omp-conductor 0.3.18 → 0.3.20

package/src/worker.ts

@@ -11,10 +11,14 @@
  */
 
 import { createSession, disposeSession } from "./omp.ts";
-import type { Caps, RunState } from "./types.ts";
+import type { ReleaseShape } from "./release-policy.ts";
+import type { Caps, ReleasePolicy, RunState } from "./types.ts";
 
-/** A PR link the worker pushed, recognised anywhere in its report. */
-const PR_URL_PATTERN = /https:\/\/github\.com\/\S+\/pull\/\d+/;
+/** Structured evidence fields from the worker's final report. */
+const PR_URL_PATTERN = /^pr:\s*(https:\/\/github\.com\/\S+\/pull\/\d+)\s*$/im;
+const HEAD_SHA_PATTERN = /^head:\s*([0-9a-f]{40})\s*$/im;
+const PUSHED_GREEN_PATTERN = /^state:\s*pushed-green\s*$/im;
+const BLOCKED_PATTERN = /^state:\s*blocked\s*$/im;
 
 /** `{{KEY}}` placeholders in a brief template. */
 const PLACEHOLDER_PATTERN = /\{\{([A-Za-z0-9_]+)\}\}/g;
@@ -42,7 +46,20 @@ export interface WorkerOpts {
    * the harness to pick, which is what an unconfigured project wants.
    */
   model?: string;
+  /** Effective release/deploy gate for this session. */
+  releasePolicy?: ReleasePolicy;
+  /** Durable audit sink for rejected release/deploy calls. */
+  onReleaseBlocked?: (shape: ReleaseShape) => void;
+  /**
+   * Reads the effective ceiling at each turn boundary. Omitted, the configured
+   * startup cap remains fixed for the run.
+   */
+  maxTurns?: () => number;
+  /** Synchronous cap latch; called before the session abort begins. */
+  onKilled?: (by: KilledBy) => void;
   onTurn?: (n: number) => void;
+  /** Cumulative USD spend, reported as each cost-bearing message finishes. */
+  onSpend?: (usd: number) => void;
   /**
    * The transcript path, handed over the moment the session opens it rather
    * than at the end with {@link WorkerResult.sessionFile}. Both report the same
@@ -66,6 +83,7 @@ export interface RunWorkerDeps {
 export interface WorkerResult {
   state: RunState;
   prUrl?: string;
+  headSha?: string;
   turns: number;
   spendUsd: number;
   report: string;
@@ -101,23 +119,30 @@ export function renderBrief(template: string, vars: Record<string, string>): str
 }
 
 /**
- * Read the run's outcome out of the worker's final report.
+ * Read the run's structured outcome evidence from its final report.
  *
- * Success has to be claimed explicitly (`pushed-green`); everything else,
- * including an empty or unparseable report, is a failure. Defaulting the other
- * way would let a session that died mid-thought be reported as merge-ready.
+ * A textual `pushed-green` claim is not success by itself. The exact state line
+ * must carry both a PR URL and the head SHA observed after CI; the daemon then
+ * asks the tracker to verify those facts independently. Missing or malformed
+ * evidence fails closed.
  */
-export function deriveResult(report: string): { state: RunState; prUrl?: string } {
-  const haystack = report.toLowerCase();
-  const state: RunState = haystack.includes("pushed-green")
-    ? "pushed-green"
-    : haystack.includes("ci-red")
-      ? "failed"
-      : haystack.includes("blocked")
-        ? "blocked"
-        : "failed";
-  const prUrl = PR_URL_PATTERN.exec(report)?.[0];
-  return prUrl === undefined ? { state } : { state, prUrl };
+export function deriveResult(report: string): {
+  state: RunState;
+  prUrl?: string;
+  headSha?: string;
+} {
+  const prUrl = PR_URL_PATTERN.exec(report)?.[1];
+  const headSha = HEAD_SHA_PATTERN.exec(report)?.[1]?.toLowerCase();
+  if (PUSHED_GREEN_PATTERN.test(report) && prUrl !== undefined && headSha !== undefined) {
+    return { state: "pushed-green", prUrl, headSha };
+  }
+
+  const state: RunState = BLOCKED_PATTERN.test(report) ? "blocked" : "failed";
+  return {
+    state,
+    ...(prUrl === undefined ? {} : { prUrl }),
+    ...(headSha === undefined ? {} : { headSha }),
+  };
 }
 
 /**
@@ -145,8 +170,8 @@ export async function runWorker(
   o: WorkerOpts,
   deps: RunWorkerDeps = { createSession },
 ): Promise<WorkerResult> {
-  // Read the caps once, by value: `o.caps` belongs to the caller's config.
-  const { workerMaxTurns, workerWallClockMs } = o.caps;
+  const { workerWallClockMs } = o.caps;
+  const maxTurns = o.maxTurns ?? (() => o.caps.workerMaxTurns);
 
   const session = await deps.createSession({
     cwd: o.cwd,
@@ -154,6 +179,8 @@ export async function runWorker(
     ...(o.model === undefined ? {} : { model: o.model }),
     // Prevention half of #24: structured file tools cannot leave this worktree.
     confineToCwd: true,
+    ...(o.releasePolicy === undefined ? {} : { releasePolicy: o.releasePolicy }),
+    ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
   });
 
   // Before the first turn, not after the last: a caller that only learns the
@@ -195,6 +222,7 @@ export async function runWorker(
   const kill = (by: KilledBy) => {
     if (killedBy !== undefined) return;
     killedBy = by;
+    o.onKilled?.(by);
     clearWallClock();
     session.abort();
     // An aborted session may never reach a terminal `agent_end`. The cap is the
@@ -208,7 +236,7 @@ export async function runWorker(
     // `message_end`s and would burn the cap on a run that is behaving.
     turns += 1;
     o.onTurn?.(turns);
-    if (turns > workerMaxTurns) kill("turns");
+    if (turns > maxTurns()) kill("turns");
   });
 
   session.on("message_end", (event) => {
@@ -223,16 +251,25 @@ export async function runWorker(
     // transcripts, 2026-08-07). The earlier agent_end.telemetry path never
     // fired, so every run recorded $0 and the daily cap was theater (#46).
     const cost = costUsdFromMessage(message);
-    if (cost !== undefined) spendUsd += cost;
+    if (cost !== undefined) {
+      spendUsd += cost;
+      o.onSpend?.(spendUsd);
+    }
   });
 
   session.on("agent_end", (event) => {
     // Fallback for harnesses that only attach cost on the terminal event.
     const estimated = field(field(field(event, "telemetry"), "cost"), "estimatedUsd");
-    if (typeof estimated === "number" && Number.isFinite(estimated) && estimated > 0) {
+    if (
+      spendUsd === 0 &&
+      typeof estimated === "number" &&
+      Number.isFinite(estimated) &&
+      estimated > 0
+    ) {
       // Prefer message totals when both exist — do not double-count a run that
       // already accumulated per-message costs.
-      if (spendUsd === 0) spendUsd += estimated;
+      spendUsd = estimated;
+      o.onSpend?.(spendUsd);
     }
 
     // Anything that is not literally `false` — including garbage or nothing at
@@ -283,12 +320,12 @@ export async function runWorker(
     return withSessionFacts({ state: "killed", turns, spendUsd, report, killedBy });
   }
 
-  const { state, prUrl } = deriveResult(report);
-  return withSessionFacts(
-    prUrl === undefined
-      ? { state, turns, spendUsd, report }
-      : { state, prUrl, turns, spendUsd, report },
-  );
+  return withSessionFacts({
+    ...deriveResult(report),
+    turns,
+    spendUsd,
+    report,
+  });
 }
 
 /**

package/src/worktree.ts

@@ -608,3 +608,69 @@ export async function removeWorktree(
 
   await git(["worktree", "prune"], mirrorPath);
 }
+
+export type RetainedWorktreeCleanup =
+  | { kind: "removed" }
+  | { kind: "retained"; reason: "dirty" | "unpushed" | "unknown"; detail: string };
+
+/**
+ * Reap a terminal run's tree and local mirror branch without deleting the only
+ * copy of work. Tracker state is proved by the caller; this function proves the
+ * local half after refreshing remote refs. Any ambiguity retains everything.
+ */
+export async function cleanupRetainedWorktree(
+  mirrorPath: string,
+  worktreePath: string,
+  branch: string,
+): Promise<RetainedWorktreeCleanup> {
+  if (!existsSync(mirrorPath)) {
+    return existsSync(worktreePath)
+      ? { kind: "retained", reason: "unknown", detail: "mirror is missing" }
+      : { kind: "removed" };
+  }
+
+  try {
+    if (existsSync(worktreePath)) {
+      const dirty = await git(["status", "--porcelain"], worktreePath);
+      if (dirty !== "") {
+        return { kind: "retained", reason: "dirty", detail: "worktree has uncommitted changes" };
+      }
+      const actual = await git(["rev-parse", "--abbrev-ref", "HEAD"], worktreePath);
+      if (actual !== branch) {
+        return {
+          kind: "retained",
+          reason: "unknown",
+          detail: `worktree is on ${actual}, expected ${branch}`,
+        };
+      }
+    }
+
+    // A deleted remote branch can make a pushed commit look local-only until
+    // the default branch is fetched. Failure is ambiguity, never permission.
+    await git(["fetch", "--prune", "origin"], mirrorPath);
+
+    const ref = `refs/heads/${branch}`;
+    if (await gitSucceeds(["show-ref", "--verify", "--quiet", ref], mirrorPath)) {
+      const unique = await git(["rev-list", ref, "--not", "--remotes"], mirrorPath);
+      if (unique !== "") {
+        return {
+          kind: "retained",
+          reason: "unpushed",
+          detail: `${branch} has commits absent from every remote ref`,
+        };
+      }
+    }
+
+    await removeWorktree(mirrorPath, worktreePath);
+    if (await gitSucceeds(["show-ref", "--verify", "--quiet", ref], mirrorPath)) {
+      await git(["branch", "-D", branch], mirrorPath);
+    }
+    return { kind: "removed" };
+  } catch (err) {
+    return {
+      kind: "retained",
+      reason: "unknown",
+      detail: err instanceof Error ? err.message : String(err),
+    };
+  }
+}

package/systemd/omp-conductor.service.example

@@ -16,8 +16,10 @@
 #      fleet on a ≤8 GB box.
 #
 # Install:
-#   sudo cp omp-conductor.service.example /etc/systemd/system/omp-conductor.service
-#   sudo systemctl daemon-reload && sudo systemctl enable --now omp-conductor
+#   sudo install -m 0644 omp-conductor.service.example /etc/systemd/system/omp-conductor.service
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable omp-conductor.service
+#   sudo systemctl restart omp-conductor.service
 
 [Unit]
 Description=omp-conductor dispatch daemon
@@ -38,7 +40,7 @@ WorkingDirectory=/home/fleet
 
 # Foreground daemon so systemd tracks MainPID. `omp-conductor start` backgrounds;
 # under a unit, call `daemon` directly.
-ExecStart=/home/fleet/.local/bin/omp-conductor daemon --port 7432
+ExecStart=/home/fleet/.local/bin/omp-conductor daemon --port 8787
 
 Restart=on-failure
 # Handled SIGTERM exits 143; without this, Restart=on-failure brings the unit