teems 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b2001d1f6e7653df296a0443a0a2f2bec80068ca05b4693bfd2b74c5f6a5240
-  data.tar.gz: 4f8e3920b836feb38237cd828a11ab63589855391f21cbea90eee6a54a34be9f
+  metadata.gz: 5932afeb278892c20e7e3fbb92980da31ff45cd9a528a3e2463de38ee7ea3f70
+  data.tar.gz: 331a38b48c8bb1d87ff770a0579e1846aa643b5d1d1daf5061c0bbf8f0589264
 SHA512:
-  metadata.gz: 245ff54545cf04f3d0db0062ab51ae2e1dc001a474c45c05e7e7cde21e8a00a523813b5019b96acaba0665010b6a6d31b7922141cb01a4203a2850f10fe5ad56
-  data.tar.gz: dffaa23979af2e85fffb8b0d3b8b3d8688aee1ff7c6d53eeeb5c151c81836380e93921eb5c37e2f2acf7d633a2f73e02a007e0c70af59a01e68f0bcb31a87f99
+  metadata.gz: 5d750e3b09de3a6ce07612398e0e00a7eb5ac647aa9cd38d45023cd0605777625a9ec212aa81c111b69118d068ffd3b4bd946280d4194cc1ecd34f40708adf7f
+  data.tar.gz: 355288361bbfa4e21166b18b248793403a023411e3588be731e205c9fe4f6994684426ae7037a09cf009bdb699e9a17caf932572aea9ab1588449c3298224624

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.3.1] - 2026-09-02
+
+### Added
+- `teems meeting --date YYYY-MM-DD` - Pick a single occurrence of a recurring meeting series by date. Filters call events, recordings, transcripts, and chat messages to that day in the user's local timezone, so iterating multiple days from the same series is a one-liner shell loop. Errors when nothing matches.
+- `teems meeting --date` automatically paginates the chat thread via `_metadata.backwardLink` until the page covers the requested date — using `lastCompleteSegmentStartTime` as the boundary cursor so pages with interleaved old replies/system messages don't terminate pagination prematurely. Capped at 50 pages of 200 messages as a safety net; cap-hit surfaces a user-visible error. API errors mid-pagination now exit non-zero instead of rendering partial data as success.
+- `teems messages <teams-url>` now treats a message permalink as a thread root: it fetches the linked message and its replies and renders them with a `--- N replies ---` separator (modelled after `slk view`). Falls back to listing recent messages when the URL has no message ID.
+
+### Fixed
+- `teems auth login` no longer hangs and then fails on a first login. The Safari OAuth flow read its tenant from `tokens.json` and bailed when it was absent, so the flow that obtains tokens required tokens to already exist; it now falls back to the `common` tenant. The redirect poll also assumed silent SSO with a 12-second budget, which never survived an account picker, MFA, or a PIV/CAC certificate prompt — it now polls every tab for three minutes and prints a visible "waiting for sign-in" notice instead of sitting silent
+- `teems auth login` records the tenant the token was actually issued for instead of the placeholder used to start the flow, so refreshes and the headless helper use the tenant-specific endpoint
+- Interrupting a command that is waiting on a child process (Safari sign-in, the headless helper, or the Swift compile) no longer prints `Open3` reader-thread `IOError` backtraces before exiting
+- `teems org` no longer hangs when the manager chain contains a cycle; cycle detection breaks the walk on the first repeated manager
+
 ## [0.3.0] - 2026-04-23
 
 ### Added

data/lib/teems/api/messages.rb

@@ -39,6 +39,12 @@ module Teems
         get("/v1/users/ME/conversations/#{encoded_id}/messages", params: params)
       end
 
