@volter/supercode-orchestrator 0.4.23 → 0.4.24

package/board/cli.mjs

@@ -466,7 +466,7 @@ export async function runWorkflow(argv) {
       if (args.reason) for (const [t] of results) withBoard((b) => engine.comment(b, t, callerName(), `UNBLOCK: ${args.reason}`));
       say(args, results.map(([t, s]) => `Unblocked ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
-    case 'request-review': need(1, 'a card id'); withBoard((b) => engine.requestReview(b, id, { summary: args.summary ?? null, reviewer: args.reviewer ?? null, metadata: metadataOf(args.metadata) ?? null, force: Boolean(args.force) })); say(args, `${id} → review`, { ok: true }); return 0;
+    case 'request-review': need(1, 'a card id'); withBoard((b) => engine.requestReview(b, id, { summary: args.summary ?? null, reviewer: args.reviewer ?? null, metadata: metadataOf(args.metadata) ?? null, force: Boolean(args.force), expectedRunId: workerRun(b.db, id, sid) })); say(args, `${id} → review`, { ok: true }); return 0;
     case 'request-changes': need(2, 'a card id and the reason'); withBoard((b) => engine.requestChanges(b, id, { reason: rest.slice(1).join(' '), reviewer: args.reviewer ?? callerName() })); say(args, `${id} sent back for changes`, { ok: true }); return 0;
     case 'reopen': {
       // a done card back to work; the cards that built on it are invalidated with it (Hermes's reopen)
@@ -909,6 +909,17 @@ function importBoard(root, archive, as) {
 // ------------------------------------------------------------------ a card's own session
 
 /** The card whose latest session is `sessionId` (the caller works it), or null. */
+/**
+ * The run the caller works on card `id`, as Hermes's `_worker_run_id_for` names it: a one-shot worker's
+ * `HERMES_KANBAN_TASK`/`HERMES_KANBAN_RUN_ID`, or the run the board recorded for the caller's session. Null for anyone else.
+ */
+function workerRun(db, id, sessionId) {
+  if (process.env.HERMES_KANBAN_TASK === id && Number.isInteger(Number(process.env.HERMES_KANBAN_RUN_ID)) && process.env.HERMES_KANBAN_RUN_ID) return Number(process.env.HERMES_KANBAN_RUN_ID);
+  if (!sessionId) return null;
+  const hit = db.prepare('SELECT id FROM task_runs WHERE task_id = ? AND metadata LIKE ? ORDER BY id DESC LIMIT 1').get(id, `%"session_id":"${sessionId}"%`);
+  return hit ? Number(hit.id) : null;
+}
+
 function ownCard(db, sessionId) {
   const hit = db.prepare('SELECT task_id FROM task_runs WHERE metadata LIKE ? ORDER BY id DESC LIMIT 1').get(`%"session_id":"${sessionId}"%`);
   if (!hit) return null;

package/board/engine.mjs

@@ -7,7 +7,7 @@
 //
 // Each function takes an open board (`store.mjs`) and runs in one write transaction. Nothing here launches,
 // observes or sends: the dispatcher (`dispatch.mjs`) does, and records what it did through these.
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, rmSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
@@ -60,6 +60,15 @@ export function parseWorkspace(word = 'scratch') {
 
 // ------------------------------------------------------------------ runs
 
+/**
+ * Hermes's `_terminate_reclaimed_worker`: SIGTERM to the worker's process group, SIGKILL if it is still alive five
+ * seconds later. The wait runs in a detached shell, so the board's write lock is never held through it.
+ */
+function terminate(pid) {
+  try { process.kill(-pid, 'SIGTERM'); } catch { try { process.kill(pid, 'SIGTERM'); } catch { return; } }
+  spawn('/bin/sh', ['-c', 'for i in 1 2 3 4 5 6 7 8 9 10; do kill -0 "$0" 2>/dev/null || exit 0; sleep 0.5; done; kill -KILL -"$0" 2>/dev/null || kill -KILL "$0" 2>/dev/null', String(pid)], { detached: true, stdio: 'ignore' }).unref();
+}
+
 /** Close the card's open run; answers its id, or null when none was open. */
 export function endRun(db, taskId, { outcome, status = null, summary = null, error = null, metadata = undefined }) {
   const row = one(db, 'SELECT current_run_id FROM tasks WHERE id = ?', taskId);
@@ -70,9 +79,8 @@ export function endRun(db, taskId, { outcome, status = null, summary = null, err
   // a run taken back (reclaim, archive, a reopened ancestor) stops its one-shot worker on this machine, as Hermes
   // terminates a reclaimed worker (a board's one-shot workers run where the board is); a pane session is a person-visible session and is never killed from the board
   const worker = outcome === 'reclaimed' ? json(was, {})?.supercode : null;
-  if (worker?.surface === 'headless' && worker.pid) {
-    try { process.kill(-worker.pid, 'SIGTERM'); } catch { try { process.kill(worker.pid, 'SIGTERM'); } catch { /* gone */ } }
-  }
+  const lock = one(db, 'SELECT claim_lock FROM task_runs WHERE id = ?', runId)?.claim_lock ?? one(db, 'SELECT claim_lock FROM tasks WHERE id = ?', taskId)?.claim_lock;
+  if (worker?.surface === 'headless' && worker.pid && String(lock ?? '').startsWith(`${claimer().split(':')[0]}:`)) terminate(Number(worker.pid));
   run(db, `UPDATE task_runs SET status = ?, outcome = ?, summary = ?, error = ?, metadata = ?, ended_at = ?, claim_lock = NULL, claim_expires = NULL, worker_pid = NULL
            WHERE id = ? AND ended_at IS NULL`, status ?? outcome, outcome, summary, error, keep, now(), runId);
   run(db, 'UPDATE tasks SET current_run_id = NULL WHERE id = ?', taskId);
@@ -424,13 +432,15 @@ export function unblock(board, id) {
 }
 
 /** Implementation done, awaiting review (not a block): the review lane, optionally under a reviewer profile. */
-export function requestReview(board, id, { summary = null, metadata = null, reviewer = null, force = false } = {}) {
+export function requestReview(board, id, { summary = null, metadata = null, reviewer = null, force = false, expectedRunId = null } = {}) {
   return tx(board, (db) => {
     const task = must(db, id);
     if (!parentsDone(db, id)) throw new Error(`${id} waits on parents that are not done`);
     if (!['running', 'ready'].includes(task.status)) throw new Error(`${id} is ${task.status}; only a running or ready card goes to review`);
     // a live claim is its worker's to hand off; anyone else says so on purpose (Hermes's guard)
-    if (task.status === 'running' && task.claim_lock && !force) throw new Error(`${id} is running under a live claim; its worker requests review, or pass --force to override on purpose`);
+    // (Hermes's expected_run_id: the worker names the run it holds; a superseded run changes nothing)
+    if (expectedRunId !== null && Number(task.current_run_id) !== Number(expectedRunId)) throw new Error(`run ${expectedRunId} of ${id} is no longer its current run; nothing was changed`);
+    if (task.status === 'running' && task.claim_lock && !force && expectedRunId === null) throw new Error(`${id} is running under a live claim; its worker requests review, or pass --force to override on purpose`);
     // a re-review goes back to the reviewer who asked for the changes
     if (!reviewer) {
       const changed = one(db, "SELECT id FROM task_runs WHERE task_id = ? AND outcome = 'changes_requested' ORDER BY id DESC LIMIT 1", id);

package/board/tools.mjs

@@ -97,7 +97,7 @@ export async function boardTool(root, name, args = {}, env = {}) {
       }
       case 'kanban_request_review': {
         const stale = ownRun(); if (stale) return error(stale);
-        engine.requestReview(board, tid, { summary: args.summary ? redact(String(args.summary)) : null, metadata: args.metadata ? redact(args.metadata) : null, reviewer: args.reviewer ?? null, force: own === tid });
+        engine.requestReview(board, tid, { summary: args.summary ? redact(String(args.summary)) : null, metadata: args.metadata ? redact(args.metadata) : null, reviewer: args.reviewer ?? null, expectedRunId: own === tid && runId ? runId : null });
         return ok({ task_id: tid, status: 'review' });
       }
       case 'kanban_request_changes': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.4.23",
+  "version": "0.4.24",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {