@volter/supercode-teams 0.2.175 → 0.2.177

package/README.md

@@ -61,7 +61,13 @@ anything else, for a wildcard (`pane:*`) or for the whole filesystem (`root:/`)
 token must carry `iat` and live at most 15 minutes (`exp - iat` and `exp - now`). The hosted viewer
 at `/view#token=…` opens it; the server turns the token into a machine grant on exactly that target
 (a pane: `observe`, and `control` to type; a folder: `observe` to read, `files` to change) that
-expires with the token, and closes the channel then. A page embedding the viewer sends it a fresh
+expires with the token, and closes the channel then. Before it writes that grant, and while the
+channel is open every 15 seconds, the server asks the workplace whether the token still admits what it was issued for
+(`POST <issuer>/api/v3/delegated/status`); when the workplace answers that it does not (the member's
+binding revoked, their Task closed, their contract ended), the grant is deleted and the channel closes
+with `access_revoked`, which the viewer shows rather than reconnecting; an open with such a token is
+refused (403 `access_revoked`) and writes no grant. An unreachable workplace leaves the channel to
+the token's expiry. A page embedding the viewer sends it a fresh
 token by `postMessage({ type: 'delegated-token', token })`, which the viewer asks for with
 `delegated-token-needed`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.175",
+  "version": "0.2.177",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/terminal-mail.mjs

@@ -3,9 +3,20 @@
 import { mkdirSync, readFileSync, writeFileSync, renameSync, appendFileSync, statSync, openSync, readSync, closeSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 import { StringDecoder } from 'node:string_decoder';
 import { codexUpdatePrompt } from './codex-startup.mjs';
 
+// When process `pid` started (ms), from `ps -o etime=` ([[dd-]hh:]mm:ss); null when it cannot be read.
+function startedAt(pid) {
+  if (!Number.isInteger(pid)) return null;
+  const out = spawnSync('ps', ['-o', 'etime=', '-p', String(pid)], { encoding: 'utf8' }).stdout?.trim();
+  const m = /^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/.exec(out ?? '');
+  if (!m) return null;
+  const [, d = 0, h = 0, mi, se] = m.map((v) => (v === undefined ? 0 : Number(v)));
+  return Date.now() - (((d * 24 + h) * 60 + mi) * 60 + se) * 1000;
+}
+
 const hash = value => createHash('sha256').update(value).digest('hex');
 const textOf = content => typeof content === 'string' ? content : Array.isArray(content) && content.every(p => ['text', 'input_text'].includes(p.type)) ? content.map(p => p.text).join('') : null;
 
@@ -85,6 +96,13 @@ export class TerminalMailbox {
     this.state.binding = { context: session.contextKey, terminal: session.id, pid: session.rootPid, identity }; this.save();
     return messageIds;
   }
+  /** Whether `batch` was pasted into another terminal than the one the session runs in now. A batch from before
+   *  pastes recorded their terminal is judged by its last Enter: a process started after it never saw the paste. */
+  pastedElsewhere(batch) {
+    if (batch.terminal) return batch.terminal !== this.session.id || (batch.pid != null && batch.pid !== this.session.rootPid);
+    const started = startedAt(this.session.rootPid);
+    return Boolean(batch.last_enter) && started !== null && started > batch.last_enter;
+  }
   kick() {
     if (this.work) return this.work;
     this.work = this.drain().catch(error => {
@@ -117,6 +135,16 @@ export class TerminalMailbox {
       this.state.receipts.push(receipt);
       this.state.active = null; this.save(); this.log(receipt); return;
     }
+    if (batch.phase !== 'prepared' && this.session && this.pastedElsewhere(batch)) {
+      // The paste went to a terminal the session no longer runs in (its pane's process was replaced, a resume): that
+      // composer died with its process and the transcript never got the text, so the batch is pasted again here.
+      // Nothing is guessed: the transcript was read above, from the paste's own offset, and holds no such message.
+      this.log({ delivered: false, queued: true, batch: batch.id, message_ids: batch.message_ids, reason: `pasted into terminal ${batch.terminal ?? 'unrecorded'}, which the session no longer runs in; pasting again into ${this.session.id}` });
+      const baseline = batch.kind === 'codex' ? null : await this.load(this.identity.locator, { message_tail: 1 });
+      Object.assign(batch, { phase: 'prepared', enters: 0, last_enter: 0, error: null, path: this.identity.path, locator: this.identity.locator,
+        offset: batch.kind === 'codex' ? statSync(this.identity.path).size : null, messageOffset: baseline?.window?.total_messages ?? null });
+      this.save();
+    }
     if (batch.kind === 'codex' && codexUpdatePrompt(await this.host.capture(this.session.id, { lines: 120 }))) {
       batch.error = 'codex-update-prompt: delivery retained; restart Codex with check_for_update_on_startup=false';
       this.save(); this.log({ delivered: false, queued: true, reason: batch.error, message_ids: batch.message_ids }); return;
@@ -124,7 +152,7 @@ export class TerminalMailbox {
     if (batch.phase === 'prepared') {
       // Persist uncertainty before I/O. A daemon restart checks the transcript;
       // it never guesses that an unacknowledged paste did not happen.
-      batch.phase = 'paste_started'; this.save();
+      Object.assign(batch, { phase: 'paste_started', terminal: this.session.id, pid: this.session.rootPid ?? null, pasted_at: Date.now() }); this.save();
       // The terminal host's final newline selects one bracketed paste;
       // submitMode:none holds the separate Enter until the paste completes.
       await this.host.sendInput(this.session.id, `${batch.text}\n`, { submitMode: 'none' });