than being taken on faith — which is the whole point, since the
- * symptom this replaces was a *successful* import of the wrong build.
- */
-export function harnessBindingProblem(deps: HarnessBindingDeps = {}): string | undefined {
-  const moduleDir = deps.moduleDir ?? import.meta.dir;
-  const identity = deps.identity ?? pathIdentity;
-  const bindingRoot = deps.bindingRoot ?? WORKER_HARNESS_NODE_MODULES;
-  const packageRoot = packageNodeModulesRoot(moduleDir);
-  if (packageRoot === undefined) {
-    return (
-      `omp-conductor is running from ${moduleDir}, which is not inside a node_modules install root — ` +
-      "a worker session resolves its harness through a read-only bind of that root, so worker dispatch " +
-      "needs the installed package (install omp-conductor with its harness peer, then re-run `omp-conductor setup host`)"
-    );
-  }
-  for (const dir of [moduleDir, join(packageRoot, OMP_HARNESS_PACKAGE)]) {
-    const source = identity(dir);
-    if (source === undefined) {
-      return (
-        `${dir} is missing or unreadable — ${OMP_HARNESS_PACKAGE} must be installed alongside omp-conductor ` +
-        "for a worker session to load the same harness build the operator runs"
-      );
-    }
-    // Non-null by construction: `dir` is inside `packageRoot`.
-    const bound = workerHarnessPath(dir, packageRoot, bindingRoot) ?? dir;
-    if (identity(bound) !== source) {
-      return (
-        `${bound} does not resolve to ${dir} — the worker harness binding of ${packageRoot} at ` +
-        `${bindingRoot} is missing or stale, so a worker session would resolve a different ` +
-        "harness build (or none). Run `omp-conductor setup host` to establish it"
-      );
-    }
-  }
-  return undefined;
-}
-

package/src/omp.ts

@@ -641,6 +641,24 @@ export interface CreateSessionOptions {
    * its verb channel to this pid, and a channel accepts nothing until it is bound.
    */
   onSpawn?: (pid: number) => void;
+  /**
+   * The session's Herdr representation (#840), opened from the exact pid the
+   * spawn below reports and released when the child is gone.
+   *
+   * Injected rather than imported so this module keeps knowing nothing about
+   * Herdr: `createSession` owns the process, and whoever launches a *worker*
+   * owns whether that process should be visible in an operator's workspace. A
+   * caller that passes nothing gets today's behaviour exactly.
+   *
+   * `open` is called with the same pid, at the same instant, as
+   * {@link CreateSessionOptions.onSpawn} — the representation is of the
+   * authoritative child or of nothing. It must never throw and never block the
+   * launch: visibility is not a precondition for work.
+   */
+  pane?: {
+    open(pid: number): void;
+    release(): void;
+  };
   /**
    * Pre-spawn admission gate (#374). Consulted once, immediately after the
    * socket bind await and immediately before `Bun.spawn` — the last window a
@@ -805,6 +823,11 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
   // Synchronously, before a single await: the child cannot have connected yet, so
   // the caller's channel is bound before it can be reached.
   if (child.pid !== undefined) opts.onSpawn?.(child.pid);
+  // The workspace representation is of THIS pid or of nothing (#840). After the
+  // verb-channel bind above, because a pane is a convenience and the bind is a
+  // correctness boundary — and never before the child exists, which is what
+  // makes "bound to the exact session-host pid" true rather than nominal.
+  if (child.pid !== undefined) opts.pane?.open(child.pid);
 
   let stderrTail = "";
   const drain = async (stream: ReadableStream<Uint8Array> | undefined, prefix: string): Promise<void> => {
@@ -965,6 +988,12 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
     onExit();
     const exitCode = typeof code === "number" ? code : null;
     emitSessionExit(exitCode);
+    // The pid this pane spoke for is gone, so conductor stops speaking for it
+    // (#840) — on every exit path, crash and clean dispose alike, because a
+    // representation that outlives its process is a worker the workspace still
+    // shows as live. What happens to the pane itself is #841's policy; this only
+    // gives back the authority.
+    opts.pane?.release();
     // A child that cannot start writes `start-error` over the socket, not the
     // pipes — and its exit can be dispatched before the accept of a connection
     // that already completed in the kernel. Let the socket settle before the