@volter/supercode-teams 0.2.20 → 0.2.22

package/README.md

@@ -29,7 +29,8 @@ The daemon owns one `supercode harness serve` and the tmux terminal host.
 Two doors reach it:
 
 - **Local**: an owner-only Unix socket, `$SUPERCODE_HOME/teams/machine.sock` (or, when that path
-  is too long for a socket address, a per-user 0700 directory under `/tmp`). Whoever can open it
+  is too long for a socket address, a per-user 0700 directory under `/tmp`). On Windows it is a
+  named pipe, `\\.\pipe\supercode-<hash>`, which by default only its owner may open. Whoever can open it
   is this OS user, an operator. The local CLI, the agent inside the machine and a service on the
   same box (RH2's connector) use it.
 - **Remote**: the Teams server. The daemon holds one outbound WebSocket link; the server forwards

package/bin/teams.mjs

@@ -25,8 +25,16 @@
 // Every other verb (server, login, context, connect, disconnect, status,
 // members, groups, sources, sync, machines, sessions) is the Teams workspace
 // CLI in ./workspace.mjs.
-import { readFileSync, writeFileSync } from 'node:fs';
+import { createWriteStream, readFileSync, writeFileSync } from 'node:fs';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
+
+// A Windows scheduled task keeps no output (launchd and systemd name log files), so its unit names one here.
+if (process.env.SUPERCODE_TEAMS_LOG) {
+  const log = createWriteStream(process.env.SUPERCODE_TEAMS_LOG, { flags: 'a' });
+  for (const stream of [process.stdout, process.stderr]) stream.write = log.write.bind(log);
+  // The log is this process's own; a pane or harness it starts writes to its own terminal.
+  delete process.env.SUPERCODE_TEAMS_LOG;
+}
 import { TeamsMachine } from '../machine.mjs';
 import { harnessTransport, nodeRpc, forwardPort, watchMachine } from '../client.mjs';
 import { attachBrowserProfile, listBrowserProfiles } from '../browser-attach.mjs';
@@ -63,20 +71,23 @@ if (verb === undefined || verb === 'help') {
   await workspaceMain(['--help']);
   process.exit(0);
 }
-if (!MACHINE_VERBS.has(verb)) {
+// A workspace verb is done when its promise settles. On Windows the process then ends on its own: Node there aborts
+// (libuv's `UV_HANDLE_CLOSING` assertion) when process.exit() follows a fetch, which every workspace verb makes.
+const workspaceVerb = !MACHINE_VERBS.has(verb);
+if (workspaceVerb) {
   const { workspaceMain } = await import('./workspace.mjs');
-  await workspaceMain(argv).catch((error) => {
+  await workspaceMain(argv).then(() => { process.exitCode = 0; }, (error) => {
     process.stderr.write(JSON.stringify({ version: 1, error: { code: error.code ?? 'invalid_request', message: error.message } }) + '\n');
-    process.exit(error.exitCode ?? ({ invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 }[error.code] ?? 1));
+    process.exitCode = (error.exitCode ?? ({ invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 }[error.code] ?? 1));
   });
-  process.exit(0);
+  if (process.platform !== 'win32') process.exit();
 }
 
 const home = flags.home ? String(flags.home) : teamsHome();
 const p = paths(home);
 const out = (value) => process.stdout.write((typeof value === 'string' ? value : JSON.stringify(value, null, 2)) + '\n');
 const die = (message, code = 2) => { process.stderr.write(`supercode teams: ${message}\n`); process.exit(code); };
-for (const flag of Object.keys(flags)) if (!KNOWN_FLAGS.has(flag)) die(`unknown flag: --${flag}`);
+if (!workspaceVerb) for (const flag of Object.keys(flags)) if (!KNOWN_FLAGS.has(flag)) die(`unknown flag: --${flag}`);
 
 async function machineChannel() {
   return openMachine({ machine: flags.machine ? String(flags.machine) : null, context: flags.context ? String(flags.context) : null, home });
@@ -288,4 +299,4 @@ async function main() {
   }
 }
 
-main().catch((error) => die(error.message ?? String(error), error.code === 'machine_offline' ? 5 : 1));
+if (!workspaceVerb) main().catch((error) => die(error.message ?? String(error), error.code === 'machine_offline' ? 5 : 1));

package/bin/workspace/args.mjs

@@ -1,7 +1,7 @@
 const BOOLEANS = new Set([
   'json', 'help', 'live', 'saved', 'watch', 'paginate', 'token-stdin',
   'invite-stdin', 'include-children', 'rotate', 'install', 'force',
-  'take-control', 'dry-run', 'volter', 'foreground',
+  'take-control', 'dry-run', 'volter', 'foreground', 'no-connect',
 ]);
 
 const VALUES = new Set([

package/bin/workspace/lifecycle.mjs

@@ -2,19 +2,30 @@ import { createConnection, createServer } from 'node:net';
 import { mkdirSync, renameSync, rmSync, unlinkSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { shortSocketPath, ensureSocketDirectory } from '@volter/teams/home';
+import { shortSocketPath, ensureSocketDirectory, isNamedPipe } from '@volter/teams/home';
 import { execFileSync } from 'node:child_process';
 
 const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+// A process's start time names it exactly: a reused pid has another. Windows has no ps; its process table answers.
 const processIdentity = pid => {
-  try { return execFileSync('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 1_000, stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null; }
+  const [command, args] = process.platform === 'win32'
+    ? ['powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `(Get-Process -Id ${Number(pid)}).StartTime.ToUniversalTime().Ticks`]]
+    : ['/bin/ps', ['-o', 'lstart=', '-p', String(pid)]];
+  try { return execFileSync(command, args, { encoding: 'utf8', timeout: process.platform === 'win32' ? 5_000 : 1_000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }).trim() || null; }
   catch { return null; }
 };
 const readOwner = lock => {
   try { return JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8')); }
   catch { return null; }
 };
-const sameOwner = owner => owner?.pid > 0 && owner.start === processIdentity(owner.pid);
+// Without both start times (a lookup that timed out, as a cold PowerShell can) the pid's liveness decides, so a live
+// owner is never taken for stale.
+const sameOwner = owner => {
+  if (!(owner?.pid > 0)) return false;
+  const start = processIdentity(owner.pid);
+  if (owner.start != null && start != null) return owner.start === start;
+  try { process.kill(owner.pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+};
 
