@volter/supercode-orchestrator 0.5.50 → 0.5.52

package/bin/runtime.mjs

@@ -70,7 +70,7 @@ import {
   TICK_MS, accessPolicy, applyOperator, performRemoveProfileDir, OPERATOR_OPS,
 } from '../index.mjs';
 import * as events from '../events.mjs';
-import { appView, installAgent, installApp, installedApps, removeApp } from '../installed-apps.mjs';
+import { appView, installAgent, installApp, installedAgentRecord, installedApps, removeApp, rh2AgentEnv } from '../installed-apps.mjs';
 import { httpJobExecutor } from '../hosted.mjs';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 
@@ -460,6 +460,31 @@ const ACCESS_OPS = {
  * `apps remove NAME`. */
 async function appsMain(argv) {
   const [verb, ...rest] = argv;
+  // `apps exec rh2-agent --profile <agent> [--root R] -- <command…>`: the command run as the installed agent, its
+  // credential in the command's environment (rh2AgentEnv) and nowhere else: no config file carries the token. It is
+  // how an agent's session mounts `rh2 mcp` (mcp/mount.mjs).
+  if (verb === 'exec') {
+    const cut = rest.indexOf('--');
+    const own = cut < 0 ? rest : rest.slice(0, cut);
+    const command = cut < 0 ? [] : rest.slice(cut + 1);
+    const opts = {};
+    for (let i = 0; i < own.length; i += 1) if (own[i].startsWith('--')) { opts[own[i].slice(2)] = own[i + 1]; i += 1; }
+    const app = own.find((word, i) => !word.startsWith('--') && !own[i - 1]?.startsWith('--'));
+    if (app !== 'rh2-agent' || !opts.profile || !command.length) {
+      process.stderr.write('apps exec rh2-agent --profile <agent> [--root R] -- <command…>\n');
+      process.exit(2);
+    }
+    const record = installedAgentRecord(resolve(opts.root ?? defaultRoot()), opts.profile);
+    if (!record) {
+      process.stderr.write(`no rh2-agent is installed for ${opts.profile}: install it with apps install rh2-agent --profile ${opts.profile}\n`);
+      process.exit(1);
+    }
+    const child = spawn(command[0], command.slice(1), { stdio: 'inherit', env: { ...process.env, ...rh2AgentEnv(record) } });
+    for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, () => child.kill(signal));
+    child.on('error', (error) => { process.stderr.write(`apps exec: ${error.message}\n`); process.exit(127); });
+    child.on('exit', (code, signal) => process.exit(code ?? (signal ? 1 : 0)));
+    return;
+  }
   const flags = {}, positional = [];
   for (let i = 0; i < rest.length; i += 1) {
     if (rest[i].startsWith('--')) { flags[rest[i].slice(2)] = rest[i + 1]; i += 1; } else positional.push(rest[i]);

package/gates.mjs

@@ -81,7 +81,7 @@ function scriptEnv() {
  * else with python3; the cwd is the job's workdir, else the scripts folder.
  * Returns `{ok, output}`; a failure's output is the reason, in Hermes's words.
  */
-export async function runJobScript(profile, scriptPath, workdir = null, { env = process.env, signal = null, secrets = [], automation = null } = {}) {
+export async function runJobScript(profile, scriptPath, workdir = null, { env = process.env, signal = null, secrets = [], automation = null, fire = null } = {}) {
   const raw = String(scriptPath ?? '');
   if (raw.includes('\0')) return { ok: false, output: `Blocked: script path contains a NUL byte: ${JSON.stringify(raw)}` };
   const scriptsDir = join(profile.dir, 'scripts');
@@ -103,8 +103,10 @@ export async function runJobScript(profile, scriptPath, workdir = null, { env =
     const out = { stdout: [], stderr: [] };
     const size = { stdout: 0, stderr: 0 };
     let finished = false;
-    // A scheduled script is an automation: what it files names the automation, never an agent or the OS user (C4)
-    const child = spawn(argv[0], argv[1], { cwd, env: { ...scriptEnv(), HERMES_HOME: profile.dir, ...(automation ? { SUPERCODE_AUTOMATION: automation } : {}) }, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    // A scheduled script is an automation: what it files names the automation, never an agent or the OS user (C4).
+    // SUPERCODE_FIRE_ID names the fire it runs for, so what it files can be keyed to that fire (a retried run of the
+    // same fire files nothing new), not to the wall clock an interval schedule drifts against.
+    const child = spawn(argv[0], argv[1], { cwd, env: { ...scriptEnv(), HERMES_HOME: profile.dir, ...(automation ? { SUPERCODE_AUTOMATION: automation } : {}), ...(fire ? { SUPERCODE_FIRE_ID: String(fire) } : {}) }, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
     const kill = () => { try { process.kill(-child.pid, 'SIGKILL'); } catch { /* already gone */ } };
     const end = (result) => {
       if (finished) return;

package/index.d.ts

@@ -433,6 +433,8 @@ export function mountOrchestratorMcp(o: {
   root: Path; profile: Profile; harness: string; surfaceKey?: string | null;
   launch?: { program: string; arguments?: string[]; env?: Record<string, string> };
   socketPath?: Path; serverPath?: Path; program?: string;
+  /** The agent the session is; its installed rh2-agent is mounted beside the orchestrator server as `rh2-agent`. */
+  agent?: string | null;
 }): { door: McpDoor; ran: string; launch: unknown; mcp_servers: McpServerLaunch[] | null; path: Path | null };
 
 export function socketPathFor(root: Path): Path;

package/installed-apps.mjs

@@ -44,6 +44,25 @@ export async function installAgent({ root, origin, organization, principal, toke
   return { ...record, name: `rh2-agent.${profile}`, token: undefined };
 }
 
+/** The rh2-agent record installed for `agent` (an agent name, as `apps install rh2-agent --profile <agent>` names it),
+ * or null. */
+export function installedAgentRecord(root, agent) {
+  if (typeof agent !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(agent)) return null;
+  const path = recordPath(root, 'rh2-agent', agent);
+  if (!existsSync(path)) return null;
+  try {
+    const record = JSON.parse(readFileSync(path, 'utf8'));
+    return record?.app === 'rh2-agent' && record.token ? record : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The environment the `rh2` CLI reads to act as an installed agent: its RH2 origin, its organization and its token. */
+export function rh2AgentEnv(record) {
+  return { RH2_BASE_URL: record.origin, RH2_ORGANIZATION: record.organizationId, RH2_SESSION_TOKEN: record.token };
+}
+
 /** Exchange an RH2 install code for the installation's token and keep the record. */
 export async function installApp({ root, name, origin, clientId, clientSecret, code, profile = 'default', fetchImpl = globalThis.fetch }) {
   const app = INSTALLABLE_APPS[name];

package/loop.mjs

@@ -385,7 +385,7 @@ export class Orchestrator {
       }
       // Hermes runs a no_agent script in the job's workdir, and an agent job's
       // pre-run script from the scripts folder
-      const script = gate.script ? await runJobScript(profile, gate.script, gate.no_agent ? workdir : null, { signal, secrets, automation: `cron:${profile.name}/${job.id}` }) : null;
+      const script = gate.script ? await runJobScript(profile, gate.script, gate.no_agent ? workdir : null, { signal, secrets, automation: `cron:${profile.name}/${job.id}`, fire: fire_id }) : null;
       return { monitor, script };
     })()
       .catch((error) => ({ script: { ok: false, output: `Script execution failed: ${error.message}` } }))
@@ -452,7 +452,7 @@ export class Orchestrator {
     // this conversation, mounted through whatever door this harness publishes.
     const mount = mountOrchestratorMcp({
       root: this.state.root, profile, harness: worker.harness, surfaceKey: keyString, launch,
-      socketPath: this.bridge?.path ?? socketPathFor(this.state.root), vault: this.vault,
+      socketPath: this.bridge?.path ?? socketPathFor(this.state.root), vault: this.vault, agent: agent?.identity?.name ?? null,
     });
     this.log('info', `mcp mount (${worker.harness}, ${mount.door}): ${mount.ran}`);
     if (resume_runtime_id) resume_runtime_id = await this.continueFromHermes(profile, keyString, worker, resume_runtime_id, cwd,agentHome);

package/mcp/mount.mjs

@@ -13,7 +13,8 @@
 // worker's own environment, which `activationEnv` already set per session.
 
