omp-conductor 0.3.25 → 0.4.1

package/src/session-host.ts

@@ -0,0 +1,307 @@
+#!/usr/bin/env bun
+/**
+ * The child process one omp session runs in (#125 A1).
+ *
+ * Before this file existed, `createSession` called the harness in the daemon's
+ * own process, so every session inherited the daemon's `process.env`, its
+ * `$HOME` and its whole filesystem view — and the daemon authenticates by
+ * shelling out to the operator's logged-in `gh`. No amount of tool-layer
+ * confinement closes that, because `bash` is deliberately unconfined and the
+ * credential is reachable by running the same binary the daemon runs.
+ *
+ * So the session moves out of process. This file is the far side: it loads the
+ * harness, runs the real session, and speaks a five-verb protocol back over a
+ * unix socket to the {@link AgentSessionLike} proxy in `omp.ts`. It holds no
+ * conductor state, opens no database, and reads no config — everything it needs
+ * arrives in {@link SessionHostSpec}, because under `uid-pool` this process runs
+ * as a principal that cannot read the daemon's state directory at all.
+ *
+ * The protocol is deliberately tiny. `AgentSessionLike` has five members, so
+ * there are five things to carry, and every one of them is data.
+ */
+
+import { connect } from "node:net";
+
+import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
+import type { OrchestratorJail, OrchestratorRefusal } from "./confinement.ts";
+import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
+
+/**
+ * Everything the child needs to build the session. Plain JSON on purpose:
+ * callbacks (`onReleaseBlocked`, the confinement audit sink) cannot cross a
+ * process boundary, so they become messages instead — see
+ * {@link HostToParent}.
+ */
+export interface SessionHostSpec {
+  socket: string;
+  cwd: string;
+  role: SessionRole;
+  sessionDir?: string;
+  model?: string;
+  resume?: boolean;
+  releaseGrants?: ResolvedGrants;
+  /**
+   * Resolved by the *parent*, never by this process. `orchestratorJailFromConfig`
+   * reads the conductor config, and an isolated child cannot — a jail that
+   * silently fell back to defaults here would widen the very gate #127 closed.
+   */
+  orchestratorJail?: OrchestratorJail;
+  /**
+   * The conductor verb socket this session may call mutations on (#126).
+   *
+   * Carried in the spec rather than read from the environment by the child,
+   * for the same reason `orchestratorJail` is resolved by the parent: the
+   * child deciding *which* socket it owns is the child deciding which run it
+   * is, and that is the question the transport exists to stop it answering.
+   * Absent, the verbs are registered and every one of them fails closed.
+   */
+  verbSocketPath?: string;
+}
+
+/** Parent → child. */
+export type ParentToHost =
+  | { t: "prompt"; id: number; text: string; opts?: Record<string, unknown> }
+  | { t: "abort" }
+  | { t: "dispose" };
+
+/** Child → parent. */
+export type HostToParent =
+  | { t: "ready"; sessionFile?: string; modelFallbackMessage?: string }
+  | { t: "start-error"; message: string }
+  | { t: "event"; event: unknown }
+  | { t: "session-file"; path: string }
+  | { t: "prompt-result"; id: number; ok: boolean; error?: string }
+  | { t: "release-blocked"; shape: ReleaseShape }
+  | { t: "confinement-refusal"; refusal: OrchestratorRefusal };
+
+/**
+ * Depth at which a harness event stops being copied for the wire.
+ *
+ * Every field this package actually reads — `type`, `message.role`,
+ * `message.content[].text`, `message.usage.cost.total`,
+ * `telemetry.cost.estimatedUsd`, `isTerminal` — is within five levels. The cap
+ * exists for the other direction: a harness event holding a client, a socket or
+ * a parent pointer would otherwise be walked until something threw, and losing
+ * the event stream is losing turn counting, spend accounting and the run's
+ * report.
+ */
+const EVENT_DEPTH = 8;
+
+/**
+ * A JSON-safe copy of one harness event.
+ *
+ * Cycle- and depth-guarded rather than a bare `JSON.stringify`, because the
+ * event union belongs to the peer dependency and this package does not get to
+ * assume it is a tree. Functions, symbols and `undefined` drop out the way they
+ * would through `JSON.stringify`; a `Date` keeps its ISO form; anything that
+ * refuses to be read is replaced by `null` rather than taking the event with it.
+ */
+export function serializableEvent(value: unknown, depth = EVENT_DEPTH, seen = new WeakSet<object>()): unknown {
+  if (value === null || typeof value !== "object") {
+    return typeof value === "function" || typeof value === "symbol" || typeof value === "bigint"
+      ? undefined
+      : value;
+  }
+  if (value instanceof Date) return value.toISOString();
+  if (seen.has(value)) return null;
+  if (depth <= 0) return null;
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) return value.map((item) => serializableEvent(item, depth - 1, seen));
+    const out: Record<string, unknown> = {};
+    for (const [key, raw] of Object.entries(value)) {
+      const copied = serializableEvent(raw, depth - 1, seen);
+      if (copied !== undefined) out[key] = copied;
+    }
+    return out;
+  } catch {
+    return null;
+  } finally {
+    seen.delete(value);
+  }
+}
+
+/** Newline-delimited JSON both ways. Values are escaped, so a newline is a frame. */
+export function encodeFrame(message: HostToParent | ParentToHost): string {
+  return `${JSON.stringify(message)}\n`;
+}
+
+/**
+ * Split a growing buffer into whole frames. Returns the frames and the tail that
+ * is not a frame yet — a socket read boundary lands mid-message routinely, and
+ * dropping that tail loses whichever message straddled it.
+ */
+export function decodeFrames(buffer: string): { frames: unknown[]; rest: string } {
+  const parts = buffer.split("\n");
+  const rest = parts.pop() ?? "";
+  const frames: unknown[] = [];
+  for (const part of parts) {
+    if (part === "") continue;
+    try {
+      frames.push(JSON.parse(part));
+    } catch {
+      // A torn frame must not stop the frames written after it: losing one
+      // event costs a turn count, losing the stream costs the run.
+    }
+  }
+  return { frames, rest };
+}
+
+export interface SessionHostDeps {
+  createSession: typeof createLocalSession;
+}
+
+/**
+ * Run one session until the parent disposes it or the socket drops.
+ *
+ * Resolves when the session is over. Never throws for a session that failed to
+ * start: the failure is reported as `start-error` and the parent turns it back
+ * into the same `Error` the in-process path would have raised, so a missing
+ * peer dependency still reads as a deployment mistake rather than as an
+ * unexplained child exit.
+ */
+export async function runSessionHost(
+  spec: SessionHostSpec,
+  deps: SessionHostDeps = { createSession: createLocalSession },
+): Promise<void> {
+  // umask before anything is created. Under uid-pool the run tree is
+  // `2770 slot:conductor-daemon`, and the setgid bit only decides the *group*
+  // of what this process writes — without `0007` the mode still lands `0644`
+  // and the daemon's access to a file the worker created is silently partial,
+  // which surfaces as a failed salvage in production rather than here.
+  process.umask(0o007);
+
+  const socket = connect(spec.socket);
+  socket.setNoDelay(true);
+  const send = (message: HostToParent): void => {
+    if (!socket.writableEnded) socket.write(encodeFrame(message));
+  };
+
+  const { promise: connected, resolve: onConnect, reject: onConnectFail } = Promise.withResolvers<void>();
+  socket.once("connect", () => {
+    onConnect();
+  });
+  socket.once("error", (err: Error) => {
+    onConnectFail(err);
+  });
+  await connected;
+
+  let session: AgentSessionLike | undefined;
+  try {
+    session = await deps.createSession({
+      cwd: spec.cwd,
+      role: spec.role,
+      ...(spec.sessionDir === undefined ? {} : { sessionDir: spec.sessionDir }),
+      ...(spec.model === undefined ? {} : { model: spec.model }),
+      ...(spec.resume === undefined ? {} : { resume: spec.resume }),
+      ...(spec.releaseGrants === undefined ? {} : { releaseGrants: spec.releaseGrants }),
+      ...(spec.orchestratorJail === undefined ? {} : { orchestratorJail: spec.orchestratorJail }),
+      ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
+      // Both audit sinks live in the daemon's state directory, which this
+      // process may not be able to write and must not be trusted to. They
+      // become messages; the parent performs the durable write.
+      onReleaseBlocked: (shape) => {
+        send({ t: "release-blocked", shape });
+      },
+      onConfinementRefusal: (refusal) => {
+        send({ t: "confinement-refusal", refusal });
+      },
+    });
+  } catch (err) {
+    send({ t: "start-error", message: err instanceof Error ? err.message : String(err) });
+    socket.end();
+    return;
+  }
+
+  const live = session;
+  // `sessionFile` is a getter that can materialise after the session opens, and
+  // the daemon records it as the only readable evidence a run leaves behind. So
+  // it is re-read on every event rather than captured once.
+  let lastSessionFile = live.sessionFile;
+  live.on("*", (event) => {
+    send({ t: "event", event: serializableEvent(event) });
+    const current = live.sessionFile;
+    if (current !== undefined && current !== lastSessionFile) {
+      lastSessionFile = current;
+      send({ t: "session-file", path: current });
+    }
+  });
+
+  send({
+    t: "ready",
+    ...(live.sessionFile === undefined ? {} : { sessionFile: live.sessionFile }),
+    ...(live.modelFallbackMessage === undefined
+      ? {}
+      : { modelFallbackMessage: live.modelFallbackMessage }),
+  });
+
+  const { promise: finished, resolve: finish } = Promise.withResolvers<void>();
+  let buffer = "";
+  socket.on("data", (chunk: Buffer) => {
+    buffer += chunk.toString("utf8");
+    const { frames, rest } = decodeFrames(buffer);
+    buffer = rest;
+    for (const frame of frames) {
+      const message = frame as ParentToHost;
+      if (message.t === "prompt") {
+        void live.prompt(message.text, message.opts).then(
+          () => {
+            send({ t: "prompt-result", id: message.id, ok: true });
+          },
+          (err: unknown) => {
+            send({
+              t: "prompt-result",
+              id: message.id,
+              ok: false,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          },
+        );
+        continue;
+      }
+      if (message.t === "abort") {
+        live.abort();
+        continue;
+      }
+      if (message.t === "dispose") finish();
+    }
+  });
+
+  // A dead parent must not leave a live session holding a checkout and a model
+  // budget. The daemon dying used to take its in-process sessions with it; the
+  // socket closing is how that stays true now it does not.
+  socket.on("close", () => {
+    finish();
+  });
+  await finished;
+
+  try {
+    live.abort();
+  } catch {
+    // Already finished, or a harness that dislikes a second abort. Either way
+    // teardown continues: this path runs on the way out.
+  }
+  try {
+    await disposeSession(live);
+  } catch {
+    // Teardown noise must not become the run's outcome.
+  }
+  socket.end();
+}
+
+/** Reads the spec the parent handed over. Argv, not stdin: stdin is the harness's. */
+function specFromArgv(argv: readonly string[]): SessionHostSpec {
+  const raw = argv[2];
+  if (raw === undefined) {
+    throw new Error("omp-conductor session host: expected a JSON session spec as argv[2]");
+  }
+  return JSON.parse(raw) as SessionHostSpec;
+}
+
+if (import.meta.main) {
+  // Exit code is the parent's only signal when the socket never opened, so a
+  // spec that will not parse fails loudly here rather than as a silent hang.
