Reverts 971c8a9 and 0c6ea9c. The env wrapping approach polluted
the superpowerd notification with all env vars, making it
impossible to see what command was being approved.
The elevate client now includes the full environment in its request.
The adapter wraps the command with 'env -i K=V ... bash -c cmd' so
the elevated command runs with the agent's env rather than the
adapter's startup env.
Reuse SEQPACKET connections across requests instead of
connect/close per command. Connections are returned to a
pool (max 4 idle) after successful use and discarded on error.
superpowerd HandleConn already loops for multiple requests
per connection, so this is safe. Each ExecuteCommandStreaming
still blocks its connection until the command exits, so
concurrent commands use separate pooled connections.
The adapter is now started by the system service manager, not
on-demand from inside the sandbox. ensureElevateAdapter was
removed from core in the previous commit.
Replace subprocess-based token refresh (superpowers run-session --child-session)
with direct SEQPACKET CreateSession RPC to superpowerd. This fixes:
1. Session PID mismatch: old approach registered session to short-lived sh
subprocess PID, causing immediate pidAlive() failure on next use
2. Child session failure: --child-session fails when superpowerd restarts
(parent session gone)
3. Gentoo python-exec2c exec chain: replace os.execvp startup with direct
CreateSession call
The adapter now owns its session directly (peerPID = adapter PID), so the
session stays valid for the adapters entire lifetime.
When superpowerd returns exit 255 with no output streamed, treat it as a
suspicious session failure (same as auth error) and retry with a refreshed
token. This addresses intermittent elevated command failures where the
session silently expires mid-conversation.
Also adds stderr logging at key decision points: token refresh attempts,
retry signals, RPC errors, and non-JSON responses from superpowerd.
prime script no longer detects platform/git locally. All PRIME_*
variables are set by BuildRuntime callers and stored in the agent
for /agent reloads. Templates use PRIME_CWD instead of PWD.
Remove _start_adapter() from x/elevate (ran inside sandbox, could not
function). The Go executeElevated() now calls ensureElevateAdapter()
which runs outside the sandbox and can properly start the adapter.
core: update submodule.
Wrap _handle_inner() in try/except so unhandled exceptions always
produce an error frame instead of silently closing the connection
(which caused exit 255 with no output on the client).
elevate-adapter-superpowerd: detect auth errors from superpowerd and
automatically refresh the session token via "superpowers run-session
--child-session", retrying the request once.
x/elevate: auto-start the adapter if the socket is not available,
removing the dependency on the agentSpawn hook for adapter lifecycle.
core: update submodule (hook run/fail summary).
Replace the batch JSON request/response protocol with a streaming
frame protocol. The adapter now uses superpowerd ExecuteCommandStreaming
with SCM_RIGHTS fd-passing to stream stdout/stderr in real-time.
Protocol: client sends {cmd,cwd}+newline, server streams frames
(type byte + 4-byte length + payload). This enables elevated+detach
to capture live output in the ring buffer.
Also updates core submodule with elevated+detach support.
- agent JSONs: $OLLIE/x/ -> $OLLIE_CFG_PATH/scripts/x/
- x/prime: use $OLLIE_PROMPTS_PATH instead of $OLLIE/p/
- x/elevate-adapter-start: use $OLLIE_CFG_PATH/scripts/x/
- Update core and 9p submodules
olliesrv and agent sessions now work without FUSE. Mount remains
available as an enhancement when present.
All front-ends (sh, b, ls, kill, cleanup, ellie.el, ollie-acme, Kmpl)
now retry file operations after running ollie-remount on failure.
contrib target added to 'all' so ollie-remount is always installed.
Workers retry with linear backoff (attempt*2s). Each retry uses a
unique session name suffix (-r2, -r3, ...) to avoid collisions.
Default: 1 (no retry).
- Results gathered as JSON array [{id, status, output}]
- Default output is pretty-printed JSON (no synthesis)
- -max-workers N (default 8) throttles concurrent workers
- Synthesis renders JSON to text for planner prompt
- Validate all entries have non-empty string id and instruction
- No synthesis: exit 1 on worker failures (partial results)
- Synthesis: exit 0 — planner accounts for failures in its answer
tools/cascade: fire-and-forget delegation to cheap model; worker
reports back to parent prompt when done. Parallelizable.
scripts/u/cascade: script-driven hub-and-spoke orchestrator for
terminal use — planner decomposes, workers execute in parallel,
planner synthesizes.
Levi Neely
Ollie Agent
Levi Neely