@volter/supercode-teams 0.2.36 → 0.2.37

package/connector/index.mjs

@@ -151,7 +151,13 @@ export class TeamsConnector {
       if (running || this.abort.signal.aborted) return null;
       running = true;
       const run = (async () => { this.localRoots = await roots(); await pass(); })();
-      void run.catch(error => { this.lastError = error; }).finally(() => { running = false; });
+      // A pass that fails is said in the connector's log (once per distinct failure): nothing syncs until it passes.
+      void run.catch(error => {
+        this.lastError = error;
+        const said = `${error?.code ?? ''} ${error?.message ?? error}`;
+        if (said !== this.lastPassFailure) process.stderr.write(`supercode teams: a sync pass failed: ${error?.message ?? error}\n`);
+        this.lastPassFailure = said;
+      }).then(() => { if (run && !this.lastError) this.lastPassFailure = null; }).finally(() => { running = false; });
       return run;
     };
     /** The first sync pass, for a caller that waits on it; the connector keeps running if it fails. */

package/machine.mjs

@@ -68,6 +68,31 @@ const COMPOSER_RECHECK_MS = 400;
  *  must have stopped changing for this long before the pane counts as ready. */
 const INITIAL_INPUT_SETTLE_MS = 1_000;
 
+/**
+ * Claude asks whether to trust a folder it has not opened before, whatever its permission mode, and has no flag that
+ * skips the question; its default answer exits, taking the pane with it. A Claude this machine launches without
+ * prompts has its folder recorded as trusted in this machine's Claude config (`projects[<folder>]` in .claude.json,
+ * keyed as Claude keys it: the real path, with forward slashes on Windows), as a Codex launch has its trust passed on
+ * its command line. A whole new file is renamed over the old one, since Claude rewrites it while it runs.
+ */
+function trustClaudeFolder(cwd) {
+  try {
+    const config = join(process.env.CLAUDE_CONFIG_DIR || homedir(), '.claude.json');
+    const real = realpathSync(cwd);
+    const folder = process.platform === 'win32' ? real.replace(/^\\\\\?\\/, '').replaceAll('\\', '/') : real;
+    let root = {};
+    try { root = JSON.parse(readFileSync(config, 'utf8')); } catch (error) { if (error.code !== 'ENOENT') return; }
+    if (!root || typeof root !== 'object' || Array.isArray(root)) return;
+    const projects = root.projects ??= {};
+    const project = projects[folder] ??= {};
+    if (project.hasTrustDialogAccepted === true) return;
+    project.hasTrustDialogAccepted = true;
+    const staged = `${config}.supercode-${process.pid}`;
+    writeFileSync(staged, JSON.stringify(root, null, 2));
+    renameSync(staged, config);
+  } catch { /* Claude asks as it always did */ }
+}
+
 /** How long a launch watches its new pane before answering, so a program that ends at once is reported. */
 const LAUNCH_SETTLE_MS = 500;
 
@@ -353,9 +378,10 @@ export class TeamsMachine extends MachineCore {
     // receiver named rather than addressed needs `mail:*`.
     const { admitted, principal } = entry;
     const request = stream.params?.request;
+    if (request?.op === 'turn') return this.#serveTurn(entry, request, stream, accept, refuse);
     const to = typeof request?.to === 'string' ? request.to : '*';
     const target = to.startsWith('sc:') ? `mail:${to}` : 'mail:*';
-    if (!request || !['send', 'file', 'list'].includes(request.op)) return refuse('mail needs a send, file or list request');
+    if (!request || !['send', 'file', 'list'].includes(request.op)) return refuse('mail needs a send, file, list or turn request');
     if (!holds(admitted, 'mail', target)) {
       this.log.append({ principal, cap: 'mail', target, outcome: 'refused' });
       return refuse(`no mail grant for ${target}`);
@@ -377,6 +403,37 @@ export class TeamsMachine extends MachineCore {
     child.stdin.end(JSON.stringify({ ...request, via_principal: principal ?? null }));
   }
 
+  #serveTurn(entry, request, stream, accept, refuse) {
+    // A person's line typed into one session here as that session's own user turn (a Room member in a Conversation
+    // bound to the session): `interact` on `session:<harness>/<id>`. Who typed it comes from the caller's claim
+    // (the name its workplace signed), never from the request.
+    const { admitted, principal } = entry;
+    // A caller the server admitted for one session (a Room member's token) names nothing: its grant names the session.
+    const granted = admitted?.class === 'operator' ? [] : (admitted?.grants ?? []).filter((grant) => grant.caps.includes('interact')).flatMap((grant) => grant.targets).filter((target) => target.startsWith('session:') && target !== 'session:*');
+    const named = typeof request.harness === 'string' && typeof request.session === 'string' ? `${request.harness}/${request.session}` : (granted.length === 1 ? granted[0].slice('session:'.length) : '');
+    const [harness, session] = named.includes('/') ? [named.slice(0, named.indexOf('/')), named.slice(named.indexOf('/') + 1)] : ['', ''];
+    const target = `session:${harness}/${session}`;
+    if (!harness || !session || typeof request.text !== 'string' || !request.text.trim()) return refuse('a turn needs harness, session and text');
+    if (!holds(admitted, 'interact', target)) {
+      this.log.append({ principal, cap: 'interact', target, outcome: 'refused' });
+      return refuse(`no interact grant for ${target}`);
+    }
+    accept();
+    const child = spawn(this.supercodeBin, ['message', 'remote-deliver'], { stdio: ['pipe', 'pipe', 'pipe'], env: this.env });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (chunk) => { out += chunk; });
+    child.stderr.on('data', (chunk) => { err += chunk; });
+    child.on('error', (error) => { err += error.message; });
+    child.on('close', (code) => {
+      this.log.append({ principal, cap: 'interact', target, outcome: code === 0 ? 'turn' : 'failed', detail: err.trim().slice(0, 200) || undefined });
+      if (stream.closed) return;
+      stream.write(out.trim() || JSON.stringify({ code: 1, text: err.trim() || `remote-deliver exited ${code}` }));
+      stream.close('delivered');
+    });
+    child.stdin.end(JSON.stringify({ op: 'turn', harness, session, text: request.text, from_name: entry.name ?? principal ?? 'a Room member', via: 'room' }));
+  }
+
   // ---- terminal ------------------------------------------------------------
 
   async #attachTerminal(entry, stream, accept, refuse) {
@@ -989,6 +1046,7 @@ export class TeamsMachine extends MachineCore {
         }
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
         this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'issued' });
+        if (params.kind === 'claude-code' && params.cwd && (params.arguments ?? []).includes('--dangerously-skip-permissions')) trustClaudeFolder(params.cwd);
         let session;
         try {
           session = await this.host.createSession({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",