@volter/supercode-teams 0.2.112 → 0.2.114

package/bin/teams.mjs

@@ -165,7 +165,7 @@ async function main() {
     case 'panes': {
       if (sub === 'ls') return withNode(async (rpc) => out(await rpc.call('panes.list')));
       if (sub === 'capture') return withNode(async (rpc) => out((await rpc.call('panes.capture', { pane: rest[0], lines: Number(flags.lines ?? 200) })).text));
-      if (sub === 'close') return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: rest[0], caller: caller() })));
+      if (sub === 'close') return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: rest[0] })));
       die('panes ls|capture|close');
     }
     case 'title': {

package/connector/index.mjs

@@ -92,6 +92,11 @@ const fileStamp=stat=>`${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
 const recordedAt=entry=>{if(Number.isSafeInteger(entry.recorded_at))return entry.recorded_at;if(Number.isSafeInteger(entry.timestamp))return entry.timestamp;const value=entry.metadata?.timestamp??entry.value?.metadata?.timestamp??entry.timestamp;if(typeof value!=='string')return null;const parsed=Date.parse(value);return Number.isSafeInteger(parsed)?parsed:null;};
 const serverOrigin=value=>{const url=new URL(value),loopback=url.hostname==='localhost'||url.hostname==='::1'||url.hostname==='[::1]'||/^127(?:\.\d{1,3}){3}$/.test(url.hostname);if(!['http:','https:'].includes(url.protocol)||url.username||url.password||url.search||url.hash||(url.pathname!==''&&url.pathname!=='/')||(url.protocol==='http:'&&!loopback))throw new TypeError('server must be an HTTPS origin (HTTP is loopback-only)');return url.origin;};
 const SAVE_COALESCE_MS = 2000;
+// The catalog is conversation history, not a model's compacted continuation
+// context. Keep the native artifact separately for continuation/export.
+const captureRead = (harness, options = {}) => harness === 'codex'
+  ? { ...options, view: { displayHistory: true, tailMessages: 5000, includeSubagents: false } } : options;
+
 
 function atomic(path, value) {
   const temporary = `${path}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`;
@@ -460,7 +465,7 @@ export class TeamsConnector {
       this.lastCaptures.set(key,now);
       const {locator}=options,path=locator?.storage?.kind==='file'&&existsSync(locator.storage.path)?realpathSync(locator.storage.path):null;
       const artifactBefore=path?statSync(path):null;
-      options={...options,preloaded:{loaded:await (options.live?this.liveCore:this.core).session(locator).load(),artifactBefore}};
+      options={...options,preloaded:{loaded:await (options.live?this.liveCore:this.core).session(locator).load(captureRead(options.harness)),artifactBefore}};
     }
     // A capture the server refused and the outbox dropped stays that session's problem; any other capture clears it.
     const work=this.work.then(()=>this.captureSerial(options)).then(receipt=>{if(!this.droppedCaptures?.delete(`${options.harness}:${options.nativeSessionId}`))this.clearSessionProblem(options.harness,options.nativeSessionId);return receipt;});
@@ -540,7 +545,7 @@ export class TeamsConnector {
         this.largeCaptures??=new Map();const last=this.largeCaptures.get(key),wait=last&&!this.watched?.has(key)?Math.min(LARGE_CAPTURE_EVERY_MS,Math.max(LARGE_CAPTURE_FLOOR_MS,last.ms*10))-(this.clock.nowMs()-last.at):0;
         if(wait>0){this.largeRetry??=new Map();if(!this.largeRetry.has(key))this.largeRetry.set(key,setTimeout(()=>{this.largeRetry.delete(key);this.captureLarge(options);},wait).unref?.());continue;}
         started=this.clock.nowMs();
-        const loaded=await lane.core.session(options.locator).load({timeoutMs:Math.max(30000,Math.ceil(artifactBefore.size/(1024*1024))*1000)});
+        const loaded=await lane.core.session(options.locator).load(captureRead(options.harness,{timeoutMs:Math.max(30000,Math.ceil(artifactBefore.size/(1024*1024))*1000)}));
         this.largeCaptures.set(key,{at:started,ms:this.clock.nowMs()-started});
         await this.capture({...options,preloaded:{loaded,artifactBefore}});
       }catch(error){
@@ -560,10 +565,11 @@ export class TeamsConnector {
     const artifactSource=locator?.storage?.kind==='file'&&existsSync(locator.storage.path)?realpathSync(locator.storage.path):null;
     const artifactBefore=preloaded?preloaded.artifactBefore:artifactSource?statSync(artifactSource):null;
     const large=(artifactBefore?.size??0)>=LARGE_CAPTURE_BYTES;
-    const loaded=preloaded?preloaded.loaded:await this.core.session(locator).load(large?{timeoutMs:Math.max(30000,Math.ceil(artifactBefore.size/(1024*1024))*1000)}:undefined),configuredBackfill=rule.backfill??backfill??'all',backfillPolicy=typeof configuredBackfill==='string'?{mode:configuredBackfill,since:null}:configuredBackfill;
+    const loaded=preloaded?preloaded.loaded:await this.core.session(locator).load(captureRead(harness,large?{timeoutMs:Math.max(30000,Math.ceil(artifactBefore.size/(1024*1024))*1000)}:{})),configuredBackfill=rule.backfill??backfill??'all',backfillPolicy=typeof configuredBackfill==='string'?{mode:configuredBackfill,since:null}:configuredBackfill;
     const key=`${harness}:${nativeSessionId}`,previous=this.state.origins[key]??null;
     let messages=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});
     this.labelTurns(key,loaded.messages??loaded.turns??[],messages);
+    if (harness === 'codex' && loaded.total_message_count > messages.length) coverage = { ...coverage, completeness: 'partial', reasons: [...new Set([...coverage.reasons, 'prefix_not_captured'])] };
     // A session published without its native bundle is captured again, with the same messages, once the bundle can be built.
     const nativeWanted=backfillPolicy.mode==='all'&&typeof this.core.translateSession==='function'&&!((artifactBefore?.size??0)>NATIVE_MAX_BYTES);
     const retryNative=Boolean(previous?.native_deferred&&nativeWanted&&artifactBefore?.isFile()&&!previous?.baseline&&this.nativeReady(key,artifactBefore));

