@volter/supercode-teams 0.2.102 → 0.2.104

package/bin/fleet.mjs

@@ -46,16 +46,13 @@ function channelForOn() {
   return openOn(onName(), { context: contextName() });
 }
 
-// Who starts a pane: supercode names it when it runs this CLI (empty: a person); run on its own, supercode is asked
-// (`teams caller`), and a launch no supercode answers for records no starter (so no session may act on the pane).
+// Who starts a pane, as supercode answers it (`teams caller`); a launch nothing answers for records no starter, so no
+// session may act on the pane.
 let launcherAnswer;
 function launcher() {
   if (launcherAnswer === undefined) {
-    if (process.env.SUPERCODE_CALLER !== undefined) launcherAnswer = process.env.SUPERCODE_CALLER || null;
-    else {
-      const r = spawnSync(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'caller'], { encoding: 'utf8', shell: process.platform === 'win32', windowsHide: true });
-      try { launcherAnswer = JSON.parse(r.stdout.trim().split('\n').pop()).caller ?? null; } catch { launcherAnswer = null; }
-    }
+    const r = spawnSync(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'caller'], { encoding: 'utf8', shell: process.platform === 'win32', windowsHide: true });
+    try { launcherAnswer = JSON.parse(r.stdout.trim().split('\n').pop()).caller ?? null; } catch { launcherAnswer = null; }
   }
   return launcherAnswer;
 }

package/bin/teams.mjs

@@ -108,19 +108,16 @@ async function machineChannel() {
 }
 
 // The session (or board) this command acts for: the pane doors refuse a session acting on a pane it did not start.
-// supercode names it when it runs this CLI (empty: a person); run on its own (`supercode-teams`), this CLI asks
-// supercode (`teams caller`), which reads the session from this process's ancestry, and refuses when none answers.
+// supercode answers it (`teams caller`: the session in this process's ancestry first, a named caller only as supercode
+// itself takes one), so this bin holds the same rule as \`supercode teams\`; a command nothing answers for is refused.
 let callerAnswer;
 function caller() {
   if (callerAnswer === undefined) {
-    if (process.env.SUPERCODE_CALLER !== undefined) callerAnswer = process.env.SUPERCODE_CALLER || null;
-    else {
-      const r = spawnSync(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'caller'], { encoding: 'utf8', shell: process.platform === 'win32', windowsHide: true });
-      let answer;
-      try { answer = JSON.parse(r.stdout.trim().split('\n').pop()); } catch { /* no answer */ }
-      if (!answer || !('caller' in answer)) die(`cannot tell which session runs this, so the pane doors cannot hold it to the panes it started; nothing was done. Run it as \`supercode teams …\` (${(r.error?.message ?? r.stderr ?? '').trim().slice(0, 200)})`, 1);
-      callerAnswer = answer.caller ?? null;
-    }
+    const r = spawnSync(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'caller'], { encoding: 'utf8', shell: process.platform === 'win32', windowsHide: true });
+    let answer;
+    try { answer = JSON.parse(r.stdout.trim().split('\n').pop()); } catch { /* no answer */ }
+    if (!answer || !('caller' in answer)) die(`cannot tell which session runs this, so the pane doors cannot hold it to the panes it started; nothing was done (${(r.error?.message ?? r.stderr ?? '').trim().slice(0, 200)})`, 1);
+    callerAnswer = answer.caller ?? null;
   }
   return callerAnswer ?? undefined;
 }

package/machine.mjs

@@ -582,6 +582,35 @@ export class TeamsMachine extends MachineCore {
    * address) on a pane another session, a board or a person started is refused, naming who started it. A person (no
    * caller) and a board (its cards' own door) act on any pane.
    */
+  /**
+   * Who is calling, for the pane doors. On the local socket the daemon decides: it hands the connection to its own
+   * supercode (`teams caller --peer-fd 3`), which reads the peer's pid from the kernel and resolves that process's
+   * session from its ancestry and its own environment, so nothing the client sends about itself is believed. Asked
+   * once per connection. A request the Teams connector forwards from another machine keeps the caller it carries,
+   * as does a platform with no peer credentials (Windows named pipes). A local peer nothing can resolve is refused.
+   */
+  #callerOf(entry, params) {
+    const named = typeof params.caller === 'string' && params.caller ? params.caller : null;
+    if (entry.principal !== 'local' || !entry.socket) return Promise.resolve(named);
+    entry.peerCaller ??= new Promise((resolve) => {
+      let out = '';
+      let child;
+      try {
+        child = spawn(this.supercodeBin, ['teams', 'caller', '--peer-fd', '3'], { stdio: ['ignore', 'pipe', 'ignore', entry.socket], env: this.env, windowsHide: true });
+      } catch { resolve({ unknown: true }); return; }
+      child.stdout.on('data', (chunk) => { out += chunk; });
+      child.on('error', () => resolve({ unknown: true }));
+      child.on('close', () => { try { resolve(JSON.parse(out.trim().split('\n').pop())); } catch { resolve({ unknown: true }); } });
+    });
+    return entry.peerCaller.then((answer) => {
+      // No peer credentials here, or a supercode older than the question (it answers for itself, with no pid): the
+      // caller the client names, as before.
+      if (answer.unsupported || (answer.caller !== undefined && !('pid' in answer))) return named;
+      if (answer.unknown || !('caller' in answer)) throw Object.assign(new Error('cannot tell which process is calling, so the pane doors cannot hold it to the panes it started; nothing was done'), { code: 403 });
+      return answer.caller ?? null;
+    });
+  }
+
   #refuseForeign(pane, caller) {
     if (typeof caller !== 'string' || !caller || /^sc:[^:]+:board:/.test(caller)) return;
     const by = this.launches.all().find((entry) => entry.pane === pane)?.by ?? null;
@@ -1155,7 +1184,7 @@ export class TeamsMachine extends MachineCore {
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
         // Who started the pane: the launching session's (or board's) address, null for a person. A session's later
         // input and close on the pane are refused unless it is this one (#refuseForeign).
-        const by = typeof params.caller === 'string' && params.caller ? params.caller : null;
+        const by = await this.#callerOf(entry, params).catch(() => null);
         // Who to tell when the pane ends (`open --new … --notify-when-ended`): a session's mail address, and this
         // machine's name as the address a notice from its pane comes from.
         if (params.notify !== undefined && !(params.notify && typeof params.notify.to === 'string' && /^sc:[^:\s]+:[^:\s]+:\S+$/.test(params.notify.to) && typeof params.notify.machine === 'string' && /^[a-z0-9][a-z0-9-]*$/.test(params.notify.machine))) throw Object.assign(new Error('launch notify is { to: <sc: address>, machine: <this machine\'s mail name> }'), { code: 400 });
@@ -1233,7 +1262,7 @@ export class TeamsMachine extends MachineCore {
       }
       case 'panes.close': {
         need(operator ? 'control' : 'control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         await this.host.closeSession(session.id);
@@ -1246,7 +1275,7 @@ export class TeamsMachine extends MachineCore {
         // working, only `{input}` is refused — until `resume`, which may carry
         // the input that hands the pane back. Local tmux input is never touched.
         need('control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         const doc = readJson(this.p.suspended, { v: 1, panes: {} });
@@ -1268,7 +1297,7 @@ export class TeamsMachine extends MachineCore {
         // mechanics) for callers that are services rather than terminals. Same gate as an
         // attachment in control mode, same suspend rule as remote input everywhere.
         need('control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });
@@ -1287,7 +1316,7 @@ export class TeamsMachine extends MachineCore {
         // answer, not an error: the caller keeps the turn and asks again. Its own
         // method, so a daemon without it refuses instead of typing into a draft.
         need('control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.102",
+  "version": "0.2.104",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",