@volter/supercode-teams 0.2.178 → 0.3.0

package/README.md

@@ -146,7 +146,8 @@ enrollments).
 ### RH2 agent DMs
 
 Share a session as its RH2 agent with `supercode teams sessions bind REF --room ROOM --agent PRINCIPAL --rh2 ORIGIN`.
-Only the session custodian can grant this binding. The returned `session` can be passed to RH2’s room-member door;
+Only the session custodian can grant this binding, in person or through an app they installed with
+`sessions.access` (the Agents → Room agents app binds a card agent's main session this way). The returned `session` can be passed to RH2’s room-member door;
 no session-backed channel is created. The agent DM uses the exact resource `${ROOM}:dm:${PRINCIPAL}`.
 `unbind` accepts the same flags. `--conversation` remains available for existing grants; it is mutually exclusive
 with `--agent`. Opening a DM reads the existing session; sending a turn is a separate action.

package/bin/fleet.mjs

@@ -9,7 +9,7 @@
 //       context the caller can reach (or the named subset), merged into one
 //       page; each unreachable machine is a row of its own. Nothing is stored.
 //   rpc --on <machine> <harness.v1 method> [json]     one operator request, one machine
-//   launch [--on <machine>] <program> [--cwd d] [--launch-key k] [--kind k] [--input text] -- args
+//   launch [--on <machine>] <program> [--cwd d] [--launch-key k] [--kind k] [--input text] [--env=KEY=VALUE]… -- args
 //       (`open --new`)
 //   attach [--on <machine>] <pane> [--mode observe|control]    ctrl-] detaches (`open --on`)
 //
@@ -28,6 +28,8 @@ for (let i = 0; i < argv.length; i += 1) {
   if (a === '--') { positional.push(...argv.slice(i + 1)); break; }
   if (a.startsWith('--')) {
     const eq = a.indexOf('=');
+    // `--env=KEY=VALUE` repeats: the pane's environment, one variable each.
+    if (eq > 0 && a.slice(2, eq) === 'env') { (flags.env ??= []).push(a.slice(eq + 1)); continue; }
     if (eq > 0) { flags[a.slice(2, eq)] = a.slice(eq + 1); continue; } // --args=--norc
     const key = a.slice(2);
     if (key === 'act-for-caller') { flags[key] = true; continue; }
@@ -95,6 +97,7 @@ async function main() {
           arguments: flags.args ? String(flags.args).split(' ').filter(Boolean) : rest,
           cwd: flags.cwd,
           initialInput: flags.input,
+          ...(Array.isArray(flags.env) ? { env: Object.fromEntries(flags.env.map((pair) => [pair.slice(0, pair.indexOf('=')), pair.slice(pair.indexOf('=') + 1)]).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key))) } : {}),
           name: flags.name,
           // The launch's window choice, when its caller states one: `open` attaching this terminal to the pane asks
           // for none, and the board's dispatcher states its workflow's choice on every launch.

package/bin/teams.mjs

@@ -305,11 +305,11 @@ async function main() {
       return;
     }
     case 'workspace': {
-      if (sub === 'list') return withNode(async (rpc) => out(await rpc.call('workspace.list', {})));
-      if (sub === 'register' && rest[0]) return withNode(async (rpc) => out(await rpc.call('workspace.register', { path: rest[0], repository: flags.repo ?? null })));
-      if (sub === 'unregister' && rest[0]) return withNode(async (rpc) => out(await rpc.call('workspace.unregister', { path: rest[0] })));
-      if (sub === 'resolve' && rest[0]) return withNode(async (rpc) => out(await rpc.call('workspace.resolve', { repository: rest[0], branch: flags.branch ?? null, solo: Boolean(flags.solo), card: flags.card ?? null, create: Boolean(flags.create) })));
-      if (sub === 'inspect' && rest[0]) return withNode(async (rpc) => out(await rpc.call('workspace.inspect', { path: rest[0] })));
+      if (sub === 'list') return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.list', {})));
+      if (sub === 'register' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.register', { path: rest[0], repository: flags.repo ?? null })));
+      if (sub === 'unregister' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.unregister', { path: rest[0] })));
+      if (sub === 'resolve' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.resolve', { repository: rest[0], branch: flags.branch ?? null, solo: Boolean(flags.solo), card: flags.card ?? null, create: Boolean(flags.create) })));
+      if (sub === 'inspect' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.inspect', { path: rest[0] })));
       // `workspace move --from A --to B --path P [--to-path Q]`: the project leaves A and arrives
       // at B, published there only if every byte arrived (sha256 on commit) and neither machine
       // runs an exec job. A is left as it was; B's path must not exist.

package/bin/workspace/agent-session.mjs

@@ -0,0 +1,20 @@
+// Native session hints choose the nearest actual harness when terminal servers inherited both variables.
+import { spawnSync } from 'node:child_process';
+import { basename } from 'node:path';
+export function agentSessionHint(env=process.env){
+  if(env.SUPERCODE_AGENT_SESSION)return env.SUPERCODE_AGENT_SESSION;
+  const claude=env.CLAUDE_CODE_SESSION_ID,codex=env.CODEX_THREAD_ID;
+  if(!claude)return codex?`codex:${codex}`:null;
+  if(!codex)return `claude-code:${claude}`;
+  const table=spawnSync('ps',['-A','-o','pid=,ppid=,comm='],{encoding:'utf8',timeout:2000});
+  const rows=new Map();for(const line of String(table.stdout??'').split('\n')){
+    const row=line.trim().match(/^(\d+)\s+(\d+)\s+(.*)$/);if(row)rows.set(Number(row[1]),{parent:Number(row[2]),name:basename(row[3])});
+  }
+  for(let pid=process.ppid,depth=0;pid>1&&depth<64;depth++){
+    const row=rows.get(pid);if(!row)break;
+    if(row.name==='codex')return `codex:${codex}`;
+    if(/^claude(\.exe)?$/.test(row.name))return `claude-code:${claude}`;
+    pid=row.parent;
+  }
+  throw new Error('native session hints are ambiguous; name --session SESSION');
+}

package/bin/workspace/args.mjs

@@ -1,7 +1,7 @@
 const BOOLEANS = new Set([
   'json', 'help', 'live', 'saved', 'watch', 'paginate', 'token-stdin',
   'invite-stdin', 'enrollment-stdin', 'include-children', 'rotate', 'install', 'force',
-  'take-control', 'dry-run', 'volter', 'foreground', 'no-connect', 'record-only', 'workplace-only',
+  'take-control', 'dry-run', 'volter', 'foreground', 'no-connect', 'record-only', 'workplace-only', 'main', 'descendants',
 ]);
 
 const VALUES = new Set([
@@ -9,9 +9,9 @@ const VALUES = new Set([
   'public-origin', 'init-team', 'as', 'user', 'repo', 'harness', 'machine',
   'source', 'cursor', 'limit', 'tail', 'before', 'after', 'revision', 'role',
   'out', 'ttl', 'type', 'name', 'visibility', 'backfill', 'format', 'to',
-  'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session',
+  'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session', 'starter',
   'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'workplace', 'organization', 'key', 'room',
-  'conversation', 'rh2', 'scope', 'agent', 'body-file', 'enrollment',
+  'if-match', 'observation', 'conversation', 'rh2', 'scope', 'agent', 'body-file', 'enrollment',
 ]);
 
 export function parseArgs(argv) {

package/bin/workspace.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import { hostname } from 'node:os';
+import { agentSessionHint } from './workspace/agent-session.mjs';
+import { compareAgentProfile } from '@volter/teams/agent-profile';
 import { fileURLToPath } from 'node:url';
 import { existsSync, readFileSync, realpathSync, rmSync } from 'node:fs';
 import { basename, join, resolve } from 'node:path';
@@ -43,12 +45,48 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   const contexts = new WorkspaceContexts(home);
   const outputStream = dependencies.stdout ?? process.stdout;
   const output = value => outputStream.write(flags.json ? `${JSON.stringify(value)}\n` : humanOutput(value));
+  if (verb==='identities'&&sub==='sender') {
+    only(flags,['json','help','context','body_file']);
+    if(!flags.body_file)usage('--body-file is required (use - for stdin)');
+    const {SenderIdentityRecord}=await import('@volter/teams/sender-identity');
+    const record=new SenderIdentityRecord({supercodeHome:home,context:flags.context??env.SUPERCODE_CONTEXT});
+    const identity=await record.observe(JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8')));
+    return output({...identity,links:identity.links.map(link=>({id:link.id,classification:link.classification,label:link.label,principal_id:link.principal_id}))});
+  }
   if (verb === 'context') return contextCommand({ contexts, flags, sub, rest, output });
   if (verb === 'server') return serverCommand({ flags, sub, rest, home, output });
   if (verb === 'login') return loginCommand({ flags, origin: sub, rest, home, output });
   if (verb === 'auth') return authCommand({ flags, sub, rest, home, contexts, output, env, dependencies });
   if (verb === 'connect' && flags.enrollment_stdin) adoptEnrollment(contexts, home, flags);
-  const explicitContext = flags.context ?? env.SUPERCODE_CONTEXT;
+  let agentLocal=null;
+  if(['agent','sessions'].includes(verb)){
+    const session=flags.session??agentSessionHint(env);
+    if(session){
+      let channel;
+      try{
+        channel=await openLocalMachine(paths(teamsHome()).socket);const rpc=await nodeRpc(channel);
+        const identity=await rpc.call('harness.v1.agents.session',{session});
+        agentLocal=identity;
+        if(identity&&!flags.context&&!env.SUPERCODE_AGENT_CONTEXT)env={...env,SUPERCODE_AGENT_CONTEXT:identity.context,SUPERCODE_AGENT_ID:identity.agent,SUPERCODE_AGENT_ASSIGNMENTS:JSON.stringify(identity.assignments)};
+      }catch(error){
+        // Only absence of an older/offline daemon permits the ordinary plain-session context.
+        if(!['ENOENT','ECONNREFUSED',-32601].includes(error.code))throw error;
+      }finally{channel?.close();}
+    }
+  }
+  // Every door called from an agent starts under its delegated context. A sibling product verb
+  // must not silently recover the custodian's ordinary login when an agent's reader is bounded.
+  const agentContext = env.SUPERCODE_AGENT_CONTEXT || null;
+  if(env.SUPERCODE_AGENT_ID&&!flags.context&&!agentContext){
+    // An identity minted while Teams was unreachable still answers whoami from its launch. No other door
+    // proceeds without the agent's delegation, and the custodian's own login is never borrowed.
+    if(verb==='agent'&&sub==='whoami')return output({data:{session:flags.session??agentSessionHint(env),
+      agent:{id:env.SUPERCODE_AGENT_ID,name:env.SUPERCODE_AGENT_NAME,path:env.SUPERCODE_AGENT_PATH,org:env.SUPERCODE_AGENT_ORG},
+      main:env.SUPERCODE_AGENT_MAIN!=='0',synced:env.SUPERCODE_AGENT_SYNCED!=='0',
+      assignment_intent:JSON.parse(env.SUPERCODE_AGENT_ASSIGNMENTS||'[]'),source:'launch environment; Teams delegation unavailable'}});
+    throw new Error('agent delegation is unavailable; no custodian context fallback is permitted');
+  }
+  const explicitContext = flags.context ?? agentContext ?? env.SUPERCODE_CONTEXT;
   let selected = explicitContext ?? contexts.read().current;
   const urlReference = verb === 'sessions' ? rest.find(value => /^https?:\/\//.test(value)) : null;
   if (!explicitContext && urlReference) selected = contextForUrl(contexts.read(), urlReference) ?? selected;
@@ -58,8 +96,13 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   const team = client.team(context.team_id);
   // A machine-only context (a box enrolled by its custodian) holds its machine credential and nothing a person has.
   if (context.machine_only && !['connect', 'disconnect', 'status'].includes(verb)) usage(`context ${selected} is machine ${context.machine_name}'s: run teams ${verb} where a person is signed in`);
-  const command = { flags, rest, output, client, context, team, explicitContext, home, contextName: selected, env, dependencies };
+  const command = { flags, rest, output, client, context, team, explicitContext, home, contextName: selected, env, dependencies,agentLocal };
   if (teamsPrefix && ['list', 'create'].includes(verb)) return teamsCommand(verb, sub, command);
+  if (verb === 'agent') return agentCommand(sub,command);
+  if (verb === 'principals') return principalsCommand(sub,command);
+  if (verb === 'permissions') return permissionsCommand(sub,command);
+  if (verb === 'org') return orgCommand(sub,command);
+  if (verb === 'identities') return identityRecordCommand(sub,command);
   if (verb === 'apps' || verb === 'app-installations') return appsCommand(verb,sub,{...command,output:value=>output(flags.json?value:redactAppSecrets(value))});
   if (verb === 'sessions') return sessionsCommand(sub, command);
   if (verb === 'members') return membersCommand(sub, command);
@@ -73,6 +116,115 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   usage(`unsupported workspace command ${verb}`);
 }
 
+async function agentCommand(sub,{flags,rest,team,output,env,agentLocal}) {
+  only(flags,['json','help','context','body_file','if_match','agent','session','starter','main','descendants','after','limit']);
+  const body=()=>{if(!flags.body_file)usage('--body-file is required (use - for stdin)');return JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8'));};
+  const currentSession=()=>{
+    const ref=flags.session??agentSessionHint(env);
+    if(!ref)usage('no session identity available; name --session SESSION');
+    return ref;
+  };
+  const whoami=async()=>{
+    const session=currentSession();
+    let identity;
+    try{identity=await team.sessions.get(session).identity();}
+    catch(error){
+      // A session asks at its start, before the board has joined it to its agent: it is told its launch, and says so.
+      if(error.code==='not_found'&&!env.SUPERCODE_AGENT_ID)throw Object.assign(new Error(`session ${session} is not in Teams yet, or not readable to you: a machine publishes a session its sync rules cover once it has recorded a turn`),{code:'not_found'});
+      if(error.code!=='not_found')throw error;
+      // the agent's own record is public to it before its session is joined; the launch names it when that is unreadable
+      const record=await team.agents.get(env.SUPERCODE_AGENT_ID).then(answer=>answer.data,()=>null);
+      return {data:{session,agent:record??{id:env.SUPERCODE_AGENT_ID,name:env.SUPERCODE_AGENT_NAME,path:env.SUPERCODE_AGENT_PATH,org:env.SUPERCODE_AGENT_ORG},
+        main:env.SUPERCODE_AGENT_MAIN!=='0',synced:env.SUPERCODE_AGENT_SYNCED!=='0',assignment_intent:JSON.parse(env.SUPERCODE_AGENT_ASSIGNMENTS||'[]'),
+        source:'launch environment; Teams has not yet joined this session to its agent'}};
+    }
+    if(env.SUPERCODE_AGENT_ID&&identity.data.agent?.id!==env.SUPERCODE_AGENT_ID)throw new Error('session ownership does not match its launch identity; catalogue publication may still be pending');
+    if(identity.data.agent&&env.SUPERCODE_AGENT_ASSIGNMENTS){
+      // Assignment hints are launch intent; live identity and access always come from the public door.
+      identity.data.assignment_intent=JSON.parse(env.SUPERCODE_AGENT_ASSIGNMENTS);
+    }
+    if(agentLocal&&identity.data.agent&&agentLocal.agent===identity.data.agent.id&&agentLocal.intended){
+      identity.data.profile_intent=agentLocal.intended;
+      identity.data.profile_comparison=compareAgentProfile(agentLocal.intended,identity.data.resolved);
+    }
+    return identity;
+  };
+  if(sub==='whoami'){requireArgs(rest,0,0,'agent whoami [--session SESSION]');return output(await whoami());}
+  if(sub==='sessions'){
+    requireArgs(rest,0,1,'agent sessions [AGENT] [--descendants]');
+    const id=rest[0]??flags.agent??(await whoami()).data.agent?.id;
+    if(!id)usage('this is a plain session; it has no owning agent');
+    return output(await team.agents.sessions(id,{descendants:flags.descendants?true:undefined,after:flags.after,limit:flags.limit}));
+  }
+  if(sub==='message'){
+    requireArgs(rest,1,1,'agent message SESSION --body-file FILE');
+    return output(await team.sessions.get(rest[0]).mail(body()));
+  }
+  if(sub==='list'){requireArgs(rest,0,0,'agent list');return output(await team.agents.list({after:flags.after,limit:flags.limit}));}
+  if(sub==='get'){requireArgs(rest,1,1,'agent get AGENT');return output(await team.agents.get(rest[0]));}
+  if(sub==='closures'){requireArgs(rest,1,1,'agent closures AGENT');return output(await team.agents.closures(rest[0]));}
+  if(sub==='declare'){requireArgs(rest,0,0,'agent declare --body-file FILE');return output(await team.agents.declare(body()));}
+  if(sub==='update'||sub==='end'){
+    requireArgs(rest,1,1,'agent update|end AGENT --body-file FILE --if-match REVISION');
+    if(!flags.if_match)usage('--if-match is required');
+    return output(await team.agents[sub](rest[0],body(),{ifMatch:Number(flags.if_match)}));
+  }
+  if(sub==='record'){
+    requireArgs(rest,0,0,'agent record --session SESSION [--agent AGENT | --starter STARTER_SESSION]');
+    const session=currentSession();
+    // Without --agent the starter decides: an agent's session makes this one that agent's; otherwise it stays plain.
+    return output(flags.agent?await team.agents.ownSession(flags.agent,{session,...(flags.main?{main:true}:{}),...(flags.starter?{starter_session:flags.starter}:{})})
+      :await team.sessions.get(session).recordLineage(flags.starter?{starter_session:flags.starter}:{}));
+  }
+  usage('agent whoami|sessions|message|list|get|declare|update|end|closures|record');
+}
+
+/** C5: one role-and-binding shape. Sharing a session, a machine or anything else in the Org is a binding. */
+async function permissionsCommand(sub,{flags,rest,team,output}) {
+  only(flags,['json','help','context','body_file']);
+  const body=()=>{if(!flags.body_file)usage('--body-file is required (use - for stdin)');return JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8'));};
+  if(sub==='roles'){requireArgs(rest,0,0,'permissions roles');return output(await team.permissions.roles());}
+  if(sub==='define-role'){requireArgs(rest,0,0,'permissions define-role --body-file FILE');return output(await team.permissions.defineRole(body()));}
+  if(sub==='bindings'){requireArgs(rest,2,2,'permissions bindings RESOURCE_KIND RESOURCE_ID');return output(await team.permissions.bindings({resource_kind:rest[0],resource_id:rest[1]}));}
+  if(sub==='bind'){requireArgs(rest,0,0,'permissions bind --body-file FILE');return output(await team.permissions.bind(body()));}
+  if(sub==='revoke'){requireArgs(rest,1,1,'permissions revoke BINDING');return output(await team.permissions.revoke(rest[0]));}
+  if(sub==='decide'){requireArgs(rest,0,0,'permissions decide --body-file FILE');return output(await team.permissions.decide(body()));}
+  usage('permissions roles|define-role|bindings|bind|revoke|decide');
+}
+
+/** The team's standard org doors: an identity issuer's groups it admits, the app it takes its members from, and the
+ * removals that source asked for that the team could not apply. */
+async function orgCommand(sub,{flags,rest,client,context,output}) {
+  only(flags,['json','help','context']);
+  const path=`/api/v1/teams/${encodeURIComponent(context.team_id)}`;
+  if(sub==='groups'){requireArgs(rest,0,0,'org groups');return output(await client.request('GET',`${path}/identity/groups`));}
+  if(sub==='link-group'||sub==='unlink-group'){requireArgs(rest,2,2,`org ${sub} ISSUER GROUP`);return output(await client.request(sub==='link-group'?'POST':'DELETE',`${path}/identity/groups`,{body:{issuer:rest[0],group:rest[1]}}));}
+  if(sub==='source'){requireArgs(rest,0,0,'org source');return output(await client.request('GET',`${path}/membership-source`));}
+  if(sub==='link-source'){requireArgs(rest,1,1,'org link-source INSTALLATION');return output(await client.request('PUT',`${path}/membership-source`,{body:{installation_id:rest[0]}}));}
+  if(sub==='unlink-source'){requireArgs(rest,0,0,'org unlink-source');return output(await client.request('DELETE',`${path}/membership-source`));}
+  if(sub==='alarms'){requireArgs(rest,0,0,'org alarms');return output(await client.request('GET',`${path}/membership-alarms`));}
+  if(sub==='seats'){requireArgs(rest,0,0,'org seats');return output(await client.request('GET',`${path}/membership-seats`));}
+  usage('org groups|link-group|unlink-group|source|link-source|unlink-source|alarms|seats');
+}
+
+/** An automation's accountable person; agents it starts inherit this sponsor. */
+async function principalsCommand(sub,{flags,rest,team,output}) {
+  only(flags,['json','help','context']);
+  if(sub==='sponsor'){requireArgs(rest,1,2,'principals sponsor AUTOMATION [PERSON]');return output(rest[1]?await team.principals.setSponsor(rest[0],rest[1]):await team.principals.sponsor(rest[0]));}
+  if(sub==='unsponsor'){requireArgs(rest,1,1,'principals unsponsor AUTOMATION');return output(await team.principals.clearSponsor(rest[0]));}
+  usage('principals sponsor|unsponsor');
+}
+
+async function identityRecordCommand(sub,{flags,rest,team,output}) {
+  only(flags,['json','help','context','body_file','if_match','observation','after','limit']);
+  const body=()=>{if(!flags.body_file)usage('--body-file is required (use - for stdin)');return JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8'));};
+  if(sub==='resolve'){requireArgs(rest,1,1,'teams identities resolve OBSERVATION');return output(await team.identity.resolve(rest[0]));}
+  if(sub==='observations'||sub==='sightings'){requireArgs(rest,0,0,'teams identities observations|sightings');return output(await team.identity[sub]({observation:flags.observation,after:flags.after,limit:flags.limit}));}
+  if(['observe','link','infer','declare-person'].includes(sub)){requireArgs(rest,0,0,'teams identities observe|link|declare-person --body-file FILE');return output(await team.identity[sub==='declare-person'?'declarePerson':sub](body()));}
+  if(sub==='revoke'||sub==='revoke-inference'){requireArgs(rest,1,1,'teams identities revoke LINK --if-match REVISION');return output(await team.identity[sub==='revoke'?'revoke':'revokeInference'](rest[0],{ifMatch:Number(flags.if_match)}));}
+  usage('teams identities observations|sightings|resolve|observe|declare-person|link|revoke');
+}
+
 function redactAppSecrets(value) {
   if(!value||typeof value!=='object')return value;
   if(Array.isArray(value))return value.map(redactAppSecrets);
@@ -842,6 +994,16 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     const machineEvents = new MachineEvents({home:daemonHome,server:context.origin,teamId:context.team_id,credential:saved.credential.token,machineName:saved.machine.name,binary});
     const machine = new TeamsMachine({ home: daemonHome, supercode: binary, ...(flags.tmux_socket ? { tmuxSocket: String(flags.tmux_socket) } : {}), link: { server: context.origin, teamId: context.team_id, machineId: saved.machine.id, credential: saved.credential.token, incarnationId: connector.state.incarnation_id, configuration: () => connector.configuration() }, onTurn: (turn) => connector.noteTurn(turn), onTurnWithdrawn: (turn) => connector.withdrawTurn(turn) });
     machine.machineEvents = machineEvents;
+    connector.closeAgentSession=async id=>{
+      const channel=await openLocalMachine(paths(daemonHome).socket);
+      try{const rpc=await nodeRpc(channel);return await rpc.call('harness.v1.agents.closeSession',{closure:id},{timeoutMs:60000});}
+      finally{channel.close();}
+    };
+    connector.agentClosureReceipt=async id=>{
+      const channel=await openLocalMachine(paths(daemonHome).socket);
+      try{const rpc=await nodeRpc(channel);return await rpc.call('harness.v1.agents.closureReceipt',{closure:id});}
+      finally{channel.close();}
+    };
     machine.on('link', (event) => { if (event.event === 'replaced') process.stderr.write(`supercode teams: ${event.error}. Two connectors were running for this machine; stop one of them (\`supercode teams disconnect\` where it should not run).\n`); });
     // The link's state for the watch after start: down until it is up, down again (since when) when it drops. A
     // `replaced` link is left alone: another connector for this machine owns it, by design.
@@ -859,7 +1021,7 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     // restarts (from a supercode old enough not to wait for the service): it yields to the service's connector, which
     // otherwise failed on EADDRINUSE at every restart and left this machine unlinked.
     if (saved.service) await retireLinklessDaemon(paths(daemonHome).machine);
-    try { await machine.start(); await connector.start({ roots: () => saved.roots }); machineEvents.start(); } catch (error) { await stopAll(); throw error; }
+    try { await machine.start(); await connector.start({ roots: () => saved.roots,bindings:()=>machine.sessionBindings(saved.machine.id,connector.state.incarnation_id) }); machineEvents.start(); } catch (error) { await stopAll(); throw error; }
     output({ version: 1, context: scope(context), data: { machine: saved.machine, source: saved.source, roots: saved.roots.map(({ path: _path, ...item }) => item), socket: machine.socketPath, foreground: true } });
     // Run by a service, the connector moves to an upgrade on its own: its readers would otherwise answer from the code
     // they loaded until something restarted it (after 0.5.51 this Mac's went on reading a Codex turn waiting on an
@@ -1085,10 +1247,14 @@ function printHelp() {
   process.stdout.write(`supercode workspace commands:
   context create|list|show|use|remove
   teams list|create
+  agent whoami|sessions|message|list|get|declare|update|end|closures|record
+  principals sponsor AUTOMATION [PERSON] | principals unsponsor AUTOMATION
+  permissions roles | define-role --body-file F | bindings KIND ID | bind --body-file F | revoke BINDING | decide --body-file F
   auth login|status|switch|logout   (one Volter sign-in; "supercode login" is "auth login")
   login [ORIGIN] [--team TEAM] [--as CONTEXT] [--token-stdin|--invite-stdin]   (Volter sign-in in the browser by default)
   identity link
-  server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN] [--delegated-issuers ORIGIN,ORIGIN]
+  identities observations|sightings|resolve|observe|declare-person|link|infer|revoke|revoke-inference --body-file FILE
+  server start [--data-dir DIR] [--listen HOST:PORT] [--public-origin ORIGIN] [--init-team NAME] | server token
   publish pane|root TARGET --room ROOM --workplace ORIGIN --organization ORG [--scope view|control] [--name] [--key] [--machine] [--token-stdin] [--record-only]
   unpublish SURFACE --room ROOM --workplace ORIGIN --organization ORG [--machine] [--token-stdin] [--record-only|--workplace-only]
   connect|disconnect|status

package/board-process-guard.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// The board's native PreToolUse command policy. No process lookup or signal occurs here.
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+export const processGuardReason = 'Pattern kills are refused for board sessions. Kill only the PID this session recorded when it started that process; use the owning service door for a service.';
+export function patternKill(command) {
+  // Inspect shell bodies as well as nested `sh -c` / substitutions. Removing shell
+  // escapes and quotes catches split words, paths and quoted embedded commands.
+  const text = String(command).replace(/\\\r?\n/g, '').replace(/\\([a-zA-Z-])/g, '$1').replace(/["']/g, '');
+  const head = String.raw`(?:^|[;|&(\n{}]|\s-[a-zA-Z]*c\s+)\s*(?:(?:env|sudo|exec|command|xargs|nohup|do|then|else|!)\s+(?:--?[^\s;|&()]+\s+)*|[A-Za-z_][A-Za-z0-9_]*=[^\s;|&()]+\s+)*(?:[\w./-]+/)?`;
+  return new RegExp(head + String.raw`(?:pkill|killall)(?=$|[\s;|&()])`).test(text) ||
+    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text);
+}
+const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
+export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath } = {}) {
+  if (!enabled) return args;
+  const command = `${quote(node)} ${quote(fileURLToPath(import.meta.url))}`;
+  const hooks = [{ matcher: '^Bash$', hooks: [{ type: 'command', command, timeout: 10 }] }];
+  if (kind === 'claude-code') {
+    const next = [...args], at = next.findIndex(arg => arg === '--settings' || arg.startsWith('--settings='));
+    if (at < 0) return [...next, '--settings', JSON.stringify({ hooks: { PreToolUse: hooks } })];
+    const inline = next[at].startsWith('--settings='), value = inline ? next[at].slice(11) : next[at + 1];
+    const settings = JSON.parse(value?.trimStart().startsWith('{') ? value : readFileSync(resolve(cwd || process.cwd(), value), 'utf8'));
+    settings.hooks ??= {}; settings.hooks.PreToolUse = [...(settings.hooks.PreToolUse ?? []), ...hooks];
+    next.splice(at, inline ? 1 : 2, '--settings', JSON.stringify(settings));
+    return next;
+  }
+  if (kind === 'codex') {
+    // Native Codex rules cannot split substitutions such as kill $(pgrep -f …).
+    // Its synchronous Bash hook can deny the entire command before execution.
+    // This invocation enables and trusts the board-vetted command policy.
+    const handler = `{ matcher = "^Bash$", hooks = [{ type = "command", command = ${JSON.stringify(command)}, timeout = 10 }] }`;
+    const next = [...args], at = next.indexOf('--');
+    next.splice(at < 0 ? next.length : at, 0, ...(next.includes('--dangerously-bypass-hook-trust') ? [] : ['--dangerously-bypass-hook-trust']), '-c', 'features.hooks=true', '-c', `hooks.PreToolUse=[${handler}]`);
+    return next;
+  }
+  throw new Error(`board process guard is unavailable for ${kind}; no unguarded session was launched`);
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const input = JSON.parse(readFileSync(0, 'utf8'));
+    const command = input.tool_input?.command ?? input.tool_input?.cmd;
+    if (typeof command !== 'string') throw new Error('Bash hook input has no command');
+    if (patternKill(command)) process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+      hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: processGuardReason,
+    } }) + '\n');
+  } catch (error) {
+    process.stderr.write(`Board process policy could not read the command: ${error.message}. ${processGuardReason}\n`);
+    process.exitCode = 2;
+  }
+}

package/client.mjs

@@ -6,10 +6,10 @@ import { connect as netConnect } from 'node:net';
 import { randomBytes } from 'node:crypto';
 import { EventEmitter } from 'node:events';
 import { Channel } from '@volter/teams/channel';
-import { openLocalMachine, openRemoteMachine, StreamRpc, fromWebPage } from '@volter/teams/client';
-import { lineSplitter } from './lines.mjs';
+import { openLocalMachine, openRemoteMachine, StreamRpc, fromWebPage, harnessTransport } from '@volter/teams/client';
+import { lineSplitter } from '@volter/teams/lines';
 
-export { openLocalMachine, openRemoteMachine, StreamRpc, fromWebPage };
+export { openLocalMachine, openRemoteMachine, StreamRpc, fromWebPage, harnessTransport };
 
 export async function execServerBridge(channel, harness, { host = '127.0.0.1' } = {}) {
   // a channel, or a function opening one per connection (closed with it), so a daemon's restart strands nothing
@@ -47,32 +47,6 @@ export async function execServerBridge(channel, harness, { host = '127.0.0.1' }
   };
 }
 
-/**
- * A `HarnessTransport` (harness SDK `ClientOptions.transport`) over the
- * channel's `harness` stream. Only an operator's channel is admitted to it.
- */
-export function harnessTransport(channel) {
-  let stream = null;
-  return {
-    get running() { return stream !== null && !stream.closed; },
-    async start(handlers) {
-      stream = await channel.open('harness');
-      const lines = lineSplitter();
-      stream.on('data', (chunk) => {
-        for (const line of lines(chunk)) if (line) handlers.onLine(line);
-      });
-      stream.on('close', (reason) => handlers.onExit(null, reason ?? null));
-    },
-    write(line) {
-      if (!stream || stream.closed) throw new Error('harness stream is not open');
-      stream.write(line.endsWith('\n') ? line : line + '\n');
-    },
-    async close() {
-      stream?.close();
-      stream = null;
-    },
-  };
-}
 
 /** The node's own doors (describe, grants, launch, files, ports, attention, titles) over the `node` stream. */
 export async function nodeRpc(channel) {

package/connector/agent-closures.mjs

@@ -0,0 +1,28 @@
+// End obligations survive reconnects. Once an attempt may have crossed the process boundary, it is never replayed.
+export async function consumeAgentClosures(connector){
+  const c=connector,path=`/machines/${c.machineId}/agent-closures`;
+  const page=await c.request('GET',path),attempts=c.state.agent_closures??={};
+  for(const closure of page.items??[]){
+    if(c.abort.signal.aborted)return;
+    const target=`${path}/${encodeURIComponent(closure.id)}`;
+    let local=attempts[closure.id];
+    if(local?.result){await c.request('POST',`${target}/result`,local.result);local.reported=true;c.save();continue;}
+    if(local||closure.state==='claimed'){
+      if(closure.state==='pending')await c.request('POST',`${target}/claim`,{});
+      // Read the native receipt before classifying a lost RPC reply. Never replay the close.
+      if(!c.agentClosureReceipt)continue;
+      const receipt=await c.agentClosureReceipt(closure.id);
+      if(receipt.pending)continue;
+      local=attempts[closure.id]??={};local.result=receipt.result??{state:'unknown',reason:'prior closure attempt has no retained receipt'};c.save();
+      await c.request('POST',`${target}/result`,local.result);local.reported=true;c.save();continue;
+    }
+    local=attempts[closure.id]={attempted_at:c.clock.nowMs()};c.save();
+    const claim=await c.request('POST',`${target}/claim`,{});
+    if(!claim.execute){local.result={state:'unknown',reason:'closure was already claimed'};c.save();continue;}
+    try{
+      if(!c.closeAgentSession)throw new Error('this connector has no native closure door');
+      local.result=await c.closeAgentSession(closure.id);
+    }catch(error){local.error=String(error.message).slice(0,1024);c.save();continue;}
+    c.save();await c.request('POST',`${target}/result`,local.result);local.reported=true;c.save();
+  }
+}

package/connector/index.d.ts

@@ -7,6 +7,7 @@ export interface ConnectorClock {
 }
 
 export interface LoadedConnectorSession {
+  resolved_profile?: import('@volter/supercode-harness-sdk').NormalizedSession['resolved_profile'];
   messages?: Array<NormalizedMessage | ({ value: NormalizedMessage } & Record<string, unknown>)>;
   turns?: Array<NormalizedMessage | ({ value: NormalizedMessage } & Record<string, unknown>)>;
   title?: string | null;