omp-conductor 0.19.0 → 0.19.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",
@@ -29,7 +29,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "check": "tsc --noEmit && bun run src/check-trailing-newlines.ts",
+    "check": "tsc --noEmit && bun run src/check-trailing-newlines.ts && bun run src/check-browser-js.ts",
     "test": "bun test",
     "schema": "bun run src/generate-schema.ts"
   },

package/src/check-browser-js.ts

@@ -0,0 +1,72 @@
+/**
+ * Gate: every browser script this package serves must parse.
+ *
+ * Run via `bun run check` from the package root, beside the trailing-newline
+ * gate. `tsc` never sees `src/dashboard/app.js` — it is plain browser JS,
+ * shipped as an asset and loaded by a `<script>` tag — and no test executes
+ * it, so nothing in the pipeline had an opinion about whether it was even
+ * syntactically valid.
+ *
+ * It was not. 0.19.0 shipped an `app.js` carrying four `__omp_shell("…")`
+ * fragments where `!answer.ok` and `!confirmDestructive(` should have been:
+ * the authoring session wrote the file through a Python eval path, whose
+ * IPython-style `!cmd` shell escape rewrote every line that began with `!`.
+ * A single SyntaxError takes the whole script with it, so the dashboard
+ * rendered its static `<h1>` and nothing else — no token prompt, no fleet —
+ * and looked, from the outside, like an auth or data problem (#981).
+ *
+ * A parse is the whole check. It is not a linter and has no opinion about
+ * style: it asks the one question a served script must answer yes to.
+ */
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Tracked browser scripts, repo-root-relative. */
+export const BROWSER_SCRIPTS: readonly string[] = ["omp/src/dashboard/app.js"];
+
+/**
+ * The parse error for one script, or null when it parses. Uses Bun's own
+ * transpiler: a full parse of the source, without executing a line of it (the
+ * script drives a DOM this process does not have).
+ */
+export function parseFailure(source: string, path: string): string | null {
+  try {
+    new Bun.Transpiler({ loader: "js", target: "browser" }).transformSync(source);
+    return null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return `${path}: ${message.split("\n")[0]}`;
+  }
+}
+
+/** One violation line per unparseable script, so a run names every offender. */
+export function findViolations(
+  paths: readonly string[],
+  read: (path: string) => string,
+): string[] {
+  const violations: string[] = [];
+  for (const path of paths) {
+    const failure = parseFailure(read(path), path);
+    if (failure !== null) violations.push(failure);
+  }
+  return violations;
+}
+
+function repoRoot(): string {
+  return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+}
+
+if (import.meta.main) {
+  const root = repoRoot();
+  const violations = findViolations(BROWSER_SCRIPTS, (path) =>
+    readFileSync(join(root, path), "utf8"),
+  );
+  if (violations.length > 0) {
+    for (const violation of violations) console.error(violation);
+    console.error(`browser script gate: ${violations.length} script(s) do not parse`);
+    process.exit(1);
+  }
+  console.log("browser script gate: ok");
+}

package/src/dashboard/app.js

@@ -140,7 +140,7 @@ async function runControl(path, body, describe) {
         : JSON.stringify(answer.body);
     showControlResult(
       answer.ok ? `${describe}: ok` : `${describe} refused (${answer.status}): ${detail}`,
-      __omp_shell("answer.ok,")
+      !answer.ok,
     );
   } catch (err) {
     showControlResult(`${describe} failed: ${String(err.message ?? err)}`, true);
@@ -188,7 +188,7 @@ controls.addEventListener("click", (event) => {
   if (reason === null || reason.trim() === "") return;
   if (
     action === "hold" &&
-    __omp_shell("confirmDestructive(")
+    !confirmDestructive(
       "Hold stops new claims AND disarms ticks. Re-arming needs a Telegram challenge answered in the chat. Continue?",
     )
   ) {
@@ -447,7 +447,7 @@ function renderRunControls(issue) {
     const reason = window.prompt(`Reason for stopping #${issue} (recorded in the run's report):`);
     if (reason === null || reason.trim() === "") return;
     if (
-      __omp_shell("confirmDestructive(")
+      !confirmDestructive(
         `Stop #${issue}? This settles the run terminally, salvages its tree and frees the slot. It cannot be resumed.`,
       )
     ) {
@@ -474,7 +474,7 @@ function renderRunControls(issue) {
   );
   button("Unblock --force", "destructive", () => {
     if (
-      __omp_shell("confirmDestructive(")
+      !confirmDestructive(
         `Force-unblock #${issue}? This accepts the loss of uncommitted work in its worktree, which may be the only copy.`,
       )
     ) {

package/src/doctor.ts

@@ -55,7 +55,7 @@ import { ompSettingsOverlay, sessionRootDir } from "./omp-settings.ts";
 import {
   DEFAULT_HERDR_UNIT,
   probeTelegramHealth,
-  resolveHerdrSessionWithBridge,
+  resolveHerdrSession,
   resolveTickConfig,
   sessionsRoot,
   sessionDirForCwd,
@@ -2003,7 +2003,7 @@ export function defaultProbes(): Probes {
     workerHarness: defaultWorkerHarness,
     pidLive: (pid) => pidAlive(pid),
     herdrAgents: defaultHerdrAgents,
-    herdrSession: () => resolveHerdrSessionWithBridge(),
+    herdrSession: () => resolveHerdrSession(),
     herdrConfig: defaultHerdrConfig,
     herdrEnv: defaultHerdrEnv,
     claimedTopics: () => claimedTelegramTopics(),

package/src/fleet.ts

@@ -105,10 +105,11 @@ export const PANE_HALT_FILE = ".conductor-pane-halted";
 export const DEFAULT_HERDR_UNIT = "herdr-fleet.service";
 
 /**
- * Default Herdr session name for conductor fleets. Renamed from `fleet` in
- * #320; `HERDR_SESSION` still wins when set. Legacy hosts that still run a
- * session named `fleet` are bridged for one release by
- * {@link resolveHerdrSession}.
+ * The Herdr session conductor fleets run in. `HERDR_SESSION` wins when set;
+ * this is the only other name any surface may resolve. #320 renamed it from
+ * `fleet` and shipped a one-release probe that preferred a populated legacy
+ * session; #976 removed that probe, because a name resolved two ways is a
+ * name two surfaces can disagree about — and they did, in `upgrade`.
  */
 export const DEFAULT_HERDR_SESSION = "conductor";
 
@@ -121,32 +122,13 @@ export const DEFAULT_HERDR_SESSION = "conductor";
 export const DEFAULT_FLEET_AGENT_NAME = "fleet";
 export const ARM_CHALLENGE_TIMEOUT_MS = 300_000;
 
-
-/** Pre-#320 session name. Bridged for one release when `conductor` is empty. */
-const LEGACY_HERDR_SESSION = "fleet";
-
-export const LEGACY_HERDR_SESSION_HINT =
-  'herdr session "fleet" found — rename it to "conductor" or run omp-conductor setup host to pin HERDR_SESSION=fleet (remove this bridge next minor)';
-
-let legacyHerdrSessionHintPrinted = false;
-
-function noteLegacyHerdrSession(log?: (message: string) => void): void {
-  if (legacyHerdrSessionHintPrinted) return;
-  legacyHerdrSessionHintPrinted = true;
-  if (log) log(LEGACY_HERDR_SESSION_HINT);
-  else console.warn(LEGACY_HERDR_SESSION_HINT);
-}
-
-/** Reset the once-per-process rename hint (tests). */
-export function resetLegacyHerdrSessionHintForTests(): void {
-  legacyHerdrSessionHintPrinted = false;
-}
-
 /**
- * Resolve the Herdr session name. `HERDR_SESSION` is always authoritative.
- * When unset, default to {@link DEFAULT_HERDR_SESSION}. The one-release bridge
- * that prefers a populated legacy `fleet` session lives in
- * {@link resolveHerdrSessionWithBridge} — call that at probe sites.
+ * Resolve the Herdr session name — the single resolution every surface uses.
+ * `HERDR_SESSION` is authoritative; otherwise {@link DEFAULT_HERDR_SESSION}.
+ * Never probe for an alternative name here: a session that answers is not
+ * evidence of which session this fleet is, and the probe that assumed it was
+ * is what made `upgrade` install against `fleet` and verify against
+ * `conductor` (#976).
  */
 export function resolveHerdrSession(env: NodeJS.ProcessEnv = process.env): string {
   const explicit = env["HERDR_SESSION"];
@@ -154,56 +136,6 @@ export function resolveHerdrSession(env: NodeJS.ProcessEnv = process.env): strin
   return DEFAULT_HERDR_SESSION;
 }
 
