@volter/supercode-orchestrator 0.4.160 → 0.5.1

package/reducer.mjs

@@ -11,6 +11,7 @@ import { parseCommand, frame, REPLY } from './commands.mjs';
 import { cronTick, gateResult, fireFinal, fireFailed, finishHostedFire, homeZone, isSynthetic, nextRunAt, scheduleError, unattendedRequest } from './cron.mjs';
 import { handleWebhook } from './webhook.mjs';
 import { modelError } from './activation.mjs';
+import { addParticipant, agentSlot, budgetRefusal, conversationId, ensureConversation, isAgent, profileOfAgent, receivingAgents, recordUsage } from './conversations.mjs';
 
 export function keyOf(event) {
   return surfaceKeyString(event.key);
@@ -150,7 +151,8 @@ function handleInbound(state, ev, effects) {
 
   // 1. access
   const policy = accessPolicy(owner, ev.key.platform);
-  const allowed = policy === 'open' || (owner.access.allowlist[ev.key.platform] ?? []).includes(ev.sender);
+  const principal = ev.identity?.classification==='proven'?ev.identity.principal?.id:null;
+  const allowed = policy === 'open' || (principal && (owner.access.allowlist[ev.key.platform] ?? []).includes(`principal:${principal}`)) || (owner.access.allowlist[ev.key.platform] ?? []).includes(ev.sender);
   if (!allowed) {
     // Hermes's gateway: in a DM whose platform pairs, a stranger is offered a code from Hermes's own
     // pairing store (its codes, expiry, rate limit and lockout; docs/plans/hermes-compat.md row 8);
@@ -163,16 +165,31 @@ function handleInbound(state, ev, effects) {
     return;
   }
 
-  // 2. route
-  const routed = resolveRoute(owner.routes, ev.key, ev.guild_id) ?? owner.name;
-  const profile = profileOf(state, routed);
-  const keyString = keyOf(ev);
+  // 2. route: to an agent (G1); a named profile's own agent bears its name
+  const routedAgent = resolveRoute(owner.routes, ev.key, ev.guild_id) ?? owner.name;
+  const routedProfile = profileOf(state, profileOfAgent(state, routedAgent) ?? owner.name);
 
-  // 3. command
+  // 3. command: the routed agent's
   const cmd = parseCommand(ev.text);
-  if (cmd) { handleCommand(state, profile, ev, keyString, cmd, effects); return; }
+  if (cmd) { handleCommand(state, routedProfile, ev, agentSlot(routedProfile.name, routedAgent, keyOf(ev)), cmd, effects); return; }
+
+  // 4. the conversation (G5, created on first sight); its speaker policy picks who receives the line (G1)
+  const conversation = ensureConversation(state, ev.key, routedAgent, now);
+  addParticipant(conversation, `${ev.key.platform}:${ev.sender}`, 'to', now);
+  const agents = receivingAgents(state, conversation, ev, routedAgent);
+  if (agents.length) conversation.last_speaker = agents[agents.length - 1];
+  for (const agent of agents) inboundToAgent(state, agent, conversation, ev, effects);
+  effects.push({ type: 'save' });
+}
 
-  // 4. get-or-create
+/** One receiving agent's binding for the conversation: get-or-create, then frame and send (§4.1 steps 4–5). */
+function inboundToAgent(state, agent, conversation, ev, effects) {
+  const now = ev.at;
+  const profile = profileOf(state, profileOfAgent(state, agent) ?? ev.profile);
+  const keyString = agentSlot(profile.name, agent, keyOf(ev));
+  addParticipant(conversation, agent, 'to', now);
+
+  // get-or-create the (conversation, agent) binding
   let b = liveBinding(profile, keyString);
   if (b) {
     const reason = expired(b, sessionReset(profile), now);
@@ -180,13 +197,13 @@ function handleInbound(state, ev, effects) {
   }
   if (!b) {
     b = {
-      key: ev.key,
+      key: ev.key, conversation: conversation.id, agent,
       worker: { harness: profile.worker?.harness ?? 'unknown', session_id: null, locator: null },
-      started_at: now, last_activity_at: now, ended_at: null, end_reason: null, handoff: null, recurrence: null, residue: {},
+      started_at: now, last_activity_at: now, ended_at: null, end_reason: null, recurrence: null, residue: {},
     };
     profile.bindings[keyString] = b;
     if (!profile.worker) { reply(state, profile, ev.key, `Profile ${profile.name} has no worker configured.`, now, effects); return; }
-    startWorker(state, profile, keyString, effects);
+    if (!startWorker(state, profile, keyString, effects, now)) return;
   } else {
     // A live binding whose lease is gone — a restart, a worker that died — must
     // get its worker back on the next message rather than queue it forever
@@ -199,15 +216,17 @@ function handleInbound(state, ev, effects) {
         // The conversation's session comes back, not a blank one; one that will not reopen starts fresh (loop).
         b.residue.resume_runtime_id ??= b.residue.runtime_id ?? b.worker.session_id;
       }
-      startWorker(state, profile, keyString, effects);
+      if (!startWorker(state, profile, keyString, effects, now)) return;
     }
   }
   b.last_activity_at = now;
+  b.conversation ??= conversation.id;
+  b.agent ??= agent;
 