+      # Get a single message by ID
+      def message(thread_id:, message_id:)
+        encoded_id = URI.encode_www_form_component(thread_id)
+        get("/v1/users/ME/conversations/#{encoded_id}/messages/#{message_id}")
+      end
+
       # Get replies to a message
       def replies(thread_id:, message_id:, limit: 50)
         encoded_id = URI.encode_www_form_component(thread_id)

data/lib/teems/commands/auth.rb

@@ -221,8 +221,8 @@ module Teems
 
       def print_login_banner
         puts 'Starting Teams authentication...'
-        puts 'Safari will open to teams.microsoft.com'
-        puts 'Please complete the login process'
+        puts 'Safari will open so you can sign in (PIV/CAC or MFA prompts appear there).'
+        puts 'Leave this running - it captures the tokens as soon as sign-in completes.'
         puts
       end
 
@@ -238,7 +238,9 @@ module Teems
 
       def suggest_manual_auth
         error('Failed to extract tokens automatically')
-        puts "\nTry manual extraction instead:\n  teems auth manual"
+        puts "\nRerun with -v to see where it stopped:\n  teems auth login -v"
+        puts "\nOn VPN with a PIV card, try:\n  teems auth login --certauth"
+        puts "\nOr extract the tokens by hand:\n  teems auth manual"
         1
       end
 

data/lib/teems/commands/meeting.rb

@@ -22,6 +22,8 @@ module Teems
         --audio          Also save a separate audio file (M4A) — ideal for transcription
         --no-video       Skip the video file; with --audio produces audio-only output
         --chat           Show meeting chat messages
+        --date YYYY-MM-DD  Pick a single occurrence of a recurring meeting by date
+                           (filters call events, recordings, and transcripts)
         -o, --output-dir Directory for downloads (default: current directory)
         -v, --verbose    Show debug output
         -q, --quiet      Suppress output
@@ -36,6 +38,7 @@ module Teems
         teems meeting 19:meeting_abc123@thread.v2 --audio --no-video -o ~/Downloads  # audio only
         teems meeting 19:meeting_abc123@thread.v2 --recording -o ~/Downloads
         teems meeting 19:meeting_abc123@thread.v2 --recording --transcript -o ~/Downloads
+        teems meeting "<recurring-url>" --date 2026-05-04 --audio --no-video --transcript
         teems meeting AAMkAGVmMDEz...        # By calendar event ID
     HELP
 
@@ -47,6 +50,7 @@ module Teems
         '--audio' => ->(opts, _args) { opts[:audio] = true },
         '--no-video' => ->(opts, _args) { opts[:no_video] = true },
         '--chat' => ->(opts, _args) { opts[:chat] = true },
+        '--date' => ->(opts, args) { opts[:date] = args.shift },
         '-o' => ->(opts, args) { opts[:output_dir] = args.shift },
         '--output-dir' => ->(opts, args) { opts[:output_dir] = args.shift }
       }.freeze
@@ -164,6 +168,16 @@ module Teems
       CALLID_RE = %r{<callId>([^<]+)</callId>}
       INSTANCE_ICAL_RE = %r{<instanceDetails>.*?<iCalUid>([^<]+)</iCalUid>}m
 
+      # Public helper: parses an ISO/RFC time string, returning nil for nil/garbage input.
+      # Shared with MeetingPage which doesn't include the module.
+      def self.safe_parse_time(time_str)
+        return nil unless time_str
+
+        Time.parse(time_str)
+      rescue ArgumentError, TypeError
+        nil
+      end
+
       private
 
       def classify_meeting_messages(messages_data)
@@ -364,6 +378,200 @@ module Teems
       end
     end
 
