omp-conductor 0.19.7 → 0.20.0

package/src/dashboard/app.js

@@ -574,6 +574,62 @@ function orDash(value, format) {
   return value === null || value === undefined ? "—" : format(value);
 }
 
+/**
+ * The attribution block (phase 4): where the spend went, as opposed to what it
+ * bought. Rendered in the empty case too — a dry queue is exactly when the
+ * daemon's own grooming sessions run, and that spend bought no outcome, which
+ * is the number an operator most wants to see.
+ */
+function renderAttribution(out, report) {
+  const models = report.models ?? [];
+  if (models.length > 0) {
+    const box = el("div", "chart");
+    box.appendChild(el("h4", undefined, "Per model (grouped on the model actually billed)"));
+    const rows = el("div", "summary");
+    for (const m of models) {
+      // Nothing metered at all is stated as unknown: "$0.00 metered" is true and
+      // still reads as free, which is the misreading this panel exists to
+      // prevent — the same rule the CLI's human form follows.
+      const cost =
+        m.spendUsd === 0 && m.unmeteredRuns === m.runs
+          ? "cost unknown — no run on this model metered"
+          : `${usd(m.spendUsd)} metered · ${orDash(m.spendPerMerge, usd)} / merge` +
+            (m.unmeteredRuns > 0 ? ` · ${m.unmeteredRuns} unmetered` : "");
+      rows.appendChild(statLine(m.model, `${m.runs} run(s) · ${m.merges} merge(s) · ${cost}`));
+    }
+    box.appendChild(rows);
+    out.appendChild(box);
+  }
+
+  const ran = (report.sessions ?? []).filter((s) => s.sessions > 0);
+  const unmeteredRoles = report.unmeteredRoles ?? [];
+  // Silence rather than a row of zeros: "no grooming ran" and "grooming cost
+  // nothing" are different claims, and only the first would be true.
+  if (ran.length === 0 && unmeteredRoles.length === 0) return;
+  const box = el("div", "chart");
+  box.appendChild(el("h4", undefined, "Daemon-owned sessions (not worker runs)"));
+  const rows = el("div", "summary");
+  for (const s of ran) {
+    // An unmetered session's cost is unknown, so it is stated as a count and
+    // never folded into the dollar figure as a zero.
+    const cost =
+      s.spendUsd === 0 && s.unmeteredSessions === s.sessions
+        ? "cost unknown — no session metered"
+        : `${usd(s.spendUsd)} metered` +
+          (s.unmeteredSessions > 0
+            ? ` · ${s.unmeteredSessions} unmetered (cost unknown, not $0.00)`
+            : "");
+    rows.appendChild(statLine(s.role, `${s.sessions} session(s) · ${s.turns} turn(s) · ${cost}`));
+  }
+  for (const role of unmeteredRoles) {
+    rows.appendChild(
+      statLine(role, "unmetered — no usage events observable, so the cost is unknown"),
+    );
+  }
+  box.appendChild(rows);
+  out.appendChild(box);
+}
+
 function hours(ms) {
   return `${(ms / 3_600_000).toFixed(1)}h`;
 }
@@ -594,6 +650,7 @@ async function refreshStats() {
       ),
     );
     out.appendChild(statLine("GitHub API calls", String(report.ghCalls)));
+    renderAttribution(out, report);
     return;
   }
 
@@ -657,6 +714,7 @@ async function refreshStats() {
       (v) => String(v),
     ),
   );
+  renderAttribution(out, report);
 }
 
 statsWindowBar.addEventListener("click", (event) => {

package/src/dashboard/controls.ts

@@ -47,6 +47,7 @@ import { makeTracker } from "../tracker/github.ts";
 import { dbPath, openStore } from "../store.ts";
 import { loadConfig, resolveCaps } from "../config.ts";
 import { acknowledgeUpgradeRecovery } from "../upgrade-verify.ts";
+import { httpAuthHeader, missingHttpTokenMessage } from "../http-token.ts";
 import type { ProjectConfig } from "../types.ts";
 
 /** The source string every dashboard mutation attributes itself with. */
@@ -265,8 +266,24 @@ export function dashboardAnswerDecision(id: string, body: unknown, d: ControlDep
 