-function herdrAgentListRaw(
-  session: string,
-  bin: string,
-  env: NodeJS.ProcessEnv,
-): { ok: true; agents: HerdrAgent[] } | { ok: false } {
-  const res = spawnSync(bin, ["--session", session, "agent", "list"], {
-    encoding: "utf8",
-    timeout: 8_000,
-    env,
-  });
-  if (res.error || res.status !== 0) return { ok: false };
-  try {
-    return { ok: true, agents: parseHerdrAgentList(res.stdout ?? "") };
-  } catch {
-    return { ok: false };
-  }
-}
-
-/**
- * One-release bridge (#320): when `HERDR_SESSION` is unset, a `conductor`
- * session with no agents while a `fleet` session answers → use `fleet` and
- * print the rename hint once. Remove next minor.
- */
-export function resolveHerdrSessionWithBridge(opts: {
-  env?: NodeJS.ProcessEnv;
-  herdrBin?: string;
-  log?: (message: string) => void;
-} = {}): string {
-  const env = opts.env ?? process.env;
-  const explicit = env["HERDR_SESSION"];
-  if (explicit !== undefined && explicit.length > 0) return explicit;
-
-  const bin = opts.herdrBin ?? "herdr";
-  const primary = herdrAgentListRaw(DEFAULT_HERDR_SESSION, bin, env);
-  if (primary.ok && primary.agents.length > 0) return DEFAULT_HERDR_SESSION;
-
-  const legacy = herdrAgentListRaw(LEGACY_HERDR_SESSION, bin, env);
-  if (legacy.ok && legacy.agents.length > 0) {
-    noteLegacyHerdrSession(opts.log);
-    return LEGACY_HERDR_SESSION;
-  }
-  // conductor answered (even empty) wins over a dead legacy session.
-  if (primary.ok) return DEFAULT_HERDR_SESSION;
-  if (legacy.ok) {
-    noteLegacyHerdrSession(opts.log);
-    return LEGACY_HERDR_SESSION;
-  }
-  return DEFAULT_HERDR_SESSION;
-}
-
 export function telegramStateDir(): string {
   const override = process.env["OMP_TELEGRAM_STATE_DIR"];
   if (override !== undefined && override.length > 0) return override;
@@ -1382,9 +1314,7 @@ export async function stopConductorPane(
 
 async function herdrAgentList(deps: PaneStopDeps): Promise<HerdrAgent[]> {
   const bin = deps.herdrBin ?? "herdr";
-  const session =
-    deps.herdrSession ??
-    resolveHerdrSessionWithBridge({ env: process.env, herdrBin: bin });
+  const session = deps.herdrSession ?? resolveHerdrSession(process.env);
   const res = spawnSync(bin, ["--session", session, "agent", "list"], {
     encoding: "utf8",
     timeout: 8_000,
@@ -1485,9 +1415,7 @@ export function parseHerdrProcessInfo(stdout: string, paneId: string): ProcessIn
 
