omp-conductor 0.3.18 → 0.3.20

package/src/fleet.ts

@@ -28,7 +28,8 @@ import { createInterface } from "node:readline";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { findProject, loadConfig, stateDir } from "./config.ts";
-import { isPaused, setPaused, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
+import { probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
+import { formatDispatchSummary, isPaused, setPaused, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
 import {
   healthCheck,
   isAlive,
@@ -873,12 +874,61 @@ export function fleetLayers(projectName?: string): FleetLayers {
   };
 }
 
+export function codeGraphFromHealthz(body: string | undefined, project: string): CodeGraphHealth | undefined {
+  if (body === undefined) return undefined;
+  try {
+    const parsed = JSON.parse(body) as Record<string, unknown>;
+    if (parsed["project"] !== project) return undefined;
+    const graph = parsed["codeGraph"];
+    if (graph === null || typeof graph !== "object" || Array.isArray(graph)) return undefined;
+    const value = graph as Record<string, unknown>;
+    if (value["configured"] === false) return { configured: false };
+    if (
+      value["configured"] !== true ||
+      !["healthy", "degraded", "unknown"].includes(String(value["status"])) ||
+      typeof value["checkedAt"] !== "string" ||
+      value["prerequisites"] === null ||
+      typeof value["prerequisites"] !== "object" ||
+      !Array.isArray(value["repos"]) ||
+      value["timer"] === null ||
+      typeof value["timer"] !== "object" ||
+      value["refresh"] === null ||
+      typeof value["refresh"] !== "object" ||
+      !Array.isArray(value["reasons"])
+    ) {
+      return undefined;
+    }
+    return graph as CodeGraphHealth;
+  } catch {
+    return undefined;
+  }
+}
+
+export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()): string | undefined {
+  if (!graph.configured) return undefined;
+  const indexed = graph.repos.filter((repo) => repo.index === "present").length;
+  let refresh: string = graph.refresh.result;
+  if (graph.refresh.lastSuccessAt !== undefined) {
+    const ageMs = Math.max(0, now - Date.parse(graph.refresh.lastSuccessAt));
+    refresh = `${graph.refresh.lastSuccessAt} (${Math.max(1, Math.ceil(ageMs / 60_000))}m ago)`;
+  }
+  return [
+    `code graph  ${graph.status}  ${indexed}/${graph.repos.length} repos indexed`,
+    `  indexer   ${graph.prerequisites.indexer}`,
+    `  MCP mount ${graph.prerequisites.mcpMount}`,
+    `  timer     ${graph.timer.enabled} / ${graph.timer.active}`,
+    `  refresh   ${refresh}`,
+    ...graph.reasons.map((reason) => `  - ${reason}`),
+  ].join("\n");
+}
+
 export function formatFleetStatus(
   s: StatusSnapshot,
   layers: FleetLayers,
   daemonHealth?: { ok: boolean; body?: string },
   telegram: TelegramHealth = { kind: "unprobed" },
   now = Date.now(),
+  codeGraph: CodeGraphHealth = { configured: false },
 ): string {
   const tickLine =
     layers.ticksDetail === undefined
@@ -917,7 +967,7 @@ export function formatFleetStatus(
       daemonHealth === undefined
         ? "unprobed"
         : daemonHealth.ok
-          ? `ok  ${daemonHealth.body ?? ""}`.trimEnd()
+          ? "ok"
           : "unreachable — the process is up but not serving";
     const rss = rssBytesFromHealthz(daemonHealth?.body);
     daemonBlock = [
@@ -930,6 +980,7 @@ export function formatFleetStatus(
     ].join("\n");
   }
 
+  const graphBlock = formatCodeGraphHealth(codeGraph, now);
   return [
     `dispatch  ${layers.dispatch}`,
     tickLine,
@@ -938,6 +989,7 @@ export function formatFleetStatus(
     recoveryLine,
     herdrLine,
     telegramLine,
+    ...(graphBlock === undefined ? [] : [graphBlock]),
     daemonBlock,
     "",
     formatProjectBody(s),
@@ -956,9 +1008,12 @@ function formatProjectBody(s: StatusSnapshot): string {
     s.caps.dailySpendUsd === null
       ? `  spend today        $${s.spendTodayUsd.toFixed(2)} (no daily cap)`
       : `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
-    `  worker max turns   ${s.caps.workerMaxTurns}`,
+    `  new worker turns   ${s.caps.workerMaxTurns}`,
     `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
-    `  attempts per issue ${s.caps.maxAttemptsPerIssue}`,
+    `  failed attempts    ${s.caps.maxAttemptsPerIssue}`,
+    `  continuations      ${s.caps.maxContinuationsPerIssue}`,
+    "",
+    formatDispatchSummary(s.dispatch),
     "",
   ];
   if (s.activeRuns.length === 0) {
@@ -968,7 +1023,7 @@ function formatProjectBody(s: StatusSnapshot): string {
     for (const r of s.activeRuns) {
       lines.push(
         `  #${r.issue}  ${r.repo}  ${r.state}  attempt ${r.attempt}  ` +
-          `${r.turns} turns  $${r.spendUsd.toFixed(2)}  ${r.branch}` +
+          `${r.turns}/${r.maxTurns} turns  $${r.spendUsd.toFixed(2)}  ${r.branch}` +
           (r.prUrl ? `  ${r.prUrl}` : ""),
       );
     }
@@ -986,12 +1041,15 @@ function formatProjectBody(s: StatusSnapshot): string {
 export async function renderStatus(projectName?: string): Promise<string> {
   const s = statusSnapshot(projectName);
   const layers = fleetLayers(projectName);
+  const project = findProject(loadConfig(), projectName);
   const rec = livingDaemon();
   const [health, telegram] = await Promise.all([
     rec === undefined ? undefined : healthCheck(rec.port),
     probeTelegramHealth(projectName),
   ]);
-  return formatFleetStatus(s, layers, health, telegram);
+  const cached = codeGraphFromHealthz(health?.body, project.name);
+  const codeGraph = cached ?? (await probeCodeGraph(project));
+  return formatFleetStatus(s, layers, health, telegram, Date.now(), codeGraph);
 }
 
