@volter/supercode-teams 0.2.156 → 0.2.158

package/README.md

@@ -47,7 +47,11 @@ a kind another product serves on the same machine. `title.set` needs `control` o
 
 A workplace can open one pane or one folder for someone who is not a member of the team. A
 server started with `--delegated-issuer ORIGIN` (the Worker's `DELEGATED_ISSUER`) trusts short-lived
-tokens that issuer signs (Ed25519, keys at `ORIGIN/.well-known/jwks.json`, audience this server's
+tokens that issuer signs. `--delegated-issuers ORIGIN,ORIGIN` (the Worker's
+`DELEGATED_ISSUERS`) adds an explicit list of trusted origins; the legacy singular setting
+remains supported. Keys are cached separately per origin, and each token must match a
+publication or session binding for that exact issuer. Staging never opens a production
+binding or publication. Tokens use Ed25519 (keys at `ORIGIN/.well-known/jwks.json`, audience this server's
 public origin), each naming a pane (`pane:<key>`) or a folder (`root:/path`) on one machine of one
 team, and `view` or `control`. A token opens only a surface the machine's custodian **published** on
 this server (the machine's publications, `/machines/{id}/publications`): the same team, machine and

package/bin/workspace/args.mjs

@@ -10,8 +10,8 @@ const VALUES = new Set([
   'source', 'cursor', 'limit', 'tail', 'before', 'after', 'revision', 'role',
   'out', 'ttl', 'type', 'name', 'visibility', 'backfill', 'format', 'to',
   'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session',
-  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'delegated-issuer', 'workplace', 'organization', 'key', 'room',
-  'conversation', 'rh2', 'scope',
+  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'delegated-issuer', 'delegated-issuers', 'workplace', 'organization', 'key', 'room',
+  'conversation', 'rh2', 'scope', 'agent',
 ]);
 
 export function parseArgs(argv) {

package/bin/workspace.mjs

@@ -120,7 +120,7 @@ async function serverCommand({ flags, sub, rest, home, output }) {
   // The Node host's store is node:sqlite (Node 22.5+); only this verb loads it, so every client
   // verb runs on the Node 20 the package declares.
   const { createTeamsServer } = await import('../server/index.mjs');
-  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, identityIssuer: flags.volter_issuer ?? null, delegatedIssuer: flags.delegated_issuer ?? null, ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
+  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, identityIssuer: flags.volter_issuer ?? null, delegatedIssuer: flags.delegated_issuer ?? null, delegatedIssuers: flags.delegated_issuers?.split(',').map(origin => origin.trim()) ?? [], ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
   output(await server.start());
   await new Promise(resolveStop => { const stop = async () => { await server.close(); resolveStop(); }; process.once('SIGINT', stop); process.once('SIGTERM', stop); });
 }
@@ -999,7 +999,7 @@ function printHelp() {
   auth login|status|switch|logout   (one Volter sign-in; "supercode login" is "auth login")
   login [ORIGIN] [--team TEAM] [--as CONTEXT] [--token-stdin|--invite-stdin]   (Volter sign-in in the browser by default)
   identity link
-  server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN]
+  server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN] [--delegated-issuers ORIGIN,ORIGIN]
   publish pane|root TARGET --room ROOM --workplace ORIGIN --organization ORG [--scope view|control] [--name] [--key] [--machine] [--token-stdin] [--record-only]
   unpublish SURFACE --room ROOM --workplace ORIGIN --organization ORG [--machine] [--token-stdin] [--record-only|--workplace-only]
   connect|disconnect|status

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.156",
+  "version": "0.2.158",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/harness-routes.mjs

@@ -406,7 +406,7 @@ async function viewBindingRoute(api,req,res,auth,ref,requestId){
   if(session.custodian_id!==auth.principal_id)fail(403,'forbidden',"only the session's owner binds it to a view");
   const body=await parseJson(req);exact(body,['issuer','room','conversation']);
   if(typeof body.room!=='string'||!body.room||typeof body.conversation!=='string'||!body.conversation)fail(400,'invalid_request','room and conversation are required');
-  if(!api.delegatedIssuer||body.issuer!==api.delegatedIssuer)fail(400,'invalid_request',`this server accepts views signed by ${api.delegatedIssuer??'no workplace'}`);
+  if(!api.delegatedIssuers.includes(body.issuer))fail(400,'invalid_request',`this server accepts views signed by ${api.delegatedIssuers.join(', ')||'no workplace'}`);
   const key=[auth.team_id,session.id,body.issuer,body.room,body.conversation];
   await api.store.transaction(req.method==='POST'
     ?[{sql:'INSERT OR IGNORE INTO session_view_bindings(team_id,session_id,issuer,room,conversation,bound_by,created_at) VALUES (?,?,?,?,?,?,?)',params:[...key,auth.principal_id,api.clock.nowMs()]}]