 async function herdrOmpForegroundPids(paneId: string, deps: PaneStopDeps): Promise<number[]> {
   const bin = deps.herdrBin ?? "herdr";
-  const session =
-    deps.herdrSession ??
-    resolveHerdrSessionWithBridge({ env: process.env, herdrBin: bin });
+  const session = deps.herdrSession ?? resolveHerdrSession(process.env);
   const res = spawnSync(bin, ["--session", session, "pane", "process-info", "--pane", paneId], {
     encoding: "utf8",
     timeout: 8_000,
@@ -2539,7 +2467,7 @@ function probeOmpPane(
   }
   const agentName =
     tick.kind === "ok" ? (tick.config.agentName ?? DEFAULT_FLEET_AGENT_NAME) : DEFAULT_FLEET_AGENT_NAME;
-  const session = resolveHerdrSessionWithBridge({ env: process.env });
+  const session = resolveHerdrSession(process.env);
   try {
     const res = spawnSync("herdr", ["--session", session, "agent", "list"], {
       encoding: "utf8",

package/src/setup-host.ts

@@ -9,7 +9,7 @@ import {
   DEFAULT_FLEET_AGENT_NAME,
   DEFAULT_HERDR_SESSION,
   DEFAULT_HERDR_UNIT,
-  resolveHerdrSessionWithBridge,
+  resolveHerdrSession,
 } from "./fleet.ts";
 import {
   WORKER_HARNESS_DIR,
@@ -612,9 +612,9 @@ export function canonicalBinSearchPath(home: string = homedir()): string {
 
 export function defaultServiceRuntime(
   telegramStateDir: string,
-  // Bridge-resolved session name. Passed in so tests stay hermetic (no herdr
-  // spawn) and the renderer never shells out — same threading as telegramStateDir.
-  herdrSession: string = resolveHerdrSessionWithBridge(),
+  // The one resolved session name (#976). Passed in so tests stay hermetic and
+  // the renderer never shells out — same threading as telegramStateDir.
+  herdrSession: string = resolveHerdrSession(),
   // The canonical search path (#890), injectable for the same reason: a test
   // must be able to prove the render does not move when the CALLER's PATH does,
   // which means controlling what "installed here" means without touching the

package/src/upgrade.ts

@@ -4,9 +4,7 @@ import { backupTimestamp, copyToUniqueBackup } from "./backups.ts";
 import { inspectBriefLayout, type BriefLayout } from "./brief-upgrade.ts";
 import { pauseInstance, setPaused, statusSnapshot, type AdmissionAckRecord } from "./daemon.ts";
 import {
-  DEFAULT_HERDR_SESSION,
   fleetLayers,
-  LEGACY_HERDR_SESSION_HINT,
   resolveHerdrSession,
   telegramStateDir,
 } from "./fleet.ts";
@@ -133,6 +131,14 @@ export interface UpgradeDeps {
   setPaused(value: boolean, project?: string): void;
   restartDaemon(): Promise<void>;
   sleep(ms: number): Promise<void>;
+  /**
+   * The environment every surface of this transaction resolves from — the
+   * herdr session included, through {@link resolveHerdrSession}. One source,
+   * because the `herdr plugin list` read and the pane probe MUST agree on
+   * which session this fleet is: when they did not, `upgrade` installed
+   * against one session and failed verification against another, then rolled
+   * a good release back (#976).
+   */
   env: NodeJS.ProcessEnv;
   log(message: string): void;
   /**
@@ -142,11 +148,6 @@ export interface UpgradeDeps {
    * session process actually loaded.
    */
   health(port: number): Promise<{ ok: boolean; body?: string }>;
-  /**
-   * The herdr session the fleet pane lives in, for the external-orchestrator
-   * pane probe (#832).
-   */
-  herdrSession(): string;
   /**
    * Every omp process the fleet pane currently claims by herdr, resolved to
    * its start time — the evidence an external (pane-owned) orchestrator
@@ -208,7 +209,6 @@ export const DEFAULT_DEPS: UpgradeDeps = {
     await restartDaemon({});
   },
   health: async (port) => healthCheck(port),
-  herdrSession: () => resolveHerdrSession(process.env),
   probePaneOmp: (session) => herdrPaneOmpStarts(runCommand, session, processStartTimeMs),
   // The bare host-global plan — the same render the advisory's `setup host`
   // command would install: no per-project tail, the recovery unit encoding no
@@ -430,32 +430,7 @@ export async function inspectSurfaces(
     if (version.length === 0) throw new Error("installed omp-conductor CLI has no version");
     return { cliVersion: version, ompVersion: ompPluginVersion(ompOnly.stdout) };
   }
-  // HERDR_SESSION is authoritative. Otherwise prefer DEFAULT_HERDR_SESSION, with
-  // #320's one-release bridge to a populated legacy "fleet" session.
-  let session = resolveHerdrSession(deps.env);
-  if (deps.env["HERDR_SESSION"] === undefined || deps.env["HERDR_SESSION"] === "") {
-    // Prefer a session that answers plugin list; fall back to conductor.
-    let conductorOk = false;
-    let fleetOk = false;
-    try {
-      const r = await deps.run("herdr", ["--session", DEFAULT_HERDR_SESSION, "plugin", "list"]);
-      conductorOk = r.code === 0;
-    } catch {
-      conductorOk = false;
-    }
-    try {
-      const r = await deps.run("herdr", ["--session", "fleet", "plugin", "list"]);
-      fleetOk = r.code === 0;
-    } catch {
-      fleetOk = false;
-    }
-    if (!conductorOk && fleetOk) {
-      session = "fleet";
-      deps.log(LEGACY_HERDR_SESSION_HINT);
-    } else {
-      session = DEFAULT_HERDR_SESSION;
-    }
-  }
+  const session = resolveHerdrSession(deps.env);
   const [cli, omp, herdr] = await Promise.all([
     mustRun(deps, "omp-conductor", ["--version"]),
     mustRun(deps, "omp", ["plugin", "list", "--json"]),
@@ -908,7 +883,7 @@ async function sessionVerifyProblem(
     // No daemon to attest: only the pane could have reloaded anything, so the
     // pane probe decides alone, exactly as the external leg of the detached
     // verifier does.
-    const pane = await deps.probePaneOmp(deps.herdrSession());
+    const pane = await deps.probePaneOmp(resolveHerdrSession(deps.env));
     if ("problem" in pane) return `the fleet pane could not be probed: ${pane.problem}`;
     return paneRestartProblem(pane.starts, reloadAfterMs) ?? undefined;
   }
@@ -934,7 +909,7 @@ async function sessionVerifyProblem(
   if (names.length === 0) {
     return `the restarted daemon's /healthz on :${port} named no project — the live session cannot be attested`;
   }
-  const pane = await deps.probePaneOmp(deps.herdrSession());
+  const pane = await deps.probePaneOmp(resolveHerdrSession(deps.env));
   for (const project of names) {
     const problem = sessionReloadProblem({
       facts: orchestratorFactsFromHealth(health.body, project),
@@ -1388,6 +1363,23 @@ export async function upgradeConductor(
   }
   if (initial.herdr === "unknown") throw new Error("cannot determine whether herdr-fleet.service is active");
 
+  // The one verification input that can be read before anything moves (#976).
+  // Verification probes the fleet pane in `resolveHerdrSession(deps.env)`; a
+  // host whose session answers to another name only discovers that after three
+  // installs and two restarts, and a good release is then rolled back. Read it
+  // first: the same probe, at zero cost, as a refusal.
+  if (!detached && (initial.dispatch !== "stopped" || initial.herdr === "active")) {
+    const session = resolveHerdrSession(deps.env);
+    const pane = await deps.probePaneOmp(session);
+    if ("problem" in pane) {
+      throw new Error(
+        `the fleet pane in herdr session "${session}" cannot be probed, so this upgrade could not be ` +
+          `verified: ${pane.problem}. Set HERDR_SESSION to the session that owns the fleet pane and ` +
+          `re-run, or bring that session up first — nothing has been installed.`,
+      );
+    }
+  }
+
   if (detached) {
     // The durable record the returning process rolls back or verifies against:
     // what was installed, what dispatch state the fleet began in, which pause