@volter/supercode-teams 0.2.20 → 0.2.21

package/README.md

@@ -29,7 +29,8 @@ The daemon owns one `supercode harness serve` and the tmux terminal host.
 Two doors reach it:
 
 - **Local**: an owner-only Unix socket, `$SUPERCODE_HOME/teams/machine.sock` (or, when that path
-  is too long for a socket address, a per-user 0700 directory under `/tmp`). Whoever can open it
+  is too long for a socket address, a per-user 0700 directory under `/tmp`). On Windows it is a
+  named pipe, `\\.\pipe\supercode-<hash>`, which by default only its owner may open. Whoever can open it
   is this OS user, an operator. The local CLI, the agent inside the machine and a service on the
   same box (RH2's connector) use it.
 - **Remote**: the Teams server. The daemon holds one outbound WebSocket link; the server forwards

package/bin/teams.mjs

@@ -25,8 +25,16 @@
 // Every other verb (server, login, context, connect, disconnect, status,
 // members, groups, sources, sync, machines, sessions) is the Teams workspace
 // CLI in ./workspace.mjs.
-import { readFileSync, writeFileSync } from 'node:fs';
+import { createWriteStream, readFileSync, writeFileSync } from 'node:fs';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
+
+// A Windows scheduled task keeps no output (launchd and systemd name log files), so its unit names one here.
+if (process.env.SUPERCODE_TEAMS_LOG) {
+  const log = createWriteStream(process.env.SUPERCODE_TEAMS_LOG, { flags: 'a' });
+  for (const stream of [process.stdout, process.stderr]) stream.write = log.write.bind(log);
+  // The log is this process's own; a pane or harness it starts writes to its own terminal.
+  delete process.env.SUPERCODE_TEAMS_LOG;
+}
 import { TeamsMachine } from '../machine.mjs';
 import { harnessTransport, nodeRpc, forwardPort, watchMachine } from '../client.mjs';
 import { attachBrowserProfile, listBrowserProfiles } from '../browser-attach.mjs';
@@ -63,20 +71,23 @@ if (verb === undefined || verb === 'help') {
   await workspaceMain(['--help']);
   process.exit(0);
 }
-if (!MACHINE_VERBS.has(verb)) {
+// A workspace verb is done when its promise settles. On Windows the process then ends on its own: Node there aborts
+// (libuv's `UV_HANDLE_CLOSING` assertion) when process.exit() follows a fetch, which every workspace verb makes.
+const workspaceVerb = !MACHINE_VERBS.has(verb);
+if (workspaceVerb) {
   const { workspaceMain } = await import('./workspace.mjs');
-  await workspaceMain(argv).catch((error) => {
+  await workspaceMain(argv).then(() => { process.exitCode = 0; }, (error) => {
     process.stderr.write(JSON.stringify({ version: 1, error: { code: error.code ?? 'invalid_request', message: error.message } }) + '\n');
-    process.exit(error.exitCode ?? ({ invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 }[error.code] ?? 1));
+    process.exitCode = (error.exitCode ?? ({ invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 }[error.code] ?? 1));
   });
-  process.exit(0);
+  if (process.platform !== 'win32') process.exit();
 }
 
 const home = flags.home ? String(flags.home) : teamsHome();
 const p = paths(home);
 const out = (value) => process.stdout.write((typeof value === 'string' ? value : JSON.stringify(value, null, 2)) + '\n');
 const die = (message, code = 2) => { process.stderr.write(`supercode teams: ${message}\n`); process.exit(code); };
-for (const flag of Object.keys(flags)) if (!KNOWN_FLAGS.has(flag)) die(`unknown flag: --${flag}`);
+if (!workspaceVerb) for (const flag of Object.keys(flags)) if (!KNOWN_FLAGS.has(flag)) die(`unknown flag: --${flag}`);
 
 async function machineChannel() {
   return openMachine({ machine: flags.machine ? String(flags.machine) : null, context: flags.context ? String(flags.context) : null, home });
@@ -288,4 +299,4 @@ async function main() {
   }
 }
 
