@volter/supercode-teams 0.2.20

package/README.md

@@ -0,0 +1,119 @@
+# `@volter/supercode-teams`
+
+Harness Teams, the harness's part of Volter Teams, has a server and machines. A **machine daemon**, one per OS user, serves this machine's
+doors: panes, launch, files, ports, attention, titles, a signed `describe`, and `harness.v1`.
+A **Teams server** retains a shared session catalog, membership and access rules, and routes
+callers to enrolled machines. It runs as a Node process (`server/index.mjs`) or as a Cloudflare
+Worker with one Durable Object (`worker/`); both host the same `server/core.mjs`. Existing OpenTelemetry pipelines can publish
+evidence without installing Volter Harness on each developer's machine. Start with the
+[Teams guide](../../docs/guides/teams.md); the design is
+[Teams server, CLI and API](../../docs/plans/teams-server.md).
+
+The server uses SQLite and requires Node 22.13 or newer. Package exports: `.` (the daemon,
+channel and client), `/machine`, `/client`, `/admission`, `/fleet`, `/server`,
+`/workspace-client`, `/connector`, `/connector/native-continuation` and `/contracts`. The
+workspace client is browser-safe and takes explicit credentials. Native capture and execution use
+the matching harness SDK and native core; source capabilities and fidelity remain explicit.
+Fresh-session materialization supports Claude Code and Codex with requested `value_lossless`;
+telemetry alone does not establish resumable native history.
+
+See the [public client declarations](workspace-client.d.ts), [contracts](contracts/index.d.ts),
+and [implementation specification](../../docs/plans/teams-server-build/README.md).
+
+## The machine daemon
+
+`supercode teams machine start` runs it with its local door only; `supercode teams connect` runs
+the same daemon enrolled to the selected Teams context, adding catalog sync and the server link.
+The daemon owns one `supercode harness serve` and the tmux terminal host.
+
+Two doors reach it:
+
+- **Local**: an owner-only Unix socket, `$SUPERCODE_HOME/teams/machine.sock` (or, when that path
+  is too long for a socket address, a per-user 0700 directory under `/tmp`). Whoever can open it
+  is this OS user, an operator. The local CLI, the agent inside the machine and a service on the
+  same box (RH2's connector) use it.
+- **Remote**: the Teams server. The daemon holds one outbound WebSocket link; the server forwards
+  a caller's channel over it after checking the caller's machine grants, and the daemon
+  re-derives that admission from its own synced copy of the grants before every door.
+
+The machine's custodian holds it as operator. Anyone else holds a **machine grant**:
+`operate` (the whole machine: `harness.v1` and `launch`), or `view`, `observe`, `interact`,
+`control`, `files`, `ports` on named targets (`pane:<key>`, `runtime:<id>`, `root:/path`,
+`port:<pane>/<n>`), or on every target of one kind (`pane:*`, `port:*`). `*` carries only
+`operate` and `view`: a grant that reaches more names the kind it reaches, so it never covers
+a kind another product serves on the same machine. `title.set` needs `control` on its target.
+`observe` on a `root:/path` reads it (stat, list, read, search); `files` also changes it.
+
+A workplace can open one pane or one folder for someone who is not a member of the team. A
+server started with `--delegated-issuer ORIGIN` (the Worker's `DELEGATED_ISSUER`) trusts short-lived
+tokens that issuer signs (Ed25519, keys at `ORIGIN/.well-known/jwks.json`, audience this server's
+public origin), each naming a pane (`pane:<key>`) or a folder (`root:/path`) on one machine of one
+team, and `view` or `control`. The hosted viewer at `/view#token=…` opens it; the server turns the
+token into a machine grant on exactly that target (a pane: `observe`, and `control` to type; a
+folder: `observe` to read, `files` to change) that expires with the token, and closes the channel
+then. A page embedding the viewer sends it a fresh token by `postMessage({ type: 'delegated-token',
+token })`, which the viewer asks for with `delegated-token-needed`.
+
+`teams publish` puts a pane or a folder of the connected machine (or `--machine NAME`) into a
+workplace Room as a Surface, through the workplace's own door with a session token of yours;
+`teams unpublish SURFACE` retires it:
+
+```sh
+supercode teams publish pane <ctx> --room room_… --workplace https://pilot.runhuman.com --organization acme --token-stdin
+supercode teams publish root ./reports --room room_… --workplace https://pilot.runhuman.com --organization acme --token-stdin
+```
+
+```sh
+supercode teams machine start                        # local door only
+supercode open --new bash --detach                   # a pane; prints its contextKey
+supercode open <ctx>                                 # attach; ctrl-] detaches
+supercode teams input <ctx> "make test"
+supercode teams title set <ctx> "rate-limit rescue"  # also names the owned tmux window
+supercode teams suspend <ctx>                        # remote input refused; observe keeps streaming
+supercode teams resume <ctx> --input "carry on"      # the input that hands the pane back
+supercode teams log verify                           # the hash chain across every rotation
+
+supercode teams machines access grant laptop --to user:usr_… --caps observe,control --on pane:<ctx> --ttl 1h
+supercode open <ctx> --on laptop                     # through the selected context's server
+supercode discover --fleet                           # every reachable machine of the context
+supercode open --new claude --on laptop              # a pane on an enrolled machine
+```
+
+### Products served behind the daemon
+
+Another product serves its own kind of target on the machine (Volter Browsers:
+`browser-profile:<name>`) through the daemon's `product` stream, opened with
+`{ target: '<kind>:<name>', ...params }`. The product calls `serveProduct` from `products.mjs`,
+which listens on loopback and writes a receipt, `products/<name>.json`, naming the kinds it
+serves, its endpoint and a token. The daemon admits the caller first. Then it dials the newest
+live receipt's endpoint and tells the product the principal, the capabilities held on that
+target and the caller's params. Each side first proves it holds the receipt's token, the
+product before it hears anything, and the token never crosses the wire. The daemon then
+relays text messages both ways, each under the channel's frame limit. The product enforces what each
+capability admits on its kind. A grant on `*` reaches a product's target only for `view`.
+
+A remote caller is re-admitted every 15 s and when a grant it holds expires. The daemon decides
+from the grants it holds, then refreshes them from the server, at most once per interval.
+Wider capabilities are passed on; narrower ones close the stream. The server closes a
+member's channels when their membership is deactivated, or when a group they reached a machine
+through loses them or is deleted.
+
+`supercode teams browser <profile> --machine <name>` serves a machine's browser profile as a
+local CDP endpoint: `chromium.connectOverCDP('<printed address>')` drives it, each connection
+riding its own `product` stream. The machine's own CDP address and Volter Browsers' publication token
+never leave it. The endpoint answers any local process that reaches it, like a browser's own
+debugging port.
+
+A target whose kind has no live receipt is refused as not served on this machine. The
+harness's own kinds (`pane`, `runtime`, `root`, `port`) are never served by a product.
+
+## Files (under `$SUPERCODE_HOME/teams`)
+
+`machine.key|pub` (the host key; it signs `describe` and nothing else) · `machine.sock` ·
+`machine.json` · `launches.jsonl` · `log.jsonl` (hash-chained, rotating to `log.<ts>.jsonl`) ·
+`attention.json` · `titles.json` · `suspended.json` · `limits.json` · `products/` (receipts of
+products served behind the daemon) · `workspaces/` (Teams contexts, credentials and connector
+enrollments).
+
+`limits.json` is read when the daemon starts: `maxAttachmentsPerPrincipal` (16),
+`protocolFloor` (2), `logRotateBytes` (16 MiB), `logKeep` (8).

package/attention.mjs

@@ -0,0 +1,191 @@
+// Attention. The split this file exists to hold:
+//
+//   the terminal snapshot carries the EVIDENCE — what the Machine can see about
+//   a pane: is it live, is a foreground command running, does the screen show a
+//   crash or a choice, how long since the screen last moved, and whether anyone
+//   declared that this pane needs a human;
+//
+//   the node owns `attention.request|clear` and a RANK TABLE as configuration;
+//
+//   the label is a PURE FUNCTION of the two, computed on the Machine.
+//
+// Nothing here routes, acks, silences or notifies: `computeLabel`
+// says what the evidence means and `notifies` says whether the label is the kind
+// that warrants interrupting a human. WHO gets paged, and whether they already
+// acknowledged it, is the consumer's — this module has no idea a human exists.
+
+/** Normalized liveness of a pane: what the Machine could prove about whether
+ *  anything is running in it.
+ *    ended    — no live pane with that context key
+ *    running  — a foreground command other than the pane's own shell
+ *    waiting  — the pane's shell is the foreground process: a prompt, turn over
+ *    unknown  — the pane exists but named no foreground command (the honest
+ *               floor: absence of evidence, never silently reported as running)
+ */
+export const LIVENESS = Object.freeze(['ended', 'running', 'unknown', 'waiting']);
+
+/** Every label the vocabulary has, in the default precedence — the order
+ *  `computeLabel` walks, first guard to match wins. The precedence is data,
+ *  not control flow, and reads as one line:
+ *
+ *    requested > ended > errored > asking > awaiting_me > stuck > unknown > working
+ *
+ *  requested   — someone (usually the agent in the pane) DECLARED it needs a
+ *                human. Outranks even errored/asking: a declaration is stronger
+ *                evidence than a screen read, and may be raised for a reason no
+ *                screen heuristic could ever detect ("I finished, review my PR").
+ *                It outranks `ended` too, so a request survives its pane.
+ *  ended       — the pane is gone. Checked before the screen rungs because there
+ *                is no screen left to read; whatever the last capture said, it is
+ *                not evidence about a pane that no longer exists.
+ *  errored     — the screen shows the agent's own call failing.
+ *  asking      — the screen shows a choice/permission prompt: blocked on an answer.
+ *  awaiting_me — the shell is at its prompt: the turn ended, it waits on input.
+ *  stuck       — running, but the screen has not moved in `stuckIdleSeconds`.
+ *                Looks busy, likely wedged. A heuristic, and labelled as one.
+ *  unknown     — live, but no rung said anything. A real look is warranted; it
+ *                never outranks a state we affirmatively detected.
+ *  working     — live and running. The floor: always true, so the walk terminates.
+ */
+export const LABELS = Object.freeze(['requested', 'ended', 'errored', 'asking', 'awaiting_me', 'stuck', 'unknown', 'working']);
+
+/** The labels that warrant interrupting a human.
+ *
+ *  `unknown` is deliberately NOT here: it is an UNPROVEN read — no rung
+ *  matched this tick — not an affirmative signal. A pane's first capture is
+ *  often empty, so notifying on `unknown` would page a human every time a pane
+ *  is born and every time a capture is momentarily unreadable. It still sorts
+ *  ahead of `working` in the order above, so it is visible to anyone already
+ *  looking at the list, without paging anyone on a transient miss.
+ *
+ *  `ended` and `working` are absent for the opposite reason: they are proven,
+ *  and proven-to-be-fine needs nobody.
+ *
+ *  `requested` is absent too, and that one is a deliberate default rather than
+ *  a reasoned exclusion. It reads oddly — a label whose entire content is "a
+ *  human is needed here" reports `notify: false` — and an org that wants
+ *  declarations to page adds one word to its own `notify` list. Written down
+ *  here so the next reader finds the question already asked.
+ */
+export const DEFAULT_NOTIFY = Object.freeze(['errored', 'asking', 'awaiting_me', 'stuck']);
+
+/** A foreground-running pane whose screen has not moved in this long looks busy
+ *  but is likely wedged (a hung tool call, a crash without an exit). Heuristic,
+ *  which is why it is configuration: 5 minutes suits an agent mid-turn and is
+ *  far too long for a fleet of one-second jobs. */
+export const DEFAULT_STUCK_IDLE_SECONDS = 300;
+
+/** The rank table as it ships. It lives in `<home>/attention.json` under `rank`,
+ *  beside the `requests` map, and the ORG EDITS THE FILE — the node re-reads it
+ *  on every call, so a precedence change takes effect on the next `attention ls`
+ *  with nothing restarted. Three knobs, and no more:
+ *
+ *    order              the precedence walk. Reorder it to change which evidence
+ *                       wins an argument; you cannot invent a label, because a
+ *                       label without a guard below is a label nothing can prove.
+ *    stuckIdleSeconds   how long a silent screen stays `working` before `stuck`.
+ *    notify             which labels warrant interrupting a human.
+ */
+export const DEFAULT_RANK = Object.freeze({
+  order: LABELS,
+  stuckIdleSeconds: DEFAULT_STUCK_IDLE_SECONDS,
+  notify: DEFAULT_NOTIFY,
+});
+
+/** What it takes to prove each label, given the evidence tuple. One guard per
+ *  label; the table above only decides the ORDER they are asked in. Guards are
+ *  not configuration: a guard is the meaning of the word, and an org that could
+ *  edit them would be renaming `errored` rather than re-ranking it. */
+const GUARDS = Object.freeze({
+  requested: (e) => Boolean(e.requested),
+  ended: (e) => e.liveness === 'ended',
+  errored: (e) => e.signal === 'errored',
+  asking: (e) => e.signal === 'asking',
+  awaiting_me: (e) => e.liveness === 'waiting',
+  stuck: (e, table) => e.liveness === 'running' && (e.idleSeconds ?? 0) >= table.stuckIdleSeconds,
+  unknown: (e) => e.liveness === 'unknown',
+  working: () => true,
+});
+
+/** The rung each label's verdict actually came from, in the substrate's own
+ *  `DerivationSource` vocabulary (sdk/terminal/substrate/session-lifecycle.d.ts)
+ *  so the node speaks one evidence grammar rather than a second private one:
+ *    agent-declared    somebody told the node directly (`attention request`)
+ *    process-tree      tmux session enumeration and its foreground command
+ *    screen-heuristic  `classifyAttentionSignal` over the pane's capture
+ *    transcript        the capture-hash plateau that produces `stuck`
+ */
+const SOURCES = Object.freeze({
+  requested: 'agent-declared',
+  ended: 'process-tree',
+  errored: 'screen-heuristic',
+  asking: 'screen-heuristic',
+  awaiting_me: 'process-tree',
+  stuck: 'transcript',
+  unknown: 'process-tree',
+  working: 'process-tree',
+});
+
+/** Merge an org's `rank` into the defaults so the walk is always total: unknown
+ *  names are dropped (a label nothing can prove would silently swallow the rest
+ *  of the order), and any label the org left out is appended in default order
+ *  rather than made unreachable — omitting `ended` must not mean a dead pane has
+ *  no label. */
+export function normalizeRank(raw) {
+  const table = raw && typeof raw === 'object' ? raw : {};
+  const wanted = Array.isArray(table.order) ? table.order.filter((label) => LABELS.includes(label)) : [];
+  const order = [...new Set([...wanted, ...LABELS])];
+  const notify = Array.isArray(table.notify) ? table.notify.filter((label) => LABELS.includes(label)) : DEFAULT_NOTIFY;
+  const stuck = Number(table.stuckIdleSeconds);
+  return {
+    order,
+    stuckIdleSeconds: Number.isFinite(stuck) && stuck >= 0 ? stuck : DEFAULT_STUCK_IDLE_SECONDS,
+    notify: [...notify],
+  };
+}
+
+/**
+ * The label, from the four inputs and the table. Pure: same tuple, same table,
+ * same answer, on any Machine, with no clock and no I/O of its own.
+ *
+ * @param {{requested?: unknown, signal?: 'asking'|'errored'|null, liveness: 'ended'|'running'|'unknown'|'waiting', idleSeconds?: number|null}} evidence
+ * @param {{order: string[], stuckIdleSeconds: number, notify: string[]}} [rankTable]
+ * @returns {string} one of LABELS
+ */
+export function computeLabel(evidence, rankTable = DEFAULT_RANK) {
+  const table = normalizeRank(rankTable);
+  for (const label of table.order) {
+    if (GUARDS[label](evidence, table)) return label;
+  }
+  return 'working';
+}
+
+/** Where in the precedence a label sits — the index the caller sorts by, so a
+ *  list ordered urgent-first never needs its own copy of the order. */
+export function rankOf(label, rankTable = DEFAULT_RANK) {
+  return normalizeRank(rankTable).order.indexOf(label);
+}
+
+/** Whether this label is the kind that warrants interrupting a human. The node
+ *  reports the flag; who is interrupted, and whether they already said "I know",
+ *  belongs to whoever is reading. */
+export function notifies(label, rankTable = DEFAULT_RANK) {
+  return normalizeRank(rankTable).notify.includes(label);
+}
+
+/** The rung that decided this label, for the `source` the evidence carries. */
+export function sourceOf(label) {
+  return SOURCES[label] ?? 'process-tree';
+}
+
+/** Labels decided by liveness alone: when the harness reported that liveness
+ *  itself, the verdict came from its own lifecycle, not the process tree. */
+const LIVENESS_LABELS = new Set(['awaiting_me', 'working', 'unknown', 'ended']);
+
+/** Label + rank + notify in one call, for the node's row builder. */
+export function judge(evidence, rankTable = DEFAULT_RANK) {
+  const table = normalizeRank(rankTable);
+  const attention = computeLabel(evidence, table);
+  const source = evidence.livenessSource && LIVENESS_LABELS.has(attention) ? evidence.livenessSource : sourceOf(attention);
+  return { attention, rank: table.order.indexOf(attention), notify: table.notify.includes(attention), source };
+}

package/bin/fleet.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+// The fleet CLI. `supercode discover --fleet`, `supercode discover --on M`,
+// `supercode open [--new] [--on M]` and `supercode harness drive --on M` spawn this; it is also
+// runnable directly as `supercode-teams-fleet …`. It mints no verb of its own:
+// every verb here is the remote arm of a verb supercode already has.