   // 5. frame and send, or queue behind the running turn
   const rt = ensureRuntime(state);
   const lid = leaseId(profile.name, keyString);
-  const text = frame(profile.name, ev.key, ev.sender, ev.sender_name, now, ev.text);
+  const text = frame(profile.name, ev.key, ev.sender, ev.sender_name, now, ev.text, ev.identity);
   const inFlight = Boolean(rt.turns[lid]);
   const leased = Boolean(rt.leases[lid]);
   if (inFlight && leased && rt.leases[lid].steer) {
@@ -220,7 +239,6 @@ function handleInbound(state, ev, effects) {
     rt.turns[lid] = { started_at: now, buffer: '' };
     effects.push({ type: 'send_input', profile: profile.name, keyString, text });
   }
-  effects.push({ type: 'save' });
 }
 
 /**
@@ -228,13 +246,24 @@ function handleInbound(state, ev, effects) {
  * a burst of messages before the lease exists queues behind ONE start (the
  * `started`/`error` worker events clear the mark).
  */
-export function startWorker(state, profile, keyString, effects) {
+export function startWorker(state, profile, keyString, effects, now = null) {
   const rt = ensureRuntime(state);
+  const binding = profile.bindings[keyString];
+  const agent = binding?.agent ?? profile.name;
+  // G3: a start or resume over the agent's budget is refused with the reason; nothing is paused or ended
+  const session = binding?.worker?.session_id ? `${binding.worker.harness}:${binding.worker.session_id}` : null;
+  const refused = now ? budgetRefusal(state, profile, agent, now, session) : null;
+  if (refused) {
+    if (binding) reply(state, profile, binding.key, `Not started: ${refused}.`, now, effects);
+    effects.push({ type: 'budget_refused', profile: profile.name, agent, reason: refused });
+    return false;
+  }
   rt.starting[leaseId(profile.name, keyString)] = true;
   // A binding whose runtime went away with the daemon reopens that same session where its harness can, so the
   // conversation it held is not lost; the loop starts fresh when the harness cannot.
-  const resume = profile.bindings[keyString]?.residue?.resume_runtime_id ?? null;
-  effects.push({ type: 'runtime_start', profile: profile.name, keyString, worker: profile.worker, prompt: null, resume_runtime_id: resume });
+  const resume = binding?.residue?.resume_runtime_id ?? null;
+  effects.push({ type: 'runtime_start', profile: profile.name, keyString, worker: profile.worker, prompt: null, resume_runtime_id: resume, agent });
+  return true;
 }
 
