@volter/supercode-teams 0.2.155 → 0.2.157

package/README.md

@@ -47,7 +47,11 @@ a kind another product serves on the same machine. `title.set` needs `control` o
 
 A workplace can open one pane or one folder for someone who is not a member of the team. A
 server started with `--delegated-issuer ORIGIN` (the Worker's `DELEGATED_ISSUER`) trusts short-lived
-tokens that issuer signs (Ed25519, keys at `ORIGIN/.well-known/jwks.json`, audience this server's
+tokens that issuer signs. `--delegated-issuers ORIGIN,ORIGIN` (the Worker's
+`DELEGATED_ISSUERS`) adds an explicit list of trusted origins; the legacy singular setting
+remains supported. Keys are cached separately per origin, and each token must match a
+publication or session binding for that exact issuer. Staging never opens a production
+binding or publication. Tokens use Ed25519 (keys at `ORIGIN/.well-known/jwks.json`, audience this server's
 public origin), each naming a pane (`pane:<key>`) or a folder (`root:/path`) on one machine of one
 team, and `view` or `control`. A token opens only a surface the machine's custodian **published** on
 this server (the machine's publications, `/machines/{id}/publications`): the same team, machine and

package/bin/workspace/args.mjs

@@ -10,8 +10,8 @@ const VALUES = new Set([
   'source', 'cursor', 'limit', 'tail', 'before', 'after', 'revision', 'role',
   'out', 'ttl', 'type', 'name', 'visibility', 'backfill', 'format', 'to',
   'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session',
-  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'delegated-issuer', 'workplace', 'organization', 'key', 'room',
-  'conversation', 'rh2', 'scope',
+  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'delegated-issuer', 'delegated-issuers', 'workplace', 'organization', 'key', 'room',
+  'conversation', 'rh2', 'scope', 'agent',
 ]);
 
 export function parseArgs(argv) {

package/bin/workspace.mjs

@@ -120,7 +120,7 @@ async function serverCommand({ flags, sub, rest, home, output }) {
   // The Node host's store is node:sqlite (Node 22.5+); only this verb loads it, so every client
   // verb runs on the Node 20 the package declares.
   const { createTeamsServer } = await import('../server/index.mjs');
-  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, identityIssuer: flags.volter_issuer ?? null, delegatedIssuer: flags.delegated_issuer ?? null, ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
+  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, identityIssuer: flags.volter_issuer ?? null, delegatedIssuer: flags.delegated_issuer ?? null, delegatedIssuers: flags.delegated_issuers?.split(',').map(origin => origin.trim()) ?? [], ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
   output(await server.start());
   await new Promise(resolveStop => { const stop = async () => { await server.close(); resolveStop(); }; process.once('SIGINT', stop); process.once('SIGTERM', stop); });
 }
@@ -999,7 +999,7 @@ function printHelp() {
   auth login|status|switch|logout   (one Volter sign-in; "supercode login" is "auth login")
   login [ORIGIN] [--team TEAM] [--as CONTEXT] [--token-stdin|--invite-stdin]   (Volter sign-in in the browser by default)
   identity link
-  server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN]
+  server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN] [--delegated-issuers ORIGIN,ORIGIN]
   publish pane|root TARGET --room ROOM --workplace ORIGIN --organization ORG [--scope view|control] [--name] [--key] [--machine] [--token-stdin] [--record-only]
   unpublish SURFACE --room ROOM --workplace ORIGIN --organization ORG [--machine] [--token-stdin] [--record-only|--workplace-only]
   connect|disconnect|status

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.155",
+  "version": "0.2.157",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/harness-routes.mjs

@@ -359,14 +359,17 @@ async function captureCommit(api,req,res,auth,sourceId,captureId,requestId){cons
     carriedRevision = session.revision;
     const hash = createHash('sha256').update('['), sent = new Set(messages.map(m => m.native_key));
     while (carriedCount < count) {
-      const row = await api.store.one(`SELECT ordinal,source_id,native_key,recorded_at,value_json FROM messages m
-        WHERE m.team_id=? AND m.session_id=? AND ${MESSAGE_AT()} AND m.ordinal=?`,
-        [auth.team_id, origin.session_id, carriedRevision, carriedRevision, carriedCount]);
-      if (!row || row.source_id !== sourceId) fail(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
-      if (sent.has(row.native_key)) fail(409, 'capture_conflict', 'duplicate native message key');
-      if (carriedCount) hash.update(',');
-      hash.update(canonicalJson({native_key:row.native_key, recorded_at:row.recorded_at ?? null, value:JSON.parse(row.value_json)}));
-      carriedCount++;
+      const page = await api.store.query(`SELECT ordinal,source_id,native_key,recorded_at,value_json FROM messages m
+        WHERE m.team_id=? AND m.session_id=? AND m.ordinal>=? AND m.ordinal<? AND ${MESSAGE_AT()} ORDER BY m.ordinal LIMIT 16`,
+        [auth.team_id, origin.session_id, carriedCount, count, carriedRevision, carriedRevision]);
+      if (!page.length) fail(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
+      for (const row of page) {
+        if (row.ordinal !== carriedCount || row.source_id !== sourceId) fail(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
+        if (sent.has(row.native_key)) fail(409, 'capture_conflict', 'duplicate native message key');
+        if (carriedCount) hash.update(',');
+        hash.update(canonicalJson({native_key:row.native_key, recorded_at:row.recorded_at ?? null, value:JSON.parse(row.value_json)}));
+        carriedCount++;
+      }
     }
     if (hash.update(']').digest('hex') !== digest) fail(409, 'carry_mismatch', 'the carried messages are not what this session holds; send the capture whole');
   }
@@ -403,7 +406,7 @@ async function viewBindingRoute(api,req,res,auth,ref,requestId){
   if(session.custodian_id!==auth.principal_id)fail(403,'forbidden',"only the session's owner binds it to a view");
   const body=await parseJson(req);exact(body,['issuer','room','conversation']);
   if(typeof body.room!=='string'||!body.room||typeof body.conversation!=='string'||!body.conversation)fail(400,'invalid_request','room and conversation are required');
-  if(!api.delegatedIssuer||body.issuer!==api.delegatedIssuer)fail(400,'invalid_request',`this server accepts views signed by ${api.delegatedIssuer??'no workplace'}`);
+  if(!api.delegatedIssuers.includes(body.issuer))fail(400,'invalid_request',`this server accepts views signed by ${api.delegatedIssuers.join(', ')||'no workplace'}`);
   const key=[auth.team_id,session.id,body.issuer,body.room,body.conversation];
   await api.store.transaction(req.method==='POST'
     ?[{sql:'INSERT OR IGNORE INTO session_view_bindings(team_id,session_id,issuer,room,conversation,bound_by,created_at) VALUES (?,?,?,?,?,?,?)',params:[...key,auth.principal_id,api.clock.nowMs()]}]

package/server/index.mjs

@@ -16,12 +16,12 @@ import { createTeamsApi, bootstrapServer, maintain, normalizePublicOrigin, produ
 
 function atomicJson(path,value){const tmp=`${path}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`;let fd;try{fd=openSync(tmp,'wx',0o600);writeFileSync(fd,JSON.stringify(value,null,2)+'\n');closeSync(fd);fd=undefined;renameSync(tmp,path);chmodSync(path,0o600);}catch(error){if(fd!==undefined)closeSync(fd);try{unlinkSync(tmp);}catch{}throw error;}}
 
-export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,identityIssuer=null,delegatedIssuer=null,clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
+export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,identityIssuer=null,delegatedIssuer=null,delegatedIssuers=[],clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
   if(!dataDir) throw new TypeError('dataDir is required');
   const loopback=['127.0.0.1','::1','localhost'].includes(listen.host??'127.0.0.1');
   publicOrigin=normalizePublicOrigin(publicOrigin);
   if(!loopback&&!publicOrigin?.startsWith('https:'))throw new TypeError('non-loopback Teams servers require an HTTPS publicOrigin');
-  const api=createTeamsApi({clock,ids,publicOrigin,identityIssuer,identityOrganizations:identityIssuer?identityOrganizationsFromEnv(process.env):null,delegatedIssuer,uploadLimitBytes});
+  const api=createTeamsApi({clock,ids,publicOrigin,identityIssuer,identityOrganizations:identityIssuer?identityOrganizationsFromEnv(process.env):null,delegatedIssuer,delegatedIssuers,uploadLimitBytes});
   // The harness's own routes on this server (harness-routes.mjs); the handler owns the neutral ones.
   api.attach({harnessRoutes});
   const events=api.events;

package/worker/index.mjs

@@ -81,7 +81,7 @@ export class TeamsServer extends DurableObject {
       console.log(`storage: database_bytes=${ctx.storage.sql.databaseSize}`);
       const db = durableSql(ctx.storage);
       migrate({ exec: db.exec, tx: db.tx, version: () => ctx.storage.kv.get('schema_version') ?? 0, setVersion: (n) => ctx.storage.kv.put('schema_version', n) });
-      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), identityIssuer: env.VOLTER_ISSUER || null, identityOrganizations: identityOrganizationsFromEnv(env), delegatedIssuer: env.DELEGATED_ISSUER || null });
+      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), identityIssuer: env.VOLTER_ISSUER || null, identityOrganizations: identityOrganizationsFromEnv(env), delegatedIssuer: env.DELEGATED_ISSUER || null, delegatedIssuers: env.DELEGATED_ISSUERS ? env.DELEGATED_ISSUERS.split(',').map(origin => origin.trim()) : [] });
       this.api.storageUsage = () => {
         const sql = ctx.storage.sql;
         let freeBytes = null;

package/worker/wrangler.toml

@@ -4,20 +4,24 @@
 #     --var PUBLIC_ORIGIN:https://<worker>.<account>.workers.dev --var INIT_TEAM:<first team>
 # The token printed above is the owner's first credential (`supercode teams login <origin> --token-stdin`).
 #
-# A deployment's variables live with the deployment (the first deploy's --var, or the dashboard), not here:
-# keep_vars leaves them in place, so a later deploy of new code never resets its origin or issuers.
+# Origin and identity variables are retained with keep_vars. The explicit delegated
+# allowlist below is versioned and installed by deploy-teams CI.
 #   PUBLIC_ORIGIN     the https origin the Worker is served at (required)
 #   INIT_TEAM         the first team's name, used once at bootstrap
 #   VOLTER_ISSUER     optional: members sign in with Volter (supercode teams login --volter); the issuer
 #                     must have this origin registered as a resource
 #   DELEGATED_ISSUER  optional: a workplace (RH2) whose delegated tokens open published panes and folders and
 #                     bound sessions; its keys are at <issuer>/.well-known/jwks.json
+#   DELEGATED_ISSUERS comma-separated exact origins, additive with legacy DELEGATED_ISSUER
 name = "supercode-teams"
 main = "index.mjs"
 compatibility_date = "2026-09-01"
 compatibility_flags = ["nodejs_compat"]
 keep_vars = true
 
+[vars]
+DELEGATED_ISSUERS = "https://pilot.runhuman.com,https://rh2-staging.voltertest.xyz"
+
 # Workers Logs: the Worker's log lines (viewer-error, session-view refused, maintain) kept and searchable after the fact.
 [observability]
 enabled = true