@volter/supercode-orchestrator 0.5.53 → 0.5.55

package/bin/runtime.mjs

@@ -478,7 +478,12 @@ async function appsMain(argv) {
       process.stderr.write(`no rh2-agent is installed for ${opts.profile}: install it with apps install rh2-agent --profile ${opts.profile}\n`);
       process.exit(1);
     }
-    const child = spawn(rh2Program(), ['mcp'], { stdio: 'inherit', env: { ...process.env, ...rh2AgentEnv(record) } });
+    const program = rh2Program();
+    if (!program) {
+      process.stderr.write('apps mcp: no rh2 CLI in an absolute PATH folder or ~/.local/bin\n');
+      process.exit(127);
+    }
+    const child = spawn(program, ['mcp'], { stdio: 'inherit', env: { ...process.env, ...rh2AgentEnv(record) } });
     for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, () => child.kill(signal));
     child.on('error', (error) => { process.stderr.write(`apps mcp: ${error.message}\n`); process.exit(127); });
     child.on('exit', (code, signal) => process.exit(code ?? (signal ? 1 : 0)));

package/board/cli.mjs

@@ -50,13 +50,16 @@ import { completionOwnerOf, isLatestReviewer, loadWorkflow, requestSessionClose,
 import { evaluate } from './expr.mjs';
 import { agentDoor,agentScope,activeAgentAssignments,reassignAgent,agentUsage,localAgentRecord,agentRunForSession } from '../agents.mjs';
 
+// Text a verb stores, read from --file/--body-file PATH (`-` for stdin) when given: a shell never expands what it
+// never sees, as it does `$(...)` and `$VAR` in an argument.
+const textFrom = (file, inline) => file === undefined ? inline : readFileSync(file === '-' ? 0 : String(file), 'utf8');
 const HELP = `supercode workflow <verb> [--root <home>] [--board <slug>] [--json]
 
 The board's verbs, with their flags:
   init [--backing sqlite|files|ztrack] [--document <arcs.md>]
   migrate --backing ztrack --document <arcs.md> --status-map <json>
   boards list|create|rm|switch|show|rename|set-default-workdir|export|import
-  create <title> [--body] [--assignee] [--parent]... [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch] [--project]
+  create <title> [--body | --body-file PATH|-] [--assignee] [--parent]... [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch] [--project]
          [--tenant] [--priority] [--triage] [--idempotency-key] [--max-runtime 30m] [--created-by] [--skill]... [--max-retries]
          [--model] [--provider] [--goal|--no-goal] [--goal-max-turns] [--initial-status blocked|running]
   swarm <goal> --worker PROFILE:TITLE[:SKILL,SKILL]... --verifier P --synthesizer P
@@ -64,14 +67,14 @@ The board's verbs, with their flags:
   set <id> <assignee|machine|model|every> <value|none> [--provider] [--ids ...]   assign <id> <profile|none>   set-model <id> [model] [--provider]   set-goal <id>... [--goal-max-turns N] [--off]
   reassign <id> --agent AGENT [--role implementer]   (moves a card role's assignment to another agent; sessions keep their identity)
   claim <id> [--ttl]   reclaim <id> [--reason]   heartbeat <id> [--note] [--until <time|30m>]   link|unlink <parent> <child>
-  comment <id> <text> [--author] [--max-len]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
+  comment <id> (<text> | --file PATH|-) [--author] [--max-len]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
   complete <id>... [--result] [--summary] [--metadata JSON]   edit <id> --result [--summary] [--metadata]
   block <id> [reason] (--on <card> | --waiting-on <message id>) [--ids ...]   schedule <id> [reason] [--ids ...]
   pause <id> --reason <why>   resume <id>   cancel <id> --reason <why>
   request-state <id> --state block|pause|done|cancelled --reason <why> [--on <card>|--waiting-on <message>] [--evidence <pointers>]
   unblock <id>... --on <blocker> --reason <what arrived>   request-review <id> (--pr URL --pr-head SHA)... [--summary] [--reviewer] [--force]   request-changes <id> <reason> [--finding <finding>]...   reopen-review <id>...   reopen <id>... [--reason]
   promote <id> [reason] [--ids ...] [--force] [--dry-run]   archive <id>... --reason <why> [--rm <id>...]
-  specify <id> [--title --body] [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch NAME] [--machine M|none] [--all]
+  specify <id> [--title --body | --body-file PATH|-] [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch NAME] [--machine M|none] [--all]
   decompose <id> [--child "<title>[@<profile>]"]... [--all]
   diagnostics [--task] [--severity]   stats   assignees   log <id> [--tail N]   tail <id>   watch [--assignee] [--kinds]
   notify-subscribe <id> --platform P --chat-id C [--thread-id]   notify-list [<id>]   notify-unsubscribe <id> --platform P --chat-id C
@@ -437,7 +440,7 @@ export async function runWorkflow(argv) {
       if ((workspace === 'dir' || workspace === 'worktree') && meta.default_workdir) workspace = `${workspace}:${meta.default_workdir}`;
       // --goal / --no-goal are the create's words; without either, the workflow's initial decides
       const created = withBoard((b) => engine.createCard(b, {
-        title: rest.join(' '), body: args.body, assignee: args.assignee === 'none' ? null : args.assignee, machine: args.machine,
+        title: rest.join(' '), body: textFrom(args['body-file'], args.body), assignee: args.assignee === 'none' ? null : args.assignee, machine: args.machine,
         workspace, branch: args.branch, parents: args.parent, priority: args.priority, tenant: args.tenant,
         triage: args.triage, idempotencyKey: args['idempotency-key'], maxRuntime: duration(args['max-runtime']),
         maxRetries, skills: args.skill, model: args.model, provider: args.provider, createdBy: args['created-by'] ?? null,
@@ -700,8 +703,8 @@ export async function runWorkflow(argv) {
     }
 
     case 'comment': {
-      need(2, 'a card id and the text');
-      let text = rest.slice(1).join(' ');
+      need(args.file !== undefined ? 1 : 2, 'a card id and the text (or --file PATH, - for stdin)');
+      let text = textFrom(args.file, rest.slice(1).join(' '));
       if (args['max-len']) text = text.slice(0, Number(args['max-len']));
       const n = await withBoardAsync((b) => engine.comment(b, id, isLatestReviewer(b.db, id, actorOf()) ? actorOf() : args.author ?? callerAddress() ?? callerName(), text));
       say(args, `Comment added to ${id}`, { ok: true, comment: n }); return 0;
@@ -829,8 +832,8 @@ export async function runWorkflow(argv) {
       if (!targets[0]) throw new Error(`${verb} needs a card id, or --all`);
       const results = [];
       for (const t of targets) {
-        if (verb === 'specify' && (args.title !== undefined || args.body !== undefined || args.workspace !== undefined || args.branch !== undefined || args.machine !== undefined)) {
-          const moved = await withBoardAsync((b) => engine.specify(b, t, { title: args.title ?? null, body: args.body ?? null, workspace: args.workspace ?? null, branch: args.branch ?? null, machine: args.machine ?? null, author: args.author ?? callerAddress() ?? callerName() }));
+        if (verb === 'specify' && (args.title !== undefined || args.body !== undefined || args['body-file'] !== undefined || args.workspace !== undefined || args.branch !== undefined || args.machine !== undefined)) {
+          const moved = await withBoardAsync((b) => engine.specify(b, t, { title: args.title ?? null, body: textFrom(args['body-file'], args.body) ?? null, workspace: args.workspace ?? null, branch: args.branch ?? null, machine: args.machine ?? null, author: args.author ?? callerAddress() ?? callerName() }));
           results.push({ id: t, specified: true, status: moved.to });
         } else if (verb === 'decompose' && args.child?.length) {
           const children = args.child.map((c) => { const [title, assignee] = c.split(/@(?=[^@]*$)/); return { title: title.trim(), assignee: assignee?.trim() || undefined }; });

package/board/credential-guard.mjs

@@ -0,0 +1,41 @@
+// A comment, a card's title or body, or a verb's payload that looks like a credential or environment dump is refused
+// before it is stored, naming why (never the value). The test is the Teams upload redactor's (@volter/teams/redact:
+// gitleaks' rule set and this machine's custody values), plus the shape of an environment listing: several NAME=value
+// lines in a row. A shell that expanded `$(env)` or a pasted .env into a comment once put live keys on a card, where
+// every reader, every launch prompt and the board's own remote received them.
+import { redactText } from '@volter/teams/redact';
+
+const ENV_LINE = /^\s*(?:export\s+|declare\s+-x\s+)?[A-Z][A-Z0-9_]{2,}=\S/;
+const ENV_LINES = 5;
+
+/** Why `text` looks like a credential or environment dump, or null. */
+export function credentialDumpIn(text) {
+  if (typeof text !== 'string' || text.length < 8) return null;
+  const lines = text.split('\n').filter((line) => ENV_LINE.test(line)).length;
+  if (lines >= ENV_LINES) return `${lines} NAME=value lines, the shape of an environment listing`;
+  const redacted = redactText(text);
+  if (redacted === text) return null;
+  const before = new Set(text.match(/\[redacted:[^\]]+\]/g) ?? []);
+  const found = [...new Set((redacted.match(/\[redacted:[^\]]+\]/g) ?? []).filter((marker) => !before.has(marker)))]
+    .map((marker) => marker.slice('[redacted:'.length, -1));
+  return found.length ? `it holds what reads as a secret (${found.slice(0, 5).join(', ')})` : null;
+}
+
+const stringsIn = (value, at = '') => typeof value === 'string' ? [[at, value]]
+  : Array.isArray(value) ? value.flatMap((item, index) => stringsIn(item, `${at}[${index}]`))
+  : value && typeof value === 'object' ? Object.entries(value).flatMap(([key, item]) => stringsIn(item, at ? `${at}.${key}` : key))
+  : [];
+
+/** Throw, naming `what` and why, when any string in `value` looks like a dump; nothing is stored. */
+export function refuseCredentialDump(what, value) {
+  for (const [at, text] of stringsIn(value)) {
+    const why = credentialDumpIn(text);
+    if (why) throw Object.assign(new Error(`${what}${at ? ` (${at})` : ''} was not stored: ${why}. Remove the values and point to where they are kept instead.`), { code: 'credential_dump' });
+  }
+}
+
+/** `text`, or a line saying it was withheld, for text stored before this check that goes into a prompt. */
+export function withheldIfDump(text) {
+  const why = credentialDumpIn(text);
+  return why ? `[withheld from this prompt: ${why}]` : text;
+}

package/board/engine.mjs

@@ -15,6 +15,7 @@ import { DatabaseSync } from 'node:sqlite';
 import { view, actorOf, principalOf, claimer, contention, event, json, newTaskId, now, retryContention, tx } from './store.mjs';
 import { completionPhase, inspectCompletionEvidence, observeCompletionEvidence, withCompletionEvidence } from './ci.mjs';
 import { addDependency, retireSupersededRuns, refreshCardInputs, requestSessionClose, eventTo, fire, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
+import { refuseCredentialDump, withheldIfDump } from './credential-guard.mjs';
 
 export const STATUSES = ['triage', 'todo', 'scheduled', 'ready', 'running', 'blocked', 'review', 'done', 'archived'];
 export const WORKSPACE_KINDS = ['scratch', 'dir', 'worktree'];
@@ -182,6 +183,7 @@ export function bodyTasks(body) {
 export function createCard(board, spec) {
   const title = String(spec.title ?? '').trim();
   if (!title) throw new Error('a card has a title');
+  refuseCredentialDump('the card', { title, body: spec.body ?? null });
   const steps = spec.subtaskOf ? [] : bodyTasks(spec.body).tasks;
   if (steps.length) spec = { ...spec, body: bodyTasks(spec.body).body };
   const ws = parseWorkspace(spec.workspace ?? 'scratch');
@@ -402,6 +404,7 @@ export function setCaller(fn) { callerRoles = fn; }
 export async function act(board, id, name, { roles = null, payload = {}, extra = {} } = {}) {
   const entry = await loadWorkflow(board.root);
   if (name === 'comment' && (!String(payload.body ?? '').trim() || !String(payload.author ?? '').trim())) throw new Error('a comment has an author and body');
+  refuseCredentialDump(name === 'comment' ? `the comment on ${id}` : `${name.replace(/_/g, '-')} on ${id}`, payload);
   refreshCardInputs(board, id, { commits: ['complete', 'request_review'].includes(name) });
   const evidencePhase = ['complete', 'request_review', 'request_state'].includes(name) ? completionPhase(board, id, entry, name, payload, roles ?? callerRoles(board.db, id)) : null;
   if (evidencePhase) payload = { ...payload, ci: observeCompletionEvidence(board, id, entry, payload, evidencePhase) };
@@ -633,6 +636,7 @@ export const promote = (board, id, { actor = 'user', reason = null, force = fals
 export const reclaim = (board, id, reason = null, { roles } = {}) => act(board, id, 'reclaim', { roles, payload: { reason } });
 export const archive = (board, id, { roles, reason } = {}) => act(board, id, 'archive', { roles, payload: { reason } });
 export async function specify(board, id, { title = null, body = null, workspace = null, branch = null, machine = null, author = 'user', roles } = {}) {
+  refuseCredentialDump(`${id}'s specification`, { title, body });
   let declaration = null;
   if (workspace != null || branch != null || machine != null) {
     const task = getTask(board.db, id);
@@ -797,7 +801,9 @@ export function showCard(db, id) {
   };
 }
 
-const cap = (text, n) => (text && text.length > n ? `${text.slice(0, n)}… (${text.length - n} more characters)` : text);
+// Stored text goes into a launch prompt only once it passes the credential check: what was stored before the check
+// existed is withheld there, naming why, so no prompt carries it.
+const cap = (text, n) => { text = text ? withheldIfDump(text) : text; return text && text.length > n ? `${text.slice(0, n)}… (${text.length - n} more characters)` : text; };
 
 /** What a session starting on a card reads first: the card, its parents' results, earlier attempts and the thread. */
 export function cardContext(db, id) {

package/board/store.mjs

@@ -10,6 +10,7 @@
 // are in `engine.mjs`. Hermes's own tools may write a `kanban.db` at the same time: every write there takes SQLite's
 // native transaction boundary and retries an optimistic conflict.
 import { noteStep } from '@volter/supercode-harness-sdk/slow-log';
+import { redactValue } from '@volter/teams/redact';
 import { randomBytes } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { hostname } from 'node:os';
@@ -318,8 +319,10 @@ export function event(db, taskId, kind, payload = null, runId = null) {
     }
   }
   const said = actor && !(payload && 'by' in payload) ? { ...(payload ?? {}), by: actor } : payload;
+  // An event carries what the board observed (a command's stderr, a session's screen), which a verb's text check never
+  // saw: a secret in it is stored as its marker (@volter/teams/redact), never as its value.
   const r = db.prepare('INSERT INTO task_events (task_id, run_id, kind, payload, created_at) VALUES (?, ?, ?, ?, ?)')
-    .run(taskId, runId, kind, said ? JSON.stringify(said) : null, now());
+    .run(taskId, runId, kind, said ? JSON.stringify(redactValue(said)) : null, now());
   return Number(r.lastInsertRowid);
 }
 

package/installed-apps.mjs

@@ -4,7 +4,7 @@
 // `apps/` folder (owner-only); no `platforms:` block attaches an integration. Uninstalling on the other side revokes the
 // token, and the channel stops; `remove` forgets the record here.
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { delimiter, join } from 'node:path';
+import { delimiter, isAbsolute, join } from 'node:path';
 import { homedir } from 'node:os';
 
 export const APPS_DIR = 'apps';
@@ -65,10 +65,13 @@ function rh2Origin(origin) {
   return /^https:\/\/|^http:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/.test(String(origin ?? ''));
 }
 
-/** The `rh2` CLI: on this process's PATH, else where RH2's installer puts it (`~/.local/bin`), else the bare name. */
+/** The `rh2` CLI, by absolute path: in an absolute folder on this process's PATH, else where RH2's installer puts it
+ * (`~/.local/bin`); null when neither has it. A relative PATH entry is never searched (a session's working directory
+ * may be a checkout that carries its own `rh2`, which would then run with the agent's token), and neither is a bare
+ * name, which the OS would look up the same way. */
 export function rh2Program() {
-  const folders = [...String(process.env.PATH ?? '').split(delimiter), join(homedir(), '.local', 'bin')].filter(Boolean);
-  return folders.map((folder) => join(folder, 'rh2')).find((file) => existsSync(file)) ?? 'rh2';
+  const folders = [...String(process.env.PATH ?? '').split(delimiter), join(homedir(), '.local', 'bin')].filter((folder) => folder && isAbsolute(folder));
+  return folders.map((folder) => join(folder, 'rh2')).find((file) => existsSync(file)) ?? null;
 }
 
 /** The environment the `rh2` CLI reads to act as an installed agent: its RH2 origin, its organization and its token. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.53",
+  "version": "0.5.55",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {