@volter/supercode-teams 0.2.115 → 0.2.117

package/codex-startup.mjs

@@ -1,8 +1,36 @@
 // Codex can still show hook review on resume despite its invocation trust flag.
 // Act only on this exact startup menu, and never submit without reading selection.
 import { composerText } from '@volter/supercode-terminal';
+import { realpathSync } from 'node:fs';
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
+// CLI and portable SDK callers can name a directory through a filesystem alias.
+// Resolve only on the executing machine, before the native seed/server is built.
+export function canonicalCodexFolderTrust(cwd, args = []) {
+  if (typeof cwd !== 'string' || !cwd) return args;
+  const grant = `projects={${JSON.stringify(cwd)}={trust_level="trusted"}}`;
+  const projects = [];
+  for (let i = 0; i < args.length && args[i] !== '--'; i += 1) {
+    const arg = args[i];
+    if (arg === '-c' || arg === '--config') {
+      const value = args[++i];
+      if (value?.startsWith('projects')) projects.push({ index: i, value, prefix: '' });
+    } else if (arg.startsWith('--config=')) {
+      const value = arg.slice('--config='.length);
+      if (value.startsWith('projects')) projects.push({ index: i, value, prefix: '--config=' });
+    }
+  }
+  // A custom table, an untrusted grant or multiple overrides belongs to the caller.
+  if (projects.length !== 1 || projects[0].value !== grant) return args;
+  let effective;
+  try { effective = realpathSync(cwd); } catch { return args; }
+  if (effective === cwd) return args;
+  const out = [...args];
+  const { index, prefix } = projects[0];
+  out[index] = `${prefix}projects={${JSON.stringify(effective)}={trust_level="trusted"}}`;
+  return out;
+}
+
 function hookReview(screen) {
   const lines = String(screen).split('\n').map((line) => line.trim()).filter(Boolean);
   const start = lines.lastIndexOf('Hooks need review');

package/machine.mjs

@@ -50,7 +50,7 @@ import { DEFAULT_RANK, normalizeRank, judge } from './attention.mjs';
 import { popupTerminal, openPopup } from './popup-terminals.mjs';
 import { JobOwner, executionCapabilities, streamProgram, serveWorkspace } from './execution.mjs';
 import { confirmNativeInitialInput } from './native-initial-input.mjs';
-import { settleCodexHookReview } from './codex-startup.mjs';
+import { canonicalCodexFolderTrust, settleCodexHookReview } from './codex-startup.mjs';
 
 /** The preload every launched pane carries: it announces the ports a pane's node processes listen on. */
 const PORTHOLE_HOOK = fileURLToPath(new URL('./porthole-hook.cjs', import.meta.url));
@@ -1326,6 +1326,7 @@ export class TeamsMachine extends MachineCore {
         let session;
         let nativeInput;
         try {
+          if (params.kind === 'codex') params = { ...params, arguments: canonicalCodexFolderTrust(params.cwd, params.arguments) };
           session = await this.host.createSession({
             command: this.#nativeQuestionCommand(params, contextKey, by, (value) => { nativeInput = value; }),
             contextKey,

package/mail-history.mjs

@@ -4,6 +4,47 @@ import { hostname } from 'node:os';
 import { spawn } from 'node:child_process';
 import { teamsHome } from '@volter/teams/home';
 
