@volter/supercode-orchestrator 0.5.42 → 0.5.43

package/activation.mjs

@@ -7,6 +7,7 @@ import { homedir } from 'node:os';
 import { mkdirSync, readFileSync, readdirSync, lstatSync, rmSync, writeFileSync, existsSync } from 'node:fs';
 import { CLAUDE_BRIDGE, linkTo, skillSources } from './hermes-home.mjs';
 import { ownLogin } from './worker-route.mjs';
+import { execFile } from 'node:child_process';
 
 /** Which env var each harness reads its config home from (supercode registry evidence). */
 export const HOME_ENV = Object.freeze({
@@ -54,6 +55,24 @@ export function activationEnv({ root, profile, surfaceKey, vault }) {
   return env;
 }
 
+const declaredHomes = new Set();
+/**
+ * A worker that keeps its sessions in a config home of its own (its profile's CODEX_HOME or CLAUDE_CONFIG_DIR) is
+ * declared to this machine's connector through its own door (`supercode teams roots home add`), on each root covering
+ * the folder it runs in, so its sessions are found and published (D138 step 5). Once per home and folder per process,
+ * off the launch's path: the door is local, and a refusal (no connected root covers the folder) is only said.
+ */
+export function declareWorkerHome({ harness, env, cwd, log = () => {} }) {
+  const home = ['codex', 'claude-code'].includes(harness) ? env?.[HOME_ENV[harness]] : null;
+  if (!home || declaredHomes.has(`${harness}\0${home}\0${cwd}`)) return;
+  declaredHomes.add(`${harness}\0${home}\0${cwd}`);
+  execFile(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'roots', 'home', 'add', home, '--harness', harness, '--cwd', cwd, '--json'], { timeout: 30_000 }, (error, _stdout, stderr) => {
+    if (!error) return;
+    declaredHomes.delete(`${harness}\0${home}\0${cwd}`);
+    log('warn', `worker home ${home} not declared to this machine's connector: ${String(stderr || error.message).trim().split('\n').at(-1)}`);
+  });
+}
+
 export function activationCwd(profile, workdir) {
   return resolve(profile.dir, workdir ?? profile.worker?.cwd ?? '.');
 }

package/agents.mjs

@@ -15,7 +15,8 @@ const entry=fileURLToPath(new URL('./bin/agent-door.mjs',import.meta.url));
 const HOST_CALLER=(process.env.SUPERCODE_CALLER_NAME??`orchestrator ${process.argv.slice(2).filter(arg=>!arg.startsWith('-')).slice(0,2).filter(arg=>/^[a-z][a-z0-9-]{0,30}$/.test(arg)).join(' ')}`).slice(0,80);
 export function agentDoor(op,args=[],{context,timeout=25000}={}){
   const reply=spawnSync(process.execPath,[entry],{input:JSON.stringify({op,args,context}),encoding:'utf8',timeout,maxBuffer:4*1024*1024,env:{...process.env,SUPERCODE_CALLER_NAME:`${HOST_CALLER} agent-door ${op}`}});
-  if(reply.status!==0){let detail;try{detail=JSON.parse(reply.stderr);}catch{detail={message:reply.error?.message??String(reply.stderr).slice(-1000)};}throw Object.assign(new Error(detail.message??'Teams agent door unavailable'),detail);}
+  // The door's answer to a failure is its last stderr line; a runtime's own lines may come before it (a preload's notice).
+  if(reply.status!==0){let detail;try{detail=JSON.parse(String(reply.stderr).trim().split('\n').at(-1));}catch{detail={message:reply.error?.message??String(reply.stderr).slice(-1000)};}throw Object.assign(new Error(detail.message??'Teams agent door unavailable'),detail);}
   return JSON.parse(reply.stdout);
 }
 /** Teams is not configured, not reachable, or no longer accepts this login: identity stays local until it syncs.
@@ -31,13 +32,12 @@ function store(root){
   mkdirSync(root,{recursive:true,mode:0o700});const db=new DatabaseSync(join(root,'agent-state.sqlite'));
   db.exec(`PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL;
   CREATE TABLE IF NOT EXISTS agent_intents(org TEXT NOT NULL,id TEXT NOT NULL,key TEXT NOT NULL,profile_ref TEXT NOT NULL,profile_json TEXT NOT NULL,declared INTEGER NOT NULL DEFAULT 0,declaration_json TEXT,created_at INTEGER NOT NULL,PRIMARY KEY(org,id),UNIQUE(org,key));
-  CREATE TABLE IF NOT EXISTS agent_run_retries(org TEXT NOT NULL,agent_id TEXT NOT NULL,session_ref TEXT NOT NULL,next_at INTEGER NOT NULL,wait_ms INTEGER NOT NULL,PRIMARY KEY(org,agent_id,session_ref));
   CREATE TABLE IF NOT EXISTS agent_declaration_heads(org TEXT NOT NULL,key TEXT NOT NULL,agent_id TEXT NOT NULL,generation INTEGER NOT NULL DEFAULT 0,PRIMARY KEY(org,key));
   CREATE TABLE IF NOT EXISTS agent_assignments(org TEXT NOT NULL,id TEXT NOT NULL,agent_id TEXT NOT NULL,kind TEXT NOT NULL,target TEXT NOT NULL,role TEXT NOT NULL,state TEXT NOT NULL,started_at INTEGER NOT NULL,ended_at INTEGER,PRIMARY KEY(org,id));
   CREATE INDEX IF NOT EXISTS agent_active_assignments ON agent_assignments(org,agent_id,state);
   CREATE TABLE IF NOT EXISTS agent_end_outbox(org TEXT NOT NULL,agent_id TEXT NOT NULL,reason TEXT NOT NULL,created_at INTEGER NOT NULL,PRIMARY KEY(org,agent_id));
   CREATE TABLE IF NOT EXISTS agent_runtime_sessions(org TEXT NOT NULL,runtime_ref TEXT NOT NULL,session_ref TEXT NOT NULL,PRIMARY KEY(org,runtime_ref));
-  CREATE TABLE IF NOT EXISTS agent_runs(org TEXT NOT NULL,agent_id TEXT NOT NULL,session_ref TEXT NOT NULL,machine TEXT,run_id TEXT,profile_json TEXT,published INTEGER NOT NULL DEFAULT 0,ended_at INTEGER,end_reason TEXT,main INTEGER NOT NULL DEFAULT 1,starter_session TEXT,usage_json TEXT,PRIMARY KEY(org,session_ref));`);
+  CREATE TABLE IF NOT EXISTS agent_runs(org TEXT NOT NULL,agent_id TEXT NOT NULL,session_ref TEXT NOT NULL,machine TEXT,run_id TEXT,profile_json TEXT,ended_at INTEGER,end_reason TEXT,main INTEGER NOT NULL DEFAULT 1,starter_session TEXT,usage_json TEXT,PRIMARY KEY(org,session_ref));`);
   // A declaration Teams refused is asked again a bounded number of times (synchronizeLocalAgents), then left failed.
   const columns=new Set(db.prepare('PRAGMA table_info(agent_intents)').all().map(c=>c.name));
   for(const [column,type] of Object.entries({declare_attempts:'INTEGER NOT NULL DEFAULT 0',declare_next_at:'INTEGER NOT NULL DEFAULT 0',declare_failed_at:'INTEGER',declare_error:'TEXT'}))if(!columns.has(column))db.exec(`ALTER TABLE agent_intents ADD COLUMN ${column} ${type}`);
@@ -91,7 +91,6 @@ export function synchronizeAgentEnds(root,org,{context}={}){
   try{
     for(const row of db.prepare('SELECT * FROM agent_end_outbox WHERE org=? ORDER BY created_at LIMIT 100').all(org)){
       if(db.prepare("SELECT 1 FROM agent_assignments WHERE org=? AND agent_id=? AND state='active'").get(org,row.agent_id)){db.prepare('DELETE FROM agent_end_outbox WHERE org=? AND agent_id=?').run(org,row.agent_id);continue;}
-      if(db.prepare('SELECT 1 FROM agent_runs WHERE org=? AND agent_id=? AND published<=0').get(org,row.agent_id)){pending.push({agent:row.agent_id,error:'session ownership publication remains pending'});continue;}
       // claimed by compare-and-set on its claimed_at (free, or a claim older than SYNC_CLAIM_MS from a pass that died);
       // deleted only after Teams ended the agent (the end is idempotent by its digest), handed back when it failed
       if(db.prepare('UPDATE agent_end_outbox SET claimed_at=? WHERE org=? AND agent_id=? AND (claimed_at IS NULL OR claimed_at<?)').run(Date.now(),org,row.agent_id,Date.now()-SYNC_CLAIM_MS).changes!==1)continue;
@@ -399,42 +398,12 @@ export function recordNativeAgentSession(root,runtimeRef,session) {
   const db=store(root);try{
     db.exec('BEGIN IMMEDIATE');
     db.prepare('INSERT INTO agent_runtime_sessions(org,runtime_ref,session_ref) VALUES (?,?,?) ON CONFLICT(org,runtime_ref) DO UPDATE SET session_ref=excluded.session_ref').run(owner.org,runtimeRef,session);
-    // A published native session remains history; an unpublished lease-only row is not a session.
-    db.prepare('DELETE FROM agent_runs WHERE org=? AND session_ref=? AND published<=0').run(owner.org,runtimeRef);
+    // The lease-only row is not a session: its native session is the run now.
+    db.prepare('DELETE FROM agent_runs WHERE org=? AND session_ref=?').run(owner.org,runtimeRef);
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
   return agentRunForSession(root,[runtimeRef]);
 }
-/** Join an observed native session through the public catalogue; unknown catalogue state remains pending. */
-// A run whose session ownership Teams refused (a 4xx answer to the claim: not found, forbidden, conflict, signed out)
-// is asked again after a growing wait (two minutes, doubling to an hour), not every round: each ask spends the shared
-// credential's allowance. Anything else (the rate limit, a timeout, a 5xx, the local daemon's bind of a session just
-// spawned) is not the run's own and is asked again next round.
-// The wait is kept in this home's agent store, not in the asking process: a one-shot `workflow dispatch` asked again
-// on every run when each process kept its own, and every ask spends the shared credential's allowance.
-const retryOf=(root,org,row)=>{const db=store(root);try{return db.prepare('SELECT next_at,wait_ms FROM agent_run_retries WHERE org=? AND agent_id=? AND session_ref=?').get(org,row.agent_id,row.session_ref)??null;}finally{db.close();}};
-const refused=error=>error?.status>=400&&error.status<500&&error.status!==408&&error.status!==429;
-export function synchronizeAgentRun(root,org,row,{context,intended}={}) {
-  let answer;
-  try{answer=joinAgentRun(root,org,row,{context,intended});}
-  catch(error){
-    if(error?.claimRefused){
-      const wait=Math.min((retryOf(root,org,row)?.wait_ms??60000)*2,3600000),db=store(root);
-      try{db.prepare('INSERT INTO agent_run_retries(org,agent_id,session_ref,next_at,wait_ms) VALUES (?,?,?,?,?) ON CONFLICT(org,agent_id,session_ref) DO UPDATE SET next_at=excluded.next_at,wait_ms=excluded.wait_ms').run(org,row.agent_id,row.session_ref,Date.now()+wait,wait);}finally{db.close();}
-    }
-    throw error;
-  }
-  const db=store(root);try{db.prepare('DELETE FROM agent_run_retries WHERE org=? AND agent_id=? AND session_ref=?').run(org,row.agent_id,row.session_ref);}finally{db.close();}
-  return answer;
-}
-function joinAgentRun(root,org,row,{context,intended}) {
-  const claim=(...args)=>{try{return agentDoor(...args);}catch(error){throw Object.assign(error,{claimRefused:refused(error)});}};
-  const response=claim('ownSession',[row.agent_id,{session:row.session_ref,main:row.main!==0&&row.main!==false,...(row.starter_session?{starter_session:row.starter_session}:{})},digest(`${org}/${row.agent_id}/${row.session_ref}`)],{context});
-  const intent=agentIntent(root,org,row.agent_id);
-  const runtime=agentDoor('bindContext',[row.agent_id,row.session_ref,row.machine,intent?.assignments??[],intended??intent?.profile.resolved],{context});
-  publishAgentRun(root,org,row.session_ref);
-  return {...response.data,runtime};
-}
 export function recordAgentRun(root,org,id,{session,machine=null,run,profile=null,main=true,starterSession=null}){
   const db=store(root);try{
     db.exec('BEGIN IMMEDIATE');
@@ -444,13 +413,6 @@ export function recordAgentRun(root,org,id,{session,machine=null,run,profile=nul
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
-// A run waiting to be joined has published=0; a pass joining it holds published=-(the time it claimed it), by
-// compare-and-set, and a claim older than SYNC_CLAIM_MS (a pass that died) is free again.
-export function pendingAgentRuns(root,org){const db=store(root);try{return db.prepare('SELECT * FROM agent_runs WHERE org=? AND (published=0 OR (published<0 AND -published<?)) ORDER BY rowid LIMIT 100').all(org,Date.now()-SYNC_CLAIM_MS).filter(row=>!(retryOf(root,org,row)?.next_at>Date.now()));}finally{db.close();}}
-/** Claim one waiting run for this pass; false when another pass holds it. */
-export function claimAgentRun(root,org,row){const db=store(root);try{return db.prepare('UPDATE agent_runs SET published=? WHERE org=? AND session_ref=? AND published=?').run(-Date.now(),org,row.session_ref,row.published).changes===1;}finally{db.close();}}
-/** Give a claimed run back, unjoined. */
-export function releaseAgentRun(root,org,row){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=0 WHERE org=? AND session_ref=? AND published<0').run(org,row.session_ref);}finally{db.close();}}
 /** Session references come from the bound runtime, never from a model's requested agent id. */
 export function agentRunForSession(root, references) {
   const db = store(root);
@@ -496,9 +458,6 @@ export function runBudgetRefusal(root,agent,budgets,now){
   }
   return null;
 }
-/** A run whose session Teams never had and that no longer runs here can never be owned there: it leaves the sync. */
-export function abandonAgentRun(root,org,session){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=2 WHERE org=? AND session_ref=? AND published<=0').run(org,session);db.prepare('DELETE FROM agent_run_retries WHERE org=? AND session_ref=?').run(org,session);}finally{db.close();}}
-export function publishAgentRun(root,org,session){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=1 WHERE org=? AND session_ref=?').run(org,session);}finally{db.close();}}
 export function agentPreamble(agent,{main=true,previous=[]}={}){
   const {identity:a,intended,assignments=[]}=agent;
   return `You are agent ${a.path} (${a.id}), ${main?'its main session':'a concurrent session'}.${a.synced===false?' This identity was minted on this machine and is not yet declared on a Teams server; it keeps this id when it is.':''}\nSponsor: ${a.sponsor??'none yet'}; parent: ${a.parent??'none'}; lineage: ${JSON.stringify(a.lineage)}.\nAssignments: ${assignments.map(value=>`${value.kind} ${value.target}, role ${value.role}`).join("; ")}; profile: ${a.profile}; permission layers: ${JSON.stringify(intended.resolved.permissions.layers)}.\nAsk again with supercode agent whoami. List your sessions with supercode agent sessions; read a transcript only when needed.${previous.length?'\nEarlier sessions:\n'+previous.map(s=>`${s.session} · ${s.machine??'unknown machine'} · ended ${s.ended_at??'live'} · ${s.end_reason??''}`).join('\n'):''}`;

