@volter/supercode-teams 0.2.116 → 0.2.118

package/bin/teams.mjs

@@ -19,6 +19,7 @@
 //   title set <pane> <text> | title ls
 //   attention ls | rank | request <pane> [--urgency now|soon|whenever] [--reason text] | clear <pane>
 //   watch [--interval ms] [--for ms]
+//   launches get <key> | list                 operators: keyed node launch receipts
 //   rpc <harness.v1 method> [json-params]   operators: one harness.v1 request
 //   log verify
 //
@@ -44,7 +45,7 @@ import { moveWorkspace } from '../workspace-move.mjs';
 import { teamsHome, paths, readJson, AccountLog, parseHostPort } from '@volter/teams/home';
 import { NODE_PROTOCOL } from '@volter/teams/channel';
 
-const MACHINE_VERBS = new Set(['machine', 'describe', 'panes', 'input', 'suspend', 'resume', 'files', 'ports', 'port', 'browser', 'stream', 'jobs', 'workspace', 'title', 'attention', 'watch', 'rpc', 'log', 'mail']);
+const MACHINE_VERBS = new Set(['machine', 'describe', 'panes', 'input', 'suspend', 'resume', 'files', 'ports', 'port', 'browser', 'stream', 'jobs', 'workspace', 'title', 'attention', 'watch', 'rpc', 'launches', 'log', 'mail']);
 // Every flag a machine verb reads; any other is refused rather than silently ignored.
 const KNOWN_FLAGS = new Set(['home', 'machine', 'context', 'floor', 'supercode', 'tmux-socket', 'verbose', 'lines', 'input', 'name', 'for', 'urgency', 'reason', 'interrupt', 'query', 'out', 'in', 'interval', 'no-enter', 'when-composer-empty', 'key', 'listen', 'list', 'from', 'to', 'path', 'to-path']);
 
@@ -64,7 +65,7 @@ for (let i = 0; i < argv.length; i += 1) {
 }
 const [verb, sub, ...rest] = positional;
 
-const MACHINE_HELP = 'machine verbs: machine start|status, describe, panes, input, suspend, resume, files, ports, port, stream, jobs, workspace, title, attention, watch, rpc, log, browser (add --machine NAME for an enrolled machine)';
+const MACHINE_HELP = 'machine verbs: machine start|status, describe, panes, input, suspend, resume, files, ports, port, stream, jobs, workspace, title, attention, watch, rpc, launches, log, browser (add --machine NAME for an enrolled machine)';
 
 if (verb === undefined || verb === 'help') {
   process.stdout.write(`supercode teams: ${MACHINE_HELP}\n`);
@@ -312,6 +313,12 @@ async function main() {
     case 'jobs':
       // `jobs [--machine NAME]`: the execution jobs the machine's daemon owns now.
       return withNode(async (rpc) => out(await rpc.call('jobs.list', {})));
+    case 'launches': {
+      if (sub === 'get' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.get', { key: rest[0] })));
+      if (sub === 'list') return withNode(async (rpc) => out(await rpc.call('launches.list', {})));
+      die('launches get <key> | launches list [--machine NAME]');
+      return;
+    }
     case 'rpc': {
       const channel = await machineChannel();
       const client = new SupercodeHarnessClient({ transport: harnessTransport(channel) });

package/codex-startup.mjs

@@ -1,8 +1,36 @@
 // Codex can still show hook review on resume despite its invocation trust flag.
 // Act only on this exact startup menu, and never submit without reading selection.
 import { composerText } from '@volter/supercode-terminal';
+import { realpathSync } from 'node:fs';
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
+// CLI and portable SDK callers can name a directory through a filesystem alias.
+// Resolve only on the executing machine, before the native seed/server is built.
+export function canonicalCodexFolderTrust(cwd, args = []) {
+  if (typeof cwd !== 'string' || !cwd) return args;
+  const grant = `projects={${JSON.stringify(cwd)}={trust_level="trusted"}}`;
+  const projects = [];
+  for (let i = 0; i < args.length && args[i] !== '--'; i += 1) {
+    const arg = args[i];
+    if (arg === '-c' || arg === '--config') {
+      const value = args[++i];
+      if (value?.startsWith('projects')) projects.push({ index: i, value, prefix: '' });
+    } else if (arg.startsWith('--config=')) {
+      const value = arg.slice('--config='.length);
+      if (value.startsWith('projects')) projects.push({ index: i, value, prefix: '--config=' });
+    }
+  }
+  // A custom table, an untrusted grant or multiple overrides belongs to the caller.
+  if (projects.length !== 1 || projects[0].value !== grant) return args;
+  let effective;
+  try { effective = realpathSync(cwd); } catch { return args; }
+  if (effective === cwd) return args;
+  const out = [...args];
+  const { index, prefix } = projects[0];
+  out[index] = `${prefix}projects={${JSON.stringify(effective)}={trust_level="trusted"}}`;
+  return out;
+}
+
 function hookReview(screen) {
   const lines = String(screen).split('\n').map((line) => line.trim()).filter(Boolean);
   const start = lines.lastIndexOf('Hooks need review');

package/machine.mjs

@@ -50,7 +50,7 @@ import { DEFAULT_RANK, normalizeRank, judge } from './attention.mjs';
 import { popupTerminal, openPopup } from './popup-terminals.mjs';
 import { JobOwner, executionCapabilities, streamProgram, serveWorkspace } from './execution.mjs';
 import { confirmNativeInitialInput } from './native-initial-input.mjs';
-import { settleCodexHookReview } from './codex-startup.mjs';
+import { canonicalCodexFolderTrust, settleCodexHookReview } from './codex-startup.mjs';
 
 /** The preload every launched pane carries: it announces the ports a pane's node processes listen on. */
 const PORTHOLE_HOOK = fileURLToPath(new URL('./porthole-hook.cjs', import.meta.url));
@@ -1326,6 +1326,7 @@ export class TeamsMachine extends MachineCore {
         let session;
         let nativeInput;
         try {
+          if (params.kind === 'codex') params = { ...params, arguments: canonicalCodexFolderTrust(params.cwd, params.arguments) };
           session = await this.host.createSession({
             command: this.#nativeQuestionCommand(params, contextKey, by, (value) => { nativeInput = value; }),
             contextKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.116",
+  "version": "0.2.118",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",