 
@@ -270,7 +299,7 @@ function handleCommand(state, profile, ev, keyString, cmd, effects) {
       break;
     }
     case 'whoami': {
-      reply(state, profile, ev.key, `${ev.sender}${ev.sender_name ? ` (${ev.sender_name})` : ''} on ${renderSurfaceKey(profile.name, ev.key)}`, now, effects);
+      reply(state, profile, ev.key, `${ev.identity?.label??'unresolved'}${ev.identity?.principal?` (${ev.identity.principal.id}; proven)`:''}; ${ev.sender}${ev.sender_name ? ` (${ev.sender_name})` : ''} on ${renderSurfaceKey(profile.name, ev.key)}`, now, effects);
       break;
     }
     case 'model': {
@@ -322,18 +351,80 @@ export function doHandoff(state, profile, keyString, to, note, now, effects) {
   const b = liveBinding(profile, keyString);
   if (!b) return { ok: false, message: 'No live session to hand off.' };
   if (!to) return { ok: false, message: 'Cannot hand off: no platform named.' };
-  b.handoff = { to, state: 'pending', error: null };
+  // G2: a Handoff record (session → target conversation), never a field on the binding
   const target = homeChannel(profile, to);
+  const agent = b.agent ?? profile.name;
+  const record = { session: `${b.worker.harness}:${b.worker.session_id ?? ''}`, to: target ? conversationId(target) : `platform:${to}`, by: agent, state: target ? 'pending' : 'failed', at: now };
   if (target) {
+    addParticipant(ensureConversation(state, target, agent, now), agent, 'to', now);
     reply(state, profile, target, `Continuing session ${b.worker.session_id} from ${b.key.platform}. Reply here to pick it up.${note ? `\n${note}` : ''}`, now, effects);
   } else {
-    b.handoff.state = 'failed';
-    b.handoff.error = `no home chat on ${to}`;
+    record.error = `no home chat on ${to}`;
   }
+  (state.handoffs ??= []).push(record);
   effects.push({ type: 'save' });
-  return b.handoff.state === 'pending'
+  return record.state === 'pending'
     ? { ok: true, message: `Handed off to ${to}.` }
-    : { ok: false, message: `Cannot hand off: ${b.handoff.error}.` };
+    : { ok: false, message: `Cannot hand off: ${record.error}.` };
+}
+
+/** A transfer's line reaches its receiver: queued behind a running turn, or sent now. */
+function handOver(rt, profileName, keyString, line, now, effects) {
+  const lid = leaseId(profileName, keyString);
+  if (rt.turns[lid] || !rt.leases[lid]) (rt.queues[lid] ??= []).push(line);
+  else { rt.turns[lid] = { started_at: now, buffer: '' }; effects.push(queuedInput(profileName, keyString, line)); }
+}
+
+/** The handovers a giver's turn held back go out when that turn ends. */
+function releaseHandovers(rt, lid, now, effects) {
+  for (const held of rt.handovers?.[lid] ?? []) handOver(rt, held.profile, held.keyString, held.line, now, effects);
+  if (rt.handovers) delete rt.handovers[lid];
+}
+
+/**
+ * G2: the conversation passes from one agent to another. The giver's binding ends with `transfer` (it stays a
+ * participant); the receiver gets or continues its binding, and its next turn is given the conversation's history
+ * as the transfer says. Refused unless the receiver is an agent of this home.
+ */
+export function doTransfer(state, profile, keyString, args, now, effects) {
+  const from = liveBinding(profile, keyString);
+  if (!from) return { ok: false, message: 'No live conversation to transfer.' };
+  const giver = from.agent ?? profile.name;
+  const conversation = state.conversations?.[from.conversation] ?? ensureConversation(state, from.key, giver, now);
+  const history = ['full', 'filtered', 'none'].includes(args.history) ? args.history : 'full';
+  const record = { conversation: conversation.id, from: giver, to: String(args.to ?? ''), by: args.by ?? giver, reason: String(args.reason ?? ''), history,
+    ...(history === 'filtered' ? { filter: args.filter ?? { last: 20 } } : {}), state: 'pending', at: now };
+  (state.transfers ??= []).push(record);
+  const refuse = (error) => { record.state = 'refused'; record.error = error; effects.push({ type: 'save' }); return { ok: false, message: `Transfer refused: ${error}.` }; };
+  if (!isAgent(state, record.to)) return refuse(`${record.to || 'nobody'} is not an agent of this home (its agents: ${[...new Set([...Object.keys(state.profiles ?? {}), ...Object.keys(state.agents ?? {})])].join(', ')})`);
+  if (record.to === giver) return refuse('the conversation is already this agent\'s');
+  const toProfile = profileOf(state, profileOfAgent(state, record.to));
+  if (!toProfile.worker) return refuse(`${record.to}'s profile has no worker`);
+  endBinding(state, profile.name, keyString, 'transfer', now, effects);
+  addParticipant(conversation, record.to, 'to', now);
+  conversation.holder = record.to;
+  const slot = agentSlot(toProfile.name, record.to, surfaceKeyString(from.key));
+  let b = liveBinding(toProfile, slot);
+  if (!b) {
+    b = { key: from.key, conversation: conversation.id, agent: record.to, worker: { harness: toProfile.worker.harness, session_id: null, locator: null },
+      started_at: now, last_activity_at: now, ended_at: null, end_reason: null, recurrence: null, residue: {} };
+    toProfile.bindings[slot] = b;
+  }
+  const rt = ensureRuntime(state);
+  const lid = leaseId(toProfile.name, slot);
+  if (!rt.leases[lid] && !rt.starting[lid] && !startWorker(state, toProfile, slot, effects, now)) return refuse(`${record.to} may not start`);
+  const text = `${giver} transferred this conversation to you${record.reason ? `: ${record.reason}` : '.'}`;
+  const handover = history === 'none' || !from.worker.session_id ? null
+    : { harness: from.worker.harness, session_id: from.worker.session_id, mode: history, filter: record.filter ?? null, from: giver };
+  const line = { text, at: now, ...(handover ? { history: handover } : {}) };
+  // The giver is mid-turn (it called the tool): its reply of that turn is part of the conversation, so the receiver
+  // is handed it when that turn ends, its history read then.
+  const giverLid = leaseId(profile.name, keyString);
+  if (rt.turns[giverLid]) (rt.handovers ??= {})[giverLid] = [...(rt.handovers?.[giverLid] ?? []), { profile: toProfile.name, keyString: slot, line }];
+  else handOver(rt, toProfile.name, slot, line, now, effects);
+  record.state = 'done';
+  effects.push({ type: 'save' });
+  return { ok: true, message: `Transferred to ${record.to}.` };
 }
 
 // ---------------------------------------------------------------- worker events
@@ -355,6 +446,9 @@ function handleWorker(state, ev, effects) {
   // any word from the worker is activity; a fire's inactivity limit counts from the last (§4.3)
   rt.activity[lid] = now;
   switch (w.kind) {
+    case 'session':
+      if(binding&&binding.worker.session_id!==w.session_id){binding.worker.session_id=w.session_id;effects.push({type:'save'});}
+      break;
     case 'activity':
       break;
     case 'started': {
@@ -440,12 +534,15 @@ function handleWorker(state, ev, effects) {
         if (failed) reply(state, profile, binding.key, `Turn failed: ${message}`, now, effects);
         else if (text && !t?.replied) reply(state, profile, binding.key, text, now, effects);
       }
+      releaseHandovers(rt, lid, now, effects);
       const q = rt.queues[lid] ?? [];
       if (q.length && rt.leases[lid]) {
         const next = q.shift();
         rt.turns[lid] = { started_at: now, buffer: '' };
         effects.push(queuedInput(profile.name, ev.keyString, next));
       }
+      // G3: the session's usage is read again from the harness's own records after every turn
+      if (binding?.worker?.session_id) effects.push({ type: 'usage_refresh', session: { harness: binding.worker.harness, session_id: binding.worker.session_id }, agent: binding.agent ?? profile.name });
       effects.push({ type: 'save' });
       break;
     }
@@ -467,6 +564,7 @@ function handleWorker(state, ev, effects) {
     case 'error': {
       delete rt.turns[lid];
       delete rt.starting[lid];
+      releaseHandovers(rt, lid, now, effects);
       const synthetic = binding ? fireFailed(state, profile, binding, w.message ?? w.reason ?? 'worker exited', now, effects) : false;
       if (binding) {
         endBinding(state, profile.name, ev.keyString, 'error', now, effects);
@@ -502,7 +600,7 @@ export function permissionResponse(options, allow, reason = null) {
  */
 function queuedInput(profile, keyString, next) {
   const framed = next.job_id && (next.context_from || next.skills?.length);
-  return { type: 'send_input', profile, keyString, text: next.text, ...(framed ? { context_from: next.context_from ?? null, skills: next.skills ?? [], job_id: next.job_id } : {}) };
+  return { type: 'send_input', profile, keyString, text: next.text, ...(framed ? { context_from: next.context_from ?? null, skills: next.skills ?? [], job_id: next.job_id } : {}), ...(next.history ? { history: next.history } : {}) };
 }
 