package/bin/agent-door.mjs

@@ -32,23 +32,6 @@ try{
     result=agent.state==='ended'?{data:{id:agent.id,state:'ended'}}:await team.agents.end(agent.id,{reason:args[1]},{...options,ifMatch:agent.revision,idempotencyKey:args[2]});
   }
   else if(op==='reader')result=await team.agents.delegateReader(args[0],{},{...options,ifMatch:args[1]});
-  else if(op==='bindContext'){
-    // The binding names the agent's reader context on the session's machine, so it installs that context itself: a
-    // launch installs one before its session starts, but an adopted session never had one, and a context installed a
-    // day before has expired. An ended agent has neither a reader nor a live session: Teams revoked its credentials
-    // and ended its sessions when it ended, so there is nothing to bind.
-    const agent=(await team.agents.get(args[0],options)).data;
-    if(agent.state==='ended')result={bound:false,reason:`agent ${agent.id} ended`};
-    else{
-      const reader=await team.agents.delegateReader(agent.id,{expires_in_ms:86400000},{...options,ifMatch:agent.revision});
-      const channel=await openMachine({machine:reach(args[2]),context:context??process.env.SUPERCODE_CONTEXT});
-      try{
-        const rpc=new StreamRpc(await channel.open('node'));
-        const installed=await rpc.call('harness.v1.agents.context',{origin:scope.origin,team:scope.team_id,agent:agent.id,credential:reader.data});
-        result=await rpc.call('harness.v1.agents.bindSession',{session:args[1],context:installed.context,assignments:args[3]??[],intended:args[4]??null});
-      }finally{channel.close();}
-    }
-  }
   else if(op==='readerContext'){
     const identity=await team.agents.get(args[0],options);
     const reader=await team.agents.delegateReader(args[0],{expires_in_ms:86400000},{...options,ifMatch:identity.data.revision});

package/board/dispatch.mjs

@@ -20,7 +20,7 @@ import { readMachineFleet } from './machine-fleet.mjs';
 let fleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
-import { agentScope, localCardAgent, localReaderContext, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun, claimAgentRun, releaseAgentRun, abandonAgentRun,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
+import { agentScope, localCardAgent, localReaderContext, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
 import { memorySnapshotSync } from '../hermes-cli.mjs';
 import { createRequire } from 'node:module';
@@ -160,11 +160,6 @@ const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ?
 const sessionAt = (address) => { const m = /^sc:([^:]+):([^:]+):(.+)$/.exec(String(address)); return m && HARNESSES[m[2]] ? { address, machine: normalMachine(m[1]), harness: m[2], session_id: m[3] } : null; };
 const subscriberAlive = (fleet, address) => fleet.alive.has(address) || (sessionAt(address) ? sessionAlive(fleet, sessionAt(address)) === true : false);
 const paneLists = new Map();
-// A run the agent sync holds names only its machine and native session (`harness:id`), never a pane or pid.
-function syncRowAlive(fleet, row) {
-  const machine = row.machine || localMachine(), at = row.session_ref.indexOf(':');
-  return sessionAlive(fleet, { machine, harness: row.session_ref.slice(0, at), session_id: row.session_ref.slice(at + 1), address: `sc:${machine}:${row.session_ref}` });
-}
 function unpublishedAlive(session) {
   if (!session) return null;
   if (session.surface === 'headless' && session.pid) return pidAlive(session.pid);
@@ -1307,9 +1302,10 @@ export function reconcileCallerLaunch(board, sid) {
   }
 }
 
-/** The board's agent records joined to Teams: declarations, ends, session ownership and usage. Teams I/O, so it runs in
- * the delivery pass (`deliver`), never in a dispatch round. */
-function synchronizeAgents(board, fleet, report, entry) {
+/** The board's agent records: each run kept in the agent store, identities minted offline declared, ends, and usage.
+ * Teams I/O, so it runs in the delivery pass (`deliver`), never in a dispatch round. A run's session is bound to its
+ * agent by the machine that runs it, from the agent its launch named (the connector's bindAgentSessions), never here. */
+function synchronizeAgents(board, report, entry) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
   const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
@@ -1319,13 +1315,13 @@ function synchronizeAgents(board, fleet, report, entry) {
     const session=json(row.metadata,{})?.supercode;
     if(!session?.session_id||!session.agent_org)continue;
     const ref=`${session.harness}:${session.session_id}`;
-    // An ended run whose session the agent store already holds, published, for another agent lost that claim when it
-    // ran: no round can change an ended run or a published owner, so the disagreement is history. It is said once on
-    // its card (agent_ownership_conflict) and the run is not recorded again. A live run is never history: it is
-    // recorded below every round, and a conflict there is refused and said each round as before.
+    // An ended run whose session the agent store already holds for another agent lost that claim when it ran: no round
+    // can change an ended run, so the disagreement is history. It is said once on its card (agent_ownership_conflict)
+    // and the run is not recorded again. A live run is never history: it is recorded below every round, and a conflict
+    // there is refused and said each round as before.
     if(row.ended_at){
       let owner=null;try{owner=agentRunForSession(board.root,[ref]);}catch{/* conflicting owners: recorded below, refused there */}
-      if(owner?.published===1&&owner.org===session.agent_org&&owner.agent_id!==session.agent_id){
+      if(owner&&owner.org===session.agent_org&&owner.agent_id!==session.agent_id){
         const said=db=>db.prepare("SELECT 1 FROM task_events WHERE task_id=? AND run_id=? AND kind='agent_ownership_conflict' LIMIT 1").get(row.task_id,row.id);
         if(!view(board,said))tx(board,db=>{if(!said(db))event(db,row.task_id,'agent_ownership_conflict',{session:ref,run_agent:session.agent_id,owner:owner.agent_id,owner_run:owner.run_id},row.id);});
         continue;
@@ -1366,13 +1362,6 @@ function synchronizeAgents(board, fleet, report, entry) {
     if(task&&(task.archived||['done','cancelled'].includes(task.status)))finishAgentAssignment(board.root,assignment.org,assignment.id,`card ${assignment.target} ${task.archived?'archived':task.status}`);
   }
   for(const [org,context] of orgs)for(const pending of synchronizeAgentEnds(board.root,org,{context}))report.queued.push([pending.agent,`agent end synchronization pending: ${pending.error}`]);
-  for(const [org,context] of orgs)for(const row of pendingAgentRuns(board.root,org)){
-    const launch=agentRuns.find(run=>String(run.id)===String(row.run_id));
-    // each run is claimed by compare-and-set on its own `published` before it is joined; another pass's claim skips it
-    if(!claimAgentRun(board.root,org,row))continue;
-    try{synchronizeAgentRun(board.root,org,row,{context,intended:json(launch?.metadata,{})?.supercode?.agent_profile_intent});}
-    catch(error){releaseAgentRun(board.root,org,row);if(error.code==='rate_limited'){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);break;}const gone=error.claimRefused&&error.status===404&&fleet.ok&&syncRowAlive(fleet,row)===false;if(gone)abandonAgentRun(board.root,org,row.session_ref);report.failed.push([row.run_id,`agent session sync failed: ${error.message}${gone?`; ${row.session_ref} is stopped and Teams refuses it, so it leaves the sync`:''}`]);}
-  }
 }
 