package/machine.mjs

@@ -30,6 +30,7 @@ import { appendFileSync, readFileSync, writeFileSync, writeSync, statSync, readd
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir, hostname } from 'node:os';
+import { readMailHistory } from './mail-history.mjs';
 import { randomBytes, createHash } from 'node:crypto';
 import { WebSocket } from 'ws';
 import { TmuxTerminalHost, classifyAttentionSignal, composerHoldsDraft, composerReadyForInput } from '@volter/supercode-terminal';
@@ -451,6 +452,7 @@ export class TeamsMachine extends MachineCore {
     const { admitted, principal } = entry;
     const request = stream.params?.request;
     if (request?.op === 'turn') return this.#serveTurn(entry, request, stream, accept, refuse);
+    if (request?.op === 'history') return this.#serveMailHistory(entry, request, stream, accept, refuse);
     const to = typeof request?.to === 'string' ? request.to : '*';
     const target = to.startsWith('sc:') ? `mail:${to}` : 'mail:*';
     if (!request || !['send', 'file', 'list'].includes(request.op)) return refuse('mail needs a send, file, list or turn request');
@@ -475,6 +477,24 @@ export class TeamsMachine extends MachineCore {
     child.stdin.end(JSON.stringify({ ...request, via_principal: principal ?? null }));
   }
 
+  #serveMailHistory(entry, request, stream, accept, refuse) {
+    const { admitted, principal } = entry;
+    const granted = (admitted?.grants ?? []).filter(grant => grant.caps.includes('observe')).flatMap(grant => grant.targets).filter(target => target.startsWith('session:') && target !== 'session:*');
+    const named = typeof request.harness === 'string' && typeof request.session === 'string' ? `${request.harness}/${request.session}` : granted.length === 1 ? granted[0].slice(8) : '';
+    const [harness, session, extra] = named.split('/');
+    const target = `session:${named}`;
+    if (!harness || !session || extra || !holds(admitted, 'observe', target)) return refuse('no observe grant for this session');
+    accept();
+    const controller = new AbortController();
+    stream.on('close', () => controller.abort());
+    void readMailHistory({ binary: this.supercodeBin, env: this.env, harness, session, signal: controller.signal }).then(rows => {
+      if (!stream.closed) stream.write(JSON.stringify({ code: 0, rows }));
+      this.log.append({ principal, cap: 'observe', target, outcome: 'mail-history' });
+    }, error => {
+      if (!stream.closed) stream.write(JSON.stringify({ code: 1, text: error.message }));
+    }).finally(() => { if (!stream.closed) stream.close('complete'); });
+  }
+
   #serveTurn(entry, request, stream, accept, refuse) {
     // A person's line typed into one session here as that session's own user turn (a Room member in a Conversation
     // bound to the session): `interact` on `session:<harness>/<id>`. Who typed it comes from the caller's claim
@@ -625,9 +645,9 @@ export class TeamsMachine extends MachineCore {
   }
 
   /**
-   * A session acts only on the panes it started: input, a turn, a suspend or a close from a session (`caller`, its
+   * A session acts only on the panes it started: input, a turn or a suspend from a session (`caller`, its
    * address) on a pane another session, a board or a person started is refused, naming who started it. A person (no
-   * caller) and a board (its cards' own door) act on any pane.
+   * caller) and a board (its cards' own door) act on any pane. Close is available to any holder of pane control.
    */
   /**
    * Who is calling, for the pane doors. On the local socket the daemon decides: it hands the connection to its own
@@ -1277,7 +1297,7 @@ export class TeamsMachine extends MachineCore {
         }
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
         // Who started the pane: the launching session's (or board's) address, null for a person. A session's later
-        // input and close on the pane are refused unless it is this one (#refuseForeign).
+        // input on the pane is refused unless it is this one (#refuseForeign); close is not creator-restricted.
         const by = await this.#callerOf(entry, params).catch(() => null);
         // Who to tell when the pane ends (`open --new … --notify-when-ended`): a session's mail address, and this
         // machine's name as the address a notice from its pane comes from.
@@ -1356,8 +1376,7 @@ export class TeamsMachine extends MachineCore {
         return rows;
       }
       case 'panes.close': {
-        need(operator ? 'control' : 'control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
+        need('control', `pane:${params.pane}`);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         await this.host.closeSession(session.id);

package/mail-history.mjs

@@ -0,0 +1,51 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { hostname } from 'node:os';
+import { spawn } from 'node:child_process';
+import { teamsHome } from '@volter/teams/home';
+
+// Match the CLI's local_machine_name: the native mailbox belongs to its
+// enrolled context, which can differ from a viewer connector's --home.
+function machineName(env) {
+  let name = hostname();
+  try {
+    const root = join(teamsHome(env), 'workspaces');
+    const contexts = JSON.parse(readFileSync(join(root, 'contexts.json'), 'utf8'));
+    const context = contexts.contexts[contexts.current];
+    name = JSON.parse(readFileSync(join(root, 'connectors', context.server_id, context.team_id, 'enrollment.json'), 'utf8')).machine.name || name;
+  } catch { /* An unenrolled machine's mail uses its hostname. */ }
+  return name.split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g, '-') || 'localhost';
+}
+
+/** Read actual inbound/outbound envelopes. --session is deliberately read-only;
+ * sessions.inbox acknowledges mail and must never be used by a viewer. */
+export function readMailHistory({ binary, env, harness, session, signal }) {
+  if (!/^[a-z0-9-]+$/.test(harness) || !/^[a-zA-Z0-9_-]+$/.test(session)) throw new Error('invalid session address');
+  // A local Teams preview may keep its enrollment separate from the native
+  // sessions it displays. This explicitly selects their read-only mail store.
+  if (env.SUPERCODE_SESSION_MAIL_HOME) {
+    env = { ...env, SUPERCODE_HOME: env.SUPERCODE_SESSION_MAIL_HOME };
+    delete env.SUPERCODE_TEAMS_HOME;
+  }
+  const address = `sc:${machineName(env)}:${harness}:${session}`;
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, ['message', 'inbox', '--session', address, '--json', '--recent', '100'], {
+      env, stdio: ['ignore', 'pipe', 'pipe'], signal: AbortSignal.any([signal, AbortSignal.timeout(20_000)]),
+    });
+    let out = '', error = '';
+    child.stdout.on('data', chunk => { out += chunk; if (out.length > 8_000_000) child.kill(); });
+    child.stderr.on('data', chunk => { error = (error + chunk).slice(-1000); });
+    child.on('error', reject);
+    child.on('close', code => {
+      if (code !== 0) return reject(new Error(error || 'Mailbox could not be read'));
+      try {
+        const rows = JSON.parse(out).filter(row => ['peer', 'channel'].includes(row.envelope?.kind));
+        resolve(rows.map(({ envelope, session: to, direction, delivery }) => ({
+          id: envelope.id, from: envelope.from, fromName: envelope.from_name, to,
+          text: envelope.body, at: envelope.created_at_ms, direction,
+          inReplyTo: envelope.in_reply_to ?? null, delivery: delivery?.state ?? 'unknown',
+        })));
+      } catch (error) { reject(error); }
+    });
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.112",
+  "version": "0.2.114",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",