omp-conductor 0.19.6 → 0.20.0

package/src/dashboard/app.js

@@ -574,6 +574,62 @@ function orDash(value, format) {
   return value === null || value === undefined ? "—" : format(value);
 }
 
+/**
+ * The attribution block (phase 4): where the spend went, as opposed to what it
+ * bought. Rendered in the empty case too — a dry queue is exactly when the
+ * daemon's own grooming sessions run, and that spend bought no outcome, which
+ * is the number an operator most wants to see.
+ */
+function renderAttribution(out, report) {
+  const models = report.models ?? [];
+  if (models.length > 0) {
+    const box = el("div", "chart");
+    box.appendChild(el("h4", undefined, "Per model (grouped on the model actually billed)"));
+    const rows = el("div", "summary");
+    for (const m of models) {
+      // Nothing metered at all is stated as unknown: "$0.00 metered" is true and
+      // still reads as free, which is the misreading this panel exists to
+      // prevent — the same rule the CLI's human form follows.
+      const cost =
+        m.spendUsd === 0 && m.unmeteredRuns === m.runs
+          ? "cost unknown — no run on this model metered"
+          : `${usd(m.spendUsd)} metered · ${orDash(m.spendPerMerge, usd)} / merge` +
+            (m.unmeteredRuns > 0 ? ` · ${m.unmeteredRuns} unmetered` : "");
+      rows.appendChild(statLine(m.model, `${m.runs} run(s) · ${m.merges} merge(s) · ${cost}`));
+    }
+    box.appendChild(rows);
+    out.appendChild(box);
+  }
+
+  const ran = (report.sessions ?? []).filter((s) => s.sessions > 0);
+  const unmeteredRoles = report.unmeteredRoles ?? [];
+  // Silence rather than a row of zeros: "no grooming ran" and "grooming cost
+  // nothing" are different claims, and only the first would be true.
+  if (ran.length === 0 && unmeteredRoles.length === 0) return;
+  const box = el("div", "chart");
+  box.appendChild(el("h4", undefined, "Daemon-owned sessions (not worker runs)"));
+  const rows = el("div", "summary");
+  for (const s of ran) {
+    // An unmetered session's cost is unknown, so it is stated as a count and
+    // never folded into the dollar figure as a zero.
+    const cost =
+      s.spendUsd === 0 && s.unmeteredSessions === s.sessions
+        ? "cost unknown — no session metered"
+        : `${usd(s.spendUsd)} metered` +
+          (s.unmeteredSessions > 0
+            ? ` · ${s.unmeteredSessions} unmetered (cost unknown, not $0.00)`
+            : "");
+    rows.appendChild(statLine(s.role, `${s.sessions} session(s) · ${s.turns} turn(s) · ${cost}`));
+  }
+  for (const role of unmeteredRoles) {
+    rows.appendChild(
+      statLine(role, "unmetered — no usage events observable, so the cost is unknown"),
+    );
+  }
+  box.appendChild(rows);
+  out.appendChild(box);
+}
+
 function hours(ms) {
   return `${(ms / 3_600_000).toFixed(1)}h`;
 }
@@ -594,6 +650,7 @@ async function refreshStats() {
       ),
     );
     out.appendChild(statLine("GitHub API calls", String(report.ghCalls)));
+    renderAttribution(out, report);
     return;
   }
 
@@ -657,6 +714,7 @@ async function refreshStats() {
       (v) => String(v),
     ),
   );
+  renderAttribution(out, report);
 }
 
 statsWindowBar.addEventListener("click", (event) => {

package/src/dashboard/controls.ts

@@ -47,6 +47,7 @@ import { makeTracker } from "../tracker/github.ts";
 import { dbPath, openStore } from "../store.ts";
 import { loadConfig, resolveCaps } from "../config.ts";
 import { acknowledgeUpgradeRecovery } from "../upgrade-verify.ts";
+import { httpAuthHeader, missingHttpTokenMessage } from "../http-token.ts";
 import type { ProjectConfig } from "../types.ts";
 
 /** The source string every dashboard mutation attributes itself with. */
@@ -265,8 +266,24 @@ export function dashboardAnswerDecision(id: string, body: unknown, d: ControlDep
 
 // ------------------------------------------------------- production wiring --
 
-/** Forward to the living daemon's own HTTP surface, or report there is none. */
-async function defaultProxy(
+/**
+ * Forward to the living daemon's own HTTP surface, or report there is none.
+ *
+ * Every route this forwards to is mutating, so the request carries the
+ * daemon's bearer token (Phase 4). Note this is deliberately *not* the
+ * dashboard's own token: the browser authenticated to the dashboard, and the
+ * dashboard authenticates to the daemon as a second, separately-scoped hop.
+ * A missing daemon token is its own answer rather than the 502 "no living
+ * daemon" — the daemon may be perfectly alive; what is missing is the
+ * credential file, and telling the operator "start the daemon" when it is
+ * already running would send them chasing the wrong thing.
+ *
+ * Exported so the suite can drive the *production* forwarder — the one that
+ * actually builds the request — against a stub daemon. Every other test injects
+ * `ControlDeps.proxy`, which by construction cannot prove this function sends
+ * the credential.
+ */
+export async function defaultProxy(
   project: ProjectConfig,
   path: string,
   body: unknown,
@@ -277,13 +294,15 @@ async function defaultProxy(
   // would apply an operator's action to the wrong fleet.
   if (record === undefined) return undefined;
   if (record.project !== undefined && record.project !== project.name) return undefined;
+  const auth = httpAuthHeader();
+  if (auth === undefined) return { status: 503, body: { error: missingHttpTokenMessage() } };
   // Cheap liveness first, so an unreachable daemon is a 502 rather than a
   // mutation attempt that hangs the browser.
   if (!(await healthCheck(record.port)).ok) return undefined;
   try {
     const res = await fetch(`http://127.0.0.1:${record.port}${path}`, {
       method: "PUT",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...auth },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(10_000),
     });

package/src/dashboard/server.ts

@@ -331,6 +331,10 @@ async function statsProducer(name: string, since: string): Promise<StatsReport |
       window,
       ghCalls: store.ghCallsBetween(window.sinceDay, window.untilDay),
       runs: store.statsRuns(name, window.sinceEpochMs),
+      // Phase 4 attribution: daemon-owned session spend lives in its own table,
+      // deliberately outside `runs`, so it is a second read rather than more
+      // rows in the first one.
+      sessions: store.sessionSpendSince(name, window.sinceEpochMs),
     });
   } finally {
     store.close();

package/src/diff-flags.ts

@@ -813,14 +813,35 @@ function claimRegion(body: string): string {
   return next === null ? rest : rest.slice(0, marker[0].length + next.index);
 }
 
+/**
+ * An executable token: the shape a claimed command's first word must have to
+ * be a program somebody could have run. Either an ordinary command name — an
+ * ASCII letter or `_` first, then letters, digits, `_`, `.`, `+`, `-` (`bun`,
+ * `bash`, `cd`, `export`, `omp-conductor`, `python3.12`) — or a `./`-relative
+ * executable path built from those same characters plus `/`
+ * (`./scripts/deploy.sh`).
+ *
+ * Nothing else is a command, and that exclusion is the whole point (#1039):
+ * this predicate used to accept any first word that merely lacked a `/`, so
+ * the malformed-JSON fixture `{not json` described in a PR's verified prose
+ * became a "claimed" command with no transcript match, and a green PR settled
+ * with a false `claimed-proof-missing`. The grammar therefore refuses
+ * punctuation-led fragments (`{not`, `{"kind":`, `[1,`), quote-led values
+ * (`"some value"`), tokens carrying `:` or `=` (config expressions like
+ * `retry.modelFallback: true`, env assignments), digit-led data literals
+ * (timestamps like `2026-08-24 09:14Z`) and flag-led spans (`--json`). An
+ * absolute path stays excluded as it always was: it carries `/` without the
+ * leading `./`.
+ */
+const EXECUTABLE_TOKEN = /^(?:[A-Za-z_][A-Za-z0-9_.+-]*|\.\/[A-Za-z0-9_.+\-/]+)$/;
+
 /** One backticked span that reads as a whole command: at least two shell words
- *  and a first word that is an executable (no path separator, or a `./` one).
+ *  and a first word that is an {@link EXECUTABLE_TOKEN}.
  *  A span that names a single file or a config key is not a command claim. */
 function claimedCommand(span: string): boolean {
   const words = span.split(/\s+/).filter((word) => word.length > 0);
   if (words.length < 2) return false;
-  const first = words[0] ?? "";
-  return first.startsWith("./") || !first.includes("/");
+  return EXECUTABLE_TOKEN.test(words[0] ?? "");
 }
 
 /**

package/src/doctor.ts

@@ -68,6 +68,7 @@ import {
   claimedTelegramTopics,
   lockPidAlive,
   pidAlive,
+  killOf,
   readTelegramChannel,
   readTelegramDmOwner,
   readTelegramPollState,
@@ -311,12 +312,11 @@ export interface DoctorDeps {
    *  claim-only verdict checks only. */
   armScanDirs?: (project: ProjectConfig) => readonly string[];
   /** Whether a recorded claim or dm-owner pid is live, with omp-telegram's
-   *  topics.ts semantics (EPERM is dead). */
+   *  topics.ts semantics (EPERM is dead). The one claim-liveness fact in this
+   *  package: topic-pin's dead partition, its exact-pin check, project
+   *  resolution and the telegram-plumbing verdict all derive from it, so two
+   *  rows cannot answer one claim differently (#987). */
   pidAlive?: (pid: number) => boolean;
-  /** Whether one claimed topic is live — the single fact `topic-pin` and
-   *  `telegram-plumbing` both read, so they cannot disagree about a claim
-   *  (#987). Defaults to {@link claimIsLive}. */
-  claimIsLive?: (claim: { pid?: number }) => boolean;
   /** The provider allowance window nearest its ceiling, from `omp usage --json`
    *  — what binds a subscription-billed fleet instead of a dollar cap (#984).
    *  `undefined` when the provider reports no comparable window. */
@@ -1401,12 +1401,16 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       `check omp-telegram's claim registry (threads.json in its state dir) is readable and the bridge is running, then re-run doctor — until then sends keep the pinned topic and degrade to the flat chat on a missing thread (#318)`,
     );
   }
-  // One liveness fact, shared with `telegram-plumbing` (#987). Before this the
-  // registry's rows were all treated as live here, so a pin aimed at a corpse
-  // read PASS while the plumbing row called the same claim dead.
+  // One liveness fact for everything this probe decides — the dead partition,
+  // the exact-pin check below and identity resolution all read
+  // `probes.pidAlive` through the same helper, so diverging injections cannot
+  // split the rows' answer again (#987). Before #987 every registry row was
+  // treated as live here, so a pin aimed at a corpse read PASS while the
+  // plumbing row called the same claim dead.
+  const isLive = (claim: { pid?: number }): boolean => claimIsLive(claim, killOf(probes.pidAlive));
   const all = result.claims;
-  const claims = all.filter((claim) => probes.claimIsLive(claim));
-  const dead = all.filter((claim) => !probes.claimIsLive(claim));
+  const claims = all.filter(isLive);
+  const dead = all.filter((claim) => !isLive(claim));
   // Named, never dropped: the row is the only index to the remote topic, so
   // deleting it strands the topic instead of cleaning it up.
   const deadNote =
@@ -1428,10 +1432,12 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       `[${p.name}] pinned topic ${pinned} — no live claims to compare (the bridge has claimed no topics yet); the pin stands`,
     );
   }
+  // `claims` is already the live partition, so a dead pinned row cannot win
+  // this check (#987).
   if (claims.some((claim) => claim.threadId === pinned)) {
     return passFinding("topic-pin", `[${p.name}] pinned topic ${pinned} is a live claim${deadNote}`);
   }
-  const match = resolveProjectClaim(claims, p.name);
+  const match = resolveProjectClaim(claims, p.name, probes.pidAlive);
   if (match.kind === "match") {
     return passFinding(
       "topic-pin",
@@ -2192,7 +2198,6 @@ export function defaultProbes(): Probes {
       return claimDir === cwdDir ? [cwdDir] : [cwdDir, claimDir];
     },
     pidAlive,
-    claimIsLive: (claim) => claimIsLive(claim),
     allowanceWindow: async () => bindingAllowanceWindow(await sharedUsageSource().read()),
     lockPidAlive,
     lockFresh: (mtimeMs) => Date.now() - mtimeMs < TELEGRAM_LOCK_FRESH_MS,

package/src/escalate.ts

@@ -467,11 +467,13 @@ export interface ClaimedTopic {
  * own maintenance, and every topic-addressed send silently degrades to the main
  * chat: tier-2 pages, reports, digests, arm challenges, direct messages (#407).
  *
- * The operator's pin still wins whenever it is live. Only a pin that is
- * *provably* absent from the current claims is replaced, and only by the claim
- * this project can be identified with — so a deliberately separate alerts topic
- * is never hijacked by the pane's own thread. Unavailable bridge state changes
- * nothing, and #318's stale-topic retry remains the last line of defence.
+ * The operator's pin still wins whenever it is live. Only a pin that no *live*
+ * claim carries is replaced, and only by the claim this project can be
+ * identified with — so a deliberately separate alerts topic is never hijacked
+ * by the pane's own thread. A dead row wearing the pin id does not keep it in
+ * place: the row is the bridge's past, not a destination (#987). Unavailable
+ * bridge state changes nothing, and #318's stale-topic retry remains the last
+ * line of defence.
  *
  * Identity is read from the herdr space first, and only then from the claim's
  * title. The bridge titles a topic `ownAgentName ?? basename(cwd)`, and both
@@ -483,14 +485,19 @@ export interface ClaimedTopic {
  * The substitution is logged, naming the project and which identity answered.
  * Never an id: a log line is a place these leak from.
  */
-export function resolveProjectTopicId(project: ProjectConfig): number | undefined {
+export function resolveProjectTopicId(project: ProjectConfig, alive?: (pid: number) => boolean): number | undefined {
   const pinned = project.escalation.telegramTopicId;
   if (pinned === undefined) return undefined;
   const result = claimedTelegramTopics();
   if (result.kind !== "ok" || result.claims.length === 0) return pinned;
   const claims = result.claims;
-  if (claims.some((claim) => claim.threadId === pinned)) return pinned;
-  const match = claimForProject(claims, project.name);
+  // The pin wins only while a *live* claim carries it; a dead pinned row falls
+  // through to the live-claim substitution below instead of winning the
+  // exact-pin check (#987).
+  if (claims.some((claim) => claim.threadId === pinned && claimIsLive(claim, alive === undefined ? undefined : killOf(alive)))) {
+    return pinned;
+  }
+  const match = claimForProject(claims, project.name, alive);
   if (match === undefined) return pinned;
   warn(
     `escalation.telegramTopicId for ${project.name} is no longer a claimed topic; ` +
@@ -519,25 +526,32 @@ export type ProjectClaim =
  * How the live claims answer to a project, identity spellings in order:
  * unique herdr space, then unique title.
  *
- * Ambiguity is not a coin toss: paging the wrong project's topic is worse
- * than the flat-chat degrade #318 already handles, and scanning the wrong
- * pane's session misses the reply entirely. The title is a fallback for
- * bridges that never captured a space, so it runs only when *no* claim
- * carries the project's space — several claims wearing the space is an
- * ambiguity the title cannot resolve, because the titled claim may be a
- * sibling pane, not this project (#626).
+ * Only live claims take part ({@link claimIsLive}): a dead row neither
+ * answers on its own nor turns this project's one live pane into an
+ * ambiguity (#987). Ambiguity is not a coin toss: paging the wrong project's
+ * topic is worse than the flat-chat degrade #318 already handles, and
+ * scanning the wrong pane's session misses the reply entirely. The title is
+ * a fallback for bridges that never captured a space, so it runs only when
+ * *no* live claim carries the project's space — several live claims wearing
+ * the space is an ambiguity the title cannot resolve, because the titled
+ * claim may be a sibling pane, not this project (#626).
  */
 export function resolveProjectClaim(
   claims: readonly ClaimedTopic[],
   projectName: string,
+  alive?: (pid: number) => boolean,
 ): ProjectClaim {
-  const bySpace = claims.filter((claim) => claim.workspaceLabel === projectName);
+  // Dead claims do not vote: a closed pane's row must not turn this project's
+  // one live claim into an ambiguity, and must not answer by title on its own
+  // (#987). Ambiguity among genuinely live claims is unchanged (#626).
+  const live = claims.filter((claim) => claimIsLive(claim, alive === undefined ? undefined : killOf(alive)));
+  const bySpace = live.filter((claim) => claim.workspaceLabel === projectName);
   if (bySpace.length > 0) {
     return bySpace.length === 1
       ? { kind: "match", claim: bySpace[0]! }
       : { kind: "ambiguous", claimants: bySpace };
   }
-  const byTitle = claims.filter((claim) => claim.name === projectName);
+  const byTitle = live.filter((claim) => claim.name === projectName);
   if (byTitle.length === 0) return { kind: "none" };
   return byTitle.length === 1
     ? { kind: "match", claim: byTitle[0]! }
@@ -556,8 +570,9 @@ export function resolveProjectClaim(
 export function claimForProject(
   claims: readonly ClaimedTopic[],
   projectName: string,
+  alive?: (pid: number) => boolean,
 ): ClaimedTopic | undefined {
-  const match = resolveProjectClaim(claims, projectName);
+  const match = resolveProjectClaim(claims, projectName, alive);
   return match.kind === "match" ? match.claim : undefined;
 }
 
@@ -574,10 +589,13 @@ export function claimForProject(
  * the claim names no file — the caller then falls back to the cwd-derived
  * directory, which is the honest answer for a host that predates claims.
  */
-export function resolveClaimedSessionFile(project: ProjectConfig): string | undefined {
+export function resolveClaimedSessionFile(
+  project: ProjectConfig,
+  alive?: (pid: number) => boolean,
+): string | undefined {
   const result = claimedTelegramTopics();
   if (result.kind !== "ok" || result.claims.length === 0) return undefined;
-  return claimForProject(result.claims, project.name)?.sessionFile;
+  return claimForProject(result.claims, project.name, alive)?.sessionFile;
 }
 
 /**
@@ -1111,7 +1129,7 @@ export type TelegramPlumbingScan = { dirs: readonly string[] };
  * Throwing is how `pidAlive` spells "dead", which is the contract it applies to
  * whatever this returns.
  */
-function killOf(alive: (pid: number) => boolean): (target: number, signal: number) => void {
+export function killOf(alive: (pid: number) => boolean): (target: number, signal: number) => void {
   return (target) => {
     if (!alive(target)) throw new Error("not alive");
   };

package/src/failure-class.ts

@@ -62,6 +62,16 @@ const INFRA_CHECK_STATES: Record<string, true> = {
 /** States that mean "this check has a verdict and it is good". */
 const SUCCESS_CHECK_STATES: Record<string, true> = { success: true, neutral: true };
 
+/**
+ * The runner's own sentence for "the agent under this job went away": written
+ * when the runner service is stopped, auto-updates, or is torn down under a
+ * live job. Named once because two different accountings quote it — the
+ * implementation-attempt waiver below ({@link INFRA_LOG_SIGNATURES}, #177) and
+ * the review-correction waiver ({@link runnerInfraFailure}) — and a second
+ * spelling of it would waive one while charging the other.
+ */
+const RUNNER_SHUTDOWN_SIGNAL = "the runner has received a shutdown signal";
+
 /**
  * Substrings in a failed check's log that prove the failure was infrastructure,
  * not the diff (#177). Each is a registry/docker/runner fault a worker cannot
@@ -87,7 +97,7 @@ const INFRA_LOG_SIGNATURES = [
   // the runner's, and must not be waived (#637, #639).
   "response status code does not indicate success: 429 (too many requests)",
   "failed to resolve source metadata for",
-  "the runner has received a shutdown signal",
+  RUNNER_SHUTDOWN_SIGNAL,
   "could not resolve host",
 ];
 
@@ -103,6 +113,70 @@ export function infraLogSignature(log: string): string | undefined {
   return INFRA_LOG_SIGNATURES.find((signature) => lower.includes(signature));
 }
 
+/**
+ * Runner-infrastructure wordings: a red check whose own text says the *runner*
+ * failed, not the diff (Phase 3, #1043 lane). Matched lowercased as substrings
+ * against the failing job's log — the same surface {@link infraLogSignature}
+ * reads — and each entry is the real GitHub Actions sentence, verified against
+ * the runner's own reports rather than invented:
+ *
+ * Kept as its own list rather than folded into {@link INFRA_LOG_SIGNATURES}
+ * for two reasons. The consumers differ: that list waives an *implementation
+ * attempt* for a settled run (#177), this one waives a *correction round* for
+ * a live pull request's red check. And {@link infraSignatureVersion} is a
+ * persisted cursor fingerprint — growing that list restarts the historical
+ * reconciliation, which recognising a runner-lost red has no business doing.
+ * The one overlap, {@link RUNNER_SHUTDOWN_SIGNAL}, is shared by reference so
+ * the two accountings can never disagree about that wording.
+ */
+const RUNNER_INFRA_SIGNATURES = [
+  // "The self-hosted runner: <name> lost communication with the server." and
+  // its hosted sibling "The hosted runner: <name> lost communication with the
+  // server." — the runner process was killed, starved or cut off mid-job
+  // (actions/runner#3539, community#84877, community#173431). The name varies,
+  // so only the invariant tail is matched.
+  "lost communication with the server",
+  // The runner service was stopped or auto-updated under the job: an
+  // infrastructure cancellation, not a verdict on the diff.
+  RUNNER_SHUTDOWN_SIGNAL,
+  // "The job was not acquired by Runner of type hosted even after multiple
+  // attempts" — the job never reached a runner at all, so nothing in the diff
+  // was ever executed (community#186216, community#165287).
+  "was not acquired by runner",
+  // "The hosted runner encountered an error while running your job. (Error
+  // Type: Failure)." — GitHub's own statement that its runner broke
+  // (community#126539). The parenthesised error type varies; the sentence does
+  // not.
+  "the hosted runner encountered an error while running your job",
+];
+
+/**
+ * The runner-infrastructure wording a red CI check's text carries, or
+ * `undefined` when it carries none.
+ *
+ * Exists so the review-correction accounting can decline to charge a
+ * correction round for a red that the worker's diff did not cause: a lost
+ * runner, a runner shut down under the job, or a job no runner ever picked up.
+ * The return value is the matched wording, so whatever waives a round can say
+ * *which* sentence waived it instead of asserting "infra" unexplained.
+ *
+ * Fails closed in both directions, and deliberately narrower than it could be:
+ *
+ * - Unclassifiable, empty or unread text is `undefined` — an unexplained red
+ *   still counts, and a log-fetch failure hands this function nothing to match,
+ *   so it never waives.
+ * - "The operation was canceled." is *not* here: it is what a failed `needs:`
+ *   dependency and an operator's own cancel both print, so matching it would
+ *   waive rounds for ordinary red.
+ * - "…has exceeded the maximum execution time of N minutes" is *not* here
+ *   either: a job that ran until the ceiling is usually a hanging test or an
+ *   infinite loop, which is exactly the diff's problem to fix.
+ */
+export function runnerInfraFailure(log: string): string | undefined {
+  const lower = log.toLowerCase();
+  return RUNNER_INFRA_SIGNATURES.find((signature) => lower.includes(signature));
+}
+
 /**
  * The cap kills that produced nothing: the worker reached a ceiling with no PR,
  * no observed head and no salvage commit.