@volter/supercode-teams 0.2.178 → 0.3.0

package/machine.mjs

@@ -29,8 +29,12 @@ import { EventEmitter } from 'node:events';
 import { appendFileSync, readFileSync, writeFileSync, writeSync, statSync, readdirSync, mkdirSync, renameSync, rmSync, existsSync, openSync, readSync, closeSync, accessSync, constants } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { boardGuardArguments } from './board-process-guard.mjs';
 import { homedir, hostname } from 'node:os';
 import { Workspaces, inspectCheckout } from './workspaces.mjs';
+import { WorkspaceContexts, fromContext } from '@volter/teams/context';
+import { TeamsClient } from '@volter/teams/http-client';
+import { supercodeHome } from '@volter/teams/home';
 import { readMailHistory } from './mail-history.mjs';
 import { randomBytes, createHash } from 'node:crypto';
 import { WebSocket } from 'ws';
@@ -39,7 +43,7 @@ import { TmuxTerminalHost, classifyAttentionSignal, composerHoldsDraft, composer
 // than failing the load: a POSIX daemon never needs it. Windows needs a supercode-terminal with PtyTerminalHost.
 import * as terminal from '@volter/supercode-terminal';
 import { findLiveReceipt, mintFrontendCredential } from '@volter/supercode-harness-sdk/live-runtime';
-import { lineSplitter } from './lines.mjs';
+import { lineSplitter } from '@volter/teams/lines';
 import { NODE_PROTOCOL } from '@volter/teams/channel';
 import { holds, observesPanes } from '@volter/teams/admission';
 import { MachineCore, MACHINE_VERSION } from '@volter/teams/machine-core';
@@ -53,6 +57,7 @@ import { JobOwner, executionCapabilities, streamProgram, serveWorkspace } from '
 import { TerminalMailbox, retainedTerminalMail } from './terminal-mail.mjs';
 import { confirmNativeInitialInput } from './native-initial-input.mjs';
 import { canonicalCodexFolderTrust, codexProgram, codexStartupArguments, codexUpdatePrompt, codexVersion, settleCodexHookReview } from './codex-startup.mjs';
+import { sessionNoticeTarget } from './session-notice-target.mjs';
 
 /** The preload every launched pane carries: it announces the ports a pane's node processes listen on. */
 const PORTHOLE_HOOK = fileURLToPath(new URL('./porthole-hook.cjs', import.meta.url));
@@ -155,6 +160,29 @@ function paneExit(pane) {
 export class TeamsMachine extends MachineCore {
   /** Typed lines by key → the answer their first attempt gives (see #serveTurn). */
   #turnKeys = new Map();
+  #sessionBindings = new Map();
+
+  /** Native process evidence, published by the connector; a missing transport never reports an end. */
+  async sessionBindings(machineId,incarnationId) {
+    const panes=await this.host.listSessions();
+    const live=panes.filter(pane=>!pane.dead&&pane.rootPid);
+    const reading=live.length?await this.#serveRequest('harness.v1.sessions.activity_under',{pids:live.map(pane=>pane.rootPid)}):{activities:[]};
+    const byPid=new Map((reading.activities??[]).map(item=>[item.pid,item.activity]));
+    const current=new Set(panes.filter(pane=>!pane.dead).map(pane=>pane.contextKey));
+    for(const pane of live){
+      const activity=byPid.get(pane.rootPid);if(!activity?.session_id)continue;
+      const key=`${pane.contextKey}:${activity.harness}:${activity.session_id}`;
+      this.#sessionBindings.set(key,{id:`pane_${createHash('sha256').update(`${machineId}:${incarnationId}:${key}`).digest('hex').slice(0,32)}`,
+        machine_id:machineId,incarnation_id:incarnationId,pane:pane.contextKey,harness:activity.harness,
+        native_session_id:activity.session_id,native_runtime_id:activity.session_id,state:activity.presence==='running'?'running':'unknown',
+        observed_at:Date.now(),native_capabilities:[],evidence:activity.evidence});
+    }
+    for(const binding of this.#sessionBindings.values()){
+      if(!current.has(binding.pane)){binding.state='stopped';binding.observed_at=Date.now();}
+      else if(!live.some(pane=>pane.contextKey===binding.pane&&byPid.get(pane.rootPid)?.session_id===binding.native_session_id)){binding.state='unknown';binding.observed_at=Date.now();}
+    }
+    return [...this.#sessionBindings.values()];
+  }
 
   /**
    * `link`: { server, teamId, machineId, credential, incarnationId, configuration } to hold the
@@ -475,22 +503,87 @@ export class TeamsMachine extends MachineCore {
 
   // ---- mail ----------------------------------------------------------------
 
-  #serveMail(entry, stream, accept, refuse) {
+  #nativeMailReply(request){
+    return new Promise((resolve,reject)=>{
+      const child=spawn(this.supercodeBin,['message','remote-deliver'],{stdio:['pipe','pipe','ignore'],env:this.env});
+      let output='',done=false;
+      const finish=(error,result)=>{if(done)return;done=true;clearTimeout(timer);error?reject(error):resolve(result);};
+      const timer=setTimeout(()=>{child.kill('SIGTERM');finish(new Error('native mail read timed out'));},10000);
+      child.stdout.on('data',chunk=>{output+=chunk;if(output.length>4*1024*1024){child.kill('SIGTERM');finish(new Error('native mail reply exceeded its bound'));}});
+      child.once('error',error=>finish(error));
+      child.once('close',code=>{
+        if(code!==0)return finish(new Error(`native mail read exited ${code}`));
+        try{finish(null,JSON.parse(output));}catch{finish(new Error('native mail read returned invalid JSON'));}
+      });
+      child.stdin.on('error',error=>finish(error));child.stdin.end(JSON.stringify(request));
+    });
+  }
+
+  #noticeTarget(address){
+    return sessionNoticeTarget(address,{machine:hostname().split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g,'-'),
+      mail:request=>this.#nativeMailReply(request),
+      discover:params=>this.#serveRequest('harness.v1.sessions.discover',params,10000),
+      recordedConfig:locator=>this.#serveRequest('harness.v1.sessions.recorded_config',{locator},15000)});
+  }
+
+  async #resumeNoticeTarget(address){
+    const pending=this.noticeResumes??=new Map();
+    if(pending.has(address))return pending.get(address);
+    const resume=(async()=>{
+      const status=await this.#noticeTarget(address);
+      if(status.state==='running')return;
+      if(!status.resumable)throw Object.assign(new Error(status.reason??'native session cannot resume'),{noticeCode:'session_resume_unavailable'});
+      const code=await new Promise((resolve,reject)=>{
+        // Explicit native approval and sandbox flags suppress open's unattended defaults.
+        const child=spawn(this.supercodeBin,['open',address,'--detach','--',...status.resume.args],
+          {cwd:status.resume.cwd,env:{...this.env,SUPERCODE_POPUPS:'0'},stdio:'ignore'});
+        const timer=setTimeout(()=>{child.kill('SIGTERM');resolve(null);},15000);
+        child.once('error',error=>{clearTimeout(timer);reject(error);});child.once('close',code=>{clearTimeout(timer);resolve(code);});
+      });
+      for(const deadline=Date.now()+10000;;await new Promise(resolve=>setTimeout(resolve,200))){
+        const live=await this.#nativeMailReply({op:'list'});
+        if(live.code===0&&live.sessions?.some(row=>row.address===address))return;
+        if(Date.now()>=deadline)throw Object.assign(new Error(code===0?'native resume started but has no live delivery door':`native resume was not confirmed (exit ${code??'timeout'})`),{noticeCode:'session_resume_pending'});
+      }
+    })();
+    pending.set(address,resume);
+    try{return await resume;}finally{pending.delete(address);}
+  }
+
+  #serveMail(entry, stream, accept, refuse,requestOverride=null) {
     // One message into a session on this machine, delivered by `supercode message
     // remote-deliver` through the same doors a local send uses. The receiver is the
     // target: `mail:*` reaches every session here, `mail:<address>` one of them; a
     // receiver named rather than addressed needs `mail:*`.
     const { admitted, principal } = entry;
-    const request = stream.params?.request;
+    const request = requestOverride??stream.params?.request;
     if (request?.op === 'turn') return this.#serveTurn(entry, request, stream, accept, refuse);
     if (request?.op === 'history') return this.#serveMailHistory(entry, request, stream, accept, refuse);
     const to = typeof request?.to === 'string' ? request.to : '*';
     const target = to.startsWith('sc:') ? `mail:${to}` : 'mail:*';
-    if (!request || !['send', 'file', 'list'].includes(request.op)) return refuse('mail needs a send, file, list or turn request');
+    if (!request || !['send', 'file', 'list','status'].includes(request.op)) return refuse('mail needs a send, file, list, status or turn request');
     if (!holds(admitted, 'mail', target)) {
       this.log.append({ principal, cap: 'mail', target, outcome: 'refused' });
       return refuse(`no mail grant for ${target}`);
     }
+    if(request.op==='status'){
+      if(!to.startsWith('sc:'))return refuse('status requires one exact native address');
+      accept();
+      void this.#noticeTarget(to).then(({resume,...native})=>{
+        if(!stream.closed){stream.write(JSON.stringify({code:0,native}));stream.close('status');}
+      }).catch(()=>{if(!stream.closed){stream.write(JSON.stringify({code:5,native:{state:'unknown',reason:'native_liveness_unavailable',resumable:false}}));stream.close('status');}});
+      return;
+    }
+    if(request.resume_if_closed===true){
+      if(request.op!=='send'||!to.startsWith('sc:'))return refuse('thread resume requires an exact send target');
+      accept();
+      void this.#resumeNoticeTarget(to).then(()=>{
+        if(stream.closed)return;
+        if(!holds(entry.admitted,'mail',target)){stream.write(JSON.stringify({code:2,error:'access_revoked',text:'native mail grant expired before delivery'}));stream.close('refused');return;}
+        this.#serveMail(entry,stream,()=>{},refuseWith=>{if(!stream.closed){stream.write(JSON.stringify({code:2,text:refuseWith}));stream.close('refused');}},{...request,resume_if_closed:false});
+      }).catch(error=>{if(!stream.closed){stream.write(JSON.stringify({code:3,error:error.noticeCode??'session_resume_unavailable',text:error.message}));stream.close('refused');}});
+      return;
+    }
     accept();
     const child = spawn(this.supercodeBin, ['message', 'remote-deliver'], { stdio: ['pipe', 'pipe', 'pipe'], env: this.env });
     let out = '';
@@ -629,6 +722,8 @@ export class TeamsMachine extends MachineCore {
     // A long-lived tmux server can predate a consolidated installation.
     // New panes inherit this daemon's selected tools, not that stale PATH.
     env.PATH ??= this.env.PATH;
+    // Its CLI reads this machine's contexts and sockets, not whatever home that server started with.
+    if (this.env.SUPERCODE_HOME) env.SUPERCODE_HOME ??= this.env.SUPERCODE_HOME;
     const inherited = env.NODE_OPTIONS ?? this.env.NODE_OPTIONS ?? '';
     // Quoted: NODE_OPTIONS splits on spaces, and a home path may hold one (Windows user folders often do).
     env.NODE_OPTIONS = `${inherited} --require ${JSON.stringify(PORTHOLE_HOOK)}`.trim();
@@ -640,7 +735,8 @@ export class TeamsMachine extends MachineCore {
   // Native session hooks carry the launcher's identity across Codex's shared
   // app-server process boundary. Process ancestry alone cannot recover it.
   #nativeQuestionCommand(params, pane, by, nativeInput) {
-    const args = params.arguments ?? [];
+    if (params.env?.SUPERCODE_BOARD_PROCESS_GUARD === '1' && process.platform === 'win32') throw new Error('board process guard is unavailable on Windows; no unguarded session was launched');
+    const args = boardGuardArguments(params.kind,params.arguments ?? [],{cwd:params.cwd,enabled:params.env?.SUPERCODE_BOARD_PROCESS_GUARD === '1'});
     const name = String(params.program ?? '').split(/[\\/]/).pop();
     if (process.platform === 'win32' || !((params.kind === 'codex' && name === 'codex') ||
       (params.kind === 'claude-code' && name === 'claude'))) return launchCommand(params.program, args);
@@ -1066,12 +1162,14 @@ export class TeamsMachine extends MachineCore {
       v: MACHINE_VERSION,
       id: this.id,
       hostname: hostname(),
+      name: this.machineEvents?.machine ?? hostname(),
       socket: this.socketPath,
       server: this.link?.server ?? null,
       machineId: this.link?.machineId ?? null,
       node: { pid: process.pid, version: MACHINE_VERSION, protocol: NODE_PROTOCOL, floor: this.floor },
       egress: this.env.SUPERCODE_TEAMS_EGRESS ?? 'unrestricted',
       execution: executionCapabilities(this.env),
+      boardProcessPolicy: process.platform === 'win32' ? null : { version: 1, harnesses: ['claude-code','codex'], boundary: 'native-PreToolUse' },
       runSpec: this.env.SUPERCODE_TEAMS_RUN_SPEC_SHA256 ?? null,
       at: Date.now(),
     };
@@ -1080,6 +1178,16 @@ export class TeamsMachine extends MachineCore {
 
   listPorts() { return listAnnouncedPorts(this.portsDir); }
 
+  /** The attach clients on each pane's tmux session, by its label; null where panes are not tmux's (a ConPTY host). */
+  #viewerCounts() {
+    if (process.platform === 'win32') return null;
+    const listed = spawnSync('tmux', [...(this.tmuxSocket ? ['-L', this.tmuxSocket] : []), 'list-clients', '-F', '#{session_name}'], { timeout: 3_000, encoding: 'utf8' });
+    const counts = new Map();
+    if (listed.status !== 0) return counts; // no server, or no clients: nothing shows any pane
+    for (const name of listed.stdout.split('\n').filter(Boolean)) counts.set(name, (counts.get(name) ?? 0) + 1);
+    return counts;
+  }
+
   /**
    * A terminal window on this machine's screen showing the pane, so the people at the machine see what runs on it:
    * in whichever capable terminal is installed (popup-terminals.mjs), running an attach client. The pane ending ends
@@ -1087,7 +1195,7 @@ export class TeamsMachine extends MachineCore {
    */
   #popupWindow(contextKey, session) {
     const terminal = popupTerminal(this.env);
-    if (!terminal) return;
+    if (!terminal) return false;
     const attach = process.platform === 'win32'
       ? [process.execPath, fileURLToPath(new URL('./bin/fleet.mjs', import.meta.url)), 'attach', contextKey, '--mode', 'control']
       // Presented as `supercode open`'s own client is (crates/cli/src/open.rs `attach`): the terminal sets its own
@@ -1095,7 +1203,7 @@ export class TeamsMachine extends MachineCore {
       // screen override, so the window's own scrollback, wheel and selection work instead of the wheel arriving
       // in the pane as up/down arrows.
       : ['/usr/bin/env', 'TERM=screen-256color', spawnSync('which', ['tmux'], { encoding: 'utf8' }).stdout.trim() || 'tmux', ...(this.tmuxSocket ? ['-L', this.tmuxSocket] : []), '-T', 'RGB', 'attach-session', '-t', session.label ?? contextKey];
-    openPopup(terminal, attach, { ...this.env, TMUX: '' });
+    return openPopup(terminal, attach, { ...this.env, TMUX: '' });
   }
 
   /**
@@ -1420,6 +1528,99 @@ export class TeamsMachine extends MachineCore {
         if (!this.machineEvents || params.team_id!==this.machineEvents.teamId) throw new Error('this connector is not serving that team');
         return method==='machine.events.events'?this.machineEvents.snapshot():this.machineEvents.subscribe(params.address,method.endsWith('.unsubscribe'));
       }
+      case 'harness.v1.agents.bindSession': {
+        if (!operator) throw Object.assign(new Error('binding an agent session requires operator authority'),{code:403});
+        const {session,context}=params;
+        if(typeof session!=='string'||!/^([a-z][a-z0-9-]*):(.+)$/.test(session)||typeof context!=='string')throw Object.assign(new Error('name a native session and its agent reader context'),{code:400});
+        const selected=fromContext({supercodeHome:supercodeHome(this.env),name:context});
+        const identity=await selected.client.team(selected.context.team_id).sessions.get(session).identity({signal:AbortSignal.timeout(15000)});
+        if(!identity.data.agent||identity.data.agent.id!==selected.context.principal_id)throw Object.assign(new Error('session does not belong to the context agent'),{code:403});
+        const file=join(this.home,'agent-session-contexts.json'),record=readJson(file,{version:1,sessions:{}});
+        record.sessions[session]={context,agent:identity.data.agent.id,org:selected.context.team_id,assignments:params.assignments??[],intended:params.intended??null};
+        const temporary=`${file}.${randomBytes(12).toString('hex')}.tmp`;
+        writeFileSync(temporary,JSON.stringify(record)+'\n',{mode:0o600,flag:'wx'});renameSync(temporary,file);
+        act('agents.bindSession',session);return record.sessions[session];
+      }
+      case 'harness.v1.agents.session': {
+        if(!operator)throw Object.assign(new Error('local agent session lookup requires operator authority'),{code:403});
+        if(typeof params.session!=='string')throw Object.assign(new Error('name a native session'),{code:400});
+        return readJson(join(this.home,'agent-session-contexts.json'),{sessions:{}}).sessions[params.session]??null;
+      }
+      case 'harness.v1.agents.closureReceipt': {
+        if(!operator)throw Object.assign(new Error('native closure receipts require operator authority'),{code:403});
+        if(typeof params.closure!=='string'||!/^close_[0-9a-f]{32}$/.test(params.closure))throw Object.assign(new Error('name a retained closure obligation'),{code:400});
+        const receipt=readJson(join(this.home,'agent-closure-receipts.json'),{closures:{}}).closures[params.closure];
+        return {attempted:!!receipt,pending:!!this.agentClosuresRunning?.has(params.closure),result:receipt?.result??null};
+      }
+      case 'harness.v1.agents.closeSession': {
+        if(!operator||!this.link)throw Object.assign(new Error('native agent closure requires the connected machine operator'),{code:403});
+        if(typeof params.closure!=='string'||!/^close_[0-9a-f]{32}$/.test(params.closure))throw Object.assign(new Error('name a retained closure obligation'),{code:400});
+        const {server,teamId,machineId,credential}=this.link;
+        const response=await fetch(`${server}/api/v1/teams/${teamId}/machines/${machineId}/agent-closures/${params.closure}`,{headers:{Authorization:`Bearer ${credential}`},redirect:'manual',signal:AbortSignal.timeout(15000)});
+        if(!response.ok)throw Object.assign(new Error(`agent closure authorization returned HTTP ${response.status}`),{code:403});
+        const closure=(await response.json()).data;
+        if(closure.state!=='claimed'||closure.machine_id!==machineId||closure.team_id!==teamId)throw Object.assign(new Error('the machine has no claimed closure on that session'),{code:403});
+        const session=`${closure.harness}:${closure.native_id}`,binding=readJson(join(this.home,'agent-session-contexts.json'),{sessions:{}}).sessions[session];
+        if(binding&&binding.agent!==closure.agent_id)throw Object.assign(new Error('native session identity changed'),{code:409});
+        const file=join(this.home,'agent-closure-receipts.json'),receipts=readJson(file,{version:1,closures:{}});
+        if(receipts.closures[closure.id])return receipts.closures[closure.id].result??{state:'unknown',reason:'native closure attempt has no retained receipt'};
+        receipts.closures[closure.id]={attempted_at:Date.now()};writeJson(file,receipts);
+        (this.agentClosuresRunning??=new Set()).add(closure.id);
+        let result;
+        try{
+          const found=await this.#serveRequest('harness.v1.sessions.discover',{query:closure.native_id,harnesses:[closure.harness],limit:200});
+          const descriptor=found.sessions?.find(row=>row.locator?.session_id===closure.native_id&&row.locator?.harness===closure.harness);
+          if(descriptor?.live_endpoint?.startsWith('supercode-live://')){
+            const runtime=await this.#serveRequest('harness.v1.runtimes.attach_existing',{harness:closure.harness,runtime_id:closure.native_id,cwd:descriptor.cwd,base_url:descriptor.live_endpoint});
+            const ended=await this.#serveRequest('harness.v1.runtimes.close',{connection:runtime.connection});
+            result=ended?.closed?{state:'closed',reason:'native runtime close receipt'}:{state:'unknown',reason:'runtime returned no close receipt'};
+          }else{
+            const machine=hostname().split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g,'-'),address=`sc:${machine}:${closure.harness}:${closure.native_id}`;
+            const code=await new Promise((resolve,reject)=>{
+              const child=spawn(this.supercodeBin,['close',address],{env:{...this.env,SUPERCODE_CALLER:address},stdio:'ignore'});
+              const timer=setTimeout(()=>{child.kill('SIGTERM');resolve(null);},30000);
+              child.once('error',error=>{clearTimeout(timer);reject(error);});child.once('close',status=>{clearTimeout(timer);resolve(status);});
+            });
+            result=code===0?{state:'closed',reason:'native session close door completed'}:code===null?{state:'unknown',reason:'native close did not complete within 30 seconds'}:{state:'failed',reason:`native close refused (exit ${code})`};
+          }
+        }catch(error){result={state:'failed',reason:String(error.message).slice(0,1024)};}
+        // Other sessions may have finished while this native close was in flight.
+        try {
+          const retained=readJson(file,{version:1,closures:{}});
+          retained.closures[closure.id]={...retained.closures[closure.id],result};writeJson(file,retained);
+          act('agents.closeSession',session,result.state,result.reason);return result;
+        }finally{this.agentClosuresRunning.delete(closure.id);}
+      }
+      case 'harness.v1.agents.context': {
+        if (!operator) throw Object.assign(new Error('installing an agent reader context requires operator authority'), { code: 403 });
+        const {origin,team,agent,credential}=params;
+        if(typeof origin!=='string'||typeof team!=='string'||typeof agent!=='string'||typeof credential?.token!=='string')throw Object.assign(new Error('agent context requires server, Org, identity and delegated credential'),{code:400});
+        const client=new TeamsClient({server:origin,credential:credential.token});
+        const me=await client.me({signal:AbortSignal.timeout(15000)});
+        if(me.principal.id!==agent||me.principal.kind!=='agent'||!me.teams.some(item=>item.team.id===team))throw Object.assign(new Error('delegated credential does not belong to this agent and Org'),{code:403});
+        const key=createHash('sha256').update(`${client.server}/${team}/${agent}`).digest('hex');
+        const name=`agent-${key.slice(0,32)}`,ref=`cred_${key}`,contexts=new WorkspaceContexts(supercodeHome(this.env));
+        contexts.writeCredential(ref,{token:credential.token,kind:'service',expires_at:credential.expires_at,server_id:me.server_id,origin:client.server});
+        contexts.upsert(name,{origin:client.server,server_id:me.server_id,team_id:team,principal_id:agent,credential_ref:ref,label:agent});
+        act('agents.context',agent);
+        return {context:name,agent,org:team,expires_at:credential.expires_at};
+      }
+      case 'harness.v1.agents.mint': {
+        if (!operator) throw Object.assign(new Error('minting local agent ids requires operator authority'), { code: 403 });
+        if (typeof params.key !== 'string' || !params.key || params.key.length > 1024) throw Object.assign(new Error('agent mint requires a stable key'), { code: 400 });
+        const file = join(this.home, 'agent-identities.json');
+        const record = readJson(file, { version: 1, ids: {} });
+        const key = createHash('sha256').update(params.key).digest('hex');
+        if (!record.ids[key]) {
+          record.ids[key] = { id: `agent_${randomBytes(16).toString('hex')}`, minted_at: Date.now() };
+          const temporary = `${file}.${randomBytes(12).toString('hex')}.tmp`;
+          writeFileSync(temporary, JSON.stringify(record)+'\n', { mode: 0o600, flag: 'wx' });
+          renameSync(temporary,file);
+        }
+        act('agents.mint', key);
+        return { ...record.ids[key], synced: false };
+      }
+      case 'harness.v1.machine.describe':
       case 'describe':
         return this.describe();
       case 'panes.present': {
@@ -1434,6 +1635,7 @@ export class TeamsMachine extends MachineCore {
           return { pane: session.contextKey, idleComposer: composer != null && !/\besc to (?:interrupt|cancel)\b/iu.test(screen) };
         }));
       }
+      case 'harness.v1.panes.list':
       case 'panes.list': {
         // A participant lists the panes its grants let it observe; view on the whole
         // machine (or operator) lists them all.
@@ -1445,9 +1647,12 @@ export class TeamsMachine extends MachineCore {
         // hand here: a list that made a caller ask a second door "and is anything
         // wrong with these?" would be a list that knows and will not say.
         const rows = await this.attentionEvidence();
+        // how many clients each pane has now (a popped window, a `supercode open`, a relay streaming it elsewhere): what a caller must
+        // know before it opens another view of a pane on the same screen
+        const viewers = this.#viewerCounts();
         // `title` is what a viewer should show: the override if one is set, else the tmux label.
         return rows.filter((row) => row.session.id && shown(row.session.contextKey)).map(({ session: s, attention, rank, notify, evidence }) => ({
-          pane: s.contextKey, dead: Boolean(s.dead), label: s.label, title: titles[`pane:${s.contextKey}`] ?? s.label, cwd: s.cwd, owned: s.owned, activeCommand: s.activeCommand, pid: s.rootPid ?? null, size: s.size, suspended: this.suspended.has(s.contextKey),
+          pane: s.contextKey, dead: Boolean(s.dead), label: s.label, title: titles[`pane:${s.contextKey}`] ?? s.label, cwd: s.cwd, owned: s.owned, activeCommand: s.activeCommand, pid: s.rootPid ?? null, size: s.size, suspended: this.suspended.has(s.contextKey), viewers: viewers ? (viewers.get(s.label) ?? 0) : null,
           attention, rank, notify, evidence, input_cleanup: this.inputRepairs[s.contextKey] ? {pending:true,at:this.inputRepairs[s.contextKey].at,reason:this.inputRepairs[s.contextKey].reason} : null,
         }));
       }
@@ -1541,16 +1746,20 @@ export class TeamsMachine extends MachineCore {
           this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, by, ...executable, status, error: exit?.failed ? exit.how : undefined });
           return { key, pane: contextKey, reused: false, status, exit: exit?.how ?? null };
         }
-        if (params.popup !== false) this.#popupWindow(contextKey, session);
+        // the window this machine's screen shows the pane in, when one opened: the caller is told, so it does not open a
+        // second view of a pane that is already in front of the person at the machine
+        const window = params.popup !== false && this.#popupWindow(contextKey, session);
         if (params.notify) this.#noticeWhenEnded({ key, pane: contextKey, notify: params.notify, label: params.name ?? params.kind ?? params.program });
-        return { key, pane: contextKey, reused: false, status: 'ready' };
+        return { key, pane: contextKey, reused: false, status: 'ready', window };
       }
+      case 'harness.v1.launches.get':
       case 'launches.get': {
         if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
         const found = this.launches.find(params.key);
         if (!found) return null;
         return this.#launchReceipt(found);
       }
+      case 'harness.v1.launches.cancel':
       case 'launches.cancel': {
         if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
         if (typeof params.key !== 'string' || !params.key.trim()) throw Object.assign(new Error('launch cancellation requires a nonempty key'), { code: 400 });
@@ -1576,6 +1785,7 @@ export class TeamsMachine extends MachineCore {
         }
         return rows;
       }
+      case 'harness.v1.panes.close':
       case 'panes.close': {
         need('control', `pane:${params.pane}`);
         for (const pending of this.pendingStartups.values()) if (pending.pane === params.pane) pending.abort.abort();
@@ -1799,13 +2009,13 @@ export class TeamsMachine extends MachineCore {
         act('title', params.target, 'ok', renamed);
         return { ok: true, target: params.target, title: params.title ?? null, window: renamed };
       }
-      case 'workspace.inspect': case 'workspace.register': case 'workspace.unregister': case 'workspace.list': case 'workspace.resolve': {
+      case 'harness.v1.workspaces.inspect': case 'harness.v1.workspaces.register': case 'harness.v1.workspaces.unregister': case 'harness.v1.workspaces.list': case 'harness.v1.workspaces.resolve': {
         if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
         const registry = new Workspaces(this.home);
-        const result = method === 'workspace.inspect' ? inspectCheckout(params.path)
-          : method === 'workspace.register' ? registry.register(params.path, params.repository)
-          : method === 'workspace.unregister' ? registry.unregister(params.path)
-          : method === 'workspace.list' ? registry.list()
+        const result = method === 'harness.v1.workspaces.inspect' ? inspectCheckout(params.path)
+          : method === 'harness.v1.workspaces.register' ? registry.register(params.path, params.repository)
+          : method === 'harness.v1.workspaces.unregister' ? registry.unregister(params.path)
+          : method === 'harness.v1.workspaces.list' ? registry.list()
           : registry.resolve(params.repository, params.branch, { solo: params.solo, card: params.card, create: params.create });
         act('workspace', '*', 'ok', method);
         return result;

package/native-codex-pane.mjs

@@ -20,7 +20,8 @@ const continuing = seed.arguments.includes('resume') || seed.arguments.includes(
 const writableRoots = [];
 for (let index = 0; index < seed.arguments.length; index += 1) {
   const arg = seed.arguments[index];
-  if (continuing && ['--dangerously-bypass-approvals-and-sandbox', '--yolo'].includes(arg)) {
+  if (arg === '--dangerously-bypass-hook-trust') { config.push(arg); }
+  else if (continuing && ['--dangerously-bypass-approvals-and-sandbox', '--yolo'].includes(arg)) {
     config.push('-c', 'approval_policy="never"', '-c', 'sandbox_mode="danger-full-access"');
   } else if (continuing && arg === '--full-auto') {
     config.push('-c', 'approval_policy="on-request"', '-c', 'sandbox_mode="workspace-write"');
@@ -41,7 +42,7 @@ for (let index = 0; index < seed.arguments.length; index += 1) {
   }
 }
 if(writableRoots.length)config.push('-c',`sandbox_workspace_write.writable_roots=${JSON.stringify(writableRoots)}`);
-const server = spawn(seed.program, ['app-server', '--listen', endpoint, ...config], { stdio: ['ignore', 'ignore', 'inherit'] });
+const server = spawn(seed.program, [...config, 'app-server', '--listen', endpoint], { stdio: ['ignore', 'ignore', 'inherit'] });
 let tui;
 let ended = false;
 let serverError;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.178",
+  "version": "0.3.0",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -10,6 +10,7 @@
     "./machine": "./machine.mjs",
     "./browser-attach": "./browser-attach.mjs",
     "./attention": "./attention.mjs",
+    "./event-client": "./event-client.mjs",
     "./bin": "./bin/teams.mjs",
     "./fleet": "./fleet.mjs",
     "./bin/fleet": "./bin/fleet.mjs",
@@ -62,7 +63,7 @@
     "@volter/supercode-harness-sdk": "^0.3.43",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/identity": "^0.4.1",
-    "@volter/teams": "^0.1.58",
+    "@volter/teams": "0.2.0",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",

package/server/harness-routes.mjs

@@ -125,7 +125,7 @@ export const harnessRoutes = Object.freeze({ preAuth, authed, beforeIdempotency,
 
 async function canonicalSession(api,team,row){const seen=new Set();while(row?.canonical_id){if(seen.has(row.id))fail(409,'conflict','correlation cycle');seen.add(row.id);row=await api.store.one('SELECT * FROM sessions WHERE team_id=? AND id=?',[team,row.canonical_id]);}return row;}
 async function constituents(api,team,row){const root=await canonicalSession(api,team,row);return api.store.query('WITH RECURSIVE family(id) AS (SELECT ? UNION SELECT s.id FROM sessions s JOIN family f ON s.canonical_id=f.id WHERE s.team_id=?) SELECT s.* FROM sessions s JOIN family f ON f.id=s.id WHERE s.team_id=?',[root.id,team,team]);}
-async function canReadMerged(api,auth,row){for(const member of await constituents(api,auth.team_id,row))if(!canRead(auth,member,await grants(api,auth.team_id,member.id)))return false;return true;}
+async function canReadMerged(api,auth,row){if(auth.principal_kind==='agent'){try{await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref:row.id,now:api.clock.nowMs()});return true;}catch(error){if([401,403,404,410].includes(error.status))return false;throw error;}}for(const member of await constituents(api,auth.team_id,row))if(!canRead(auth,member,await grants(api,auth.team_id,member.id)))return false;return true;}
 const managerGuard=(auth,sessionId,now,{governance=false}={})=>({
   sql:`SELECT 1 ok FROM sessions s JOIN memberships m ON m.team_id=s.team_id AND m.principal_id=? WHERE s.team_id=? AND s.id=? AND s.deleted_at IS NULL AND m.active=1 AND m.role!='viewer' AND (?=1 AND m.role IN ('owner','admin') OR s.custodian_id=? OR EXISTS (SELECT 1 FROM session_grants g WHERE g.team_id=s.team_id AND g.session_id=s.id AND g.role='manager' AND (g.expires_at IS NULL OR g.expires_at>?) AND (g.subject_kind='principal' AND g.subject_id=? OR g.subject_kind='group' AND EXISTS (SELECT 1 FROM group_members gm WHERE gm.team_id=s.team_id AND gm.group_id=g.subject_id AND gm.principal_id=?))))`,
   params:[auth.principal_id,auth.team_id,sessionId,governance?1:0,auth.principal_id,now,auth.principal_id,auth.principal_id],
@@ -171,6 +171,7 @@ async function listSessions(api,res,auth,url,requestId,search){
   const rows=[...currentRows,...olderRows],currentById=new Map(currentRows.map(row=>[row.id,row]));
   const boundaryNow=api.clock.nowMs();
   if(!membership?.active||credential?.revoked_at!=null||(credential?.expires_at!=null&&credential.expires_at<=boundaryNow))fail(401,'authentication_required','authentication required');
+  if(cursorKey&&!cursor)fail(409,'resync_required','cursor expired, mismatched, or authorization changed');
   let tuples;
   if(cursor){
     if(cursor.kind!==(search?'search':'list')||cursor.expires_at<=boundaryNow||cursor.auth_epoch!==team.auth_epoch||canonicalJson(JSON.parse(cursor.query_json))!==canonicalJson(normalizedQuery))fail(409,'resync_required','cursor expired, mismatched, or authorization changed');
@@ -441,13 +442,17 @@ async function viewBindingRoute(api,req,res,auth,ref,requestId){
     const bindings=await list();
     // Native transport destinations are custody information, not an extra transcript-reader capability.
     if(session.custodian_id===auth.principal_id&&!auth.installation_id)for(const binding of bindings){
-      const resolution=await sessionDeliveryResolution(api,auth.team_id,{sessionRef:session.id,...binding},true);
+      const resolution=await sessionDeliveryResolution(api,auth.team_id,{sessionRef:session.id,...binding},true,auth);
       binding.delivery=resolution.target&&resolution.target.harness!==session.harness
         ? {...resolution,state:'unavailable',reason:'harness_mismatch'} : resolution;
     }
     send(res,200,result(api,auth,{session_id:session.id,harness:session.harness,bindings}),requestId);return;
   }
-  if(session.custodian_id!==auth.principal_id)fail(403,'forbidden',"only the session's owner binds it to a view");
+  // The owner binds, in person or through an app they installed and consented to `sessions.access` (the app acts for its
+  // installer); an app installed by anyone else binds nothing of theirs.
+  const installer=auth.installation_id&&auth.app_grants==null&&auth.app_actions?.includes('sessions.access')
+    ?(await api.store.one("SELECT installer_id FROM app_installations WHERE id=? AND team_id=? AND state='active'",[auth.installation_id,auth.team_id]))?.installer_id:null;
+  if(session.custodian_id!==auth.principal_id&&session.custodian_id!==installer)fail(403,'forbidden',"only the session's owner binds it to a view");
   const body=await parseJson(req);exact(body,['issuer','room','conversation']);
   if(typeof body.room!=='string'||!body.room||typeof body.conversation!=='string'||!body.conversation)fail(400,'invalid_request','room and conversation are required');
   if(!await installedIssuer(api,body.issuer,'delegation.sessions',auth.team_id))fail(400,'invalid_request','this issuer is not an installed session integration');

package/server/index.mjs

@@ -1,7 +1,6 @@
 // The Node host: one process on a data directory (SQLite in a worker thread, the
 // bootstrap credential in a protected file beside it), serving HTTP and the
 // machine doors on one listener. The server itself is core.mjs's.
-import { identityOrganizationsFromEnv } from '@volter/teams/server/identity-orgs';
 import { createServer as createHttpServer } from 'node:http';
 import { mkdirSync, openSync, closeSync, writeFileSync, readFileSync, renameSync, chmodSync, unlinkSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
@@ -21,7 +20,7 @@ export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},p
   const loopback=['127.0.0.1','::1','localhost'].includes(listen.host??'127.0.0.1');
   publicOrigin=normalizePublicOrigin(publicOrigin);
   if(!loopback&&!publicOrigin?.startsWith('https:'))throw new TypeError('non-loopback Teams servers require an HTTPS publicOrigin');
-  const api=createTeamsApi({clock,ids,publicOrigin,identityOrganizations:identityOrganizationsFromEnv(process.env),uploadLimitBytes});
+  const api=createTeamsApi({clock,ids,publicOrigin,uploadLimitBytes});
   // The harness's own routes on this server (harness-routes.mjs); the handler owns the neutral ones.
   api.attach({harnessRoutes});
   const events=api.events;

package/server/store-core.mjs

@@ -7,6 +7,7 @@ import { ingestOtlpBatch, correlateSessions } from './arc2-transactions.mjs';
 import { claimEffect, getEffect, listEffects, reportEffect } from './effects-transactions.mjs';
 import { applyCaptureMessages } from './capture-transactions.mjs';
 import { MIGRATIONS, MESSAGE_AT } from '@volter/teams/server/migrations';
+import { AGENT_ACTIVE, AGENT_DESCENDANTS } from '@volter/teams/server/agent-authority';
 import { APP_LINEAGE_REVOKED, appGrantAllows } from '@volter/teams/server/auth';
 
 /** Bring a database to the newest schema. `version()`/`setVersion(n)` name where the host records it. */
@@ -27,7 +28,7 @@ export function createStoreHandlers({ all, get, run, tx }) {
     const {teamId,principalId,credentialId,ref,now,bound}=args;
     // `bound`: a workplace's session-view token ({issuer, room, conversation, expiresAt}), which reads only a
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
-    let membership=null,appFence=null,grantSource=null;
+    let membership=null,appFence=null,grantSource=null,agentGrantSource=null,agentReader=false;
     if((args.delegationDepth??0)>16)domainError(401,'authentication_required','delegation lineage is too deep');
     if(bound){
       if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.id=? AND i.created_at=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer,bound.installationId,bound.installedAt]))domainError(401,'authentication_required','integration was uninstalled');
@@ -45,6 +46,12 @@ export function createStoreHandlers({ all, get, run, tx }) {
         if(appFence!==null)grantSource=get('SELECT id,principal_id FROM credentials WHERE id=?',[app.subject_credential_id??app.parent_id]);
       }
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
+      const principal=get('SELECT kind FROM principals WHERE id=?',[principalId]);
+      if(principal?.kind==='agent'){
+        agentGrantSource=get('SELECT c.id,c.principal_id FROM agent_credentials d JOIN credentials c ON c.id=d.parent_credential_id WHERE d.credential_id=?',[credentialId]);
+        if(!get(AGENT_ACTIVE,[teamId,principalId])||get(APP_LINEAGE_REVOKED,[credentialId,now]))domainError(401,'authentication_required','agent delegation revoked');
+        agentReader=true;
+      }
     }
     if(typeof ref!=='string'||ref.length<8)domainError(404,'not_found','not found');
     const groups=all('SELECT group_id FROM group_members WHERE team_id=? AND principal_id=?',[teamId,principalId]).map(row=>row.group_id);
@@ -69,7 +76,13 @@ export function createStoreHandlers({ all, get, run, tx }) {
           if(!grantSource)return false;
           try{authorizedSession({teamId,principalId:grantSource.principal_id,credentialId:grantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}
         }
-        if(session.visibility==='team'||session.custodian_id===principalId)return true;
+        if(agentGrantSource){
+          try{authorizedSession({teamId,principalId:agentGrantSource.principal_id,credentialId:agentGrantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}
+        }
+        if(agentReader&&get(`WITH RECURSIVE owners(id) AS (${AGENT_DESCENDANTS}), family(id) AS (SELECT s.session_id FROM agent_sessions s JOIN owners o ON s.agent_id=o.id WHERE s.team_id=? UNION SELECT s.id FROM sessions s JOIN family f ON s.canonical_id=f.id WHERE s.team_id=?) SELECT 1 FROM family WHERE id=?`,[teamId,principalId,teamId,teamId,session.id]))return true;
+        // An agent's standing delegation covers its own family and descendants. Team visibility
+        // alone does not open a parent's or sibling's transcript; those require an explicit grant.
+        if(!agentReader&&(session.visibility==='team'||session.custodian_id===principalId))return true;
         const grants=all('SELECT subject_kind,subject_id,expires_at FROM session_grants WHERE team_id=? AND session_id=?',[teamId,session.id]);
         return grants.some(grant=>(grant.subject_kind==='principal'&&grant.subject_id===principalId||grant.subject_kind==='group'&&groups.includes(grant.subject_id))&&(grant.expires_at==null||grant.expires_at>now));
       });

package/session-notice-target.mjs

@@ -0,0 +1,39 @@
+// A Room reply may resume its existing thread. Configuration is read through the harness's own door.
+import { isAbsolute } from 'node:path';
+
+export function codexNoticeResumeArguments(config){
+  if(config?.harness!=='codex'||typeof config.cwd!=='string'||!isAbsolute(config.cwd))return null;
+  if(!['untrusted','on-failure','on-request','never'].includes(config.approval_policy))return null;
+  const policy=config.sandbox_policy;
+  if(!policy||typeof policy!=='object'||Array.isArray(policy)||!['read-only','workspace-write','danger-full-access'].includes(policy.type))return null;
+  const keys=['type',...(policy.type==='workspace-write'?['writable_roots','network_access','exclude_tmpdir_env_var','exclude_slash_tmp']:[])];
+  if(Object.keys(policy).some(key=>!keys.includes(key)))return null;
+  if(policy.writable_roots!==undefined&&(!Array.isArray(policy.writable_roots)||!policy.writable_roots.every(root=>typeof root==='string'&&isAbsolute(root))))return null;
+  for(const key of ['network_access','exclude_tmpdir_env_var','exclude_slash_tmp'])if(policy[key]!==undefined&&typeof policy[key]!=='boolean')return null;
+  const args=['--ask-for-approval',config.approval_policy,'--sandbox',policy.type];
+  if(policy.type==='workspace-write'){
+    args.push('-c',`sandbox_workspace_write.writable_roots=${JSON.stringify(policy.writable_roots??[])}`);
+    for(const key of ['network_access','exclude_tmpdir_env_var','exclude_slash_tmp'])args.push('-c',`sandbox_workspace_write.${key}=${policy[key]??(key!=='network_access')}`);
+  }
+  if(typeof config.model==='string'&&config.model)args.push('--model',config.model);
+  return args;
+}
+
+export async function sessionNoticeTarget(address,{machine,mail,discover,recordedConfig}){
+  const match=/^sc:([^:]+):([^:]+):([^:\s]+)$/.exec(address??'');
+  if(!match||match[1]!==machine)return {state:'unavailable',reason:'native_target_not_local',resumable:false};
+  const [, ,harness,id]=match;
+  const live=await mail({op:'list'});
+  if(live.code!==0||!Array.isArray(live.sessions))throw new Error('native liveness door returned no session catalogue');
+  if(live.sessions.some(row=>row.address===address))return {state:'running',reason:null,resumable:false};
+  const page=await discover({query:id,harnesses:[harness],limit:200});
+  const row=page.sessions?.find(value=>value.locator?.session_id===id&&value.locator?.harness===harness);
+  if(!row)return {state:'unavailable',reason:'native_session_not_found',resumable:false};
+  if(harness!=='codex')return {state:'stopped',reason:'native_resume_not_supported',resumable:false};
+  let config;
+  try{config=await recordedConfig(row.locator);}catch{return {state:'stopped',reason:'native_resume_profile_unavailable',resumable:false};}
+  const args=codexNoticeResumeArguments(config);
+  if(config.session_id!==id)return {state:'stopped',reason:'native_resume_identity_unrecorded',resumable:false};
+  return {state:'stopped',reason:args?null:'native_resume_profile_unrecorded',resumable:!!args,
+    ...(args?{resume:{cwd:config.cwd,args}}:{})};
+}

package/worker/index.mjs

@@ -6,9 +6,6 @@
 //   PUBLIC_ORIGIN                      the https origin the Worker is served at
 //   INIT_TEAM                          the first team's name (used once, at bootstrap)
 // Identity and delegation issuers are registered apps installed by team admins through the public doors.
-//   VOLTER_ORG_CLIENT_ID, VOLTER_ORG_CLIENT_SECRET, VOLTER_TEAM_ORGS
-//                                      optional: this server's product credential at the organization's identity issuer, and the teams whose
-//                                      organization there admits its members with no invitation (`team=slug,…`)
 //   SUPERCODE_TEAMS_BOOTSTRAP_TOKEN    secret: the owner's first credential, minted with
 //                                      `supercode teams server token`
 import { DurableObject } from 'cloudflare:workers';
@@ -18,7 +15,6 @@ import { createHttpHandler, authenticate } from '@volter/teams/server/http';
 import { harnessRoutes } from '../server/harness-routes.mjs';
 import { authorizeMachineUpgrade, acceptMachineSocket, LINK_PROTOCOL, CHANNEL_PROTOCOL } from '@volter/teams/server/machine-link';
 import { setOtlpSchemaSources } from '../server/otlp/transport.mjs';
-import { identityOrganizationsFromEnv } from '@volter/teams/server/identity-orgs';
 import { setViewerSources } from '@volter/teams/server/viewer';
 import { serveFetch } from './fetch-adapter.mjs';
 import { webSocketDuplex } from './websocket-duplex.mjs';
@@ -80,7 +76,7 @@ export class TeamsServer extends DurableObject {
       console.log(`storage: database_bytes=${ctx.storage.sql.databaseSize}`);
       const db = durableSql(ctx.storage);
       migrate({ exec: db.exec, tx: db.tx, version: () => ctx.storage.kv.get('schema_version') ?? 0, setVersion: (n) => ctx.storage.kv.put('schema_version', n) });
-      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), appRootSecret: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN || null, identityOrganizations: identityOrganizationsFromEnv(env) });
+      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), appRootSecret: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN || null });
       this.api.storageUsage = () => {
         const sql = ctx.storage.sql;
         let freeBytes = null;