package/server/index.mjs

@@ -16,12 +16,12 @@ import { createTeamsApi, bootstrapServer, maintain, normalizePublicOrigin, produ
 
 function atomicJson(path,value){const tmp=`${path}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`;let fd;try{fd=openSync(tmp,'wx',0o600);writeFileSync(fd,JSON.stringify(value,null,2)+'\n');closeSync(fd);fd=undefined;renameSync(tmp,path);chmodSync(path,0o600);}catch(error){if(fd!==undefined)closeSync(fd);try{unlinkSync(tmp);}catch{}throw error;}}
 
-export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,identityIssuer=null,delegatedIssuer=null,clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
+export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,identityIssuer=null,delegatedIssuer=null,delegatedIssuers=[],clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
   if(!dataDir) throw new TypeError('dataDir is required');
   const loopback=['127.0.0.1','::1','localhost'].includes(listen.host??'127.0.0.1');
   publicOrigin=normalizePublicOrigin(publicOrigin);
   if(!loopback&&!publicOrigin?.startsWith('https:'))throw new TypeError('non-loopback Teams servers require an HTTPS publicOrigin');
-  const api=createTeamsApi({clock,ids,publicOrigin,identityIssuer,identityOrganizations:identityIssuer?identityOrganizationsFromEnv(process.env):null,delegatedIssuer,uploadLimitBytes});
+  const api=createTeamsApi({clock,ids,publicOrigin,identityIssuer,identityOrganizations:identityIssuer?identityOrganizationsFromEnv(process.env):null,delegatedIssuer,delegatedIssuers,uploadLimitBytes});
   // The harness's own routes on this server (harness-routes.mjs); the handler owns the neutral ones.
   api.attach({harnessRoutes});
   const events=api.events;

package/terminal-mail.mjs

@@ -14,6 +14,7 @@ function confirmed(batch) {
     let offset = batch.offset, buffered = '';
     const decoder = new StringDecoder('utf8');
     const bytes = Buffer.alloc(64 * 1024);
+    let matched = 0, fragments = 0;
     for (;;) {
       const count = readSync(fd, bytes, 0, bytes.length, offset);
       if (!count) return false;
@@ -24,7 +25,22 @@ function confirmed(batch) {
         let row; try { row = JSON.parse(line); } catch { continue; }
         const content = batch.kind === 'codex' && row.type === 'response_item' && row.payload?.type === 'message' && row.payload.role === 'user'
           ? row.payload.content : batch.kind === 'grok' && row.type === 'user' ? row.content : null;
-        if (textOf(content) === batch.text) return true;
+        const text = textOf(content);
+        if (text === null || text.length === 0) continue;
+        if (text === batch.text) return { fragments: 1 };
+        // Older mail delivery omitted the paste delimiter, so terminal newlines
+        // submitted one envelope as several native user messages. Recover only
+        // exact, ordered fragments of the retained bytes, separated by original
+        // newlines. Never infer delivery from an id, substring or empty composer.
+        let next = matched;
+        while (next < batch.text.length && batch.text[next] === '\n') next++;
+        if (matched && batch.text.startsWith(text, next)) {
+          matched = next + text.length; fragments++;
+        } else if (batch.text.startsWith(text)) {
+          matched = text.length; fragments = 1;
+        } else { matched = 0; fragments = 0; }
+        if (matched === batch.text.length) return { fragments };
+
       }
     }
   } finally { closeSync(fd); }
@@ -50,7 +66,7 @@ export class TerminalMailbox {
     const delivered = ids.every(id => this.state.receipts.some(r => r.message_ids.includes(id)));
     const batch = this.state.active;
     return { delivered, queued: !delivered, message_ids: ids,
-      ...(delivered ? { receipt: 'native-user-message' } : { reason: batch?.error ?? 'queued', batch: batch?.id ?? null }) };
+      ...(delivered ? { receipt: this.state.receipts.some(r => r.receipt === 'native-user-messages' && r.message_ids.some(id => ids.includes(id))) ? 'native-user-messages' : 'native-user-message' } : { reason: batch?.error ?? 'queued', batch: batch?.id ?? null }) };
   }
   enqueue(text, ids, identity, host, session) {
     const messageIds = ids?.length ? ids : [`input-${randomUUID()}`];
@@ -95,7 +111,7 @@ export class TerminalMailbox {
     if (!batch) return;
     const seen = batch.offset !== null ? confirmed(batch) : (await this.load(batch.locator, { message_offset: batch.messageOffset, message_limit: 1000 })).session?.messages?.some(message => message.role === 'user' && textOf(message.content) === batch.text);
     if (seen) {
-      const receipt = { batch: batch.id, message_ids: batch.message_ids, delivered: true, receipt: 'native-user-message', at: Date.now() };
+      const receipt = { batch: batch.id, message_ids: batch.message_ids, delivered: true, receipt: seen.fragments > 1 ? 'native-user-messages' : 'native-user-message', fragments: seen.fragments ?? 1, at: Date.now() };
       appendFileSync(join(this.dir, 'receipts.jsonl'), JSON.stringify(receipt) + '\n', { mode: 0o600 });
       this.state.receipts.push(receipt);
       this.state.active = null; this.save(); this.log(receipt); return;
@@ -104,7 +120,9 @@ export class TerminalMailbox {
       // Persist uncertainty before I/O. A daemon restart checks the transcript;
       // it never guesses that an unacknowledged paste did not happen.
       batch.phase = 'paste_started'; this.save();
-      await this.host.sendInput(this.session.id, batch.text, { submitMode: 'none' });
+      // The terminal host's final newline selects one bracketed paste;
+      // submitMode:none holds the separate Enter until the paste completes.
+      await this.host.sendInput(this.session.id, `${batch.text}\n`, { submitMode: 'none' });
       batch.phase = 'pasted'; this.save();
     }
     if (batch.phase === 'paste_started') {

package/worker/index.mjs

@@ -81,7 +81,7 @@ export class TeamsServer extends DurableObject {
       console.log(`storage: database_bytes=${ctx.storage.sql.databaseSize}`);
       const db = durableSql(ctx.storage);
       migrate({ exec: db.exec, tx: db.tx, version: () => ctx.storage.kv.get('schema_version') ?? 0, setVersion: (n) => ctx.storage.kv.put('schema_version', n) });
-      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), identityIssuer: env.VOLTER_ISSUER || null, identityOrganizations: identityOrganizationsFromEnv(env), delegatedIssuer: env.DELEGATED_ISSUER || null });
+      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), identityIssuer: env.VOLTER_ISSUER || null, identityOrganizations: identityOrganizationsFromEnv(env), delegatedIssuer: env.DELEGATED_ISSUER || null, delegatedIssuers: env.DELEGATED_ISSUERS ? env.DELEGATED_ISSUERS.split(',').map(origin => origin.trim()) : [] });
       this.api.storageUsage = () => {
         const sql = ctx.storage.sql;
         let freeBytes = null;

package/worker/wrangler.toml

@@ -4,20 +4,24 @@
 #     --var PUBLIC_ORIGIN:https://<worker>.<account>.workers.dev --var INIT_TEAM:<first team>
 # The token printed above is the owner's first credential (`supercode teams login <origin> --token-stdin`).
 #
-# A deployment's variables live with the deployment (the first deploy's --var, or the dashboard), not here:
-# keep_vars leaves them in place, so a later deploy of new code never resets its origin or issuers.
+# Origin and identity variables are retained with keep_vars. The explicit delegated
+# allowlist below is versioned and installed by deploy-teams CI.
 #   PUBLIC_ORIGIN     the https origin the Worker is served at (required)
 #   INIT_TEAM         the first team's name, used once at bootstrap
 #   VOLTER_ISSUER     optional: members sign in with Volter (supercode teams login --volter); the issuer
 #                     must have this origin registered as a resource
 #   DELEGATED_ISSUER  optional: a workplace (RH2) whose delegated tokens open published panes and folders and
 #                     bound sessions; its keys are at <issuer>/.well-known/jwks.json
+#   DELEGATED_ISSUERS comma-separated exact origins, additive with legacy DELEGATED_ISSUER
 name = "supercode-teams"
 main = "index.mjs"
 compatibility_date = "2026-09-01"
 compatibility_flags = ["nodejs_compat"]
 keep_vars = true
 
+[vars]
+DELEGATED_ISSUERS = "https://pilot.runhuman.com,https://rh2-staging.voltertest.xyz"
+
 # Workers Logs: the Worker's log lines (viewer-error, session-view refused, maintain) kept and searchable after the fact.
 [observability]
 enabled = true