@volter/supercode-teams 0.2.169 → 0.2.171

package/bin/workspace/sync-status.mjs

@@ -14,6 +14,13 @@ export function syncStatusLines(sync, { indent = '  ' } = {}) {
     for (const item of problems.slice(0, SHOWN)) lines.push(`${indent}${item.harness} ${item.session_id}${item.rule_id ? ` · ${item.rule_id}` : ''} · ${when(item.at)} · ${reason(item)}`);
     if (problems.length > SHOWN) lines.push(`${indent}… and ${problems.length - SHOWN} more (--json lists them all)`);
   } else lines.push('Not syncing  none');
+  const unbound = sync.not_bound ?? [];
+  // A live session that is not bound cannot be typed into from the team; each says why.
+  if (unbound.length) {
+    const count = sync.not_bound_count ?? unbound.length;
+    lines.push(`Not bound (${count} live session${count === 1 ? '' : 's'}${count > unbound.length ? `, ${unbound.length} shown` : ''}):`);
+    for (const item of unbound.slice(0, SHOWN)) lines.push(`${indent}${item.harness} ${item.session_id} · ${item.reason}`);
+  }
   if (sync.queued_captures) lines.push(`Queued   ${sync.queued_captures} capture${sync.queued_captures === 1 ? '' : 's'} waiting for the server`);
   if (sync.last_error) lines.push(`Last error ${when(sync.last_error.at)} · ${reason(sync.last_error)}`);
   return lines;

package/bin/workspace.mjs

@@ -249,7 +249,7 @@ async function authCommand({ flags, sub = 'status', rest, home, contexts, output
     say(account.machine ? `Machine  ${account.machine.name} · ${account.machine.connection ?? 'unknown'} · sharing ${account.machine.folder ?? '?'}${account.machine.service ? ` (${account.machine.service})` : ' (runs while `teams connect` does)'}` : 'Machine  not connected (supercode teams connect)');
     // Only trouble (a session not syncing, an error in the last day) is worth lines here; `teams status` shows the rest.
     const sync = account.machine?.sync;
-    if (sync?.not_syncing.length || sync?.last_error?.at > Date.now() - 86_400_000) for (const line of syncStatusLines(sync)) say(line);
+    if (sync?.not_syncing.length || sync?.not_bound?.length || sync?.last_error?.at > Date.now() - 86_400_000) for (const line of syncStatusLines(sync)) say(line);
     return;
   }
   if (sub === 'switch') {

package/connector/index.d.ts

@@ -66,7 +66,7 @@ export interface ConnectorConfigurationValue {
 export interface SyncErrorSummary { code: string | null; message: string; at: number }
 export interface SyncProblem extends SyncErrorSummary { harness: string; session_id: string; rule_id: string | null }
 /** What `supercode teams status` shows: sessions not syncing (most recent first) and the last error; null without state. */
-export declare function readSyncStatus(stateDir: string): { not_syncing: SyncProblem[]; last_error: SyncErrorSummary | null; queued_captures: number } | null;
+export declare function readSyncStatus(stateDir: string): { not_syncing: SyncProblem[]; not_bound: { harness: string; session_id: string; reason: string }[]; not_bound_count: number; last_error: SyncErrorSummary | null; queued_captures: number } | null;
 
 export declare class TeamsConnector {
   constructor(options: TeamsConnectorOptions);

package/connector/index.mjs

@@ -24,7 +24,7 @@ const errorSummary=(error,at)=>error==null?null:{code:typeof error.code==='strin
 export function readSyncStatus(stateDir){
   let state;try{state=JSON.parse(readFileSync(join(stateDir,'connector.json'),'utf8'));}catch{return null;}
   const status=state?.sync_status;
-  return {not_syncing:Array.isArray(status?.problems)?status.problems:[],last_error:status?.last_error??null,queued_captures:Array.isArray(state?.outbox)?state.outbox.length:0};
+  return {not_syncing:Array.isArray(status?.problems)?status.problems:[],not_bound:Array.isArray(status?.unbound)?status.unbound:[],not_bound_count:Number.isSafeInteger(status?.unbound_count)?status.unbound_count:(Array.isArray(status?.unbound)?status.unbound.length:0),last_error:status?.last_error??null,queued_captures:Array.isArray(state?.outbox)?state.outbox.length:0};
 }
 // A tool call still running when the core reads a session has no result yet; the core answers it with a synthesized
 // placeholder (crates/interchange session/helpers.rs ensure_tool_results_paired: a `tool` message for that call id,
@@ -139,6 +139,8 @@ export class TeamsConnector {
     this.lastErrorValue=error;const known=sameError(status.last_error,summary);if(!known)status.last_error=summary;
     if(!listed||!known)this.saveQuietly();
   }
+  /** The live sessions that could not be bound, and why, kept for `teams status`; written only when the list changes. */
+  noteUnbound(){const status=this.syncStatus(),next=this.nativeEffects.notBound(SYNC_PROBLEM_LIMIT),count=this.nativeEffects.unbound.size;if(JSON.stringify(status.unbound??[])===JSON.stringify(next)&&status.unbound_count===count)return;status.unbound=next;status.unbound_count=count;this.saveQuietly();}
   clearSessionProblem(harness,nativeSessionId){
     const status=this.state.sync_status;if(!status?.problems?.some(item=>item.harness===harness&&item.session_id===nativeSessionId))return;
     status.problems=status.problems.filter(item=>!(item.harness===harness&&item.session_id===nativeSessionId));this.saveQuietly();
@@ -179,6 +181,9 @@ export class TeamsConnector {
         this.lastHeartbeatAt = this.clock.nowMs();
         // The sessions someone is following now (a viewer or channel open on them) skip the capture floors.
         if (Array.isArray(reply?.watched)) this.watched = new Set(reply.watched.map(item => `${item.harness}:${item.native_id}`));
+        // A binding the server could not store (no session with its native id) is said, not lost.
+        this.nativeEffects.refused(reply?.unbound_bindings);
+        this.noteUnbound();
         this.save();
       });
       beating = next.catch(() => {});

package/connector/native-effects.mjs

@@ -8,19 +8,30 @@ const within = (root, path) => { const name = relative(root, path); return name
 const LIMIT = 1024 * 1024;
 
 export class NativeEffects {
-  constructor(connector) { this.c = connector; this.bindings = new Map(); this.attachments = new Map(); this.ownedRuntimes = new Set(); }
+  constructor(connector) { this.c = connector; this.bindings = new Map(); this.attachments = new Map(); this.ownedRuntimes = new Set(); this.unbound = new Map(); }
   async discover(descriptor, ruleId) {
     const c = this.c, locator = descriptor.locator;
-    if (!descriptor.live_endpoint?.startsWith('supercode-live://') || !descriptor.cwd || !c.core.attachManagedRuntime || !c.core.runtimeCapabilities) return;
+    if (!descriptor.live_endpoint?.startsWith('supercode-live://')) return;
+    // A session with a live endpoint that ends up unbound says why (`teams status`, Not bound): it cannot be typed into.
+    const key = `${locator.harness}:${locator.session_id}`, unbound = reason => { this.unbound.set(key, { harness: locator.harness, session_id: locator.session_id, reason, seen: true }); };
+    if (!descriptor.cwd) return unbound('the session names no working folder');
+    if (!c.core.attachManagedRuntime || !c.core.runtimeCapabilities) return unbound('this harness client cannot attach to live runtimes');
     const id = `bind_${digest(`${c.machineId}:${c.state.incarnation_id}:${locator.harness}:${locator.session_id}`).slice(0,32)}`;
     const params = { harness: locator.harness, runtime_id: locator.session_id, cwd: descriptor.cwd, base_url: descriptor.live_endpoint };
     const existing = this.bindings.get(id);
-    if (existing && JSON.stringify(existing.params) === JSON.stringify(params)) { existing.seen = true; existing.ruleId = ruleId; return; }
-    const { capabilities } = await c.core.runtimeCapabilities(params);
-    if (!capabilities.attach_existing_process || !capabilities.stream_events) return;
-    // A live endpoint whose runtime is gone (its receipt's process ended) has nothing to bind: that is quiet.
+    if (existing && JSON.stringify(existing.params) === JSON.stringify(params)) { existing.seen = true; existing.ruleId = ruleId; this.unbound.delete(key); return; }
+    let capabilities;
+    try { ({ capabilities } = await c.core.runtimeCapabilities(params)); } catch (error) { return unbound(`reading its runtime's capabilities failed: ${String(error?.message ?? error).slice(0, 200)}`); }
+    const missing = ['attach_existing_process', 'stream_events'].filter(name => !capabilities[name]);
+    if (missing.length) return unbound(`its runtime does not offer ${missing.join(' or ')}`);
+    // A live endpoint whose runtime is gone (its receipt's process ended) has nothing to bind: that is quiet, and the
+    // next discovery no longer offers it. Any other failure to attach is said.
     let runtime;
-    try { runtime = await c.core.attachManagedRuntime(params); } catch { return; }
+    try { runtime = await c.core.attachManagedRuntime(params); } catch (error) {
+      const message = String(error?.message ?? error);
+      if (error?.code === 'not_found' || error?.sdkCode === 'not_found') { this.unbound.delete(key); return; }
+      return unbound(`attaching to its runtime failed: ${message.slice(0, 200)}`);
+    }
     try {
       const actions = ['attach_observe'];
       if (capabilities.send_input) actions.push('interact');
@@ -31,10 +42,21 @@ export class NativeEffects {
         native_runtime_id: runtime.handle.runtime_id, native_session_id: locator.session_id,
         harness: locator.harness, state: 'running', observed_at: c.clock.nowMs(), native_capabilities: actions,
       } });
+      this.unbound.delete(key);
     } finally { await runtime.close(); } // This backend's close detaches the observer only.
   }
-  beginDiscovery() { for (const binding of this.bindings.values()) binding.seen = false; }
-  endDiscovery() { for (const [id, binding] of this.bindings) if (!binding.seen) this.bindings.delete(id); }
+  /** The server said it holds no session for these bindings: they stay unbound, and say so. */
+  refused(items) {
+    for (const item of items ?? []) {
+      const binding = this.bindings.get(item.id);
+      if (!binding) continue;
+      this.unbound.set(`${binding.descriptor.harness}:${binding.descriptor.native_session_id}`, { harness: binding.descriptor.harness, session_id: binding.descriptor.native_session_id, reason: 'the server holds no session with this native id from this machine', seen: true });
+    }
+  }
+  /** Every live session that is not bound, and why. */
+  notBound(limit = 50) { return [...this.unbound.values()].slice(0, limit).map(({ seen, ...item }) => item); }
+  beginDiscovery() { for (const binding of this.bindings.values()) binding.seen = false; for (const item of this.unbound.values()) item.seen = false; }
+  endDiscovery() { for (const [id, binding] of this.bindings) if (!binding.seen) this.bindings.delete(id); for (const [key, item] of this.unbound) if (!item.seen) this.unbound.delete(key); }
   published() { return [...this.bindings.values()].map(binding => ({ ...binding.descriptor, observed_at: this.c.clock.nowMs() })); }
   async prepare(effect) {
     if (effect.kind === 'continue') return this.prepareContinuation(effect);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.169",
+  "version": "0.2.171",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/harness-routes.mjs

@@ -136,8 +136,22 @@ const managerGuard=(auth,sessionId,now,{governance=false}={})=>({
 async function resolve(api,auth,ref){const head='SELECT s.*,v.descriptor_json,v.sort_at FROM sessions s JOIN session_versions v ON v.team_id=s.team_id AND v.session_id=s.id AND v.revision=s.revision WHERE s.team_id=? AND ',native=/^([a-z][a-z0-9-]*):(.+)$/.exec(ref);let rows;if(native)rows=await api.store.query(head+'s.id IN (SELECT session_id FROM origins WHERE team_id=? AND harness=? AND native_id=? AND deleted_at IS NULL)',[auth.team_id,auth.team_id,native[1],native[2]]);else if(ref.length>=36)rows=await api.store.query(head+'s.id=?',[auth.team_id,ref]);else if(ref.length>=8)rows=await api.store.query(head+'s.id LIKE ?',[auth.team_id,`${ref}%`]);else rows=[];const visible=[];for(let r of rows){r=await canonicalSession(api,auth.team_id,r);r=await api.store.one('SELECT s.*,v.descriptor_json,v.sort_at FROM sessions s JOIN session_versions v ON v.team_id=s.team_id AND v.session_id=s.id AND v.revision=s.revision WHERE s.team_id=? AND s.id=?',[auth.team_id,r.id]);if(r&&await canReadMerged(api,auth,r)&&!visible.some(x=>x.id===r.id))visible.push(r);}if(visible.length>1)fail(400,'ambiguous_reference','ambiguous session reference');if(!visible.length)fail(404,'not_found','not found');return visible[0];}
 function qobj(url){return Object.fromEntries([...url.searchParams].map(([k,v])=>[k,['limit','since','until','tail','revision'].includes(k)?Number(v):k==='include_children'?v==='true':v]));}
 function projection(row){return JSON.parse(row.descriptor_json);}
-async function readerProjection(api,auth,row){
+/**
+ * The native bindings sessions have now (contracts: Descriptor.bindings), by session id: each one a machine reported in
+ * its latest heartbeat, from the incarnation it runs as, on a machine still enrolled and seen within the window attach
+ * uses (effects.mjs), so a read offers only bindings attach would accept. Only the contract's fields are served. The
+ * captured descriptor never holds them; a heartbeat replaces them, so every read takes them fresh.
+ */
+const BINDING_FIELDS=['id','machine_id','incarnation_id','native_session_id','native_runtime_id','harness','state','observed_at','native_capabilities'];
+async function liveBindings(api,teamId,sessionId=null){
+  const rows=await api.store.query(`SELECT b.session_id,b.descriptor_json FROM bindings b JOIN machines m ON m.team_id=b.team_id AND m.id=b.machine_id AND m.incarnation_id=b.incarnation_id AND m.revoked_at IS NULL AND m.last_seen_at>? WHERE b.team_id=?${sessionId?' AND b.session_id=?':''} ORDER BY b.id`,[api.clock.nowMs()-45000,teamId,...(sessionId?[sessionId]:[])]);
+  const bySession=new Map();
+  for(const row of rows){const reported=JSON.parse(row.descriptor_json),binding=Object.fromEntries(BINDING_FIELDS.filter(field=>field in reported).map(field=>[field,reported[field]]));const list=bySession.get(row.session_id)??[];list.push(binding);bySession.set(row.session_id,list);}
+  return bySession;
+}
+async function readerProjection(api,auth,row,bindings=null){
   const view=projection(row);
+  view.bindings=(bindings??await liveBindings(api,auth.team_id,row.id)).get(row.id)??[];
   for(const field of ['parent_id','continued_from']){
     const reference=view[field];
     if(!reference)continue;
@@ -177,11 +191,11 @@ async function listSessions(api,res,auth,url,requestId,search){
   }else tuples=rows.filter(row=>row.revision===row.version_revision).map(row=>[row.id,row.version_revision]);
   const rowByVersion=new Map(rows.map(row=>[`${row.id}:${row.version_revision}`,row])),grantsBySession=new Map();
   for(const grant of allGrants){const list=grantsBySession.get(grant.session_id)??[];list.push(grant);grantsBySession.set(grant.session_id,list);}
-  const hits=[],hitTuples=[];
+  const hits=[],hitTuples=[],bindingsBySession=await liveBindings(api,auth.team_id);
   for(const [id,revision]of tuples){
     const row=rowByVersion.get(`${id}:${revision}`),current=currentById.get(id);
     if(!row||!current||current.canonical_id||!await canReadMerged(api,{...auth,now:boundaryNow},current))continue;
-    const view=await readerProjection(api,auth,row);
+    const view=await readerProjection(api,auth,row,bindingsBySession);
     if(query.user&&(query.user==='me'?auth.principal_id:query.user)!==view.user?.principal_id)continue;
     if(query.repo&&query.repo!==view.repository?.key)continue;
     if(query.harness&&query.harness!==view.harness)continue;
@@ -226,7 +240,7 @@ async function activityOf(api,teamId,sessionId){
 async function sessionDescriptor(api,res,auth,id,requestId){
   const row=await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref:id,now:api.clock.nowMs(),bound:auth.bound});
   const activity=await activityOf(api,auth.team_id,row.id);
-  send(res,200,result(api,auth,{...JSON.parse(row.descriptor_json),turnActivity:activity,working:activity.state==='working'?{since:activity.since}:null}),requestId,{ETag:`"${row.revision}"`});
+  send(res,200,result(api,auth,{...JSON.parse(row.descriptor_json),bindings:(await liveBindings(api,auth.team_id,row.id)).get(row.id)??[],turnActivity:activity,working:activity.state==='working'?{since:activity.since}:null}),requestId,{ETag:`"${row.revision}"`});
 }
 async function correlateRoute(api,req,res,auth,path,requestId){
   if(!['user','service'].includes(auth.kind)||auth.role==='viewer')fail(403,'forbidden','credential cannot correlate sessions');
@@ -252,6 +266,7 @@ async function readSession(api,res,auth,id,url,requestId){
   const {rows,beforeCursor,revision}=snapshot;
   const messages=rows.map(row=>({id:row.id,source_id:row.source_id,native_key:row.native_key,recorded_at:row.recorded_at,value:JSON.parse(row.value_json)}));
   const descriptor=JSON.parse(snapshot.descriptor_json);
+  descriptor.bindings=(await liveBindings(api,auth.team_id,descriptor.id)).get(descriptor.id)??[];
   const activity=await activityOf(api,auth.team_id,descriptor.id);
   send(res,200,{version:1,context:{server_id:api.serverId,team_id:auth.team_id,principal_id:auth.principal_id},descriptor,turnActivity:activity,working:activity.state==='working'?{since:activity.since}:null,names:await sessionNames(api,auth.team_id,descriptor),messages,before_cursor:beforeCursor,event_cursor:snapshot.eventCursor,revision,display:{returned:messages.length,total:snapshot.total,truncated_fields:0}},requestId);
 }