@volter/supercode-teams 0.2.103 → 0.2.105

package/machine.mjs

@@ -582,6 +582,39 @@ export class TeamsMachine extends MachineCore {
    * address) on a pane another session, a board or a person started is refused, naming who started it. A person (no
    * caller) and a board (its cards' own door) act on any pane.
    */
+  /**
+   * Who is calling, for the pane doors. On the local socket the daemon decides: it hands the connection to its own
+   * supercode (`teams caller --peer-fd 3`), which reads the peer's pid from the kernel and resolves that process's
+   * session from its ancestry and its own environment, so nothing the client sends about itself is believed. Asked
+   * once per connection. A request the Teams connector forwards from another machine keeps the caller it carries,
+   * as does a platform with no peer credentials (Windows named pipes). A local peer nothing can resolve is refused.
+   */
+  #callerOf(entry, params) {
+    const named = typeof params.caller === 'string' && params.caller ? params.caller : null;
+    if (entry.principal !== 'local' || !entry.socket) return Promise.resolve(named);
+    entry.peerCaller ??= new Promise((resolve) => {
+      let out = '';
+      let child;
+      try {
+        // The descriptor's number, not the socket: a stream handed to spawn stops being read here, and the
+        // connection's next request would never be answered. The child gets its own duplicate of the descriptor.
+        const fd = entry.socket._handle?.fd;
+        if (!Number.isInteger(fd) || fd < 0) { resolve({ unsupported: true }); return; }
+        child = spawn(this.supercodeBin, ['teams', 'caller', '--peer-fd', '3'], { stdio: ['ignore', 'pipe', 'ignore', fd], env: this.env, windowsHide: true });
+      } catch { resolve({ unknown: true }); return; }
+      child.stdout.on('data', (chunk) => { out += chunk; });
+      child.on('error', () => resolve({ unknown: true }));
+      child.on('close', () => { try { resolve(JSON.parse(out.trim().split('\n').pop())); } catch { resolve({ unknown: true }); } });
+    });
+    return entry.peerCaller.then((answer) => {
+      // No peer credentials here, or a supercode older than the question (it answers for itself, with no pid): the
+      // caller the client names, as before.
+      if (answer.unsupported || (answer.caller !== undefined && !('pid' in answer))) return named;
+      if (answer.unknown || !('caller' in answer)) throw Object.assign(new Error('cannot tell which process is calling, so the pane doors cannot hold it to the panes it started; nothing was done'), { code: 403 });
+      return answer.caller ?? null;
+    });
+  }
+
   #refuseForeign(pane, caller) {
     if (typeof caller !== 'string' || !caller || /^sc:[^:]+:board:/.test(caller)) return;
     const by = this.launches.all().find((entry) => entry.pane === pane)?.by ?? null;
@@ -1155,7 +1188,7 @@ export class TeamsMachine extends MachineCore {
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
         // Who started the pane: the launching session's (or board's) address, null for a person. A session's later
         // input and close on the pane are refused unless it is this one (#refuseForeign).
-        const by = typeof params.caller === 'string' && params.caller ? params.caller : null;
+        const by = await this.#callerOf(entry, params).catch(() => null);
         // Who to tell when the pane ends (`open --new … --notify-when-ended`): a session's mail address, and this
         // machine's name as the address a notice from its pane comes from.
         if (params.notify !== undefined && !(params.notify && typeof params.notify.to === 'string' && /^sc:[^:\s]+:[^:\s]+:\S+$/.test(params.notify.to) && typeof params.notify.machine === 'string' && /^[a-z0-9][a-z0-9-]*$/.test(params.notify.machine))) throw Object.assign(new Error('launch notify is { to: <sc: address>, machine: <this machine\'s mail name> }'), { code: 400 });
@@ -1233,7 +1266,7 @@ export class TeamsMachine extends MachineCore {
       }
       case 'panes.close': {
         need(operator ? 'control' : 'control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         await this.host.closeSession(session.id);
@@ -1246,7 +1279,7 @@ export class TeamsMachine extends MachineCore {
         // working, only `{input}` is refused — until `resume`, which may carry
         // the input that hands the pane back. Local tmux input is never touched.
         need('control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         const doc = readJson(this.p.suspended, { v: 1, panes: {} });
@@ -1268,7 +1301,7 @@ export class TeamsMachine extends MachineCore {
         // mechanics) for callers that are services rather than terminals. Same gate as an
         // attachment in control mode, same suspend rule as remote input everywhere.
         need('control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });
@@ -1287,7 +1320,7 @@ export class TeamsMachine extends MachineCore {
         // answer, not an error: the caller keeps the turn and asks again. Its own
         // method, so a daemon without it refuses instead of typing into a draft.
         need('control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, params.caller);
+        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
         const session = await this.#paneByContext(params.pane);
         if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.103",
+  "version": "0.2.105",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",