 function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
@@ -2668,7 +2657,7 @@ export async function deliver({ root, slugs = null }) {
       tx(board, (db) => queueBoardMail(db)); phase('mail');
       report.effects = await runEffects(board, [], { pending: true }); phase('effects');
       await notify(board, fleet, report, entry); phase('notify');
-      synchronizeAgents(board, fleet, report, entry); phase('agents');
+      synchronizeAgents(board, report, entry); phase('agents');
       report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
       report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
     } catch (error) { report.error = error.message; }

package/index.d.ts

@@ -122,9 +122,6 @@ export function activeAgentAssignments(root: Path): Array<Record<string, unknown
 export function finishAgentAssignment(root: Path, org: string, assignment: string, reason: string): void;
 export function synchronizeAgentEnds(root: Path, org: string, options?: {context?: string}): Array<{agent: string; error: string}>;
 export function recordAgentRun(root: Path, org: string, id: string, run: {session: string; machine?: string | null; run: string | number; profile?: unknown; main?: boolean; starterSession?: string | null}): void;
-export function pendingAgentRuns(root: Path, org: string): Array<Record<string, unknown>>;
-export function abandonAgentRun(root: Path, org: string, session: string): void;
-export function synchronizeAgentRun(root: Path, org: string, row: {agent_id: string; session_ref: string; machine?: string | null; main?: boolean | number; starter_session?: string | null}, options?: {context?: string; intended?: unknown}): import('@volter/teams/http-client').SessionIdentity & {runtime: unknown};
 export function agentRunForSession(root: Path, references: Array<string | null | undefined>): Record<string, unknown> | null;
 export function agentPreamble(agent: ReturnType<typeof ensureCardAgent>, options?: {main?: boolean; previous?: Array<{session: string; machine?: string | null; ended_at?: number | null; end_reason?: string | null}>}): string;
 export function agentEnvironment(agent: ReturnType<typeof ensureCardAgent>, options: {root: Path; context?: string; session?: string | null; main?: boolean}): Record<string, string>;

package/index.mjs

@@ -39,5 +39,5 @@ export { hermesAccess, recordIncident, hermesToolEnv, hermesInstall } from './he
 export { holdGatewayLock, gatewayLockHeld, acquireTokenLock, releaseTokenLock, looksLikeGateway, TOKEN_SCOPES } from './hermes-locks.mjs';
 
 export { resolveAgentProfile, profileDifferences, sessionAgent } from "./agent-profiles.mjs";
-export { agentScope, teamsUnavailable, localCardAgent, localProfileAgent, localAgentRecord, localAgentSessions, synchronizeLocalAgents, declareAgentIntent, ensureRootAgent, ensureCardAgent,ensureProfileAgent,ensureForkAgent,agentRunForKey, agentIntent, assignAgent, reassignAgent,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds,recordAgentRun, recordNativeAgentSession,pendingAgentRuns, synchronizeAgentRun, agentRunForSession,agentPreamble, agentEnvironment, agentProfileMismatch } from "./agents.mjs";
+export { agentScope, teamsUnavailable, localCardAgent, localProfileAgent, localAgentRecord, localAgentSessions, synchronizeLocalAgents, declareAgentIntent, ensureRootAgent, ensureCardAgent,ensureProfileAgent,ensureForkAgent,agentRunForKey, agentIntent, assignAgent, reassignAgent,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds,recordAgentRun, recordNativeAgentSession, agentRunForSession,agentPreamble, agentEnvironment, agentProfileMismatch } from "./agents.mjs";
 export { agentStateHome,materializeAgentHome } from './agent-home.mjs';

