@volter/supercode-teams 0.2.36 → 0.2.38

package/connector/index.mjs

@@ -60,6 +60,12 @@ const CHUNK_BYTES=1024*1024;
 // A minute is four beats with no write: the turn is over, or waiting on the user or one long tool call.
 // Smaller files translate in well under a second and keep getting a bundle with every capture.
 const NATIVE_IDLE_MS=60000,NATIVE_IDLE_BYTES=8*1024*1024;
+// Loading a transcript reads all of it, and a live one changes on every message: a 135 MB Claude transcript took
+// over 30 s a load on a Windows PC, on every beat, and translating it held the harness server past 272 s while every
+// other request queued behind. A file of LARGE_CAPTURE_BYTES or more is captured at most once per
+// LARGE_CAPTURE_EVERY_MS (tried or not), its load given a second per megabyte, and one past NATIVE_MAX_BYTES is
+// published without a native bundle, which could not be built in time.
+const LARGE_CAPTURE_BYTES=8*1024*1024,LARGE_CAPTURE_EVERY_MS=5*60000,NATIVE_MAX_BYTES=64*1024*1024;
 const fileStamp=stat=>`${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
 const recordedAt=entry=>{if(Number.isSafeInteger(entry.recorded_at))return entry.recorded_at;if(Number.isSafeInteger(entry.timestamp))return entry.timestamp;const value=entry.metadata?.timestamp??entry.value?.metadata?.timestamp??entry.timestamp;if(typeof value!=='string')return null;const parsed=Date.parse(value);return Number.isSafeInteger(parsed)?parsed:null;};
 const serverOrigin=value=>{const url=new URL(value),loopback=url.hostname==='localhost'||url.hostname==='::1'||url.hostname==='[::1]'||/^127(?:\.\d{1,3}){3}$/.test(url.hostname);if(!['http:','https:'].includes(url.protocol)||url.username||url.password||url.search||url.hash||(url.pathname!==''&&url.pathname!=='/')||(url.protocol==='http:'&&!loopback))throw new TypeError('server must be an HTTPS origin (HTTP is loopback-only)');return url.origin;};
@@ -151,7 +157,13 @@ export class TeamsConnector {
       if (running || this.abort.signal.aborted) return null;
       running = true;
       const run = (async () => { this.localRoots = await roots(); await pass(); })();
-      void run.catch(error => { this.lastError = error; }).finally(() => { running = false; });
+      // A pass that fails is said in the connector's log (once per distinct failure): nothing syncs until it passes.
+      void run.catch(error => {
+        this.lastError = error;
+        const said = `${error?.code ?? ''} ${error?.message ?? error}`;
+        if (said !== this.lastPassFailure) process.stderr.write(`supercode teams: a sync pass failed: ${error?.message ?? error}\n`);
+        this.lastPassFailure = said;
+      }).then(() => { if (run && !this.lastError) this.lastPassFailure = null; }).finally(() => { running = false; });
       return run;
     };
     /** The first sync pass, for a caller that waits on it; the connector keeps running if it fails. */
@@ -392,11 +404,13 @@ export class TeamsConnector {
     if(!configuration)configuration=await this.configuration();const rule=configuration.rules.find(item=>item.id===ruleId&&item.revision===ruleRevision&&item.state==='active');if(!rule)throw Object.assign(new Error('sync rule is absent, inactive, or stale'),{code:'forbidden'});visibility=rule.visibility;
     const artifactSource=locator?.storage?.kind==='file'&&existsSync(locator.storage.path)?realpathSync(locator.storage.path):null;
     const artifactBefore=artifactSource?statSync(artifactSource):null;
-    const loaded=await this.core.session(locator).load(),configuredBackfill=rule.backfill??backfill??'all',backfillPolicy=typeof configuredBackfill==='string'?{mode:configuredBackfill,since:null}:configuredBackfill;
+    const large=(artifactBefore?.size??0)>=LARGE_CAPTURE_BYTES,sessionKey=`${harness}:${nativeSessionId}`;
+    if(large){this.largeCaptures??=new Map();const last=this.largeCaptures.get(sessionKey);if(last!=null&&this.clock.nowMs()-last<LARGE_CAPTURE_EVERY_MS)return null;this.largeCaptures.set(sessionKey,this.clock.nowMs());}
+    const loaded=await this.core.session(locator).load(large?{timeoutMs:Math.max(30000,Math.ceil(artifactBefore.size/(1024*1024))*1000)}:undefined),configuredBackfill=rule.backfill??backfill??'all',backfillPolicy=typeof configuredBackfill==='string'?{mode:configuredBackfill,since:null}:configuredBackfill;
     const key=`${harness}:${nativeSessionId}`,previous=this.state.origins[key]??null;
     let messages=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});
     // A session published without its native bundle is captured again, with the same messages, once the bundle can be built.
-    const nativeWanted=backfillPolicy.mode==='all'&&typeof this.core.translateSession==='function';
+    const nativeWanted=backfillPolicy.mode==='all'&&typeof this.core.translateSession==='function'&&!((artifactBefore?.size??0)>NATIVE_MAX_BYTES);
     const retryNative=Boolean(previous?.native_deferred&&nativeWanted&&artifactBefore?.isFile()&&!previous?.baseline&&this.nativeReady(key,artifactBefore));
     const unchanged=previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&hash(canonicalJson(message.value))===previous.observed_digests?.[index]);
     if(unchanged&&!retryNative){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}

package/machine.mjs

@@ -68,6 +68,31 @@ const COMPOSER_RECHECK_MS = 400;
  *  must have stopped changing for this long before the pane counts as ready. */
 const INITIAL_INPUT_SETTLE_MS = 1_000;
 
+/**
+ * Claude asks whether to trust a folder it has not opened before, whatever its permission mode, and has no flag that
+ * skips the question; its default answer exits, taking the pane with it. A Claude this machine launches without
+ * prompts has its folder recorded as trusted in this machine's Claude config (`projects[<folder>]` in .claude.json,
+ * keyed as Claude keys it: the real path, with forward slashes on Windows), as a Codex launch has its trust passed on
+ * its command line. A whole new file is renamed over the old one, since Claude rewrites it while it runs.
+ */
+function trustClaudeFolder(cwd) {
+  try {
+    const config = join(process.env.CLAUDE_CONFIG_DIR || homedir(), '.claude.json');
+    const real = realpathSync(cwd);
+    const folder = process.platform === 'win32' ? real.replace(/^\\\\\?\\/, '').replaceAll('\\', '/') : real;
+    let root = {};
+    try { root = JSON.parse(readFileSync(config, 'utf8')); } catch (error) { if (error.code !== 'ENOENT') return; }
+    if (!root || typeof root !== 'object' || Array.isArray(root)) return;
+    const projects = root.projects ??= {};
+    const project = projects[folder] ??= {};
+    if (project.hasTrustDialogAccepted === true) return;
+    project.hasTrustDialogAccepted = true;
+    const staged = `${config}.supercode-${process.pid}`;
+    writeFileSync(staged, JSON.stringify(root, null, 2));
+    renameSync(staged, config);
+  } catch { /* Claude asks as it always did */ }
+}
+
 /** How long a launch watches its new pane before answering, so a program that ends at once is reported. */
 const LAUNCH_SETTLE_MS = 500;
 
@@ -353,9 +378,10 @@ export class TeamsMachine extends MachineCore {
     // receiver named rather than addressed needs `mail:*`.
     const { admitted, principal } = entry;
     const request = stream.params?.request;
+    if (request?.op === 'turn') return this.#serveTurn(entry, request, stream, accept, refuse);
     const to = typeof request?.to === 'string' ? request.to : '*';
     const target = to.startsWith('sc:') ? `mail:${to}` : 'mail:*';
-    if (!request || !['send', 'file', 'list'].includes(request.op)) return refuse('mail needs a send, file or list request');
+    if (!request || !['send', 'file', 'list'].includes(request.op)) return refuse('mail needs a send, file, list or turn request');
     if (!holds(admitted, 'mail', target)) {
       this.log.append({ principal, cap: 'mail', target, outcome: 'refused' });
       return refuse(`no mail grant for ${target}`);
@@ -377,6 +403,37 @@ export class TeamsMachine extends MachineCore {
     child.stdin.end(JSON.stringify({ ...request, via_principal: principal ?? null }));
   }
 
+  #serveTurn(entry, request, stream, accept, refuse) {
+    // A person's line typed into one session here as that session's own user turn (a Room member in a Conversation
+    // bound to the session): `interact` on `session:<harness>/<id>`. Who typed it comes from the caller's claim
+    // (the name its workplace signed), never from the request.
+    const { admitted, principal } = entry;
+    // A caller the server admitted for one session (a Room member's token) names nothing: its grant names the session.
+    const granted = admitted?.class === 'operator' ? [] : (admitted?.grants ?? []).filter((grant) => grant.caps.includes('interact')).flatMap((grant) => grant.targets).filter((target) => target.startsWith('session:') && target !== 'session:*');
+    const named = typeof request.harness === 'string' && typeof request.session === 'string' ? `${request.harness}/${request.session}` : (granted.length === 1 ? granted[0].slice('session:'.length) : '');
+    const [harness, session] = named.includes('/') ? [named.slice(0, named.indexOf('/')), named.slice(named.indexOf('/') + 1)] : ['', ''];
+    const target = `session:${harness}/${session}`;
+    if (!harness || !session || typeof request.text !== 'string' || !request.text.trim()) return refuse('a turn needs harness, session and text');
+    if (!holds(admitted, 'interact', target)) {
+      this.log.append({ principal, cap: 'interact', target, outcome: 'refused' });
+      return refuse(`no interact grant for ${target}`);
+    }
+    accept();
+    const child = spawn(this.supercodeBin, ['message', 'remote-deliver'], { stdio: ['pipe', 'pipe', 'pipe'], env: this.env });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (chunk) => { out += chunk; });
+    child.stderr.on('data', (chunk) => { err += chunk; });
+    child.on('error', (error) => { err += error.message; });
+    child.on('close', (code) => {
+      this.log.append({ principal, cap: 'interact', target, outcome: code === 0 ? 'turn' : 'failed', detail: err.trim().slice(0, 200) || undefined });
+      if (stream.closed) return;
+      stream.write(out.trim() || JSON.stringify({ code: 1, text: err.trim() || `remote-deliver exited ${code}` }));
+      stream.close('delivered');
+    });
+    child.stdin.end(JSON.stringify({ op: 'turn', harness, session, text: request.text, from_name: entry.name ?? principal ?? 'a Room member', via: 'room' }));
+  }
+
   // ---- terminal ------------------------------------------------------------
 
   async #attachTerminal(entry, stream, accept, refuse) {
@@ -989,6 +1046,7 @@ export class TeamsMachine extends MachineCore {
         }
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
         this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'issued' });
+        if (params.kind === 'claude-code' && params.cwd && (params.arguments ?? []).includes('--dangerously-skip-permissions')) trustClaudeFolder(params.cwd);
         let session;
         try {
           session = await this.host.createSession({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.36",
+  "version": "0.2.38",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",