+//
+//   discover [--query q] [--limit n] [--machines a,b] [--context c]
+//       harness.v1.sessions.discover on every machine of the selected Teams
+//       context the caller can reach (or the named subset), merged into one
+//       page; each unreachable machine is a row of its own. Nothing is stored.
+//   rpc --on <machine> <harness.v1 method> [json]     one operator request, one machine
+//   launch [--on <machine>] <program> [--cwd d] [--launch-key k] [--kind k] [--input text] -- args
+//       (`open --new`)
+//   attach [--on <machine>] <pane> [--mode observe|control]    ctrl-] detaches (`open --on`)
+//
+// `--on` names an enrolled machine of the selected context, reached through
+// its Teams server. Omitted, every verb acts on this OS user's own daemon, so
+// the remote arm and the local arm are one code path.
+import { attachPane, attachRuntime } from '../client.mjs';
+import { openOn, harnessRequest, nodeRequest, fleetDiscover } from '../fleet.mjs';
+
+const argv = process.argv.slice(2);
+const flags = {};
+const positional = [];
+for (let i = 0; i < argv.length; i += 1) {
+  const a = argv[i];
+  if (a === '--') { positional.push(...argv.slice(i + 1)); break; }
+  if (a.startsWith('--')) {
+    const eq = a.indexOf('=');
+    if (eq > 0) { flags[a.slice(2, eq)] = a.slice(eq + 1); continue; } // --args=--norc
+    const key = a.slice(2);
+    const next = argv[i + 1];
+    if (next !== undefined && !next.startsWith('--')) { flags[key] = next; i += 1; } else flags[key] = true;
+  } else positional.push(a);
+}
+const [verb, sub, ...rest] = positional;
+
+const out = (value) => process.stdout.write((typeof value === 'string' ? value : JSON.stringify(value, null, 2)) + '\n');
+const die = (message, code = 2) => { process.stderr.write(`supercode fleet: ${message}\n`); process.exit(code); };
+const onName = () => (typeof flags.on === 'string' ? flags.on : null);
+const contextName = () => (typeof flags.context === 'string' ? flags.context : null);
+
+/** The machine `--on` names in the selected context, or this box's own daemon. */
+function channelForOn() {
+  return openOn(onName(), { context: contextName() });
+}
+
+async function main() {
+  switch (verb) {
+    case 'discover': {
+      const params = {};
+      if (typeof flags.query === 'string') params.query = flags.query;
+      if (flags.limit !== undefined) params.limit = Number(flags.limit);
+      if (typeof flags.workspace === 'string') params.workspace = flags.workspace;
+      if (flags.harness) params.harnesses = String(flags.harness).split(',').filter(Boolean);
+      const machines = typeof flags.machines === 'string' ? String(flags.machines).split(',').filter(Boolean) : null;
+      out(await fleetDiscover({ context: contextName(), machines, params }));
+      return;
+    }
+    case 'rpc': {
+      if (!sub) die('rpc --on <machine> <harness.v1 method> [json]');
+      const channel = await channelForOn();
+      try {
+        out(await harnessRequest(channel, sub, rest[0] ? JSON.parse(rest[0]) : {}));
+      } finally {
+        channel.close();
+      }
+      return;
+    }
+    case 'launch': {
+      // The node's own `launch` door: a pane on the Machine, keyed so a
+      // retry of the same launch key never opens a second one.
+      const program = typeof flags.program === 'string' ? flags.program : sub;
+      if (!program) die('launch --on <machine> --program <program> [--args=…]');
+      const channel = await channelForOn();
+      try {
+        out(await nodeRequest(channel, 'launch', {
+          key: flags['launch-key'],
+          pane: flags.pane,
+          kind: flags.kind,
+          program,
+          arguments: flags.args ? String(flags.args).split(' ').filter(Boolean) : rest,
+          cwd: flags.cwd,
+          initialInput: flags.input,
+          name: flags.name,
+        }));
+      } finally {
+        channel.close();
+      }
+      return;
+    }
+    case 'attach': {
+      const pane = sub;
+      if (!pane && !flags.runtime) die('attach --on <machine> <pane> [--mode observe|control]  |  attach --on <machine> --runtime <runtime-id> [--send text]');
+      const mode = typeof flags.mode === 'string' ? flags.mode : 'observe';
+      const channel = await channelForOn();
+      if (flags.runtime || (pane && pane.includes('://'))) {
+        // A MANAGED runtime: frontend.v2 over the channel . The node mints this principal
+        // its own credential, so control and approvals are the lease coordinator's own semantics.
+        const runtime = String(flags.runtime ?? pane).replace(/^supercode-live:\/\//, '');
+        const fc = await attachRuntime(channel, { runtime, permissions: mode === 'control' ? ['observe', 'interact', 'approve'] : ['observe'] });
+        const descriptor = await fc.describe();
+        process.stderr.write(`[attached runtime ${runtime} (${descriptor.harness ?? descriptor.title ?? 'runtime'}) — ${mode}${mode === 'control' ? '; ctrl-] detaches' : ''}]\n`);
+        const snapshot = await fc.attach(Number(flags.tail ?? 20));
+        for (const cell of snapshot.cells ?? snapshot.messages ?? []) {
+          const text = cell.text ?? cell.content ?? '';
+          if (text) process.stdout.write(`${cell.role ?? cell.kind ?? ''}: ${String(text).slice(0, 400)}\n`);
+        }
+        fc.on('event', (event) => {
+          const text = event.text ?? event.payload?.text ?? null;
+          if (event.type === 'output_delta' && text) process.stdout.write(text);
+          else if (event.type && event.type !== 'output_delta') process.stderr.write(`[${event.type}${text ? ': ' + String(text).slice(0, 120) : ''}]\n`);
+        });
+        fc.on('disconnect', () => { process.stderr.write('\n[runtime detached]\n'); channel.close(); process.exit(0); });
+        if (mode === 'control') await fc.takeControl();
+        if (typeof flags.send === 'string') { await fc.sendInput(flags.send); process.stderr.write(`[sent]\n`); }
+        if (mode === 'control' && process.stdin.isTTY) {
+          process.stdin.setRawMode(false);
+          let line = '';
+          process.stdin.on('data', async (chunk) => {
+            const s = chunk.toString('utf8');
+            if (s.includes('')) { fc.detachChannel(); channel.close(); process.exit(0); }
+            line += s;
+            if (line.endsWith('\n')) { const prompt = line.trimEnd(); line = ''; if (prompt) await fc.sendInput(prompt).catch((e) => process.stderr.write(`[${e.message}]\n`)); }
+          });
+        }
+        await fc.startEvents({}).catch((e) => { process.stderr.write(`[events ended: ${e.message}]\n`); });
+        if (typeof flags.for === 'string') setTimeout(() => { fc.detachChannel(); channel.close(); process.exit(0); }, Number(flags.for));
+        return;
+      }
+      const term = await attachPane(channel, { pane, mode, cols: process.stdout.columns ?? 120, rows: process.stdout.rows ?? 40 });
+      term.on('hello', (frame) => process.stderr.write(`[attached ${pane} ${frame.cols}x${frame.rows}${mode === 'control' ? ' — ctrl-] detaches' : ''}]\n`));
+      term.on('error-message', (message) => process.stderr.write(`[${message}]\n`));
+      term.on('data', (text) => process.stdout.write(text));
+      term.on('close', (reason) => { process.stderr.write(`\n[detached${reason ? `: ${reason}` : ''}]\n`); channel.close(); process.exit(0); });
+      if (mode === 'control' && process.stdin.isTTY) {
+        process.stdin.setRawMode(true);
+        process.stdin.on('data', (chunk) => {
+          if (chunk[0] === 0x1d) { term.close(); return; } // ctrl-] detaches
+          term.write(chunk.toString('utf8'));
+        });
+      }
+      process.stdout.on('resize', () => term.resize(process.stdout.columns, process.stdout.rows));
+      return;
+    }
+    default:
+      die('verbs: discover, rpc, launch, attach');
+  }
+}
+
+main().catch((error) => die(error.message ?? String(error), 1));