@volter/supercode-teams 0.2.20

package/machine.mjs

@@ -0,0 +1,1398 @@
+// The machine daemon: one per OS user and home. It is the neutral core
+// (machine-core.mjs: identity, log, the local door, the server link, admission and
+// product doors) with the harness's own doors registered on it. It owns one
+// `supercode harness serve` and the terminal host, and serves these streams:
+//
+//   stream "harness"   operators only: harness.v1 lines to the one serve process,
+//                      request ids rewritten per connection, notifications routed
+//                      by the subscription/connection they name (never fanned out)
+//   stream "terminal"  a pane attachment under observe|control
+//   stream "node"      describe, launch, launches.get|list, panes.*, files.*,
+//                      ports.*, attention.*, title.*
+//   stream "frontend"  frontend.v2 to a hosted runtime, one client id per caller
+//   stream "port"      one TCP connection to an announced port
+//   stream "watch"     panes and ports as a snapshot then deltas
+//   stream "product"   a target another product serves here (products.mjs), admitted first
+//   stream "exec" | "sftp" | "exec-server"   operators: a pilot's tool process or file view
+//   stream "workspace" operators: a project leaving or arriving
+//
+// Two doors reach it. The LOCAL door is an owner-only Unix socket in the home:
+// whoever can open it is this OS user, an operator. The REMOTE door is the
+// Teams server: with `link`, the daemon holds one outbound WebSocket to the
+// server, which forwards a caller's streams stamped with the machine grants it
+// checked; the daemon re-derives that admission from its own synced copy of the
+// grants before acting. There is no inbound port and no address book.
+//
+// It decides nothing on anyone's behalf. Every act is logged.
+import { spawn, spawnSync } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import { readFileSync, writeFileSync, writeSync, statSync, readdirSync, mkdirSync, renameSync, rmSync, existsSync, openSync, readSync, closeSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { hostname } from 'node:os';
+import { randomBytes, createHash } from 'node:crypto';
+import { WebSocket } from 'ws';
+import { TmuxTerminalHost, classifyAttentionSignal, composerHoldsDraft, composerReadyForInput } from '@volter/supercode-terminal';
+import { findLiveReceipt, mintFrontendCredential } from '@volter/supercode-harness-sdk/live-runtime';
+import { NODE_PROTOCOL } from '@volter/teams/channel';
+import { holds, observesPanes } from '@volter/teams/admission';
+import { MachineCore, MACHINE_VERSION } from '@volter/teams/machine-core';
+import { realpathSync } from 'node:fs';
+import { fingerprint, signBytes, canonical } from '@volter/teams/identity';
+import { teamsHome, paths, readJson, writeJson, Launches } from '@volter/teams/home';
+import { request as httpRequest } from 'node:http';
+import { DEFAULT_RANK, normalizeRank, judge } from './attention.mjs';
+import { JobOwner, executionCapabilities, streamProgram, serveWorkspace } from './execution.mjs';
+
+/** The preload every launched pane carries: it announces the ports a pane's node processes listen on. */
+const PORTHOLE_HOOK = fileURLToPath(new URL('./porthole-hook.cjs', import.meta.url));
+/** How long a launch's `initialInput` waits for its pane to become ready for
+ *  input before it is delivered anyway. Long enough for the slowest cold
+ *  start anyone has reported (a first-run agent TUI fetching its config over a
+ *  slow link); past it the input goes in regardless and the launch record says
+ *  so, because silently dropping a caller's first message is worse than an
+ *  imperfectly-timed one. */
+const INITIAL_INPUT_READY_DEADLINE_MS = 90_000;
+/** How often the readiness evidence is re-read while waiting. Same cadence the
+ *  terminal controller polls its own composer at: fast enough that a ready pane
+ *  is not left idling, cheap enough to run for the whole deadline. */
+const INITIAL_INPUT_POLL_MS = 250;
+/** The pause between the two composer readings a user's turn waits on. */
+const COMPOSER_RECHECK_MS = 400;
+
+/** The settle floor for a pane whose kind has no composer pattern: the screen
+ *  must have stopped changing for this long before the pane counts as ready. */
+const INITIAL_INPUT_SETTLE_MS = 1_000;
+
+export class TeamsMachine extends MachineCore {
+  /**
+   * `link`: { server, teamId, machineId, credential, incarnationId, configuration } to hold the
+   * server link; `configuration()` resolves the machine's current configuration from the server
+   * (custodian and machine grants). Without it the daemon serves its local door only.
+   */
+  constructor({ home = teamsHome(), supercode = 'supercode', tmuxSocket, floor = null, limits = null, env = process.env, link = null } = {}) {
+    super({ home, floor, limits, env, link });
+    this.supercodeBin = supercode;
+    this.tmuxSocket = tmuxSocket ?? null;
+    this.launches = new Launches(this.p.launches);
+    this.host = new TmuxTerminalHost({
+      // Stable owner id so panes this daemon launched stay "owned" across restarts.
+      ownerId: `supercode-teams-${fingerprint(this.identity.publicKeyPem)}`,
+      ...(tmuxSocket ? { socket: tmuxSocket } : {}),
+    });
+    // How many pane attachments a principal may hold (limits.json); every refusal is logged.
+    this.attachmentsByPrincipal = new Map(); // principal → live pane attachments
+    this.serve = null;
+    this.serveBuffer = '';
+    this.routes = new Map(); // routing key (subscription/connection id) → connection index
+    this.portsDir = join(home, 'ports');
+    // Panes whose REMOTE input is refused. It survives a daemon restart:
+    // a hand-back that outlives this process is still a hand-back.
+    this.suspended = new Set(Object.keys(readJson(this.p.suspended, { v: 1, panes: {} }).panes));
+    // Idle evidence for attention: the last capture we saw of each pane and
+    // when it last differed. In memory and nowhere else — there is no timer and
+    // no watcher; every `panes.list` / `attention.*` call is the sample. A pane
+    // first seen this call is idle 0, which is the truth about what we know, and
+    // a daemon restart honestly resets the clock rather than inventing history.
+    this.paneScreens = new Map(); // terminal session id → { hash, changedAt }
+    // Launches whose `initialInput` is still waiting for its pane to be ready
+    //. The launch reply does not wait for delivery — a cold TUI can take
+    // longer than the caller's own RPC timeout — so the wait lives here, where
+    // `stop()` can abandon it rather than leave a timer running past the daemon.
+    this.pendingInitialInputs = new Map(); // launch key → { abort, task }
+    this.registerDoor('harness', (entry, stream, accept, refuse, index) => this.#serveHarness(index, entry, stream, accept, refuse));
+    this.registerDoor('terminal', (entry, stream, accept, refuse) => this.#attachTerminal(entry, stream, accept, refuse));
+    this.registerDoor('node', (entry, stream, accept) => { accept(); return this.#serveNodeRpc(entry, stream); });
+    this.registerDoor('frontend', (entry, stream, accept, refuse) => this.#serveFrontendProxy(entry, stream, accept, refuse));
+    this.registerDoor('port', (entry, stream, accept, refuse) => this.#servePortForward(entry, stream, accept, refuse));
+    this.registerDoor('watch', (entry, stream, accept, refuse) => this.#serveWatch(entry, stream, accept, refuse));
+    for (const name of ['exec', 'sftp', 'exec-server']) this.registerDoor(name, (entry, stream, accept, refuse) => this.#serveExecution(entry, stream, accept, refuse));
+    this.registerDoor('workspace', (entry, stream, accept, refuse) => this.#serveWorkspace(entry, stream, accept, refuse));
+    this.registerDoor('mail', (entry, stream, accept, refuse) => this.#serveMail(entry, stream, accept, refuse));
+  }
+
+  // ---- lifecycle ------------------------------------------------------------
+
+  async beforeListen() {
+    mkdirSync(this.portsDir, { recursive: true }); // the port table's announce directory exists before any pane launches
+    this.#startServe();
+    this.#startMailWatch();
+    this.jobs = new JobOwner({ home: this.home, env: this.env, log: (row) => this.log.append({ principal: null, cap: 'exec', target: `job:${row.job}`, outcome: row.outcome, detail: row.reason }) });
+    this.jobs.reapOrphans();
+  }
+
+  async beforeClose() {
+    // A launch still waiting for its pane to be ready is abandoned, not hurried:
+    // this daemon is going away, and shoving a message at a half-booted TUI on the
+    // way out is the very failure the wait exists to prevent. The launch record
+    // already says the input was never delivered.
+    for (const { abort } of this.pendingInitialInputs.values()) abort.abort();
+    await Promise.allSettled([...this.pendingInitialInputs.values()].map(({ task }) => task));
+    this.pendingInitialInputs.clear();
+  }
+
+  async afterStop() {
+    this.jobs?.stopAll();
+    this.stoppingMailWatch = true;
+    this.mailWatch?.kill('SIGTERM');
+    this.serve?.kill('SIGTERM');
+    this.host.dispose();
+  }
+
+  connectionClosed(index) {
+    for (const [key, owners] of this.routes) { owners.delete(index); if (owners.size === 0) this.routes.delete(key); }
+  }
+
+  #startServe() {
+    const child = spawn(this.supercodeBin, ['harness', 'serve'], { stdio: ['pipe', 'pipe', 'pipe'], env: this.env });
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+      this.serveBuffer += chunk;
+      let index;
+      while ((index = this.serveBuffer.indexOf('\n')) >= 0) {
+        const line = this.serveBuffer.slice(0, index);
+        this.serveBuffer = this.serveBuffer.slice(index + 1);
+        if (line) this.#routeServeLine(line);
+      }
+    });
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (text) => this.emit('serve-stderr', text));
+    child.on('exit', (code, signal) => {
+      this.emit('serve-exit', { code, signal });
+      for (const [, entry] of this.connections) entry.harness?.close('harness serve exited');
+    });
+    this.serve = child;
+  }
+
+  // Idle notices for every session on this machine (`supercode message watch`):
+  // it settles `--notify-when-idle` subscriptions from session activity. It
+  // lives beside `harness serve` and is restarted if it exits, so a
+  // subscription made at any time has a watcher.
+  #startMailWatch() {
+    if (this.stoppingMailWatch) return;
+    const child = spawn(this.supercodeBin, ['message', 'watch'], { stdio: ['ignore', 'ignore', 'pipe'], env: this.env });
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (text) => this.emit('mail-watch-stderr', text));
+    child.on('error', (error) => this.emit('mail-watch-stderr', error.message));
+    child.on('exit', () => {
+      if (this.mailWatch !== child || this.stoppingMailWatch) return;
+      setTimeout(() => this.#startMailWatch(), 5000).unref();
+    });
+    this.mailWatch = child;
+  }
+
+  /** One `harness.v1` request of the daemon's own, to its `harness serve`: the
+   *  connection id INTERNAL_CONNECTION marks the answer as ours. */
+  #serveRequest(method, params, timeoutMs = 3000) {
+    this.internalRequests ??= new Map();
+    const id = (this.internalNext = (this.internalNext ?? 0) + 1);
+    return new Promise((resolve, reject) => {
+      if (!this.serve?.stdin?.writable) return reject(new Error('harness serve is not running'));
+      this.internalRequests.set(id, { resolve, reject });
+      setTimeout(() => { if (this.internalRequests.delete(id)) reject(new Error(`${method} timed out`)); }, timeoutMs).unref();
+      this.serve.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id: joinId(INTERNAL_CONNECTION, id), method, params })}\n`);
+    });
+  }
+
+  /** Response and notification routing: ids carry the connection index. */
+  #routeServeLine(line) {
+    let message;
+    try { message = JSON.parse(line); } catch { return; }
+    if (message.id !== undefined && message.id !== null) {
+      const [conn, original] = splitId(message.id);
+      const entry = this.connections.get(conn);
+      if (conn === INTERNAL_CONNECTION) {
+        const pending = this.internalRequests?.get(original);
+        if (!pending) return;
+        this.internalRequests.delete(original);
+        if (message.error) pending.reject(new Error(message.error.message ?? 'harness serve refused'));
+        else pending.resolve(message.result);
+        return;
+      }
+      if (!entry?.harness) return;
+      // Learn routing keys from results so later notifications find their owner.
+      if (message.result && typeof message.result === 'object') {
+        for (const key of ['subscription', 'connection', 'runtime_id', 'subscription_id']) {
+          const value = message.result[key];
+          // Owners are a set: two operators following one thing both keep receiving (routed, never fanned out to non-owners).
+          if (typeof value === 'string') { if (!this.routes.has(value)) this.routes.set(value, new Set()); this.routes.get(value).add(conn); }
+        }
+      }
+      writeLine(entry.harness, JSON.stringify({ ...message, id: original }));
+      return;
+    }
+    // Notification: find the connection that owns what it names.
+    const params = message.params ?? {};
+    for (const key of ['subscription', 'connection', 'runtime_id', 'subscription_id']) {
+      const value = params[key];
+      if (typeof value === 'string' && this.routes.has(value)) {
+        for (const owner of this.routes.get(value)) {
+          const harness = this.connections.get(owner)?.harness;
+          if (harness) writeLine(harness, line);
+        }
+        return;
+      }
+    }
+    this.emit('unrouted-notification', message);
+  }
+
+  /**
+   * Claim one of a principal's pane attachments (`maxAttachmentsPerPrincipal`
+   * in limits.json). Returns the
+   * release; throws, refusing the attachment, when the principal is at its bound.
+   */
+  claimAttachment(principal) {
+    const limit = this.limits.maxAttachmentsPerPrincipal;
+    const live = this.attachmentsByPrincipal.get(principal) ?? 0;
+    if (Number.isFinite(limit) && limit > 0 && live >= limit) {
+      this.log.append({ principal, cap: 'attach', target: '*', outcome: 'rate-limited', detail: `over ${limit} attachments` });
+      throw Object.assign(new Error(`this Machine allows ${limit} pane attachments per principal`), { code: 429 });
+    }
+    this.attachmentsByPrincipal.set(principal, live + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const now = (this.attachmentsByPrincipal.get(principal) ?? 1) - 1;
+      if (now <= 0) this.attachmentsByPrincipal.delete(principal); else this.attachmentsByPrincipal.set(principal, now);
+    };
+  }
+
+  #serveHarness(index, entry, stream, accept, refuse) {
+    const { admitted, principal } = entry;
+    if (admitted.class !== 'operator') {
+      this.log.append({ principal, cap: 'harness', target: '*', outcome: 'refused' });
+      return refuse('harness.v1 is for operators');
+    }
+    if (entry.harness) return refuse('one harness stream per connection');
+    entry.harness = stream;
+    accept();
+    this.log.append({ principal, cap: 'harness', target: '*', outcome: 'opened' });
+    let buffer = '';
+    stream.on('data', (chunk) => {
+      buffer += chunk;
+      let nl;
+      while ((nl = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, nl);
+        buffer = buffer.slice(nl + 1);
+        if (!line) continue;
+        let message;
+        try { message = JSON.parse(line); } catch { continue; }
+        if (message.id !== undefined && message.id !== null) message.id = joinId(index, message.id);
+        this.serve?.stdin.write(JSON.stringify(message) + '\n');
+      }
+    });
+    stream.on('close', () => { entry.harness = null; });
+  }
+
+  #serveWorkspace(entry, stream, accept, refuse) {
+    // A project leaving or arriving (execution.mjs serveWorkspace): the machine's files as
+    // this user, so operators only, like exec.
+    const { admitted, principal } = entry;
+    if (admitted.class !== 'operator') {
+      this.log.append({ principal, cap: 'workspace', target: '*', outcome: 'refused' });
+      return refuse('workspace is for operators');
+    }
+    accept();
+    const target = `root:${stream.params.path}`;
+    const onEnd = (detail) => this.log.append({ principal, cap: 'workspace', target, outcome: stream.params.op, detail });
+    // A door that fails closes its stream; it never takes the daemon down with it.
+    try { return serveWorkspace(stream, stream.params, { onEnd }); } catch (error) { onEnd(`failed: ${error.message}`); stream.close(error.message); return; }
+  }
+
+  // ---- mail ----------------------------------------------------------------
+
+  #serveMail(entry, stream, accept, refuse) {
+    // One message into a session on this machine, delivered by `supercode message
+    // remote-deliver` through the same doors a local send uses. The receiver is the
+    // target: `mail:*` reaches every session here, `mail:<address>` one of them; a
+    // receiver named rather than addressed needs `mail:*`.
+    const { admitted, principal } = entry;
+    const request = stream.params?.request;
+    const to = typeof request?.to === 'string' ? request.to : '*';
+    const target = to.startsWith('sc:') ? `mail:${to}` : 'mail:*';
+    if (!request || !['send', 'file', 'list'].includes(request.op)) return refuse('mail needs a send, file or list request');
+    if (!holds(admitted, 'mail', target)) {
+      this.log.append({ principal, cap: 'mail', target, outcome: 'refused' });
+      return refuse(`no mail grant for ${target}`);
+    }
+    accept();
+    const child = spawn(this.supercodeBin, ['message', 'remote-deliver'], { stdio: ['pipe', 'pipe', 'pipe'], env: this.env });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (chunk) => { out += chunk; });
+    child.stderr.on('data', (chunk) => { err += chunk; });
+    child.on('error', (error) => { err += error.message; });
+    child.on('close', (code) => {
+      this.log.append({ principal, cap: 'mail', target, outcome: code === 0 ? request.op : 'failed', detail: err.trim().slice(0, 200) || undefined });
+      if (stream.closed) return;
+      stream.write(out.trim() || JSON.stringify({ outcome: 'failed', detail: err.trim() || `remote-deliver exited ${code}` }));
+      stream.close('delivered');
+    });
+    // Who asked travels with the request, so the receiving session's envelope can say so.
+    child.stdin.end(JSON.stringify({ ...request, via_principal: principal ?? null }));
+  }
+
+  // ---- terminal ------------------------------------------------------------
+
+  async #attachTerminal(entry, stream, accept, refuse) {
+    const { admitted, principal } = entry;
+    const { pane, mode = 'observe', cols = 120, rows = 40 } = stream.params;
+    const cap = mode === 'control' ? 'control' : 'observe';
+    if (!holds(admitted, cap, `pane:${pane}`)) {
+      this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'refused' });
+      return refuse(`no ${cap} on pane:${pane}`);
+    }
+    const session = await this.#paneByContext(pane);
+    if (!session) return refuse(`no pane with context ${pane}`);
+    let grant;
+    let release;
+    try {
+      release = this.claimAttachment(principal);
+      grant = this.host.issueAttachment(session.id, { mode });
+    } catch (error) {
+      release?.();
+      this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'refused', detail: error.message });
+      return refuse(error.message);
+    }
+    accept();
+    const socketLike = this.gateInput(new ChannelWebSocket(stream), pane);
+    try {
+      const attachment = await this.host.attachSocket(grant.id, socketLike, { cols, rows });
+      this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'attached' });
+      stream.on('close', () => { release(); attachment.dispose(); });
+    } catch (error) {
+      release();
+      this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'failed', detail: error.message });
+      stream.close(error.message);
+    }
+  }
+
+  /**
+   * The environment every launched pane carries: the porthole hook preloaded into
+   * each node process the pane runs, the announce directory it writes into, and the pane's
+   * own contextKey, so an announced port names the pane that owns it.
+   */
+  #paneEnv(contextKey, requested) {
+    const env = { ...(requested ?? {}) };
+    const inherited = env.NODE_OPTIONS ?? this.env.NODE_OPTIONS ?? '';
+    env.NODE_OPTIONS = `${inherited} --require ${PORTHOLE_HOOK}`.trim();
+    env.SUPERCODE_TEAMS_PORTS_DIR = this.portsDir;
+    env.SUPERCODE_TEAMS_PANE = contextKey;
+    return env;
+  }
+
+  async #paneByContext(contextKey) {
+    const sessions = await this.host.listSessions();
+    return sessions.find((s) => s.contextKey === contextKey) ?? null;
+  }
+
+  // ---- attention: the evidence, gathered here ---------------------------
+
+  /** attention.json, with the rank table filled in from the defaults the first
+   *  time anyone looks. It is written back so the org has a real file to edit —
+   *  a table that only exists as a default is a table nobody knows they may
+   *  change. Re-read on every call: a precedence edit lands on the next call
+   *  with nothing restarted. */
+  attentionDoc() {
+    const doc = readJson(this.p.attention, { v: 1, requests: {} });
+    const before = JSON.stringify(doc.rank ?? null);
+    doc.rank = normalizeRank(doc.rank ?? DEFAULT_RANK);
+    if (JSON.stringify(doc.rank) !== before) writeJson(this.p.attention, doc);
+    return doc;
+  }
+
+  /** Seconds since this pane's screen last CHANGED, by hashing the capture and
+   *  remembering when the hash last moved. The transcript rung: a foreground
+   *  command whose screen has plateaued is what separates `stuck` from
+   *  `working`, and nothing cheaper can tell them apart. */
+  #idleSeconds(sessionId, capture, now) {
+    return Math.round(this.#screenUnchangedMs(sessionId, capture, now) / 1000);
+  }
+
+  /** The same plateau in milliseconds, which is the unit a launch's readiness
+   *  wait needs (its settle floor is a second, not a count of them). One clock,
+   *  two units: `attention` rounds it to seconds, and a pane sampled by either
+   *  caller feeds the other's reading rather than keeping a private history. */
+  #screenUnchangedMs(sessionId, capture, now) {
+    const hash = createHash('sha256').update(capture ?? '').digest('hex');
+    const seen = this.paneScreens.get(sessionId);
+    if (!seen || seen.hash !== hash) {
+      this.paneScreens.set(sessionId, { hash, changedAt: now });
+      return 0;
+    }
+    return Math.max(0, now - seen.changedAt);
+  }
+
+  /** The four attention inputs, for every pane this daemon can see, plus any pane
+   *  with a standing request whose pane is gone (liveness `ended` — a request
+   *  outranks `ended`, so a declaration raised at the end of a run survives the
+   *  pane that raised it).
+   *
+   *  Where each input comes from, and nowhere else:
+   *    liveness     for a pane running a harness session (Claude Code, Codex),
+   *                 the harness's own lifecycle through `harness.v1.sessions.
+   *                 activity_under`: working is `running`, idle is `waiting`,
+   *                 needing input is `waiting` with the `asking` signal
+   *                 (source `cooperative`). Otherwise the terminal host's
+   *                 `activeCommand` — tmux's own
+   *                 `pane_current_command`. The pane's shell in the foreground
+   *                 means the shell is at its prompt (`waiting`); any other
+   *                 command means work is running (`running`); an empty or
+   *                 absent value means tmux named nothing, which is `unknown`
+   *                 and never quietly reported as running.
+   *    signal       `classifyAttentionSignal` from the terminal substrate, over
+   *                 this pane's capture. The classifier is NOT re-derived here:
+   *                 one set of patterns, one precision, every surface.
+   *    idleSeconds  the capture-hash plateau above.
+   *    requested    attention.json — what `attention request` recorded, with the
+   *                 urgency and reason the caller gave, carried through intact.
+   */
+  async attentionEvidence(now = Date.now()) {
+    const doc = this.attentionDoc();
+    const sessions = await this.host.listSessions();
+    const harness = new Map();
+    const pids = sessions.map((session) => session.rootPid).filter(Number.isInteger);
+    if (pids.length) {
+      try {
+        const answer = await this.#serveRequest('harness.v1.sessions.activity_under', { pids });
+        for (const { pid, activity } of answer?.activities ?? []) harness.set(pid, activity);
+      } catch { /* no harness evidence this tick: the process tree still answers */ }
+    }
+    const live = new Set();
+    const rows = sessions.map((session) => {
+      if (session.contextKey) live.add(session.contextKey);
+      const capture = this.#safeCapture(session.id);
+      const requested = session.contextKey ? doc.requests[session.contextKey] ?? null : null;
+      const own = harnessLiveness(harness.get(session.rootPid));
+      const evidence = {
+        liveness: own?.liveness ?? livenessOf(session.activeCommand),
+        signal: classifyAttentionSignal(capture) ?? own?.signal ?? null,
+        idleSeconds: this.#idleSeconds(session.id, capture, now),
+        requested,
+        ...(own ? { livenessSource: 'cooperative' } : {}),
+      };
+      return { session, ...judged(evidence, doc.rank) };
+    });
+    for (const [pane, request] of Object.entries(doc.requests)) {
+      if (live.has(pane)) continue;
+      const evidence = { liveness: 'ended', signal: null, idleSeconds: null, requested: request };
+      rows.push({ session: { contextKey: pane, label: null, id: null }, ...judged(evidence, doc.rank) });
+    }
+    return rows;
+  }
+
+  /** One capture, never fatal: a pane that died between the listing and the read
+   *  is evidence of nothing, not a failed door. */
+  #safeCapture(sessionId) {
+    if (!sessionId) return '';
+    try {
+      return this.host.capture(sessionId, { lines: 120 });
+    } catch {
+      return '';
+    }
+  }
+
+  // ---- launch: the first input ------------------------------------------
+
+  /**
+   * Wait for the pane to be ready for input, then deliver the launch's first
+   * message and record what happened. Started by `launch` and deliberately NOT
+   * awaited by it: the reply says the pane exists, and this says the message
+   * went in.
+   *
+   * Never rejects. The only caller is a fire-and-forget from the request path,
+   * where an unhandled rejection would take the daemon down over one pane.
+   */
+  #deliverInitialInput({ key, contextKey, session, kind, input, act }) {
+    const abort = new AbortController();
+    const task = (async () => {
+      const readyBy = await this.#awaitInputReady(session, contextKey, kind, abort.signal);
+      if (readyBy === 'aborted') return;
+      if (readyBy === 'pane-gone') {
+        this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: false, inputReadyBy: readyBy });
+        act('launch', `pane:${contextKey}`, 'failed', 'first input undelivered: the pane ended before it was ready');
+        return;
+      }
+      // `single` stays `single`: one paste, one submit. The repeated Enter of
+      // `retry` exists for a composer that swallowed the first one, and pressing
+      // Enter again at an agent that already took the message sends an empty
+      // turn. The fix for a lost submit is waiting until there is something to
+      // submit into, which is what happened above.
+      try {
+        await this.host.sendInput(session.id, submission(input), { submitMode: 'single' });
+      } catch (error) {
+        this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: false, inputReadyBy: readyBy, inputError: error.message });
+        act('launch', `pane:${contextKey}`, 'failed', `first input undelivered: ${error.code ?? error.message}`);
+        return;
+      }
+      // `inputDeliveredLate` is the deadline's own confession: the pane never
+      // showed us it was ready, and the message went in on a screen nobody
+      // vouched for. A launch that reads `ready` without it was given its
+      // message by an input box that existed.
+      const late = readyBy === 'deadline';
+      this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: true, inputReadyBy: readyBy, ...(late ? { inputDeliveredLate: true } : {}) });
+      act('launch', `pane:${contextKey}`, 'ok', `first input delivered (${readyBy})`);
+    })().catch((error) => {
+      // Nothing above is expected to throw; if something does, the launch record
+      // is where it is answerable, not a crashed daemon.
+      this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: false, inputError: error?.message ?? String(error) });
+    }).finally(() => {
+      if (this.pendingInitialInputs.get(key)?.task === task) this.pendingInitialInputs.delete(key);
+    });
+    this.pendingInitialInputs.set(key, { abort, task });
+  }
+
+  /** The program a pane runs, as the terminal package names kinds: what it was
+   *  launched as, else what its foreground command is. */
+  #paneKind(contextKey, session) {
+    const launched = this.launches.all().find((row) => row.pane === contextKey && row.kind)?.kind;
+    const named = String(launched ?? '').trim().toLowerCase();
+    if (named === 'claude' || named === 'claude-code') return 'claude-code';
+    if (named) return named;
+    const command = String(session.activeCommand ?? '').toLowerCase().replace(/\.exe$/u, '');
+    return command === 'claude' ? 'claude-code' : command;
+  }
+
+  /**
+   * Is this pane ready to be given text, and on what evidence? Polls until it
+   * is, the pane is gone, the deadline passes or the daemon stops. Returns the
+   * rung that decided it:
+   *
+   *   composer   the kind's idle composer is on screen — the program has
+   *              finished booting and is waiting for a message. The patterns
+   *              are the terminal package's own (`composerReadyForInput`), the
+   *              same ones its controller waits on, never a second copy here.
+   *   settled    the kind has no composer pattern, so the terminal host's own
+   *              settle heuristic decides: the screen has not changed for
+   *              `INITIAL_INPUT_SETTLE_MS` and the program has printed
+   *              something — or, on a pane with nothing to print, its shell is
+   *              the foreground command (`awaiting_me`'s evidence: a prompt,
+   *              turn over).
+   *   deadline   neither, for `INITIAL_INPUT_READY_DEADLINE_MS`. The caller
+   *              delivers anyway and says so.
+   */
+  async #awaitInputReady(session, contextKey, kind, signal) {
+    const composerKind = typeof kind === 'string' ? kind.trim().toLowerCase() : '';
+    const until = Date.now() + INITIAL_INPUT_READY_DEADLINE_MS;
+    while (!signal.aborted && Date.now() < until) {
+      const capture = this.#safeCapture(session.id);
+      const unchangedMs = this.#screenUnchangedMs(session.id, capture, Date.now());
+      const blank = capture.trim() === '';
+      // A blank screen is the one reading that can mean the pane is GONE rather
+      // than merely quiet, so that is when its existence is worth a tmux call —
+      // and the same lookup carries the foreground command, which is the only
+      // evidence a shell with nothing to print is nonetheless at its prompt.
+      const live = blank ? await this.#paneByContext(contextKey) : null;
+      if (blank && !live) return 'pane-gone';
+      // `null` from the terminal package means it has no pattern for this kind —
+      // never "not yet", or an unrecognized kind would wait out the whole
+      // deadline on a screen nobody is reading.
+      const composer = composerReadyForInput(composerKind, capture);
+      if (composer === true) return 'composer';
+      if (composer === null && unchangedMs >= INITIAL_INPUT_SETTLE_MS && (!blank || livenessOf(live.activeCommand) === 'waiting')) return 'settled';
+      await new Promise((resolve) => setTimeout(resolve, INITIAL_INPUT_POLL_MS));
+    }
+    if (signal.aborted) return 'aborted';
+    return (await this.#paneByContext(contextKey)) ? 'deadline' : 'pane-gone';
+  }
+
+  /**
+   * A host-key-signed statement a service records as its attestation input: which
+   * key this machine signs with, the run-spec hash and egress mode it was started
+   * under, and the server it is linked to.
+   */
+  describe() {
+    const body = {
+      v: MACHINE_VERSION,
+      id: this.id,
+      hostname: hostname(),
+      socket: this.socketPath,
+      server: this.link?.server ?? null,
+      machineId: this.link?.machineId ?? null,
+      node: { pid: process.pid, version: MACHINE_VERSION, protocol: NODE_PROTOCOL, floor: this.floor },
+      egress: this.env.SUPERCODE_TEAMS_EGRESS ?? 'unrestricted',
+      execution: executionCapabilities(this.env),
+      runSpec: this.env.SUPERCODE_TEAMS_RUN_SPEC_SHA256 ?? null,
+      at: Date.now(),
+    };
+    return { ...body, signature: signBytes(this.identity.privateKeyPem, Buffer.from(canonical(body))) };
+  }
+
+  listPorts() { return listAnnouncedPorts(this.portsDir); }
+
+  /**
+   * Rename the tmux window behind an owned pane. The terminal host exposes
+   * no rename, so this is `tmux` on the host's own socket; automatic-rename is
+   * turned off first, or the shell would take the name straight back. Returns
+   * the tmux label renamed, or null if the pane is gone or not ours.
+   */
+  async #renameWindow(contextKey, title) {
+    const session = await this.#paneByContext(contextKey);
+    if (!session || !session.owned) return null;
+    const socketArgs = this.tmuxSocket ? ['-L', this.tmuxSocket] : [];
+    const target = `${session.label}:0`;
+    const run = (args) => spawnSync('tmux', [...socketArgs, ...args], { timeout: 5_000, encoding: 'utf8' });
+    if (title == null) {
+      run(['set-window-option', '-t', target, 'automatic-rename', 'on']);
+      return session.label;
+    }
+    run(['set-window-option', '-t', target, 'automatic-rename', 'off']);
+    const result = run(['rename-window', '-t', target, String(title)]);
+    if (result.status !== 0) throw new Error(`tmux rename-window failed: ${(result.stderr ?? '').trim() || result.error?.message || 'unknown'}`);
+    return session.label;
+  }
+
+  /**
+   * Wrap a ws-shaped socket so that while its pane is suspended the
+   * peer's `input` frames are dropped with one notice back, and everything
+   * else — output, resize, hello, exit — passes through untouched.
+   */
+  gateInput(socketLike, pane) {
+    return new SuspendGate(socketLike, {
+      suspended: () => this.suspended.has(pane),
+      notice: `pane ${pane} is suspended: remote input is refused until resume`,
+    });
+  }
+
+  paneByContext(contextKey) { return this.#paneByContext(contextKey); }
+
+  // ---- the node stream: request/reply doors -----------------------------------
+
+  /**
+   * frontend.v2 over the channel, with the runtime's receipt resolved here on
+   * the machine. The caller's FrontendClient
+   * talks to a fetch that rides this stream; the daemon resolves the runtime's
+   * live receipt, mints THIS principal its own credential through the loopback
+   * mint door (so the lease coordinator sees one RuntimeClientId per remote
+   * principal), and forwards each request to the runtime's own server.
+   *
+   *   → { id, method, path, headers, body(base64) }
+   *   ← { id, status, headers }  then  { id, chunk(base64) }*  then  { id, end }
+   *   → { id, abort }
+   */
+  async #serveFrontendProxy(entry, stream, accept, refuse) {
+    const { admitted, principal } = entry;
+    const runtimeId = String(stream.params.runtime ?? '');
+    const wantsInteract = admitted.class === 'operator' || holds(admitted, 'interact', `runtime:${runtimeId}`);
+    if (!wantsInteract && !holds(admitted, 'observe', `runtime:${runtimeId}`)) {
+      this.log.append({ principal, cap: 'observe', target: `runtime:${runtimeId}`, outcome: 'refused' });
+      return refuse(`no observe on runtime:${runtimeId}`);
+    }
+    const receipt = findLiveReceipt(runtimeId, this.env);
+    if (!receipt) return refuse(`no live runtime ${runtimeId} on this Machine`);
+    // One RuntimeClientId per remote principal. Two runtime servers exist in core: the SDK-hosted
+    // one offers the loopback mint door (a credential BOUND to a client id); the frontend server
+    // for ACP-backed runtimes does not, and instead takes the client id from
+    // `x-supercode-client-id` and clamps rights from `x-supercode-permissions` when the credential
+    // is unbound (server.rs coordinated_http_client). So: mint when the door exists, otherwise
+    // forward the receipt's own token with this principal's id and a clamped permission header.
+    const clientId = `teams-${principal.slice(0, 12)}-${randomBytes(4).toString('hex')}`;
+    let credential = { clientId, token: receipt.token, minted: false };
+    try {
+      const token = await mintFrontendCredential(receipt, { clientId, grant: wantsInteract ? 'interactive' : 'observer' });
+      credential = { clientId, token, minted: true };
+    } catch (error) {
+      if (!/^mint 404/.test(error.message)) {
+        this.log.append({ principal, cap: 'observe', target: `runtime:${runtimeId}`, outcome: 'failed', detail: error.message });
+        return refuse(`could not mint a credential: ${error.message}`);
+      }
+    }
+    accept();
+    this.log.append({ principal, cap: wantsInteract ? 'interact' : 'observe', target: `runtime:${runtimeId}`, outcome: 'attached', detail: credential.minted ? 'channel, minted credential' : 'channel, receipt token + client id' });
+    const inflight = new Map(); // id → ClientRequest
+    stream.on('data', (chunk) => {
+      let message;
+      try { message = JSON.parse(chunk); } catch { return; }
+      if (message.abort) { inflight.get(message.id)?.destroy(); inflight.delete(message.id); return; }
+      // Only a path on the runtime's own server: an absolute URL or a `//host` prefix would turn
+      // the daemon into a proxy carrying the runtime's bearer to an arbitrary origin.
+      if (typeof message.path !== 'string' || !/^\/(?!\/)/.test(message.path)) {
+        if (!stream.closed) stream.write(JSON.stringify({ id: message.id, status: 400, headers: {}, error: 'path must be a root-relative path on the runtime', end: true }));
+        return;
+      }
+      const target = new URL(message.path, receipt.base_url);
+      const headers = { ...(message.headers ?? {}) };
+      // The principal's own identity replaces whatever the caller sent: the minted credential
+      // and its clientId are what the runtime's lease coordinator must see.
+      headers.authorization = `Bearer ${credential.token}`;
+      headers['x-supercode-client-id'] = credential.clientId;
+      // Clamp to the grant: observers get observe; interact holders get the three runtime rungs the
+      // grant carries (approve travels with interact); an operator keeps the token's own authorization.
+      if (!wantsInteract) headers['x-supercode-permissions'] = 'observe';
+      else if (admitted.class !== 'operator') headers['x-supercode-permissions'] = 'observe,interact,approve';
+      headers.host = target.host;
+      delete headers['content-length'];
+      const body = message.body ? Buffer.from(message.body, 'base64') : null;
+      if (body) headers['content-length'] = String(body.length);
+      const upstream = httpRequest(target, { method: message.method ?? 'GET', headers }, (res) => {
+        if (stream.closed) { res.destroy(); return; }
+        stream.write(JSON.stringify({ id: message.id, status: res.statusCode, headers: res.headers }));
+        res.on('data', (piece) => { if (!stream.closed) stream.write(JSON.stringify({ id: message.id, chunk: Buffer.from(piece).toString('base64') })); });
+        res.on('end', () => { inflight.delete(message.id); if (!stream.closed) stream.write(JSON.stringify({ id: message.id, end: true })); });
+      });
+      upstream.on('error', (error) => { inflight.delete(message.id); if (!stream.closed) stream.write(JSON.stringify({ id: message.id, status: 502, headers: {}, error: error.message, end: true })); });
+      inflight.set(message.id, upstream);
+      upstream.end(body ?? undefined);
+    });
+    stream.on('close', () => { for (const req of inflight.values()) req.destroy(); inflight.clear(); });
+  }
+
+  /**
+   * A Machine port forwarded to a keyed caller (`port:<pane>/<n>`). One stream is
+   * one TCP connection to 127.0.0.1:<port> on this Machine; bytes ride base64. A participant
+   * needs `ports` on `port:<pane>/<n>` and the port must be one that pane announced (the live
+   * port table); an operator may reach any port.
+   */
+  /**
+   * A pilot's tool process (`exec`) or its view of this machine's files (`sftp`), each one job
+   * the daemon owns (execution.mjs). Arbitrary code as this user, so operators only: the owner
+   * through the local door, or an `operate` grant through the server.
+   */
+  #serveExecution(entry, stream, accept, refuse) {
+    const { admitted, principal } = entry;
+    if (admitted.class !== 'operator') {
+      this.log.append({ principal, cap: stream.name, target: '*', outcome: 'refused' });
+      return refuse(`${stream.name} is for operators`);
+    }
+    const endpoint = streamProgram(stream.name, stream.params ?? {}, this.env);
+    const served = stream.name === 'exec-server' ? Boolean(endpoint) : executionCapabilities(this.env)[stream.name];
+    if (!endpoint || !served) return refuse(stream.name === 'exec-server' ? `this machine serves no exec-server for ${stream.params?.harness}` : `this machine does not serve ${stream.name}`);
+    accept();
+    try {
+      // an exec-server runs its processes in the directories its client names; it starts in the daemon's home
+      const job = this.jobs.run(stream, { kind: stream.name, ...endpoint, cwd: this.home });
+      this.log.append({ principal, cap: stream.name, target: `job:${job.id}`, outcome: 'started', detail: job.cgroup ? 'cgroup' : 'process-group' });
+    } catch (error) {
+      this.log.append({ principal, cap: stream.name, target: '*', outcome: 'failed', detail: error.message });
+      stream.close(error.message);
+    }
+  }
+
+  async #servePortForward(entry, stream, accept, refuse) {
+    const { admitted, principal } = entry;
+    const port = Number(stream.params.port);
+    const pane = stream.params.pane ? String(stream.params.pane) : null;
+    if (!Number.isInteger(port) || port <= 0 || port > 65535) return refuse('port must be 1–65535');
+    const target = `port:${pane ?? '*'}/${port}`;
+    if (admitted.class !== 'operator') {
+      if (!holds(admitted, 'ports', target) && !(pane && holds(admitted, 'ports', `pane:${pane}`))) {
+        this.log.append({ principal, cap: 'ports', target, outcome: 'refused' });
+        return refuse(`no ports on ${target}`);
+      }
+      const announced = this.listPorts().some((p) => p.port === port && (pane == null || p.pane === pane));
+      if (!announced) { this.log.append({ principal, cap: 'ports', target, outcome: 'refused', detail: 'not announced by that pane' }); return refuse(`port ${port} is not announced by pane ${pane}`); }
+    }
+    const { connect } = await import('node:net');
+    const socket = connect({ host: '127.0.0.1', port });
+    socket.once('connect', () => {
+      accept();
+      this.log.append({ principal, cap: 'ports', target, outcome: 'forwarded' });
+      socket.on('data', (bytes) => { if (!stream.closed) stream.write(bytes.toString('base64')); });
+      socket.on('close', () => stream.close('port closed'));
+      stream.on('data', (chunk) => { if (!socket.destroyed) socket.write(Buffer.from(chunk, 'base64')); });
+      stream.on('close', () => socket.destroy());
+    });
+    socket.once('error', (error) => { this.log.append({ principal, cap: 'ports', target, outcome: 'failed', detail: error.code ?? error.message }); refuse(`port ${port}: ${error.code ?? error.message}`); });
+  }
+
+  /**
+   * The Machine's live state as a stream ("transition stream"; the local state a
+   * caller would otherwise poll): one `snapshot` on open, then `delta`s — panes appearing,
+   * changing or vanishing (with attention label, holder, title, suspended), ports announced or
+   * gone. Computed from what the daemon already has (listSessions, the label, the port table);
+   * nothing new is decided. Participants see only the panes their grants cover; operators all.
+   */
+  async #serveWatch(entry, stream, accept, refuse) {
+    const { admitted, principal } = entry;
+    if (admitted.class !== 'operator' && !holds(admitted, 'view', '*') && !observesPanes(admitted)) {
+      this.log.append({ principal, cap: 'view', target: '*', outcome: 'refused', detail: 'watch' });
+      return refuse('no view on this Machine');
+    }
+    accept();
+    this.log.append({ principal, cap: 'view', target: '*', outcome: 'watching' });
+    const visible = (pane) => admitted.class === 'operator' || holds(admitted, 'view', '*') || holds(admitted, 'observe', `pane:${pane}`);
+    const intervalMs = Math.max(500, Math.min(Number(stream.params.intervalMs) || 1000, 10_000));
+    let last = new Map();
+    let lastPorts = '';
+    const tick = async () => {
+      if (stream.closed) return;
+      try {
+        const rows = (await this.#dispatch(entry, 'panes.list', {})).filter((r) => r.pane && visible(r.pane));
+        const now = new Map(rows.map((r) => [r.pane, r]));
+        const ports = this.listPorts().filter((p) => (p.pane ? visible(p.pane) : admitted.class === 'operator' || holds(admitted, 'view', '*') || holds(admitted, 'ports', `port:*/${p.port}`)));
+        const portsKey = JSON.stringify(ports);
+        if (last.size === 0 && lastPorts === '') {
+          stream.write(JSON.stringify({ type: 'snapshot', panes: rows, ports, at: Date.now() }));
+        } else {
+          const deltas = [];
+          for (const [pane, row] of now) {
+            const before = last.get(pane);
+            if (!before) deltas.push({ kind: 'pane-added', pane, row });
+            else if (JSON.stringify(before) !== JSON.stringify(row)) deltas.push({ kind: 'pane-changed', pane, row, was: { attention: before.attention, title: before.title, suspended: before.suspended } });
+          }
+          for (const pane of last.keys()) if (!now.has(pane)) deltas.push({ kind: 'pane-gone', pane });
+          if (portsKey !== lastPorts) deltas.push({ kind: 'ports', ports });
+          if (deltas.length) stream.write(JSON.stringify({ type: 'delta', deltas, at: Date.now() }));
+        }
+        last = now; lastPorts = portsKey;
+      } catch (error) {
+        if (!stream.closed) stream.write(JSON.stringify({ type: 'error', message: error.message }));
+      }
+    };
+    await tick();
+    const timer = setInterval(tick, intervalMs);
+    stream.on('close', () => clearInterval(timer));
+  }
+
+  #serveNodeRpc(entry, stream) {
+    let buffer = '';
+    stream.on('data', async (chunk) => {
+      buffer += chunk;
+      let nl;
+      while ((nl = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, nl);
+        buffer = buffer.slice(nl + 1);
+        if (!line) continue;
+        let request;
+        try { request = JSON.parse(line); } catch { continue; }
+        const startedAt = Date.now();
+        // A reply to a stream the caller closed mid-door is dropped, never thrown: a throw here
+        // would reject the data listener and take the daemon down with it.
+        const reply = (envelope) => { if (stream.closed) return; try { stream.write(JSON.stringify(envelope) + '\n'); } catch { /* peer gone */ } };
+        try {
+          // Every door answers or fails within a bound; a hung substrate call becomes an error, never silence.
+          // The caller may shorten the bound, never lengthen it past the daemon's own 30 s.
+          const bound = Math.min(Number(request.params?.timeoutMs) || 30_000, 30_000);
+          const result = await withTimeout(this.#dispatch(entry, request.method, request.params ?? {}), bound, request.method);
+          reply({ id: request.id, result });
+          this.emit('door', { method: request.method, ms: Date.now() - startedAt, outcome: 'ok' });
+        } catch (error) {
+          this.emit('door', { method: request.method, ms: Date.now() - startedAt, outcome: error.code ?? 'error', detail: error.message });
+          reply({ id: request.id, error: { code: error.code ?? -1, message: error.message } });
+        }
+      }
+    });
+  }
+
+  async #dispatch(entry, method, params) {
+    // A server-forwarded caller is re-admitted on every door: a grant revoked or expired
+    // since the stream opened stops mattering NOW, not at the next stream.
+    if (entry.verify) {
+      const fresh = await entry.verify();
+      if (!fresh) {
+        this.log.append({ principal: entry.principal, cap: method, target: '*', outcome: 'refused', detail: 'no live machine grant' });
+        throw Object.assign(new Error('no live machine grant'), { code: 403 });
+      }
+      entry.admitted = fresh;
+    }
+    const { admitted, principal } = entry;
+    const operator = admitted.class === 'operator';
+    const need = (cap, target) => {
+      if (!holds(admitted, cap, target)) {
+        this.log.append({ principal, cap, target, outcome: 'refused' });
+        throw Object.assign(new Error(`no ${cap} on ${target}`), { code: 403 });
+      }
+    };
+    const act = (cap, target, outcome = 'ok', detail = null) => this.log.append({ principal, cap, target, outcome, detail });
+
+    switch (method) {
+      case 'describe':
+        return this.describe();
+      case 'panes.list': {
+        // A participant lists the panes its grants let it observe; view on the whole
+        // machine (or operator) lists them all.
+        const whole = operator || holds(admitted, 'view', '*');
+        if (!whole && !observesPanes(admitted)) need('view', '*');
+        const shown = (pane) => whole || holds(admitted, 'observe', `pane:${pane}`);
+        const titles = readJson(this.p.titles, { v: 1, titles: {} }).titles;
+        // Every row carries its attention because the evidence is already in
+        // hand here: a list that made a caller ask a second door "and is anything
+        // wrong with these?" would be a list that knows and will not say.
+        const rows = await this.attentionEvidence();
+        // `title` is what a viewer should show: the override if one is set, else the tmux label.
+        return rows.filter((row) => row.session.id && shown(row.session.contextKey)).map(({ session: s, attention, rank, notify, evidence }) => ({
+          pane: s.contextKey, label: s.label, title: titles[`pane:${s.contextKey}`] ?? s.label, cwd: s.cwd, owned: s.owned, activeCommand: s.activeCommand, size: s.size, suspended: this.suspended.has(s.contextKey),
+          attention, rank, notify, evidence,
+        }));
+      }
+      case 'launch': {
+        // A pane launch. Operators only; the body may carry secrets and is never logged.
+        if (!operator) throw Object.assign(new Error('launch is for operators'), { code: 403 });
+        const key = params.key ?? `lk_${randomBytes(9).toString('base64url')}`;
+        const existing = this.launches.find(key);
+        // A key whose launch is in flight, or whose pane still lives, is reused; a failed
+        // launch, or one whose pane has ended, may be launched again.
+        if (existing && (existing.status === 'issued' || (existing.status === 'ready' && await this.#paneByContext(existing.pane)))) {
+          return { key, pane: existing.pane, reused: true, status: existing.status };
+        }
+        const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
+        this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'issued' });
+        let session;
+        try {
+          session = await this.host.createSession({
+            command: { program: params.program, arguments: params.arguments ?? [] },
+            contextKey,
+            cwd: params.cwd,
+            env: this.#paneEnv(contextKey, params.env),
+            name: params.name ?? contextKey,
+          });
+        } catch (error) {
+          this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'failed', error: error.message });
+          act('launch', `pane:${contextKey}`, 'failed', error.code ?? error.message);
+          throw error;
+        }
+        this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'ready' });
+        act('launch', `pane:${contextKey}`, 'ok', params.kind ?? params.program);
+        // The first input is delivered when the pane can TAKE it, not when the
+        // pane exists: a program that is still painting its banner has no
+        // input box yet, and text sent into one lands half in the scrollback and
+        // half in a composer that never sees the submit. The wait runs past this
+        // reply — a cold TUI outlasts the caller's own RPC timeout — and its
+        // outcome is recorded against the launch key, so `launches.get|list`
+        // answers "did my message go in, and was it late?" without anyone
+        // reading the screen.
+        if (params.initialInput) this.#deliverInitialInput({ key, contextKey, session, kind: params.kind ?? null, input: params.initialInput, act });
+        return { key, pane: contextKey, reused: false, status: 'ready' };
+      }
+      case 'launches.get': {
+        if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
+        const found = this.launches.find(params.key);
+        if (!found) return null;
+        const session = await this.#paneByContext(found.pane);
+        return {
+          key: found.key, pane: found.pane, live: Boolean(session), label: session?.label ?? null, activeCommand: session?.activeCommand ?? null,
+          ...initialInputFacts(found),
+        };
+      }
+      case 'launches.list': {
+        // Everything this daemon launched, by key, with whether the pane still lives: how an
+        // operator tells its own launches from a person's panes without reading labels.
+        if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
+        const rows = [];
+        for (const found of this.launches.all()) {
+          const session = found.pane ? await this.#paneByContext(found.pane) : null;
+          rows.push({ key: found.key, pane: found.pane ?? null, kind: found.kind ?? null, status: found.status ?? null, at: found.t, live: Boolean(session), ...initialInputFacts(found) });
+        }
+        return rows;
+      }
+      case 'panes.close': {
+        need(operator ? 'control' : 'control', `pane:${params.pane}`);
+        const session = await this.#paneByContext(params.pane);
+        if (!session) throw new Error(`no pane with context ${params.pane}`);
+        this.host.closeSession(session.id);
+        act('close', `pane:${params.pane}`);
+        return { closed: params.pane };
+      }
+      case 'panes.suspend': case 'panes.resume': {
+        // a holder of `control` (an operator always) stops REMOTE input on a
+        // pane — attachments keep streaming output and `panes.capture` keeps
+        // working, only `{input}` is refused — until `resume`, which may carry
+        // the input that hands the pane back. Local tmux input is never touched.
+        need('control', `pane:${params.pane}`);
+        const session = await this.#paneByContext(params.pane);
+        if (!session) throw new Error(`no pane with context ${params.pane}`);
+        const doc = readJson(this.p.suspended, { v: 1, panes: {} });
+        if (method === 'panes.suspend') {
+          this.suspended.add(params.pane);
+          doc.panes[params.pane] = { at: Date.now(), by: principal };
+          if (params.interrupt) await this.host.sendInput(session.id, '\u0003', { submitMode: 'single' });
+        } else {
+          this.suspended.delete(params.pane);
+          delete doc.panes[params.pane];
+          if (params.input) await this.host.sendInput(session.id, submission(params.input), { submitMode: params.submitMode ?? 'single' });
+        }
+        writeJson(this.p.suspended, doc);
+        act(method, `pane:${params.pane}`, 'ok', method === 'panes.resume' && params.input ? 'with input' : null);
+        return { pane: params.pane, suspended: method === 'panes.suspend' };
+      }
+      case 'panes.input': {
+        // Input as a request (the terminal host's own sendInput, with its paste/settle/submit
+        // mechanics) for callers that are services rather than terminals. Same gate as an
+        // attachment in control mode, same suspend rule as remote input everywhere.
+        need('control', `pane:${params.pane}`);
+        const session = await this.#paneByContext(params.pane);
+        if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
+        if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });
+        // `deadlineMs` is how long the caller will wait (default 10 s, which covers `retry`'s 5.5 s of
+        // submit presses; at most 30 s); the terminal host takes an absolute deadline.
+        const delivery = await this.host.sendInput(session.id, submission(params.text, params.submit !== false), { submitMode: params.submit === false ? 'single' : 'retry', deadlineMs: Date.now() + Math.min(Number(params.deadlineMs) || 10_000, 30_000) });
+        act('control', `pane:${params.pane}`, 'input');
+        return { delivered: true, delivery };
+      }
+      case 'panes.turn': {
+        // A user's own turn, as its own submitted turn: typed only into an empty
+        // composer, read twice so a person who just started typing is not typed
+        // over. A draft, or a screen with no composer (a menu, a dialog), is an
+        // answer, not an error: the caller keeps the turn and asks again. Its own
+        // method, so a daemon without it refuses instead of typing into a draft.
+        need('control', `pane:${params.pane}`);
+        const session = await this.#paneByContext(params.pane);
+        if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
+        if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });
+        const kind = this.#paneKind(params.pane, session);
+        const draftOf = () => composerHoldsDraft(kind, this.host.capture(session.id, { lines: 200, preserveEscapes: true }));
+        const first = draftOf();
+        await new Promise((resolve) => setTimeout(resolve, COMPOSER_RECHECK_MS));
+        const second = draftOf();
+        if (first !== false || second !== false) {
+          return { delivered: false, reason: first === true || second === true ? 'draft' : 'no-composer' };
+        }
+        const delivery = await this.host.sendInput(session.id, submission(params.text, true), { submitMode: 'single', deadlineMs: Date.now() + 10_000 });
+        act('control', `pane:${params.pane}`, 'input');
+        return { delivered: true, delivery };
+      }
+      case 'panes.capture': {
+        need('observe', `pane:${params.pane}`);
+        const session = await this.#paneByContext(params.pane);
+        if (!session) throw new Error(`no pane with context ${params.pane}`);
+        return { text: this.host.capture(session.id, { lines: params.lines ?? 200 }) };
+      }
+      case 'files.stat': case 'files.list': case 'files.read': case 'files.write': case 'files.mkdir': case 'files.rename': case 'files.delete': case 'files.search': {
+        // Authorize the REAL path: a symlink under a granted root must not reach outside it. Reading (stat, list,
+        // read, search) is `files` or `observe` on the root, as observing a pane is reading it; changing is `files`.
+        const path = realOrResolved(params.path);
+        const reads = method === 'files.stat' || method === 'files.list' || method === 'files.read' || method === 'files.search';
+        if (!(reads && holds(admitted, 'observe', `root:${path}`))) need('files', `root:${path}`);
+        // A rename's destination is a write to a second path: it is authorized on its own.
+        const to = params.to ? realOrResolved(params.to) : null;
+        if (to) need('files', `root:${to}`);
+        const outcome = await filesOp(method, { ...params, path }, to);
+        act('files', `root:${path}`, 'ok', method);
+        return outcome;
+      }
+      case 'ports.list': {
+        // Operators see every port; a participant sees the ports its grants reach.
+        if (operator) return this.listPorts();
+        const reach = (p) => holds(admitted, 'ports', `port:${p.pane ?? '*'}/${p.port}`) || (p.pane && holds(admitted, 'ports', `pane:${p.pane}`));
+        const shown = this.listPorts().filter(reach);
+        if (!shown.length && !admitted.grants.some((g) => g.caps.includes('ports'))) need('ports', 'port:*');
+        return shown;
+      }
+      case 'ports.resolve': {
+        // One pane's announced port, for a caller holding `ports` on that pane.
+        if (typeof params.pane !== 'string' || !params.pane) throw Object.assign(new Error('ports.resolve needs a pane'), { code: 400 });
+        if (!operator) need('ports', `pane:${params.pane}`);
+        return this.listPorts().find((entry) => entry.pane === params.pane) ?? null;
+      }
+      case 'attention.request': case 'attention.clear': {
+        // The declaration rung: somebody SAYS this pane needs a human. The
+        // urgency and the reason ride with the record and reach the evidence
+        // verbatim — the daemon never grades a reason, and `now` versus `whenever`
+        // is the caller's claim about their own work, not a label we infer.
+        need('interact', `pane:${params.pane}`);
+        const doc = this.attentionDoc();
+        if (method === 'attention.request') doc.requests[params.pane] = { urgency: params.urgency ?? 'soon', reason: params.reason ?? null, at: Date.now(), by: principal };
+        else delete doc.requests[params.pane];
+        writeJson(this.p.attention, doc);
+        act(method, `pane:${params.pane}`, 'ok', method === 'attention.request' ? (params.urgency ?? 'soon') : null);
+        return { ok: true };
+      }
+      case 'attention.list': {
+        // The standing declarations, as recorded. The computed view is
+        // `attention.snapshot`; this door stays the raw map so a caller asking
+        // "what did anyone ASK for" is never handed an inference as an answer.
+        if (!operator) need('view', '*');
+        return this.attentionDoc().requests;
+      }
+      case 'attention.snapshot': {
+        // The label for every pane, from the evidence and the table, computed
+        // here on the Machine. It carries `notify` — whether this label is
+        // the kind that warrants interrupting a human — and stops there: who is
+        // paged, and whether they already know, is the consumer's.
+        if (!operator) need('view', '*');
+        const rows = await this.attentionEvidence();
+        return rows.map(({ session, attention, rank, notify, evidence }) => ({ pane: session.contextKey, attention, rank, notify, evidence }));
+      }
+      case 'attention.rank': {
+        // The rank table as this Machine reads it — the configuration the label
+        // is a function of, so a caller surprised by a label can see the
+        // precedence that produced it rather than guess at a default.
+        if (!operator) need('view', '*');
+        return this.attentionDoc().rank;
+      }
+      case 'title.set': {
+        // The title is a teams file, never a store in core. A pane the daemon
+        // owns also gets the name in tmux, so the rename is visible to anyone
+        // looking at the tmux server rather than only through this door.
+        need('control', params.target);
+        const doc = readJson(this.p.titles, { v: 1, titles: {} });
+        if (params.title == null) delete doc.titles[params.target]; else doc.titles[params.target] = params.title;
+        writeJson(this.p.titles, doc);
+        const renamed = params.target.startsWith('pane:') ? await this.#renameWindow(params.target.slice(5), params.title) : null;
+        act('title', params.target, 'ok', renamed);
+        return { ok: true, target: params.target, title: params.title ?? null, window: renamed };
+      }
+      case 'jobs.list': {
+        // The execution jobs this daemon owns now (execution.mjs): a pilot changes its binding
+        // only when the target it leaves and the one it takes run none.
+        if (!operator) throw Object.assign(new Error('jobs are for operators'), { code: 403 });
+        return { jobs: [...(this.jobs?.live.values() ?? [])].map(({ id, kind, cgroup, at }) => ({ id, kind, contained: Boolean(cgroup), at })) };
+      }
+      case 'title.list': {
+        // Operators and whole-machine viewers see every title; others see the titles of targets they observe.
+        const titles = readJson(this.p.titles, { v: 1, titles: {} }).titles;
+        if (operator || holds(admitted, 'view', '*')) return titles;
+        if (!observesPanes(admitted)) need('view', '*');
+        return Object.fromEntries(Object.entries(titles).filter(([target]) => holds(admitted, 'observe', target)));
+      }
+      default:
+        throw Object.assign(new Error(`unknown method ${method}`), { code: -32601 });
+    }
+  }
+}
+
+// ---- helpers ------------------------------------------------------------------
+
+/** The shells a pane may be sitting in. `activeCommand` is tmux's
+ *  `pane_current_command`: the name of the process in the foreground of the
+ *  pane's tty. When that is the pane's own shell, no command is running and the
+ *  shell is at its prompt; when it is anything else, that thing is the work. The
+ *  list is names, not paths, because that is the form tmux reports. */
+const PANE_SHELLS = new Set(['ash', 'bash', 'csh', 'dash', 'fish', 'ksh', 'ksh93', 'nu', 'pwsh', 'sh', 'tcsh', 'xonsh', 'zsh']);
+
+/** Liveness of a live pane from its foreground command (attention.mjs LIVENESS).
+ *  A missing or empty value is `unknown`, the honest floor: tmux named nothing,
+ *  which is absence of evidence and never reported as `running`. */
+/** A pane's liveness from the harness session running in it, or null when
+ *  the harness has no trustworthy turn state (the process tree answers then). */
+function harnessLiveness(activity) {
+  if (!activity || activity.presence !== 'running') return null;
+  if (activity.turn === 'working') return { liveness: 'running' };
+  if (activity.turn === 'idle') return { liveness: 'waiting' };
+  if (activity.turn === 'needs_input') return { liveness: 'waiting', signal: 'asking' };
+  return null;
+}
+
+function livenessOf(activeCommand) {
+  if (typeof activeCommand !== 'string' || activeCommand.trim() === '') return 'unknown';
+  const name = activeCommand.trim().replace(/^-/, '').split('/').pop();
+  return PANE_SHELLS.has(name) ? 'waiting' : 'running';
+}
+
+/** The label, its rank and its notify flag, with the evidence tagged by the rung
+ *  that decided it — the shape every attention-bearing row carries. */
+function judged(evidence, rankTable) {
+  const verdict = judge(evidence, rankTable);
+  return {
+    attention: verdict.attention,
+    rank: verdict.rank,
+    notify: verdict.notify,
+    evidence: { ...evidence, source: verdict.source },
+  };
+}
+
+/** Text a door delivers as one message: the terminal host submits (a paste, then Enter) only
+ *  text that ends in a newline and types anything else as keystrokes, so a door that promises
+ *  a submission ends the text with exactly one, and `submit: false` leaves it without. */
+function submission(text, submit = true) {
+  const body = String(text ?? '').replace(/(?:\r\n|\n|\r)+$/u, '');
+  return submit ? `${body}\n` : body;
+}
+
+/** Characters of a harness line sent per channel frame. A frame is capped at 8 MiB,
+ *  and one answer (a whole machine's `sessions.discover`) can be larger; the reader
+ *  joins a stream's chunks back into lines, so a long line travels as several frames.
+ *  512 Ki characters stay under the cap even when every one needs four bytes. */
+const LINE_CHUNK = 512 * 1024;
+
+/** Write one JSON line to a harness stream, in as many frames as it needs. */
+function writeLine(stream, line) {
+  const text = line + '\n';
+  for (let at = 0; at < text.length; at += LINE_CHUNK) stream.write(text.slice(at, at + LINE_CHUNK));
+}
+
+/** What a launch record says about its first input, for the rows `launches.get`
+ *  and `launches.list` return. Absent from a launch that carried no
+ *  `initialInput`, and absent while one is still waiting for its pane — a
+ *  launch that has not answered yet must not read as one that answered "no". */
+function initialInputFacts(record) {
+  if (record?.inputDelivered === undefined) return {};
+  return {
+    inputDelivered: Boolean(record.inputDelivered),
+    inputReadyBy: record.inputReadyBy ?? null,
+    ...(record.inputDeliveredLate ? { inputDeliveredLate: true } : {}),
+    ...(record.inputError ? { inputError: record.inputError } : {}),
+  };
+}
+
+/**
+ * The path a `files.*` door authorizes: the real path when it exists (so a symlink under a granted
+ * root cannot point outside it), else the resolved path with its deepest existing ancestor made real.
+ */
+function realOrResolved(candidate) {
+  const resolved = resolve(String(candidate ?? ''));
+  try { return realpathSync(resolved); } catch { /* not there yet: a write or mkdir target */ }
+  let dir = dirname(resolved);
+  while (dir !== dirname(dir)) {
+    try { return join(realpathSync(dir), resolved.slice(dir.length)); } catch { dir = dirname(dir); }
+  }
+  return resolved;
+}
+
+function withTimeout(promise, ms, label) {
+  let timer;
+  const bound = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(Object.assign(new Error(`${label} did not answer within ${ms} ms`), { code: 504 })), ms);
+  });
+  return Promise.race([promise, bound]).finally(() => clearTimeout(timer));
+}
+
+/** Connection id of the daemon's own requests to its `harness serve`. */
+const INTERNAL_CONNECTION = -1;
+
+function joinId(conn, id) { return `${conn}:${typeof id === 'string' ? 's' : 'n'}:${id}`; }
+function splitId(id) {
+  if (typeof id !== 'string') return [null, id];
+  const first = id.indexOf(':');
+  const second = id.indexOf(':', first + 1);
+  if (first < 0 || second < 0) return [null, id];
+  const conn = Number(id.slice(0, first));
+  const kind = id.slice(first + 1, second);
+  const rest = id.slice(second + 1);
+  return [conn, kind === 'n' ? Number(rest) : rest];
+}
+
+/** A `ws`-shaped socket over a channel stream, for the terminal substrate. */
+class ChannelWebSocket extends EventEmitter {
+  constructor(stream) {
+    super();
+    this.OPEN = 1;
+    this.CLOSED = 3;
+    this.readyState = 1;
+    this.stream = stream;
+    stream.on('data', (chunk) => {
+      // Inbound from the caller: JSON {input} | {resize}. The substrate wants {type:'input',data} | {type:'resize',cols,rows}.
+      let message;
+      try { message = JSON.parse(chunk); } catch { return; }
+      if (message.input !== undefined) this.emit('message', Buffer.from(JSON.stringify({ type: 'input', data: message.input })));
+      else if (message.resize) this.emit('message', Buffer.from(JSON.stringify({ type: 'resize', cols: message.resize.cols, rows: message.resize.rows })));
+    });
+    stream.on('close', () => { this.readyState = 3; this.emit('close'); });
+  }
+  send(data) {
+    if (this.readyState !== 1) return;
+    const bytes = Buffer.isBuffer(data) ? data : Buffer.from(String(data), 'utf8');
+    this.stream.write(bytes.toString('base64'));
+  }
+  close(code, reason) {
+    if (this.readyState === 3) return;
+    this.readyState = 3;
+    this.stream.close(reason ? String(reason) : null);
+    this.emit('close');
+  }
+}
+
+/**
+ * The suspend gate. It is a socket in front of a socket: the substrate
+ * (tmux-stream) sees an ordinary ws-shaped peer, and the only difference is
+ * that an `input` message arriving while the pane is suspended never reaches
+ * it — the sender gets one `notice` frame instead.
+ */
+class SuspendGate extends EventEmitter {
+  constructor(inner, { suspended, notice }) {
+    super();
+    this.inner = inner;
+    this.OPEN = 1;
+    this.CLOSED = 3;
+    inner.on('message', (raw) => {
+      let type = null;
+      try { type = JSON.parse(raw.toString()).type; } catch { /* not ours to parse */ }
+      if (type === 'input' && suspended()) {
+        this.send(JSON.stringify({ type: 'notice', message: notice }));
+        return;
+      }
+      this.emit('message', raw);
+    });
+    inner.on('close', () => this.emit('close'));
+  }
+  get readyState() { return this.inner.readyState; }
+  send(data) { this.inner.send(data); }
+  close(code, reason) { this.inner.close(code, reason); }
+}
+
+async function filesOp(method, params, to) {
+  const path = params.path;
+  switch (method) {
+    case 'files.stat': {
+      const s = statSync(path);
+      return { path, size: s.size, mode: s.mode, mtimeMs: s.mtimeMs, kind: s.isDirectory() ? 'directory' : s.isFile() ? 'file' : 'other' };
+    }
+    case 'files.list':
+      return readdirSync(path, { withFileTypes: true }).map((d) => ({ name: d.name, kind: d.isDirectory() ? 'directory' : d.isFile() ? 'file' : 'other' }));
+    case 'files.read': {
+      const fd = openSync(path, 'r');
+      try {
+        // One read is at most 8 MiB (RH2's transfer chunks at 8 MiB); a caller asks again for more.
+        const length = Math.min(Number(params.length) || statSync(path).size, 8 * 1024 * 1024);
+        const buffer = Buffer.alloc(length);
+        const read = readSync(fd, buffer, 0, length, params.offset ?? 0);
+        return { bytes: buffer.subarray(0, read).toString('base64'), read };
+      } finally { closeSync(fd); }
+    }
+    case 'files.write': {
+      const bytes = Buffer.from(params.bytes ?? '', 'base64');
+      mkdirSync(dirname(path), { recursive: true });
+      if (params.truncate || params.offset == null) writeFileSync(path, bytes, { mode: params.mode ?? 0o644 });
+      else {
+        const fd = openSync(path, 'r+');
+        try { writeSync(fd, bytes, 0, bytes.length, params.offset); } finally { closeSync(fd); }
+      }
+      return { written: bytes.length };
+    }
+    case 'files.mkdir':
+      mkdirSync(path, { recursive: true, mode: params.mode ?? 0o755 });
+      return { ok: true };
+    case 'files.rename':
+      renameSync(path, to);
+      return { ok: true };
+    case 'files.delete':
+      rmSync(path, { recursive: Boolean(params.recursive), force: false });
+      return { ok: true };
+    case 'files.search': {
+      const needle = String(params.query ?? '').toLowerCase();
+      const out = [];
+      const walk = (dir, depth) => {
+        // Bounded walk: depth ≤ 16, results ≤ 1000, whatever the caller asks.
+        if (depth > Math.min(Number(params.maxDepth) || 8, 16) || out.length >= Math.min(Number(params.limit) || 200, 1000)) return;
+        for (const d of readdirSync(dir, { withFileTypes: true })) {
+          const full = join(dir, d.name);
+          if (d.name.toLowerCase().includes(needle)) out.push({ path: full, kind: d.isDirectory() ? 'directory' : 'file' });
+          if (d.isDirectory() && d.name !== 'node_modules' && d.name !== '.git') walk(full, depth + 1);
+        }
+      };
+      walk(path, 0);
+      return out;
+    }
+    default:
+      throw new Error(`unknown files op ${method}`);
+  }
+}
+/**
+ * The live port table: one JSON file per announced port under <home>/ports.
+ * A hook that was killed before its exit handler ran leaves its file behind, so the
+ * table is swept here — an entry whose pid is gone is neither returned nor kept.
+ */
+function listAnnouncedPorts(dir) {
+  if (!existsSync(dir)) return [];
+  const out = [];
+  for (const name of readdirSync(dir)) {
+    if (!name.endsWith('.json')) continue;
+    const file = join(dir, name);
+    try {
+      const entry = JSON.parse(readFileSync(file, 'utf8'));
+      if (!alive(entry.pid)) { rmSync(file, { force: true }); continue; }
+      out.push({ port: entry.port, pid: entry.pid, pane: entry.pane ?? null, label: entry.label ?? null, kind: entry.kind ?? 'http', at: entry.at ?? null });
+    } catch { /* a half-written announce file is skipped */ }
+  }
+  return out;
+}
+
+/** A socket file left by a daemon that is gone is removed; one a live daemon answers on is not ours to take. */
+/** Signal 0: does this pid still exist? EPERM means it does, under another uid. */
+function alive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+}
+
+export { listAnnouncedPorts };