+  const spec = specFromArgv(process.argv);
+  await runSessionHost(spec);
+  process.exit(0);
+}

package/src/setup-host.ts

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
-import { configPath, stateDir } from "./config.ts";
+import { configPath, resolveCredentials, sharedRoot, stateDir } from "./config.ts";
 import { isPaused, runDaemon, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
 import { DEFAULT_FLEET_AGENT_NAME } from "./fleet.ts";
 import {
@@ -110,6 +110,28 @@ export function renderDaemonService(
     `Environment=${systemdQuote(`PATH=${runtime.path}`)}`,
     `Environment=${systemdQuote(`OMP_CONDUCTOR_HOME=${runtime.conductorHome}`)}`,
     `Environment=${systemdQuote(`OMP_TELEGRAM_STATE_DIR=${runtime.telegramStateDir}`)}`,
+    // Both of these are per-run only, and grouped so the managed set stays one
+    // idea. The shared root is baked in so a custom location survives systemd's
+    // clean environment — without it the daemon resolves the platform default
+    // while the operator provisioned somewhere else, and every dispatch is
+    // refused for a path nobody chose. It is meaningless under `none`, where
+    // nothing resolves it, and rendering it there would make every unit
+    // installed before 0.4.0 look drifted for no reason (#125).
+    //
+    // The capabilities exist to be DROPPED INTO run children by the
+    // privilege-dropping launcher, never inherited by them — see `setprivArgv`.
+    // Rendered only for `per-run`, because that is the only isolation that
+    // changes uid; granting them to a fleet that does not need them widens the
+    // daemon for nothing. Without them the probe honestly reports `group-mode`
+    // and a configured per-run fleet refuses every dispatch, which is the
+    // failure an operator following setup would otherwise hit first.
+    ...(resolveCredentials(project).isolation === "per-run"
+      ? [
+          `Environment=${systemdQuote(`OMP_CONDUCTOR_SHARED=${sharedRoot()}`)}`,
+          "AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
+          "CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
+        ]
+      : []),
     `WorkingDirectory=${systemdQuote(stateDir())}`,
     `ExecStart=${command.map(systemdQuote).join(" ")}`,
     "Restart=on-failure",
@@ -283,3 +305,142 @@ export async function runSetupSmoke(
     await deps.stop();
   }
 }
+
+/** Absolute path of the unit systemd actually reads. */
+export function installedUnitPath(): string {
+  return join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME);
+}
+
+/**
+ * Why the *live* systemd unit no longer matches what this version would render.
+ *
+ * `planHostRuntime` compares against the **staged** copy under the state dir,
+ * which says nothing about the file systemd booted from. That gap is not
+ * cosmetic since 0.4.0: a fleet configured `per-run` whose installed unit
+ * predates the capability grant probes down to `group-mode` and then refuses
+ * every dispatch — and `upgrade` would happily verify package identities,
+ * services, pane and ticks around it, because none of those look at the unit.
+ *
+ * Checked by directive rather than by whole-file equality on purpose. An
+ * operator is entitled to hand-tune `MemoryMax`, add `After=`, or set an
+ * `Environment=` of their own, and failing an upgrade over that would teach
+ * them to stop running upgrades. What is reported is the set of directives this
+ * configuration *requires* and the live unit lacks.
+ *
+ * `undefined` means either "no drift that matters" or "no installed unit at
+ * all" — a host running `omp-conductor start` without systemd is not broken,
+ * and must not be told it is.
+ */
+/**
+ * What systemd has actually loaded for the unit, as `systemctl show` reports it.
+ *
+ * Deliberately not the file on disk. A unit installed without `daemon-reload`
+ * can match the rendered text byte for byte while the manager still runs the
+ * previous configuration, and a drop-in under `…service.d/` changes what runs
+ * without touching the file at all. Both read clean from the filesystem.
+ */
+export interface EffectiveUnit {
+  /** `systemctl show -p AmbientCapabilities`; empty string when unset. */
+  ambientCapabilities: string;
+  capabilityBoundingSet: string;
+  /** `systemctl show -p Environment`, newline- or space-joined. */
+  environment: string;
+  needDaemonReload: boolean;
+}
+
+/** Capability names as a comparable set: systemd reports them lowercased, `cap_`-prefixed and reordered. */
+function capabilitySet(text: string): Set<string> {
+  return new Set(
+    text
+      .split(/[\s,]+/)
+      .map((name) => name.trim().toLowerCase().replace(/^cap_/, ""))
+      .filter((name) => name.length > 0),
+  );
+}
+
+function renderedDirective(rendered: string, key: string): string | undefined {
+  for (const line of rendered.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith(`${key}=`)) return trimmed.slice(key.length + 1);
+  }
+  return undefined;
+}
+
+/**
+ * Why what systemd loaded no longer matches what this version would render.
+ *
+ * Three asymmetries, each for a reason:
+ *
+ * - **Ambient capabilities are compared exactly, both ways.** Missing them
+ *   breaks a per-run fleet; *leftover* ones are worse. Roll back to `none` and
+ *   there is no `setpriv` launcher at all, so ambient capabilities on the unit
+ *   are inherited straight into model-executed code, which can then `setuid()`
+ *   to any account. `systemctl` reports an empty string when unset, so the
+ *   rollback case is unambiguous.
+ * - **The bounding set is checked only when this version sets it.** systemd
+ *   reports the full default set when a unit does not, so comparing both ways
+ *   would flag every ordinary host.
+ * - **Only directives this configuration manages are considered**, so an
+ *   operator's own `MemoryMax`, `After=` or drop-in never fails an upgrade.
+ */
+export function unitDriftReason(rendered: string, effective: EffectiveUnit | undefined): string | undefined {
+  if (effective === undefined) return undefined;
+  const problems: string[] = [];
+
+  const wantAmbient = capabilitySet(renderedDirective(rendered, "AmbientCapabilities") ?? "");
+  const haveAmbient = capabilitySet(effective.ambientCapabilities);
+  const missingAmbient = [...wantAmbient].filter((c) => !haveAmbient.has(c));
+  const extraAmbient = [...haveAmbient].filter((c) => !wantAmbient.has(c));
+  if (missingAmbient.length > 0) {
+    problems.push(`AmbientCapabilities is missing ${missingAmbient.join(", ")}`);
+  }
+  if (extraAmbient.length > 0) {
+    problems.push(
+      `AmbientCapabilities grants ${extraAmbient.join(", ")} that this configuration does not — with ` +
+        `isolation off there is no privilege-dropping launcher, so these are inherited by model-executed code`,
+    );
+  }
+
+  const wantBounding = renderedDirective(rendered, "CapabilityBoundingSet");
+  if (wantBounding !== undefined) {
+    const missing = [...capabilitySet(wantBounding)].filter(
+      (c) => !capabilitySet(effective.capabilityBoundingSet).has(c),
+    );
+    if (missing.length > 0) problems.push(`CapabilityBoundingSet is missing ${missing.join(", ")}`);
+  }
+
+  const wantShared = rendered
+    .split("\n")
+    .map((l) => l.trim())
+    .find((l) => l.includes("OMP_CONDUCTOR_SHARED="));
+  if (wantShared !== undefined) {
+    const value = wantShared.slice(wantShared.indexOf("OMP_CONDUCTOR_SHARED=")).replace(/"$/, "");
+    if (!effective.environment.includes(value)) {
+      problems.push(`Environment is missing ${value}`);
+    }
+  }
+
+  if (effective.needDaemonReload) {
+    problems.push("systemd reports the unit needs a daemon-reload, so what runs is not what is on disk");
+  }
+
+  if (problems.length === 0) return undefined;
+  return (
+    `what systemd loaded for ${STAGED_SERVICE_NAME} does not match this configuration: ${problems.join("; ")}.`
+  );
+}
+
+/** Parse `systemctl show -p …` key=value output into an {@link EffectiveUnit}. */
+export function parseEffectiveUnit(stdout: string): EffectiveUnit {
+  const values = new Map<string, string>();
+  for (const line of stdout.split("\n")) {
+    const at = line.indexOf("=");
+    if (at > 0) values.set(line.slice(0, at).trim(), line.slice(at + 1).trim());
+  }
+  return {
+    ambientCapabilities: values.get("AmbientCapabilities") ?? "",
+    capabilityBoundingSet: values.get("CapabilityBoundingSet") ?? "",
+    environment: values.get("Environment") ?? "",
+    needDaemonReload: (values.get("NeedDaemonReload") ?? "no") === "yes",
+  };
+}