-main().catch((error) => die(error.message ?? String(error), error.code === 'machine_offline' ? 5 : 1));
+if (!workspaceVerb) main().catch((error) => die(error.message ?? String(error), error.code === 'machine_offline' ? 5 : 1));

package/bin/workspace/args.mjs

@@ -1,7 +1,7 @@
 const BOOLEANS = new Set([
   'json', 'help', 'live', 'saved', 'watch', 'paginate', 'token-stdin',
   'invite-stdin', 'include-children', 'rotate', 'install', 'force',
-  'take-control', 'dry-run', 'volter', 'foreground',
+  'take-control', 'dry-run', 'volter', 'foreground', 'no-connect',
 ]);
 
 const VALUES = new Set([

package/bin/workspace/lifecycle.mjs

@@ -2,19 +2,30 @@ import { createConnection, createServer } from 'node:net';
 import { mkdirSync, renameSync, rmSync, unlinkSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { shortSocketPath, ensureSocketDirectory } from '@volter/teams/home';
+import { shortSocketPath, ensureSocketDirectory, isNamedPipe } from '@volter/teams/home';
 import { execFileSync } from 'node:child_process';
 
 const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+// A process's start time names it exactly: a reused pid has another. Windows has no ps; its process table answers.
 const processIdentity = pid => {
-  try { return execFileSync('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 1_000, stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null; }
+  const [command, args] = process.platform === 'win32'
+    ? ['powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `(Get-Process -Id ${Number(pid)}).StartTime.ToUniversalTime().Ticks`]]
+    : ['/bin/ps', ['-o', 'lstart=', '-p', String(pid)]];
+  try { return execFileSync(command, args, { encoding: 'utf8', timeout: process.platform === 'win32' ? 5_000 : 1_000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }).trim() || null; }
   catch { return null; }
 };
 const readOwner = lock => {
   try { return JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8')); }
   catch { return null; }
 };
-const sameOwner = owner => owner?.pid > 0 && owner.start === processIdentity(owner.pid);
+// Without both start times (a lookup that timed out, as a cold PowerShell can) the pid's liveness decides, so a live
+// owner is never taken for stale.
+const sameOwner = owner => {
+  if (!(owner?.pid > 0)) return false;
+  const start = processIdentity(owner.pid);
+  if (owner.start != null && start != null) return owner.start === start;
+  try { process.kill(owner.pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+};
 
 export async function activeSocket(path) {
   return new Promise(resolve => {
@@ -65,15 +76,19 @@ export async function acquireLifecycle(directory, onStop) {
       catch (renameError) { if (renameError.code !== 'ENOENT') throw renameError; }
     }
   }
-  try { unlinkSync(socketPath); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (!isNamedPipe(socketPath)) try { unlinkSync(socketPath); } catch (error) { if (error.code !== 'ENOENT') throw error; }
   const server = createServer(connection => {
-    let body = ''; connection.setEncoding('utf8');
+    let body = '', answered = false; connection.setEncoding('utf8');
     connection.on('error', () => {});
-    connection.on('data', chunk => { body += chunk; if (body.length > 1024) connection.destroy(); });
-    connection.on('end', () => {
+    // A request is one line; it is answered at its newline, or at the end of a request without one. A Windows named
+    // pipe has no half-close, so a client there cannot end its side and still read the answer.
+    const answer = () => {
+      if (answered) return; answered = true;
       if (body.trim() !== token) { connection.end('forbidden\n'); return; }
       connection.end('ok\n', () => { void onStop(); });
-    });
+    };
+    connection.on('data', chunk => { body += chunk; if (body.length > 1024) connection.destroy(); else if (body.includes('\n')) answer(); });
+    connection.on('end', answer);
   });
   try {
     await new Promise((resolve, reject) => { server.once('error', reject); server.listen(socketPath, resolve); });
@@ -87,7 +102,7 @@ export async function acquireLifecycle(directory, onStop) {
     close: async () => {
       await new Promise(resolve => server.close(resolve));
       if (readOwner(lock)?.token !== token) return;
-      try { unlinkSync(socketPath); } catch {}
+      if (!isNamedPipe(socketPath)) try { unlinkSync(socketPath); } catch {}
       rmSync(lock, { recursive: true, force: true });
     },
   };
@@ -101,7 +116,7 @@ export async function requestStop(socketPath, token) {
         const finish = (error, value) => { if (settled) return; settled = true; socket.destroy(); error ? reject(error) : resolve(value); };
         socket.setTimeout(500, () => finish(new Error('connector control request timed out')));
         socket.setEncoding('utf8');
-        socket.once('connect', () => socket.end(`${token}\n`));
+        socket.once('connect', () => process.platform === 'win32' ? socket.write(`${token}\n`) : socket.end(`${token}\n`));
         socket.on('data', chunk => { text += chunk; if (text.length > 1024) finish(new Error('connector control reply is too large')); });
         socket.once('end', () => finish(null, text));
         socket.once('error', error => finish(error));

package/bin/workspace.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { hostname } from 'node:os';
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, rmSync } from 'node:fs';
 import { basename, join, resolve } from 'node:path';
 import { execFileSync, spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
@@ -19,6 +19,8 @@ import { reserveArtifactDirectory, reserveProtected, writeProtected } from './wo
 import { acquireLifecycle, activeSocket, requestStop } from './workspace/lifecycle.mjs';
 import { volterDeviceSignIn } from './workspace/volter-device.mjs';
 import { loginSummary, signInToTeams } from './workspace/volter-login.mjs';
+import { readSharedSignIn, signOut } from '@volter/identity';
+import { createInterface } from 'node:readline/promises';
 
 const ERROR_EXITS = { invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 };
 
@@ -35,6 +37,7 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   if (verb === 'context') return contextCommand({ contexts, flags, sub, rest, output });
   if (verb === 'server') return serverCommand({ flags, sub, rest, home, output });
   if (verb === 'login') return loginCommand({ flags, origin: sub, rest, home, output });
+  if (verb === 'auth') return authCommand({ flags, sub, rest, home, contexts, output, env, dependencies });
   const explicitContext = flags.context ?? env.SUPERCODE_CONTEXT;
   let selected = explicitContext ?? contexts.read().current;
   const urlReference = verb === 'sessions' ? rest.find(value => /^https?:\/\//.test(value)) : null;
@@ -145,6 +148,112 @@ async function loginCommand({ flags, origin, rest, home, output }) {
   return signedIn(flags, output, await loginContext({ supercodeHome: home, name: flags.as ?? null, origin, teamId: flags.team ?? null, token, invite, as: flags.as ?? null, fetch: globalThis.fetch }));
 }
 
+/**
+ * `supercode auth`: one Volter sign-in for everything supercode does, the way `gh auth` signs in to GitHub.
+ *   login [ORIGIN]  sign in (or say who is), make that team current, and offer to connect this machine
+ *   status          who is signed in, which team, and whether this machine is connected
+ *   switch [NAME]   make another saved team current (without NAME, list them)
+ *   logout          forget the sign-in and every team it signed into (refused while this machine is connected)
+ * Everything a person reads goes to stdout: none of it is an error.
+ */
+async function authCommand({ flags, sub = 'status', rest, home, contexts, output, env }) {
+  // A person reads stdout; with --json it carries only the JSON, and progress goes to stderr.
+  const say = line => (flags.json ? process.stderr : process.stdout).write(`${line}\n`);
+  if (sub === 'login') {
+    only(flags, ['json', 'help', 'team', 'as', 'force', 'no_connect', 'cwd', 'volter_issuer']);
+    requireArgs(rest, 0, 1, 'auth login [ORIGIN] [--team TEAM] [--as NAME] [--force] [--no-connect] [--cwd DIR]');
+    const origin = rest[0] ?? env.SUPERCODE_TEAMS_ORIGIN ?? DEFAULT_TEAMS_ORIGIN;
+    let account = authAccount(home, contexts);
+    if (account.context && !flags.force && !flags.team && !rest[0]) {
+      if (flags.json) return output(account);
+      say(`✓ Already logged in to Volter as ${account.email ?? 'you'} · team ${account.team}`);
+    } else {
+      const signIn = { ...(flags.volter_issuer ? { issuer: flags.volter_issuer } : {}), audience: new URL(origin).origin, say };
+      // As `teams login`: --team signs into that team; otherwise the person chooses among the teams they may use
+      // (volter-login.mjs), and the context it leaves current is the one this login reports.
+      if (flags.team) {
+        const saved = await loginContext({ supercodeHome: home, name: flags.as ?? null, origin, teamId: flags.team, token: null, invite: null, identityToken: await volterDeviceSignIn(signIn), as: flags.as ?? null, fetch: globalThis.fetch });
+        const name = Object.entries(contexts.read().contexts).find(([, value]) => value.credential_ref === saved.credential_ref)?.[0];
+        if (name) contexts.use(name);
+      } else {
+        const signedInTo = await volterDeviceSignIn({ ...signIn, finish: ({ token, ask }) => signInToTeams({ supercodeHome: home, origin, identityToken: token, ask, as: flags.as ?? null }) });
+        for (const { team, reason } of signedInTo.failed ?? []) say(`Not signed in to ${team}: ${reason}`);
+      }
+      account = authAccount(home, contexts);
+      if (flags.json) return output(account);
+      say(`✓ Logged in to Volter as ${account.email ?? 'you'} · team ${account.team ?? 'none'}${account.others.length ? ` (also: ${account.others.join(', ')}; supercode auth switch)` : ''}`);
+    }
+    if (flags.no_connect || !account.context || !process.stdin.isTTY || !process.stdout.isTTY) return;
+    const command = authTeamCommand(home, account.context, flags, output, env);
+    if (command.state().read()?.machine) return;
+    const readline = createInterface({ input: process.stdin, output: process.stdout });
+    let folder;
+    try {
+      const yes = (await readline.question(`Connect this machine to ${account.team}, so its sessions show there and teammates you allow can reach it? [Y/n] `)).trim();
+      if (/^n/i.test(yes)) { say(`Not connected. Later: supercode teams connect`); return; }
+      folder = (await readline.question(`Folder to share [${flags.cwd ?? process.cwd()}]: `)).trim() || (flags.cwd ?? process.cwd());
+    } finally { readline.close(); }
+    // As `teams connect` from a terminal: a service where the platform has a manager, else connected while it runs
+    // (the prompt is closed first, so Ctrl+C reaches the connector rather than the prompt).
+    command.flags = { cwd: folder };
+    return await connectorCommand('connect', command, home);
+  }
+  if (sub === 'status') {
+    only(flags, ['json', 'help']); requireArgs(rest, 0, 0, 'auth status');
+    const account = authAccount(home, contexts);
+    if (account.context) {
+      const command = authTeamCommand(home, account.context, flags, output, env);
+      const enrollment = command.state().read();
+      account.machine = enrollment?.machine ? { id: enrollment.machine.id, name: enrollment.machine.name, folder: enrollment.roots?.[0]?.path ?? null, service: enrollment.service?.kind ?? null, connection: null } : null;
+      try { await command.client.me(); account.reachable = true; } catch { account.reachable = false; }
+      if (account.machine && account.reachable) account.machine.connection = (await command.team.machines.get(account.machine.id).catch(() => null))?.data?.connection ?? null;
+    }
+    if (flags.json) return output(account);
+    say(account.email ? `Volter   ✓ ${account.email}` : 'Volter   not logged in (supercode login)');
+    if (!account.context) return say(account.others.length ? `Team     none current · saved: ${account.others.join(', ')} (supercode auth switch NAME)` : 'Team     none (supercode login)');
+    say(`Team     ${account.team} · ${new URL(account.origin).host}${account.reachable ? '' : ' · unreachable'}${account.others.length ? ` · also: ${account.others.join(', ')} (supercode auth switch)` : ''}`);
+    say(account.machine ? `Machine  ${account.machine.name} · ${account.machine.connection ?? 'unknown'} · sharing ${account.machine.folder ?? '?'}${account.machine.service ? ` (${account.machine.service})` : ' (runs while `teams connect` does)'}` : 'Machine  not connected (supercode teams connect)');
+    return;
+  }
+  if (sub === 'switch') {
+    only(flags, ['json', 'help']); requireArgs(rest, 0, 1, 'auth switch [NAME]');
+    const doc = contexts.read(), names = Object.keys(doc.contexts);
+    if (!rest[0]) return flags.json ? output({ current: doc.current, contexts: names }) : say(names.map(name => `${name === doc.current ? '*' : ' '} ${name} · ${doc.contexts[name].team_name ?? doc.contexts[name].team_id}`).join('\n') || 'No saved teams (supercode login)');
+    contexts.use(rest[0]);
+    return say(`✓ Switched to ${doc.contexts[rest[0]]?.team_name ?? rest[0]}`);
+  }
+  if (sub === 'logout') {
+    only(flags, ['json', 'help']); requireArgs(rest, 0, 0, 'auth logout');
+    const account = authAccount(home, contexts), doc = contexts.read();
+    // One sign-in is one credential, shared by every team context it signed into, so logging out ends all of them.
+    const credentialRef = account.context ? doc.contexts[account.context]?.credential_ref : null;
+    const signedIn = Object.entries(doc.contexts).filter(([name, context]) => name === account.context || (credentialRef && context.credential_ref === credentialRef));
+    // A connected machine's connector runs as one of those contexts, so logging out would strand it: disconnect first.
+    const connected = signedIn.find(([, context]) => contexts.connector(context.server_id, context.team_id).read()?.machine);
+    if (connected) throw Object.assign(new Error(`this machine is connected to ${connected[1].team_name ?? connected[0]}; run supercode teams disconnect first, then log out`), { code: 'conflict', exitCode: 6 });
+    const signedOut = signOut();
+    for (const [name] of signedIn) contexts.remove(name);
+    if (credentialRef) rmSync(join(contexts.paths.credentials, `${credentialRef}.json`), { force: true });
+    const teams = signedIn.map(([name, context]) => context.team_name ?? name);
+    if (flags.json) return output({ signed_out: signedOut, removed_contexts: signedIn.map(([name]) => name) });
+    return say(signedOut || teams.length ? `✓ Logged out${account.email ? ` ${account.email}` : ''}${teams.length ? ` from ${teams.join(', ')}` : ''}; every Volter tool on this machine is signed out` : 'Not logged in');
+  }
+  usage('auth login|status|switch|logout');
+}
+
+/** Who is signed in here: the machine's shared Volter sign-in and the current team context. */
+function authAccount(home, contexts) {
+  const doc = contexts.read(), name = doc.current && doc.current !== 'local' ? doc.current : null, context = name ? doc.contexts[name] : null;
+  const shared = readSharedSignIn();
+  return { email: shared?.email ?? null, context: context ? name : null, team: context?.team_name ?? context?.team_id ?? null, origin: context?.origin ?? null, serverId: context?.server_id ?? null, teamId: context?.team_id ?? null, others: Object.keys(doc.contexts).filter(other => other !== name) };
+}
+
+/** The command a team verb runs with, for the current team context. */
+function authTeamCommand(home, contextName, flags, output, env) {
+  const { client, context } = fromContext({ supercodeHome: home, name: contextName, fetch: globalThis.fetch });
+  return { flags, rest: [], output, client, context, team: client.team(context.team_id), home, contextName, env, dependencies: {}, state: () => new WorkspaceContexts(home).connector(context.server_id, context.team_id) };
+}
+
 /** What a login says: the context as JSON, or to a person, the team they are in and the next step. */
 function signedIn(flags, output, saved) {
   if (flags.json) return output(saved);
@@ -536,10 +645,18 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     saved = state.update(current => ({ ...current, roots: [root] }));
     // Run from a terminal, connect installs the service that keeps this machine connected (launchd or systemd) and
     // returns; the service itself runs connect without a terminal, in the foreground. --foreground runs it here.
+    let service = null;
     if (flags.install || (!flags.foreground && process.stdin.isTTY && process.stdout.isTTY)) {
       const serviceBin = process.env.SUPERCODE_BIN;
       if (!serviceBin) unsupported('--install requires invocation through the native supercode CLI');
-      const service = JSON.parse(execFileSync(serviceBin, ['__teams-connector-service', 'install', contextName, path, context.server_id, context.team_id], { encoding: 'utf8' }));
+      try { service = JSON.parse(execFileSync(serviceBin, ['__teams-connector-service', 'install', contextName, path, context.server_id, context.team_id], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })); }
+      catch (error) {
+        // A platform with no service manager still connects: here, for as long as this terminal runs it. Anything else is an error.
+        if (flags.install || !/no service manager/.test(String(error.stderr ?? error.message))) { core.close(); throw error; }
+        process.stderr.write('No service manager on this platform, so this machine stays connected while this command runs (Ctrl+C to stop).\n');
+      }
+    }
+    if (service) {
       saved = state.update(current => ({ ...current, service }));
       core.close();
       if (!flags.json) {
@@ -562,7 +679,7 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     const stopAll = async () => { await machine.stop().catch(() => {}); await connector.stop(); await core.close(); await lifecycle.close(); state.update(current => current ? ({ ...current, process: undefined }) : null); };
     try { await connector.start({ roots: () => saved.roots }); await machine.start(); } catch (error) { await stopAll(); throw error; }
     output({ version: 1, context: scope(context), data: { machine: saved.machine, source: saved.source, roots: saved.roots.map(({ path: _path, ...item }) => item), socket: machine.socketPath, foreground: true } });
-    await new Promise(resolveStop => { let stopped = false; stopConnector = async () => { if (stopped) return; stopped = true; await stopAll(); resolveStop(); }; process.once('SIGINT', stopConnector); process.once('SIGTERM', stopConnector); });
+    await new Promise(resolveStop => { let stopped = false; stopConnector = async () => { if (stopped) return; stopped = true; await stopAll(); resolveStop(); }; for (const signal of ['SIGINT', 'SIGTERM', ...(process.platform === 'win32' ? ['SIGHUP', 'SIGBREAK'] : [])]) process.once(signal, stopConnector); });
     return;
   }
   const enrollment = state.read();
@@ -572,7 +689,8 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     if (!serviceBin) unsupported('disconnecting an installed connector requires invocation through the native supercode CLI');
     execFileSync(serviceBin, ['__teams-connector-service', 'uninstall', contextName, enrollment.roots?.[0]?.path ?? '.', context.server_id, context.team_id], { encoding: 'utf8' });
   }
-  if (enrollment.process?.socket && enrollment.process?.token) await requestStop(enrollment.process.socket, enrollment.process.token);
+  // Uninstalling a Windows task already stopped its connector, so only one still answering is asked to stop.
+  if (enrollment.process?.socket && enrollment.process?.token && await activeSocket(enrollment.process.socket)) await requestStop(enrollment.process.socket, enrollment.process.token);
   const machine = await team.machines.get(enrollment.machine.id);
   await client.request('DELETE', teamPath(context, `/machines/${enrollment.machine.id}`), { ifMatch: machine.data.revision });
   state.remove();
@@ -707,6 +825,7 @@ function printHelp() {
   process.stdout.write(`supercode workspace commands:
   context create|list|show|use|remove
   teams list|create
+  auth login|status|switch|logout   (one Volter sign-in; "supercode login" is "auth login")
   login [ORIGIN] [--team TEAM] [--as CONTEXT] [--token-stdin|--invite-stdin]   (Volter sign-in in the browser by default)
   identity link
   server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN]

package/connector/index.mjs

@@ -96,8 +96,18 @@ export class TeamsConnector {
         const locator=descriptor.locator,nativeSessionId=locator?.session_id,harness=locator?.harness;
         if(!locator||!nativeSessionId||!harness)continue;
         const options={locator,descriptor,harness,nativeSessionId,ruleId:rule.id,ruleRevision:rule.revision,backfill:rule.backfill,rootPath:root.path??root.workspace};
-        await this.capture(options);
+        // One session that cannot be captured (a transcript that rewrote its history needs an explicit resync)
+        // is recorded, logged and skipped; it must not stop every other session, or the connector itself, from
+        // syncing. An error of the connection itself (the outbox, authentication, the server, a stop) still ends
+        // the pass. The session keeps its native binding either way, so it can still be attached to.
+        let captured = true;
+        try { await this.capture(options); } catch (error) {
+          if (error.outbox || error.status === 401 || error.status === 403 || error.status >= 500 || this.abort.signal.aborted) throw error;
+          captured = false; this.lastError = error;
+          process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} not synced: ${error.message}\n`);
+        }
         try { await this.nativeEffects.discover(descriptor, rule.id); } catch (error) { this.lastError = error; }
+        if (!captured) continue;
         const key=`${rule.id}:${harness}:${nativeSessionId}`;
         if(this.followers.has(key)||typeof this.core.session(locator).follow!=='function')continue;
         const controller=new AbortController(),stop=()=>controller.abort(this.abort.signal.reason);this.abort.signal.addEventListener('abort',stop,{once:true});
@@ -169,6 +179,8 @@ export class TeamsConnector {
     this.work=work.catch(()=>{});
     return work;
   }
-  async flushSerial(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);let receipt;if(begun.state==='committed')receipt=begun.receipt;else{for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);for(const artifact of item.artifacts??[])for(const chunk of artifact.chunks)await this.request('PUT',`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`,chunk);receipt=await this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;}this.state.origins[key]=next;this.state.outbox.shift();this.save();latest=receipt;}return latest;}
+  // Every outbox error is the connection's, not one session's: a capture's own catch passes it on (syncConfiguredSessions).
+  async flushSerial(){try{return await this.flushOutbox();}catch(error){throw Object.assign(error,{outbox:true});}}
+  async flushOutbox(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);let receipt;if(begun.state==='committed')receipt=begun.receipt;else{for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);for(const artifact of item.artifacts??[])for(const chunk of artifact.chunks)await this.request('PUT',`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`,chunk);receipt=await this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;}this.state.origins[key]=next;this.state.outbox.shift();this.save();latest=receipt;}return latest;}
   stop(){if(this.timer)clearInterval(this.timer);this.abort.abort();for(const follower of this.followers?.values()??[])follower.controller.abort();return this.nativeEffects.close();}
 }

package/machine.mjs

@@ -33,6 +33,9 @@ import { hostname } from 'node:os';
 import { randomBytes, createHash } from 'node:crypto';
 import { WebSocket } from 'ws';
 import { TmuxTerminalHost, classifyAttentionSignal, composerHoldsDraft, composerReadyForInput } from '@volter/supercode-terminal';
+// The ConPTY host is read from the namespace, where a terminal package too old to have it gives undefined rather
+// than failing the load: a POSIX daemon never needs it. Windows needs a supercode-terminal with PtyTerminalHost.
+import * as terminal from '@volter/supercode-terminal';
 import { findLiveReceipt, mintFrontendCredential } from '@volter/supercode-harness-sdk/live-runtime';
 import { NODE_PROTOCOL } from '@volter/teams/channel';
 import { holds, observesPanes } from '@volter/teams/admission';
@@ -75,7 +78,9 @@ export class TeamsMachine extends MachineCore {
     this.supercodeBin = supercode;
     this.tmuxSocket = tmuxSocket ?? null;
     this.launches = new Launches(this.p.launches);
-    this.host = new TmuxTerminalHost({
+    // Windows has no tmux: its panes are ConPTY children of this daemon, and end with it.
+    if (process.platform === 'win32' && !terminal.PtyTerminalHost) throw new Error('panes on Windows need a newer @volter/supercode-terminal (one with PtyTerminalHost)');
+    this.host = process.platform === 'win32' ? new terminal.PtyTerminalHost() : new TmuxTerminalHost({
       // Stable owner id so panes this daemon launched stay "owned" across restarts.
       ownerId: `supercode-teams-${fingerprint(this.identity.publicKeyPem)}`,
       ...(tmuxSocket ? { socket: tmuxSocket } : {}),
@@ -376,7 +381,8 @@ export class TeamsMachine extends MachineCore {
   #paneEnv(contextKey, requested) {
     const env = { ...(requested ?? {}) };
     const inherited = env.NODE_OPTIONS ?? this.env.NODE_OPTIONS ?? '';
-    env.NODE_OPTIONS = `${inherited} --require ${PORTHOLE_HOOK}`.trim();
+    // Quoted: NODE_OPTIONS splits on spaces, and a home path may hold one (Windows user folders often do).
+    env.NODE_OPTIONS = `${inherited} --require ${JSON.stringify(PORTHOLE_HOOK)}`.trim();
     env.SUPERCODE_TEAMS_PORTS_DIR = this.portsDir;
     env.SUPERCODE_TEAMS_PANE = contextKey;
     return env;
@@ -630,6 +636,8 @@ export class TeamsMachine extends MachineCore {
   async #renameWindow(contextKey, title) {
     const session = await this.#paneByContext(contextKey);
     if (!session || !session.owned) return null;
+    // A host with windows of its own renames them itself (a ConPTY pane has none).
+    if (typeof this.host.renameWindow === 'function') return this.host.renameWindow(session.id, title);
     const socketArgs = this.tmuxSocket ? ['-L', this.tmuxSocket] : [];
     const target = `${session.label}:0`;
     const run = (args) => spawnSync('tmux', [...socketArgs, ...args], { timeout: 5_000, encoding: 'utf8' });
@@ -1149,7 +1157,7 @@ export class TeamsMachine extends MachineCore {
  *  pane's tty. When that is the pane's own shell, no command is running and the
  *  shell is at its prompt; when it is anything else, that thing is the work. The
  *  list is names, not paths, because that is the form tmux reports. */
-const PANE_SHELLS = new Set(['ash', 'bash', 'csh', 'dash', 'fish', 'ksh', 'ksh93', 'nu', 'pwsh', 'sh', 'tcsh', 'xonsh', 'zsh']);
+const PANE_SHELLS = new Set(['ash', 'bash', 'cmd', 'cmd.exe', 'csh', 'dash', 'fish', 'ksh', 'ksh93', 'nu', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe', 'sh', 'tcsh', 'xonsh', 'zsh']);
 
 /** Liveness of a live pane from its foreground command (attention.mjs LIVENESS).
  *  A missing or empty value is `unknown`, the honest floor: tmux named nothing,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -62,7 +62,9 @@
     "@volter/supercode-harness-sdk": "^0.3.43",
     "@volter/supercode-terminal": "^0.2.30",
     "@volter/identity": "^0.4.0",
-    "@volter/teams": "^0.1.6",
+    "@volter/teams": "^0.1.7",
+    "@xterm/addon-serialize": "^0.14.0",
+    "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",
     "ws": "^8.21.0"
   },