 // ---------------------------------------------------------------------------

package/src/graph-health.ts

@@ -0,0 +1,296 @@
+import { existsSync } from "node:fs";
+import { graphRepos, REINDEX_UNIT, resolvePrereqs, type GraphPrereqs } from "./graph.ts";
+import type { ProjectConfig } from "./types.ts";
+
+export const GRAPH_PROBE_TIMEOUT_MS = 1_000;
+export const GRAPH_FRESHNESS_MS = 45 * 60_000;
+
+type CheckState = "present" | "missing" | "unknown";
+
+export interface CodeGraphRepoHealth {
+  name: string;
+  path: string;
+  clone: CheckState;
+  index: CheckState;
+}
+
+export type CodeGraphHealth =
+  | { configured: false }
+  | {
+      configured: true;
+      status: "healthy" | "degraded" | "unknown";
+      checkedAt: string;
+      prerequisites: {
+        indexer: CheckState;
+        mcpMount: CheckState;
+      };
+      repos: CodeGraphRepoHealth[];
+      timer: {
+        enabled: "enabled" | "disabled" | "unknown";
+        active: "active" | "inactive" | "unknown";
+      };
+      refresh: {
+        result: "success" | "failed" | "unknown";
+        fresh: boolean | null;
+        lastSuccessAt?: string;
+        ageMs?: number;
+      };
+      reasons: string[];
+    };
+
+export type ReadOnlyCommandResult =
+  | { kind: "completed"; exitCode: number; stdout: string }
+  | { kind: "timeout" }
+  | { kind: "unavailable" };
+
+/** Immediate cache value while the first bounded host probe is in flight. */
+export function pendingCodeGraph(project: ProjectConfig, now = Date.now()): CodeGraphHealth {
+  const repos = graphRepos(project);
+  if (repos.length === 0) return { configured: false };
+  return {
+    configured: true,
+    status: "unknown",
+    checkedAt: new Date(now).toISOString(),
+    prerequisites: { indexer: "unknown", mcpMount: "unknown" },
+    repos: repos.map((repo) => ({
+      name: repo.name,
+      path: repo.graphProject,
+      clone: "unknown",
+      index: "unknown",
+    })),
+    timer: { enabled: "unknown", active: "unknown" },
+    refresh: { result: "unknown", fresh: null },
+    reasons: ["graph health probe pending"],
+  };
+}
+
+export interface CodeGraphProbeDeps {
+  prereqs(): GraphPrereqs;
+  exists(path: string): boolean;
+  run(command: string, args: readonly string[]): Promise<ReadOnlyCommandResult>;
+  now(): number;
+}
+
+async function runReadOnly(command: string, args: readonly string[]): Promise<ReadOnlyCommandResult> {
+  try {
+    const proc = Bun.spawn([command, ...args], {
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "ignore",
+    });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      proc.kill("SIGKILL");
+    }, GRAPH_PROBE_TIMEOUT_MS);
+    try {
+      const [exitCode, stdout] = await Promise.all([proc.exited, new Response(proc.stdout).text()]);
+      if (timedOut) return { kind: "timeout" };
+      return { kind: "completed", exitCode, stdout };
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    return { kind: "unavailable" };
+  }
+}
+
+const DEFAULT_DEPS: CodeGraphProbeDeps = {
+  prereqs: resolvePrereqs,
+  exists: existsSync,
+  run: runReadOnly,
+  now: Date.now,
+};
+
+function indexedRoots(raw: string): Set<string> | undefined {
+  let value: unknown;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const projects = Reflect.get(value, "projects");
+  if (!Array.isArray(projects)) return undefined;
+  const roots = new Set<string>();
+  for (const project of projects) {
+    if (project === null || typeof project !== "object" || Array.isArray(project)) return undefined;
+    const root = Reflect.get(project, "root_path");
+    if (typeof root !== "string" || root.length === 0) return undefined;
+    roots.add(root);
+  }
+  return roots;
+}
+
+function timerEnabled(result: ReadOnlyCommandResult): "enabled" | "disabled" | "unknown" {
+  if (result.kind !== "completed") return "unknown";
+  switch (result.stdout.trim()) {
+    case "enabled":
+    case "enabled-runtime":
+      return "enabled";
+    case "disabled":
+    case "masked":
+    case "masked-runtime":
+    case "not-found":
+    case "static":
+      return "disabled";
+    default:
+      return "unknown";
+  }
+}
+
+function timerActive(result: ReadOnlyCommandResult): "active" | "inactive" | "unknown" {
+  if (result.kind !== "completed") return "unknown";
+  switch (result.stdout.trim()) {
+    case "active":
+      return "active";
+    case "inactive":
+    case "failed":
+    case "activating":
+    case "deactivating":
+      return "inactive";
+    default:
+      return "unknown";
+  }
+}
+
+interface RefreshResult {
+  health: Extract<CodeGraphHealth, { configured: true }>["refresh"];
+  reason?: string;
+  uncertain: boolean;
+}
+
+function refreshResult(result: ReadOnlyCommandResult, now: number): RefreshResult {
+  const unknown = (reason: string, uncertain: boolean): RefreshResult => ({
+    health: { result: "unknown", fresh: null },
+    reason,
+    uncertain,
+  });
+  if (result.kind === "timeout") return unknown("refresh service probe timed out", true);
+  if (result.kind === "unavailable") return unknown("refresh service state unavailable", true);
+  if (result.exitCode !== 0) return unknown("refresh service state unavailable", true);
+
+  const fields = new Map<string, string>();
+  for (const line of result.stdout.trim().split("\n")) {
+    const equals = line.indexOf("=");
+    if (equals < 1) return unknown("refresh service returned an unrecognized result", true);
+    fields.set(line.slice(0, equals), line.slice(equals + 1));
+  }
+  const serviceResult = fields.get("Result");
+  const exitStatus = fields.get("ExecMainStatus");
+  const completedAt = fields.get("ExecMainExitTimestamp");
+  if (serviceResult === undefined || exitStatus === undefined || completedAt === undefined) {
+    return unknown("refresh service returned an unrecognized result", true);
+  }
+  if (serviceResult !== "success" || exitStatus !== "0") {
+    return {
+      health: { result: "failed", fresh: false },
+      reason: `refresh service failed (${serviceResult || "no result"}, exit ${exitStatus || "unknown"})`,
+      uncertain: false,
+    };
+  }
+  if (completedAt === "" || completedAt === "n/a") {
+    return unknown("no successful refresh has been recorded", false);
+  }
+  const completedMs = Date.parse(completedAt);
+  const ageMs = now - completedMs;
+  if (!Number.isFinite(completedMs) || ageMs < 0) {
+    return unknown("refresh service returned an invalid completion time", true);
+  }
+  const lastSuccessAt = new Date(completedMs).toISOString();
+  if (ageMs > GRAPH_FRESHNESS_MS) {
+    return {
+      health: { result: "success", fresh: false, lastSuccessAt, ageMs },
+      reason: `last successful refresh is stale (${Math.round(ageMs / 60_000)}m old)`,
+      uncertain: false,
+    };
+  }
+  return {
+    health: { result: "success", fresh: true, lastSuccessAt, ageMs },
+    uncertain: false,
+  };
+}
+
+/**
+ * Read-only, bounded evidence for the optional code graph. Every child command
+ * is a query; this module never clones, fetches, indexes, or changes systemd.
+ */
+export async function probeCodeGraph(
+  project: ProjectConfig,
+  deps: CodeGraphProbeDeps = DEFAULT_DEPS,
+): Promise<CodeGraphHealth> {
+  const configured = graphRepos(project);
+  if (configured.length === 0) return { configured: false };
+
+  const checkedAt = new Date(deps.now()).toISOString();
+  const prereqs = deps.prereqs();
+  const reasons: string[] = [];
+  let uncertain = false;
+
+  const indexer: CheckState = prereqs.indexer === null ? "missing" : "present";
+  const mcpMount: CheckState = prereqs.mounted ? "present" : "missing";
+  if (indexer === "missing") reasons.push("indexer is not present on PATH");
+  if (mcpMount === "missing") reasons.push("worker MCP configuration does not mount the indexer");
+
+  const [projectsResult, enabledResult, activeResult, serviceResult] = await Promise.all([
+    prereqs.indexer === null
+      ? Promise.resolve<ReadOnlyCommandResult>({ kind: "unavailable" })
+      : deps.run(prereqs.indexer, ["cli", "list_projects", "{}"]),
+    deps.run("systemctl", ["is-enabled", `${REINDEX_UNIT}.timer`]),
+    deps.run("systemctl", ["is-active", `${REINDEX_UNIT}.timer`]),
+    deps.run("systemctl", [
+      "show",
+      `${REINDEX_UNIT}.service`,
+      "--property=Result",
+      "--property=ExecMainStatus",
+      "--property=ExecMainExitTimestamp",
+    ]),
+  ]);
+
+  let roots: Set<string> | undefined;
+  if (prereqs.indexer !== null) {
+    if (projectsResult.kind === "completed" && projectsResult.exitCode === 0) {
+      roots = indexedRoots(projectsResult.stdout);
+      if (roots === undefined) {
+        uncertain = true;
+        reasons.push("indexer returned malformed project data");
+      }
+    } else {
+      uncertain = true;
+      reasons.push(projectsResult.kind === "timeout" ? "indexer project probe timed out" : "indexer project state unavailable");
+    }
+  }
+
+  const repos: CodeGraphRepoHealth[] = configured.map((repo) => {
+    const clone: CheckState = deps.exists(repo.graphProject) ? "present" : "missing";
+    const index: CheckState = roots === undefined ? "unknown" : roots.has(repo.graphProject) ? "present" : "missing";
+    if (clone === "missing") reasons.push(`${repo.name}: configured clone is missing`);
+    if (index === "missing") reasons.push(`${repo.name}: no indexed project exactly matches ${repo.graphProject}`);
+    return { name: repo.name, path: repo.graphProject, clone, index };
+  });
+
+  const enabled = timerEnabled(enabledResult);
+  const active = timerActive(activeResult);
+  if (enabled === "unknown" || active === "unknown") {
+    uncertain = true;
+    reasons.push("refresh timer state is unavailable or unrecognized");
+  } else {
+    if (enabled === "disabled") reasons.push("refresh timer is disabled");
+    if (active === "inactive") reasons.push("refresh timer is inactive");
+  }
+
+  const refresh = refreshResult(serviceResult, deps.now());
+  if (refresh.reason !== undefined) reasons.push(refresh.reason);
+  uncertain ||= refresh.uncertain;
+
+  return {
+    configured: true,
+    status: uncertain ? "unknown" : reasons.length === 0 ? "healthy" : "degraded",
+    checkedAt,
+    prerequisites: { indexer, mcpMount },
+    repos,
+    timer: { enabled, active },
+    refresh: refresh.health,
+    reasons,
+  };
+}

package/src/graph.ts

@@ -11,12 +11,12 @@
  *
  * Two hard boundaries hold everything here together:
  *
- * - **This package never runs an indexer, and never depends on one.** Nothing
- *   below spawns the graph server, imports it, or checks for it; the daemon's
- *   dispatch, caps and escalation paths do not mention it. `graph-setup` prints
- *   commands, and with `--write` writes two systemd units — it does not even run
- *   `systemctl`, because the wizard and the CLI are not root and a package that
- *   silently writes root-level state is not one you can trust with a fleet.
+ * - **This package never builds or mutates an index, and never depends on the
+ *   indexer for dispatch.** The optional health surface runs the indexer's
+ *   read-only `list_projects` query; nothing spawns the graph server or imports
+ *   it. `graph-setup` prints commands, and with `--write` writes two systemd
+ *   units — it does not enable them, because a package that silently writes
+ *   root-level state is not one you can trust with a fleet.
  * - **A worker never queries its own worktree.** An index is keyed by the
  *   realpath of the directory it was built from, with no git-worktree awareness,
  *   so a run's `worktrees/<issue>` path is always an empty project. Workers are

package/src/omp.ts

@@ -14,6 +14,8 @@
  * the module, which is the whole reason this shim exists.
  */
 import { worktreeConfinement } from "./confinement.ts";
+import { releasePolicyTripwire, type ReleaseShape } from "./release-policy.ts";
+import type { ReleasePolicy } from "./types.ts";
 
 const OMP_PACKAGE = "@oh-my-pi/pi-coding-agent";
 
@@ -122,6 +124,10 @@ export async function createSession(opts: {
    * to read the state directory and briefs.
    */
   confineToCwd?: boolean;
+  /** Install the release/deploy tool-call gate for this session. */
+  releasePolicy?: ReleasePolicy;
+  /** Durable audit callback invoked only when that gate rejects a call. */
+  onReleaseBlocked?: (shape: ReleaseShape) => void;
 }): Promise<AgentSessionLike> {
   let loaded: unknown;
   try {
@@ -158,6 +164,12 @@ export async function createSession(opts: {
   // `session.sessionFile` undefined, and once the worktree is gone the
   // transcript is the only record of what the worker actually did.
   const sessionManager = await openSessionManager(mod, opts);
+  const extensions = [
+    ...(opts.confineToCwd ? [worktreeConfinement(opts.cwd)] : []),
+    ...(opts.releasePolicy === undefined
+      ? []
+      : [releasePolicyTripwire(opts.releasePolicy, opts.onReleaseBlocked)]),
+  ];
 
   const created = await mod.createAgentSession({
     cwd: opts.cwd,
@@ -175,10 +187,9 @@ export async function createSession(opts: {
     // agentDir (~/.omp/agent/mcp.json) — without this, workers grep-only and
     // burn the turns cap on discovery (#29).
     enableMCP: true,
-    // Mechanical worktree gate (#24): structured write/edit/read/grep/glob
-    // whose path resolves outside cwd are blocked before execution. Inline
-    // extension — the harness has no separate fs-policy field.
-    ...(opts.confineToCwd ? { extensions: [worktreeConfinement(opts.cwd)] } : {}),
+    // Mechanical tool gates: confinement prevents structured worktree I/O from
+    // escaping cwd; release policy blocks release/deploy calls when configured.
+    ...(extensions.length === 0 ? {} : { extensions }),
   });
   const raw = asRawSession(created);
   // Surfaced rather than swallowed: this is how a quiet downgrade to a weaker