package/kanban-worker.mjs

@@ -12,7 +12,7 @@ import { existsSync, statSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 import { load } from './orchestration.mjs';
-import { INSTRUCTION_ARGUMENTS, activationCwd, activationEnv, sandboxArguments, approvalPolicy, limitArguments, materializePersona, materializeSkills, modelArguments, turnCounter, userHomeArguments, userHomePersona } from './activation.mjs';
+import { INSTRUCTION_ARGUMENTS, activationCwd, activationEnv, declareWorkerHome, sandboxArguments, approvalPolicy, limitArguments, materializePersona, materializeSkills, modelArguments, turnCounter, userHomeArguments, userHomePersona } from './activation.mjs';
 import { workerRoute } from './worker-route.mjs';
 import { KANBAN_ENV, untrustedServerVerdict, hermesApproval, hermesInstall, memorySnapshot } from './hermes-cli.mjs';
 import { pinnedSkills, taskProtocol } from './board/worker-prompt.mjs';
@@ -94,6 +94,7 @@ async function runTurn({ client, profile, harness, worker, route, root, vault, s
     arguments: boardGuardArguments(harness, [...(base.arguments ?? []), ...modelArguments(worker), ...route.args, ...(instructions && INSTRUCTION_ARGUMENTS[harness] ? INSTRUCTION_ARGUMENTS[harness](instructions) : []), ...userHomeArguments(profile), ...reasoning, ...sandboxArguments(profile, harness), ...limitArguments(profile, worker, (level, line) => say(line))], { enabled: ['claude-code','codex'].includes(harness), cwd }),
     env: { ...(base.env ?? {}), ...runEnv },
   };
+  declareWorkerHome({ harness, env: launch.env, cwd, log: (_level, line) => say(`hermes-worker: ${line}`) });
   const mount = mountOrchestratorMcp({ root, profile, harness, surfaceKey, launch, vault, task });
   const policy = approvalPolicy(profile, harness);
   const runtime = await client.startManagedRuntime({ harness, cwd, launch: mount.launch, ...(mount.mcp_servers ? { mcp_servers: mount.mcp_servers } : {}), ...(policy ? { approval_policy: policy } : {}) });

package/loop.mjs

@@ -9,7 +9,7 @@ import { basename, join, dirname } from 'node:path';
 import { step, leaseId } from './reducer.mjs';
 import * as events from './events.mjs';
 import { read, save, retainWorld, releaseWorld } from './orchestration.mjs';
-import { INSTRUCTION_ARGUMENTS, NAME_ARGUMENTS, activationEnv, activationCwd, approvalPolicy, sandboxArguments, limitArguments, materializePersona, materializeSkills, modelArguments, turnCounter, userHomeArguments, userHomePersona } from './activation.mjs';
+import { INSTRUCTION_ARGUMENTS, NAME_ARGUMENTS, activationEnv, activationCwd, declareWorkerHome, approvalPolicy, sandboxArguments, limitArguments, materializePersona, materializeSkills, modelArguments, turnCounter, userHomeArguments, userHomePersona } from './activation.mjs';
 import { workerRoute } from './worker-route.mjs';
 import { hermesAccess, hermesApproval, untrustedServerVerdict, hermesToolEnv, memorySnapshot, mirrorSession, mirrorState, recordIncident, sealMirror } from './hermes-cli.mjs';
 import { hermesSessionKey, homeChannel } from './ir.mjs';
@@ -24,7 +24,7 @@ import { harnessHomes } from './mcp/verbs.mjs';
 import { checkMonitor, runJobScript } from './gates.mjs';
 import { startBoard } from './board.mjs';
 import { SenderIdentityRecord } from '@volter/teams/sender-identity';
-import { agentDoor,agentScope,teamsUnavailable,ensureProfileAgent,localProfileAgent,localAgentRecord,localAgentSessions,synchronizeLocalAgents,ensureForkAgent,agentRunForKey,agentIntent,agentPreamble,agentEnvironment,recordAgentRun,recordNativeAgentSession,pendingAgentRuns,claimAgentRun,releaseAgentRun,synchronizeAgentRun,agentRunForSession } from './agents.mjs';
+import { agentDoor,agentScope,teamsUnavailable,ensureProfileAgent,localProfileAgent,localAgentRecord,localAgentSessions,synchronizeLocalAgents,ensureForkAgent,agentRunForKey,agentIntent,agentPreamble,agentEnvironment,recordAgentRun,recordNativeAgentSession,agentRunForSession } from './agents.mjs';
 import { materializeAgentHome } from './agent-home.mjs';
 import { localMachine } from './board/dispatch.mjs';
 import { execFile } from 'node:child_process';
@@ -189,23 +189,19 @@ export class Orchestrator {
   tick(at = this.clock()) {
     this.queue = this.queue.then(() => this.adoptOutsideJobs()).catch((error) => this.log('warn', `cron/jobs.json not read back: ${error.message}`));
     return this.dispatch(events.tick(at, cronInactivitySeconds(), cronMaxParallel())).then(
-      (result) => { this.tickerHeartbeat(true); this.synchronizeProfileSessions();return result; },
+      (result) => { this.tickerHeartbeat(true); this.declareLocalAgents();return result; },
       (error) => { this.tickerHeartbeat(false); throw error; },
     );
   }
 
