omp-conductor 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/config.ts

@@ -219,6 +219,18 @@ export function loadConfig(): ConductorConfig {
  * a truncated one. Mode 0600 because a config carries chat ids and clone URLs.
  */
 export function saveConfig(c: ConductorConfig): void {
+  writeConfigFile(c);
+}
+
+/**
+ * Atomic write of whatever object is handed in.
+ *
+ * Takes `unknown` rather than `ConductorConfig` so the credentials migration
+ * can persist the operator's own parsed file with one key added, instead of a
+ * value that has been through the loader and back out. That round-trip is what
+ * rewrote a live fleet's config into a dialect the previous release rejected.
+ */
+export function writeConfigFile(c: unknown): void {
   const dir = stateDir();
   const created = mkdirSync(dir, { recursive: true, mode: 0o700 });
   // mkdir's mode is masked by umask; chmod only what we just created so an
@@ -931,9 +943,39 @@ export function migrateCredentialsOnDisk(): { migrated: string[]; path: string }
   }
   const migrated = projectsMissingCredentials(parsed);
   if (migrated.length === 0) return { migrated: [], path };
-  // Through the loader and back out, so the rewrite is the same normalisation
-  // every other key already gets rather than a second, divergent writer.
-  saveConfig(loadConfig());
+
+  // A SURGICAL edit: add the one missing key to the projects that lack it and
+  // leave every other byte exactly as the operator wrote it.
+  //
+  // This was `saveConfig(loadConfig())` once, and that round-trip took a live
+  // fleet down. Normalising on the way out rewrites the whole file into the
+  // current dialect — `defaults.planUsage`, `releasePolicy` as a per-shape map
+  // — and the previous release rejects both. The daemon performing the
+  // migration is started *by* an upgrade still running the previous CLI, so
+  // that CLI's next `loadConfig` failed, and its rollback reinstalled a version
+  // which then could not read the file either. A migration must never make a
+  // config unreadable by the release you may have to roll back to.
+  // Verified against the real previous release, not just against this parser:
+  // omp-conductor@0.3.25 loads a config carrying `credentials` and prints
+  // `status` normally, because it ignores unknown *project* keys while
+  // rejecting unknown `defaults` keys and a non-string `releasePolicy` — the
+  // two things the old round-trip wrote. Re-check that with `npm install
+  // omp-conductor@<previous>` before widening what this writes.
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { migrated: [], path };
+  const projects = (parsed as Raw)["projects"];
+  if (!Array.isArray(projects)) return { migrated: [], path };
+  for (const entry of projects) {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+    const raw = entry as Raw;
+    const credentials = raw["credentials"];
+    const explicit =
+      typeof credentials === "object" &&
+      credentials !== null &&
+      !Array.isArray(credentials) &&
+      (credentials as Raw)["isolation"] !== undefined;
+    if (!explicit) (raw as Record<string, unknown>)["credentials"] = { isolation: "none" };
+  }
+  writeConfigFile(parsed);
   return { migrated, path };
 }
 

package/src/upgrade.ts

@@ -3,7 +3,7 @@ import { inspectBriefLayout, type BriefLayout } from "./brief-upgrade.ts";
 import { setPaused, statusSnapshot } from "./daemon.ts";
 import { fleetLayers, telegramStateDir, type DispatchLayer, type FleetLayers } from "./fleet.ts";
 import { livingDaemon, restartDaemon } from "./lifecycle.ts";
-import { findProject, loadConfig, resolveCaps } from "./config.ts";
+import { configPath, findProject, loadConfig, resolveCaps, writeConfigFile } from "./config.ts";
 import { renderBriefForProject } from "./setup.ts";
 import {
   STAGED_SERVICE_NAME,
@@ -296,8 +296,30 @@ async function rollbackUpgrade(
   briefChanged: boolean,
   herdrReloadStarted: boolean,
   daemonReloadStarted: boolean,
+  configBefore?: string,
 ): Promise<void> {
   const failures: string[] = [];
+
+  // Restored FIRST, before the packages that have to read it.
+  //
+  // Rolling back binaries alone is not a rollback. The new daemon starts during
+  // the upgrade and may migrate config.json; the reinstated older release then
+  // cannot parse its own config and will not boot — which is exactly how an
+  // upgrade failure turned into an outage. The snapshot is taken before the
+  // first install, and restoring it is unconditional: writing back a file that
+  // never changed is harmless, and detecting "did it change" is one more thing
+  // to get wrong while the fleet is down.
+  if (configBefore !== undefined) {
+    try {
+      const path = configPath();
+      if (readFileSync(path, "utf8") !== configBefore) {
+        deps.log("rollback: conductor config.json");
+        writeConfigFile(JSON.parse(configBefore));
+      }
+    } catch (err) {
+      failures.push(`could not restore config.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   const restore = async (label: string, command: string, args: readonly string[]): Promise<void> => {
     deps.log(`rollback: ${label}`);
     try {
@@ -498,6 +520,18 @@ export async function upgradeConductor(
     };
   }
 
+  // Snapshotted before anything is installed, because the new daemon starts
+  // during this transaction and may migrate the file — see the restore in
+  // `rollbackUpgrade`. Read as bytes, not through the loader: the point is to
+  // put back exactly what was there, dialect and all.
+  let configBefore: string | undefined;
+  try {
+    configBefore = readFileSync(configPath(), "utf8");
+  } catch {
+    // No readable config is not a reason to refuse an upgrade; there is simply
+    // nothing to put back.
+  }
+
   if (brief.kind === "missing") throw new Error("no ORCHESTRATOR.md exists for the configured project");
   if (initial.herdr === "unknown") throw new Error("cannot determine whether herdr-fleet.service is active");
 
@@ -611,6 +645,7 @@ export async function upgradeConductor(
         briefChanged,
         herdrReloadStarted,
         daemonReloadStarted,
+        configBefore,
       );
     } catch (rollbackErr) {
       const rollback = rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr);