feat(console): full operator control — fix kill, add pause/resume, spawn/purge/status#200
Open
Lanzelot1 wants to merge 1 commit into
Open
feat(console): full operator control — fix kill, add pause/resume, spawn/purge/status#200Lanzelot1 wants to merge 1 commit into
Lanzelot1 wants to merge 1 commit into
Conversation
Lanzelot1
force-pushed
the
feat/console-views
branch
from
1f1128d to
601451f
Compare
Lanzelot1
force-pushed
the
feat/console-control
branch
from
36f96ba to
29745a9
Compare
Lanzelot1
force-pushed
the
feat/console-views
branch
from
601451f to
9db360e
Compare
Lanzelot1
force-pushed
the
feat/console-control
branch
from
29745a9 to
d245b87
Compare
Lanzelot1
force-pushed
the
feat/console-views
branch
from
9db360e to
61a33a9
Compare
Lanzelot1
force-pushed
the
feat/console-control
branch
from
d245b87 to
e29a877
Compare
…awn/purge/status The console was ~90% observer + chat; its one control (D-kill) was mis-tiered (privileged, where the manager only stops your own child) and used the read-only god-view cred, so it silently failed on auth meshes. Now every control action mints a per-action, tier-scoped caller cred from held trust material (open mesh: bare; --creds: as-is) and targets the right tier — gated on a new canControl distinct from chat-write. - core/manager: new pause/resume ops (SIGSTOP/SIGCONT the pty process group, POSIX-only; tmux/cmux + win32 error loud). Paused-ness lives in managed- state (ps/status), not presence — a stopped agent can't heartbeat; a graceful stop resumes before SIGTERM so it can't hang. - console: D-kill fixed (admin tier + mint) with y=graceful / f=force; roster 'p' pause/resume toggle with a ps-merged ⏸ badge; palette :spawn/:purge/ :status/ps; every action flashes its result. - pause-resume-live smoke (15 checks): real freeze (state T), tier denial for a non-spawner (the old kill bug), and control-caller-admin cred scoping.
Lanzelot1
force-pushed
the
feat/console-views
branch
from
61a33a9 to
16e5570
Compare
Lanzelot1
force-pushed
the
feat/console-control
branch
from
e29a877 to
f4d3961
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Makes the console a real "lazygit for Cotal" operator surface. Stacked on #197 (
feat/console-views) — retarget tomainonce #197 merges.The bug this fixes
D-kill sentrequestControl("manager", …)— the privileged tier, where the manager only stops your own spawned child — using the console's self-minted god-viewadmincred, which has noctl.*publish grant. So on any auth mesh, kill silently did nothing. Now every control action mints a per-action, tier-scoped caller cred from held trust material (open mesh: bare;--creds: as-is) and targets the right tier — the same pattern the CLI (askManager) and web (channel-purger) already use. Gated on a newcanControl, distinct from chat-write.New capability: pause/resume (new wire ops)
Freeze an agent in place —
SIGSTOP/SIGCONTto the pty process group (POSIX only; tmux/cmux have no owned pid and win32 has no job-control signals, so both error loud, no fallback). Same authority as a named stop. Paused-ness lives in the manager's managed-state (ps/status), not presence — a stopped agent can't heartbeat, so its presence would TTL to "offline" and lie; the console mergespsby id and shows a⏸ pausedbadge. A graceful stop of a paused agent resumes it first (SIGTERM isn't delivered to a stopped process).Console affordances (graduated destructiveness)
pon a roster agent → pause/resume, no confirm (recoverable).D→ kill behind a confirm:ygraceful stop,fforce-kill.:palette:spawn <persona> [name],status <agent>,ps,purge(type-the-name confirm).Verified
pnpm typecheck+pnpm testclean; view/connect/lifecycle-e2e smokes pass.pause-resume-livesmoke (15 checks) against a real broker + manager + process: real OS freeze (stateT), tier denial for a non-spawner (regression guard for the old kill bug),control-caller-admincred scoped toctl.adminonly, unsupported-runtime error, and graceful-stop-of-paused (SIGCONT-first).pand:psreach the manager end-to-end (an old v0.10 manager on the running mesh returnsunknown op: pause, confirming the console wire works — the new op is proven by the smoke).Notes
docs/architecture.md+docs/protocol-view.mdupdated in-change.