 // ------------------------------------------------------- production wiring --
 
-/** Forward to the living daemon's own HTTP surface, or report there is none. */
-async function defaultProxy(
+/**
+ * Forward to the living daemon's own HTTP surface, or report there is none.
+ *
+ * Every route this forwards to is mutating, so the request carries the
+ * daemon's bearer token (Phase 4). Note this is deliberately *not* the
+ * dashboard's own token: the browser authenticated to the dashboard, and the
+ * dashboard authenticates to the daemon as a second, separately-scoped hop.
+ * A missing daemon token is its own answer rather than the 502 "no living
+ * daemon" — the daemon may be perfectly alive; what is missing is the
+ * credential file, and telling the operator "start the daemon" when it is
+ * already running would send them chasing the wrong thing.
+ *
+ * Exported so the suite can drive the *production* forwarder — the one that
+ * actually builds the request — against a stub daemon. Every other test injects
+ * `ControlDeps.proxy`, which by construction cannot prove this function sends
+ * the credential.
+ */
+export async function defaultProxy(
   project: ProjectConfig,
   path: string,
   body: unknown,
@@ -277,13 +294,15 @@ async function defaultProxy(
   // would apply an operator's action to the wrong fleet.
   if (record === undefined) return undefined;
   if (record.project !== undefined && record.project !== project.name) return undefined;
+  const auth = httpAuthHeader();
+  if (auth === undefined) return { status: 503, body: { error: missingHttpTokenMessage() } };
   // Cheap liveness first, so an unreachable daemon is a 502 rather than a
   // mutation attempt that hangs the browser.
   if (!(await healthCheck(record.port)).ok) return undefined;
   try {
     const res = await fetch(`http://127.0.0.1:${record.port}${path}`, {
       method: "PUT",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...auth },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(10_000),
     });

package/src/dashboard/server.ts

@@ -331,6 +331,10 @@ async function statsProducer(name: string, since: string): Promise<StatsReport |
       window,
       ghCalls: store.ghCallsBetween(window.sinceDay, window.untilDay),
       runs: store.statsRuns(name, window.sinceEpochMs),
+      // Phase 4 attribution: daemon-owned session spend lives in its own table,
+      // deliberately outside `runs`, so it is a second read rather than more
+      // rows in the first one.
+      sessions: store.sessionSpendSince(name, window.sinceEpochMs),
     });
   } finally {
     store.close();

package/src/diff-flags.ts

@@ -813,14 +813,35 @@ function claimRegion(body: string): string {
   return next === null ? rest : rest.slice(0, marker[0].length + next.index);
 }
 
+/**
+ * An executable token: the shape a claimed command's first word must have to
+ * be a program somebody could have run. Either an ordinary command name — an
+ * ASCII letter or `_` first, then letters, digits, `_`, `.`, `+`, `-` (`bun`,
+ * `bash`, `cd`, `export`, `omp-conductor`, `python3.12`) — or a `./`-relative
+ * executable path built from those same characters plus `/`
+ * (`./scripts/deploy.sh`).
+ *
+ * Nothing else is a command, and that exclusion is the whole point (#1039):
+ * this predicate used to accept any first word that merely lacked a `/`, so
+ * the malformed-JSON fixture `{not json` described in a PR's verified prose
+ * became a "claimed" command with no transcript match, and a green PR settled
+ * with a false `claimed-proof-missing`. The grammar therefore refuses
+ * punctuation-led fragments (`{not`, `{"kind":`, `[1,`), quote-led values
+ * (`"some value"`), tokens carrying `:` or `=` (config expressions like
+ * `retry.modelFallback: true`, env assignments), digit-led data literals
+ * (timestamps like `2026-08-24 09:14Z`) and flag-led spans (`--json`). An
+ * absolute path stays excluded as it always was: it carries `/` without the
+ * leading `./`.
+ */
+const EXECUTABLE_TOKEN = /^(?:[A-Za-z_][A-Za-z0-9_.+-]*|\.\/[A-Za-z0-9_.+\-/]+)$/;
+
 /** One backticked span that reads as a whole command: at least two shell words
- *  and a first word that is an executable (no path separator, or a `./` one).
+ *  and a first word that is an {@link EXECUTABLE_TOKEN}.
  *  A span that names a single file or a config key is not a command claim. */
 function claimedCommand(span: string): boolean {
   const words = span.split(/\s+/).filter((word) => word.length > 0);
   if (words.length < 2) return false;
-  const first = words[0] ?? "";
-  return first.startsWith("./") || !first.includes("/");
+  return EXECUTABLE_TOKEN.test(words[0] ?? "");
 }
 
 /**

package/src/failure-class.ts

@@ -62,6 +62,16 @@ const INFRA_CHECK_STATES: Record<string, true> = {
 /** States that mean "this check has a verdict and it is good". */
 const SUCCESS_CHECK_STATES: Record<string, true> = { success: true, neutral: true };
 
