@volter/supercode-orchestrator 0.4.150 → 0.4.152

package/board/ci.mjs

@@ -6,6 +6,43 @@ import { dirname, join, relative } from 'node:path';
 import { createHash } from 'node:crypto';
 import { branchCheckouts, checkoutOf, resolveWorkspace } from './workspace.mjs';
 
+// GitHub is read through its REST API with Node's own fetch, not the gh binary: Node takes a World's trust bundle and
+// injector (NODE_EXTRA_CA_CERTS, NODE_OPTIONS), so a review World's GitHub twin answers it, where gh (Go) trusts only
+// the system keychain. The read runs in a child Node so the callers stay synchronous.
+const GITHUB_READ = `
+const [path, all] = process.argv.slice(1);
+const base = (process.env.GITHUB_API_URL || 'https://api.github.com').replace(/\\/$/, '');
+const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+const headers = { accept: 'application/vnd.github+json', 'user-agent': 'supercode-board', ...(token ? { authorization: 'Bearer ' + token } : {}) };
+let url = base + path, out = [];
+for (let page = 0; url && page < 10; page += 1) {
+  const r = await fetch(url, { headers });
+  if (!r.ok) { process.stderr.write('GitHub ' + r.status + ' for ' + path + ': ' + (await r.text()).slice(0, 300)); process.exit(1); }
+  const body = await r.json();
+  if (all !== '1') { process.stdout.write(JSON.stringify(body)); process.exit(0); }
+  out = out.concat(body);
+  url = /<([^>]+)>;\\s*rel="next"/.exec(r.headers.get('link') ?? '')?.[1] ?? null;
+}
+process.stdout.write(JSON.stringify(out));`;
+let githubToken;
+/** One GitHub REST read (`all`: every page of a list). The token is the environment's, else gh's stored login. */
+function github(path, all = false) {
+  if (githubToken === undefined) {
+    githubToken = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || null;
+    if (!githubToken) try { githubToken = run('gh', ['auth', 'token']) || null; } catch { githubToken = null; }
+  }
+  const env = githubToken ? { ...process.env, GH_TOKEN: githubToken } : process.env;
+  const result = spawnSync(process.execPath, ['--input-type=module', '-e', GITHUB_READ, path, all ? '1' : '0'], { env, encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`GitHub: ${(result.stderr || result.error?.message || 'read failed').trim().slice(-500)}`);
+  return JSON.parse(result.stdout);
+}
+const repositoryOf = (url) => new URL(url).pathname.split('/').slice(1, 3).join('/');
+const numberOf = (url) => Number(new URL(url).pathname.split('/')[4]);
+/** A PR as the board reads it (gh's field names). */
+const pullRequest = (repository, p) => ({ url: p.html_url, number: p.number, state: p.merged_at ? 'MERGED' : String(p.state).toUpperCase(), headRefOid: p.head.sha,
+  headRefName: p.head.ref, baseRefName: p.base.ref, defaultBranch: p.base.repo?.default_branch ?? null, isCrossRepository: p.head.repo?.full_name?.toLowerCase() !== repository.toLowerCase(), isDraft: Boolean(p.draft) });
+const readPullRequest = (url) => pullRequest(repositoryOf(url), github(`/repos/${repositoryOf(url)}/pulls/${numberOf(url)}`));
+
 const observations = new Map();
 const key = (board, id) => `${board.root}\0${board.slug}\0${id}`;
 const run = (program, args, cwd) => {
@@ -85,18 +122,22 @@ function registeredBranches(board, id) {
   return out;
 }
 
-/** Every opened PR of the arc: each open PR whose head is the card's branch or a `wt/<card id>` branch, in the
- *  card's own repository and in every repository this machine keeps a checkout of, and each open PR on a sibling
- *  checkout the arc registered (`registeredBranches`). One review covers them all; the caller decides the transition. */
+/** Every opened PR of the arc, each proposed to its repository's default branch: an open PR whose head is the card's
+ *  work branch in the card's own repository, a `wt/<card id>` branch in any repository this machine keeps a checkout
+ *  of, or a sibling checkout the arc registered (`registeredBranches`). The repository's default branch, declared or
+ *  checked out (or no branch), is not a work branch: such a card's PRs are only its `wt/<card>` and registered ones, and with none it
+ *  answers `{ waits }` saying so. One review covers them all; the caller decides the transition. */
 export function openReviewPullRequests(board, id) {
   const own = repositoryWorkspace(board, id);
   if (!own) return null;
   const task = board.db.prepare('SELECT branch_name FROM tasks WHERE id=?').get(id);
-  const branch = task?.branch_name ?? run('git', ['branch', '--show-current'], own);
   const ownRepository = originOf(own);
   if (!ownRepository) return null;
+  const current = task?.branch_name ? null : run('git', ['branch', '--show-current'], own);
+  let branch = task?.branch_name ?? (current || null);
   const registered = registeredBranches(board, id);
-  const mine = (repository, head) => head === branch || [`wt/${id}`, `wt/${id.replace(/^t_/, 't-')}`].some((prefix) => head === prefix || head.startsWith(`${prefix}-`) || head.startsWith(`${prefix}/`))
+  const named = (head) => [`wt/${id}`, `wt/${id.replace(/^t_/, 't-')}`].some((prefix) => head === prefix || head.startsWith(`${prefix}-`) || head.startsWith(`${prefix}/`));
+  const mine = (repository, head) => (repository === ownRepository && head === branch) || named(head)
     || registered.some((r) => r.repository === repository && r.branch === head);
   const prs = [];
   for (const repository of new Set([ownRepository, ...registered.map((r) => r.repository), ...knownRepositories()])) {
@@ -104,16 +145,21 @@ export function openReviewPullRequests(board, id) {
     let list = pullRequestLists.get(repository);
     if (!list || Date.now() - list.at >= 60_000) {
       let items = [];
-      try { items = JSON.parse(run('gh', ['pr', 'list', '--repo', repository, '--state', 'open', '--limit', '1000', '--json', 'url,headRefOid,headRefName,baseRefName,isCrossRepository,isDraft'])); }
+      try { items = github(`/repos/${repository}/pulls?state=open&per_page=100`, true).map((p) => pullRequest(repository, p)); }
       catch (error) { if (repository === ownRepository || registered.some((r) => r.repository === repository)) throw error; } // another repository unreachable here is not this arc's
       list = { at: Date.now(), items };
       if (pullRequestLists.size >= 64) pullRequestLists.delete(pullRequestLists.keys().next().value);
       pullRequestLists.set(repository, list);
     }
-    // a draft is not handed over yet: its review starts when it is marked ready
-    for (const pr of list.items) if (!pr.isCrossRepository && !pr.isDraft && mine(repository, pr.headRefName)) prs.push({ url: pr.url, head: pr.headRefOid });
+    // The repository's default branch is not a work branch, declared or checked out (a card working in a `dir` on main).
+    if (repository === ownRepository && branch) {
+      const defaultBranch = list.items.find((pr) => pr.defaultBranch)?.defaultBranch ?? (() => { try { return run('git', ['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'], own).replace(/^origin\//, ''); } catch { return null; } })();
+      if (branch === defaultBranch) branch = null;
+    }
+    // a draft is not handed over yet: its review starts when it is marked ready; a PR to another base (main→prod) is a release, not the arc's work
+    for (const pr of list.items) if (!pr.isCrossRepository && !pr.isDraft && pr.baseRefName === pr.defaultBranch && mine(repository, pr.headRefName)) prs.push({ url: pr.url, head: pr.headRefOid });
   }
-  if (!prs.length) return null;
+  if (!prs.length) return branch ? null : { waits: `the card has no work branch (${task?.branch_name ? `it declares ${task.branch_name}, its repository's default` : current ? `its checkout ${own} is on ${current}, its repository's default` : `its checkout ${own} is on no branch`}): give it one with --branch, or open its PR from a wt/${id} branch` };
   return { pr: prs.map((p) => p.url), pr_head: prs.map((p) => p.head), branch };
 }
 
@@ -122,17 +168,35 @@ function knownRepositories() {
   try { return [...new Set(branchCheckouts(null, '*').map((row) => row.repository))]; } catch { return []; }
 }
 
-/** Whether the arc's open PRs (`[{ url, head }]`) call for its review. Before any verdict: while some head has none.
- *  After a verdict: only once a PR that verdict judged shows a new head. A PR that joins the arc, or one that merged or
- *  closed, does not by itself bring the arc back: after changes are requested the next run is the implementer's. */
+/** Whether the arc's open PRs (`[{ url, head }]`) call for its review: some head no verdict judged that is new work.
+ *  Before any verdict every unjudged head is. After a verdict, a PR it judged with a new head is, and so is a head
+ *  committed after that verdict (a new PR carrying the fixes, or any PR after a verdict that named none). A PR that
+ *  joins with a head committed before the verdict is not: after changes are requested the next run is the
+ *  implementer's until it pushes. */
 export function reviewDue(board, id, prs) {
-  const unjudged = prs.some((p) => !judgedHead(board, id, p.head));
-  const last = board.db.prepare(`SELECT r.payload FROM task_events r WHERE r.task_id = ? AND r.kind = 'review_requested'
+  const unjudged = prs.filter((p) => !judgedHead(board, id, p.head));
+  if (!unjudged.length) return false;
+  const last = board.db.prepare(`SELECT r.payload, (SELECT MIN(v.created_at) FROM task_events v WHERE v.task_id = r.task_id
+      AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id) AS verdict_at
+    FROM task_events r WHERE r.task_id = ? AND r.kind = 'review_requested'
     AND EXISTS (SELECT 1 FROM task_events v WHERE v.task_id = r.task_id AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id)
     ORDER BY r.id DESC LIMIT 1`).get(id);
-  if (!last) return unjudged;
+  if (!last) return true;
   const judged = candidatePullRequests(JSON.parse(last.payload)?.ci);
-  return unjudged && judged.some((j) => prs.some((p) => p.url === j.pr.url && p.head !== j.commit));
+  if (judged.some((j) => prs.some((p) => p.url === j.pr.url && p.head !== j.commit))) return true;
+  return unjudged.some((p) => (commitTime(p) ?? 0) > Number(last.verdict_at));
+}
+
+const commitTimes = new Map();
+/** When a PR's head was committed (seconds), read from GitHub once per head; null when it cannot be read. */
+function commitTime({ url, head }) {
+  if (commitTimes.has(head)) return commitTimes.get(head);
+  let at = null;
+  try {
+    at = Math.floor(Date.parse(github(`/repos/${repositoryOf(url)}/commits/${head}`).commit.committer.date) / 1000) || null;
+  } catch { /* unreadable: not counted as new */ }
+  commitTimes.set(head, at);
+  return at;
 }
 
 /** The verdict already recorded on `head` of the card's PR: a changes-requested or pass that answered
@@ -163,7 +227,7 @@ export function inspectCompletionEvidence(board, id, entry, payload = {}, stage
         const wanted = candidatePullRequests(candidate);
         if (wanted.length !== passed.length || wanted.some((w) => !passed.some((p) => p.pr.url === w.pr.url && p.commit === w.commit))) throw new Error('The current PR heads need their independent verdict before acceptance.');
         for (const w of wanted) {
-          const pr = JSON.parse(run('gh', ['pr', 'view', w.pr.url, '--repo', w.repository, '--json', 'state,headRefOid']));
+          const pr = readPullRequest(w.pr.url);
           if (!['OPEN', 'MERGED'].includes(pr.state) || pr.headRefOid !== w.commit) throw new Error(`The head of ${w.pr.url} changed after its verdict; request a new review.`);
         }
         Object.assign(state, { ...candidate, ready: true, reason: null });
@@ -211,7 +275,7 @@ function verifyPullRequest(board, id, entry, own, url, supplied, stage) {
   // An arc may change several repositories. A PR is read from GitHub; its pushed head is the reviewed one. The
   // card's own checkout, and this machine's checkout of the PR's branch when it keeps one, must also hold that head
   // with nothing uncommitted.
-  const observed = JSON.parse(run('gh', ['pr', 'view', url, '--repo', repository, '--json', 'url,number,state,headRefOid,headRefName,baseRefName,isCrossRepository,isDraft']));
+  const observed = readPullRequest(url);
   const path = originOf(own) === repository && run('git', ['branch', '--show-current'], own) === observed.headRefName ? own : branchCheckout(board, id, repository, observed.headRefName);
   if (observed.state !== 'OPEN' || observed.isCrossRepository) throw new Error(`Source review needs an open PR from its repository (${url}).`);
   if (observed.isDraft) throw new Error(`${url} is a draft; its review starts when it is marked ready for review.`);

package/board/dispatch.mjs

@@ -23,7 +23,7 @@ import { hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { view, boardPath, claimer, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
+import { view, boardCopyOf, boardPath, claimer, copyRefusal, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
 import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, templateValue, workflowFor } from './workflow.mjs';
 import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
 import { evaluate, holds, render } from './expr.mjs';
@@ -428,6 +428,7 @@ function limitsOf(db, board, entry, task, session) {
 
 function stopSession(board, session) {
   if (!session) return;
+  if (boardCopyOf()) throw copyRefusal('closes no session');
   if (session.surface === 'headless' && pidAlive(session.pid)) {
     // SIGTERM to the worker's process group, then SIGKILL if it is still there after a grace, as Hermes stops its own
     const signal = (sig) => { try { process.kill(-session.pid, sig); } catch { try { process.kill(session.pid, sig); } catch { /* gone */ } } };
@@ -1354,6 +1355,7 @@ function resolveLocalWorkspace(board, task) {
  */
 export function requestAdoption(board, id, who, { workspace = null, assignee = null, role = null } = {}) {
   if (!who) throw new Error('name the session to adopt');
+  if (boardCopyOf()) throw copyRefusal('adopts no session');
   tx(board, db => {
     if (!getTask(db, id)) throw new Error(`no card ${id}`);
     event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested', workspace, assignee, role });
@@ -1442,6 +1444,7 @@ function adoptSession(board, id, who, { workspace = null, ttl, assignee = null,
 
 // a notice sent within a transaction's caller that cannot await (the launcher): the same door, synchronously
 function deliverNow(board, to, body, key) {
+  if (boardCopyOf()) throw copyRefusal('sends no notice to sessions');
   const request = { op: 'send', from: boardAddress(board.label), from_name: `${board.label} board`, to, queue: false, id: key, subject: String(body).split('\n')[0].slice(0, 160),
     body: `[Board notice from the ${board.label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)` };
   const r = sc(['message', 'remote-deliver'], { input: JSON.stringify(request), timeout: 120_000 });
@@ -1451,6 +1454,7 @@ function deliverNow(board, to, body, key) {
 }
 
 async function send(from, label, to, body, key, { queue = false, ask = false, subject } = {}) {
+  if (boardCopyOf()) throw copyRefusal('sends no mail to sessions or managers');
   const request = {
     op: 'send', from, from_name: `${label} board`, to, queue, id: key, subject: String(subject ?? String(body).split('\n')[0]).slice(0, 160),
     // a question the board waits on is answered by a reply; a notice is not
@@ -1563,11 +1567,20 @@ async function notify(board, fleet, report, entry) {
     // a worker whose run has ended is not woken by a notice (a second session would start working the card beside
     // the one the next run gets): the notice is filed in its mailbox, read when it next works
     const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, sub.task_id)?.metadata?.supercode) === sub.chat_id);
+    // An idle Claude session cannot hold a notice in its mailbox (it starts a turn for every message it is given), so
+    // a notice that must not wake it waits, unsent, for the session's next work.
+    if (!working && fleet.ok && fleet.sessions.some((s) => s.address === sub.chat_id && s.harness === 'claude-code' && s.status === 'idle')) {
+      report.notices_waiting = (report.notices_waiting ?? 0) + 1;
+      return;
+    }
     let cursor = Number(sub.last_event_id);
     let failed = null;
     try {
+      // an event older than the workflow's notice_max_age_seconds is history, not news: it is passed over, never mailed
+      const maxAge = Number(entry.params.notice_max_age_seconds) || null;
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
+        if (maxAge && now() - Number(ev.created_at) > maxAge) { cursor = ev.id; (report.stale_notices_passed ??= 0); report.stale_notices_passed += 1; continue; }
         // nobody is told of their own act
         if (p.by && p.by === sub.chat_id) { cursor = ev.id; continue; }
         let text;
@@ -1593,7 +1606,8 @@ async function notify(board, fleet, report, entry) {
         const kind = 'notice_failed';
         const previous = db.prepare('SELECT payload FROM task_events WHERE task_id=? AND kind=? ORDER BY id DESC LIMIT 1').get(sub.task_id, kind);
         const payload = { after_event: cursor, address: sub.chat_id, error: failed, retry: true };
-        if (JSON.stringify(json(previous?.payload, {})) !== JSON.stringify(payload)) event(db, sub.task_id, kind, payload);
+        const { by: _, ...said } = json(previous?.payload, {}) ?? {};
+        if (JSON.stringify(said) !== JSON.stringify(payload)) event(db, sub.task_id, kind, payload);
       });
       report.undelivered.push([sub.task_id, sub.chat_id, failed]);
     }
@@ -1865,7 +1879,12 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
       payload = openReviewPullRequests(board, id);
       // The arc's open PRs ask for one review only while some head has no verdict: after changes are
       // requested the next run is the implementer's, until a new head is pushed.
-      if (!payload || !reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) continue;
+      if (!payload) { report.queued.push([id, 'review waits: no open PR on its branch, a wt/<card> branch or a registered checkout']); continue; }
+      if (payload.waits) { report.queued.push([id, `review waits: ${payload.waits}`]); payload = null; continue; }
+      if (!reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
+        report.queued.push([id, `review waits: every open PR head (${payload.pr.join(', ')}) has a verdict or predates the last one; push a commit that answers it`]);
+        continue;
+      }
       const evidence = inspectCompletionEvidence(board, id, entry, payload, 'request_review');
       if (!evidence.ready) throw new Error(evidence.reason);
       refreshCardInputs(board, id, { commits: true });
@@ -1912,6 +1931,8 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
     const path = boardPath(root, slug);
     const marker = `${path}.corrupt-seen`;
     if (existsSync(marker) && readFileSync(marker, 'utf8').trim() === fingerprint(path)) { report.error = 'skipped: the board file was corrupt and has not changed since (`supercode workflow repair`)'; out.push(report); continue; }
+    // a copy of a home dispatches nothing: its runs, sessions and managers are the original's
+    if (boardCopyOf()) { report.error = `skipped: ${copyRefusal('starts, supervises, adopts and mails nothing').message}`; out.push(report); continue; }
     let board;
     try {
       board = openBoard(root, slug);

package/board/store.mjs

@@ -10,7 +10,7 @@
 // are in `engine.mjs`. Hermes's own tools may write a `kanban.db` at the same time: every write there takes SQLite's
 // native transaction boundary and retries an optimistic conflict.
 import { randomBytes } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
@@ -142,7 +142,23 @@ export function layOut(db, { fresh }) {
  * Open (creating when `create`, in `backing`) board `slug`: `{ db, root, slug, path, backing, tx, close }`. `db` answers
  * SQLite's statement API (`prepare(sql).get|all|run`, `exec`) whatever the backing.
  */
+// A home records where it was made (`.board-origin` at its root). A copy of the home carries that record elsewhere and
+// is a copy: it may be read and written, but it addresses no session and no manager, which are the original's.
+let copyOfHome = null;
+/** The original home's path when the board opened last is a copy of it; null for a home of its own. */
+export const boardCopyOf = () => copyOfHome;
+export const copyRefusal = (what) => new Error(`this board is a copy of the home at ${copyOfHome}; it ${what}, which belong to the original`);
+function noteOrigin(root) {
+  if (!existsSync(root)) return;
+  const here = realpathSync(root), file = join(root, '.board-origin');
+  let origin = null;
+  try { origin = JSON.parse(readFileSync(file, 'utf8')).root ?? null; } catch { /* none yet */ }
+  if (!origin) { writeFileSync(file, `${JSON.stringify({ root: here })}\n`); origin = here; }
+  copyOfHome = origin === here ? null : origin;
+}
+
 export function openBoard(root, slug = DEFAULT_BOARD, { create = false, backing = null, document = null } = {}) {
+  noteOrigin(root);
   const kept = backingOf(root, slug);
   if (!kept && !create) throw new Error(`no board ${slug} in ${root} (${boardPath(root, slug)})`);
   if (kept && backing && kept !== backing) throw new Error(`board ${slug} in ${root} is kept by the ${kept} backing, not ${backing}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.4.150",
+  "version": "0.4.152",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {