@volter/supercode-orchestrator 0.5.6 → 0.5.7

package/hermes-cli.mjs

@@ -336,7 +336,8 @@ export function hermesTool(profileDir, name, args, { sessionId = null, env = nul
  * other tool (Hermes's file tools are not gated); a dangerous one is asked in a conversation (unless
  * `approvals.mode: off`), and answered by `approvals.cron_mode` in a fire and `approvals.single_query_mode`
  * in a dispatched worker, each deny by default. Answers `{ verdict: allow|ask|deny, why }`, or null without
- * Hermes (the worker's own prompt is then relayed as it stands).
+ * Hermes (the worker's own prompt is then relayed as it stands). A request to widen the worker's own sandbox
+ * is never asked here (loop.mjs `widensSandbox`): this rule cannot see it.
  */
 export async function hermesApproval(profileDir, { command = null, context = 'conversation' } = {}) {
   if (!hermesInstall()?.python) return null;

package/kanban-worker.mjs

@@ -14,10 +14,10 @@ import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 import { load } from './orchestration.mjs';
 import { INSTRUCTION_ARGUMENTS, activationCwd, activationEnv, sandboxArguments, approvalPolicy, limitArguments, materializePersona, materializeSkills, modelArguments, turnCounter, userHomeArguments, userHomePersona } from './activation.mjs';
 import { workerRoute } from './worker-route.mjs';
-import { KANBAN_ENV, untrustedServerVerdict, hermesInstall, memorySnapshot } from './hermes-cli.mjs';
+import { KANBAN_ENV, untrustedServerVerdict, hermesApproval, hermesInstall, memorySnapshot } from './hermes-cli.mjs';
 import { pinnedSkills, taskProtocol } from './board/worker-prompt.mjs';
 import { mountOrchestratorMcp } from './mcp/mount.mjs';
-import { normalizeWorkerEvent } from './loop.mjs';
+import { normalizeWorkerEvent, widensSandbox } from './loop.mjs';
 import { DEFAULT_BOARD, json, openBoard, tx } from './board/store.mjs';
 import { setRunSession } from './board/engine.mjs';
 import { permissionResponse } from './reducer.mjs';
@@ -112,12 +112,20 @@ async function runTurn({ client, profile, harness, worker, route, root, vault, s
       if (w.kind === 'final' && counter) w = counter.settle(w);
       if (w.kind === 'text') text += w.block && text ? `\n\n${w.delta}` : w.delta;
       else if (w.kind === 'request') {
-        // nobody attends a dispatched worker: an untrusted server's tool is denied, anything else is answered by the
-        // profile's `worker.permission.unattended` (deny unless it says approve)
-        const gated = untrustedServerVerdict(profile, w.tool, 'single_query', { mcp: w.mcp && !String(w.tool ?? '').startsWith('mcp__orchestrator__') });
-        const approve = gated ? gated.verdict === 'allow' : profile.worker?.permission?.unattended === 'approve';
-        say(`hermes-worker: ${approve ? 'approved' : 'denied'} a permission request with nobody attending (${gated ? gated.why : 'worker.permission.unattended'}): ${w.subject}`);
-        runtime.respond(JSON.parse(w.id), permissionResponse(w.options, approve, gated?.message ?? (approve ? null : 'Denied: nobody is attending this run to approve it (worker.permission.unattended). Find an alternative approach that avoids this action.'))).catch(() => {});
+        // nobody attends a dispatched worker: an untrusted server's tool is denied; anything else is answered by Hermes's
+        // approval rule in single-query mode, as the daemon's path asks it (loop.mjs): a safe command runs, a dangerous
+        // one is answered by `approvals.single_query_mode` (deny by default). A request to widen the worker's own
+        // sandbox (`widensSandbox`), and any request without Hermes, is answered by the profile's
+        // `worker.permission.unattended` (deny unless it says approve): Hermes's rule cannot see those.
+        void (async () => {
+          const gated = untrustedServerVerdict(profile, w.tool, 'single_query', { mcp: w.mcp && !String(w.tool ?? '').startsWith('mcp__orchestrator__') });
+          const hermes = gated || widensSandbox(w) ? null : await hermesApproval(profile.dir, { command: w.command ?? null, context: 'single_query' })
+            .catch((error) => { say(`hermes-worker: Hermes's approval rule: ${error.message}`); return null; });
+          const approve = gated ? gated.verdict === 'allow' : hermes ? hermes.verdict === 'allow' : profile.worker?.permission?.unattended === 'approve';
+          const rule = gated ? gated.why : hermes ? `Hermes: ${hermes.verdict === 'allow' ? 'not a dangerous command' : hermes.why ?? 'a dangerous command'}` : 'worker.permission.unattended';
+          say(`hermes-worker: ${approve ? 'approved' : 'denied'} a permission request with nobody attending (${rule}): ${w.subject}`);
+          await runtime.respond(JSON.parse(w.id), permissionResponse(w.options, approve, gated?.message ?? hermes?.message ?? (approve ? null : 'Denied: nobody is attending this run to approve it (worker.permission.unattended). Find an alternative approach that avoids this action.')));
+        })().catch(() => {});
       } else if (w.kind === 'final') {
         if (w.outcome === 'error') say(`hermes-worker: the turn failed: ${w.message ?? 'no reason given'}`);
         done(w.outcome === 'error' ? 1 : 0);

package/loop.mjs

@@ -698,7 +698,9 @@ export class Orchestrator {
       // a tool of one of the profile's untrusted MCP servers is gated as Hermes's trust gate gates it
       const gated = untrustedServerVerdict(profile, w.tool, context, { mcp: w.mcp && !String(w.tool ?? '').startsWith('mcp__orchestrator__') });
       if (gated) { this.enqueue(events.worker({ profile: profileName, keyString, runtime_id: runtime.handle.runtime_id, ev: { ...w, hermes: gated }, at })); return; }
-      void hermesApproval(profile.dir, { command: w.command ?? null, context })
+      // a request to widen the worker's own sandbox is not Hermes's to judge (its rule cannot see it): it is asked in a
+      // conversation and answered by `worker.permission.unattended` with nobody present
+      void (widensSandbox(w) ? Promise.resolve(null) : hermesApproval(profile.dir, { command: w.command ?? null, context }))
         .catch((error) => { this.log('warn', `approval ${keyString}: ${error.message}`); return null; })
         .then((hermes) => this.enqueue(events.worker({ profile: profileName, keyString, runtime_id: runtime.handle.runtime_id, ev: { ...w, hermes }, at })));
       return;
@@ -1097,6 +1099,17 @@ function claudePermissionRequest(payload) {
 }
 
 /** The shell command a worker asks to run (Codex's `params.command`, a string or an argv), for Hermes's rule. */
+/**
+ * Whether a worker's request asks to widen its own sandbox: Codex's `item/permissions/requestApproval` (network and
+ * file-system roots for the turn) and `item/fileChange/requestApproval` (a write outside its writable roots). Hermes's
+ * approval rule judges commands and lets its own file tools through, which have no sandbox behind them; it never sees
+ * these, so they keep the profile's own answer.
+ */
+export function widensSandbox(w) {
+  const kind = String(w?.subject ?? '').toLowerCase();
+  return kind.includes('permissions/requestapproval') || kind.includes('filechange/requestapproval');
+}
+
 function requestCommand(payload) {
   const raw = payload?.params?.command ?? payload?.command ?? payload?.params?.input?.command ?? null;
   if (Array.isArray(raw)) return raw.map(String).join(' ');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {