@volter/supercode-teams 0.2.166 → 0.2.167

package/bin/workspace/args.mjs

@@ -1,6 +1,6 @@
 const BOOLEANS = new Set([
   'json', 'help', 'live', 'saved', 'watch', 'paginate', 'token-stdin',
-  'invite-stdin', 'include-children', 'rotate', 'install', 'force',
+  'invite-stdin', 'enrollment-stdin', 'include-children', 'rotate', 'install', 'force',
   'take-control', 'dry-run', 'volter', 'foreground', 'no-connect', 'record-only', 'workplace-only',
 ]);
 
@@ -11,7 +11,7 @@ const VALUES = new Set([
   'out', 'ttl', 'type', 'name', 'visibility', 'backfill', 'format', 'to',
   'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session',
   'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'workplace', 'organization', 'key', 'room',
-  'conversation', 'rh2', 'scope', 'agent', 'body-file',
+  'conversation', 'rh2', 'scope', 'agent', 'body-file', 'enrollment',
 ]);
 
 export function parseArgs(argv) {

package/bin/workspace.mjs

@@ -2,7 +2,7 @@
 import { hostname } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { existsSync, readFileSync, realpathSync, rmSync } from 'node:fs';
-import { basename, join, resolve } from 'node:path';
+import { basename, isAbsolute, join, resolve } from 'node:path';
 import { execFileSync, spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
@@ -47,6 +47,7 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   if (verb === 'server') return serverCommand({ flags, sub, rest, home, output });
   if (verb === 'login') return loginCommand({ flags, origin: sub, rest, home, output });
   if (verb === 'auth') return authCommand({ flags, sub, rest, home, contexts, output, env, dependencies });
+  if (verb === 'connect' && flags.enrollment_stdin) adoptEnrollment(contexts, home, flags);
   const explicitContext = flags.context ?? env.SUPERCODE_CONTEXT;
   let selected = explicitContext ?? contexts.read().current;
   const urlReference = verb === 'sessions' ? rest.find(value => /^https?:\/\//.test(value)) : null;
@@ -55,6 +56,8 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   if (selected === 'local') return localCommand({ verb, sub, rest, flags, output });
   const { client, context } = fromContext({ supercodeHome: home, name: selected, fetch: globalThis.fetch });
   const team = client.team(context.team_id);
+  // A machine-only context (a box enrolled by its custodian) holds its machine credential and nothing a person has.
+  if (context.machine_only && !['connect', 'disconnect', 'status'].includes(verb)) usage(`context ${selected} is machine ${context.machine_name}'s: run teams ${verb} where a person is signed in`);
   const command = { flags, rest, output, client, context, team, explicitContext, home, contextName: selected, env, dependencies };
   if (teamsPrefix && ['list', 'create'].includes(verb)) return teamsCommand(verb, sub, command);
   if (verb === 'apps' || verb === 'app-installations') return appsCommand(verb,sub,{...command,output:value=>output(flags.json?value:redactAppSecrets(value))});
@@ -588,6 +591,26 @@ async function sourcesCommand(sub, command) {
 }
 
 async function machinesCommand(sub, { flags, rest, output, client, context, team }) {
+  if (sub === 'remove') {
+    // The custodian revokes a machine: its credentials, links and grants end, and every later door is refused.
+    requireArgs(rest, 1, 1, 'teams machines remove MACHINE_ID'); const current = await team.machines.get(rest[0]);
+    await client.request('DELETE', teamPath(context, `/machines/${rest[0]}`), { ifMatch: current.data.revision });
+    return output({ version: 1, context: scope(context), data: { removed: rest[0] } });
+  }
+  if (sub === 'enroll') {
+    // The signed-in person enrolls another machine as its custodian. The file carries only that machine's own
+    // credential; the machine connects from it (teams connect --enrollment-stdin) and never holds a person's.
+    requireArgs(rest, 0, 0, 'teams machines enroll --name NAME --out PATH'); if (!flags.name) usage('--name is required');
+    if (!flags.out) usage('--out is required to deliver the machine credential'); const destination = reserveProtected(flags.out, { force: flags.force });
+    try {
+      const enrollment_key = crypto.randomUUID();
+      const response = await team.machines.create({ name: flags.name, enrollment_key });
+      let credential = response.data.credential;
+      if (!credential) credential = (await client.request('POST', teamPath(context, `/sources/${response.data.source.id}/credentials`), { body: { rotate: true } })).data;
+      destination.write({ version: 1, kind: 'machine-enrollment', origin: context.origin, server_id: context.server_id, team_id: context.team_id, team_name: context.team_name ?? null, enrollment_key, machine: response.data.machine, source: response.data.source, credential });
+      return output({ version: 1, context: scope(context), data: { machine: response.data.machine, source: response.data.source, written_to: resolve(flags.out) } });
+    } catch (error) { destination.abort(); throw error; }
+  }
   if (['subscribe','unsubscribe','events'].includes(sub)) {
     requireArgs(rest,sub==='events'?0:1,sub==='events'?0:1,`teams machines ${sub} ${sub==='events'?'':'ADDRESS'}`);
     const channel=await openLocalMachine(paths(teamsHome()).socket);
@@ -647,11 +670,24 @@ async function machinesCommand(sub, { flags, rest, output, client, context, team
       return output(await client.request('POST', machineBase, { body: { subject_id: subject, caps, targets, expires_at: Date.now() + ttl } }));
     }
   }
-  usage('teams machines list|roots|access|authorize-continuation|subscribe|unsubscribe|events');
+  usage('teams machines list|roots|access|enroll|remove|authorize-continuation|subscribe|unsubscribe|events');
 }
 
 async function syncCommand(sub, { flags, rest, output, client, context, team, home }) {
   if (sub === 'list') return output(await team.syncRules.list(optional(flags, ['machine'])));
+  if (sub === 'add' && flags.enrollment) {
+    // A custodian's rule for a machine it enrolled: the path is the machine's own, and its root id is the one the
+    // machine's connector registers for it (sha256 of machine id and path). The harness is named, as this computer
+    // cannot ask that machine's native core.
+    requireArgs(rest, 0, 0, 'teams sync add --enrollment FILE --repo PATH --harness ID'); if (!flags.repo) usage('--repo is required'); if (!flags.harness) usage('--harness is required with --enrollment');
+    const enrolled = JSON.parse(readFileSync(resolve(flags.enrollment), 'utf8'));
+    if (enrolled.kind !== 'machine-enrollment' || enrolled.team_id !== context.team_id) usage('--enrollment names no machine of this team');
+    // connect registers the folder's real path; name it the same way (absolute, normalized, no symlink).
+    if (!isAbsolute(flags.repo)) usage('--repo with --enrollment is the machine\'s absolute path');
+    const repo = resolve(flags.repo);
+    const root_id = `root_${createHash('sha256').update(`${enrolled.machine.id}\0${repo}`).digest('hex').slice(0, 32)}`;
+    return output(await team.syncRules.create({ machine_id: enrolled.machine.id, source_id: enrolled.source.id, selector: { root_id, harnesses: [flags.harness] }, visibility: flags.visibility ?? 'restricted', backfill: backfill(flags.backfill ?? 'none') }));
+  }
   if (sub === 'add') {
     requireArgs(rest, 0, 0, 'teams sync add --repo PATH'); if (!flags.repo) usage('--repo is required');
     const enrollment = new WorkspaceContexts(home).connector(context.server_id, context.team_id).read();
@@ -683,16 +719,38 @@ async function stopRunningConnector(saved) {
   for (let waited = 0; running.pid > 0 && alive() && waited < 15_000; waited += 250) await new Promise(resolve => setTimeout(resolve, 250));
 }
 
+/**
+ * The machine side of `teams machines enroll`: the enrollment on stdin becomes this home's machine-only context (its
+ * machine credential, never a person's) and its connector state, and the connect that follows starts from them.
+ */
+function adoptEnrollment(contexts, home, flags) {
+  let enrolled;
+  try { enrolled = JSON.parse(readFileSync(0, 'utf8')); } catch { usage('stdin is not JSON: pipe the file teams machines enroll --out wrote'); }
+  if (enrolled?.version !== 1 || enrolled.kind !== 'machine-enrollment' || !enrolled.credential?.token || !enrolled.machine?.id || !enrolled.source?.id || !enrolled.enrollment_key) usage('stdin is not a machine enrollment (teams machines enroll --out)');
+  const connector = contexts.connector(enrolled.server_id, enrolled.team_id), saved = connector.read();
+  if (saved?.machine && saved.machine.id !== enrolled.machine.id) usage(`this home is already connected as ${saved.machine.name ?? saved.machine.id}; disconnect it first`);
+  const name = flags.context ?? 'machine', existing = contexts.read().contexts[name];
+  if (existing && !(existing.machine_only && existing.server_id === enrolled.server_id && existing.team_id === enrolled.team_id)) usage(`context ${name} is not this machine's; name another with --context`);
+  const credentialId = `cred_${crypto.randomUUID().replaceAll('-', '')}`;
+  contexts.writeCredential(credentialId, { token: enrolled.credential.token, kind: 'machine', expires_at: enrolled.credential.expires_at ?? null, server_id: enrolled.server_id, origin: enrolled.origin });
+  contexts.upsert(name, { origin: enrolled.origin, server_id: enrolled.server_id, team_id: enrolled.team_id, team_name: enrolled.team_name ?? null, principal_id: null, credential_ref: credentialId, label: null, machine_only: true, machine_name: enrolled.machine.name });
+  if (!saved?.machine) connector.write({ version: 1, enrollment_key: enrolled.enrollment_key, phase: 'enrolled', machine: enrolled.machine, source: enrolled.source, credential: enrolled.credential });
+  if (!contexts.read().current) contexts.use(name);
+  flags.context = name;
+}
+
 async function connectorCommand(verb, { flags, rest, output, client, context, team, contextName }, home) {
   requireArgs(rest, 0, 0, `teams ${verb}`); const state = new WorkspaceContexts(home).connector(context.server_id, context.team_id);
   if (verb === 'status') {
-    let reachable = true; let account = null; try { account = await client.me(); } catch { reachable = false; }
+    // A machine has no account to name: its own door answering its credential is the answer.
+    let reachable = true; let account = null;
+    try { if (context.machine_only) { const enrolled = state.read(); await client.request('GET', teamPath(context, `/machines/${enrolled?.machine?.id}/configuration`)); } else account = await client.me(); } catch { reachable = false; }
     const saved = state.read(); const running = saved?.process?.socket ? await activeSocket(saved.process.socket) : false;
     // A connector deep in a large capture can miss the probe's second while its process lives on: it is busy, not stopped.
     const busy = !running && Boolean(saved?.process) && lifecycleHeld(state.directory);
     // What the connector could not sync, as it last wrote it to its state (it is written while it runs).
     const sync = saved ? readSyncStatus(state.directory) ?? { not_syncing: [], last_error: null, queued_captures: 0 } : null;
-    const value = { version: 1, context: scope(context), data: { reachable, account, connector: saved ? { enrolled: true, running: running || busy, ...(busy ? { busy: true } : {}), machine: saved.machine, source: saved.source, sync } : { enrolled: false, running: false }, sources: reachable ? (await team.sources.list()).items : [] } };
+    const value = { version: 1, context: scope(context), data: { reachable, account, connector: saved ? { enrolled: true, running: running || busy, ...(busy ? { busy: true } : {}), machine: saved.machine, source: saved.source, sync } : { enrolled: false, running: false }, sources: reachable && !context.machine_only ? (await team.sources.list()).items : [] } };
     if (flags.json) return output(value);
     const lines = [`Team       ${context.team_name ?? context.team_id} · ${new URL(context.origin).host}${reachable ? '' : ' · unreachable'}`];
     lines.push(saved?.machine ? `Connector  ${saved.machine.name ?? saved.machine.id} · ${running ? 'running' : busy ? 'running (busy: its control socket did not answer within 1 s)' : 'not running'}${saved.service?.kind ? ` (${saved.service.kind})` : ''}` : 'Connector  not connected (supercode teams connect)');
@@ -846,6 +904,9 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
   }
   // Uninstalling a Windows task already stopped its connector, so only one still answering is asked to stop.
   if (enrollment.process?.socket && enrollment.process?.token && await activeSocket(enrollment.process.socket)) await requestStop(enrollment.process.socket, enrollment.process.token);
+  // A machine its custodian enrolled stops here; revoking it is the custodian's (teams machines remove).
+  // It keeps its enrollment, so connect resumes it; the custodian's removal is what ends it.
+  if (context.machine_only) { state.update((current) => ({ ...current, process: null, service: null })); return output({ version: 1, context: scope(context), data: { disconnected: true, machine_id: enrollment.machine.id, revoked: false } }); }
   const machine = await team.machines.get(enrollment.machine.id);
   await client.request('DELETE', teamPath(context, `/machines/${enrollment.machine.id}`), { ifMatch: machine.data.revision });
   state.remove();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.166",
+  "version": "0.2.167",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",