@volter/supercode-orchestrator 0.5.208 → 0.5.210

package/bin/orchestrator.mjs

@@ -34,7 +34,7 @@ if (process.argv[2] === 'workflow') {
   catch(error) {noteCommandError(error);process.stderr.write(`supercode workflow: ${error.message??error}\n${error?.errcode!=null&&error.stack?`${error.stack}\n`:''}`);code=1;}
   // the board documents' git work this command queued (a ztrack board's commit and push) is finished before it exits
   try{const{settleDocuments}=await import('../board/git-document.mjs');await settleDocuments();}catch{/* nothing queued */}
-  await Promise.all([process.stdout,process.stderr].map(stream=>new Promise(done=>stream.write('',done))));
+  await Promise.all([process.stdout,process.stderr].map(stream=>new Promise(done=>stream.destroyed?done():stream.write('',done))));
   process.exit(code);
 } else if (process.argv[2] === 'connect') {
   const {parseArgs}=await import('node:util');

package/board/event-stream.mjs

@@ -3,6 +3,7 @@
 import { watch, existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { dirname, basename, join, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
+import { once } from 'node:events';
 import { listBoards, openBoard, backingPaths } from './store.mjs';
 
 const identity = root => createHash('sha256').update(realpathSync(root)).digest('hex');
@@ -117,14 +118,47 @@ export async function* followBoardPublications({root,after,signal}) {
 
 export async function streamBoardPublications(options) {
   if(options.once&&options.after)throw new Error('--once requires a fresh snapshot; omit --after');
+  const parent=process.ppid, reader=Number(process.env.SUPERCODE_WORKFLOW_READER_PID??parent);
+  if(!Number.isSafeInteger(reader)||reader<1||reader>2147483647)throw new Error('Invalid SUPERCODE_WORKFLOW_READER_PID');
   const abort=new AbortController();const stop=()=>abort.abort();
+  let outputError=null;
+  const failed=error=>{outputError=error;stop();};
   process.once('SIGINT',stop);process.once('SIGTERM',stop);
+  process.stdout.on('error',failed);process.stdout.once('close',stop);
+  // Quiet streams never meet EPIPE. The connector names the real reader across native/npm/home hand-offs; direct
+  // callers use their parent. Unix also detects reparenting (including death before this command finished starting).
+  // On Windows ppid does not change, but probing the named reader still detects its exit.
+  const checkReader=()=>{
+    if(process.platform!=='win32'&&(parent===1||process.ppid!==parent)){stop();return;}
+    try{process.kill(reader,0);}catch(error){if(error.code==='ESRCH')stop();}
+  };
+  const lifetime=setInterval(checkReader,1000);lifetime.unref();checkReader();
+  const write=async frame=>{
+    if(abort.signal.aborted)return;
+    try{
+      if(!process.stdout.write(`${JSON.stringify(frame)}\n`))await once(process.stdout,'drain',{signal:abort.signal});
+    }catch(error){
+      if(error.name==='AbortError'&&abort.signal.aborted)return;
+      if(error.code==='EPIPE'){stop();return;}
+      throw error;
+    }
+  };
+  let code=0;
   try {
     for await(const frame of followBoardPublications({...options,signal:abort.signal})){
-      if(!process.stdout.write(`${JSON.stringify(frame)}\n`))await new Promise(done=>process.stdout.once('drain',done));
+      if(abort.signal.aborted)break;
+      await write(frame);
+      if(abort.signal.aborted)break;
       if(options.once&&frame.type==='snapshot_end')break;
     }
-  }catch(error){if(error.code==='resync_required'){process.stdout.write(`${JSON.stringify({type:'resync_required',reason:error.message})}\n`);return 1;}throw error;}
-  finally{process.removeListener('SIGINT',stop);process.removeListener('SIGTERM',stop);}
-  return 0;
+  }catch(error){if(error.code==='resync_required'){await write({type:'resync_required',reason:error.message});code=1;}else throw error;}
+  finally{
+    clearInterval(lifetime);process.removeListener('SIGINT',stop);process.removeListener('SIGTERM',stop);
+    // No final flush can drain into a dead or stalled reader. Returning the iterator above closes its board and
+    // watchers first; discard pending bytes on cancellation so the public entry can finish too.
+    if(abort.signal.aborted)process.stdout.destroy();
+    process.stdout.removeListener('error',failed);process.stdout.removeListener('close',stop);
+  }
+  if(outputError&&outputError.code!=='EPIPE')throw outputError;
+  return code;
 }

package/board/published.mjs

@@ -125,7 +125,11 @@ function agentFacts(db,taskId){
   const agents=new Map(parse(checkpoint?.facts_json,[]).map(agent=>[JSON.stringify([agent.org,agent.assignment,agent.id]),agent]));
   let scope=db.prepare('SELECT from_org,org,changed_at FROM supercode_card_agent_scopes WHERE task_id=?').get(taskId)??null;
   let receipt=checkpoint?.receipt_sequence??0,declared=checkpoint?.declared_event_id??0;
-  for(const event of db.prepare(`SELECT id,kind,payload FROM task_events WHERE task_id=? AND kind IN ${AGENT_KINDS} ORDER BY id`).all(taskId)){
+  // Match idx_events_task_kind's order. ORDER BY id alone lets SQLite choose idx_events_task_id and fetch every
+  // event's row just to reject its kind (including cards with no agent events). Those synchronous page reads held
+  // the owner's loop inside synchronizeAgents and expired unrelated manager lookups. Sort only the matching events.
+  const events=db.prepare(`SELECT id,kind,payload FROM task_events WHERE task_id=? AND kind IN ${AGENT_KINDS} ORDER BY kind,id`).all(taskId);
+  for(const event of events.sort((a,b)=>a.id-b.id)){
     if(event.kind==='agent_declared')declared=Math.max(declared,event.id);
     const value=parse(event.payload,{});
     if(Number.isSafeInteger(value.receipt))receipt=Math.max(receipt,value.receipt);

package/board/ztrack.mjs

@@ -830,7 +830,6 @@ class ZtrackBoard {
     if (this.get('rebuild_from_documents') || !this.one('SELECT 1 FROM main.tasks LIMIT 1')) return;
     let fields = [];
     try { fields = workflowFor(this.root).params.document_control_fields ?? []; } catch { /* no home policy */ }
-    if (!fields.length) return;
     const value = (task, state, field) => field === 'status' ? state?.stage ?? task?.status ?? 'todo'
       : field === 'blocked_by' ? json(state?.blocked_by, []).map((b) => [b.kind, b.id]).sort()
       : field === 'paused' ? json(state?.paused, null)
@@ -862,15 +861,20 @@ class ZtrackBoard {
     };
     for (const [id, rows] of plan.rows) {
       const task = this.one('SELECT * FROM main.tasks WHERE id = ?', id), state = this.one('SELECT * FROM main.supercode_cards WHERE task_id = ?', id);
+      // Stale status recovery is independent of a home's document-control policy. In particular, render() re-reads a
+      // refused span after a verb completes its card: its unchanged running line must not undo that completion.
+      // Reopening an ended card requires its workflow verb, even in a home that otherwise permits document edits.
+      const controlled = new Set(fields);
+      if (task && ENDED.has(value(task, state, 'status'))) controlled.add('status');
       // A new display author is not an authenticated creator.
-      const differ = fields.filter((field) => (task || field !== 'created_by') && !same(value(rows.task, rows.state, field), value(task, state, field)));
+      const differ = [...new Set(['status', ...controlled])].filter((field) => (task || field !== 'created_by') && !same(value(rows.task, rows.state, field), value(task, state, field)));
       const prior = task && differ.length ? rowsBefore(rows.state.subtask_of ?? id).get(id) : null;
       const stale = prior ? differ.filter((field) => same(value(prior.task, prior.state, field), value(rows.task, rows.state, field))) : [];
       for (const field of stale) adopt(rows, task, state, field);
-      const forbidden = differ.filter((field) => !stale.includes(field));
+      const forbidden = differ.filter((field) => controlled.has(field) && !stale.includes(field));
       if (forbidden.length) plan.errors.set(id, `Document edit cannot change ${forbidden.join(', ')}; use this card's role-checked workflow verbs or request-state.`);
     }
-    for (const id of plan.remove) {
+    for (const id of fields.length ? plan.remove : []) {
       // A task line already absent from the replaced span was not removed by this edit: the store keeps it.
       const parent = this.one('SELECT subtask_of FROM main.supercode_cards WHERE task_id = ?', id)?.subtask_of;
       const prior = parent && !plan.remove.has(parent) ? rowsBefore(parent) : null;

