omp-conductor 0.3.7 → 0.3.11

package/src/orchestrator-tick.ts

@@ -94,6 +94,14 @@ const RETRY_OWNERSHIP_MS = 60_000;
 export const STALL_MARKER_FILE = ".conductor-stalled";
 export const STALL_TICKS = 2;
 
+/**
+ * Written by herdr-conductor `recover.sh` *before* `agent start`, so a resumed
+ * fleet can reconcile orphans without waiting a full `intervalSeconds`. Cleared
+ * only after a tick is actually sent — a disarmed or channel-down fleet keeps
+ * the request until gates pass (or a human removes the file).
+ */
+export const TICK_REQUESTED_FILE = ".conductor-tick-requested";
+
 /**
  * The marker's one line after its ISO timestamp, and the middle of the error
  * log. Shared so the file and the log can never describe different failures.
@@ -834,6 +842,23 @@ function clearStallMarker(pi: TickApi, cwd: string): void {
   }
 }
 
+/**
+ * Best-effort, same posture as {@link clearStallMarker}. Leaving the file on a
+ * failed unlink means the next successful send retries the clear; that is
+ * preferable to treating a recover poke as fire-and-forget when the tick did
+ * land.
+ */
+function clearTickRequest(pi: TickApi, cwd: string): void {
+  const path = join(cwd, TICK_REQUESTED_FILE);
+  if (!existsSync(path)) return;
+  try {
+    rmSync(path, { force: true });
+    pi.logger.info("[omp-conductor] recover tick request cleared: a tick was sent");
+  } catch (err) {
+    pi.logger.error(`[omp-conductor] could not remove ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 /** Everything one tick remembers for the next. */
 interface TickSession {
   /**
@@ -900,6 +925,21 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // this is the only place either the counter or the marker is cleared.
   session.pendingSkips = 0;
   clearStallMarker(pi, ctx.cwd);
+  // Recover poke is consumed only on a real send — gates still apply above.
+  clearTickRequest(pi, ctx.cwd);
+}
+
+/**
+ * Arm the interval heartbeat, then honour a recover poke if one is waiting.
+ * Extracted so the ownership-retry path and the immediate-accept path cannot
+ * drift: both must fire the same "do not wait a full interval after resume"
+ * behaviour.
+ */
+function armTickHeartbeat(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): void {
+  ctx.setInterval(() => tick(pi, ctx, config, session), config.intervalSeconds * 1000);
+  if (!existsSync(join(ctx.cwd, TICK_REQUESTED_FILE))) return;
+  pi.logger.info("[omp-conductor] tick requested by recover — firing without waiting for the interval");
+  tick(pi, ctx, config, session);
 }
 
 export default function orchestratorTickExtension(pi: TickApi): void {
@@ -995,7 +1035,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
           return;
         }
         if (next.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${next.note}`);
-        ctx.setInterval(() => tick(pi, ctx, config, session), config.intervalSeconds * 1000);
+        armTickHeartbeat(pi, ctx, config, session);
         pi.logger.info(`[omp-conductor] orchestrator tick active: ownership resolved on retry`, { agentName });
       }, retryMs);
       decided = true;
@@ -1008,7 +1048,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
       return;
     }
     if (ownership.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${ownership.note}`);
-    ctx.setInterval(() => tick(pi, ctx, config, session), config.intervalSeconds * 1000);
+    armTickHeartbeat(pi, ctx, config, session);
     decided = true;
     // Both gates are named at startup: "why is it not ticking?" is answered by
     // looking at the files this line lists, and an unset channel gate on a fleet

package/src/plugin.ts

@@ -193,6 +193,30 @@ async function askNumber(ctx: CommandContext, title: string, fallback: number):
   return value;
 }
 
+/**
+ * Daily spend ceiling. Blank / "none" / "off" → null (no gate). Unparseable
+ * non-empty input keeps the current value. Distinct from askNumber so operators
+ * can turn the money brake off without writing a magic 0 (which is a hard stop).
+ */
+async function askSpendCap(
+  ctx: CommandContext,
+  title: string,
+  fallback: number | null,
+): Promise<number | null> {
+  const seed = fallback === null ? "" : String(fallback);
+  const raw = (await ask(ctx, title, seed)).trim().toLowerCase();
+  if (raw === "" || raw === "none" || raw === "off" || raw === "null") return null;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value < 0) {
+    ctx.ui.notify(
+      `"${raw}" is not a non-negative number or blank — keeping ${fallback === null ? "no cap" : fallback}.`,
+      "warning",
+    );
+    return fallback;
+  }
+  return value;
+}
+
 /**
  * Pre-push gates as one comma-separated line, `cmd @ cwd` for a subdirectory:
  * `bun run check, bun test @ server`. Shown through `formatGates`, the same
@@ -500,10 +524,12 @@ const askGraph: AreaAsker = async (ctx, a) => {
  *  answer for anyone who has not measured their own runners. */
 const askCaps: AreaAsker = async (ctx, a) => {
   const caps: Partial<Caps> = { ...a.caps };
+  const spendLabel =
+    DEFAULT_CAPS.dailySpendUsd === null ? "no spend cap" : `$${DEFAULT_CAPS.dailySpendUsd}/day`;
   const tuneCaps = await ctx.ui.confirm(
     "Caps",
     `Defaults: ${DEFAULT_CAPS.maxConcurrentWorkers} workers, ` +
-      `$${DEFAULT_CAPS.dailySpendUsd}/day, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
+      `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
       `${Math.round(DEFAULT_CAPS.workerWallClockMs / 60000)} min per worker, ` +
       `${DEFAULT_CAPS.maxAttemptsPerIssue} attempts per issue. Change them?`,
   );
@@ -516,7 +542,11 @@ const askCaps: AreaAsker = async (ctx, a) => {
     "Max concurrent workers",
     caps.maxConcurrentWorkers ?? DEFAULT_CAPS.maxConcurrentWorkers,
   );
-  caps.dailySpendUsd = await askNumber(ctx, "Spend ceiling per rolling day (USD)", caps.dailySpendUsd ?? DEFAULT_CAPS.dailySpendUsd);
+  caps.dailySpendUsd = await askSpendCap(
+    ctx,
+    "Spend ceiling per rolling day (USD) — blank = no spend cap",
+    caps.dailySpendUsd !== undefined ? caps.dailySpendUsd : DEFAULT_CAPS.dailySpendUsd,
+  );
   caps.workerMaxTurns = await askNumber(ctx, "Turn ceiling per worker", caps.workerMaxTurns ?? DEFAULT_CAPS.workerMaxTurns);
   caps.workerWallClockMs = await askNumber(
     ctx,

package/src/setup.ts

@@ -954,9 +954,11 @@ export const AMEND_AREAS: {
     describe: (p) => {
       const c = resolveCaps(p, DEFAULT_CAPS);
       const answered = Object.keys(p.caps).length > 0;
+      const spend =
+        c.dailySpendUsd === null ? "no spend cap" : `$${c.dailySpendUsd}/day`;
       return (
         `${c.maxConcurrentWorkers} workers, ${c.workerMaxTurns} turns, ` +
-        `${Math.round(c.workerWallClockMs / 60000)}m, $${c.dailySpendUsd}/day, ` +
+        `${Math.round(c.workerWallClockMs / 60000)}m, ${spend}, ` +
         `${c.maxAttemptsPerIssue} attempts${answered ? "" : " (all defaults)"} — ` +
         `${p.workerModel === undefined ? "harness default model" : `model ${p.workerModel}`}`
       );

package/src/types.ts

@@ -16,8 +16,11 @@ export interface Caps {
   /** Parallel omp sessions. Two by default: on a small self-hosted runner pool
    *  a third worker would starve its own PR checks. */
   maxConcurrentWorkers: number;
-  /** Rolling-day spend ceiling; the loop stops claiming work once it is hit. */
-  dailySpendUsd: number;
+  /**
+   * Rolling-day spend ceiling. `null` means no spend gate (turns + wall-clock
+   * still apply). `0` is a hard stop — deliberate, not "unset".
+   */
+  dailySpendUsd: number | null;
   /** Turn ceiling for one worker — catches loops that are burning tokens
    *  without converging. */
   workerMaxTurns: number;

package/src/worker.ts

@@ -216,15 +216,22 @@ export async function runWorker(
     // is its report, whether it finished cleanly or was cut off.
     const text = reportText(field(message, "content"));
     if (text !== "") report = text;
+
+    // Real cost lives on assistant messages as `usage.cost.total` (live hermes
+    // transcripts, 2026-08-07). The earlier agent_end.telemetry path never
+    // fired, so every run recorded $0 and the daily cap was theater (#46).
+    const cost = costUsdFromMessage(message);
+    if (cost !== undefined) spendUsd += cost;
   });
 
   session.on("agent_end", (event) => {
-    // ponytail: cost only arrives when the harness run carries telemetry, so
-    // spend can legitimately read 0 and the daily-spend cap then leans on the
-    // turn and wall-clock ceilings. Upgrade path: pass a telemetry config
-    // through `createSession` once the harness exposes it on the SDK options.
+    // Fallback for harnesses that only attach cost on the terminal event.
     const estimated = field(field(field(event, "telemetry"), "cost"), "estimatedUsd");
-    if (typeof estimated === "number" && Number.isFinite(estimated)) spendUsd += estimated;
+    if (typeof estimated === "number" && Number.isFinite(estimated) && estimated > 0) {
+      // Prefer message totals when both exist — do not double-count a run that
+      // already accumulated per-message costs.
+      if (spendUsd === 0) spendUsd += estimated;
+    }
 
     // Anything that is not literally `false` — including garbage or nothing at
     // all — is a finished run.
@@ -282,6 +289,31 @@ export async function runWorker(
   );
 }
 
+/**
+ * USD cost from one assistant message's `usage.cost` block.
+ *
+ * Prefer `total` when present; otherwise sum the component fields the live
+ * harness emits (input/output/cacheRead/cacheWrite). Exported so a unit test
+ * can pin the shape without standing up a session.
+ */
+export function costUsdFromMessage(message: unknown): number | undefined {
+  const usage = field(message, "usage");
+  const cost = field(usage, "cost");
+  if (cost === null || typeof cost !== "object") return undefined;
+  const total = field(cost, "total");
+  if (typeof total === "number" && Number.isFinite(total) && total >= 0) return total;
+  let sum = 0;
+  let any = false;
+  for (const key of ["input", "output", "cacheRead", "cacheWrite"] as const) {
+    const v = field(cost, key);
+    if (typeof v === "number" && Number.isFinite(v) && v >= 0) {
+      sum += v;
+      any = true;
+    }
+  }
+  return any ? sum : undefined;
+}
+
 /**
  * Read one property off an unvalidated harness event. The event union lives in
  * the peer dependency, so the worker narrows the handful of fields it reads

package/src/worktree.ts

@@ -194,6 +194,40 @@ async function configureMirror(mirrorPath: string): Promise<void> {
   writeFileSync(exclude, mergeExclude(existsSync(exclude) ? readFileSync(exclude, "utf8") : ""));
 }
 
+/**
+ * Rewrites this worktree's common `info/exclude` managed block to the package's
+ * current list. Salvage must do this itself: it is the path that runs after a
+ * package swap, when the mirror may still carry a previous release's patterns,
+ * and `git add -A` would otherwise silently skip legitimate new files the old
+ * list happened to name (dogfood 2026-08-07 / #44).
+ *
+ * Failures are swallowed — a missing common dir is "no exclude to heal", and
+ * the salvage dirty check still runs. Never throws into the salvage outcome.
+ */
+function refreshManagedExclude(worktree: string): void {
+  try {
+    // `--git-common-dir` is relative for linked worktrees; resolve against the
+    // tree so bare-mirror layouts and plain clones both land on info/exclude.
+    const common = Bun.spawnSync(["git", "rev-parse", "--git-common-dir"], {
+      cwd: worktree,
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+    });
+    if (common.exitCode !== 0) return;
+    const raw = common.stdout.toString().trim();
+    if (raw === "") return;
+    const commonDir = raw.startsWith("/") ? raw : join(worktree, raw);
+    const exclude = join(commonDir, "info", "exclude");
+    mkdirSync(dirname(exclude), { recursive: true });
+    writeFileSync(exclude, mergeExclude(existsSync(exclude) ? readFileSync(exclude, "utf8") : ""));
+  } catch {
+    // ponytail: exclude heal is best-effort; salvage still prefers a commit of
+    // whatever git can see over failing the whole orphan path.
+  }
+}
+
 /**
  * Returns the path of the bare mirror for `repo`, cloning it on first use and
  * refreshing it otherwise.
@@ -251,7 +285,7 @@ export async function addWorktree(
   workspaceRoot: string,
   issue: number,
   branch: string,
-): Promise<string> {
+): Promise<{ path: string; reattached: boolean }> {
   const mirrorPath = await ensureMirror(repo, mirrorRoot);
   mkdirSync(workspaceRoot, { recursive: true });
 
@@ -335,7 +369,7 @@ export async function addWorktree(
     }
   }
 
-  return worktreePath;
+  return { path: worktreePath, reattached: branchExists };
 }
 
 /**
@@ -345,7 +379,17 @@ export async function addWorktree(
  * none of that may be skipped by an exception from the last-ditch step.
  */
 export type SalvageOutcome =
-  | { kind: "salvaged"; sha: string; branch: string; pushed: boolean; pushError?: string }
+  | {
+      kind: "salvaged";
+      sha: string;
+      branch: string;
+      pushed: boolean;
+      pushError?: string;
+      /** Paths in the salvage commit (count = length). */
+      files: string[];
+      /** Subset that were untracked before salvage (`A` in the commit). */
+      newPaths: string[];
+    }
   /** Nothing uncommitted was there to save — a clean tree, or no tree at all. */
   | { kind: "nothing" }
   /** There was work and git would not commit it. This is the loud one. */
@@ -369,6 +413,51 @@ const SALVAGE_COMMIT_CONFIG = [
   "commit.gpgsign=false",
 ];
 
+/**
+ * Subject stays the historical one-liner so status greps keep working; the
+ * body is the manifest (#38). Cap the new-path list so a runaway tree cannot
+ * push a multi-kilobyte commit message into every escalation.
+ */
+export function salvageCommitMessage(
+  issue: number,
+  attempt: number,
+  reason: string,
+  files: string[],
+  newPaths: string[],
+): { subject: string; body: string } {
+  const subject = `wip(#${issue}): attempt ${attempt} killed by ${reason} — auto-salvaged`;
+  const n = files.length;
+  const count = `${n} file${n === 1 ? "" : "s"}`;
+  if (newPaths.length === 0) {
+    return { subject, body: `${count} (all modifications to tracked paths).` };
+  }
+  const cap = 30;
+  const shown = newPaths.slice(0, cap);
+  const more = newPaths.length - shown.length;
+  const list = shown.map((f) => `  ${f}`).join("\n");
+  const suffix = more > 0 ? `\n  … and ${more} more` : "";
+  return {
+    subject,
+    body: `${count}. New (untracked before salvage):\n${list}${suffix}`,
+  };
+}
+
+function parseCachedNameStatus(raw: string): { files: string[]; newPaths: string[] } {
+  const files: string[] = [];
+  const newPaths: string[] = [];
+  for (const line of raw.split("\n")) {
+    if (line === "") continue;
+    // name-status: "<status>\t<path>" or rename "R100\t<old>\t<new>"
+    const parts = line.split("\t");
+    const status = parts[0] ?? "";
+    const path = parts.length >= 3 ? (parts[2] ?? parts[1] ?? "") : (parts[1] ?? "");
+    if (path === "") continue;
+    files.push(path);
+    if (status.startsWith("A")) newPaths.push(path);
+  }
+  return { files, newPaths };
+}
+
 /**
  * Commits a dead run's uncommitted work to the run's own branch and pushes it,
  * so that the tree the next attempt destroys is no longer the only copy.
@@ -406,6 +495,12 @@ export async function salvageWip(
     // code, and "no tree" is not a salvage failure worth alarming anyone with.
     if (!existsSync(worktree)) return { kind: "nothing" };
 
+    // Heal the managed ignore *before* status/add. A mirror left by an older
+    // build may still list patterns this release dropped; without this, an
+    // untracked deliverable matching the stale list is invisible to salvage
+    // and dies with the next `worktree remove --force` (#44).
+    refreshManagedExclude(worktree);
+
     if ((await git(["status", "--porcelain"], worktree)) === "") return { kind: "nothing" };
 
     // The tree's own branch, not one the caller believes it should be on: this
@@ -432,40 +527,42 @@ export async function salvageWip(
     // only changes were ignored scratch had work by that test and none by this.
     // Without this, `commit` exits non-zero on an empty index and a tree
     // holding nothing worth keeping gets reported as a salvage *failure*.
-    if ((await git(["diff", "--cached", "--name-only"], worktree)) === "") {
+    const cached = await git(["diff", "--cached", "--name-status"], worktree);
+    if (cached === "") {
       return { kind: "nothing" };
     }
+    const { files, newPaths } = parseCachedNameStatus(cached);
+    const msg = salvageCommitMessage(issue, attempt, reason, files, newPaths);
     await git(
       [
         ...SALVAGE_COMMIT_CONFIG,
         "commit",
         "--no-verify",
         "-m",
-        `wip(#${issue}): attempt ${attempt} killed by ${reason} — auto-salvaged`,
+        msg.subject,
+        "-m",
+        msg.body,
       ],
       worktree,
     );
     const sha = await git(["rev-parse", "HEAD"], worktree);
+    const salvaged = { kind: "salvaged" as const, sha, branch, files, newPaths };
 
     if (branch === "HEAD") {
       // Detached: the commit is real but reachable only by sha, and pushing
       // `HEAD` from here would publish a branch literally named HEAD.
       return {
-        kind: "salvaged",
-        sha,
-        branch,
+        ...salvaged,
         pushed: false,
         pushError: "detached HEAD — no branch to push",
       };
     }
 
     const push = await runGit(["push", "origin", `HEAD:refs/heads/${branch}`], worktree);
-    if (push.code === 0) return { kind: "salvaged", sha, branch, pushed: true };
+    if (push.code === 0) return { ...salvaged, pushed: true };
 
     return {
-      kind: "salvaged",
-      sha,
-      branch,
+      ...salvaged,
       pushed: false,
       pushError: (
         push.stderr.trim() ||