+    # A single page of meeting chat messages with the cursor to the page before it.
+    # Constructor normalizes a blank backward_link to nil so `last?` is a simple nil check.
+    # Date comparisons use the user's local timezone to match `--date` semantics.
+    #
+    # `segment_cursor` is `_metadata.lastCompleteSegmentStartTime` (a Time) — the API's
+    # boundary marker for "all messages from here on are fully loaded." Prefer it for
+    # `covers_through?` because pages can intersperse old replies/system messages, making
+    # the message-level `oldest_local_date` an unreliable stop signal. Falls back to the
+    # oldest message when the cursor is absent (e.g. in synthetic test data).
+    MeetingPage = Data.define(:messages, :backward_link, :segment_cursor) do
+      def self.from_response(response)
+        msgs, value_msgs, meta_or_nil = response.values_at('messages', 'value', '_metadata')
+        meta = meta_or_nil || {}
+        new(messages: msgs || value_msgs || [],
+            backward_link: meta['backwardLink'],
+            segment_cursor: cursor_from_millis(meta['lastCompleteSegmentStartTime']))
+      end
+
+      def self.cursor_from_millis(millis)
+        return nil unless millis.is_a?(Numeric)
+
+        Time.at(millis / 1000.0)
+      end
+
+      def initialize(messages:, backward_link:, segment_cursor: nil)
+        super(messages: messages,
+              backward_link: backward_link.to_s.empty? ? nil : backward_link,
+              segment_cursor: segment_cursor)
+      end
+
+      def empty? = messages.empty?
+      def last? = !backward_link
+
+      def oldest_local_date
+        oldest_message_time&.localtime&.to_date
+      end
+
+      # Strict `<` is load-bearing: when the cursor equals target_date, we must keep
+      # paginating to ensure we've fetched all of target_date's messages.
+      def covers_through?(target_date)
+        cursor = segment_cursor || oldest_message_time
+        cursor && cursor.localtime.to_date < target_date
+      end
+
+      def terminal_for?(target_date)
+        empty? || last? || covers_through?(target_date)
+      end
+
+      private
+
+      def oldest_message_time
+        messages.filter_map { |msg| MeetingMessageParser.safe_parse_time(msg['composetime']) }.min
+      end
+    end
+
+    # Pages backward through chat messages until we've fetched past the target date.
+    # The ng.msg wrapper requests 200 messages per page and exposes no messageType filter,
+    # so for recurring meetings we paginate via _metadata.backwardLink.
+    module MeetingPagination
+      # Per-page request size used by Api::Messages#chat_messages_page.
+      PAGE_SIZE = 200
+
+      # Safety net: 50 pages × 200 = 10K messages worst case (~25s with the rate-limit
+      # cushion). Beyond this we assume the requested date is older than retained history
+      # and surface a user-visible error.
+      MAX_PAGES = 50
+
+      # Polite pause between page fetches. Matches Services::SyncEngine::API_DELAY_SECONDS.
+      PAGE_DELAY_SECONDS = 0.5
+
+      private
+
+      # Returns the accumulated messages, or nil if the API errored mid-pagination
+      # (so callers can fail loudly instead of rendering partial data as success).
+      def paginate_meeting_messages(thread_id, target_date)
+        @page_count = 0
+        @pagination_link = nil
+        @paginated_messages = []
+        return nil unless run_pagination_loop(thread_id, target_date)
+
+        @paginated_messages
+      end
+
+      def run_pagination_loop(thread_id, target_date)
+        loop do
+          page = fetch_meeting_page(thread_id, @pagination_link)
+          return false unless page
+
+          merge_meeting_page(page)
+          return true if pagination_done?(page, target_date)
+
+          @pagination_link = page.backward_link
+          page_pause
+        end
+      end
+
+      def page_pause
+        sleep(PAGE_DELAY_SECONDS)
+      end
+
+      def fetch_meeting_page(thread_id, backward_link)
+        response = with_token_refresh do
+          runner.messages_api.chat_messages_page(
+            chat_id: thread_id, limit: PAGE_SIZE, backward_link: backward_link
+          )
+        end
+        MeetingPage.from_response(response)
+      rescue ApiError => e
+        error("Failed to fetch meeting messages: #{e.message}")
+        nil
+      end
+
+      def merge_meeting_page(page)
+        page_messages = page.messages
+        @paginated_messages.concat(page_messages)
+        @page_count += 1
+        debug("Page #{@page_count}: #{page_messages.length} message(s) " \
+              "(oldest #{page.oldest_local_date}); total #{@paginated_messages.length}")
+      end
+
+      def pagination_done?(page, target_date)
+        return true if page.terminal_for?(target_date)
+
+        reached_pagination_cap?
+      end
+
+      def reached_pagination_cap?
+        return false if @page_count < MAX_PAGES
+
+        error("Stopped after #{MAX_PAGES} pages (~#{MAX_PAGES * PAGE_SIZE} messages); " \
+              '--date may predate available history')
+        true
+      end
+    end
+
+    # Filters classified call events, recordings, transcripts, and chat messages to a
+    # single date. Used to select one occurrence of a recurring meeting series.
+    # Date comparison uses the user's local timezone.
+    module MeetingDateFilter
+      # All four classification buckets are date-filtered. Parsed buckets (call_events,
+      # recordings, transcripts) carry :time (symbol); raw chat_messages carry
+      # 'composetime' (string) — `item_on_date?` accepts either shape.
+      DATE_KEYS = %i[call_events recordings transcripts chat_messages].freeze
+
+      private
+
+      def validate_date_option
+        raw = @options[:date]
+        return nil unless raw
+
+        @options[:target_date] = Date.parse(raw)
+        nil
+      rescue ArgumentError, TypeError
+        error("Invalid --date value: #{raw.inspect} (expected YYYY-MM-DD)")
+        1
+      end
+
+      def apply_date_option(classified)
+        target_date = @options[:target_date]
+        return classified unless target_date
+
+        filtered = filter_classified_by_date(classified, target_date)
+        return filtered unless date_filter_empty?(filtered)
+
+        error("No meeting activity found for #{@options[:date]}")
+        nil
+      end
+
+      def date_filter_empty?(classified)
+        DATE_KEYS.all? { |key| classified[key].empty? }
+      end
+
+      def filter_classified_by_date(classified, target_date)
+        classified.to_h { |key, val| [key, filter_classified_value(key, val, target_date)] }
+      end
+
+      def filter_classified_value(key, val, target_date)
+        DATE_KEYS.include?(key) ? items_on_date(val, target_date) : val
+      end
+
+      def items_on_date(items, target_date)
+        items.select { |item| item_on_date?(item, target_date) }
+      end
+
+      def item_on_date?(item, target_date)
+        time_str = item[:time] || item['composetime']
+        return false unless time_str
+
+        Time.parse(time_str).localtime.to_date == target_date
+      rescue ArgumentError, TypeError
+        false
+      end
+    end
+
     # Filters classified messages to a specific call instance by callId
     module MeetingCallFilter
       private
@@ -403,6 +611,8 @@ module Teems
       include MeetingDisplay
       include MeetingChatDisplay
       include MeetingCallFilter
+      include MeetingDateFilter
+      include MeetingPagination
       include MeetingTranscript
       include MeetingRecording
 
@@ -422,6 +632,13 @@ module Teems
         target ? process_meeting(target) : 1
       end
 
+      def validate_options
+        result = super
+        return result if result
+
+        validate_date_option
+      end
+
       protected
 
       MEETING_OPTIONS = MeetingOptionDefs::ALL
@@ -442,11 +659,21 @@ module Teems
         return 1 unless messages_data
 
         classified = classify_and_filter(messages_data, target)
+        classified = apply_date_option(classified)
+        return 1 unless classified
+
         dispatch_mode(target, classified)
       end
 
       def fetch_meeting_messages(thread_id)
         debug("Fetching messages for thread: #{thread_id}")
+        target_date = @options[:target_date]
+        return paginate_meeting_messages(thread_id, target_date) if target_date
+
+        single_page_meeting_messages(thread_id)
+      end
+
+      def single_page_meeting_messages(thread_id)
         response = with_token_refresh do
           runner.messages_api.chat_messages(chat_id: thread_id, limit: @options[:limit])
         end

data/lib/teems/commands/messages.rb

@@ -24,6 +24,7 @@ module Teems
         teems messages 19:abc123@thread.v2         # Read chat messages
         teems messages 19:abc123@thread.v2 -n 50   # Show 50 messages
         teems messages "https://teams.microsoft.com/l/message/19:abc@thread.v2/123?context=..."
+                                                   # Show the linked message and its thread replies
     HELP
 
     # Display formatting for messages command
@@ -167,10 +168,51 @@ module Teems
       end
     end
 
+    # Fetch and render a single message and its thread replies
+    module ThreadFetch
+      private
+
+      def fetch_thread(thread_id, message_id)
+        api = runner.messages_api
+        parent_data = with_token_refresh { api.message(thread_id: thread_id, message_id: message_id) }
+        replies_data = with_token_refresh do
+          api.replies(thread_id: thread_id, message_id: message_id, limit: @options[:limit])
+        end
+        display_thread(parent_data, extract_messages_data(replies_data))
+      rescue ApiError => e
+        error("Failed to fetch message: #{e.message}")
+      end
+
+      def display_thread(parent_data, replies_data)
+        parent = Models::Message.from_api(parent_data)
+        replies = replies_data.map { |data| Models::Message.from_api(data) }.reject(&:system_message?).reverse
+        return output_json(thread_to_hash(parent, replies)) if @options[:json]
+
+        render_thread(parent, replies)
+        download_attachments([parent, *replies]) if @options[:download]
+        0
+      end
+
+      def render_thread(parent, replies)
+        display_message(parent)
+        count = replies.length
+        return if count.zero?
+
+        puts output.gray("--- #{count} #{count == 1 ? 'reply' : 'replies'} ---")
+        puts
+        replies.each { |reply| display_message(reply) }
+      end
+
+      def thread_to_hash(parent, replies)
+        { parent: message_to_hash(parent), replies: replies.map { |reply| message_to_hash(reply) } }
+      end
+    end
+
     # Read messages from a channel or chat
     class Messages < Base
       include MessagesDisplay
       include AttachmentDownload
+      include ThreadFetch
 
       def initialize(args, runner:)
         @options = {}
@@ -231,12 +273,17 @@ module Teems
       def apply_parsed_url(result)
         conversation_id = result.conversation_id
         team_id = result.team_id
-        debug("Parsed URL: conversation=#{conversation_id}, team=#{team_id}")
+        message_id = result.message_id
+        debug("Parsed URL: conversation=#{conversation_id}, team=#{team_id}, message=#{message_id}")
         @options[:team_id] = team_id if team_id
+        @options[:message_id] = message_id if message_id
         conversation_id
       end
 
       def fetch_messages(target)
+        message_id = @options[:message_id]
+        return fetch_thread(target, message_id) if message_id
+
         @options[:team_id] ? fetch_channel_messages(target) : fetch_chat_messages(target)
       end
 

data/lib/teems/commands/org.rb

@@ -7,16 +7,18 @@ module Teems
       private
 
       def walk_manager_chain(target_id)
-        managers = []
-        current_id = target_id
         fetch = method(target_is_me? ? :fetch_my_manager : :fetch_user_manager)
-        collect_managers(managers, current_id, fetch)
+        collect_managers(target_id, fetch, Set[target_id])
       end
 
-      def collect_managers(managers, current_id, fetch)
+      def collect_managers(current_id, fetch, visited)
+        managers = []
         while (mgr = fetch.call(current_id))
+          mgr_id = mgr.id
+          break unless visited.add?(mgr_id)
+
           managers.unshift(mgr)
-          current_id = mgr.id
+          current_id = mgr_id
           fetch = method(:fetch_user_manager)
         end
         managers

data/lib/teems/services/headless_extract.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require 'open3'
 require 'json'
 require 'net/http'
 require 'uri'
@@ -24,7 +23,7 @@ module Teems
 
       def compile_helper(source, binary)
         log('Compiling headless token helper...')
-        _stdout, stderr, status = Open3.capture3(*swiftc_command(source, binary))
+        _stdout, stderr, status = Support::Subprocess.capture3(*swiftc_command(source, binary))
         log_helper_stderr(stderr)
         status.success? ? binary : log_and_nil('Failed to compile helper')
       rescue Errno::ENOENT
@@ -117,7 +116,7 @@ module Teems
         return nil unless binary
 
         log('Trying headless token extraction...')
-        output, stderr, status = Open3.capture3(binary, *build_helper_args)
+        output, stderr, status = Support::Subprocess.capture3(binary, *build_helper_args)
         log_helper_stderr(stderr)
         handle_helper_result(output, status.exitstatus)
       rescue StandardError => e

data/lib/teems/services/safari_js_runner.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'open3'
-
 module Teems
   module Services
     # Runs JavaScript in Safari's current tab via AppleScript
@@ -74,7 +72,7 @@ module Teems
       end
 
       def run_applescript(script)
-        out, _err, status = Open3.capture3('osascript', '-e', script)
+        out, _err, status = Support::Subprocess.capture3('osascript', '-e', script)
         return nil unless status.success?
 
         out.strip

data/lib/teems/services/safari_oauth.rb

@@ -116,12 +116,28 @@ module Teems
 
     # Polls Safari's URL bar via AppleScript and manages Safari tab navigation
     module SafariOAuthPolling
+      # Sign-in can require an account picker, MFA or a PIV/CAC certificate prompt, so the
+      # redirect is polled in chunks for several minutes rather than a single short burst.
+      POLL_TICK_SECONDS = 0.1
+      POLL_CHUNK_SECONDS = 15
+      POLL_CHUNKS = 12
+
       private
 
       def poll_safari_query_redirect
-        raw = run_applescript(poll_query_redirect_script).to_s
-        if raw.empty? || raw == 'timeout'
-          log('Safari OAuth: fast capture missed, falling back')
+        POLL_CHUNKS.times do |chunk|
+          raw = run_applescript(poll_query_redirect_script).to_s
+          return handle_poll_result(raw) unless raw == 'timeout'
+
+          announce_sign_in_wait(chunk)
+        end
+        log('Safari OAuth: timed out waiting for the sign-in redirect')
+        nil
+      end
+
+      def handle_poll_result(raw)
+        if raw.empty?
+          log('Safari OAuth: unable to read Safari tab URLs')
           return nil
         end
 
@@ -129,19 +145,30 @@ module Teems
         parse_oauth_params(raw)
       end
 
-      # Poll for ?code= in the URL — Safari's URL property includes query strings
+      def announce_sign_in_wait(chunk)
+        return notify('Waiting for you to finish signing in to Safari...') if chunk.zero?
+
+        log("Safari OAuth: still waiting for sign-in (#{(chunk + 1) * POLL_CHUNK_SECONDS}s)")
+      end
+
+      # Poll every tab for ?code= — Safari's URL property includes query strings, and the
+      # redirect can land in a tab other than the one we opened.
       def poll_query_redirect_script
         <<~APPLESCRIPT
           tell application "Safari"
-            repeat 600 times
-              try
-                set pageURL to URL of current tab of front window
-                if pageURL contains "teams.microsoft.com/go?" then
-                  set codeStart to offset of "?" in pageURL
-                  return text (codeStart + 1) thru -1 of pageURL
-                end if
-              end try
-              delay 0.02
+            repeat #{(POLL_CHUNK_SECONDS / POLL_TICK_SECONDS).to_i} times
+              repeat with w in windows
+                repeat with t in tabs of w
+                  try
+                    set pageURL to (URL of t) as text
+                    if pageURL contains "teams.microsoft.com/go?" then
+                      set codeStart to offset of "?" in pageURL
+                      return text (codeStart + 1) thru -1 of pageURL
+                    end if
+                  end try
+                end repeat
+              end repeat
+              delay #{POLL_TICK_SECONDS}
             end repeat
             return "timeout"
           end tell
@@ -192,20 +219,20 @@ module Teems
       include SafariOAuthPolling
 
       SKYPE_RESOURCE = 'https://api.spaces.skype.com'
+      # Used when no previous login is on disk; Entra ID resolves the tenant from the account.
+      DEFAULT_TENANT = 'common'
 
       private
 
       def try_safari_oauth
         hint, tenant = stored_login_hint
-        return nil unless tenant
-
-        log('Trying fast Safari OAuth flow...')
-        safari_code_flow({ tenant: tenant, hint: hint })
+        log('Trying Safari OAuth flow...')
+        safari_code_flow({ tenant: tenant || DEFAULT_TENANT, hint: hint })
       rescue StandardError => e
         log("Safari OAuth error: #{e.class}: #{e.message}")
         nil
       ensure
-        close_teams_tab if tenant
+        close_teams_tab
       end
 
       def safari_code_flow(context)
@@ -273,12 +300,19 @@ module Teems
       # :reek:FeatureEnvy
       def assemble_safari_result(context, graph, skype)
         spaces_token = skype[:spaces_token]
-        { auth_token: graph['access_token'],
+        auth_token = graph['access_token']
+        { auth_token: auth_token,
           skype_token: exchange_skype_via_http(spaces_token),
           skype_spaces_token: spaces_token, chatsvc_token: nil,
           refresh_token: skype[:refresh_token],
           client_id: OAuthUrlBuilder::TEAMS_APP_ID,
-          tenant_id: context[:tenant] }
+          tenant_id: resolved_tenant(auth_token, context[:tenant]) }
+      end
+
+      # Prefer the tenant the token was actually issued for over the placeholder used to
+      # start the flow, so refreshes hit the tenant-specific endpoint.
+      def resolved_tenant(auth_token, requested)
+        decode_jwt(auth_token.to_s)&.fetch('tid', nil) || requested
       end
     end
   end

data/lib/teems/services/token_extractor.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require 'open3'
 require_relative 'token_extractor_scripts'
 require_relative 'token_exchange_scripts'
 require_relative 'headless_extract'
@@ -58,7 +57,7 @@ module Teems
       end
 
       def run_applescript(script)
-        output, _stderr, status = Open3.capture3('osascript', '-e', script)
+        output, _stderr, status = Support::Subprocess.capture3('osascript', '-e', script)
         return applescript_failure(status) unless status.success?
 
         output.strip
@@ -396,6 +395,7 @@ module Teems
       end
 
       def log(message) = @output&.debug(message)
+      def notify(message) = @output&.info(message)
     end
   end
 end

data/lib/teems/support/subprocess.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'open3'
+
+module Teems
+  module Support
+    # Wrapper around Open3.capture3 for long-running child processes.
+    #
+    # Open3 reads stdout and stderr on background threads. When the process is signalled
+    # while those reads are in flight, the pipes close underneath them and each thread
+    # raises IOError, which Ruby prints as a backtrace before the main thread can exit
+    # cleanly. Waiting on Safari sign-in or the headless helper keeps us inside capture3
+    # for minutes at a time, so Ctrl-C there is routine rather than exceptional.
+    #
+    # Reader threads inherit Thread.report_on_exception when they are created, so muting
+    # it for the duration of the call silences exactly those threads and nothing else.
+    module Subprocess
+      module_function
+
+      def capture3(*command)
+        previous = Thread.report_on_exception
+        Thread.report_on_exception = false
+        Open3.capture3(*command)
+      ensure
+        Thread.report_on_exception = previous
+      end
+    end
+  end
+end

data/lib/teems/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Teems
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 end

data/lib/teems.rb

@@ -117,5 +117,6 @@ module Teems
     autoload :ErrorLogger, 'teems/support/error_logger'
     autoload :Timezone, 'teems/support/timezone'
     autoload :TimeParsing, 'teems/support/time_parsing'
+    autoload :Subprocess, 'teems/support/subprocess'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: teems
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Eric Boehs
@@ -83,6 +83,7 @@ files:
 - lib/teems/services/token_store.rb
 - lib/teems/support/error_logger.rb
 - lib/teems/support/help_formatter.rb
+- lib/teems/support/subprocess.rb
 - lib/teems/support/time_parsing.rb
 - lib/teems/support/timezone.rb
 - lib/teems/support/xdg_paths.rb