package/connection.mjs

@@ -101,14 +101,22 @@ export async function connectWorkplace(flags) {
   if(Boolean(flags['webhook-url'])!==Boolean(flags['webhook-listen']))throw new Error('--webhook-url and --webhook-listen go together: where the Workplace sends the agents registration\'s events, and the loopback address the service listens on');
   const moduleRoot=flags['modules-root']?resolve(flags['modules-root']):null;
   // An explicit local credential input is useful for an owned stack; a normal connect uses its existing Teams context.
-  let teams,owner;
+  let teams,owner,teamsContext=flags.context??process.env.SUPERCODE_CONTEXT;
   if(flags['teams-token-file']){
     if(!flags['teams-url']||!flags.team)throw new Error('--teams-token-file needs --teams-url and --team');
     teams={server:new URL(flags['teams-url']).origin,team:flags.team};owner=readFileSync(flags['teams-token-file'],'utf8').trim();
   }else{
-    const {context}=fromContext({supercodeHome:supercodeHome(),name:flags.context});
+    // An agent session connects as its agent: its delegated context, never the person's who signed the box in (the
+    // Teams verbs' rule, agentContextName). A person's context named from an agent session is refused, as a grant is.
     const {WorkspaceContexts}=await import('@volter/teams/context');
-    teams={server:context.origin,team:context.team_id};owner=new WorkspaceContexts(supercodeHome()).credential(context.credential_ref).token;
+    const {agentSessionEnvironment,agentSessionHint,agentContextName}=await import('@volter/supercode-teams/agent-session');
+    const contexts=new WorkspaceContexts(supercodeHome());
+    // Asked of the daemon whatever the environment says: a resumed session can lack its launch's SUPERCODE_AGENT_ID,
+    // and the daemon's retained binding is what names its agent (workspace.mjs does the same for every Teams verb).
+    const env=await agentSessionEnvironment(process.env,agentSessionHint(process.env));
+    teamsContext=agentContextName(contexts,env,flags.context??null);
+    const {context}=fromContext({supercodeHome:supercodeHome(),name:teamsContext});
+    teams={server:context.origin,team:context.team_id};owner=contexts.credential(context.credential_ref).token;
   }
   for(const origin of [ticket.origin,ticket.issuer,teams.server]){
     const url=new URL(origin);if(url.origin!==origin||url.username||url.password||(url.protocol!=='https:'&&!(url.protocol==='http:'&&['127.0.0.1','localhost','[::1]'].includes(url.hostname))))throw new Error('connection endpoints must be exact HTTPS origins or loopback HTTP');
@@ -116,7 +124,7 @@ export async function connectWorkplace(flags) {
   const id=createHash('sha256').update(`${ticket.scope}\0${ticket.issuer}\0${ticket.organization}\0${teams.server}\0${teams.team}\0${flags.source}`).digest('hex').slice(0,24);
   const path=connectionPath(root,id),prior=existsSync(path)?JSON.parse(readFileSync(path,'utf8')):null;
   if(!prior&&!(Date.parse(ticket.expiresAt)>Date.now()))throw new Error('connection ticket expired; apply the organization file again');
-  const record=prior??{version:1,id,scope:ticket.scope,teamsContext:flags.context??process.env.SUPERCODE_CONTEXT,origin:ticket.origin,issuer:ticket.issuer,organization:ticket.organization,teams,source:flags.source,
+  const record=prior??{version:1,id,scope:ticket.scope,teamsContext,origin:ticket.origin,issuer:ticket.issuer,organization:ticket.organization,teams,source:flags.source,
     selection:ticket.grants.map(g=>g.name),moduleRoot,...(flags['webhook-url']?{webhook:{url:flags['webhook-url'],listen:flags['webhook-listen']}}:{}),floor:flags.floor??ticket.floor??'Work',alertRole:flags['alert-role']??'admin',grants:[]};
   record.root=root;
   if(prior?.disconnectedAt)throw new Error('this connection was disconnected; apply the organization file again for a new ticket');
@@ -187,7 +195,7 @@ export async function connectWorkplace(flags) {
 }
 
 /** Undo a connection with its own credentials, no admin needed (runhuman-2 ADR 0055 decision 3): its runner stops, every
- * installation it holds leaves both sides by itself (each Workplace installation through its own uninstall door, each
+ * installation it holds leaves both sides by itself (each Workplace installation through its own leave door, each
  * Teams installation and the issuer's by deleting itself), and the home's registry entries go. The registrations stay, as
  * consented apps with no installation; an admin deregisters them. The custody record stays, marked disconnected, for
  * audit; it can never run again. */
@@ -211,10 +219,11 @@ export async function disconnectWorkplace(flags) {
   };
   for(const grant of record.grants){
     if(grant.teams?.installation?.id)await leave(grant.name,'teams','DELETE',`${team}/app-installations/${encodeURIComponent(grant.teams.installation.id)}`,grant.teams.credential.token);
-    if(grant.rh2?.installationId)await leave(grant.name,'rh2','POST',`/api/v3/automation/installations/${encodeURIComponent(grant.rh2.installationId)}/uninstall`,grant.rh2.accessToken);
+    if(grant.rh2?.installationId)await leave(grant.name,'rh2','POST',`/api/v3/automation/installations/${encodeURIComponent(grant.rh2.installationId)}/leave`,grant.rh2.accessToken);
     const entry=join(root,'apps',`${grant.name}.${record.id}.json`);if(existsSync(entry))unlinkSync(entry);
   }
-  if(record.issuerCredential?.installation?.id)await leave('issuer','teams','DELETE',`${team}/app-installations/${encodeURIComponent(record.issuerCredential.installation.id)}`,record.issuerCredential.token);
+  // The token exchange answers {installation, credential: {token, …}} (renewTeams reads the same shape).
+  if(record.issuerCredential?.installation?.id)await leave('issuer','teams','DELETE',`${team}/app-installations/${encodeURIComponent(record.issuerCredential.installation.id)}`,record.issuerCredential.credential?.token);
   record.disconnectedAt=new Date().toISOString();record.left=left;privateJson(path,record);
   return {connection:record.id,root,left,registrations:[...record.grants.map(g=>g.registration?.id).filter(Boolean),record.issuerRegistration?.id].filter(Boolean)};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.208",
+  "version": "0.5.210",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -32,7 +32,7 @@
     "check-types": "node scripts/generate-types.mjs --check"
   },
   "dependencies": {
-    "@volter/supercode-teams": "^0.3.345",
+    "@volter/supercode-teams": "^0.3.346",
     "@volter/supercode-terminal": "^0.3.10",
     "@volter/supercode-harness-sdk": "^0.3.104",
     "@volter/teams": "0.2.98",
@@ -62,5 +62,5 @@
     "apply",
     "README.md"
   ],
-  "gitHead": "db4a88b4d2f670654fa8e57dbc3e93c7daa8d2bb"
+  "gitHead": "b2585dc5c6b40d48be96fd3c4148f2c53d7a7ef2"
 }

package/source-lock.mjs

@@ -10,6 +10,8 @@ if (lock) {
   enforceSourceLock(import.meta.resolve('@volter/supercode-teams/source-lock'), 'the orchestrator Teams package');
 }
 
+let driftSaid = false;
+
 /** The locked tree's release native, proved against the same lock before any codec door opens. */
 export function lockedNative() {
   const lock = enforceSourceLock(import.meta.url, 'the orchestrator');
@@ -27,8 +29,11 @@ export function lockedNative() {
   const result = spawnSync(binary, ['source', 'show', '--json'], { encoding: 'utf8', timeout: 5000 });
   if (result.error || result.status !== 0) throw new SourceLockError(`supercode source lock: the orchestrator native ${binary} cannot be verified: ${result.error?.message || result.stderr}`);
   const receipt = JSON.parse(result.stdout);
-  if (receipt.verdict !== 'matches' || receipt.native.version !== lock.supercode || receipt.native.commit !== lock.commit || receipt.native.dirty) {
-    throw new SourceLockError(`supercode source lock: the orchestrator native ${binary} does not match ${lock.path}: ${receipt.verdict}`);
+  // The native is judged by its binding alone: a retired copy that came back (drift) is said, and never stops the board.
+  const binding = receipt.binding ?? receipt.verdict;
+  if (binding !== 'matches' || receipt.native.version !== lock.supercode || receipt.native.commit !== lock.commit || receipt.native.dirty) {
+    throw new SourceLockError(`supercode source lock: the orchestrator native ${binary} does not match ${lock.path}: ${binding}`);
   }
+  if (Array.isArray(receipt.drift) && receipt.drift.length && !driftSaid) { driftSaid = true; process.stderr.write(`supercode source lock: ${receipt.drift.join('; ')}\n`); }
   return binary;
 }