 export async function activeSocket(path) {
   return new Promise(resolve => {
@@ -65,15 +76,19 @@ export async function acquireLifecycle(directory, onStop) {
       catch (renameError) { if (renameError.code !== 'ENOENT') throw renameError; }
     }
   }
-  try { unlinkSync(socketPath); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (!isNamedPipe(socketPath)) try { unlinkSync(socketPath); } catch (error) { if (error.code !== 'ENOENT') throw error; }
   const server = createServer(connection => {
-    let body = ''; connection.setEncoding('utf8');
+    let body = '', answered = false; connection.setEncoding('utf8');
     connection.on('error', () => {});
-    connection.on('data', chunk => { body += chunk; if (body.length > 1024) connection.destroy(); });
-    connection.on('end', () => {
+    // A request is one line; it is answered at its newline, or at the end of a request without one. A Windows named
+    // pipe has no half-close, so a client there cannot end its side and still read the answer.
+    const answer = () => {
+      if (answered) return; answered = true;
       if (body.trim() !== token) { connection.end('forbidden\n'); return; }
       connection.end('ok\n', () => { void onStop(); });
-    });
+    };
+    connection.on('data', chunk => { body += chunk; if (body.length > 1024) connection.destroy(); else if (body.includes('\n')) answer(); });
+    connection.on('end', answer);
   });
   try {
     await new Promise((resolve, reject) => { server.once('error', reject); server.listen(socketPath, resolve); });
@@ -87,7 +102,7 @@ export async function acquireLifecycle(directory, onStop) {
     close: async () => {
       await new Promise(resolve => server.close(resolve));
       if (readOwner(lock)?.token !== token) return;
-      try { unlinkSync(socketPath); } catch {}
+      if (!isNamedPipe(socketPath)) try { unlinkSync(socketPath); } catch {}
       rmSync(lock, { recursive: true, force: true });
     },
   };
@@ -101,7 +116,7 @@ export async function requestStop(socketPath, token) {
         const finish = (error, value) => { if (settled) return; settled = true; socket.destroy(); error ? reject(error) : resolve(value); };
         socket.setTimeout(500, () => finish(new Error('connector control request timed out')));
         socket.setEncoding('utf8');
-        socket.once('connect', () => socket.end(`${token}\n`));
+        socket.once('connect', () => process.platform === 'win32' ? socket.write(`${token}\n`) : socket.end(`${token}\n`));
         socket.on('data', chunk => { text += chunk; if (text.length > 1024) finish(new Error('connector control reply is too large')); });
         socket.once('end', () => finish(null, text));
         socket.once('error', error => finish(error));

package/bin/workspace/roots.mjs

@@ -0,0 +1,48 @@
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+
+const canonical = path => { try { return realpathSync.native(path); } catch { return resolve(path); } };
+const folded = (path, platform) => platform === 'win32' || platform === 'darwin' ? path.toLowerCase() : path;
+const contains = (outer, inner) => { const name = relative(outer, inner); return name === '' || (!isAbsolute(name) && name !== '..' && !name.startsWith('..' + sep)); };
+
+/**
+ * Why connecting `path` as a Teams sync root would share every session on this machine, or null.
+ * A rule covers its root and every folder under it, so a filesystem or drive root, the user's home, or
+ * a folder holding the home (`/Users`, `C:\Users`) publishes everything the harnesses ever recorded.
+ */
+export function broadRootReason(path, { home = homedir(), platform = process.platform } = {}) {
+  const root = canonical(path);
+  if (dirname(root) === root) return 'a filesystem root';
+  if (!home) return null;
+  const user = canonical(home);
+  if (folded(root, platform) === folded(user, platform)) return 'your home directory';
+  if (contains(folded(root, platform), folded(user, platform))) return 'a folder that holds your home directory';
+  return null;
+}
+
+/**
+ * How `teams connect` registers `path`: the fields its saved root carries.
+ * - An ordinary folder: `{}` (the rule covers the folder and every folder under it).
+ * - A broad root with --force, or one accepted with --force before: `{ broad_accepted: true }`.
+ * - A broad root this enrollment already had before rules covered subfolders (saved without
+ *   `broad_accepted`), rerun without a terminal by the background service: `{ exact_only: true }`. It keeps
+ *   syncing only sessions recorded in that exact folder, as it did, and says so on stderr; refusing it
+ *   would silently stop the machine's sync.
+ * - Otherwise a broad root is refused.
+ */
+export function connectRootScope(path, { force = false, saved = null, interactive = false, warn = message => process.stderr.write(message), ...options } = {}) {
+  const previous = saved?.roots?.find(item => item.path === path) ?? null;
+  const reason = refuseBroadRoot(path, { force, accepted: Boolean(previous?.broad_accepted) || (Boolean(previous) && !interactive), ...options });
+  if (!reason) return {};
+  if (force || previous?.broad_accepted) return { broad_accepted: true };
+  warn(`supercode teams: ${path} is ${reason}. Its sync rules keep sharing only sessions recorded in that exact folder; sessions in its subfolders are not shared. To share every session under it, run \`supercode teams connect --force\` from that folder.\n`);
+  return { exact_only: true };
+}
+
+/** Refuse a broad root unless the caller passed --force (or accepted this same root before). */
+export function refuseBroadRoot(path, { force = false, accepted = false, verb = 'connect', ...options } = {}) {
+  const reason = broadRootReason(path, options);
+  if (!reason || force || accepted) return reason;
+  throw Object.assign(new Error(`refusing to ${verb} ${path}: it is ${reason}, and a Teams sync rule covers every session whose working directory is that folder or any folder under it, so it would share every session on this machine. Choose a project folder, or pass --force to share them all.`), { code: 'invalid_request', exitCode: 2 });
+}

package/bin/workspace.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { hostname } from 'node:os';
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, rmSync } from 'node:fs';
 import { basename, join, resolve } from 'node:path';
 import { execFileSync, spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
@@ -19,6 +19,9 @@ import { reserveArtifactDirectory, reserveProtected, writeProtected } from './wo
 import { acquireLifecycle, activeSocket, requestStop } from './workspace/lifecycle.mjs';
 import { volterDeviceSignIn } from './workspace/volter-device.mjs';
 import { loginSummary, signInToTeams } from './workspace/volter-login.mjs';
+import { readSharedSignIn, signOut } from '@volter/identity';
+import { createInterface } from 'node:readline/promises';
+import { connectRootScope, refuseBroadRoot } from './workspace/roots.mjs';
 
 const ERROR_EXITS = { invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 };
 
@@ -35,6 +38,7 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   if (verb === 'context') return contextCommand({ contexts, flags, sub, rest, output });
   if (verb === 'server') return serverCommand({ flags, sub, rest, home, output });
   if (verb === 'login') return loginCommand({ flags, origin: sub, rest, home, output });
+  if (verb === 'auth') return authCommand({ flags, sub, rest, home, contexts, output, env, dependencies });
   const explicitContext = flags.context ?? env.SUPERCODE_CONTEXT;
   let selected = explicitContext ?? contexts.read().current;
   const urlReference = verb === 'sessions' ? rest.find(value => /^https?:\/\//.test(value)) : null;
@@ -145,6 +149,112 @@ async function loginCommand({ flags, origin, rest, home, output }) {
   return signedIn(flags, output, await loginContext({ supercodeHome: home, name: flags.as ?? null, origin, teamId: flags.team ?? null, token, invite, as: flags.as ?? null, fetch: globalThis.fetch }));
 }
 
+/**
+ * `supercode auth`: one Volter sign-in for everything supercode does, the way `gh auth` signs in to GitHub.
+ *   login [ORIGIN]  sign in (or say who is), make that team current, and offer to connect this machine
+ *   status          who is signed in, which team, and whether this machine is connected
+ *   switch [NAME]   make another saved team current (without NAME, list them)
+ *   logout          forget the sign-in and every team it signed into (refused while this machine is connected)
+ * Everything a person reads goes to stdout: none of it is an error.
+ */
+async function authCommand({ flags, sub = 'status', rest, home, contexts, output, env }) {
+  // A person reads stdout; with --json it carries only the JSON, and progress goes to stderr.
+  const say = line => (flags.json ? process.stderr : process.stdout).write(`${line}\n`);
+  if (sub === 'login') {
+    only(flags, ['json', 'help', 'team', 'as', 'force', 'no_connect', 'cwd', 'volter_issuer']);
+    requireArgs(rest, 0, 1, 'auth login [ORIGIN] [--team TEAM] [--as NAME] [--force] [--no-connect] [--cwd DIR]');
+    const origin = rest[0] ?? env.SUPERCODE_TEAMS_ORIGIN ?? DEFAULT_TEAMS_ORIGIN;
+    let account = authAccount(home, contexts);
+    if (account.context && !flags.force && !flags.team && !rest[0]) {
+      if (flags.json) return output(account);
+      say(`✓ Already logged in to Volter as ${account.email ?? 'you'} · team ${account.team}`);
+    } else {
+      const signIn = { ...(flags.volter_issuer ? { issuer: flags.volter_issuer } : {}), audience: new URL(origin).origin, say };
+      // As `teams login`: --team signs into that team; otherwise the person chooses among the teams they may use
+      // (volter-login.mjs), and the context it leaves current is the one this login reports.
+      if (flags.team) {
+        const saved = await loginContext({ supercodeHome: home, name: flags.as ?? null, origin, teamId: flags.team, token: null, invite: null, identityToken: await volterDeviceSignIn(signIn), as: flags.as ?? null, fetch: globalThis.fetch });
+        const name = Object.entries(contexts.read().contexts).find(([, value]) => value.credential_ref === saved.credential_ref)?.[0];
+        if (name) contexts.use(name);
+      } else {
+        const signedInTo = await volterDeviceSignIn({ ...signIn, finish: ({ token, ask }) => signInToTeams({ supercodeHome: home, origin, identityToken: token, ask, as: flags.as ?? null }) });
+        for (const { team, reason } of signedInTo.failed ?? []) say(`Not signed in to ${team}: ${reason}`);
+      }
+      account = authAccount(home, contexts);
+      if (flags.json) return output(account);
+      say(`✓ Logged in to Volter as ${account.email ?? 'you'} · team ${account.team ?? 'none'}${account.others.length ? ` (also: ${account.others.join(', ')}; supercode auth switch)` : ''}`);
+    }
+    if (flags.no_connect || !account.context || !process.stdin.isTTY || !process.stdout.isTTY) return;
+    const command = authTeamCommand(home, account.context, flags, output, env);
+    if (command.state().read()?.machine) return;
+    const readline = createInterface({ input: process.stdin, output: process.stdout });
+    let folder;
+    try {
+      const yes = (await readline.question(`Connect this machine to ${account.team}, so its sessions show there and teammates you allow can reach it? [Y/n] `)).trim();
+      if (/^n/i.test(yes)) { say(`Not connected. Later: supercode teams connect`); return; }
+      folder = (await readline.question(`Folder to share [${flags.cwd ?? process.cwd()}]: `)).trim() || (flags.cwd ?? process.cwd());
+    } finally { readline.close(); }
+    // As `teams connect` from a terminal: a service where the platform has a manager, else connected while it runs
+    // (the prompt is closed first, so Ctrl+C reaches the connector rather than the prompt).
+    command.flags = { cwd: folder };
+    return await connectorCommand('connect', command, home);
+  }
+  if (sub === 'status') {
+    only(flags, ['json', 'help']); requireArgs(rest, 0, 0, 'auth status');
+    const account = authAccount(home, contexts);
+    if (account.context) {
+      const command = authTeamCommand(home, account.context, flags, output, env);
+      const enrollment = command.state().read();
+      account.machine = enrollment?.machine ? { id: enrollment.machine.id, name: enrollment.machine.name, folder: enrollment.roots?.[0]?.path ?? null, service: enrollment.service?.kind ?? null, connection: null } : null;
+      try { await command.client.me(); account.reachable = true; } catch { account.reachable = false; }
+      if (account.machine && account.reachable) account.machine.connection = (await command.team.machines.get(account.machine.id).catch(() => null))?.data?.connection ?? null;
+    }
+    if (flags.json) return output(account);
+    say(account.email ? `Volter   ✓ ${account.email}` : 'Volter   not logged in (supercode login)');
+    if (!account.context) return say(account.others.length ? `Team     none current · saved: ${account.others.join(', ')} (supercode auth switch NAME)` : 'Team     none (supercode login)');
+    say(`Team     ${account.team} · ${new URL(account.origin).host}${account.reachable ? '' : ' · unreachable'}${account.others.length ? ` · also: ${account.others.join(', ')} (supercode auth switch)` : ''}`);
+    say(account.machine ? `Machine  ${account.machine.name} · ${account.machine.connection ?? 'unknown'} · sharing ${account.machine.folder ?? '?'}${account.machine.service ? ` (${account.machine.service})` : ' (runs while `teams connect` does)'}` : 'Machine  not connected (supercode teams connect)');
+    return;
+  }
+  if (sub === 'switch') {
+    only(flags, ['json', 'help']); requireArgs(rest, 0, 1, 'auth switch [NAME]');
+    const doc = contexts.read(), names = Object.keys(doc.contexts);
+    if (!rest[0]) return flags.json ? output({ current: doc.current, contexts: names }) : say(names.map(name => `${name === doc.current ? '*' : ' '} ${name} · ${doc.contexts[name].team_name ?? doc.contexts[name].team_id}`).join('\n') || 'No saved teams (supercode login)');
+    contexts.use(rest[0]);
+    return say(`✓ Switched to ${doc.contexts[rest[0]]?.team_name ?? rest[0]}`);
+  }
+  if (sub === 'logout') {
+    only(flags, ['json', 'help']); requireArgs(rest, 0, 0, 'auth logout');
+    const account = authAccount(home, contexts), doc = contexts.read();
+    // One sign-in is one credential, shared by every team context it signed into, so logging out ends all of them.
+    const credentialRef = account.context ? doc.contexts[account.context]?.credential_ref : null;
+    const signedIn = Object.entries(doc.contexts).filter(([name, context]) => name === account.context || (credentialRef && context.credential_ref === credentialRef));
+    // A connected machine's connector runs as one of those contexts, so logging out would strand it: disconnect first.
+    const connected = signedIn.find(([, context]) => contexts.connector(context.server_id, context.team_id).read()?.machine);
+    if (connected) throw Object.assign(new Error(`this machine is connected to ${connected[1].team_name ?? connected[0]}; run supercode teams disconnect first, then log out`), { code: 'conflict', exitCode: 6 });
+    const signedOut = signOut();
+    for (const [name] of signedIn) contexts.remove(name);
+    if (credentialRef) rmSync(join(contexts.paths.credentials, `${credentialRef}.json`), { force: true });
+    const teams = signedIn.map(([name, context]) => context.team_name ?? name);
+    if (flags.json) return output({ signed_out: signedOut, removed_contexts: signedIn.map(([name]) => name) });
+    return say(signedOut || teams.length ? `✓ Logged out${account.email ? ` ${account.email}` : ''}${teams.length ? ` from ${teams.join(', ')}` : ''}; every Volter tool on this machine is signed out` : 'Not logged in');
+  }
+  usage('auth login|status|switch|logout');
+}
+
+/** Who is signed in here: the machine's shared Volter sign-in and the current team context. */
+function authAccount(home, contexts) {
+  const doc = contexts.read(), name = doc.current && doc.current !== 'local' ? doc.current : null, context = name ? doc.contexts[name] : null;
+  const shared = readSharedSignIn();
+  return { email: shared?.email ?? null, context: context ? name : null, team: context?.team_name ?? context?.team_id ?? null, origin: context?.origin ?? null, serverId: context?.server_id ?? null, teamId: context?.team_id ?? null, others: Object.keys(doc.contexts).filter(other => other !== name) };
+}
+
+/** The command a team verb runs with, for the current team context. */
+function authTeamCommand(home, contextName, flags, output, env) {
+  const { client, context } = fromContext({ supercodeHome: home, name: contextName, fetch: globalThis.fetch });
+  return { flags, rest: [], output, client, context, team: client.team(context.team_id), home, contextName, env, dependencies: {}, state: () => new WorkspaceContexts(home).connector(context.server_id, context.team_id) };
+}
+
 /** What a login says: the context as JSON, or to a person, the team they are in and the next step. */
 function signedIn(flags, output, saved) {
   if (flags.json) return output(saved);
@@ -498,6 +608,7 @@ async function syncCommand(sub, { flags, rest, output, client, context, team, ho
     if (!enrollment?.machine?.id) unsupported('this context has no connector enrollment');
     const path = realpathSync(resolve(flags.repo)), root = enrollment.roots?.find(item => item.path === path);
     if (!root) unsupported('the connector has not registered that repository root; restart connect with --cwd PATH');
+    refuseBroadRoot(path, { force: flags.force, verb: 'sync' });
     if (flags.harness && !root.harnesses.includes(flags.harness)) unsupported(`the native core does not report a ${flags.harness} discovery adapter`);
     return output(await team.syncRules.create({ machine_id: enrollment.machine.id, source_id: enrollment.source.id, selector: { root_id: root.id, harnesses: flags.harness ? [flags.harness] : root.harnesses }, visibility: flags.visibility ?? 'restricted', backfill: backfill(flags.backfill ?? 'none') }));
   }
@@ -517,6 +628,11 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
   if (verb === 'status') { let reachable = true; let account = null; try { account = await client.me(); } catch { reachable = false; } const saved = state.read(); const running = saved?.process?.socket ? await activeSocket(saved.process.socket) : false; return output({ version: 1, context: scope(context), data: { reachable, account, connector: saved ? { enrolled: true, running, machine: saved.machine, source: saved.source } : { enrolled: false, running: false }, sources: reachable ? (await team.sources.list()).items : [] } }); }
   if (verb === 'connect') {
     let saved = state.read();
+    const path = realpathSync(resolve(flags.cwd ?? '.'));
+    // A broad root is refused before enrolling anything. The service reruns connect without a terminal, and
+    // without --force, for the root accepted here; a broad root enrolled before rules covered subfolders keeps
+    // its exact-folder sync there.
+    const rootScope = connectRootScope(path, { force: flags.force, saved, interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY) });
     if (!saved) { const enrollment_key = crypto.randomUUID(); saved = { version: 1, enrollment_key, phase: 'enrolling' }; state.write(saved); }
     if (!saved.machine) {
       const response = await team.machines.create({ name: flags.name ?? hostname(), enrollment_key: saved.enrollment_key });
@@ -531,15 +647,22 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     try { support = await core.supportReport(); } catch (error) { core.close(); throw error; }
     const harnesses = [...new Set((support.harnesses ?? []).map(item => item.id).filter(id => typeof id === 'string'))];
     if (!harnesses.length) { core.close(); unsupported('the native core reported no discoverable harness adapters'); }
-    const path = realpathSync(resolve(flags.cwd ?? '.'));
-    const root = { id: `root_${createHash('sha256').update(`${saved.machine.id}\0${path}`).digest('hex').slice(0, 32)}`, machine_id: saved.machine.id, name: basename(path), harnesses, path };
+    const root = { id: `root_${createHash('sha256').update(`${saved.machine.id}\0${path}`).digest('hex').slice(0, 32)}`, machine_id: saved.machine.id, name: basename(path), harnesses, path, ...rootScope };
     saved = state.update(current => ({ ...current, roots: [root] }));
     // Run from a terminal, connect installs the service that keeps this machine connected (launchd or systemd) and
     // returns; the service itself runs connect without a terminal, in the foreground. --foreground runs it here.
+    let service = null;
     if (flags.install || (!flags.foreground && process.stdin.isTTY && process.stdout.isTTY)) {
       const serviceBin = process.env.SUPERCODE_BIN;
       if (!serviceBin) unsupported('--install requires invocation through the native supercode CLI');
-      const service = JSON.parse(execFileSync(serviceBin, ['__teams-connector-service', 'install', contextName, path, context.server_id, context.team_id], { encoding: 'utf8' }));
+      try { service = JSON.parse(execFileSync(serviceBin, ['__teams-connector-service', 'install', contextName, path, context.server_id, context.team_id], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })); }
+      catch (error) {
+        // A platform with no service manager still connects: here, for as long as this terminal runs it. Anything else is an error.
+        if (flags.install || !/no service manager/.test(String(error.stderr ?? error.message))) { core.close(); throw error; }
+        process.stderr.write('No service manager on this platform, so this machine stays connected while this command runs (Ctrl+C to stop).\n');
+      }
+    }
+    if (service) {
       saved = state.update(current => ({ ...current, service }));
       core.close();
       if (!flags.json) {
@@ -559,10 +682,11 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     const hostKeyId = publicKeyId(loadOrCreateKeyPair(paths(daemonHome).machineKey).publicKeyPem);
     const connector = new TeamsConnector({ server: context.origin, teamId: context.team_id, machineId: saved.machine.id, sourceId: saved.source.id, credential: saved.credential.token, stateDir: state.directory, core, hostKeyId });
     const machine = new TeamsMachine({ home: daemonHome, supercode: binary, ...(flags.tmux_socket ? { tmuxSocket: String(flags.tmux_socket) } : {}), link: { server: context.origin, teamId: context.team_id, machineId: saved.machine.id, credential: saved.credential.token, incarnationId: connector.state.incarnation_id, configuration: () => connector.configuration() } });
+    machine.on('link', (event) => { if (event.event === 'replaced') process.stderr.write(`supercode teams: ${event.error}. Two connectors were running for this machine; stop one of them (\`supercode teams disconnect\` where it should not run).\n`); });
     const stopAll = async () => { await machine.stop().catch(() => {}); await connector.stop(); await core.close(); await lifecycle.close(); state.update(current => current ? ({ ...current, process: undefined }) : null); };
     try { await connector.start({ roots: () => saved.roots }); await machine.start(); } catch (error) { await stopAll(); throw error; }
     output({ version: 1, context: scope(context), data: { machine: saved.machine, source: saved.source, roots: saved.roots.map(({ path: _path, ...item }) => item), socket: machine.socketPath, foreground: true } });
-    await new Promise(resolveStop => { let stopped = false; stopConnector = async () => { if (stopped) return; stopped = true; await stopAll(); resolveStop(); }; process.once('SIGINT', stopConnector); process.once('SIGTERM', stopConnector); });
+    await new Promise(resolveStop => { let stopped = false; stopConnector = async () => { if (stopped) return; stopped = true; await stopAll(); resolveStop(); }; for (const signal of ['SIGINT', 'SIGTERM', ...(process.platform === 'win32' ? ['SIGHUP', 'SIGBREAK'] : [])]) process.once(signal, stopConnector); });
     return;
   }
   const enrollment = state.read();
@@ -572,7 +696,8 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     if (!serviceBin) unsupported('disconnecting an installed connector requires invocation through the native supercode CLI');
     execFileSync(serviceBin, ['__teams-connector-service', 'uninstall', contextName, enrollment.roots?.[0]?.path ?? '.', context.server_id, context.team_id], { encoding: 'utf8' });
   }
-  if (enrollment.process?.socket && enrollment.process?.token) await requestStop(enrollment.process.socket, enrollment.process.token);
+  // Uninstalling a Windows task already stopped its connector, so only one still answering is asked to stop.
+  if (enrollment.process?.socket && enrollment.process?.token && await activeSocket(enrollment.process.socket)) await requestStop(enrollment.process.socket, enrollment.process.token);
   const machine = await team.machines.get(enrollment.machine.id);
   await client.request('DELETE', teamPath(context, `/machines/${enrollment.machine.id}`), { ifMatch: machine.data.revision });
   state.remove();
@@ -707,6 +832,7 @@ function printHelp() {
   process.stdout.write(`supercode workspace commands:
   context create|list|show|use|remove
   teams list|create
+  auth login|status|switch|logout   (one Volter sign-in; "supercode login" is "auth login")
   login [ORIGIN] [--team TEAM] [--as CONTEXT] [--token-stdin|--invite-stdin]   (Volter sign-in in the browser by default)
   identity link
   server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN]

package/connector/index.mjs

@@ -25,8 +25,20 @@ function atomic(path, value) {
 }
 export class TeamsConnector {
   constructor({server,teamId,machineId,sourceId,credential,stateDir,core,hostKeyId=null,effectExecutor=null,clock={nowMs:()=>Date.now()},fetch:fetchImpl=globalThis.fetch}){Object.assign(this,{server:serverOrigin(server),teamId,machineId,sourceId,credential,stateDir,core,hostKeyId,effectExecutor,clock,fetch:fetchImpl});mkdirSync(stateDir,{recursive:true,mode:0o700});chmodSync(stateDir,0o700);this.statePath=join(stateDir,'connector.json');this.state=existsSync(this.statePath)?JSON.parse(readFileSync(this.statePath,'utf8')):{version:1,sequence:0,origins:{},outbox:[]};this.state.effects??={};this.state.incarnation_id=`inc_${randomBytes(16).toString('hex')}`;this.abort=new AbortController();this.work=Promise.resolve();this.nativeEffects=new NativeEffects(this);this.effects=new EffectConsumer(this,effectExecutor?{prepare:async effect=>({execute:()=>effectExecutor(effect,{core:this.core,signal:this.abort.signal})})}:this.nativeEffects);this.save();}
-  save(){atomic(this.statePath,this.state);} async request(method,path,body){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);const response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:this.abort.signal});if(response.type==='opaqueredirect'||response.status>=300&&response.status<400)throw Object.assign(new Error('cross-origin redirects are refused'),{code:'invalid_request',status:400});const value=await response.json();if(!response.ok)throw Object.assign(new Error(value.error?.message??`HTTP ${response.status}`),value.error,{status:response.status});return value.data;}
-  async configuration(){const value=await this.request('GET',`/machines/${this.machineId}/configuration`);this.configurationValue=value;return value;}
+  save(){atomic(this.statePath,this.state);} async request(method,path,body){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);let response;for(let attempt=0;;attempt++){response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:this.abort.signal});
+    // A rate limit is waited out (the server says how long; the same idempotency key makes the retry safe), so a
+    // large first sync slows down instead of failing its pass and restarting the connector.
+    if(response.status!==429||attempt>=5)break;// The server names the wait in error.details (wire.mjs validationFailure); a Retry-After header is the fallback.
+    const limited=await response.json().catch(()=>null),named=limited?.error?.details?.retry_after_seconds??limited?.error?.retry_after_seconds??response.headers?.get?.('retry-after'),asked=named==null||named===''?NaN:Number(named),seconds=Number.isFinite(asked)?Math.min(60,Math.max(0,asked)):1;
+    await new Promise((resolve,reject)=>{const stop=()=>{clearTimeout(timer);reject(this.abort.signal.reason);},timer=setTimeout(()=>{this.abort.signal.removeEventListener('abort',stop);resolve();},seconds*1000);this.abort.signal.addEventListener('abort',stop,{once:true});});}if(response.type==='opaqueredirect'||response.status>=300&&response.status<400)throw Object.assign(new Error('cross-origin redirects are refused'),{code:'invalid_request',status:400});const value=await response.json();if(!response.ok)throw Object.assign(new Error(value.error?.message??`HTTP ${response.status}`),value.error,{status:response.status});return value.data;}
+  async configuration(){const value=await this.request('GET',`/machines/${this.machineId}/configuration`);this.configurationValue=value;this.pruneStamps(value);return value;}
+  // A capture stamp belongs to one rule; once that rule is no longer active its stamps are dropped.
+  pruneStamps(configuration){
+    if(!Array.isArray(configuration?.rules))return;
+    const active=new Set(configuration.rules.filter(rule=>rule.state==='active').map(rule=>rule.id));let pruned=false;
+    for(const origin of Object.values(this.state.origins??{}))for(const ruleId of Object.keys(origin?.capture_stamps??{}))if(!active.has(ruleId)){delete origin.capture_stamps[ruleId];pruned=true;}
+    if(pruned)this.save();
+  }
   async start({bindings=()=>[],roots=()=>[]}={}) {
     await this.configuration();
     const heartbeat = async () => {
@@ -82,61 +94,123 @@ export class TeamsConnector {
     this.nativeEffects.beginDiscovery();
     const activeRules=new Map(configuration.rules.filter(item=>item.state==='active').map(rule=>[rule.id,rule]));
     for(const [key,follower] of this.followers){const rule=activeRules.get(follower.ruleId);if(!rule||rule.revision!==follower.ruleRevision){follower.controller.abort();this.followers.delete(key);}}
+    // A rule covers its root folder and every folder under it. Core discovery filters that subtree before it
+    // reads any session's tail, so a beat costs one bounded scan per root, not one over every session on the
+    // machine; rules over the same root and harnesses share the scan.
+    const discoveries=new Map();
     for(const rule of activeRules.values()){
       const root=roots.find(item=>item.id===rule.selector.root_id);
       if(!root)continue;
-      const descriptors=[];
-      let cursor;
-      do {
-        const page=await this.core.discover({workspace:root.path??root.workspace,harnesses:rule.selector.harnesses,homes:root.homes,limit:2048,...(cursor?{cursor}:{})});
-        descriptors.push(...(page.sessions??page.entries??[]));
-        cursor=page.next_cursor??page.nextCursor??null;
-      } while(cursor);
+      const workspace=root.path??root.workspace,subtree=!root.exact_only,discoveryKey=JSON.stringify([workspace,subtree,[...(rule.selector.harnesses??[])].sort(),root.homes??null]);
+      if(!discoveries.has(discoveryKey))discoveries.set(discoveryKey,(async()=>{
+        const descriptors=[];
+        let cursor;
+        do {
+          // A broad root enrolled before rules covered subfolders keeps its exact-folder discovery.
+          const page=await this.core.discover({workspace,...(subtree?{workspace_subtree:true}:{}),harnesses:rule.selector.harnesses,homes:root.homes,limit:2048,...(cursor?{cursor}:{})});
+          descriptors.push(...(page.sessions??page.entries??[]));
+          cursor=page.next_cursor??page.nextCursor??null;
+        } while(cursor);
+        return descriptors;
+      })());
+      const descriptors=await discoveries.get(discoveryKey);
       for(const descriptor of descriptors){
         const locator=descriptor.locator,nativeSessionId=locator?.session_id,harness=locator?.harness;
         if(!locator||!nativeSessionId||!harness)continue;
-        const options={locator,descriptor,harness,nativeSessionId,ruleId:rule.id,ruleRevision:rule.revision,backfill:rule.backfill,rootPath:root.path??root.workspace};
-        await this.capture(options);
+        const options={locator,descriptor,harness,nativeSessionId,ruleId:rule.id,ruleRevision:rule.revision,backfill:rule.backfill,rootPath:workspace,configuration};
+        // A session whose native store has not changed since this rule last captured it is not reloaded.
+        // One session that cannot be captured (a transcript that rewrote its history needs an explicit resync)
+        // is recorded, logged and skipped; it must not stop every other session, or the connector itself, from
+        // syncing. An error of the connection itself (the outbox, authentication, the server, a stop) still ends
+        // the pass. The session keeps its native binding either way, so it can still be attached to.
+        let captured = true;
+        if (this.sessionChanged(options)) try { await this.capture(options); } catch (error) {
+          if (error.outbox || error.status === 401 || error.status === 403 || error.status >= 500 || this.abort.signal.aborted) throw error;
+          captured = false; this.lastError = error;
+          process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} not synced: ${error.message}\n`);
+        }
         try { await this.nativeEffects.discover(descriptor, rule.id); } catch (error) { this.lastError = error; }
+        if (!captured) continue;
         const key=`${rule.id}:${harness}:${nativeSessionId}`;
         if(this.followers.has(key)||typeof this.core.session(locator).follow!=='function')continue;
         const controller=new AbortController(),stop=()=>controller.abort(this.abort.signal.reason);this.abort.signal.addEventListener('abort',stop,{once:true});
-        const task=(async()=>{for await(const _event of this.core.session(locator).follow({signal:controller.signal})){if(controller.signal.aborted)break;await this.capture(options);}})().catch(error=>{if(!controller.signal.aborted)this.lastError=error;}).finally(()=>{this.abort.signal.removeEventListener('abort',stop);this.followers.delete(key);});
+        // A follow event may land between beats, after the rule changed: it reads the configuration afresh.
+        const followed={...options,configuration:null,stamp:undefined};
+        const task=(async()=>{for await(const _event of this.core.session(locator).follow({signal:controller.signal})){if(controller.signal.aborted)break;await this.capture(followed);}})().catch(error=>{if(!controller.signal.aborted)this.lastError=error;}).finally(()=>{this.abort.signal.removeEventListener('abort',stop);this.followers.delete(key);});
         this.followers.set(key,{ruleId:rule.id,ruleRevision:rule.revision,controller,task});
       }
     }
     this.nativeEffects.endDiscovery();
   }
+  // What a session's native store looked like when discovery listed it: its file's size and modification
+  // time (read before any load, so a write after it reads as a change), those of the file's SQLite write-ahead
+  // log, and the descriptor's updated_at_ms and message_count. A SQLite store (Hermes state.db, OpenCode,
+  // Goose) is shared by many sessions, and a live one appends to `<path>-wal` until a checkpoint while the
+  // database file, and a Hermes session's updated_at_ms (its start until it ends), stay put; its message count
+  // still moves. Null when nothing is known; such a session is reloaded every beat.
+  sessionStamp({locator,descriptor}){
+    const stat=path=>{try{const value=statSync(path);return `${value.size}:${value.mtimeMs}`;}catch{return null;}};
+    const path=typeof locator?.storage?.path==='string'?locator.storage.path:null;
+    const file=path?stat(path):null,wal=path?stat(`${path}-wal`):null;
+    const updated=Number.isSafeInteger(descriptor?.updated_at_ms)?descriptor.updated_at_ms:null;
+    const count=Number.isSafeInteger(descriptor?.message_count)?descriptor.message_count:null;
+    return file===null&&updated===null&&count===null?null:JSON.stringify([file,wal,updated,count]);
+  }
+  sessionChanged(options){
+    const stamp=this.sessionStamp(options);options.stamp=stamp;
+    if(stamp===null||this.state.outbox.length)return true;
+    const rule=options.configuration?.rules?.find(item=>item.id===options.ruleId&&item.revision===options.ruleRevision&&item.state==='active');if(!rule)return true;
+    const configured=rule.backfill??options.backfill??'all',mode=typeof configured==='string'?configured:configured.mode;
+    const seen=this.state.origins[`${options.harness}:${options.nativeSessionId}`]?.capture_stamps?.[options.ruleId];
+    return !(seen&&seen.stamp===stamp&&seen.rule_revision===options.ruleRevision&&seen.backfill_mode===mode);
+  }
+  recordStamp(key,ruleId,ruleRevision,backfillMode,stamp){
+    const origin=this.state.origins[key];
+    if(origin&&ruleId&&stamp)origin.capture_stamps={...origin.capture_stamps,[ruleId]:{stamp,rule_revision:ruleRevision,backfill_mode:backfillMode}};
+    this.save();
+  }
   capture(options) {
     const work=this.work.then(()=>this.captureSerial(options));
     this.work=work.catch(()=>{});
     return work;
   }
-  async captureSerial({locator,descriptor=null,harness,nativeSessionId,visibility='restricted',ruleId=null,ruleRevision=null,coverage={completeness:'complete',reasons:[],missing:[]},backfill='all',rootPath=null}) {
+  async captureSerial({locator,descriptor=null,harness,nativeSessionId,visibility='restricted',ruleId=null,ruleRevision=null,coverage={completeness:'complete',reasons:[],missing:[]},backfill='all',rootPath=null,configuration=null,stamp}) {
     if(this.state.outbox.length)await this.flushSerial();
-    const configuration=await this.configuration(),rule=configuration.rules.find(item=>item.id===ruleId&&item.revision===ruleRevision&&item.state==='active');if(!rule)throw Object.assign(new Error('sync rule is absent, inactive, or stale'),{code:'forbidden'});visibility=rule.visibility;
+    // Discovery hands each session the configuration its beat fetched; a follow event fetches its own.
+    if(stamp===undefined)stamp=this.sessionStamp({locator,descriptor});
+    if(!configuration)configuration=await this.configuration();const rule=configuration.rules.find(item=>item.id===ruleId&&item.revision===ruleRevision&&item.state==='active');if(!rule)throw Object.assign(new Error('sync rule is absent, inactive, or stale'),{code:'forbidden'});visibility=rule.visibility;
     const artifactSource=locator?.storage?.kind==='file'&&existsSync(locator.storage.path)?realpathSync(locator.storage.path):null;
     const artifactBefore=artifactSource?statSync(artifactSource):null;
     const loaded=await this.core.session(locator).load(),configuredBackfill=rule.backfill??backfill??'all',backfillPolicy=typeof configuredBackfill==='string'?{mode:configuredBackfill,since:null}:configuredBackfill;
     const key=`${harness}:${nativeSessionId}`,previous=this.state.origins[key]??null;
     let messages=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});
-    if(previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&hash(canonicalJson(message.value))===previous.observed_digests?.[index]))return null;
-    let effectivePrevious=previous;
-    if(!previous&&backfillPolicy.mode==='none'){this.state.origins[key]={generation:1,sequence:0,digest:null,baseline:messages.map(x=>x.native_key),baseline_digests:messages.map(x=>hash(canonicalJson(x.value))),observed_keys:messages.map(x=>x.native_key),observed_digests:messages.map(x=>hash(canonicalJson(x.value))),last_rule_revision:ruleRevision,backfill_mode:backfillPolicy.mode};this.save();return null;}
+    if(previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&hash(canonicalJson(message.value))===previous.observed_digests?.[index])){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
+    let effectivePrevious=previous;const clearBaseline=backfillPolicy.mode==='all';
+    if(!previous&&backfillPolicy.mode==='none'){this.state.origins[key]={generation:1,sequence:0,digest:null,baseline:messages.map(x=>x.native_key),baseline_digests:messages.map(x=>hash(canonicalJson(x.value))),observed_keys:messages.map(x=>x.native_key),observed_digests:messages.map(x=>hash(canonicalJson(x.value))),last_rule_revision:ruleRevision,backfill_mode:backfillPolicy.mode};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
     if(!previous&&backfillPolicy.mode==='since'){
       if(!Number.isSafeInteger(backfillPolicy.since))throw Object.assign(new Error('since backfill requires an integer timestamp'),{code:'invalid_request'});
       const excluded=messages.filter(message=>message.recorded_at==null||message.recorded_at<backfillPolicy.since);
       effectivePrevious={generation:1,sequence:0,digest:null,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>hash(canonicalJson(message.value)))};
       this.state.origins[key]=effectivePrevious;
     }
-    if(previous?.observed_keys?.every(x=>/^\d+$/.test(x))){
-      const prefix=messages.slice(0,previous.observed_keys.length);
-      const rewritten=prefix.length!==previous.observed_keys.length||prefix.some((message,index)=>message.native_key!==previous.observed_keys[index]||hash(canonicalJson(message.value))!==previous.observed_digests?.[index]);
-      if(rewritten)throw Object.assign(new Error('index-key source rewrote its baseline; explicit backfill is required'),{code:'resync_required'});
+    // A source keyed by position (a Claude Code transcript is) can change a message it already reported: the core
+    // reports a tool call still running as an interrupted placeholder, and the result replaces it at the same
+    // position; a compaction or a parser change rewrites more. Every capture is a whole snapshot (the server keeps
+    // only the latest capture's messages as the session's history), so a rewrite of what was published is simply
+    // republished by the next capture. Only the unpublished baseline of a `none` or `since` rule is a problem:
+    // positions no longer identify the history the rule kept back. A `since` rule derives it again from the
+    // timestamps; a `none` rule cannot tell old history from new, so that session waits for an explicit
+    // `supercode teams sync resume RULE --backfill all` (or a since window), which republishes it whole.
+    if(!clearBaseline&&effectivePrevious?.baseline?.length&&effectivePrevious.baseline.every(x=>/^\d+$/.test(x))){
+      const baselineMoved=effectivePrevious.baseline.some((native_key,index)=>messages[index]?.native_key!==native_key||hash(canonicalJson(messages[index].value))!==effectivePrevious.baseline_digests?.[index]);
+      if(baselineMoved&&backfillPolicy.mode==='since'&&Number.isSafeInteger(backfillPolicy.since)){
+        const excluded=messages.filter(message=>message.recorded_at==null||message.recorded_at<backfillPolicy.since);
+        effectivePrevious={...effectivePrevious,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>hash(canonicalJson(message.value)))};
+        this.state.origins[key]={...this.state.origins[key],baseline:effectivePrevious.baseline,baseline_digests:effectivePrevious.baseline_digests};
+      }else if(baselineMoved)throw Object.assign(new Error(`the history kept back when rule ${ruleId} started was rewritten; run \`supercode teams sync resume ${ruleId} --backfill all\` (or a since window) to republish this session`),{code:'resync_required'});
     }
-    const clearBaseline=backfillPolicy.mode==='all';
     if(effectivePrevious?.baseline&&!clearBaseline)messages=messages.filter(x=>!effectivePrevious.baseline.includes(x.native_key));
-    if(!messages.length)return null;
+    if(!messages.length){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
     const captureId=`cap_${randomBytes(16).toString('hex')}`,generation=effectivePrevious?.generation??1,sequence=(effectivePrevious?.sequence??0)+1;
     const begin={native_session_id:nativeSessionId,harness,generation,sequence,capture_id:captureId,previous_digest:effectivePrevious?.digest??null,visibility,rule_id:ruleId,rule_revision:ruleRevision};
     const parts=[];for(let index=0;index<messages.length;index+=500)parts.push({capture_id:captureId,index:parts.length,messages:messages.slice(index,index+500)});
@@ -162,13 +236,27 @@ export class TeamsConnector {
     }
     const recordedTimes=messages.map(message=>message.recorded_at).filter(Number.isSafeInteger),commit={capture_id:captureId,parts:parts.length,digest:'',title:descriptor?.title??null,repository:null,reported_user:null,recorded_activity_at:recordedTimes.length?Math.max(...recordedTimes):null,parent_native_id:descriptor?.parent_session_id??null,coverage:effectivePrevious?.baseline&&!clearBaseline?{...coverage,completeness:'partial',reasons:[...new Set([...coverage.reasons,'prefix_not_captured'])]}:coverage,artifacts:artifacts.map(item=>item.manifest),...(nativeBundle?{native_bundle:nativeBundle}:{})};
     const digestCommit={...commit};delete digestCommit.digest;commit.digest=hash(canonicalJson({begin,parts,commit:digestCommit}));
-    this.state.outbox.push({begin,parts,commit,artifacts,clearBaseline,backfillMode:backfillPolicy.mode,observed:{keys:(loaded.messages??loaded.turns??[]).map((entry,index)=>entry.id??entry.native_key??String(index)),digests:(loaded.messages??loaded.turns??[]).map(entry=>hash(canonicalJson(entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key))))))}});this.save();return this.flushSerial();
+    this.state.outbox.push({begin,parts,commit,artifacts,clearBaseline,backfillMode:backfillPolicy.mode,stamp,observed:{keys:(loaded.messages??loaded.turns??[]).map((entry,index)=>entry.id??entry.native_key??String(index)),digests:(loaded.messages??loaded.turns??[]).map(entry=>hash(canonicalJson(entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key))))))}});this.save();return this.flushSerial();
   }
   flush() {
     const work=this.work.then(()=>this.flushSerial());
     this.work=work.catch(()=>{});
     return work;
   }
-  async flushSerial(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);let receipt;if(begun.state==='committed')receipt=begun.receipt;else{for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);for(const artifact of item.artifacts??[])for(const chunk of artifact.chunks)await this.request('PUT',`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`,chunk);receipt=await this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;}this.state.origins[key]=next;this.state.outbox.shift();this.save();latest=receipt;}return latest;}
+  // Every outbox error is the connection's, not one session's: a capture's own catch passes it on (syncConfiguredSessions).
+  async flushSerial(){try{return await this.flushOutbox();}catch(error){throw Object.assign(error,{outbox:true});}}
+  async sendCapture(item){const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);if(begun.state==='committed')return begun.receipt;for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);for(const artifact of item.artifacts??[])for(const chunk of artifact.chunks)await this.request('PUT',`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`,chunk);return this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);}
+  // True when the server refused a queued capture because its sync rule was removed, paused or revised since it
+  // was queued: the capture can never be accepted, so it must not hold every later capture behind it. The
+  // refusal is confirmed against a fresh configuration; any other refusal (a revoked credential, a paused
+  // source) or a network or server error keeps the capture queued for the next flush.
+  async ruleRejected(item,error){
+    if(!item.begin.rule_id||!(error.status===403||error.status===404||error.code==='source_paused'))return false;
+    let configuration;try{configuration=await this.configuration();}catch{return false;}
+    // A configuration without a rule list says nothing about the rule, so the capture stays queued.
+    if(!Array.isArray(configuration?.rules))return false;
+    return !configuration.rules.some(rule=>rule.id===item.begin.rule_id&&rule.revision===item.begin.rule_revision&&rule.state==='active');
+  }
+  async flushOutbox(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];let receipt;try{receipt=await this.sendCapture(item);}catch(error){if(!await this.ruleRejected(item,error))throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.state.outbox.shift();this.save();continue;}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;}if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.state.origins[key]=next;this.state.outbox.shift();this.save();latest=receipt;}return latest;}
   stop(){if(this.timer)clearInterval(this.timer);this.abort.abort();for(const follower of this.followers?.values()??[])follower.controller.abort();return this.nativeEffects.close();}
 }

package/machine.mjs

@@ -33,6 +33,9 @@ import { hostname } from 'node:os';
 import { randomBytes, createHash } from 'node:crypto';
 import { WebSocket } from 'ws';
 import { TmuxTerminalHost, classifyAttentionSignal, composerHoldsDraft, composerReadyForInput } from '@volter/supercode-terminal';
+// The ConPTY host is read from the namespace, where a terminal package too old to have it gives undefined rather
+// than failing the load: a POSIX daemon never needs it. Windows needs a supercode-terminal with PtyTerminalHost.
+import * as terminal from '@volter/supercode-terminal';
 import { findLiveReceipt, mintFrontendCredential } from '@volter/supercode-harness-sdk/live-runtime';
 import { NODE_PROTOCOL } from '@volter/teams/channel';
 import { holds, observesPanes } from '@volter/teams/admission';
@@ -75,7 +78,9 @@ export class TeamsMachine extends MachineCore {
     this.supercodeBin = supercode;
     this.tmuxSocket = tmuxSocket ?? null;
     this.launches = new Launches(this.p.launches);
-    this.host = new TmuxTerminalHost({
+    // Windows has no tmux: its panes are ConPTY children of this daemon, and end with it.
+    if (process.platform === 'win32' && !terminal.PtyTerminalHost) throw new Error('panes on Windows need a newer @volter/supercode-terminal (one with PtyTerminalHost)');
+    this.host = process.platform === 'win32' ? new terminal.PtyTerminalHost() : new TmuxTerminalHost({
       // Stable owner id so panes this daemon launched stay "owned" across restarts.
       ownerId: `supercode-teams-${fingerprint(this.identity.publicKeyPem)}`,
       ...(tmuxSocket ? { socket: tmuxSocket } : {}),
@@ -376,7 +381,8 @@ export class TeamsMachine extends MachineCore {
   #paneEnv(contextKey, requested) {
     const env = { ...(requested ?? {}) };
     const inherited = env.NODE_OPTIONS ?? this.env.NODE_OPTIONS ?? '';
-    env.NODE_OPTIONS = `${inherited} --require ${PORTHOLE_HOOK}`.trim();
+    // Quoted: NODE_OPTIONS splits on spaces, and a home path may hold one (Windows user folders often do).
+    env.NODE_OPTIONS = `${inherited} --require ${JSON.stringify(PORTHOLE_HOOK)}`.trim();
     env.SUPERCODE_TEAMS_PORTS_DIR = this.portsDir;
     env.SUPERCODE_TEAMS_PANE = contextKey;
     return env;
@@ -630,6 +636,8 @@ export class TeamsMachine extends MachineCore {
   async #renameWindow(contextKey, title) {
     const session = await this.#paneByContext(contextKey);
     if (!session || !session.owned) return null;
+    // A host with windows of its own renames them itself (a ConPTY pane has none).
+    if (typeof this.host.renameWindow === 'function') return this.host.renameWindow(session.id, title);
     const socketArgs = this.tmuxSocket ? ['-L', this.tmuxSocket] : [];
     const target = `${session.label}:0`;
     const run = (args) => spawnSync('tmux', [...socketArgs, ...args], { timeout: 5_000, encoding: 'utf8' });
@@ -1149,7 +1157,7 @@ export class TeamsMachine extends MachineCore {
  *  pane's tty. When that is the pane's own shell, no command is running and the
  *  shell is at its prompt; when it is anything else, that thing is the work. The
  *  list is names, not paths, because that is the form tmux reports. */
-const PANE_SHELLS = new Set(['ash', 'bash', 'csh', 'dash', 'fish', 'ksh', 'ksh93', 'nu', 'pwsh', 'sh', 'tcsh', 'xonsh', 'zsh']);
+const PANE_SHELLS = new Set(['ash', 'bash', 'cmd', 'cmd.exe', 'csh', 'dash', 'fish', 'ksh', 'ksh93', 'nu', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe', 'sh', 'tcsh', 'xonsh', 'zsh']);
 
 /** Liveness of a live pane from its foreground command (attention.mjs LIVENESS).
  *  A missing or empty value is `unknown`, the honest floor: tmux named nothing,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -62,7 +62,9 @@
     "@volter/supercode-harness-sdk": "^0.3.43",
     "@volter/supercode-terminal": "^0.2.30",
     "@volter/identity": "^0.4.0",
-    "@volter/teams": "^0.1.6",
+    "@volter/teams": "^0.1.8",
+    "@xterm/addon-serialize": "^0.14.0",
+    "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",
     "ws": "^8.21.0"
   },