+/**
+ * The runner's own sentence for "the agent under this job went away": written
+ * when the runner service is stopped, auto-updates, or is torn down under a
+ * live job. Named once because two different accountings quote it — the
+ * implementation-attempt waiver below ({@link INFRA_LOG_SIGNATURES}, #177) and
+ * the review-correction waiver ({@link runnerInfraFailure}) — and a second
+ * spelling of it would waive one while charging the other.
+ */
+const RUNNER_SHUTDOWN_SIGNAL = "the runner has received a shutdown signal";
+
 /**
  * Substrings in a failed check's log that prove the failure was infrastructure,
  * not the diff (#177). Each is a registry/docker/runner fault a worker cannot
@@ -87,7 +97,7 @@ const INFRA_LOG_SIGNATURES = [
   // the runner's, and must not be waived (#637, #639).
   "response status code does not indicate success: 429 (too many requests)",
   "failed to resolve source metadata for",
-  "the runner has received a shutdown signal",
+  RUNNER_SHUTDOWN_SIGNAL,
   "could not resolve host",
 ];
 
@@ -103,6 +113,70 @@ export function infraLogSignature(log: string): string | undefined {
   return INFRA_LOG_SIGNATURES.find((signature) => lower.includes(signature));
 }
 
+/**
+ * Runner-infrastructure wordings: a red check whose own text says the *runner*
+ * failed, not the diff (Phase 3, #1043 lane). Matched lowercased as substrings
+ * against the failing job's log — the same surface {@link infraLogSignature}
+ * reads — and each entry is the real GitHub Actions sentence, verified against
+ * the runner's own reports rather than invented:
+ *
+ * Kept as its own list rather than folded into {@link INFRA_LOG_SIGNATURES}
+ * for two reasons. The consumers differ: that list waives an *implementation
+ * attempt* for a settled run (#177), this one waives a *correction round* for
+ * a live pull request's red check. And {@link infraSignatureVersion} is a
+ * persisted cursor fingerprint — growing that list restarts the historical
+ * reconciliation, which recognising a runner-lost red has no business doing.
+ * The one overlap, {@link RUNNER_SHUTDOWN_SIGNAL}, is shared by reference so
+ * the two accountings can never disagree about that wording.
+ */
+const RUNNER_INFRA_SIGNATURES = [
+  // "The self-hosted runner: <name> lost communication with the server." and
+  // its hosted sibling "The hosted runner: <name> lost communication with the
+  // server." — the runner process was killed, starved or cut off mid-job
+  // (actions/runner#3539, community#84877, community#173431). The name varies,
+  // so only the invariant tail is matched.
+  "lost communication with the server",
+  // The runner service was stopped or auto-updated under the job: an
+  // infrastructure cancellation, not a verdict on the diff.
+  RUNNER_SHUTDOWN_SIGNAL,
+  // "The job was not acquired by Runner of type hosted even after multiple
+  // attempts" — the job never reached a runner at all, so nothing in the diff
+  // was ever executed (community#186216, community#165287).
+  "was not acquired by runner",
+  // "The hosted runner encountered an error while running your job. (Error
+  // Type: Failure)." — GitHub's own statement that its runner broke
+  // (community#126539). The parenthesised error type varies; the sentence does
+  // not.
+  "the hosted runner encountered an error while running your job",
+];
+
+/**
+ * The runner-infrastructure wording a red CI check's text carries, or
+ * `undefined` when it carries none.
+ *
+ * Exists so the review-correction accounting can decline to charge a
+ * correction round for a red that the worker's diff did not cause: a lost
+ * runner, a runner shut down under the job, or a job no runner ever picked up.
+ * The return value is the matched wording, so whatever waives a round can say
+ * *which* sentence waived it instead of asserting "infra" unexplained.
+ *
+ * Fails closed in both directions, and deliberately narrower than it could be:
+ *
+ * - Unclassifiable, empty or unread text is `undefined` — an unexplained red
+ *   still counts, and a log-fetch failure hands this function nothing to match,
+ *   so it never waives.
+ * - "The operation was canceled." is *not* here: it is what a failed `needs:`
+ *   dependency and an operator's own cancel both print, so matching it would
+ *   waive rounds for ordinary red.
+ * - "…has exceeded the maximum execution time of N minutes" is *not* here
+ *   either: a job that ran until the ceiling is usually a hanging test or an
+ *   infinite loop, which is exactly the diff's problem to fix.
+ */
+export function runnerInfraFailure(log: string): string | undefined {
+  const lower = log.toLowerCase();
+  return RUNNER_INFRA_SIGNATURES.find((signature) => lower.includes(signature));
+}
+
 /**
  * The cap kills that produced nothing: the worker reached a ceiling with no PR,
  * no observed head and no salvage commit.