@volter/supercode-teams 0.3.125 → 0.3.127

package/bin/teams.mjs

@@ -55,7 +55,7 @@ import { APP_DOOR_PATH, appDoorFile, appDoorLink, normalOrigin, readAppDoor, rea
 
 const MACHINE_VERBS = new Set(['machine', 'slow', 'describe', 'records', 'panes', 'input', 'suspend', 'resume', 'files', 'ports', 'port', 'browser', 'stream', 'jobs', 'workspace', 'title', 'attention', 'watch', 'rpc', 'launches', 'log', 'mail', 'board', 'health', 'app-door']);
 // Every flag a machine verb reads; any other is refused rather than silently ignored.
-const KNOWN_FLAGS = new Set(['home', 'since', 'machine', 'context', 'floor', 'supercode', 'tmux-socket', 'verbose', 'lines', 'input', 'name', 'for', 'urgency', 'reason', 'interrupt', 'query', 'out', 'in', 'interval', 'no-enter', 'when-composer-empty', 'key', 'listen', 'list', 'from', 'to', 'path', 'to-path', 'repo', 'branch', 'solo', 'card', 'create', 'presence-only', 'processes', 'panes', 'clear-draft', 'message-ids', 'harness', 'observe', 'attach-context', 'json', 'all', 'origin', 'port', 'remove-origin', 'open']);
+const KNOWN_FLAGS = new Set(['home', 'since', 'machine', 'context', 'floor', 'supercode', 'tmux-socket', 'verbose', 'lines', 'input', 'name', 'for', 'urgency', 'reason', 'interrupt', 'query', 'out', 'in', 'interval', 'no-enter', 'when-composer-empty', 'key', 'listen', 'list', 'from', 'to', 'path', 'to-path', 'repo', 'branch', 'solo', 'card', 'create', 'presence-only', 'processes', 'panes', 'clear-draft', 'message-ids', 'harness', 'observe', 'attach-context', 'json', 'all', 'origin', 'port', 'remove-origin', 'open', 'foreign']);
 
 const argv = process.argv.slice(2);
 const flags = {};
@@ -247,7 +247,13 @@ async function main() {
         flags.processes ? 'panes.processes' : flags['presence-only'] ? 'panes.present' : 'panes.list',
         flags['presence-only'] && typeof flags.panes === 'string' ? { panes: flags.panes.split(',').filter(Boolean) } : {})));
       if (sub === 'capture') return withNode(async (rpc) => out((await rpc.call('panes.capture', { pane: rest[0], lines: Number(flags.lines ?? 200) })).text));
-      if (sub === 'close') return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: rest[0] })));
+      // One pane, named: `--foreign` closes a pane another session started, and is said for that pane alone.
+      if (sub === 'close') {
+        // the flag parser takes `--foreign p_…` as the flag's value: that pane is the one named
+        const named = typeof flags.foreign === 'string' ? [flags.foreign, ...rest] : rest;
+        if (named.length !== 1) die('panes close <pane> [--foreign]: one pane per close');
+        return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: named[0], foreign: flags.foreign !== undefined, ...(await acting()) })));
+      }
       // `window <pane> [machine]`: a terminal window on this machine's screen showing the pane, this machine's or, named,
       // another machine's (attached through Teams, in that machine's Teams context `--attach-context`); `--observe` shows it
       // read-only.

package/codex-startup.mjs

@@ -42,7 +42,16 @@ export function codexStartupArguments(args = []) {
     }
     normalized.push(argument);
   }
-  return ['-c', 'check_for_update_on_startup=false', ...normalized];
+  // Codex 0.160's `resume` does not take this override from before the subcommand: a resumed TUI with it there still
+  // stopped on "Update available" once another Codex had cached a newer version, and `codex resume <id> -c …` did not
+  // (yuerans, 2026-10-06). It goes after the subcommand and its session id (readers of the process take the word after
+  // `resume` as the id: codex_peer.rs `resumed_session_in`), in front when there is no subcommand. `fork` is placed the
+  // same way by extension; only `resume` was measured.
+  const subcommand = normalized.findIndex((argument, index) => ['resume', 'fork'].includes(argument)
+    && !['-c', '--config'].includes(normalized[index - 1]) && !normalized.slice(0, index).includes('--'));
+  const id = subcommand >= 0 && normalized[subcommand + 1] !== undefined && normalized[subcommand + 1] !== '--' && !normalized[subcommand + 1].startsWith('-');
+  const at = subcommand < 0 ? 0 : subcommand + (id ? 2 : 1);
+  return [...normalized.slice(0, at), '-c', 'check_for_update_on_startup=false', ...normalized.slice(at)];
 }
 
 export function codexUpdatePrompt(screen) {

package/machine.mjs

@@ -2079,16 +2079,22 @@ export class TeamsMachine extends MachineCore {
   }
 
   #refuseForeign(pane, caller) {
-    if (typeof caller !== 'string' || !caller || /^sc:[^:]+:board:/.test(caller)) return;
+    const starter = this.#foreignStarter(pane, caller);
+    if (starter) throw Object.assign(new Error(`pane ${pane} ${starter}, not by ${caller}: a session acts only on the panes it started. Nothing was done; reach that session through its own doors (supercode message send)`), { code: 403 });
+  }
+
+  /** Who started `pane`, said, when `caller` is a session that did not start it; null when the caller may act on it (a
+   *  person, a board, its starter). */
+  #foreignStarter(pane, caller) {
+    if (typeof caller !== 'string' || !caller || /^sc:[^:]+:board:/.test(caller)) return null;
     const launch = this.launches.all().find((entry) => entry.pane === pane);
     const by = launch?.by ?? null;
-    if (by === caller) return;
+    if (by === caller) return null;
     // A pane that resumes a session is that session's as well: its first starter acts on it as before the resume
     // (t_09a795fd item 18). The starter is the oldest harness launch whose own transcript confirmed it started that
     // session, never a launch row's claim (any caller can launch a program with --session-id S).
-    if (launch?.resumes && this.#sessionOrigin(launch.resumes)?.by === caller) return;
-    const starter = by ? `was started by ${by}` : 'was not started by a session (a person or an earlier daemon started it)';
-    throw Object.assign(new Error(`pane ${pane} ${starter}, not by ${caller}: a session acts only on the panes it started. Nothing was done; reach that session through its own doors (supercode message send)`), { code: 403 });
+    if (launch?.resumes && this.#sessionOrigin(launch.resumes)?.by === caller) return null;
+    return by ? `was started by ${by}` : 'was not started by a session (a person or an earlier daemon started it)';
   }
 
   /** The launch that started native Claude session `session`: the oldest journal row of a Claude launch whose own
@@ -3307,7 +3313,7 @@ export class TeamsMachine extends MachineCore {
         }
         const contextKey = params.pane ?? `p_${randomBytes(9).toString('base64url')}`;
         // Who started the pane: the launching session's (or board's) address, null for a person. A session's later
-        // input on the pane is refused unless it is this one (#refuseForeign); close is not creator-restricted.
+        // input on the pane is refused unless it is this one (#refuseForeign); its close needs `foreign` (panes.close).
         // Who to tell when the pane ends (`open --new … --notify-when-ended`): a session's mail address, and this
         // machine's name as the address a notice from its pane comes from.
         if (params.notify !== undefined && !(params.notify && typeof params.notify.to === 'string' && /^sc:[^:\s]+:[^:\s]+:\S+$/.test(params.notify.to) && typeof params.notify.machine === 'string' && /^[a-z0-9][a-z0-9-]*$/.test(params.notify.machine))) throw Object.assign(new Error('launch notify is { to: <sc: address>, machine: <this machine\'s mail name> }'), { code: 400 });
@@ -3459,14 +3465,28 @@ export class TeamsMachine extends MachineCore {
       case 'harness.v1.panes.close':
       case 'panes.close': {
         need('control', `pane:${params.pane}`);
-        for (const pending of this.pendingStartups.values()) if (pending.pane === params.pane) pending.abort.abort();
+        // A session closes the panes it started and the one it runs in. Another's pane is closed only when the caller
+        // says so (`foreign`), one pane at a time, by name: a listing piped into close is refused pane by pane rather
+        // than ending every session on the machine (docs/adr/0004-pane-close-authority.md).
+        const starting = [...this.pendingStartups.values()].filter((pending) => pending.pane === params.pane);
+        // only a pane here (open, or still starting) is anyone's: one this machine lacks is answered as absent, before
+        // the caller is asked for
+        const here = starting.length > 0 || Boolean(await this.#paneByContext(params.pane));
+        const closeBy = here ? await this.#callerOf(entry, params) : null;
+        const starter = params.foreign === true || !here ? null : this.#foreignStarter(params.pane, closeBy);
+        // the pane the caller runs in: a Claude row names it as its tmux locator (`p_…:@window.%pane`), the others as the pane
+        if (starter && !this.live.sessions().some((live) => live.address === closeBy && String(live.pane ?? '').split(':')[0] === params.pane)) {
+          act('close', `pane:${params.pane}`, 'refused', `foreign: ${starter}`);
+          throw Object.assign(new Error(`pane ${params.pane} ${starter}, not by ${closeBy}. Nothing was closed. A session closes the panes it started; closing another's is deliberate: read what the pane holds, settle it with whoever started it, then close that one pane with --foreign`), { code: 403 });
+        }
+        for (const pending of starting) pending.abort.abort();
         const session = await this.#paneByContext(params.pane);
         if (!session) {
           act('close', `pane:${params.pane}`, 'ok', 'already absent');
           return { closed: params.pane, alreadyAbsent: true };
         }
         await this.host.closeSession(session.id);
-        act('close', `pane:${params.pane}`);
+        act('close', `pane:${params.pane}`, 'ok', params.foreign === true ? `foreign, by ${closeBy ?? 'a person'}` : null);
         this.#panesChanged();
         return { closed: params.pane };
       }

package/mail/relay.mjs

@@ -371,6 +371,18 @@ export class Relays {
    * (claude_relay.rs `send_through_relay`): the receiver is named by its own socket (`uds:<path>`), unique to it, never
    * by its name. One send at a time per relay; a relay whose process is proven dead is started again once.
    */
+  /** Whether `sender`'s relay still holds a send queued (its queue file, written within SEND_TIMEOUT_MS twice over): a
+   *  relay runtime outlives a daemon that ended mid-send and may still make it. */
+  sending(sender) {
+    try { return Date.now() - statSync(this.spec(sender).queue).mtimeMs < 2 * SEND_TIMEOUT_MS; } catch { return false; }
+  }
+
+  /** Whether message `messageId` from `sender` landed in Claude session `sessionId`'s transcript, as a relay send reads
+   *  an unconfirmed outcome (send.mjs handOver asks it of a hand-over the daemon did not live to settle). */
+  async landed(sessionId, messageId, sender) {
+    return this.arrived(sessionId, `cross-session-message id=\\"${shortId(messageId)}\\" from=\\"${sender}\\"`);
+  }
+
   async send(sender, senderName, receiver, message, messageId) {
     const spec = this.spec(sender, senderName);
     const asked = performance.now();

package/mail/send.mjs

@@ -25,6 +25,12 @@ export function unansweredText(where, detail, id) {
 
 /** How long a send waits, in a daemon's first moments, for its Codex sessions to be known before it resolves a receiver. */
 const CODEX_KNOWN_WAIT_MS = 20_000;
+// A relayed message's wake is due this long after its relay send begins: a send still running here holds it (handOver),
+// so it fires only for a send the daemon did not live to finish (t_b0f9a2a0)
+const RELAY_GRACE_MS = 30_000;
+/** The kinds of delivery that hand nothing over (#deliverWoken's `how`): the copy waits filed. An operator's mailbox,
+ *  which its operator reads, and a session's hook, which shows it, are deliveries. */
+const LEFT_FILED = new Set(['queued', 'stored', 'pane_held', 'pane_waits', 'not_running']);
 
