@volter/supercode-orchestrator 0.5.215 → 0.5.217

package/source-lock.mjs

@@ -1,8 +1,9 @@
-// The orchestrator and its native codec share the CLI/Teams source lock; no second declaration.
+// @ts-check
+// The orchestrator shares the CLI/Teams source lock; it declares no second binding.
 import { existsSync, realpathSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { enforceSourceLock, sourceRoot, SourceLockError } from '@volter/supercode-teams/source-lock';
+import { supercodeInvocation } from '@volter/supercode-harness-sdk/supercode-program';
 
 const lock = enforceSourceLock(import.meta.url, 'the orchestrator');
 if (lock) {
@@ -10,30 +11,20 @@ if (lock) {
   enforceSourceLock(import.meta.resolve('@volter/supercode-teams/source-lock'), 'the orchestrator Teams package');
 }
 
-let driftSaid = false;
-
-/** The locked tree's release native, proved against the same lock before any codec door opens. */
-export function lockedNative() {
+/** The exact pinned Node front door; no native build receipt is inferred. */
+export function lockedProgram() {
   const lock = enforceSourceLock(import.meta.url, 'the orchestrator');
   if (!lock) return null;
+  if (lock.binding !== 'node') throw new SourceLockError("supercode source lock: this declaration binds a native build; run the intended tree's Node front door with `source pin` to select its Node binding");
   const root = sourceRoot(import.meta.url);
-  const binary = resolve(root, 'target/release', process.platform === 'win32' ? 'supercode.exe' : 'supercode');
-  if (!existsSync(binary)) throw new SourceLockError(`supercode source lock: the orchestrator needs the pinned tree's release native (${binary}); build it there with cargo build --release -p supercode-cli`);
-  if (process.env.SUPERCODE_BIN && (!existsSync(process.env.SUPERCODE_BIN) || realpathSync(process.env.SUPERCODE_BIN) !== realpathSync(binary))) {
-    // A host normally passes its source-linked Node front door as SUPERCODE_BIN.
-    enforceSourceLock(process.env.SUPERCODE_BIN, 'the orchestrator SUPERCODE_BIN');
-    if (realpathSync(process.env.SUPERCODE_BIN) !== realpathSync(resolve(root, 'packaging/npm/bin/supercode.js'))) {
-      throw new SourceLockError(`supercode source lock: SUPERCODE_BIN must name the pinned release native or its front door (${binary})`);
-    }
-  }
-  const result = spawnSync(binary, ['source', 'show', '--json'], { encoding: 'utf8', timeout: 5000 });
-  if (result.error || result.status !== 0) throw new SourceLockError(`supercode source lock: the orchestrator native ${binary} cannot be verified: ${result.error?.message || result.stderr}`);
-  const receipt = JSON.parse(result.stdout);
-  // The native is judged by its binding alone: a retired copy that came back (drift) is said, and never stops the board.
-  const binding = receipt.binding ?? receipt.verdict;
-  if (binding !== 'matches' || receipt.native.version !== lock.supercode || receipt.native.commit !== lock.commit || receipt.native.dirty) {
-    throw new SourceLockError(`supercode source lock: the orchestrator native ${binary} does not match ${lock.path}: ${binding}`);
+  const entry = resolve(root, 'packaging/npm/bin/supercode.js');
+  if (!existsSync(entry)) throw new SourceLockError(`supercode source lock: the orchestrator needs the pinned tree's Node front door (${entry})`);
+  enforceSourceLock(entry, 'the orchestrator supercode front door');
+  if (process.env.SUPERCODE_BIN) {
+    const selected = supercodeInvocation(process.env.SUPERCODE_BIN, [], process.env);
+    if (!selected.node || !existsSync(selected.arguments[0]) || realpathSync(selected.arguments[0]) !== realpathSync(entry))
+      throw new SourceLockError(`supercode source lock: SUPERCODE_BIN must name the pinned Node front door (${entry}) or its known Node shim`);
+    enforceSourceLock(selected.arguments[0], 'the orchestrator SUPERCODE_BIN');
   }
-  if (Array.isArray(receipt.drift) && receipt.drift.length && !driftSaid) { driftSaid = true; process.stderr.write(`supercode source lock: ${receipt.drift.join('; ')}\n`); }
-  return binary;
+  return entry;
 }

package/webhook.mjs

@@ -10,11 +10,14 @@
 // and `node:http` at call time instead.
 
 import { surfaceKeyString, sessionReset } from './ir.mjs';
-import { endBinding, ensureRuntime, expired, leaseId, liveBinding, newObligation, reply } from './reducer.mjs';
+import { endBinding, ensureRuntime, expired, leaseId, liveBinding, newObligation, startWorker } from './reducer.mjs';
 import { budgetRefusal } from './conversations.mjs';
 import { compactStamp, resolveTarget } from './cron.mjs';
 import * as events from './events.mjs';
 
+/** An intentional pre-acknowledgement refusal, not a physical cleanup failure. */
+export class WebhookRefusal extends Error {}
+
 /** The synthetic surface a subscription's turns run on (§4.4). */
 export function webhookKey(name) {
   return { platform: 'webhook', kind: 'dm', chat_id: name };
@@ -114,7 +117,10 @@ export function handleWebhook(state, ev, effects) {
     // a redelivery (GitHub's "Redeliver", a sender's retry) is the same event:
     // it runs once. The memory is runtime state (§2.8), as Hermes's is: a
     // restart forgets it.
-    const seen = ((ensureRuntime(state).webhook_deliveries ??= {})[ev.name] ??= []);
+    const runtime = ensureRuntime(state);
+    runtime.webhook_deliveries ??= {};
+    runtime.webhook_deliveries[ev.name] ??= [];
+    const seen = runtime.webhook_deliveries[ev.name];
     if (seen.includes(ev.delivery_id)) {
       effects.push({ type: 'log', level: 'info', message: `webhook ${ev.name}: delivery ${ev.delivery_id} already handled, dropped` });
       return;
@@ -145,6 +151,7 @@ export function handleWebhook(state, ev, effects) {
 
   const key = webhookKey(ev.name);
   const keyString = surfaceKeyString(key);
+  if (ev.admission_id) effects.push({ type: 'webhook_input', admission_id: ev.admission_id, profile: profile.name, keyString });
   let b = liveBinding(profile, keyString);
   if (b) {
     const reason = expired(b, sessionReset(profile), now);
@@ -153,7 +160,11 @@ export function handleWebhook(state, ev, effects) {
   if (!b) {
     // G3: an agent over its budget starts nothing; the refusal is told, never a pause
     const refused = budgetRefusal(state, profile, profile.name, now);
-    if (refused) { effects.push({ type: 'budget_refused', profile: profile.name, agent: profile.name, reason: refused }); return; }
+    if (refused) {
+      effects.push({ type: 'budget_refused', profile: profile.name, agent: profile.name, reason: refused });
+      if (ev.admission_id) effects.push({ type: 'webhook_input', admission_id: ev.admission_id, profile: profile.name, keyString, refusal: refused });
+      return;
+    }
     b = {
       key, agent: profile.name,
       worker: { harness: profile.worker.harness, session_id: `webhook_${ev.name}_${compactStamp(now)}`, locator: null },
@@ -161,7 +172,6 @@ export function handleWebhook(state, ev, effects) {
       recurrence: null, residue: { webhook: ev.name },
     };
     profile.bindings[keyString] = b;
-    effects.push({ type: 'runtime_start', profile: profile.name, keyString, worker: profile.worker, prompt: null, agent: profile.name });
   }
   b.residue.webhook = ev.name;
   b.last_activity_at = now;
@@ -169,10 +179,14 @@ export function handleWebhook(state, ev, effects) {
   const text = renderTemplate(sub.prompt_template, ev.payload);
   const rt = ensureRuntime(state);
   const lid = leaseId(profile.name, keyString);
-  if (rt.turns[lid] || !rt.leases[lid]) (rt.queues[lid] ??= []).push({ text, at: now });
+  if (!rt.leases[lid] && !rt.starting[lid] && !startWorker(state, profile, keyString, effects, now)) {
+    if (ev.admission_id) effects.push({ type: 'webhook_input', admission_id: ev.admission_id, profile: profile.name, keyString, refusal: 'worker start refused; retry after its budget permits' });
+    return;
+  }
+  if (rt.turns[lid] || !rt.leases[lid]) { rt.queues[lid] ??= []; rt.queues[lid].push({ text, at: now, ...(ev.admission_id ? { webhook_input_id: ev.admission_id } : {}) }); }
   else {
-    rt.turns[lid] = { started_at: now, buffer: '' };
-    effects.push({ type: 'send_input', profile: profile.name, keyString, text });
+    rt.turns[lid] = { started_at: now, buffer: '', ...(ev.admission_id ? { webhook_input_id: ev.admission_id } : {}) };
+    effects.push({ type: 'send_input', profile: profile.name, keyString, text, ...(ev.admission_id ? { webhook_input_id: ev.admission_id } : {}) });
   }
   effects.push({ type: 'save' });
 }
@@ -214,7 +228,10 @@ const MAX_BODY = 1024 * 1024;
  */
 export async function startWebhookListener({ state, vault, port = 0, host = '127.0.0.1', dispatch, clock, log = () => {} }) {
   const { createServer } = await import('node:http');
+  const sockets = new Set(), admitted = new Map(), tasks = new Set(), failures = [];
+  let closing = false, closePromise;
   const server = createServer((req, res) => {
+    if (closing) { req.destroy(); return; }
     const match = /^\/webhooks\/([^/?#]+)/.exec(req.url ?? '');
     if (req.method !== 'POST' || !match) { res.writeHead(404, { 'content-type': 'application/json' }); res.end('{"error":"not found"}'); return; }
     let name;
@@ -229,10 +246,36 @@ export async function startWebhookListener({ state, vault, port = 0, host = '127
       chunks.push(c);
     });
     req.on('end', () => {
+      if (closing) return;
       const body = Buffer.concat(chunks).toString('utf8');
-      void handleRequest({ state, vault, name, body, headers: req.headers, dispatch, clock, log, res });
+      const socket = req.socket;
+      admitted.set(socket, (admitted.get(socket) ?? 0) + 1);
+      const task = handleRequest({ state, vault, name, body, headers: req.headers, dispatch, clock, log, res });
+      tasks.add(task);
+      const finished = () => {
+        tasks.delete(task);
+        const count = admitted.get(socket) - 1;
+        if (count) admitted.set(socket, count); else admitted.delete(socket);
+        if (closing) socket.destroy();
+      };
+      void task.then(finished, (error) => {
+        if (!(error instanceof WebhookRefusal)) failures.push(error);
+        // No positive acknowledgement may precede failed verification or loop
+        // processing. Retain the failure for close as well as telling the sender.
+        if (!res.headersSent && !res.destroyed) {
+          res.writeHead(503, { 'content-type': 'application/json', 'retry-after': '1' });
+          res.end('{"ok":false,"error":"webhook processing failed; retry"}');
+        }
+        finished();
+        log('warn', `webhook ${name}: ${String(error?.message ?? error)}`);
+      });
     });
-    req.on('error', (error) => log('warn', `webhook ${name}: ${error.message}`));
+    req.on('error', (error) => { if (!closing) log('warn', `webhook ${name}: ${error.message}`); });
+  });
+  server.on('connection', (socket) => {
+    sockets.add(socket);
+    socket.once('close', () => sockets.delete(socket));
+    if (closing) socket.destroy();
   });
   await new Promise((resolve, reject) => {
     server.once('error', reject);
@@ -242,7 +285,17 @@ export async function startWebhookListener({ state, vault, port = 0, host = '127
   return {
     server,
     port: server.address().port,
-    close: () => new Promise((resolve) => server.close(() => resolve())),
+    close: () => closePromise ??= (async () => {
+      closing = true;
+      const closed = new Promise(resolve => server.close(error => { if (error) failures.push(error); resolve(); }));
+      // A partial body is passive ingress, not admitted loop work. It cannot
+      // hold later runtime/adapter cleanup behind HTTP's request timeout.
+      for (const socket of sockets) if (!admitted.has(socket)) socket.destroy();
+      await Promise.allSettled([...tasks]);
+      for (const socket of sockets) socket.destroy();
+      await closed;
+      if (failures.length) throw new AggregateError(failures, failures.map(error => String(error?.message ?? error)).join('; '));
+    })(),
   };
 }
 
@@ -259,9 +312,9 @@ async function handleRequest({ state, vault, name, body, headers, dispatch, cloc
   let payload;
   try { payload = JSON.parse(body); } catch { payload = { body }; }
   const at = clock();
-  res.writeHead(verified ? 202 : 401, { 'content-type': 'application/json' });
-  res.end(JSON.stringify({ ok: verified, name }));
   const event = firstHeader(headers, EVENT_HEADERS) ?? eventType(payload);
   const delivery_id = firstHeader(headers, DELIVERY_HEADERS);
   await dispatch(events.webhook({ name, payload, verified, at, event, delivery_id }));
+  res.writeHead(verified ? 202 : 401, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ ok: verified, name }));
 }