+const directories = new Map();
+function sessionDirectory(binary, env, signal) {
+  const key = `${binary}:${teamsHome(env)}`;
+  const cached = directories.get(key);
+  if (cached && cached.until > Date.now()) return cached.value;
+  const value = new Promise((resolve, reject) => {
+    const child = spawn(binary, ['message', 'list', '--json'], { env, signal: AbortSignal.any([...(signal ? [signal] : []), AbortSignal.timeout(15_000)]), stdio: ['ignore', 'pipe', 'ignore'] });
+    let out = '';
+    child.stdout.on('data', chunk => { out += chunk; if (out.length > 4_000_000) child.kill(); });
+    child.on('error', reject);
+    child.on('close', code => { try { if (code !== 0) throw new Error('Session directory unavailable'); resolve(JSON.parse(out)); } catch (error) { reject(error); } });
+  }).catch(() => []);
+  directories.set(key, { until: Date.now() + 60_000, value });
+  return value;
+}
+
+/** Resolve from supercode's existing session directory and explicit voice
+ * backing, never by interpreting an operator mailbox's generated name. */
+function mailActors(rows, sessions, self) {
+  const directory = new Map(sessions.map(session => [session.address, session]));
+  const voices = new Map(rows.filter(row => row.envelope.voice_for).map(row => [row.envelope.from, row.envelope.voice_for]));
+  const names = new Map(rows.map(row => [row.envelope.from, row.envelope.from_name]));
+  const actor = (address) => {
+    const backing = voices.get(address) || address;
+    const native = /^sc:([^:]+):([^:]+):(.+)$/.exec(backing);
+    const session = directory.get(backing);
+    const kind = native && !['operator', 'board', 'pane'].includes(native[2]) ? 'agent' : 'automation';
+    let name = session?.name || names.get(backing) || (native?.[2] === 'board' ? 'Board' : kind === 'agent' ? native[2] : 'Automation');
+    if (native && name.endsWith(`@${native[1]}`)) name = name.slice(0, -native[1].length - 1);
+    // An unnamed session gets its harness label, not its address as a name.
+    if (/^(?:codex|claude-code|claude|gemini|pi|goose|grok|opencode)-[0-9a-f]{8,}$/i.test(name)) name = native[2] === 'codex' ? 'Codex' : native[2];
+    return { id: backing, name, kind, self: backing === self, ...(native ? { session: { machine: native[1], harness: native[2], id: native[3] } } : {}), ...(voices.has(address) ? { via: 'voice' } : {}) };
+  };
+  return rows.map(({ envelope, session: to, direction, delivery }) => ({
+    id: envelope.id, from: envelope.from, fromName: envelope.from_name, to,
+    fromActor: actor(envelope.from), toActor: actor(to),
+    text: envelope.body, at: envelope.created_at_ms, direction,
+    inReplyTo: envelope.in_reply_to ?? null, delivery: delivery?.state ?? 'unknown',
+  }));
+}
+
 // Match the CLI's local_machine_name: the native mailbox belongs to its
 // enrolled context, which can differ from a viewer connector's --home.
 function machineName(env) {
@@ -30,21 +71,17 @@ export function readMailHistory({ binary, env, harness, session, signal }) {
   const address = `sc:${machineName(env)}:${harness}:${session}`;
   return new Promise((resolve, reject) => {
     const child = spawn(binary, ['message', 'inbox', '--session', address, '--json', '--recent', '100'], {
-      env, stdio: ['ignore', 'pipe', 'pipe'], signal: AbortSignal.any([signal, AbortSignal.timeout(20_000)]),
+      env, stdio: ['ignore', 'pipe', 'pipe'], signal: AbortSignal.any([...(signal ? [signal] : []), AbortSignal.timeout(20_000)]),
     });
     let out = '', error = '';
     child.stdout.on('data', chunk => { out += chunk; if (out.length > 8_000_000) child.kill(); });
     child.stderr.on('data', chunk => { error = (error + chunk).slice(-1000); });
     child.on('error', reject);
-    child.on('close', code => {
+    child.on('close', async code => {
       if (code !== 0) return reject(new Error(error || 'Mailbox could not be read'));
       try {
         const rows = JSON.parse(out).filter(row => ['peer', 'channel'].includes(row.envelope?.kind));
-        resolve(rows.map(({ envelope, session: to, direction, delivery }) => ({
-          id: envelope.id, from: envelope.from, fromName: envelope.from_name, to,
-          text: envelope.body, at: envelope.created_at_ms, direction,
-          inReplyTo: envelope.in_reply_to ?? null, delivery: delivery?.state ?? 'unknown',
-        })));
+        resolve(mailActors(rows, await sessionDirectory(binary, env, signal), address));
       } catch (error) { reject(error); }
     });
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.115",
+  "version": "0.2.117",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",