omp-conductor 0.3.25 → 0.4.0

package/src/session-host.ts

@@ -0,0 +1,307 @@
+#!/usr/bin/env bun
+/**
+ * The child process one omp session runs in (#125 A1).
+ *
+ * Before this file existed, `createSession` called the harness in the daemon's
+ * own process, so every session inherited the daemon's `process.env`, its
+ * `$HOME` and its whole filesystem view — and the daemon authenticates by
+ * shelling out to the operator's logged-in `gh`. No amount of tool-layer
+ * confinement closes that, because `bash` is deliberately unconfined and the
+ * credential is reachable by running the same binary the daemon runs.
+ *
+ * So the session moves out of process. This file is the far side: it loads the
+ * harness, runs the real session, and speaks a five-verb protocol back over a
+ * unix socket to the {@link AgentSessionLike} proxy in `omp.ts`. It holds no
+ * conductor state, opens no database, and reads no config — everything it needs
+ * arrives in {@link SessionHostSpec}, because under `uid-pool` this process runs
+ * as a principal that cannot read the daemon's state directory at all.
+ *
+ * The protocol is deliberately tiny. `AgentSessionLike` has five members, so
+ * there are five things to carry, and every one of them is data.
+ */
+
+import { connect } from "node:net";
+
+import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
+import type { OrchestratorJail, OrchestratorRefusal } from "./confinement.ts";
+import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
+
+/**
+ * Everything the child needs to build the session. Plain JSON on purpose:
+ * callbacks (`onReleaseBlocked`, the confinement audit sink) cannot cross a
+ * process boundary, so they become messages instead — see
+ * {@link HostToParent}.
+ */
+export interface SessionHostSpec {
+  socket: string;
+  cwd: string;
+  role: SessionRole;
+  sessionDir?: string;
+  model?: string;
+  resume?: boolean;
+  releaseGrants?: ResolvedGrants;
+  /**
+   * Resolved by the *parent*, never by this process. `orchestratorJailFromConfig`
+   * reads the conductor config, and an isolated child cannot — a jail that
+   * silently fell back to defaults here would widen the very gate #127 closed.
+   */
+  orchestratorJail?: OrchestratorJail;
+  /**
+   * The conductor verb socket this session may call mutations on (#126).
+   *
+   * Carried in the spec rather than read from the environment by the child,
+   * for the same reason `orchestratorJail` is resolved by the parent: the
+   * child deciding *which* socket it owns is the child deciding which run it
+   * is, and that is the question the transport exists to stop it answering.
+   * Absent, the verbs are registered and every one of them fails closed.
+   */
+  verbSocketPath?: string;
+}
+
+/** Parent → child. */
+export type ParentToHost =
+  | { t: "prompt"; id: number; text: string; opts?: Record<string, unknown> }
+  | { t: "abort" }
+  | { t: "dispose" };
+
+/** Child → parent. */
+export type HostToParent =
+  | { t: "ready"; sessionFile?: string; modelFallbackMessage?: string }
+  | { t: "start-error"; message: string }
+  | { t: "event"; event: unknown }
+  | { t: "session-file"; path: string }
+  | { t: "prompt-result"; id: number; ok: boolean; error?: string }
+  | { t: "release-blocked"; shape: ReleaseShape }
+  | { t: "confinement-refusal"; refusal: OrchestratorRefusal };
+
+/**
+ * Depth at which a harness event stops being copied for the wire.
+ *
+ * Every field this package actually reads — `type`, `message.role`,
+ * `message.content[].text`, `message.usage.cost.total`,
+ * `telemetry.cost.estimatedUsd`, `isTerminal` — is within five levels. The cap
+ * exists for the other direction: a harness event holding a client, a socket or
+ * a parent pointer would otherwise be walked until something threw, and losing
+ * the event stream is losing turn counting, spend accounting and the run's
+ * report.
+ */
+const EVENT_DEPTH = 8;
+
+/**
+ * A JSON-safe copy of one harness event.
+ *
+ * Cycle- and depth-guarded rather than a bare `JSON.stringify`, because the
+ * event union belongs to the peer dependency and this package does not get to
+ * assume it is a tree. Functions, symbols and `undefined` drop out the way they
+ * would through `JSON.stringify`; a `Date` keeps its ISO form; anything that
+ * refuses to be read is replaced by `null` rather than taking the event with it.
+ */
+export function serializableEvent(value: unknown, depth = EVENT_DEPTH, seen = new WeakSet<object>()): unknown {
+  if (value === null || typeof value !== "object") {
+    return typeof value === "function" || typeof value === "symbol" || typeof value === "bigint"
+      ? undefined
+      : value;
+  }
+  if (value instanceof Date) return value.toISOString();
+  if (seen.has(value)) return null;
+  if (depth <= 0) return null;
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) return value.map((item) => serializableEvent(item, depth - 1, seen));
+    const out: Record<string, unknown> = {};
+    for (const [key, raw] of Object.entries(value)) {
+      const copied = serializableEvent(raw, depth - 1, seen);
+      if (copied !== undefined) out[key] = copied;
+    }
+    return out;
+  } catch {
+    return null;
+  } finally {
+    seen.delete(value);
+  }
+}
+
+/** Newline-delimited JSON both ways. Values are escaped, so a newline is a frame. */
+export function encodeFrame(message: HostToParent | ParentToHost): string {
+  return `${JSON.stringify(message)}\n`;
+}
+
+/**
+ * Split a growing buffer into whole frames. Returns the frames and the tail that
+ * is not a frame yet — a socket read boundary lands mid-message routinely, and
+ * dropping that tail loses whichever message straddled it.
+ */
+export function decodeFrames(buffer: string): { frames: unknown[]; rest: string } {
+  const parts = buffer.split("\n");
+  const rest = parts.pop() ?? "";
+  const frames: unknown[] = [];
+  for (const part of parts) {
+    if (part === "") continue;
+    try {
+      frames.push(JSON.parse(part));
+    } catch {
+      // A torn frame must not stop the frames written after it: losing one
+      // event costs a turn count, losing the stream costs the run.
+    }
+  }
+  return { frames, rest };
+}
+
+export interface SessionHostDeps {
+  createSession: typeof createLocalSession;
+}
+
+/**
+ * Run one session until the parent disposes it or the socket drops.
+ *
+ * Resolves when the session is over. Never throws for a session that failed to
+ * start: the failure is reported as `start-error` and the parent turns it back
+ * into the same `Error` the in-process path would have raised, so a missing
+ * peer dependency still reads as a deployment mistake rather than as an
+ * unexplained child exit.
+ */
+export async function runSessionHost(
+  spec: SessionHostSpec,
+  deps: SessionHostDeps = { createSession: createLocalSession },
+): Promise<void> {
+  // umask before anything is created. Under uid-pool the run tree is
+  // `2770 slot:conductor-daemon`, and the setgid bit only decides the *group*
+  // of what this process writes — without `0007` the mode still lands `0644`
+  // and the daemon's access to a file the worker created is silently partial,
+  // which surfaces as a failed salvage in production rather than here.
+  process.umask(0o007);
+
+  const socket = connect(spec.socket);
+  socket.setNoDelay(true);
+  const send = (message: HostToParent): void => {
+    if (!socket.writableEnded) socket.write(encodeFrame(message));
+  };
+
+  const { promise: connected, resolve: onConnect, reject: onConnectFail } = Promise.withResolvers<void>();
+  socket.once("connect", () => {
+    onConnect();
+  });
+  socket.once("error", (err: Error) => {
+    onConnectFail(err);
+  });
+  await connected;
+
+  let session: AgentSessionLike | undefined;
+  try {
+    session = await deps.createSession({
+      cwd: spec.cwd,
+      role: spec.role,
+      ...(spec.sessionDir === undefined ? {} : { sessionDir: spec.sessionDir }),
+      ...(spec.model === undefined ? {} : { model: spec.model }),
+      ...(spec.resume === undefined ? {} : { resume: spec.resume }),
+      ...(spec.releaseGrants === undefined ? {} : { releaseGrants: spec.releaseGrants }),
+      ...(spec.orchestratorJail === undefined ? {} : { orchestratorJail: spec.orchestratorJail }),
+      ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
+      // Both audit sinks live in the daemon's state directory, which this
+      // process may not be able to write and must not be trusted to. They
+      // become messages; the parent performs the durable write.
+      onReleaseBlocked: (shape) => {
+        send({ t: "release-blocked", shape });
+      },
+      onConfinementRefusal: (refusal) => {
+        send({ t: "confinement-refusal", refusal });
+      },
+    });
+  } catch (err) {
+    send({ t: "start-error", message: err instanceof Error ? err.message : String(err) });
+    socket.end();
+    return;
+  }
+
+  const live = session;
+  // `sessionFile` is a getter that can materialise after the session opens, and
+  // the daemon records it as the only readable evidence a run leaves behind. So
+  // it is re-read on every event rather than captured once.
