Skip to content

fix(port): worktree audit fails closed when a .env can move the omp store - #29

Merged
AlexNegrescu26 merged 8 commits into
mainfrom
fix/audit-env-store-failclosed
Oct 25, 2026
Merged

AlexNegrescu26 merged 8 commits into
mainfrom
fix/audit-env-store-failclosed

Conversation

@AlexNegrescu26

Copy link
Copy Markdown
Collaborator

Why

worktree-audit.sh finds omp's session store from the process environment only. omp also fills unset variables from .env files, so a store key set only there moves the store. The audit then read the default store, showed LAST_CHAT -, and put a merged worktree with a recent omp chat in safe, which the cleanup playbook offers for deletion.

What changed

  • The audit checks the .env files omp reads (the agent dir, the config root, ~/.env, and each worktree's own) for the seven keys that move the store. A match sets the existing failed-lookup state, names the file on stderr, and the row holds at verify-recent-chat. It does not reimplement omp's .env loader.
  • test-worktree-audit.sh gains four scenarios, one per file, plus a control that leaves unrelated and commented-out keys alone. It also asserts that unpushed work still buckets hold-unpushed when the store is missing.
  • A live probe asks a real omp for its sessionFile and checks the audit's bucket directory matches. It prints SKIPPED when omp is absent and never calls a model.
  • session-store-on-omp.md records which .env files and keys omp reads, as verified.

Scope

Blast Radius

It touches only /skill:poteto-mode's worktree audit. The change can hold more rows than before and never fewer.

Verification

  • The test commit alone fails on the old script with worktree audit: FAIL (8), four rows want 'verify-recent-chat', got 'safe'. With the fix, worktree audit: PASS.
  • Probed omp 18.12.6 about 55 times in a throwaway HOME with no model call to confirm which files and keys move the store. A copy of the probe with a wrong temp bucket failed with LAST_CHAT: want '2026-10-25', got '-'.
  • check-port.sh prints check-port: PASS, and test-gate-mutations.sh passes.

AlexNegrescu26 and others added 8 commits October 23, 2026 00:50
…s.mjs

omp config set stores any string, so a bad selector or unknown alias failed only at spawn. The script checks every selector and effort against omp models --json before writing, touches only the three pstack aliases and their agent mappings, and is idempotent.
worktree-audit-omp.patch now applies on top of upstream #805 and reuses its
GNU/BSD stat and date probe instead of carrying a second one. The BSD stub in
test-worktree-audit.sh serves `stat -f <format>` with %m and %N the way BSD
does, since the reused probe asks for `-f '%m %N'`.

Upstream merged #801, #802, #803 and #804 with the same code and tests as the
carried #664, #666, #672 and #684 hunks. zzzz-check-plan-fix.patch is gone and
zzz-watch-pr-fixes.patch carries #769 alone. zzzz-orch-lock-takeover.patch
applies unchanged at exact offsets after #804.
Upstream #807 renumbered swarm's Phase A, so the model-step rule now takes
any step number and keeps it, and the Phase B rule matches any step number.
ketchup-video joins the `/skill:<name>` alternation. The description rule
is one `Use for /<name>` pattern instead of a per-name list that had
already missed ketchup, sharpen and correct.

The `run_in_background: true` exemption matched three sentence rules as a
substring and hid the Phase B rule going stale. It now names the token
rule it was written for, and the retired figure-it-out exemption is gone.
Moves the pin from 4ec7ffa across 13 upstream pstack commits: the
ketchup-video skill, the statechart Pele renderer, the /statechart read
step in generated verify skills, the reflect plugin-cache rule, the swarm
renumbering, and the merged watch-pr, check-plan and orch fixes the port
used to carry as patches. The READMEs count 60 skills.
PORTING.md named three carried-PR patches that no longer exist in that
form. It now names all five patches and what each carries, and records
that a merged equivalent can re-apply at an offset instead of failing.
… (fails until the fix)

Four scenarios put a store key in each .env file omp reads and a recent chat in the moved store. The build at this commit buckets the merged worktree safe in all four. Also asserts unpushed work holds under an unreadable store, and adds an optional live probe that asks a real omp, under the fixture HOME and with no model turn, where it would write a transcript.
…tore

omp fills unset variables from the launch cwd .env, the agent dir .env, the config root .env and ~/.env, and reads OMP_ keys there as PI_. A store key in any of them moved the store past the audit, which then read the default store, found no chat, and bucketed a merged worktree safe. The audit now greps each of those files, every worktree root included, for a store key and holds the rows at verify-recent-chat with LAST_CHAT ?, naming the file on stderr. It does not replay the loader.
… store

Probed on omp 18.12.6 in a throwaway HOME through rpc get_state.sessionFile.
@AlexNegrescu26
AlexNegrescu26 merged commit f420641 into main Oct 25, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant