omp-conductor 0.3.13 → 0.3.15

package/src/plugin.ts

@@ -22,15 +22,25 @@ import {
   writeMergedBrief,
 } from "./brief-upgrade.ts";
 import { configPath, expandHome, findProject, loadConfig, saveConfig } from "./config.ts";
+import { hostRamBytes, recommendedMaxWorkers } from "./host.ts";
 import {
   armConductor,
-  formatStatus,
   isPaused,
   previewQueue,
   setPaused,
-  statusSnapshot,
   type QueuePreview,
 } from "./daemon.ts";
+import {
+  armTicks,
+  clearPaneHalt,
+  disarmTicks,
+  halt,
+  haltWithPane,
+  hold,
+  releaseHold,
+  renderStatus,
+} from "./fleet.ts";
+
 import { defaultGraphRoot } from "./graph.ts";
 import {
   AMEND_AREAS,
@@ -124,9 +134,14 @@ const SUBCOMMANDS: Completion[] = [
     label: "setup",
     description: "wizard: config, labels, dry run, then arm — or amend one area of a configured project",
   },
-  { value: "status", label: "status", description: "pause state, caps, active runs, today's usage" },
-  { value: "pause", label: "pause", description: "stop claiming new work" },
-  { value: "resume", label: "resume", description: "allow claiming again" },
+  { value: "status", label: "status", description: "layered fleet report: dispatch, ticks, pane, herdr, daemon" },
+  { value: "hold", label: "hold", description: "soft stop: pause claiming AND disarm ticks" },
+  { value: "halt", label: "halt", description: "hold + stop dispatch daemon; pass --pane to pin recovery off" },
+  { value: "arm", label: "arm", description: "proof-gated: inbound Telegram round-trip, then write arm marker" },
+  { value: "disarm", label: "disarm", description: "remove arm marker so ticks skip" },
+  { value: "release-pane", label: "release-pane", description: "clear halt --pane recovery pin" },
+  { value: "pause", label: "pause", description: "stop claiming only (ticks keep firing if armed); prefer hold" },
+  { value: "resume", label: "resume", description: "clear pause only — does not re-arm" },
   {
     value: "brief-upgrade",
     label: "brief-upgrade",
@@ -136,9 +151,14 @@ const SUBCOMMANDS: Completion[] = [
 
 const USAGE = [
   "/conductor setup [project]         create a project, or amend one area of one you already have",
-  "/conductor status [project]        pause state, caps, active runs, today's usage",
-  "/conductor pause                   stop claiming new work",
-  "/conductor resume                  allow claiming again",
+  "/conductor status [project]        layered fleet report (dispatch, ticks, pane, herdr, daemon)",
+  "/conductor hold [project]          soft stop: pause claiming AND disarm ticks",
+  "/conductor halt [--pane] [project] hold + stop daemon; --pane pins conductor recovery off only",
+  "/conductor arm [project]           proof-gated inbound Telegram round-trip, then arm ticks",
+  "/conductor disarm [project]        remove arm marker (ticks skip)",
+  "/conductor release-pane [project]  clear halt --pane recovery pin",
+  "/conductor pause                   stop claiming only (prefer hold)",
+  "/conductor resume                  clear pause only — does not re-arm",
   "/conductor brief-upgrade [project] check ORCHESTRATOR.md against the shipped brief",
 ].join("\n");
 
@@ -537,21 +557,38 @@ const askCaps: AreaAsker = async (ctx, a) => {
   const caps: Partial<Caps> = { ...a.caps };
   const spendLabel =
     DEFAULT_CAPS.dailySpendUsd === null ? "no spend cap" : `$${DEFAULT_CAPS.dailySpendUsd}/day`;
+  // Workers are in-process omp sessions inside the daemon PID. On a host under
+  // 16 GiB the measured shape (2 workers + orchestrator) peaks at 3–4 GB and
+  // swaps on a 7.6 GB shared VPS (#51) — setup therefore defaults to 1 there.
+  const workersDefault =
+    caps.maxConcurrentWorkers ?? recommendedMaxWorkers(hostRamBytes());
+  const smallHostNote =
+    workersDefault < DEFAULT_CAPS.maxConcurrentWorkers
+      ? ` This host looks under 16 GiB RAM, so the worker default is ${workersDefault} instead of ${DEFAULT_CAPS.maxConcurrentWorkers}.`
+      : "";
   const tuneCaps = await ctx.ui.confirm(
     "Caps",
-    `Defaults: ${DEFAULT_CAPS.maxConcurrentWorkers} workers, ` +
+    `Defaults: ${workersDefault} workers, ` +
       `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
       `${Math.round(DEFAULT_CAPS.workerWallClockMs / 60000)} min per worker, ` +
-      `${DEFAULT_CAPS.maxAttemptsPerIssue} attempts per issue. Change them?`,
+      `${DEFAULT_CAPS.maxAttemptsPerIssue} attempts per issue.${smallHostNote} Change them?`,
   );
-  if (!tuneCaps) return { ...a, caps };
+  if (!tuneCaps) {
+    if (
+      caps.maxConcurrentWorkers === undefined &&
+      workersDefault !== DEFAULT_CAPS.maxConcurrentWorkers
+    ) {
+      caps.maxConcurrentWorkers = workersDefault;
+    }
+    return { ...a, caps };
+  }
 
