@volter/supercode-teams 0.2.171 → 0.2.173

package/bin/teams.mjs

@@ -19,7 +19,7 @@
 //   title set <pane> <text> | title ls
 //   attention ls | rank | request <pane> [--urgency now|soon|whenever] [--reason text] | clear <pane>
 //   watch [--interval ms] [--for ms]
-//   launches get <key> | list                 operators: keyed node launch receipts
+//   launches get <key> | cancel <key> | list   operators: keyed receipts; cancel only unissued keys
 //   rpc <harness.v1 method> [json-params]   operators: one harness.v1 request
 //   log verify
 //
@@ -323,8 +323,9 @@ async function main() {
       return withNode(async (rpc) => out(await rpc.call('jobs.list', {})));
     case 'launches': {
       if (sub === 'get' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.get', { key: rest[0] })));
+      if (sub === 'cancel' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.cancel', { key: rest[0] })));
       if (sub === 'list') return withNode(async (rpc) => out(await rpc.call('launches.list', {})));
-      die('launches get <key> | launches list [--machine NAME]');
+      die('launches get <key> | cancel <key> | list [--machine NAME]');
       return;
     }
     case 'rpc': {

package/machine.mjs

@@ -7,7 +7,7 @@
 //                      request ids rewritten per connection, notifications routed
 //                      by the subscription/connection they name (never fanned out)
 //   stream "terminal"  a pane attachment under observe|control
-//   stream "node"      describe, launch, launches.get|list, panes.*, files.*,
+//   stream "node"      describe, launch, launches.get|cancel|list, panes.*, files.*,
 //                      ports.*, attention.*, title.*
 //   stream "frontend"  frontend.v2 to a hosted runtime, one client id per caller
 //   stream "port"      one TCP connection to an announced port
@@ -1345,6 +1345,19 @@ export class TeamsMachine extends MachineCore {
     });
   }
 
+  async #launchReceipt(found) {
+    const session = found.pane ? await this.#paneByContext(found.pane) : null;
+    return {
+      key: found.key, pane: found.pane ?? null, status: found.status, by: found.by ?? null,
+      cancelled: found.status === 'cancelled', outcome: found.outcome ?? null,
+      cancelled_at: found.cancelled_at ?? null,
+      live: Boolean(session && !session.dead), label: session?.label ?? null, activeCommand: session?.activeCommand ?? null,
+      exit_output: found.pane && (!session || session.dead) ? paneExitOutput(found.pane) : null,
+      exit: session?.dead ? deadPaneExit(session) : found.pane && !session ? paneExit(found.pane) : null,
+      ...initialInputFacts(found),
+    };
+  }
+
   async #dispatch(entry, method, params) {
     // A server-forwarded caller is re-admitted on every door: a grant revoked or expired
     // since the stream opened stops mattering NOW, not at the next stream.
@@ -1439,16 +1452,24 @@ export class TeamsMachine extends MachineCore {
         const programName = String(params.program).split(/[\\/]/).pop().replace(/\.(?:exe|cmd)$/i, '');
         if (programName === 'codex') params = { ...params, kind: 'codex' };
         const key = params.key ?? `lk_${randomBytes(9).toString('base64url')}`;
-        const existing = this.launches.find(key);
-        // A key whose launch is in flight, or whose pane still lives, is reused; a failed
-        // launch, or one whose pane has ended, may be launched again.
-        if (existing && (existing.status === 'issued' || (existing.status === 'ready' && await this.#paneByContext(existing.pane)))) {
-          return { key, pane: existing.pane, reused: true, status: existing.status };
+        const by = await this.#callerOf(entry, params).catch(() => null);
+        // No await between the final journal check and issuance: cancellation and issuance
+        // serialize in this daemon even when caller resolution or pane reads yielded.
+        let existing = this.launches.find(key);
+        while (existing) {
+          if (existing.status === 'cancelled') throw Object.assign(new Error(`launch key ${key} was cancelled before issuance; use a new key`), { code: 409, reason: 'launch_key_cancelled' });
+          if (existing.status === 'issued') return { key, pane: existing.pane, reused: true, status: existing.status };
+          if (existing.status === 'ready') {
+            const session = await this.#paneByContext(existing.pane);
+            const latest = this.launches.find(key);
+            if (JSON.stringify(latest) !== JSON.stringify(existing)) { existing = latest; continue; }
+            if (session && !session.dead) return { key, pane: existing.pane, reused: true, status: existing.status };
+          }
+          break;
         }
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
         // Who started the pane: the launching session's (or board's) address, null for a person. A session's later
         // input on the pane is refused unless it is this one (#refuseForeign); close is not creator-restricted.
-        const by = await this.#callerOf(entry, params).catch(() => null);
         // Who to tell when the pane ends (`open --new … --notify-when-ended`): a session's mail address, and this
         // machine's name as the address a notice from its pane comes from.
         if (params.notify !== undefined && !(params.notify && typeof params.notify.to === 'string' && /^sc:[^:\s]+:[^:\s]+:\S+$/.test(params.notify.to) && typeof params.notify.machine === 'string' && /^[a-z0-9][a-z0-9-]*$/.test(params.notify.machine))) throw Object.assign(new Error('launch notify is { to: <sc: address>, machine: <this machine\'s mail name> }'), { code: 400 });
@@ -1523,13 +1544,21 @@ export class TeamsMachine extends MachineCore {
         if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
         const found = this.launches.find(params.key);
         if (!found) return null;
-        const session = await this.#paneByContext(found.pane);
-        return {
-          exit_output: !session || session.dead ? paneExitOutput(found.pane) : null,
-          exit: session?.dead ? deadPaneExit(session) : !session ? paneExit(found.pane) : null,
-          key: found.key, pane: found.pane, live: Boolean(session && !session.dead), label: session?.label ?? null, activeCommand: session?.activeCommand ?? null,
-          ...initialInputFacts(found),
-        };
+        return this.#launchReceipt(found);
+      }
+      case 'launches.cancel': {
+        if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
+        if (typeof params.key !== 'string' || !params.key.trim()) throw Object.assign(new Error('launch cancellation requires a nonempty key'), { code: 400 });
+        const by = await this.#callerOf(entry, params).catch(() => null);
+        // Retire only an absent key. An issued, live or failed launch keeps its actual
+        // receipt; cancellation never closes a pane or guesses that issuance did not happen.
+        let found = this.launches.find(params.key);
+        if (!found) {
+          this.launches.record({ key: params.key, pane: null, by, status: 'cancelled', outcome: 'not_issued', cancelled_at: Date.now() });
+          found = this.launches.find(params.key);
+          act('launches.cancel', params.key, 'ok', 'not issued; key retired');
+        } else act('launches.cancel', params.key, found.status === 'cancelled' ? 'ok' : 'refused', found.status);
+        return this.#launchReceipt(found);
       }
       case 'launches.list': {
         // Everything this daemon launched, by key, with whether the pane still lives: how an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.171",
+  "version": "0.2.173",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/catalog.mjs

@@ -5,3 +5,17 @@ export { cursorToken, cursorHash };
 export const normalizeSearch = text => String(text).normalize('NFC').toLowerCase();
 export function descriptor(row, auth, grants=[]) { const projection=JSON.parse(row.descriptor_json); projection.actions ??= {}; const read=canRead(auth,row,grants); for(const action of ['read','follow','export_text','export_native','manage','attach_observe','interact','approve','interrupt','terminate','continue']) projection.actions[action] ??={allowed:action==='read'||action==='follow'||action==='export_text'?read:false,reason:read?(action==='read'||action==='follow'||action==='export_text'?null:'unsupported'):'forbidden'}; return projection; }
 export function textFromContent(content) { if(typeof content==='string')return content; if(!Array.isArray(content))return ''; return content.filter(x=>x&&typeof x==='object'&&x.type==='text'&&typeof x.text==='string').map(x=>x.text).join('\n'); }
+
+/**
+ * The native bindings sessions have now (contracts: Descriptor.bindings), by session id: each one a machine reported in
+ * its latest heartbeat, from the incarnation it runs as, on a machine still enrolled and seen within the window attach
+ * uses (effects.mjs), so a read offers only bindings attach would accept. Only the contract's fields are served. The
+ * captured descriptor never holds them; a heartbeat replaces them, so every read takes them fresh.
+ */
+const BINDING_FIELDS=['id','machine_id','incarnation_id','native_session_id','native_runtime_id','harness','state','observed_at','native_capabilities'];
+export async function liveBindings(api,teamId,sessionId=null){
+  const rows=await api.store.query(`SELECT b.session_id,b.descriptor_json FROM bindings b JOIN machines m ON m.team_id=b.team_id AND m.id=b.machine_id AND m.incarnation_id=b.incarnation_id AND m.revoked_at IS NULL AND m.last_seen_at>? WHERE b.team_id=?${sessionId?' AND b.session_id=?':''} ORDER BY b.id`,[api.clock.nowMs()-45000,teamId,...(sessionId?[sessionId]:[])]);
+  const bySession=new Map();
+  for(const row of rows){const reported=JSON.parse(row.descriptor_json),binding=Object.fromEntries(BINDING_FIELDS.filter(field=>field in reported).map(field=>[field,reported[field]]));const list=bySession.get(row.session_id)??[];list.push(binding);bySession.set(row.session_id,list);}
+  return bySession;
+}

package/server/event-routes.mjs

@@ -2,7 +2,7 @@ import { appGrantAllows } from '@volter/teams/server/auth';
 import { appAuthentication } from '@volter/teams/server/apps';
 import { createHash } from 'node:crypto';
 import { validateListQuery } from '../contracts/index.mjs';
-import { cursorHash, cursorToken } from './catalog.mjs';
+import { cursorHash, cursorToken, liveBindings } from './catalog.mjs';
 import { writeSse } from '@volter/teams/server/events';
 
 function openStream(api, req, res, auth, requestId, fail) {
@@ -188,10 +188,13 @@ async function catalogWindow(api, auth, query) {
     }
     return readable(row);
   };
-  const items = [];
+  // The window carries the bindings machines report now, so a stream (re-read on every change and every 15 s) tells a
+  // watcher when a session's doors open or close.
+  const items = [], bindings = await liveBindings(api, auth.team_id);
   for (const row of rows) {
     if (row.canonical_id || !readable(row)) continue;
     const descriptor = JSON.parse(row.descriptor_json);
+    descriptor.bindings = bindings.get(row.id) ?? [];
     for (const field of ['parent_id', 'continued_from']) if (descriptor[field] && !readableReference(descriptor[field])) descriptor[field] = null;
     if (query.user && (query.user === 'me' ? auth.principal_id : query.user) !== descriptor.user?.principal_id) continue;
     if (query.repo && query.repo !== descriptor.repository?.key) continue;
@@ -220,7 +223,8 @@ export async function handleCatalogEvents({ api, req, res, auth, url, requestId,
   const enqueue = streamQueue(stream, async () => {
     const page = await catalogWindow(api, auth, query);
     // Authorization and expiry can change a window without creating a session revision.
-    const digest = createHash('sha256').update(JSON.stringify(page.data)).digest('hex');
+    // A binding's observed_at moves with every heartbeat; only a change of what the window says is a reset.
+    const digest = createHash('sha256').update(JSON.stringify(page.data, (key, value) => key === 'bindings' && Array.isArray(value) ? value.map(({ observed_at: _seen, ...binding }) => binding) : value)).digest('hex');
     const cursor = `${page.revision}:${page.authEpoch}:${digest}`;
     if (cursor !== lastCursor && stream.write({ type: 'catalog_reset', cursor, revision: page.revision, data: page.data })) lastCursor = cursor;
   });

package/server/harness-routes.mjs

@@ -11,7 +11,7 @@ import { createHash } from 'node:crypto';
 import { bearer, hashToken, canRead, canManage, isAdmin } from '@volter/teams/server/auth';
 import { storageReport } from './storage-report.mjs';
 import { validateListQuery, validateSearchQuery, validateReadQuery, validateCaptureBegin, validateCapturePart, canonicalJson } from '../contracts/index.mjs';
-import { normalizeSearch, cursorHash, cursorToken } from './catalog.mjs';
+import { normalizeSearch, cursorHash, cursorToken, liveBindings } from './catalog.mjs';
 import { handleOtlpRoute, sha256, validateArtifactName } from './ingest.mjs';
 import { handleCatalogEvents, handleSessionEvents, sessionNames } from './event-routes.mjs';
 import { exact } from '@volter/teams/server/request-json';
@@ -136,19 +136,6 @@ const managerGuard=(auth,sessionId,now,{governance=false}={})=>({
 async function resolve(api,auth,ref){const head='SELECT s.*,v.descriptor_json,v.sort_at FROM sessions s JOIN session_versions v ON v.team_id=s.team_id AND v.session_id=s.id AND v.revision=s.revision WHERE s.team_id=? AND ',native=/^([a-z][a-z0-9-]*):(.+)$/.exec(ref);let rows;if(native)rows=await api.store.query(head+'s.id IN (SELECT session_id FROM origins WHERE team_id=? AND harness=? AND native_id=? AND deleted_at IS NULL)',[auth.team_id,auth.team_id,native[1],native[2]]);else if(ref.length>=36)rows=await api.store.query(head+'s.id=?',[auth.team_id,ref]);else if(ref.length>=8)rows=await api.store.query(head+'s.id LIKE ?',[auth.team_id,`${ref}%`]);else rows=[];const visible=[];for(let r of rows){r=await canonicalSession(api,auth.team_id,r);r=await api.store.one('SELECT s.*,v.descriptor_json,v.sort_at FROM sessions s JOIN session_versions v ON v.team_id=s.team_id AND v.session_id=s.id AND v.revision=s.revision WHERE s.team_id=? AND s.id=?',[auth.team_id,r.id]);if(r&&await canReadMerged(api,auth,r)&&!visible.some(x=>x.id===r.id))visible.push(r);}if(visible.length>1)fail(400,'ambiguous_reference','ambiguous session reference');if(!visible.length)fail(404,'not_found','not found');return visible[0];}
 function qobj(url){return Object.fromEntries([...url.searchParams].map(([k,v])=>[k,['limit','since','until','tail','revision'].includes(k)?Number(v):k==='include_children'?v==='true':v]));}
 function projection(row){return JSON.parse(row.descriptor_json);}
-/**
- * The native bindings sessions have now (contracts: Descriptor.bindings), by session id: each one a machine reported in
- * its latest heartbeat, from the incarnation it runs as, on a machine still enrolled and seen within the window attach
- * uses (effects.mjs), so a read offers only bindings attach would accept. Only the contract's fields are served. The
- * captured descriptor never holds them; a heartbeat replaces them, so every read takes them fresh.
- */
-const BINDING_FIELDS=['id','machine_id','incarnation_id','native_session_id','native_runtime_id','harness','state','observed_at','native_capabilities'];
-async function liveBindings(api,teamId,sessionId=null){
-  const rows=await api.store.query(`SELECT b.session_id,b.descriptor_json FROM bindings b JOIN machines m ON m.team_id=b.team_id AND m.id=b.machine_id AND m.incarnation_id=b.incarnation_id AND m.revoked_at IS NULL AND m.last_seen_at>? WHERE b.team_id=?${sessionId?' AND b.session_id=?':''} ORDER BY b.id`,[api.clock.nowMs()-45000,teamId,...(sessionId?[sessionId]:[])]);
-  const bySession=new Map();
-  for(const row of rows){const reported=JSON.parse(row.descriptor_json),binding=Object.fromEntries(BINDING_FIELDS.filter(field=>field in reported).map(field=>[field,reported[field]]));const list=bySession.get(row.session_id)??[];list.push(binding);bySession.set(row.session_id,list);}
-  return bySession;
-}
 async function readerProjection(api,auth,row,bindings=null){
   const view=projection(row);
   view.bindings=(bindings??await liveBindings(api,auth.team_id,row.id)).get(row.id)??[];