-  synchronizeProfileSessions(){
+  /** Identities minted while Teams was absent are declared under their ids. Their sessions are bound to them by the
+   * machine that runs them, from the agent each launch named (the connector's bindAgentSessions), never here. */
+  declareLocalAgents(){
     if(!existsSync(join(this.state.root,'agent-state.sqlite')))return;
     try{
-      const context=process.env.SUPERCODE_CONTEXT,scope=agentScope(context);
-      if(scope.offline)return;
+      const context=process.env.SUPERCODE_CONTEXT;
       for(const pending of synchronizeLocalAgents({root:this.state.root,profiles:this.state.profiles,context,declarations:this.state.agents??{}}))this.log('warn',`agent ${pending.agent} declaration pending: ${pending.error}`);
-      for(const row of pendingAgentRuns(this.state.root,scope.org)){
-        if(!claimAgentRun(this.state.root,scope.org,row))continue;
-        try{synchronizeAgentRun(this.state.root,scope.org,row,{context,intended:row.profile_json?JSON.parse(row.profile_json):undefined});}
-        catch(error){releaseAgentRun(this.state.root,scope.org,row);this.log('warn',`agent session ${row.session_ref}: ${error.message}`);if(error.code==='rate_limited')break;}
-      }
-    }catch(error){this.log('warn',`agent session synchronization: ${error.message}`);}
+    }catch(error){this.log('warn',`agent declaration: ${error.message}`);}
   }
 
   /**
@@ -474,6 +470,7 @@ export class Orchestrator {
       const tools = worker.harness === 'hermes' ? {} : hermesToolEnv(agentHome);
       const env = { ...tools, ...activationEnv({ root: this.state.root, profile, surfaceKey: keyString, vault: this.vault }), ...route.env,...agentEnvironment(agent,{root:this.state.root,context:reader?.context,main}) };
       env.HERMES_HOME=agentHome;
+      declareWorkerHome({ harness: worker.harness, env, cwd, log: (level, message) => this.log(level, message) });
       // All sessions of this agent carry its state; a shared profile contributes configuration only.
       const memory = INSTRUCTION_ARGUMENTS[worker.harness] ? await memorySnapshot(agentHome).catch((error) => { this.log('warn', `memory ${keyString}: ${error.message}`); return ''; }) : '';
       // a worker in the user's own home carries its persona there too (its config home's CLAUDE.md is the user's)
@@ -522,8 +519,6 @@ export class Orchestrator {
     if(!INSTRUCTION_ARGUMENTS[worker.harness])(this.runtimeAgentPreambles??=new Map()).set(lid,agentPrompt);
     const session=`${worker.harness}:${runtime.handle.runtime_id}`;
     recordAgentRun(this.state.root,scope.org,agent.identity.id,{session,machine:null,run:run_key??lid,profile:agent.intended.resolved,main,starterSession:starter_session});
-    if(agent.synced!==false&&claimAgentRun(this.state.root,scope.org,{session_ref:session,published:0}))try{synchronizeAgentRun(this.state.root,scope.org,{agent_id:agent.identity.id,session_ref:session,machine:null,main},{context,intended:agent.intended.resolved});}
-    catch(error){releaseAgentRun(this.state.root,scope.org,{session_ref:session});this.log('warn',`agent session ${session} retained for synchronization: ${error.message}`);}
     this.enqueue(events.worker({
       profile: profileName, keyString, runtime_id: runtime.handle.runtime_id,
       ev: { kind: 'started', runtime_id: runtime.handle.runtime_id, session_id: runtime.handle.runtime_id, connection: runtime.connection, harness: worker.harness, steer },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.42",
+  "version": "0.5.43",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@volter/supercode-harness-sdk": "^0.3.60",
-    "@volter/teams": "0.2.14",
+    "@volter/teams": "0.2.15",
     "@volter/ztrack": "^2.4.23",
     "yaml": "^2.9.0"
   },