 /** An admin's numeric reply resolves the oldest pending request on that surface. */
@@ -510,7 +608,7 @@ function tryResolveRequest(state, ev, effects) {
   const rt = ensureRuntime(state);
   const keyString = keyOf(ev);
   const owner = profileOf(state, ev.profile);
-  const isAdmin = (owner.access.admins[ev.key.platform] ?? []).includes(ev.sender) || accessPolicy(owner, ev.key.platform) === 'open';
+  const isAdmin = (ev.identity?.classification==='proven' && (owner.access.admins[ev.key.platform] ?? []).includes(`principal:${ev.identity.principal.id}`)) || (owner.access.admins[ev.key.platform] ?? []).includes(ev.sender) || accessPolicy(owner, ev.key.platform) === 'open';
   const m = /^\s*(\d+)\s*$/.exec(ev.text);
   if (!m || !isAdmin) return false;
   const entry = Object.entries(rt.pending_requests).find(([, p]) => p.keyString === keyString);
@@ -588,7 +686,7 @@ function handleRestart(state, ev, effects) {
         if (!b.residue?.reopen_at_start) continue;
         delete b.residue.reopen_at_start;
         live += 1;
-        startWorker(state, profile, ks, effects);
+        startWorker(state, profile, ks, effects, ev.at);
         continue;
       }
       live += 1;
@@ -626,7 +724,7 @@ function handleOperator(state, ev, effects) {
   switch (ev.verb) {
     case 'pair_approve': {
       // Hermes's pairing store holds the code (hashed); the loop asks it, and a grant comes back as `access_granted`
-      effects.push({ type: 'access_write', profile: profile.name, op: 'approve', code: ev.args.code, platforms: Object.keys(profile.channels ?? {}) });
+      effects.push({ type: 'access_write', profile: profile.name, op: 'approve', code: ev.args.code, principal: ev.args.principal ?? null, platforms: Object.keys(profile.channels ?? {}) });
       break;
     }
     // what Hermes's store granted, mirrored into the loaded access
@@ -676,7 +774,7 @@ function handleOperator(state, ev, effects) {
       }
       // the attach is over; what queued behind it gets a worker now (resumed where the harness can)
       delete rt.starting[lid];
-      if (rt.queues[lid]?.length && profile.worker) startWorker(state, profile, ev.args.keyString, effects);
+      if (rt.queues[lid]?.length && profile.worker) startWorker(state, profile, ev.args.keyString, effects, ev.at);
       effects.push({ type: 'save' });
       break;
     }
@@ -750,6 +848,11 @@ function handleOperator(state, ev, effects) {
       if (!outcome.ok) effects.push({ type: 'log', level: 'warn', message: `session_handoff: ${outcome.message}` });
       break;
     }
+    case 'conversation_transfer': {
+      const outcome = doTransfer(state, profile, ev.args.keyString, ev.args, ev.at, effects);
+      if (!outcome.ok) effects.push({ type: 'log', level: 'warn', message: `conversation_transfer: ${outcome.message}` });
+      break;
+    }
     // Profile verbs (§4.6): a profile IS a folder, so `create` adds the record
     // and lets `save` write the folder, and `delete` removes the record and
     // asks the loop to move the folder aside — the reducer performs no I/O and
@@ -795,6 +898,8 @@ export function step(state, event) {
     case 'adapter': handleAdapter(state, event); break;
     case 'operator': handleOperator(state, event, effects); break;
     case 'pairing_issued': handlePairingIssued(state, event, effects); break;
+    // G3: a session's usage as its harness recorded it, recomputed whole
+    case 'usage': recordUsage(state, event.session, event.agent, event.usage); effects.push({ type: 'save' }); break;
     default: throw new Error(`unknown event type ${event.type}`);
   }
   return effects;

package/webhook.mjs

@@ -10,7 +10,8 @@
 // and `node:http` at call time instead.
 
 import { surfaceKeyString, sessionReset } from './ir.mjs';
-import { endBinding, ensureRuntime, expired, leaseId, liveBinding, newObligation } from './reducer.mjs';
+import { endBinding, ensureRuntime, expired, leaseId, liveBinding, newObligation, reply } from './reducer.mjs';
+import { budgetRefusal } from './conversations.mjs';
 import { compactStamp, resolveTarget } from './cron.mjs';
 import * as events from './events.mjs';
 
@@ -150,14 +151,17 @@ export function handleWebhook(state, ev, effects) {
     if (reason) { endBinding(state, profile.name, keyString, reason, now, effects); b = null; }
   }
   if (!b) {
+    // G3: an agent over its budget starts nothing; the refusal is told, never a pause
+    const refused = budgetRefusal(state, profile, profile.name, now);
+    if (refused) { effects.push({ type: 'budget_refused', profile: profile.name, agent: profile.name, reason: refused }); return; }
     b = {
-      key,
+      key, agent: profile.name,
       worker: { harness: profile.worker.harness, session_id: `webhook_${ev.name}_${compactStamp(now)}`, locator: null },
       started_at: now, last_activity_at: now, ended_at: null, end_reason: null,
-      handoff: null, recurrence: null, residue: { webhook: ev.name },
+      recurrence: null, residue: { webhook: ev.name },
     };
     profile.bindings[keyString] = b;
-    effects.push({ type: 'runtime_start', profile: profile.name, keyString, worker: profile.worker, prompt: null });
+    effects.push({ type: 'runtime_start', profile: profile.name, keyString, worker: profile.worker, prompt: null, agent: profile.name });
   }
   b.residue.webhook = ev.name;
   b.last_activity_at = now;