omp-conductor 0.19.1 → 0.19.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",
@@ -29,7 +29,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "check": "tsc --noEmit && bun run src/check-trailing-newlines.ts",
+    "check": "tsc --noEmit && bun run src/check-trailing-newlines.ts && bun run src/check-browser-js.ts",
     "test": "bun test",
     "schema": "bun run src/generate-schema.ts"
   },

package/src/check-browser-js.ts

@@ -0,0 +1,72 @@
+/**
+ * Gate: every browser script this package serves must parse.
+ *
+ * Run via `bun run check` from the package root, beside the trailing-newline
+ * gate. `tsc` never sees `src/dashboard/app.js` — it is plain browser JS,
+ * shipped as an asset and loaded by a `<script>` tag — and no test executes
+ * it, so nothing in the pipeline had an opinion about whether it was even
+ * syntactically valid.
+ *
+ * It was not. 0.19.0 shipped an `app.js` carrying four `__omp_shell("…")`
+ * fragments where `!answer.ok` and `!confirmDestructive(` should have been:
+ * the authoring session wrote the file through a Python eval path, whose
+ * IPython-style `!cmd` shell escape rewrote every line that began with `!`.
+ * A single SyntaxError takes the whole script with it, so the dashboard
+ * rendered its static `<h1>` and nothing else — no token prompt, no fleet —
+ * and looked, from the outside, like an auth or data problem (#981).
+ *
+ * A parse is the whole check. It is not a linter and has no opinion about
+ * style: it asks the one question a served script must answer yes to.
+ */
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Tracked browser scripts, repo-root-relative. */
+export const BROWSER_SCRIPTS: readonly string[] = ["omp/src/dashboard/app.js"];
+
+/**
+ * The parse error for one script, or null when it parses. Uses Bun's own
+ * transpiler: a full parse of the source, without executing a line of it (the
+ * script drives a DOM this process does not have).
+ */
+export function parseFailure(source: string, path: string): string | null {
+  try {
+    new Bun.Transpiler({ loader: "js", target: "browser" }).transformSync(source);
+    return null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return `${path}: ${message.split("\n")[0]}`;
+  }
+}
+
+/** One violation line per unparseable script, so a run names every offender. */
+export function findViolations(
+  paths: readonly string[],
+  read: (path: string) => string,
+): string[] {
+  const violations: string[] = [];
+  for (const path of paths) {
+    const failure = parseFailure(read(path), path);
+    if (failure !== null) violations.push(failure);
+  }
+  return violations;
+}
+
+function repoRoot(): string {
+  return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+}
+
+if (import.meta.main) {
+  const root = repoRoot();
+  const violations = findViolations(BROWSER_SCRIPTS, (path) =>
+    readFileSync(join(root, path), "utf8"),
+  );
+  if (violations.length > 0) {
+    for (const violation of violations) console.error(violation);
+    console.error(`browser script gate: ${violations.length} script(s) do not parse`);
+    process.exit(1);
+  }
+  console.log("browser script gate: ok");
+}

package/src/dashboard/app.js

@@ -140,7 +140,7 @@ async function runControl(path, body, describe) {
         : JSON.stringify(answer.body);
     showControlResult(
       answer.ok ? `${describe}: ok` : `${describe} refused (${answer.status}): ${detail}`,
-      __omp_shell("answer.ok,")
+      !answer.ok,
     );
   } catch (err) {
     showControlResult(`${describe} failed: ${String(err.message ?? err)}`, true);
@@ -188,7 +188,7 @@ controls.addEventListener("click", (event) => {
   if (reason === null || reason.trim() === "") return;
   if (
     action === "hold" &&
-    __omp_shell("confirmDestructive(")
+    !confirmDestructive(
       "Hold stops new claims AND disarms ticks. Re-arming needs a Telegram challenge answered in the chat. Continue?",
     )
   ) {
@@ -447,7 +447,7 @@ function renderRunControls(issue) {
     const reason = window.prompt(`Reason for stopping #${issue} (recorded in the run's report):`);
     if (reason === null || reason.trim() === "") return;
     if (
-      __omp_shell("confirmDestructive(")
+      !confirmDestructive(
         `Stop #${issue}? This settles the run terminally, salvages its tree and frees the slot. It cannot be resumed.`,
       )
     ) {
@@ -474,7 +474,7 @@ function renderRunControls(issue) {
   );
   button("Unblock --force", "destructive", () => {
     if (
-      __omp_shell("confirmDestructive(")
+      !confirmDestructive(
         `Force-unblock #${issue}? This accepts the loss of uncommitted work in its worktree, which may be the only copy.`,
       )
     ) {