@volter/supercode-orchestrator 0.4.7 → 0.4.8

package/adapters/rh2.mjs

@@ -45,11 +45,12 @@ const CLOCK_SKEW_MS = 60_000;
 const ECHO_MEMORY = 500;
 
 export class Rh2Adapter {
-  constructor({ platform = 'rh2', profile = 'default', channel = null, vault = new Map(), log = () => {}, fetchImpl = globalThis.fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms)) } = {}) {
+  constructor({ platform = 'rh2', profile = 'default', channel = null, vault = new Map(), refreshVault = () => false, log = () => {}, fetchImpl = globalThis.fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms)) } = {}) {
     this.platform = platform;
     this.profile = profile;
     this.channel = channel;
     this.vault = vault;
+    this.refreshVault = refreshVault;
     this.log = log;
     this.fetch = fetchImpl;
     this.sleep = sleep;
@@ -110,7 +111,13 @@ export class Rh2Adapter {
   async get(path, params = {}) {
     const url = new URL(`${this.apiUrl()}/api/v3${path}`);
     for (const [k, v] of Object.entries(params)) url.searchParams.set(k, String(v));
-    const res = await this.fetch(url, { headers: this.headers() });
+    let res = await this.fetch(url, { headers: this.headers() });
+    // A refused credential may have been replaced in the home's `.env` since it was read: read it again and, when
+    // it changed, retry with it, so replacing the bot's session never needs a restart.
+    if (res.status === 401 && this.refreshVault()) {
+      this.log('info', `${this.platform}: credential refused; retrying with the one now in the home's .env`);
+      res = await this.fetch(url, { headers: this.headers() });
+    }
     if (!res.ok) {
       const error = new Error(`GET ${path} -> HTTP ${res.status}: ${(await res.text()).slice(0, 200)}`);
       error.status = res.status;

package/bin/orchestrator.mjs

@@ -61,7 +61,7 @@ import { adoptHome } from '../hermes-home.mjs';
 import { hermesAccess } from '../hermes-cli.mjs';
 
 import {
-  load, save, step, importFrom, exportTo, closeWorld, Orchestrator, LoopbackAdapter,
+  load, save, refreshVault, step, importFrom, exportTo, closeWorld, Orchestrator, LoopbackAdapter,
   ChatSdkAdapter, ApiServerAdapter, Rh2Adapter,
   TICK_MS, accessPolicy, applyOperator, performRemoveProfileDir, OPERATOR_OPS,
 } from '../index.mjs';
@@ -80,7 +80,7 @@ const ADAPTERS = {
   loopback: (platform, profile) => new LoopbackAdapter({ platform, profile }),
   'chat-sdk': (platform, profile, ctx) => new ChatSdkAdapter({ platform, profile, profileDir: ctx.state.profiles[profile]?.dir ?? null, channel: ctx.channel, vault: ctx.vault, log: ctx.log }),
   api_server: (platform, profile, ctx) => new ApiServerAdapter({ platform, profile, channel: ctx.channel, vault: ctx.vault, state: ctx.state, log: ctx.log }),
-  rh2: (platform, profile, ctx) => new Rh2Adapter({ platform, profile, channel: ctx.channel, vault: ctx.vault, log: ctx.log }),
+  rh2: (platform, profile, ctx) => new Rh2Adapter({ platform, profile, channel: ctx.channel, vault: ctx.vault, refreshVault: () => refreshVault(ctx.state, ctx.vault), log: ctx.log }),
 };
 
 /// The selector a `platforms:` block resolves through: its `extra.adapter`

package/index.d.ts

@@ -440,6 +440,8 @@ export function emptyRuntime(): RuntimeState;
 export function canonicalJson(value: unknown): string;
 export function persistedView(state: OrchestratorState): Omit<OrchestratorState, 'runtime'>;
 export function parseDotenv(text: string): Map<string, string>;
+/** Read every profile's `.env` into `vault` again, in place; true when a value changed. */
+export function refreshVault(state: { profiles: Record<string, { dir: string }> }, vault: Map<string, string>): boolean;
 
 export const CHAT_TYPES: Set<ChatType>;
 export const END_REASONS: Set<EndReason>;

package/index.mjs

@@ -3,7 +3,7 @@ export {
   renderSurfaceKey, parseSurfaceKey, surfaceKeyString, parseTarget, renderTarget, resolveRoute, routeSpecificity,
   emptyState, emptyProfile, emptyRuntime, canonicalJson, persistedView, decodeContextFrom,
 } from './ir.mjs';
-export { load, save, compile, importFrom, exportTo, closeWorld, retainWorld, releaseWorld, stateOf, parseDotenv, supercodeCommand } from './orchestration.mjs';
+export { load, save, compile, importFrom, exportTo, closeWorld, retainWorld, releaseWorld, stateOf, parseDotenv, supercodeCommand, refreshVault } from './orchestration.mjs';
 export { step, expired, leaseId, accessPolicy, dmBehavior } from './reducer.mjs';
 export * as events from './events.mjs';
 export { parseCommand, frame, COMMANDS, REPLY } from './commands.mjs';

package/orchestration.mjs

@@ -116,6 +116,17 @@ function readVault(orchestration) {
   return vault;
 }
 
+/**
+ * Read every profile's `.env` into `vault` again, in place, so each reader holding it (a channel adapter) sees a
+ * credential replaced there without a restart. True when a value changed.
+ */
+export function refreshVault(state, vault) {
+  const fresh = readVault(state);
+  let changed = false;
+  for (const [k, v] of fresh) if (vault.get(k) !== v) { vault.set(k, v); changed = true; }
+  return changed;
+}
+
 /** An orchestration value as the loop's state: the persisted half plus an empty runtime half. */
 export function stateOf(orchestration) {
   return { ...orchestration, runtime: emptyRuntime() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {