@volter/supercode-teams 0.2.99 → 0.2.101

package/bin/fleet.mjs

@@ -85,6 +85,10 @@ async function main() {
           name: flags.name,
           // `open` attaching this terminal to the pane itself asks the machine for no window of its own.
           ...(flags.popup === 'false' ? { popup: false } : {}),
+          // Who starts the pane (the session or board supercode resolved; unset for a person), and whether the pane
+          // runs its one verb as that caller (`close`/`stop` on another machine).
+          ...(process.env.SUPERCODE_CALLER ? { caller: process.env.SUPERCODE_CALLER } : {}),
+          ...(flags['act-for-caller'] ? { actForCaller: true } : {}),
           // `open --notify-when-ended`: the launching session's address, told once when the pane ends, and the
           // machine's mail name the notice comes from.
           ...(typeof flags.notify === 'string' ? { notify: { to: flags.notify, machine: String(flags['notify-machine'] ?? flags.on ?? '') } } : {}),

package/bin/teams.mjs

@@ -106,6 +106,10 @@ async function machineChannel() {
   return openMachine({ machine: flags.machine ? String(flags.machine) : null, context: flags.context ? String(flags.context) : null, home });
 }
 
+// The session (or board) this command acts for, as supercode resolved it: the pane doors refuse a session acting on
+// a pane it did not start. Unset for a person.
+const caller = process.env.SUPERCODE_CALLER || undefined;
+
 async function withNode(fn) {
   const channel = await machineChannel();
   try {
@@ -149,7 +153,7 @@ async function main() {
     case 'panes': {
       if (sub === 'ls') return withNode(async (rpc) => out(await rpc.call('panes.list')));
       if (sub === 'capture') return withNode(async (rpc) => out((await rpc.call('panes.capture', { pane: rest[0], lines: Number(flags.lines ?? 200) })).text));
-      if (sub === 'close') return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: rest[0] })));
+      if (sub === 'close') return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: rest[0], caller })));
       die('panes ls|capture|close');
     }
     case 'title': {
@@ -173,9 +177,9 @@ async function main() {
       die('attention ls | rank | request <pane> [--urgency now|soon|whenever] [--reason text] | clear <pane>');
     }
     case 'suspend':
-      return withNode(async (rpc) => out(await rpc.call('panes.suspend', { pane: sub, interrupt: Boolean(flags.interrupt) })));
+      return withNode(async (rpc) => out(await rpc.call('panes.suspend', { pane: sub, interrupt: Boolean(flags.interrupt), caller })));
     case 'resume':
-      return withNode(async (rpc) => out(await rpc.call('panes.resume', { pane: sub, input: flags.input ? String(flags.input) : null })));
+      return withNode(async (rpc) => out(await rpc.call('panes.resume', { pane: sub, input: flags.input ? String(flags.input) : null, caller })));
     case 'files': {
       const path = rest[0];
       if (sub === 'ls') return withNode(async (rpc) => out(await rpc.call('files.list', { path })));
@@ -214,10 +218,10 @@ async function main() {
       // (answers `delivered: false` with the reason when it holds a draft).
       if (flags.key !== undefined) {
         if (flags.key === true || rest.length) die('input <pane> --key NAMES: keys by tmux name, space- or comma-separated (Escape, Enter, Tab, BTab, BSpace, Space, Up, Down, Left, Right, Home, End, PPage, NPage, DC, C-a … C-z)');
-        return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: keyBytes(String(flags.key)), submit: false, keys: true })));
+        return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: keyBytes(String(flags.key)), submit: false, keys: true, caller })));
       }
-      if (flags['when-composer-empty']) return withNode(async (rpc) => out(await rpc.call('panes.turn', { pane: sub, text: rest.join(' ') })));
-      return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: rest.join(' '), submit: !flags['no-enter'] })));
+      if (flags['when-composer-empty']) return withNode(async (rpc) => out(await rpc.call('panes.turn', { pane: sub, text: rest.join(' '), caller })));
+      return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: rest.join(' '), submit: !flags['no-enter'], caller })));
     case 'port': {
       // `port <pane>/<n> [--listen host:port]`: a machine port forwarded here. Stays up until ctrl-c.
       const spec = String(sub ?? '');

package/bin/workspace.mjs

@@ -19,6 +19,9 @@ import { duration, parseArgs, positiveInteger, requireArgs, usage } from './work
 import { reserveArtifactDirectory, reserveProtected, writeProtected } from './workspace/files.mjs';
 import { acquireLifecycle, activeSocket, lifecycleHeld, requestStop } from './workspace/lifecycle.mjs';
 import { retireLinklessDaemon, watchCodeChange } from './workspace/upgrade-watch.mjs';
+
+/** How long a service-run connector's machine link may stay down before the connector restarts itself. */
+const LINK_LOST_MS = 120_000;
 import { volterDeviceSignIn } from './workspace/volter-device.mjs';
 import { loginSummary, signInToTeams } from './workspace/volter-login.mjs';
 import { readSharedSignIn, signOut } from '@volter/identity';
@@ -733,6 +736,15 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     // A connected machine is a person's: each pane it launches opens a window on its screen (SUPERCODE_POPUPS=0: none).
     const machine = new TeamsMachine({ home: daemonHome, supercode: binary, popups: process.env.SUPERCODE_POPUPS !== '0', ...(flags.tmux_socket ? { tmuxSocket: String(flags.tmux_socket) } : {}), link: { server: context.origin, teamId: context.team_id, machineId: saved.machine.id, credential: saved.credential.token, incarnationId: connector.state.incarnation_id, configuration: () => connector.configuration() }, onTurn: (turn) => connector.noteTurn(turn), onTurnWithdrawn: (turn) => connector.withdrawTurn(turn) });
     machine.on('link', (event) => { if (event.event === 'replaced') process.stderr.write(`supercode teams: ${event.error}. Two connectors were running for this machine; stop one of them (\`supercode teams disconnect\` where it should not run).\n`); });
+    // The link's state for the watch after start: down until it is up, down again (since when) when it drops. A
+    // `replaced` link is left alone: another connector for this machine owns it, by design.
+    let linkDownSince = Date.now();
+    let linkReplaced = false;
+    machine.on('link', (event) => {
+      if (event.event === 'up') linkDownSince = null;
+      else if (event.event === 'dropped') linkDownSince ??= Date.now();
+      else if (event.event === 'replaced') linkReplaced = true;
+    });
     // The connector is the service's daemon and keeps serving; a daemon that took its socket path is the one to stop.
     machine.on('superseded', (path) => process.stderr.write(`supercode teams: another machine daemon replaced this connector's socket at ${path}; stop it (supercode teams status)\n`));
     const stopAll = async () => { await machine.stop().catch(() => {}); await connector.stop(); await core.close(); await largeCore.close(); await slowCore.close(); await liveCore.close(); await lifecycle.close(); state.update(current => current ? ({ ...current, process: undefined }) : null); };
@@ -762,6 +774,19 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
         if (process.platform !== 'win32') setTimeout(async () => { await stopConnector?.(); process.exit(75); }, 60_000);
       });
     }
+    // Run by a service, a connector whose machine link stays down restarts itself, so a machine is never left
+    // unreachable with no remote way back (the Mac mini sat unlinked for hours while its connector lived on): a
+    // daemon that died, a start that half failed or a link its backoff never recovered all end in a fresh start.
+    // It exits non-zero, which every service manager here restarts.
+    if (saved.service) {
+      const linkWatch = setInterval(() => {
+        if (linkReplaced || linkDownSince === null || Date.now() - linkDownSince < LINK_LOST_MS) return;
+        clearInterval(linkWatch);
+        process.stderr.write(`supercode teams: this machine has had no link to its Teams server for ${Math.round((Date.now() - linkDownSince) / 1000)} s; restarting the connector\n`);
+        void (async () => { await stopConnector?.(); process.exit(75); })();
+      }, 15_000);
+      linkWatch.unref?.();
+    }
     await new Promise(resolveStop => { let stopped = false; stopConnector = async () => { if (stopped) return; stopped = true; await stopAll(); resolveStop(); }; for (const signal of ['SIGINT', 'SIGTERM', ...(process.platform === 'win32' ? ['SIGHUP', 'SIGBREAK'] : [])]) process.once(signal, stopConnector); });
     return;
   }

package/machine.mjs

@@ -577,6 +577,19 @@ export class TeamsMachine extends MachineCore {
     return env;
   }
 
+  /**
+   * A session acts only on the panes it started: input, a turn, a suspend or a close from a session (`caller`, its
+   * address) on a pane another session, a board or a person started is refused, naming who started it. A person (no
+   * caller) and a board (its cards' own door) act on any pane.
+   */
+  #refuseForeign(pane, caller) {
+    if (typeof caller !== 'string' || !caller || /^sc:[^:]+:board:/.test(caller)) return;
+    const by = this.launches.all().find((entry) => entry.pane === pane)?.by ?? null;
+    if (by === caller) return;
+    const starter = by ? `was started by ${by}` : 'was not started by a session (a person or an earlier daemon started it)';
+    throw Object.assign(new Error(`pane ${pane} ${starter}, not by ${caller}: a session acts only on the panes it started. Nothing was done; reach that session through its own doors (supercode message send)`), { code: 403 });
+  }
+
   async #paneByContext(contextKey) {
     const sessions = await this.host.listSessions();
     return sessions.find((s) => s.contextKey === contextKey) ?? null;
@@ -701,13 +714,13 @@ export class TeamsMachine extends MachineCore {
    * Never rejects. The only caller is a fire-and-forget from the request path,
    * where an unhandled rejection would take the daemon down over one pane.
    */
-  #deliverInitialInput({ key, contextKey, session, kind, input, act }) {
+  #deliverInitialInput({ key, contextKey, session, kind, by, input, act }) {
     const abort = new AbortController();
     const task = (async () => {
       const readyBy = await this.#awaitInputReady(session, contextKey, kind, abort.signal);
       if (readyBy === 'aborted') return;
       if (readyBy === 'pane-gone') {
-        this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: false, inputReadyBy: readyBy });
+        this.launches.record({ key, pane: contextKey, kind, by, status: 'ready', inputDelivered: false, inputReadyBy: readyBy });
         act('launch', `pane:${contextKey}`, 'failed', 'first input undelivered: the pane ended before it was ready');
         return;
       }
@@ -719,7 +732,7 @@ export class TeamsMachine extends MachineCore {
       try {
         await this.host.sendInput(session.id, submission(input), { submitMode: 'single' });
       } catch (error) {
-        this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: false, inputReadyBy: readyBy, inputError: error.message });
+        this.launches.record({ key, pane: contextKey, kind, by, status: 'ready', inputDelivered: false, inputReadyBy: readyBy, inputError: error.message });
         act('launch', `pane:${contextKey}`, 'failed', `first input undelivered: ${error.code ?? error.message}`);
         return;
       }
@@ -728,12 +741,12 @@ export class TeamsMachine extends MachineCore {
       // vouched for. A launch that reads `ready` without it was given its
       // message by an input box that existed.
       const late = readyBy === 'deadline';
-      this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: true, inputReadyBy: readyBy, ...(late ? { inputDeliveredLate: true } : {}) });
+      this.launches.record({ key, pane: contextKey, kind, by, status: 'ready', inputDelivered: true, inputReadyBy: readyBy, ...(late ? { inputDeliveredLate: true } : {}) });
       act('launch', `pane:${contextKey}`, 'ok', `first input delivered (${readyBy})`);
     })().catch((error) => {
       // Nothing above is expected to throw; if something does, the launch record
       // is where it is answerable, not a crashed daemon.
-      this.launches.record({ key, pane: contextKey, kind, status: 'ready', inputDelivered: false, inputError: error?.message ?? String(error) });
+      this.launches.record({ key, pane: contextKey, kind, by, status: 'ready', inputDelivered: false, inputError: error?.message ?? String(error) });
     }).finally(() => {
       if (this.pendingInitialInputs.get(key)?.task === task) this.pendingInitialInputs.delete(key);
     });
@@ -1140,10 +1153,13 @@ export class TeamsMachine extends MachineCore {
           return { key, pane: existing.pane, reused: true, status: existing.status };
         }
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
+        // Who started the pane: the launching session's (or board's) address, null for a person. A session's later
+        // input and close on the pane are refused unless it is this one (#refuseForeign).
+        const by = typeof params.caller === 'string' && params.caller ? params.caller : null;
         // Who to tell when the pane ends (`open --new … --notify-when-ended`): a session's mail address, and this
         // machine's name as the address a notice from its pane comes from.
         if (params.notify !== undefined && !(params.notify && typeof params.notify.to === 'string' && /^sc:[^:\s]+:[^:\s]+:\S+$/.test(params.notify.to) && typeof params.notify.machine === 'string' && /^[a-z0-9][a-z0-9-]*$/.test(params.notify.machine))) throw Object.assign(new Error('launch notify is { to: <sc: address>, machine: <this machine\'s mail name> }'), { code: 400 });
-        this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'issued' });
+        this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, by, status: 'issued' });
         if (params.kind === 'claude-code' && params.cwd && (params.arguments ?? []).includes('--dangerously-skip-permissions')) trustClaudeFolder(params.cwd);
         let session;
         try {
@@ -1151,17 +1167,18 @@ export class TeamsMachine extends MachineCore {
             command: launchCommand(params.program, params.arguments ?? []),
             contextKey,
             cwd: params.cwd,
-            env: this.#paneEnv(contextKey, params.env),
+            // A pane that runs one verb for its launcher (`close`/`stop` on another machine) acts as that launcher.
+            env: this.#paneEnv(contextKey, params.actForCaller && by ? { ...params.env, SUPERCODE_CALLER: by } : params.env),
             // The pane's own tmux session is always its key: the exit hooks record and clean up p_* sessions only, and
             // a pane named otherwise lingered dead with its exit status lost. A launch's name is its title.
             name: contextKey,
           });
         } catch (error) {
-          this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'failed', error: error.message });
+          this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, by, status: 'failed', error: error.message });
           act('launch', `pane:${contextKey}`, 'failed', error.code ?? error.message);
           throw error;
         }
-        this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status: 'ready' });
+        this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, by, status: 'ready' });
         act('launch', `pane:${contextKey}`, 'ok', params.kind ?? params.program);
         if (typeof params.name === 'string' && params.name.trim()) {
           const titles = readJson(this.p.titles, { v: 1, titles: {} });
@@ -1177,7 +1194,7 @@ export class TeamsMachine extends MachineCore {
         // outcome is recorded against the launch key, so `launches.get|list`
         // answers "did my message go in, and was it late?" without anyone
         // reading the screen.
-        if (params.initialInput) this.#deliverInitialInput({ key, contextKey, session, kind: params.kind ?? null, input: params.initialInput, act });
+        if (params.initialInput) this.#deliverInitialInput({ key, contextKey, session, kind: params.kind ?? null, by, input: params.initialInput, act });
         // A program that ends at once (not found, not runnable, failing on its first line) takes its pane with it:
         // the caller is told, with its exit status, instead of being handed a pane that is already gone.
         await new Promise((resolve) => setTimeout(resolve, LAUNCH_SETTLE_MS));
@@ -1186,7 +1203,7 @@ export class TeamsMachine extends MachineCore {
           // Finished (it ran to a clean end) is an answer; exited (it failed at once) is the caller's error.
           const exit = settled?.dead ? deadPaneExit(settled) : paneExit(contextKey);
           const status = exit && !exit.failed ? 'finished' : 'exited';
-          this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, status, error: exit?.failed ? exit.how : undefined });
+          this.launches.record({ key, pane: contextKey, kind: params.kind ?? null, by, status, error: exit?.failed ? exit.how : undefined });
           return { key, pane: contextKey, reused: false, status, exit: exit?.how ?? null };
         }
         if (this.popups && params.popup !== false) this.#popupWindow(contextKey, session);
@@ -1210,12 +1227,13 @@ export class TeamsMachine extends MachineCore {
         const rows = [];
         for (const found of this.launches.all()) {
           const session = found.pane ? await this.#paneByContext(found.pane) : null;
-          rows.push({ key: found.key, pane: found.pane ?? null, kind: found.kind ?? null, status: found.status ?? null, at: found.t, live: Boolean(session), ...initialInputFacts(found) });
+          rows.push({ key: found.key, pane: found.pane ?? null, kind: found.kind ?? null, by: found.by ?? null, status: found.status ?? null, at: found.t, live: Boolean(session), ...initialInputFacts(found) });
         }
         return rows;
       }
       case 'panes.close': {
         need(operator ? 'control' : 'control', `pane:${params.pane}`);
+        this.#refuseForeign(params.pane, params.caller);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         await this.host.closeSession(session.id);
@@ -1228,6 +1246,7 @@ export class TeamsMachine extends MachineCore {
         // working, only `{input}` is refused — until `resume`, which may carry
         // the input that hands the pane back. Local tmux input is never touched.
         need('control', `pane:${params.pane}`);
+        this.#refuseForeign(params.pane, params.caller);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         const doc = readJson(this.p.suspended, { v: 1, panes: {} });
@@ -1249,6 +1268,7 @@ export class TeamsMachine extends MachineCore {
         // mechanics) for callers that are services rather than terminals. Same gate as an
         // attachment in control mode, same suspend rule as remote input everywhere.
         need('control', `pane:${params.pane}`);
+        this.#refuseForeign(params.pane, params.caller);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });
@@ -1267,6 +1287,7 @@ export class TeamsMachine extends MachineCore {
         // answer, not an error: the caller keeps the turn and asks again. Its own
         // method, so a daemon without it refuses instead of typing into a draft.
         need('control', `pane:${params.pane}`);
+        this.#refuseForeign(params.pane, params.caller);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.99",
+  "version": "0.2.101",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",