 import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { delimiter, dirname, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import {
   acpEntry, doorFor, opencodeEntry, readOpencodeConfig, removeTomlBlock, serverToml, tomlString, upsertTomlBlock, withMcpConfigFlag, writeMcpConfigFile,
@@ -23,11 +24,31 @@ import { SERVER_NAME } from './tools.mjs';
 import { SOCKET_ENV, socketPathFor } from './server.mjs';
 import { mcpServers } from '../hermes-home.mjs';
 import { KANBAN_ENV } from '../hermes-cli.mjs';
+import { installedAgentRecord } from '../installed-apps.mjs';
 
 export { MCP_DOORS, doorFor } from '@volter/supercode-harness-sdk/mcp-doors';
 
 /** The stdio server this module mounts. */
 export const SERVER_PATH = resolve(dirname(fileURLToPath(import.meta.url)), 'server.mjs');
+/** The orchestrator's CLI, whose `apps exec` runs a command as an installed agent. */
+const ORCHESTRATOR_BIN = resolve(dirname(fileURLToPath(import.meta.url)), '../bin/orchestrator.mjs');
+/** The MCP server an agent with an installed rh2-agent gets: `rh2 mcp` as that agent (its own name, so the user's own
+ * `rh2` server, whatever it holds, is neither replaced nor relied on). */
+export const RH2_AGENT_SERVER = 'rh2-agent';
+
+/** `rh2 mcp` run as `agent`'s installed RH2 principal: `apps exec` puts the record's origin, organization and token
+ * in its environment, so no config file carries the token. Null when no rh2-agent is installed for it. */
+function rh2AgentServer(root, agent, program) {
+  if (!installedAgentRecord(root, agent)) return null;
+  return { command: program, args: [ORCHESTRATOR_BIN, 'apps', 'exec', 'rh2-agent', '--root', root, '--profile', agent, '--', rh2Program(), 'mcp'] };
+}
+
+/** The `rh2` CLI: on this process's PATH, else where RH2's installer puts it (`~/.local/bin`), else the bare name. A
+ * session's own PATH may lack the folder, so the server names the file. */
+function rh2Program() {
+  const folders = [...String(process.env.PATH ?? '').split(delimiter), join(homedir(), '.local', 'bin')].filter(Boolean);
+  return folders.map((folder) => join(folder, 'rh2')).find((file) => existsSync(file)) ?? 'rh2';
+}
 
 const slug = (surfaceKey) => (surfaceKey ? String(surfaceKey).replace(/[^A-Za-z0-9_-]+/g, '-').replace(/^-+|-+$/g, '') || 'session' : 'session');
 
@@ -43,13 +64,18 @@ const slug = (surfaceKey) => (surfaceKey ? String(surfaceKey).replace(/[^A-Za-z0
  * @param {string} [o.socketPath]   defaults to `<root>/orchestrator.sock`
  * @param {string} [o.serverPath]   defaults to this package's `mcp/server.mjs`
  * @param {string} [o.program]      the interpreter, defaults to this node
+ * @param {string|null} [o.agent]   the agent the session is (its name), whose installed rh2-agent is mounted beside
  * @returns {{door: string, ran: string, launch: object|undefined, mcp_servers: object[]|null, path: string|null}}
  */
-export function mountOrchestratorMcp({ root, profile, harness, surfaceKey = null, launch, socketPath, serverPath = SERVER_PATH, program = process.execPath, vault = new Map(), task = null }) {
+export function mountOrchestratorMcp({ root, profile, harness, surfaceKey = null, launch, socketPath, serverPath = SERVER_PATH, program = process.execPath, vault = new Map(), task = null, agent = null }) {
   const door = doorFor(harness);
   // the profile's own servers (`.mcp.json`, the workers' form; docs/plans/hermes-compat.md row 4), mounted
   // beside this one through the same door, `${VAR}` resolved from the profile's vault
   const own = resolveServers(mcpServers(profile.dir), vault);
+  // an agent the RH2 organization declares acts there as its own principal, through its installed record (ADR 0017),
+  // not through whatever `rh2` the machine's user configured; a profile's own `rh2-agent` entry wins
+  const rh2 = own[RH2_AGENT_SERVER] ? null : rh2AgentServer(root, agent, program);
+  if (rh2) own[RH2_AGENT_SERVER] = rh2;
   const sock = socketPath ?? socketPathFor(root);
   const home = join(profile.dir, harness);
   const env = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.50",
+  "version": "0.5.52",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {