omp-conductor 0.5.4 → 0.5.6

package/README.md

@@ -2166,8 +2166,9 @@ refuses a connection from anything else without answering it, logged the way an
 impersonation is. Until a channel is bound it refuses everything, because the
 socket necessarily exists before the child that connects to it. The kernel
 supplies the pid: `SO_PEERCRED` on Linux, `LOCAL_PEERPID` on macOS. A host where
-neither can be asked refuses every connection and says so at startup rather than
-falling back to the uid, which would be no check at all.
+neither can be asked — no loadable libc, or the call refused — refuses every
+connection on a bound channel and says so at startup, rather than falling back to
+the uid, which under one shared uid is no check at all.
 
 The residual is narrow, real, and worth stating: one uid can `ptrace` and signal
 its siblings, so a determined session can still interfere with the process that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/omp.ts

@@ -361,6 +361,13 @@ const START_TIMEOUT_MS = 180_000;
 /** Bounded tail of the child's stderr, so a crash is legible without unbounded buffering. */
 const STDERR_TAIL = 8_000;
 
+/**
+ * How long a dying child's pipes get to finish before its failure is reported
+ * without them. Generous because it only ever delays an already-failed startup,
+ * and the streams normally reach EOF the instant the process does.
+ */
+const DRAIN_GRACE_MS = 2_000;
+
 /** How long a disposed child gets to exit before it is signalled. */
 const DISPOSE_GRACE_MS = 5_000;
 
@@ -511,8 +518,35 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
       }
     }
   };
-  void drain(child.stdout, "session: ");
-  void drain(child.stderr, "session: ");
+  // Kept, not discarded: the child's own stderr is the whole value of the startup
+  // failure path, and it is a *race* against `child.exited` rather than a
+  // guarantee. A child that dies before connecting resolves `exited` as soon as
+  // the process is gone, which can be before these loops have read what it
+  // printed on the way out — and then the operator gets "exited 1" instead of the
+  // reason, which is precisely the diagnosis this path exists to give. Observed
+  // failing on ubuntu and passing on darwin, which is what a race looks like.
+  const drained = Promise.all([drain(child.stdout, "session: "), drain(child.stderr, "session: ")]);
+  drained.catch(() => undefined);
+
+  /**
+   * The child's output, once the pipes have actually finished — the whole point of
+   * every failure path below.
+   *
+   * Bounded rather than awaited outright: a grandchild that inherited stderr keeps
+   * the pipe open after the child is gone, and a failure nobody reports is worse
+   * than one reported without its tail. Both exit routes go through here so they
+   * cannot drift apart again; the pre-connect one did, which is how a release run
+   * caught this.
+   */
+  const settledTail = async (): Promise<string> => {
+    await Promise.race([
+      drained,
+      new Promise<void>((resolve) => {
+        setTimeout(resolve, DRAIN_GRACE_MS).unref?.();
+      }),
+    ]);
+    return stderrTail.trim();
+  };
 
   const cleanup = (): void => {
     server.close();
@@ -544,7 +578,7 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
     pending.clear();
   };
 
-  void child.exited.then((code) => {
+  void child.exited.then(async (code) => {
     onExit();
     cleanup();
     // A child that exits during teardown exited because we asked it to. Only an
@@ -552,6 +586,8 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
     // to reach whoever is awaiting a prompt, or the dispatcher waits forever
     // for a turn from a process that is gone.
     if (disposing) return;
+    // The tail first, so the message carries the child's own words.
+    await settledTail();
     fail(`omp-conductor session child exited ${String(code)} before the session ended`);
   });
 
@@ -577,7 +613,11 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
   } catch (err) {
     child.kill("SIGKILL");
     cleanup();
-    const tail = stderrTail.trim();
+    // Killed first, so the pipes are already closing, and only then read. This is
+    // the route a child that dies before connecting takes — a missing peer
+    // dependency, say — and reading `stderrTail` synchronously here raced the
+    // drain loops and reported a bare exit code instead of the reason.
+    const tail = await settledTail();
     throw new Error(
       `${err instanceof Error ? err.message : String(err)}${tail === "" ? "" : `\nchild output:\n${tail}`}`,
     );

package/src/verbs/socket.ts

@@ -413,10 +413,29 @@ export function peerVerdict(
     };
   }
   if (peer === undefined) {
+    // A channel bound to a process and no way to identify the caller is the one
+    // combination that must never pass. Under one uid the mode says nothing about
+    // *which* session is connecting, so allowing here would hand any session the
+    // authority of whichever channel it reached — on exactly the hosts where the
+    // check silently could not run. This ordering was the bug: the previous
+    // release returned `socket-ownership` here before ever looking at the
+    // expected pid, so a host whose libc would not load failed OPEN while the
+    // startup banner claimed it refused everything.
+    if (expected.pid !== undefined) {
+      return {
+        ok: false,
+        peerUid: -1,
+        expectedUid: expected.uid,
+        detail:
+          `this channel belongs to pid ${expected.pid} and this host reports no peer credentials at all, ` +
+          `so the caller cannot be identified — every session here shares one uid, and the socket mode ` +
+          `cannot tell them apart`,
+      };
+    }
     return {
       ok: true,
       basis: "socket-ownership",
-      why: "this host exposes no peer-credential call, so the 0600 socket under the daemon-owned 0711 parent is all that keeps other local accounts out",
+      why: "this host exposes no peer-credential call and no pid was expected, so the 0600 socket under the daemon-owned 0711 parent is all that keeps other local accounts out",
     };
   }
   if (peer.uid !== expected.uid) {
@@ -457,7 +476,7 @@ export function peerVerdict(
 export function transportBanner(dir: string, peerReader: PeerReader | undefined): string {
   const peers =
     peerReader === undefined
-      ? `no peer-credential call on ${process.platform} — channels REFUSE every connection`
+      ? `no peer-credential call on ${process.platform} — every bound channel REFUSES every connection`
       : process.platform === "darwin"
         ? "caller pid+uid asserted with getpeereid and LOCAL_PEERPID; each channel bound to the session the daemon launched"
         : "caller pid+uid asserted with SO_PEERCRED; each channel bound to the session the daemon launched";