   // Spelled out rather than looped: adding a cap should fail to compile here,
   // not silently go unasked.
   caps.maxConcurrentWorkers = await askNumber(
     ctx,
     "Max concurrent workers",
-    caps.maxConcurrentWorkers ?? DEFAULT_CAPS.maxConcurrentWorkers,
+    workersDefault,
   );
   caps.dailySpendUsd = await askSpendCap(
     ctx,
@@ -915,7 +952,10 @@ export default function conductorPlugin(pi: PluginApi): void {
     handler: async (args, ctx) => {
       // findProject() throws when the config holds several projects and none is
       // named, so the project name rides along as an optional second word.
-      const [sub, project] = args.trim().split(/\s+/);
+      const tokens = args.trim().split(/\s+/).filter(Boolean);
+      const sub = tokens[0];
+      const withPane = tokens.includes("--pane");
+      const project = tokens.find((t, i) => i > 0 && t !== "--pane");
 
       try {
         switch (sub) {
@@ -924,17 +964,70 @@ export default function conductorPlugin(pi: PluginApi): void {
             break;
 
           case "status":
-            ctx.ui.notify(formatStatus(statusSnapshot(project)), "info");
+            ctx.ui.notify(await renderStatus(project), "info");
+            break;
+
+          case "hold": {
+            const r = hold(project);
+            ctx.ui.notify(
+              `Held — claiming paused; ticks disarmed at ${r.disarmed.path}. Daemon and pane left running.`,
+              "info",
+            );
             break;
+          }
+
+          case "halt": {
+            if (withPane) {
+              const r = await haltWithPane(project);
+              const stop =
+                r.stop.kind === "not-running"
+                  ? "daemon was not running"
+                  : `daemon stopped (pid ${r.stop.pid})`;
+              ctx.ui.notify(
+                `Halted — ${stop}. Pane: ${r.pane.stopped} (${r.pane.detail}); recovery pinned at ${r.pane.pinPath}.`,
+                "info",
+              );
+            } else {
+              const r = await halt(project);
+              const stop =
+                r.stop.kind === "not-running"
+                  ? "daemon was not running"
+                  : `daemon stopped (pid ${r.stop.pid})`;
+              ctx.ui.notify(`Halted — ${stop}. Pane left running.`, "info");
+            }
+            break;
+          }
+
+          case "arm": {
+            ctx.ui.notify("Arm: sending inbound Telegram challenge — reply in the bot DM…", "info");
+            const r = await armTicks(project);
+            ctx.ui.notify(`ARMED — owner ${r.owner}; marker ${r.path}`, "info");
+            break;
+          }
+
+          case "disarm": {
+            const r = disarmTicks(project);
+            ctx.ui.notify(`Disarmed — ${r.path}`, "info");
+            break;
+          }
+
+          case "release-pane": {
+            const r = clearPaneHalt(project);
+            ctx.ui.notify(
+              r.wasHalted ? `Pane recovery pin cleared (${r.path}).` : `No pane recovery pin at ${r.path}.`,
+              "info",
+            );
+            break;
+          }
 
           case "pause":
             setPaused(true);
-            ctx.ui.notify("Conductor paused — no new work will be claimed.", "info");
+            ctx.ui.notify("Paused claiming only — ticks keep firing if armed. Prefer /conductor hold.", "info");
             break;
 
           case "resume":
-            setPaused(false);
-            ctx.ui.notify("Conductor resumed — work will be claimed on the next tick.", "info");
+            releaseHold();
+            ctx.ui.notify("Resumed claiming — did NOT re-arm. Run /conductor arm for ticks.", "info");
             break;
 
           case "brief-upgrade": {

package/src/tracker/github.ts

@@ -10,7 +10,7 @@
  * ~200-400ms) and failure classification by matching human-readable stderr
  * instead of reading a status code. Upgrade path when either bites: replace the
  * body of `gh()` with `fetch("https://api.github.com/...")` using a token from
- * `gh auth token`; the eight Tracker methods above it stay untouched.
+ * `gh auth token`; the nine Tracker methods above it stay untouched.
  */
 
 import type { PrState, ProjectConfig, ReadyIssue, Tracker } from "../types.ts";
@@ -189,6 +189,22 @@ export function prStateFrom(raw: string): PrState | undefined {
   }
 }
 
+/**
+ * Parent number from a `gh issue view --json parent` payload, or undefined
+ * when the issue has no parent. Throws on a payload that claims a parent but
+ * does not carry a usable number — admission would otherwise treat garbage as
+ * "no parent" and skip the epic soft-cap.
+ */
+export function parentNumberFrom(raw: string): number | undefined {
+  const parsed = JSON.parse(raw) as { parent: { number?: unknown } | null };
+  if (parsed.parent == null) return undefined;
+  const n = parsed.parent.number;
+  if (typeof n !== "number" || !Number.isInteger(n) || n <= 0) {
+    throw new Error(`unexpected parent number ${JSON.stringify(n)}`);
+  }
+  return n;
+}
+
 export function makeTracker(p: ProjectConfig): Tracker {
   const repo = p.tracker.repo;
 
@@ -261,6 +277,14 @@ export function makeTracker(p: ProjectConfig): Tracker {
       await gh(["issue", "edit", String(parent), "--repo", repo, "--add-sub-issue", String(child)]);
     },
 
+    async parentOf(issue: number): Promise<number | undefined> {
+      // Native sub-issue parent, not a body scrape. Verified on gh 2.97.0:
+      // `parent` is null with no link, otherwise `{ number, title, url, ... }`.
+      return parentNumberFrom(
+        await gh(["issue", "view", String(issue), "--repo", repo, "--json", "parent"]),
+      );
+    },
+
     async openCloserFor(issue: number): Promise<string | undefined> {
       // GraphQL wants the halves of `owner/repo` separately. Config validates
       // that spelling, so an empty half means a hand-edited config: `gh` then

package/src/types.ts

@@ -230,6 +230,16 @@ export interface Tracker {
   /** Records that a worker split its issue, so follow-up work stays traceable
    *  to the request that spawned it. */
   linkParent(child: number, parent: number): Promise<void>;
+  /**
+   * The parent epic/issue number when `issue` is a linked sub-issue, or
+   * undefined when it has no parent.
+   *
+   * Admission serializes siblings under one parent (at most one in flight). A
+   * missing parent means "not epic-serialized" and keeps today's concurrent
+   * admission. A thrown error is fail-closed for that candidate — same posture
+   * as {@link Tracker.openCloserFor}.
+   */
+  parentOf(issue: number): Promise<number | undefined>;
   /**
    * The URL of an OPEN pull request that already closes `issue`, or undefined
    * when none does.

package/src/worker.ts

@@ -152,6 +152,8 @@ export async function runWorker(
     cwd: o.cwd,
     ...(o.sessionDir === undefined ? {} : { sessionDir: o.sessionDir }),
     ...(o.model === undefined ? {} : { model: o.model }),
+    // Prevention half of #24: structured file tools cannot leave this worktree.
+    confineToCwd: true,
   });
 
   // Before the first turn, not after the last: a caller that only learns the

package/systemd/omp-conductor.service.example

@@ -0,0 +1,54 @@
+# Example unit for a supervised omp-conductor daemon.
+#
+# Why MemoryMax exists: workers are *in-process* omp sessions inside this
+# service's MainPID (not separate processes). With the default two workers plus
+# the orchestrator session, journald on a reference 7.6 GB host recorded
+# Memory peaks of ~3.2–4.2 GB for this unit (issue #51). That is expected load,
+# not a leak — and on a shared VPS it is enough to thrash swap or OOM the
+# daemon mid-flight (orphan path).
+#
+# Before enabling:
+#   1. Set User=/Group=/HOME=/PATH for the account that owns ~/.omp/conductor.
+#   2. Point ExecStart at the omp-conductor binary on that host.
+#   3. On hosts under ~16 GiB RAM, prefer maxConcurrentWorkers=1 in config and
+#      consider MemoryMax=3G.
+#   4. Do not co-locate ClickHouse + other multi-GB services beside a 2-worker
+#      fleet on a ≤8 GB box.
+#
+# Install:
+#   sudo cp omp-conductor.service.example /etc/systemd/system/omp-conductor.service
+#   sudo systemctl daemon-reload && sudo systemctl enable --now omp-conductor
+
+[Unit]
+Description=omp-conductor dispatch daemon
+Documentation=https://github.com/TerrifiedBug/conductor
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# REPLACE: the account that owns ~/.omp/conductor and the gh auth the tracker uses.
+User=fleet
+Group=fleet
+Environment=HOME=/home/fleet
+# systemd's default PATH has no user installs; include wherever `omp` /
+# `omp-conductor` and `gh` live on this host.
+Environment=PATH=/home/fleet/.local/bin:/usr/local/bin:/usr/bin:/bin
+WorkingDirectory=/home/fleet
+
+# Foreground daemon so systemd tracks MainPID. `omp-conductor start` backgrounds;
+# under a unit, call `daemon` directly.
+ExecStart=/home/fleet/.local/bin/omp-conductor daemon --port 7432
+
+Restart=on-failure
+# Handled SIGTERM exits 143; without this, Restart=on-failure brings the unit
+# straight back after `systemctl stop` / `omp-conductor stop`.
+SuccessExitStatus=0 143
+
+MemoryAccounting=yes
+# Hard ceiling just above measured 2-worker peaks. Crossing it cgroups-OOMs the
+# unit — prefer lowering maxConcurrentWorkers before raising this.
+MemoryMax=5G
+
+[Install]
+WantedBy=multi-user.target