+  let lastSessionFile = live.sessionFile;
+  live.on("*", (event) => {
+    send({ t: "event", event: serializableEvent(event) });
+    const current = live.sessionFile;
+    if (current !== undefined && current !== lastSessionFile) {
+      lastSessionFile = current;
+      send({ t: "session-file", path: current });
+    }
+  });
+
+  send({
+    t: "ready",
+    ...(live.sessionFile === undefined ? {} : { sessionFile: live.sessionFile }),
+    ...(live.modelFallbackMessage === undefined
+      ? {}
+      : { modelFallbackMessage: live.modelFallbackMessage }),
+  });
+
+  const { promise: finished, resolve: finish } = Promise.withResolvers<void>();
+  let buffer = "";
+  socket.on("data", (chunk: Buffer) => {
+    buffer += chunk.toString("utf8");
+    const { frames, rest } = decodeFrames(buffer);
+    buffer = rest;
+    for (const frame of frames) {
+      const message = frame as ParentToHost;
+      if (message.t === "prompt") {
+        void live.prompt(message.text, message.opts).then(
+          () => {
+            send({ t: "prompt-result", id: message.id, ok: true });
+          },
+          (err: unknown) => {
+            send({
+              t: "prompt-result",
+              id: message.id,
+              ok: false,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          },
+        );
+        continue;
+      }
+      if (message.t === "abort") {
+        live.abort();
+        continue;
+      }
+      if (message.t === "dispose") finish();
+    }
+  });
+
+  // A dead parent must not leave a live session holding a checkout and a model
+  // budget. The daemon dying used to take its in-process sessions with it; the
+  // socket closing is how that stays true now it does not.
+  socket.on("close", () => {
+    finish();
+  });
+  await finished;
+
+  try {
+    live.abort();
+  } catch {
+    // Already finished, or a harness that dislikes a second abort. Either way
+    // teardown continues: this path runs on the way out.
+  }
+  try {
+    await disposeSession(live);
+  } catch {
+    // Teardown noise must not become the run's outcome.
+  }
+  socket.end();
+}
+
+/** Reads the spec the parent handed over. Argv, not stdin: stdin is the harness's. */
+function specFromArgv(argv: readonly string[]): SessionHostSpec {
+  const raw = argv[2];
+  if (raw === undefined) {
+    throw new Error("omp-conductor session host: expected a JSON session spec as argv[2]");
+  }
+  return JSON.parse(raw) as SessionHostSpec;
+}
+
+if (import.meta.main) {
+  // Exit code is the parent's only signal when the socket never opened, so a
+  // spec that will not parse fails loudly here rather than as a silent hang.
+  const spec = specFromArgv(process.argv);
+  await runSessionHost(spec);
+  process.exit(0);
+}

package/src/setup-host.ts

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
-import { configPath, stateDir } from "./config.ts";
+import { configPath, resolveCredentials, sharedRoot, stateDir } from "./config.ts";
 import { isPaused, runDaemon, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
 import { DEFAULT_FLEET_AGENT_NAME } from "./fleet.ts";
 import {
@@ -110,6 +110,24 @@ export function renderDaemonService(
     `Environment=${systemdQuote(`PATH=${runtime.path}`)}`,
     `Environment=${systemdQuote(`OMP_CONDUCTOR_HOME=${runtime.conductorHome}`)}`,
     `Environment=${systemdQuote(`OMP_TELEGRAM_STATE_DIR=${runtime.telegramStateDir}`)}`,
+    // Baked in so a custom shared root survives systemd's clean environment.
+    // Without it the daemon resolves the platform default while the operator
+    // provisioned somewhere else, and every per-run dispatch is refused for a
+    // path nobody chose (#125).
+    `Environment=${systemdQuote(`OMP_CONDUCTOR_SHARED=${sharedRoot()}`)}`,
+    // The capabilities exist to be DROPPED INTO run children by the
+    // privilege-dropping launcher, never inherited by them — see `setprivArgv`.
+    // Rendered only for `per-run`, because that is the only isolation that
+    // changes uid; granting them to a fleet that does not need them widens the
+    // daemon for nothing. Without them the probe honestly reports `group-mode`
+    // and a configured per-run fleet refuses every dispatch, which is the
+    // failure an operator following setup would otherwise hit first.
+    ...(resolveCredentials(project).isolation === "per-run"
+      ? [
+          "AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
+          "CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
+        ]
+      : []),
     `WorkingDirectory=${systemdQuote(stateDir())}`,
     `ExecStart=${command.map(systemdQuote).join(" ")}`,
     "Restart=on-failure",