@volter/supercode-teams 0.2.32 → 0.2.34

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 supercode contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bin/workspace/args.mjs

@@ -11,7 +11,7 @@ const VALUES = new Set([
   'out', 'ttl', 'type', 'name', 'visibility', 'backfill', 'format', 'to',
   'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session',
   'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'delegated-issuer', 'workplace', 'organization', 'key', 'room',
-  'conversation', 'rh2',
+  'conversation', 'rh2', 'scope',
 ]);
 
 export function parseArgs(argv) {

package/bin/workspace.mjs

@@ -758,7 +758,7 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
  * `--workplace-only`. `unpublish --record-only` deletes the record here and leaves the workplace alone.
  */
 async function publishCommand(verb, sub, { flags, rest, output, context, team, client, home, env }) {
-  only(flags, ['json', 'help', 'context', 'room', 'workplace', 'organization', 'name', 'key', 'machine', 'token_stdin', 'record_only', 'workplace_only']);
+  only(flags, ['json', 'help', 'context', 'room', 'workplace', 'organization', 'name', 'key', 'machine', 'token_stdin', 'record_only', 'workplace_only', 'scope']);
   const recordOnly = Boolean(flags.record_only);
   if (!flags.room || !flags.workplace || (!recordOnly && !flags.organization)) usage(`teams ${verb} needs --room ROOM --workplace ORIGIN --organization ORG`);
   const workplace = new URL(flags.workplace).origin;
@@ -807,7 +807,9 @@ async function publishCommand(verb, sub, { flags, rest, output, context, team, c
   const key = flags.key ?? `${sub === 'pane' ? 'pane' : 'folder'}-${label.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 48) || createHash('sha256').update(target).digest('hex').slice(0, 8)}`;
   const kind = sub === 'pane' ? 'pane' : 'folder';
   const existed = (await recorded()).some(item => item.target === target && item.workplace === workplace && item.room === flags.room);
-  const publication = (await client.request('POST', publications, { body: { kind, target, workplace, room: flags.room, surface_key: key } })).data;
+  // --scope view caps what the workplace's tokens can open the surface as (they can watch it, not drive it).
+  if (flags.scope !== undefined && flags.scope !== 'view' && flags.scope !== 'control') usage('--scope must be view or control');
+  const publication = (await client.request('POST', publications, { body: { kind, target, workplace, room: flags.room, surface_key: key, ...(flags.scope ? { max_scope: flags.scope } : {}) } })).data;
   if (recordOnly) return output({ version: 1, context: scope(context), data: { publication } });
   let payload;
   try {
@@ -913,7 +915,7 @@ function printHelp() {
   login [ORIGIN] [--team TEAM] [--as CONTEXT] [--token-stdin|--invite-stdin]   (Volter sign-in in the browser by default)
   identity link
   server start [--volter-issuer ORIGIN] [--delegated-issuer ORIGIN]
-  publish pane|root TARGET --room ROOM --workplace ORIGIN --organization ORG [--name] [--key] [--machine] [--token-stdin] [--record-only]
+  publish pane|root TARGET --room ROOM --workplace ORIGIN --organization ORG [--scope view|control] [--name] [--key] [--machine] [--token-stdin] [--record-only]
   unpublish SURFACE --room ROOM --workplace ORIGIN --organization ORG [--machine] [--token-stdin] [--record-only|--workplace-only]
   connect|disconnect|status
   members invite|list|remove|role

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.32",
+  "version": "0.2.34",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -39,6 +39,7 @@
     "supercode-teams-fleet": "./bin/fleet.mjs"
   },
   "files": [
+    "LICENSE-MIT",
     "*.mjs",
     "workspace-client.d.ts",
     "porthole-hook.cjs",

package/worker/wrangler.toml

@@ -1,22 +1,22 @@
 # A hosted Teams server on Cloudflare: one Worker, one Durable Object (SQLite).
 #   supercode teams server token | npx wrangler secret put SUPERCODE_TEAMS_BOOTSTRAP_TOKEN
-#   npx wrangler deploy --config sdk/teams/worker/wrangler.toml
-# Set name and PUBLIC_ORIGIN for your deployment; the token printed above is the
-# owner's first credential (`supercode teams login <origin> --token-stdin`).
+#   npx wrangler deploy --config sdk/teams/worker/wrangler.toml --name <worker> \
+#     --var PUBLIC_ORIGIN:https://<worker>.<account>.workers.dev --var INIT_TEAM:<first team>
+# The token printed above is the owner's first credential (`supercode teams login <origin> --token-stdin`).
+#
+# A deployment's variables live with the deployment (the first deploy's --var, or the dashboard), not here:
+# keep_vars leaves them in place, so a later deploy of new code never resets its origin or issuers.
+#   PUBLIC_ORIGIN     the https origin the Worker is served at (required)
+#   INIT_TEAM         the first team's name, used once at bootstrap
+#   VOLTER_ISSUER     optional: members sign in with Volter (supercode teams login --volter); the issuer
+#                     must have this origin registered as a resource
+#   DELEGATED_ISSUER  optional: a workplace (RH2) whose delegated tokens open published panes and folders and
+#                     bound sessions; its keys are at <issuer>/.well-known/jwks.json
 name = "supercode-teams"
 main = "index.mjs"
 compatibility_date = "2026-09-01"
 compatibility_flags = ["nodejs_compat"]
-
-[vars]
-PUBLIC_ORIGIN = "https://supercode-teams.example.workers.dev"
-INIT_TEAM = "Team"
-# Optional: members sign in with Volter (supercode teams login --volter); the
-# issuer must have this origin registered as a resource.
-# VOLTER_ISSUER = "https://id.volter.ai"
-# Optional: a workplace (RH2) whose delegated tokens open one pane or folder in the
-# hosted viewer (/view); its keys are at <issuer>/.well-known/jwks.json.
-# DELEGATED_ISSUER = "https://pilot.runhuman.com"
+keep_vars = true
 
 [[durable_objects.bindings]]
 name = "TEAMS_SERVER"