@volter/supercode-teams 0.2.174 → 0.2.176

package/README.md

@@ -61,7 +61,13 @@ anything else, for a wildcard (`pane:*`) or for the whole filesystem (`root:/`)
 token must carry `iat` and live at most 15 minutes (`exp - iat` and `exp - now`). The hosted viewer
 at `/view#token=…` opens it; the server turns the token into a machine grant on exactly that target
 (a pane: `observe`, and `control` to type; a folder: `observe` to read, `files` to change) that
-expires with the token, and closes the channel then. A page embedding the viewer sends it a fresh
+expires with the token, and closes the channel then. Before it writes that grant, and while the
+channel is open every 15 seconds, the server asks the workplace whether the token still admits what it was issued for
+(`POST <issuer>/api/v3/delegated/status`); when the workplace answers that it does not (the member's
+binding revoked, their Task closed, their contract ended), the grant is deleted and the channel closes
+with `access_revoked`, which the viewer shows rather than reconnecting; an open with such a token is
+refused (403 `access_revoked`) and writes no grant. An unreachable workplace leaves the channel to
+the token's expiry. A page embedding the viewer sends it a fresh
 token by `postMessage({ type: 'delegated-token', token })`, which the viewer asks for with
 `delegated-token-needed`.
 

package/bin/fleet.mjs

@@ -96,8 +96,9 @@ async function main() {
           cwd: flags.cwd,
           initialInput: flags.input,
           name: flags.name,
-          // `open` attaching this terminal to the pane itself asks the machine for no window of its own.
-          ...(flags.popup === 'false' ? { popup: false } : {}),
+          // The launch's window choice, when its caller states one: `open` attaching this terminal to the pane asks
+          // for none, and the board's dispatcher states its workflow's choice on every launch.
+          ...(flags.popup === 'false' || flags.popup === 'true' ? { popup: flags.popup === 'true' } : {}),
           // Who starts the pane (the session or board supercode resolved; unset for a person), and whether the pane
           // runs its one verb as that caller (`close`/`stop` on another machine).
           ...(launcher() ? { caller: launcher() } : {}),

package/bin/workspace.mjs

@@ -793,7 +793,7 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     if (flags.install || (!flags.foreground && process.stdin.isTTY && process.stdout.isTTY)) {
       const serviceBin = process.env.SUPERCODE_BIN;
       if (!serviceBin) unsupported('--install requires invocation through the native supercode CLI');
-      const serviceEnv = { ...process.env, SUPERCODE_POPUPS: process.env.SUPERCODE_POPUPS ?? '0', SUPERCODE_TEAMS_ENTRY: fileURLToPath(new URL('./teams.mjs', import.meta.url)) };
+      const serviceEnv = { ...process.env, SUPERCODE_TEAMS_ENTRY: fileURLToPath(new URL('./teams.mjs', import.meta.url)) };
       // Refuse source-backed installs before Windows stops the running connector.
       try {
         execFileSync(serviceBin, ['__teams-connector-service', 'validate', contextName, path, context.server_id, context.team_id], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], env: serviceEnv });
@@ -838,9 +838,9 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     // Followed (live) sessions follow and load through one of their own, so a watched session never waits behind a pass.
     const liveCore = new SupercodeHarnessClient({ command: binary, args: ['harness', 'serve'] });
     const connector = new TeamsConnector({ server: context.origin, teamId: context.team_id, machineId: saved.machine.id, sourceId: saved.source.id, credential: saved.credential.token, stateDir: state.directory, core, largeCore, slowCore, liveCore, hostKeyId });
-    // A connected machine is a person's: each pane it launches opens a window on its screen (SUPERCODE_POPUPS=0: none).
+    // A connected machine is a person's: each pane it launches opens a window on its screen.
     const machineEvents = new MachineEvents({home:daemonHome,server:context.origin,teamId:context.team_id,credential:saved.credential.token,machineName:saved.machine.name,binary});
-    const machine = new TeamsMachine({ home: daemonHome, supercode: binary, popups: (process.env.SUPERCODE_POPUPS ?? '0') !== '0', ...(flags.tmux_socket ? { tmuxSocket: String(flags.tmux_socket) } : {}), link: { server: context.origin, teamId: context.team_id, machineId: saved.machine.id, credential: saved.credential.token, incarnationId: connector.state.incarnation_id, configuration: () => connector.configuration() }, onTurn: (turn) => connector.noteTurn(turn), onTurnWithdrawn: (turn) => connector.withdrawTurn(turn) });
+    const machine = new TeamsMachine({ home: daemonHome, supercode: binary, ...(flags.tmux_socket ? { tmuxSocket: String(flags.tmux_socket) } : {}), link: { server: context.origin, teamId: context.team_id, machineId: saved.machine.id, credential: saved.credential.token, incarnationId: connector.state.incarnation_id, configuration: () => connector.configuration() }, onTurn: (turn) => connector.noteTurn(turn), onTurnWithdrawn: (turn) => connector.withdrawTurn(turn) });
     machine.machineEvents = machineEvents;
     machine.on('link', (event) => { if (event.event === 'replaced') process.stderr.write(`supercode teams: ${event.error}. Two connectors were running for this machine; stop one of them (\`supercode teams disconnect\` where it should not run).\n`); });
     // The link's state for the watch after start: down until it is up, down again (since when) when it drops. A

package/fleet.mjs

@@ -2,6 +2,7 @@
 // `open --on`, and `harness drive --on`. A machine named with `--on` is an
 // enrolled machine of the selected Teams context, reached through its server;
 // without `--on` the verb acts on this OS user's own daemon.
+import { execFile } from 'node:child_process';
 import { resolve } from 'node:path';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 import { harnessTransport, nodeRpc, openRemoteMachine } from './client.mjs';
@@ -52,6 +53,9 @@ export async function fleetDiscover({ context = null, machines = null, params =
   const { client, context: selected } = fromContext({ supercodeHome, name, fetch: globalThis.fetch });
   const token = contexts.credential(selected.credential_ref).token;
   const listed = (await client.team(selected.team_id).machines.list()).items.filter((item) => item.enrollment === 'active');
+  // This machine's own sessions are read here, as `discover` reads them, not through the server and back
+  // into this machine's daemon.
+  const here = contexts.connector(selected.server_id, selected.team_id).read()?.machine?.id ?? null;
   const targets = machines && machines.length
     ? machines.map((wanted) => listed.find((item) => item.name === wanted || item.id === wanted) ?? { name: wanted, id: null })
     : listed;
@@ -60,6 +64,10 @@ export async function fleetDiscover({ context = null, machines = null, params =
     // A machine the server reports offline is not asked (asking only waits for a link that is not coming); it is
     // named as offline, not as a failure, and only when it was named or seen in the last day.
     if (machine.connection === 'offline') return { name: machine.name, offline: true, lastSeenAt: machine.last_seen_at ?? null };
+    if (machine.id === here) {
+      try { return { name: machine.name, sessions: await discoverHere(params, env) }; }
+      catch (error) { return { name: machine.name, error: error.message ?? String(error) }; }
+    }
     let channel = null;
     try {
       channel = await openRemoteMachine({ origin: selected.origin, teamId: selected.team_id, machineId: machine.id, token });
@@ -83,3 +91,14 @@ export async function fleetDiscover({ context = null, machines = null, params =
   }
   return { sessions, unreachable, ...(offline.length ? { offline } : {}) };
 }
+
+/** `harness.v1.sessions.discover` on this machine: the local `supercode discover` page. */
+function discoverHere(params, env) {
+  const args = ['discover', '--context', 'local', '--page'];
+  if (params.query) args.push('--query', String(params.query));
+  if (params.limit) args.push('--limit', String(params.limit));
+  if (params.workspace) args.push('--workspace', String(params.workspace));
+  for (const harness of params.harnesses ?? []) args.push('--harness', String(harness));
+  return new Promise((done, fail) => execFile(env.SUPERCODE_BIN || 'supercode', args, { env, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, timeout: 60_000 },
+    (error, stdout, stderr) => error ? fail(new Error((stderr || error.message).trim().split('\n').at(-1))) : done(JSON.parse(stdout).sessions ?? [])));
+}

package/machine.mjs

@@ -161,15 +161,13 @@ export class TeamsMachine extends MachineCore {
    * server link; `configuration()` resolves the machine's current configuration from the server
    * (custodian and machine grants). Without it the daemon serves its local door only.
    */
-  constructor({ home = teamsHome(), supercode = 'supercode', tmuxSocket, floor = null, limits = null, env = process.env, link = null, popups = false, onTurn = null, onTurnWithdrawn = null } = {}) {
+  constructor({ home = teamsHome(), supercode = 'supercode', tmuxSocket, floor = null, limits = null, env = process.env, link = null, onTurn = null, onTurnWithdrawn = null } = {}) {
     super({ home, floor, limits, env, link });
     this.supercodeBin = supercode;
     // Told of each turn a Room member typed here (the connector labels the captured message with who typed it).
     this.onTurn = onTurn;
     this.onTurnWithdrawn = onTurnWithdrawn;
     this.tmuxSocket = tmuxSocket ?? null;
-    // Each pane launched here opens a terminal window on this machine's screen (popupWindow).
-    this.popups = Boolean(popups);
     this.launches = new Launches(this.p.launches);
     // Windows has no tmux: its panes live in the machine's pane server, a process of their own that outlives this
     // daemon (a restart or an upgrade never ends a pane), as tmux panes live in tmux's server.
@@ -913,6 +911,13 @@ export class TeamsMachine extends MachineCore {
       queue.identity = saved.binding.identity; queue.host = this.host; queue.session = session;
       this.terminalMailboxes.set(saved.recipient, queue);
     }
+    // A queue whose pane has ended is not retried every second into a terminal that no longer
+    // exists. Its mail stays retained: the session's next pane takes it up.
+    for (const [recipient, queue] of this.terminalMailboxes) {
+      const binding = queue.state.binding;
+      const live = binding ? await this.#paneByContext(binding.context) : null;
+      if (!live || live.id !== binding.terminal) this.terminalMailboxes.delete(recipient);
+    }
     await Promise.all([...this.terminalMailboxes.values()].filter(queue => !this.inputRepairs[queue.state.binding?.context] && !this.inputInFlight.has(queue.session?.id)).map(queue => queue.kick()));
   }
 
@@ -1536,7 +1541,7 @@ export class TeamsMachine extends MachineCore {
           this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, by, ...executable, status, error: exit?.failed ? exit.how : undefined });
           return { key, pane: contextKey, reused: false, status, exit: exit?.how ?? null };
         }
-        if (this.popups && params.popup !== false) this.#popupWindow(contextKey, session);
+        if (params.popup !== false) this.#popupWindow(contextKey, session);
         if (params.notify) this.#noticeWhenEnded({ key, pane: contextKey, notify: params.notify, label: params.name ?? params.kind ?? params.program });
         return { key, pane: contextKey, reused: false, status: 'ready' };
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.174",
+  "version": "0.2.176",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",