 /** Replies in one unbroken chain between two sessions beyond which another is refused. */
 const REPLY_CHAIN_LIMIT = 32;
@@ -53,6 +59,7 @@ export class MailSend {
   constructor({ machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, log = () => {} }) {
     Object.assign(this, { machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, log });
     this.handing = new Set(); // `<address>\n<id>` of each hand-over running here (handOver)
+    this.relaying = new Set(); // `<address>\n<id>` of each relay send running here (route): its wake waits for it
   }
 
   // ---- one send ----------------------------------------------------------------------------------------------------
@@ -319,11 +326,21 @@ export class MailSend {
       const handed = sent.reply_via?.mode === 'command' && door.session.tools ? { ...sent, reply_via: { mode: 'tool' } } : sent;
       const text = render(handed);
       if (Buffer.byteLength(text) > MAX_RELAYED_BYTES) throw new Refused('too_long', Buffer.byteLength(text));
-      // filed before it is handed over: a session that reads its mailbox at its first tool call finds it; a relay that
-      // fails takes back the copy this delivery filed
+      // filed before it is handed over, unread, with a wake due RELAY_GRACE_MS from now: a session that reads its mailbox
+      // at its first tool call finds it, and a daemon that ends before the relay answers (an upgrade's restart, a crash)
+      // leaves it for the carrier, which hands it over again (t_b0f9a2a0: filed read before, such a send was lost). It is
+      // read once the relay has made it; a relay that fails takes back the copy this delivery filed
       const filedHere = this.store.findIn(to, handed.id) == null;
-      const filed = this.store.deliverRead(to, handed);
-      const relayed = await this.relays.send(handed.from, handed.from_name, { sessionId: door.session.address.split(':').slice(3).join(':'), name: door.session.name.split('@')[0], socket: door.session.socket }, text, handed.id);
+      const filed = this.store.deliver(to, handed);
+      if (wake && !this.store.hasWake(to, handed.id)) {
+        // its hand-over begins now: a daemon that restarts reads the receiver's transcript before sending it again
+        try { this.store.requestWake(to, handed.id); this.store.setWakeState(to, handed.id, { attempts: 0, next_at_ms: Date.now() + RELAY_GRACE_MS, handover_at_ms: Date.now() }); } catch { /* the relay's own outcome stands */ }
+      }
+      const key = `${to}\n${handed.id}`;
+      this.relaying.add(key);
+      let relayed;
+      try { relayed = await this.relays.send(handed.from, handed.from_name, { sessionId: door.session.address.split(':').slice(3).join(':'), name: door.session.name.split('@')[0], socket: door.session.socket }, text, handed.id); }
+      finally { this.relaying.delete(key); }
       // a send the relay may have made keeps its copy and is unanswered, never taken back and said not sent; only one the
       // relay is known not to have made (refused, never handed in) takes its copy back. One its receiver read from its
       // mailbox meanwhile (its recipient claim) has reached it. Otherwise the relay can no longer make it (its queue is
@@ -331,7 +348,8 @@ export class MailSend {
       // goes back unread, for the receiver's own mailbox read and the mailbox's wake, which hands it over again
       const received = this.store.claimOf(to, handed.id)?.recipient === true;
       if (!relayed.delivered && relayed.unknown && !received) {
-        if (filedHere) { try { this.store.markUnread(to, filed); if (wake) this.store.requestWake(to, handed.id); } catch { /* kept read */ } }
+        // kept unread, its wake due now: the carrier hands it over again after its backoff
+        if (filedHere && wake) { try { this.store.requestWake(to, handed.id); } catch { /* the wake filed above stands */ } }
         throw Object.assign(new Error(relayed.detail), { unanswered: true });
       }
       if (!relayed.delivered && !received) { if (filedHere) { try { unlinkSync(filed); } catch { /* gone */ } } throw new Error(relayed.detail); }
@@ -378,10 +396,19 @@ export class MailSend {
     const reached = [], copied = [], failed = [];
     let recorded = false;
     const held = []; // recipients whose own copy is held unread with its wake (an unanswered relay)
+    let agentKey = null;
     if (plan.agent) {
-      // the agent's own mailbox keeps the record of what was addressed to it
-      try { this.store.deliverRead(plan.agent, sent); recorded = true; } catch (error) { failed.push(`the agent's mailbox (${error.message})`); }
+      // the agent's own mailbox keeps the record of what was addressed to it: unread, with a wake due RELAY_GRACE_MS on,
+      // until a recipient has it, so a daemon that ends while the plan runs (a resume, a relay send, another machine
+      // asked) leaves it for the carrier to plan again (#1264 review P1). While this plan runs its wake waits for it
+      try {
+        const fresh = this.store.findIn(plan.agent, sent.id) == null;
+        this.store.deliver(plan.agent, sent); recorded = true;
+        if (fresh && !this.store.hasWake(plan.agent, sent.id)) { this.store.requestWake(plan.agent, sent.id); this.store.setWakeState(plan.agent, sent.id, { attempts: 0, next_at_ms: Date.now() + RELAY_GRACE_MS }); }
+        agentKey = `${plan.agent}\n${sent.id}`; this.relaying.add(agentKey);
+      } catch (error) { failed.push(`the agent's mailbox (${error.message})`); }
     }
+    try {
     const sessions = this.live.sessions();
     for (const recipient of plan.recipients.filter((item) => item.address !== caller.address)) {
       const label = this.#label(sessions, recipient.address);
@@ -390,7 +417,16 @@ export class MailSend {
         try { this.#fileUnread(recipient.address, sent); copied.push(label); } catch (error) { failed.push(`${label} (${error.message})`); }
         continue;
       }
-      try { reached.push(`${label} (${await this.#deliverWoken(sent, recipient.address, sessions, queue, notify_when_idle)})`); }
+      try {
+        const { how, text: said } = await this.#deliverWoken(sent, recipient.address, sessions, queue, notify_when_idle);
+        // only a hand-over is a reach: a copy left filed with nothing to carry it (queued, stored, held in the daemon's
+        // memory for a pane, or for a session not running) is held when its own wake carries it, and otherwise the
+        // agent's copy keeps its retry (t_b0f9a2a0: such a send was counted reached, and nothing carried it). One the
+        // sender asked to queue (--queue) is held as asked: its receiver reads it at its next turn
+        if (!LEFT_FILED.has(how)) reached.push(`${label} (${said})`);
+        else if (this.store.hasWake(recipient.address, sent.id) || (queue && how === 'queued')) held.push(`${label} (${said})`);
+        else failed.push(`${label} (${said}; handed over again when it can be)`);
+      }
       catch (error) {
         // held only when its copy is here, unread: its wake hands it over, or (queued, no wake) the receiver's own read
         // does. An unanswered request to another machine's door holds nothing here, so it is a failure, and the agent's
@@ -400,6 +436,7 @@ export class MailSend {
         else failed.push(error.unanswered ? `${label} (unanswered, whether it arrived is unknown: ${error.message})` : `${label} (${error.message})`);
       }
     }
+    } finally { if (agentKey) this.relaying.delete(agentKey); }
     const thread = plan.thread ? ` Thread ${shortId(plan.thread.id)}.` : '';
     // agent mail that reached nobody is never left only as a read record: its copy in the agent's mailbox goes back
     // unread with a wake, and the carrier hands it over again (handOver plans it anew) after its backoff, until a
@@ -450,18 +487,18 @@ export class MailSend {
       if (cameThroughLink(sent)) throw new Error(`not carried on to ${door.machine}: a message that came to this machine through a link is for its own sessions only`);
       const answer = await this.askMachine(door.machine, { op: 'file', to, envelope: sent });
       if (answer?.code !== 0) throw new Error(typeof answer?.text === 'string' ? answer.text : 'the other machine refused the message');
-      return 'filed on its machine';
+      return { how: 'other_machine', text: 'filed on its machine' };
     }
     if (!door) {
       // a reply to a closed session resumes it; only one the mailbox launched, the way it was launched
       this.store.deliver(to, sent);
-      if (!(await this.agents.resumable(to))) return 'stopped; not resumed, since the mailbox did not launch it: the message waits in its mailbox';
+      if (!(await this.agents.resumable(to))) return { how: 'not_running', text: 'stopped; not resumed, since the mailbox did not launch it: the message waits in its mailbox' };
       try { await this.agents.resume(to); } catch (error) { throw new Error(`not resumed: ${error.message}`); }
       const started = Date.now();
       for (;;) {
         door = this.#door(to, this.live.sessions());
         if (door) break;
-        if (Date.now() - started > RESUME_WAIT_MS) return 'resumed; the message waits in its mailbox';
+        if (Date.now() - started > RESUME_WAIT_MS) return { how: 'not_running', text: 'resumed; the message waits in its mailbox' };
         await sleep(1000);
       }
     }
@@ -472,7 +509,7 @@ export class MailSend {
       if (error instanceof Refused) throw new Error(`${error.bytes} bytes; the limit is ${MAX_RELAYED_BYTES}`);
       throw error;
     }
-    return { steered: 'steered into its running turn', started: 'started a turn', native_busy: 'read at its next tool call', native_idle: 'starts its next turn', hooked: 'in its mailbox, its hook shows it', queued: 'waits in its mailbox', operator: 'filed', already: 'it already had it', stored: 'stored; it has no delivery door', typed: 'typed into its pane', pane_held: 'held for its pane until its composer is free', pane_waits: 'waits in its mailbox (its composer was not empty)' }[how];
+    return { how, text: { steered: 'steered into its running turn', started: 'started a turn', native_busy: 'read at its next tool call', native_idle: 'starts its next turn', hooked: 'in its mailbox, its hook shows it', queued: 'waits in its mailbox', operator: 'filed', already: 'it already had it', stored: 'stored; it has no delivery door', typed: 'typed into its pane', pane_held: 'held for its pane until its composer is free', pane_waits: 'waits in its mailbox (its composer was not empty)' }[how] };
   }
 
   // ---- a filing --------------------------------------------------------------------------------------------------
@@ -724,6 +761,8 @@ export class MailSend {
       this.store.markRead(address, found.path);
       return { outcome: 'filed', detail: 'already handed over' };
     }
+    // a plan or a relay send still running here holds its wake (#1264 review P1)
+    if (this.relaying.has(`${address}\n${id}`)) return { outcome: 'later', detail: 'its delivery is still in progress' };
     const parsed = parseAddress(address);
     if (parsed?.harness === AGENT_HARNESS) {
       const plan = await this.#plan(sent, address, {});
@@ -743,8 +782,20 @@ export class MailSend {
     // one still running here (its carrier gave up on its answer, past its bound) is waited for: the wake stays and is
     // tried again after its backoff, settled by that hand-over's own outcome
     const key = `${address}\n${id}`;
-    if (this.handing.has(key)) return { outcome: 'later', detail: 'its hand-over is still in progress' };
-    if (state.handover_at_ms != null) return { outcome: 'filed', detail: 'an earlier hand-over never settled' };
+    if (this.handing.has(key) || this.relaying.has(key)) return { outcome: 'later', detail: 'its hand-over is still in progress' };
+    // an earlier hand-over never settled (the daemon ended mid-way): one its receiver's transcript holds landed, and is
+    // read; any other is handed over again, never given up (t_b0f9a2a0)
+    if (state.handover_at_ms != null && door.kind === 'native') {
+      // a relay that outlived its daemon may still be making that send (its queue still there, fresh): waited for, never
+      // sent beside it (#1264 review P2a)
+      if (this.relays.sending?.(sent.from, id)) return { outcome: 'later', detail: 'its relay may still be making it' };
+      let landed = false;
+      try { landed = await this.relays.landed(door.session.address.split(':').slice(3).join(':'), id, sent.from); } catch { /* unread: hand it over */ }
+      if (landed) {
+        try { this.store.claimFor(address, id, { pid: process.pid, via: 'door', caller: null, recipient: true, at_ms: Date.now() }); this.store.markRead(address, found.path); } catch { /* moved meanwhile */ }
+        return { outcome: 'filed', detail: 'an earlier hand-over landed' };
+      }
+    }
     this.store.setWakeState(address, id, { ...state, handover_at_ms: Date.now() });
     this.handing.add(key);
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.125",
+  "version": "0.3.127",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",