omp-conductor 0.3.12 → 0.3.15

package/src/cli.ts

@@ -17,15 +17,25 @@ import {
   inspectBriefLayout,
   migrateToPolicy,
   proposeRetrofit,
+  repairPolicyBannerCrumbs,
   writeMergedBrief,
 } from "./brief-upgrade.ts";
 import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
-import { dbPath, formatStatus, runDaemon, setPaused, statusSnapshot } from "./daemon.ts";
+import { dbPath, runDaemon, setPaused } from "./daemon.ts";
+import {
+  armTicks,
+  clearPaneHalt,
+  disarmTicks,
+  halt,
+  haltWithPane,
+  hold,
+  releaseHold,
+  renderStatus,
+} from "./fleet.ts";
 import { formatGraphSetup, graphRepos, writeGraphSetup, type GraphSetupWrite } from "./graph.ts";
 import {
   clearRecord,
   DEFAULT_PORT,
-  healthCheck,
   livingDaemon,
   restartDaemon,
   startDaemon,
@@ -52,6 +62,11 @@ usage:
   omp-conductor stop
   omp-conductor restart [--port N] [--project NAME]
   omp-conductor status [--project NAME]
+  omp-conductor hold [--project NAME]
+  omp-conductor halt [--pane] [--project NAME]
+  omp-conductor arm [--project NAME]
+  omp-conductor disarm [--project NAME]
+  omp-conductor release-pane [--project NAME]
   omp-conductor tail <issue> [--project NAME]
   omp-conductor unblock <issue> [--project NAME]
   omp-conductor daemon [--once] [--port N] [--project NAME]
@@ -72,8 +87,22 @@ usage:
            dirty live worktrees before orphaning those rows — see README
            "Deploying a new package onto a busy fleet". Goes through systemctl
            when the unit owns the live pid.
-  status   show pause state, caps, active runs, today's usage, and whether a
-           daemon is alive.
+  status   layered fleet report: dispatch (running|paused|stopped), ticks
+           (armed|disarmed|…), pane, herdr, daemon — then caps and active runs.
+  hold     soft stop: pause claiming AND disarm ticks. Daemon and pane stay up.
+           This is "stop the conductor overnight" without killing processes.
+  halt     hold, then stop the dispatch daemon (systemctl-aware). Pane stays up
+           unless --pane is passed.
+  halt --pane
+           halt, then pin herdr-conductor recovery off for the conductor agent
+           only — does NOT stop herdr-fleet.service or any other herdr session.
+           Clear the pin with release-pane when you want recovery again.
+  arm      proof-gated: send a Telegram challenge and write the arm marker only
+           after your reply appears as a user turn in the orchestrator transcript.
+           Never auto-armed by resume/hold.
+  disarm   remove the arm marker so ticks skip. Processes untouched.
+  release-pane
+           clear the halt --pane recovery pin so herdr-conductor may resume again.
   tail     follow the newest run for <issue>: the worker's assistant text and
            the tools it calls, printed as they land. Workers are sessions inside
            the daemon rather than terminals, so this is the only way to watch
@@ -86,8 +115,8 @@ usage:
            cost a worker.
   daemon   run the dispatch loop in the foreground; --once runs a single tick
            and exits. This is what \`start\` launches.
-  pause    stop claiming new work. The running daemon notices on its next tick.
-  resume   allow claiming again.
+  pause    stop claiming new work only (ticks keep firing if armed). Prefer hold.
+  resume   clear pause only — does NOT re-arm. Prefer hold's inverse: resume + arm.
   graph-setup
            print how to set up the code-graph indexes workers query instead of
            grepping: the clone commands for any missing index-only clone, the
@@ -106,10 +135,18 @@ usage:
   help     print this text (also --help, -h).
 
 Pause is a flag file under the state directory, so it applies to every project
-and survives a daemon restart. A running daemon is tracked by a pidfile under
-$OMP_CONDUCTOR_RUNTIME_DIR (default ~/.omp/run/daemons/omp-conductor), written
-whether it was started in the background or in the foreground, and probed for
-liveness on every read — a stale one never blocks a start.`;
+and survives a daemon restart. Hold also removes the arm marker the heartbeat
+reads, so both brains go quiet without killing processes. A running daemon is
+tracked by a pidfile under $OMP_CONDUCTOR_RUNTIME_DIR (default
+~/.omp/run/daemons/omp-conductor), written whether it was started in the
+background or in the foreground, and probed for liveness on every read — a
+stale one never blocks a start.
+
+Stop the conductor:
+  hold              no claims, no tick sends (inspectable)
+  halt              hold + stop dispatch daemon
+  halt --pane       halt + pin conductor-pane recovery off
+  resume && arm     clear pause, then prove inbound Telegram before ticks resume`;
 
 /** Accepts both `--port 9000` and `--port=9000`; returns undefined when absent. */
 function flag(argv: string[], name: string): string | undefined {
@@ -145,26 +182,6 @@ function humanDuration(ms: number): string {
   return `${Math.floor(h / 24)}d ${String(h % 24).padStart(2, "0")}h`;
 }
 
-/**
- * The daemon half of `status`. Kept separate from `formatStatus` because the
- * pidfile and the endpoint are the CLI's business, not the dispatcher's, and
- * because a pid without a `/healthz` answer is a distinct — and interesting —
- * state: the process is up but the loop is not serving.
- */
-async function daemonSection(): Promise<string> {
-  const rec = livingDaemon();
-  if (rec === undefined) return "daemon    not running";
-  const health = await healthCheck(rec.port);
-  return [
-    "daemon",
-    `  pid       ${rec.pid}`,
-    `  uptime    ${humanDuration(Date.now() - rec.startedAt)}`,
-    `  port      ${rec.port}`,
-    ...(rec.project === undefined ? [] : [`  project   ${rec.project}`]),
-    `  healthz   ${health.ok ? `ok  ${health.body ?? ""}`.trimEnd() : "unreachable — the process is up but not serving"}`,
-    `  log       ${rec.logFile}`,
-  ].join("\n");
-}
 
 /**
  * The orchestrator half, and the one thing `status` has ever known about the
@@ -455,9 +472,84 @@ try {
     }
 
     case "status": {
-      const snapshot = formatStatus(statusSnapshot(flag(argv, "project")));
+      const project = flag(argv, "project");
+      const text = await renderStatus(project);
       const stalled = stallLine();
-      process.stdout.write(`${snapshot}\n\n${await daemonSection()}\n${stalled === undefined ? "" : `\n${stalled}\n`}`);
+      process.stdout.write(`${text}${stalled === undefined ? "\n" : `\n\n${stalled}\n`}`);
+      break;
+    }
+
+    case "hold": {
+      const r = hold(flag(argv, "project"));
+      process.stdout.write(
+        `held — claiming paused` +
+          `${r.wasPaused ? " (already paused)" : ""}` +
+          `; ticks disarmed at ${r.disarmed.path}` +
+          `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}\n` +
+          `daemon and pane left running; halt to stop the daemon\n`,
+      );
+      break;
+    }
+
+    case "halt": {
+      const project = flag(argv, "project");
+      const withPane = argv.includes("--pane");
+      if (withPane) {
+        const r = await haltWithPane(project);
+        const stopLine =
+          r.stop.kind === "not-running"
+            ? "daemon was not running"
+            : `daemon stopped — pid ${r.stop.pid}${r.stop.via === "systemctl" ? " (via systemctl)" : ""}`;
+        process.stdout.write(
+          `halted — claiming paused; ticks disarmed at ${r.hold.disarmed.path}\n` +
+            `${stopLine}\n` +
+            `pane recovery pinned at ${r.pane.pinPath}\n` +
+            `pane stop: ${r.pane.stopped} — ${r.pane.detail}\n` +
+            `  (conductor agent "${r.pane.agentName}" only — herdr-fleet.service was NOT stopped;\n` +
+            `   release-pane clears the pin when you want recovery again)\n`,
+        );
+      } else {
+        const r = await halt(project);
+        const stopLine =
+          r.stop.kind === "not-running"
+            ? "daemon was not running"
+            : `daemon stopped — pid ${r.stop.pid}${r.stop.via === "systemctl" ? " (via systemctl)" : ""}`;
+        process.stdout.write(
+          `halted — claiming paused; ticks disarmed at ${r.hold.disarmed.path}\n` +
+            `${stopLine}\n` +
+            `pane left running (pass --pane to stop the conductor agent and pin recovery)\n`,
+        );
+      }
+      break;
+    }
+
+    case "arm": {
+      process.stdout.write("arm: sending inbound Telegram challenge…\n");
+      const r = await armTicks(flag(argv, "project"));
+      process.stdout.write(
+        `ARMED — inbound round-trip proved with owner ${r.owner}; ticks are now live.\n` +
+          `marker ${r.path}${r.alreadyArmed ? " (replaced previous marker)" : ""}\n`,
+      );
+      break;
+    }
+
+    case "disarm": {
+      const r = disarmTicks(flag(argv, "project"));
+      process.stdout.write(
+        `disarmed — ticks will be skipped` +
+          `${r.wasArmed ? "" : " (was already disarmed)"}\n` +
+          `marker ${r.path}\n`,
+      );
+      break;
+    }
+
+    case "release-pane": {
+      const r = clearPaneHalt(flag(argv, "project"));
+      process.stdout.write(
+        r.wasHalted
+          ? `pane recovery pin cleared — ${r.path}\nherdr-conductor may resume the fleet agent again\n`
+          : `no pane recovery pin at ${r.path}\n`,
+      );
       break;
     }
 
@@ -483,12 +575,18 @@ try {
 
     case "pause":
       setPaused(true);
-      process.stdout.write("paused — no new work will be claimed\n");
+      process.stdout.write(
+        "paused — no new work will be claimed\n" +
+          "note: ticks keep firing if armed; use hold to silence both\n",
+      );
       break;
 
     case "resume":
-      setPaused(false);
-      process.stdout.write("resumed — work will be claimed on the next tick\n");
+      releaseHold();
+      process.stdout.write(
+        "resumed — claiming allowed on the next tick\n" +
+          "note: did NOT re-arm; run arm after an inbound Telegram proof to resume ticks\n",
+      );
       break;
 
     case "graph-setup": {
@@ -593,7 +691,32 @@ try {
 
       if (argv.includes("--migrate")) {
         if (layout.kind === "overlay") {
-          process.stdout.write(`${formatBriefStatus(path, layout)}\n`);
+          if (!argv.includes("--apply")) {
+            process.stdout.write(
+              `${formatBriefStatus(path, layout)}\n\n` +
+                "POLICY.md already present. --migrate --apply will strip any leading\n" +
+                "banner-comment crumbs from POLICY.md and recompose ORCHESTRATOR.md.\n",
+            );
+            break;
+          }
+          if (project === undefined) {
+            process.stderr.write(
+              "omp-conductor: repairing an overlay needs --project (or a config) so the floor renders.\n",
+            );
+            process.exit(1);
+          }
+          const repaired = repairPolicyBannerCrumbs({
+            orchestratorPath: layout.orchestratorPath,
+            policyPath: layout.policyPath,
+            floor: renderFloorForProject(project),
+          });
+          if (repaired === undefined) {
+            process.stdout.write(
+              `${formatBriefStatus(path, layout)}\n\nrecomposed ORCHESTRATOR.md — POLICY.md needed no crumb strip.\n`,
+            );
+          } else {
+            process.stdout.write(`${formatMigrateResult(repaired)}\n`);
+          }
           break;
         }
         if (layout.kind === "missing") {

package/src/confinement.ts

@@ -0,0 +1,123 @@
+/**
+ * Mechanical worktree confinement for worker sessions.
+ *
+ * The harness has no first-class fs-policy field, but `createAgentSession`
+ * accepts inline `extensions` that subscribe to `tool_call` and can return
+ * `{ block: true }` before a tool runs (see the harness `protected-paths`
+ * example). Workers get that gate for structured file tools; the orchestrator
+ * does not — it has to read the state directory and briefs.
+ *
+ * `bash` is deliberately not confined here: its input is an opaque shell
+ * string, and parsing it is a false-sense of security. Closing that gap is a
+ * least-privilege uid (deployment), documented beside this module's README
+ * section — not a regex over `rm -rf`.
+ */
+
+import { existsSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+/** Tools whose structured `path` (or path-like) field we can gate. */
+const GATED = new Set(["write", "edit", "read", "grep", "glob"]);
+
+/**
+ * Resolve `candidate` as a worker would, then ask whether it stays under
+ * `root`. Symlink-aware: existing path components are realpath'd so a link
+ * planted inside the worktree cannot escape by string-prefix tricks.
+ *
+ * A path that does not exist yet (a new write) realpaths the deepest existing
+ * ancestor and appends the rest — the same TOCTOU posture as the harness's
+ * own workspace confinement helper.
+ */
+export function isInsideWorktree(root: string, candidate: string): boolean {
+  if (candidate.length === 0 || candidate.includes("\0")) return false;
+
+  let rootReal: string;
+  try {
+    rootReal = realpathSync(resolve(root));
+  } catch {
+    rootReal = resolve(root);
+  }
+
+  const abs = resolve(rootReal, candidate);
+
+  const missing: string[] = [];
+  let probe = abs;
+  while (!existsSync(probe)) {
+    const parent = dirname(probe);
+    if (parent === probe) break;
+    missing.unshift(basename(probe));
+    probe = parent;
+  }
+
+  let base: string;
+  try {
+    base = realpathSync(probe);
+  } catch {
+    base = probe;
+  }
+  const resolved = missing.length === 0 ? base : join(base, ...missing);
+
+  const rel = relative(rootReal, resolved);
+  // Inside ⇒ "" or a relative path that does not climb out. Absolute `rel` is
+  // a Windows drive mismatch; anything starting with `..` has left the root.
+  return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+}
+
+/** Pull the path-like field a gated tool carries, if any. */
+export function pathFromToolInput(toolName: string, input: Record<string, unknown>): string | undefined {
+  if (!GATED.has(toolName)) return undefined;
+  const path = input.path;
+  if (typeof path === "string" && path.length > 0) return path;
+  // glob / grep sometimes scope via target_directory / path_filter; only a
+  // concrete directory root is confinable without inventing a glob parser.
+  const target = input.target_directory ?? input.cwd;
+  if (typeof target === "string" && target.length > 0) return target;
+  return undefined;
+}
+
+export type ConfineDecision = { block: true; reason: string };
+
+/**
+ * Decide whether one tool_call may run. Undefined means "no opinion" (allow).
+ * Pure so tests pin the gate without standing up a harness session.
+ */
+export function confineToolCall(
+  root: string,
+  toolName: string,
+  input: Record<string, unknown>,
+): ConfineDecision | undefined {
+  const path = pathFromToolInput(toolName, input);
+  if (path === undefined) return undefined;
+  if (isInsideWorktree(root, path)) return undefined;
+  return {
+    block: true,
+    reason:
+      `Blocked: ${toolName} path "${path}" is outside the worker worktree (${root}). ` +
+      `Structured file tools may only touch the assigned checkout; use paths under it.`,
+  };
+}
+
+/**
+ * Minimal extension surface this package needs. Kept duck-typed so the peer
+ * harness does not have to be on disk for `tsc` — same reason `omp.ts` exists.
+ */
+export interface ConfinementPi {
+  on(
+    event: "tool_call",
+    handler: (
+      event: { toolName: string; input: Record<string, unknown> },
+      ctx: unknown,
+    ) => ConfineDecision | undefined | Promise<ConfineDecision | undefined>,
+  ): void;
+}
+
+/**
+ * Inline extension factory for `createAgentSession({ extensions: [...] })`.
+ * Installs the worktree gate on every structured file tool_call.
+ */
+export function worktreeConfinement(root: string): (pi: ConfinementPi) => void {
+  const rootAbs = resolve(root);
+  return (pi) => {
+    pi.on("tool_call", (event) => confineToolCall(rootAbs, event.toolName, event.input));
+  };
+}

package/src/daemon.ts

@@ -826,7 +826,8 @@ export interface Admission {
  *
  * Exported so the admission rules can be pinned without spawning a worker.
  * Every one of them exists because of a live incident, and each guards a
- * different way the same issue gets worked twice.
+ * different way the same issue gets worked twice — including epic siblings
+ * racing onto the same files (#48).
  *
  * Takes the slice of `Deps` it actually reads rather than the whole thing: what
  * admission is allowed to consult is the point of the function, and a `Deps`
@@ -838,7 +839,34 @@ export async function admitCandidates(
   slots: number,
 ): Promise<Admission[]> {
   const { project, caps, tracker, store } = d;
-  const busy = new Set(store.activeRuns(project.name).map((r) => r.issue));
+  const busyIssues = store.activeRuns(project.name).map((r) => r.issue);
+  const busy = new Set(busyIssues);
+
+  // parent -> blocking issue. Seeded from active runs (including pushed-green),
+  // then extended by candidates admitted earlier in this same pass so two
+  // siblings never both clear the gate in one tick.
+  const occupiedParents = new Map<number, number>();
+  const parentCache = new Map<number, number | undefined>();
+
+  const resolveParent = async (issue: number): Promise<number | undefined> => {
+    if (parentCache.has(issue)) return parentCache.get(issue);
+    const parent = await tracker.parentOf(issue);
+    parentCache.set(issue, parent);
+    return parent;
+  };
+
+  // Bounded by concurrent workers, not queue depth. A failed lookup here cannot
+  // mark an epic occupied; candidates still fail closed on their own parentOf.
+  for (const issue of busyIssues) {
+    try {
+      const parent = await resolveParent(issue);
+      if (parent !== undefined && !occupiedParents.has(parent)) {
+        occupiedParents.set(parent, issue);
+      }
+    } catch (err) {
+      log(`#${issue} parent lookup failed while seeding epic occupancy (${errText(err)})`);
+    }
+  }
 
   const admitted: Admission[] = [];
   for (const r of routed) {
@@ -862,6 +890,27 @@ export async function admitCandidates(
       continue;
     }
 
+    // Soft concurrency per epic: at most one in-flight child of a given parent.
+    // No parent means today's concurrent admission. Cheap local filters already
+    // ran; this sits before the open-PR API call so a held sibling frees the
+    // slot for unrelated work without spending a closers query.
+    let parent: number | undefined;
+    try {
+      parent = await resolveParent(r.issue.number);
+    } catch (err) {
+      log(`#${r.issue.number} held: parent check failed (${errText(err)}) — retrying next tick`);
+      continue;
+    }
+    if (parent !== undefined) {
+      const blocker = occupiedParents.get(parent);
+      if (blocker !== undefined) {
+        log(
+          `#${r.issue.number} skipped: sibling #${blocker} in flight under epic #${parent}`,
+        );
+        continue;
+      }
+    }
+
     // The busy set is built from run rows, so it can only speak for work this
     // database recorded. Work pushed before this store existed — a migration, a
     // wiped or relocated state dir, a restore onto a new host — looks exactly
@@ -889,6 +938,7 @@ export async function admitCandidates(
     }
 
     admitted.push({ r, attempt: prior + 1 });
+    if (parent !== undefined) occupiedParents.set(parent, r.issue.number);
   }
 
   return admitted;
@@ -1341,6 +1391,9 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
           paused: isPaused(),
           activeRuns: store.activeRuns(project.name).length,
           project: project.name,
+          // Resident set of *this* process: workers are in-process omp sessions,
+          // so the unit's Memory peak is this number, not a separate worker pid.
+          rssBytes: process.memoryUsage().rss,
         });
       }
       return new Response("not found\n", { status: 404 });