@volter/supercode-orchestrator 0.5.195 → 0.5.197

package/bin/orchestrator.mjs

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+// Check before handing off or importing board/runtime dependencies.
+let lockedNative;
+try { ({ lockedNative } = await import('../source-lock.mjs')); }
+catch (error) { process.stderr.write(`${error.message}\n`); process.exit(1); }
 // Any command on a home whose record names another orchestrator is that orchestrator's (hand-off.mjs).
 {
   const { handOff, homeOfArgs } = await import('../hand-off.mjs');
@@ -7,6 +11,11 @@
   catch (error) { process.stderr.write(`supercode ${process.argv[2] ?? ''}: ${error.message}\n`); process.exit(1); }
   if (handed !== null) process.exit(await handed);
 }
+// Hand-off may have selected the home's SUPERCODE_BIN. Verify it too, then use the proved native for every child.
+try {
+  const pinnedNative = lockedNative();
+  if (pinnedNative) process.env.SUPERCODE_BIN = pinnedNative;
+} catch (error) { process.stderr.write(`${error.message}\n`); process.exit(1); }
 // Board commands do not load daemon transports, platform adapters or the MCP server.
 if (process.argv[2] === 'workflow') {
   const [{runWorkflow},{timeCommand}]=await Promise.all([import('../board/client.mjs'),import('@volter/supercode-harness-sdk/slow-log')]);

package/hand-off.mjs

@@ -12,6 +12,7 @@ import { spawn } from 'node:child_process';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { enforceSourceLock } from '@volter/supercode-teams/source-lock';
 
 /** The home a command (the whole of it, after the entry) names: --root, wherever it stands (the gateway's form,
  *  `node bin/orchestrator.mjs --root <home>`, has no verb before it); for `import`, which writes the home it names
@@ -36,6 +37,9 @@ export function handOff(root, argv) {
   try { named = realpathSync(record.entry); } catch { throw new Error(`${root} is served by orchestrator ${record.version ?? 'unknown'} (${record.entry ?? 'its record names none'}), which is not on this machine; this one is ${version}. Nothing was run`); }
   const supercode = record.supercode?.entry;
   if (!supercode || !existsSync(supercode)) throw new Error(`${root} is served by supercode ${record.supercode?.version ?? 'unknown'} (${supercode ?? 'its record names none'}), which is not on this machine. Nothing was run`);
+  // A stale home's record must not hand a locked command to an older npm entry that cannot enforce the lock.
+  enforceSourceLock(named, 'the home record orchestrator');
+  enforceSourceLock(supercode, 'the home record supercode');
   if (named === own) { process.env.SUPERCODE_BIN = supercode; return null; }
   return new Promise((done) => {
     const child = spawn(process.execPath, [named, ...argv], { stdio: 'inherit', env: { ...process.env, SUPERCODE_BIN: supercode } });

package/index.mjs

@@ -1,3 +1,4 @@
+import './source-lock.mjs';
 export {
   LoadError, sessionReset, homeChannel, CHAT_TYPES, END_REASONS, FIRE_STATUSES, OBLIGATION_STATES,
   renderSurfaceKey, parseSurfaceKey, surfaceKeyString, parseTarget, renderTarget, resolveRoute, routeSpecificity,

package/orchestration.mjs

@@ -27,6 +27,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 import { emptyRuntime, persistedView } from './ir.mjs';
+import { lockedNative } from './source-lock.mjs';
 
 const here = dirname(fileURLToPath(import.meta.url));
 
@@ -36,6 +37,8 @@ const here = dirname(fileURLToPath(import.meta.url));
  * checkout's debug build, else `supercode` on PATH.
  */
 export function supercodeCommand() {
+  const pinned = lockedNative();
+  if (pinned) return pinned;
   if (process.env.SUPERCODE_BIN) return process.env.SUPERCODE_BIN;
   const built = resolve(here, '../../target/debug/supercode');
   return existsSync(built) ? built : 'supercode';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.195",
+  "version": "0.5.197",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -28,9 +28,10 @@
     "check-types": "node scripts/generate-types.mjs --check"
   },
   "dependencies": {
+    "@volter/supercode-teams": "^0.3.329",
     "@volter/supercode-terminal": "^0.3.8",
     "@volter/supercode-harness-sdk": "^0.3.101",
-    "@volter/teams": "0.2.90",
+    "@volter/teams": "0.2.91",
     "@volter/ztrack": "^2.4.23",
     "yaml": "^2.9.0"
   },

package/source-lock.mjs

@@ -0,0 +1,34 @@
+// The orchestrator and its native codec share the CLI/Teams source lock; no second declaration.
+import { existsSync, realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { enforceSourceLock, sourceRoot, SourceLockError } from '@volter/supercode-teams/source-lock';
+
+const lock = enforceSourceLock(import.meta.url, 'the orchestrator');
+if (lock) {
+  enforceSourceLock(import.meta.resolve('@volter/supercode-harness-sdk'), 'the orchestrator harness SDK');
+  enforceSourceLock(import.meta.resolve('@volter/supercode-teams/source-lock'), 'the orchestrator Teams package');
+}
+
+/** The locked tree's release native, proved against the same lock before any codec door opens. */
+export function lockedNative() {
+  const lock = enforceSourceLock(import.meta.url, 'the orchestrator');
+  if (!lock) return null;
+  const root = sourceRoot(import.meta.url);
+  const binary = resolve(root, 'target/release', process.platform === 'win32' ? 'supercode.exe' : 'supercode');
+  if (!existsSync(binary)) throw new SourceLockError(`supercode source lock: the orchestrator needs the pinned tree's release native (${binary}); build it there with cargo build --release -p supercode-cli`);
+  if (process.env.SUPERCODE_BIN && (!existsSync(process.env.SUPERCODE_BIN) || realpathSync(process.env.SUPERCODE_BIN) !== realpathSync(binary))) {
+    // A host normally passes its source-linked Node front door as SUPERCODE_BIN.
+    enforceSourceLock(process.env.SUPERCODE_BIN, 'the orchestrator SUPERCODE_BIN');
+    if (realpathSync(process.env.SUPERCODE_BIN) !== realpathSync(resolve(root, 'packaging/npm/bin/supercode.js'))) {
+      throw new SourceLockError(`supercode source lock: SUPERCODE_BIN must name the pinned release native or its front door (${binary})`);
+    }
+  }
+  const result = spawnSync(binary, ['source', 'show', '--json'], { encoding: 'utf8', timeout: 5000 });
+  if (result.error || result.status !== 0) throw new SourceLockError(`supercode source lock: the orchestrator native ${binary} cannot be verified: ${result.error?.message || result.stderr}`);
+  const receipt = JSON.parse(result.stdout);
+  if (receipt.verdict !== 'matches' || receipt.native.version !== lock.supercode || receipt.native.commit !== lock.commit || receipt.native.dirty) {
+    throw new SourceLockError(`supercode source lock: the orchestrator native ${binary} does not match ${lock.path}: ${receipt.verdict}`);
+  }
+  return binary;
+}