@volter/supercode-teams 0.3.133 → 0.3.134

package/bin/teams.mjs

@@ -204,7 +204,10 @@ async function main() {
         if (action === 'unregister' && root) return withNode(async (rpc) => out(await rpc.call('harness.v1.boards.unregister', { root: resolve(root) })));
         die('machine boards [list] | machine boards unregister <root>');
       }
-      die('machine start|status|restart|boards');
+      // `machine pane-of <pid>`: the pane this daemon launched that the process runs in, and who launched it, from the
+      // daemon's own record (the native's acting caller asks it for its own pid; never what a command sets for itself)
+      if (sub === 'pane-of') return withNode(async (rpc) => out(await rpc.call('harness.v1.pane_of', { pid: Number(rest[0]) })));
+      die('machine start|status|restart|boards|pane-of');
     }
     case 'slow': {
       // `slow [--since 1h|30m|<iso>]`: the slow log on this machine, grouped by what was slow (kind and name), the
@@ -252,7 +255,7 @@ async function main() {
         // the flag parser takes `--foreign p_…` as the flag's value: that pane is the one named
         const named = typeof flags.foreign === 'string' ? [flags.foreign, ...rest] : rest;
         if (named.length !== 1) die('panes close <pane> [--foreign]: one pane per close');
-        return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: named[0], foreign: flags.foreign !== undefined, ...(await acting()) })));
+        return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: named[0], foreign: flags.foreign !== undefined, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
       }
       // `window <pane> [machine]`: a terminal window on this machine's screen showing the pane, this machine's or, named,
       // another machine's (attached through Teams, in that machine's Teams context `--attach-context`); `--observe` shows it
@@ -281,9 +284,9 @@ async function main() {
       die('attention ls | rank | request <pane> [--urgency now|soon|whenever] [--reason text] | clear <pane>');
     }
     case 'suspend':
-      return withNode(async (rpc) => out(await rpc.call('panes.suspend', { pane: sub, interrupt: Boolean(flags.interrupt), ...(await acting()) })));
+      return withNode(async (rpc) => out(await rpc.call('panes.suspend', { pane: sub, interrupt: Boolean(flags.interrupt), ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
     case 'resume':
-      return withNode(async (rpc) => out(await rpc.call('panes.resume', { pane: sub, input: flags.input ? String(flags.input) : null, ...(await acting()) })));
+      return withNode(async (rpc) => out(await rpc.call('panes.resume', { pane: sub, input: flags.input ? String(flags.input) : null, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
     case 'files': {
       const path = rest[0];
       if (sub === 'ls') return withNode(async (rpc) => out(await rpc.call('files.list', { path })));
@@ -331,14 +334,14 @@ async function main() {
       // `--harness NAME` (with it): the addressed session's harness; the daemon refuses a pane running another program.
       if (flags['clear-draft']) {
         if (rest.length || flags.key || flags['no-enter'] || flags['when-composer-empty']) die('input <pane> --clear-draft only clears the current draft; send a new message separately');
-        return withNode(async rpc => out(await rpc.call('panes.clearDraft', { pane: sub, ...(await acting()) })));
+        return withNode(async rpc => out(await rpc.call('panes.clearDraft', { pane: sub, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
       }
       if (flags.key !== undefined) {
         if (flags.key === true || rest.length) die('input <pane> --key NAMES: keys by tmux name, space- or comma-separated (Escape, Enter, Tab, BTab, BSpace, Space, Up, Down, Left, Right, Home, End, PPage, NPage, DC, C-a … C-z)');
-        return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: keyBytes(String(flags.key)), submit: false, keys: true, ...(await acting()) })));
+        return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: keyBytes(String(flags.key)), submit: false, keys: true, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
       }
-      if (flags['when-composer-empty']) return withNode(async (rpc) => out(await rpc.call('panes.turn', { pane: sub, text: rest.join(' '), message_ids: flags['message-ids'] ? String(flags['message-ids']).split(',') : undefined, harness: typeof flags.harness === 'string' ? flags.harness : undefined, ...(await acting()) })));
-      return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: rest.join(' '), submit: !flags['no-enter'], message_ids: flags['message-ids'] ? String(flags['message-ids']).split(',') : undefined, ...(await acting()) })));
+      if (flags['when-composer-empty']) return withNode(async (rpc) => out(await rpc.call('panes.turn', { pane: sub, text: rest.join(' '), message_ids: flags['message-ids'] ? String(flags['message-ids']).split(',') : undefined, harness: typeof flags.harness === 'string' ? flags.harness : undefined, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
+      return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: rest.join(' '), submit: !flags['no-enter'], message_ids: flags['message-ids'] ? String(flags['message-ids']).split(',') : undefined, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
     case 'port': {
       // `port <pane>/<n> [--listen host:port]`: a machine port forwarded here. Stays up until ctrl-c.
       const spec = String(sub ?? '');
@@ -449,7 +452,7 @@ async function main() {
       return withNode(async (rpc) => out(await rpc.call('jobs.list', {})));
     case 'launches': {
       if (sub === 'get' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.get', { key: rest[0] })));
-      if (sub === 'cancel' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.cancel', { key: rest[0], ...(await acting()) })));
+      if (sub === 'cancel' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.cancel', { key: rest[0], ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
       if (sub === 'list') return withNode(async (rpc) => out(await rpc.call('launches.list', {})));
       die('launches get <key> | cancel <key> | list [--machine NAME]');
       return;

package/live-sessions.mjs

@@ -14,7 +14,7 @@
 // - Messaging tools: the marker a `message mcp` server writes for its session process, with the server alive.
 import { EventEmitter } from 'node:events';
 import { execFile } from 'node:child_process';
-import { mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, watch, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, watch, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { FrontendClient } from '@volter/supercode-frontend';
@@ -731,31 +731,40 @@ export class LiveSessions extends EventEmitter {
     return null;
   }
 
-  /** The session a client runs in, from its claim: its parent's current session, else its environment's id through the map. */
+  /**
+   * The session a client runs in, read from its process's ancestry, which this daemon reads itself, never from the
+   * environment the client's command set (#1245 review: `CLAUDE_CODE_SESSION_ID=<another session> supercode teams panes
+   * close` acted as that session). The nearest ancestor that is a live session's process names it: a Claude Code
+   * process its current session, a runtime supercode hosts by its receipt, a Codex process the thread the claim names
+   * only while that process holds the thread's rollout open (one Codex process serves several threads). On Windows,
+   * whose processes this reads no parents of, the claim's own session stands, as before.
+   */
   async #sessionOfClaim({ pid, ppid, session, runtime }) {
     // the probes of one claim share one bound (CLAIM_PROBE_MS), however many of its processes are runtimes
     const deadline = Date.now() + CLAIM_PROBE_MS;
-    // a runtime supercode hosts (the native agent) says so in its claim: it is named by its own process first, never by
-    // the session whose shell started it; one with no receipt is named by the rest of its claim, as any client is
     if (runtime === true) {
-      // a pid several receipts name is no one runtime: the rest of the claim names it, never a refusal here
       let own = null;
       try { own = await this.#runtimeOfPid(Number(pid), deadline); } catch (error) { if (!(error instanceof CallerRefused) || error.unconfirmed) throw error; }
       if (own) return own;
     }
-    const parent = this.claude.get(Number(ppid));
-    if (parent && alive(parent.pid)) return this.#address('claude-code', parent.sessionId);
-    if (typeof session === 'string' && session) {
-      const found = this.#sessionOfId(session);
-      if (!found) throw new CallerRefused(`the session this command runs in (${session}) is not one this machine's live sessions have held, so it cannot act for it; nothing was done`);
-      return found;
+    if (process.platform === 'win32') {
+      const parent = this.claude.get(Number(ppid));
+      if (parent && alive(parent.pid)) return this.#address('claude-code', parent.sessionId);
+      if (typeof session === 'string' && session) {
+        const found = this.#sessionOfId(session);
+        if (!found) throw new CallerRefused(`the session this command runs in (${session}) is not one this machine's live sessions have held, so it cannot act for it; nothing was done`);
+        return found;
+      }
+      for (const candidate of [Number(pid), Number(ppid)]) { const found = await this.#runtimeOfPid(candidate, deadline); if (found) return found; }
+      return null;
     }
-    // a runtime supercode hosts, calling from its own process or a child of it (the native agent's mail tool): taken
-    // only when exactly one live runtime's receipt names that process. A process several receipts name (harness serve
-    // records its own pid on each runtime it hosts with no child of its own) is no one runtime, and is refused.
-    for (const candidate of [Number(pid), Number(ppid)]) {
-      const found = await this.#runtimeOfPid(candidate, deadline);
-      if (found) return found;
+    const left = () => Math.max(250, deadline - Date.now());
+    for (const { pid: at, command } of await ancestryOf(Number(pid), left())) {
+      const claude = this.claude.get(at);
+      if (claude && alive(claude.pid)) return this.#address('claude-code', claude.sessionId);
+      const hosted = await this.#runtimeOfPid(at, deadline);
+      if (hosted) return hosted;
+      if (/(^|\/)codex$/.test(command) && typeof session === 'string' && /^[0-9a-f-]{8,64}$/.test(session) && await holdsRollout(at, session, left())) return this.#address('codex', session);
     }
     return null;
   }
@@ -785,27 +794,46 @@ export class LiveSessions extends EventEmitter {
    * a caller the map does not hold.
    */
   async callerOf(claim) {
-    const { pid, owner, named } = claim ?? {};
+    const { pid, named } = claim ?? {};
     const board = typeof named === 'string' ? new RegExp(`^sc:${this.machine.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}:board:([^:\\s]+)$`).exec(named) : null;
-    // a board's owner, by the pid it registered with: the client itself, or the owner that started it as the board
-    // (`SUPERCODE_BOARD_OWNER_PID`, set by the owner for the commands it runs as its board), alive
+    // a board's owner, by the pid it registered with: the client itself, or an ancestor of it (the owner runs the
+    // commands it runs as its board), alive. Only the proven pid's own ancestry says so: the owner pid a client names
+    // (`SUPERCODE_BOARD_OWNER_PID`) is its environment's word, which any command can set (#1245 review round 3)
     const registered = board ? this.boardOwner(board[1]) : null;
-    if (registered && [pid, Number(owner)].includes(registered) && alive(registered)) return named;
+    if (registered && alive(registered) && Number.isSafeInteger(Number(pid)) && Number(pid) > 1
+      && (Number(pid) === registered || (await ancestryOf(Number(pid), CLAIM_PROBE_MS)).some((row) => row.pid === registered))) return named;
     // A board's name from anything but its owner is not taken (a card's session, a pane run for the board): the caller
     // is the session the claim resolves to, or a person, as before (a board's name stood only under its own process).
     const session = await this.#sessionOfClaim(claim ?? {});
     if (session) return session;
     if (board) return null;
-    // a verb a pane runs for the session that launched it names that session: accepted while it is live
-    if (typeof named === 'string' && named) {
-      if (this.sessions().some((live) => live.address === named)) return named;
-      throw new CallerRefused(`${named} is not a live session on this machine, so nothing can act for it; nothing was done`);
-    }
-    // no session and no name: a person
+    // a session named in the environment (SUPERCODE_CALLER) is not taken: any command can set it (#1245 review). A pane
+    // a session launched acts for it by the daemon's own record of the pane (machine.mjs #callerOf); else no caller,
+    // which is no authority (a close of what the caller did not start needs --foreign)
+    if (process.platform === 'win32' && typeof named === 'string' && named && this.sessions().some((live) => live.address === named)) return named;
     return null;
   }
 }
 
+/** Process `pid` and its ancestors, nearest first, with each one's command name: one `ps` of every process. */
+async function ancestryOf(pid, timeout = 5000) {
+  if (!Number.isSafeInteger(pid) || pid <= 1) return [];
+  const table = await new Promise((resolve) => execFile(tool('ps'), ['-A', '-o', 'pid=,ppid=,comm='], { timeout, maxBuffer: 16 * 1024 * 1024 }, (_error, stdout) => resolve(String(stdout ?? ''))));
+  const rows = new Map();
+  for (const line of table.split('\n')) { const m = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line); if (m) rows.set(Number(m[1]), { ppid: Number(m[2]), command: m[3].trim() }); }
+  const chain = [];
+  for (let at = pid; at > 1 && chain.length < 64 && !chain.some((row) => row.pid === at) && rows.has(at); at = rows.get(at).ppid) chain.push({ pid: at, command: rows.get(at).command });
+  return chain;
+}
+
+/** Whether Codex process `pid` holds thread `thread`'s rollout open (its file is named by the thread's id), and no
+ *  other's: a process serving several threads (an app-server) names none of them, so a child cannot name a sibling. */
+async function holdsRollout(pid, thread, timeout = 5000) {
+  const out = await new Promise((resolve) => execFile(tool('lsof'), ['-a', '-p', String(pid), '-Fn'], { timeout, maxBuffer: 16 * 1024 * 1024 }, (_error, stdout) => resolve(String(stdout ?? ''))));
+  const rollouts = new Set(out.split('\n').filter((line) => line.startsWith('n') && /rollout-[^/]*\.jsonl$/.test(line)).map((line) => line.slice(1)));
+  return rollouts.size === 1 && [...rollouts][0].includes(thread);
+}
+
 /** A live-runtime receipt file, when it is one a delivery may use: its schema, and a loopback HTTP address. */
 function readReceiptFile(path) {
   let receipt = null;
@@ -824,3 +852,8 @@ export function ownClaim(env = process.env) {
   return { pid: process.pid, ppid: process.ppid, session: env.CLAUDE_CODE_SESSION_ID || env.CODEX_THREAD_ID || null, named: env.SUPERCODE_CALLER || null, owner: env.SUPERCODE_BOARD_OWNER_PID || null };
 }
 
+/** A system tool by its own path: a daemon's PATH (a service's) may hold no /usr/sbin, where macOS keeps lsof. */
+function tool(name) {
+  const at = { lsof: ['/usr/sbin/lsof', '/usr/bin/lsof', '/sbin/lsof'], ps: ['/bin/ps', '/usr/bin/ps'], ss: ['/usr/bin/ss', '/bin/ss', '/usr/sbin/ss', '/sbin/ss'] }[name] ?? [];
+  return at.find((path) => existsSync(path)) ?? name;
+}

package/machine.mjs

@@ -28,7 +28,7 @@
 import { ProcessTree, harnessProcesses } from './process-tree.mjs';
 import { spawn, spawnSync, execFile } from 'node:child_process';
 import { EventEmitter } from 'node:events';
-import { appendFileSync, readFileSync, writeFileSync, writeSync, statSync, readdirSync, mkdirSync, renameSync, rmSync, existsSync, openSync, readSync, closeSync, accessSync, constants } from 'node:fs';
+import { appendFileSync, readFileSync, writeFileSync, writeSync, statSync, readdirSync, mkdirSync, renameSync, rmSync, existsSync, openSync, readSync, closeSync, accessSync, constants, readlinkSync } from 'node:fs';
 import { basename, join, resolve, dirname, isAbsolute } from 'node:path';
 import { open as openAsync, readdir as readdirAsync } from 'node:fs/promises';
 import { askBoardOwner, BOARD_OPERATION_VERBS, boardHome } from '@volter/teams/board-owner';
@@ -1784,7 +1784,21 @@ export class TeamsMachine extends MachineCore {
     // observe attachment stays.
     let attachedBy = null;
     if (cap === 'control') {
-      try { attachedBy = await this.#callerOf(entry, stream.params); } catch (error) { this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'refused', detail: error.message }); return refuse(error.message); }
+      // control types into the pane (C-c, /exit): only a process the kernel shows at this connection's other end attaches
+      // with it, never one whose claim names another (#1245 review round 3; Windows' pipes show no peer)
+      if (entry.principal === 'local' && !entry.appDoor && entry.socket && process.platform !== 'win32' && !(await peerIs(entry.socket, Number(stream.params?.claim?.pid)))) {
+        const detail = 'the process attaching could not be confirmed as this connection\'s other end; nothing was done';
+        this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'refused', detail });
+        return refuse(detail);
+      }
+      try { attachedBy = await this.#actorOf(entry, stream.params); } catch (error) { this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'refused', detail: error.message }); return refuse(error.message); }
+      // no caller is no session proven, not a person proven: a person attaches from their terminal, so a process with
+      // none (one a session detached with setsid) gets no control by having no caller (#1245 review round 3)
+      if (attachedBy == null && entry.principal === 'local' && !entry.appDoor && entry.socket && process.platform !== 'win32' && !(await holdsTerminal(Number(stream.params?.claim?.pid)))) {
+        const detail = 'a command with no session behind it attaches with control only from a terminal; nothing was done';
+        this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'refused', detail });
+        return refuse(detail);
+      }
       const sessionTurn = this.#sessionTurn({}, attachedBy)?.refused;
       if (sessionTurn) { this.log.append({ principal, cap, target: `pane:${pane}`, outcome: 'refused', detail: sessionTurn.reason }); return refuse(`${sessionTurn.reason}; a session may attach to observe`); }
     }
@@ -2049,14 +2063,71 @@ export class TeamsMachine extends MachineCore {
     return { code: 0, address: caller, rendered: [...note, ...kept.map((index) => read.rendered[index])], plain: [...note, ...kept.map((index) => plain[index])], rows: kept.map((index) => read.rows[index]), omitted: left, token };
   }
 
+  /**
+   * The pane this daemon launched that process `pid` runs in: `{ pane, by }` (`by` null for a person's), or null for a
+   * process in none. Its ancestry is read here (one `ps`), the panes from this daemon's tmux server, and a pane counts only
+   * as the one its launch made: its tmux session created within 30 s of the launch's first record, so a session made
+   * later under a pane's name (a command in a pane can make one) is not that pane.
+   */
+  async #paneOfPid(pid) {
+    if (process.platform === 'win32') return null;
+    const read = (program, args) => new Promise((done) => execFile(program, args, { encoding: 'utf8', timeout: 5000, env: this.env }, (error, out) => done(error ? '' : String(out))));
+    const parents = new Map((await read('ps', ['-A', '-o', 'pid=,ppid='])).trim().split('\n').map((line) => line.trim().split(/\s+/).map(Number)).filter(([child, parent]) => child && parent));
+    const ancestry = [];
+    for (let at = pid; at > 1 && ancestry.length < 64 && !ancestry.includes(at); at = parents.get(at)) ancestry.push(at);
+    const panes = (await read('tmux', [...(this.tmuxSocket ? ['-L', this.tmuxSocket] : []), 'list-panes', '-a', '-F', '#{pane_pid} #{session_name} #{session_created}'])).trim().split('\n').map((line) => line.split(' ')).filter((fields) => fields.length === 3);
+    const hit = panes.find(([panePid]) => ancestry.includes(Number(panePid)));
+    if (!hit) return null;
+    const [, name, created] = hit;
+    let first = null, last = null;
+    try {
+      for (const line of readFileSync(this.p.launches, 'utf8').split('\n')) {
+        let row; try { row = JSON.parse(line); } catch { continue; }
+        if (row.pane !== name) continue;
+        first ??= row; if (row.key === first.key) last = row;
+      }
+    } catch { /* no launches */ }
+    const createdMs = Number(created) * 1000;
+    if (!first || !(createdMs >= first.t - 2000 && createdMs <= first.t + 30_000)) return { pane: name, by: null, launched: false };
+    return { pane: name, by: last?.by ?? null, launched: true };
+  }
+
+  /** Who acts on a pane through its doors (launch, cancel, close, input, suspend, resume, turn, a draft cleared, control
+   *  attached, and the caller handed to another machine for its remote forms): the
+   *  caller, except on Windows, where a local claim is only the client's own word (a named pipe shows no peer process),
+   *  so it is no caller there and acting on another's pane takes --foreign (#1245 review round 3). Mail keeps the claim's
+   *  sender, labelled as the machine sees it. */
+  async #actorOf(entry, params) {
+    const caller = await this.#callerOf(entry, params);
+    return process.platform === 'win32' && entry.principal === 'local' && !entry.appDoor ? null : caller;
+  }
+
   #callerOf(entry, params) {
     const named = typeof params.caller === 'string' && params.caller ? params.caller : null;
-    if (entry.principal !== 'local') return Promise.resolve(named);
+    // a caller another machine names for its own process: never a board (a board acts on its own machine) nor a session
+    // of this machine (this machine's sessions do not reach it through the link) (#1245 review)
+    if (entry.principal !== 'local') {
+      const parsed = named ? /^sc:([^:]+):([^:]+):/.exec(named) : null;
+      return Promise.resolve(parsed && parsed[2] !== 'board' && normalMachineName(parsed[1]) !== normalMachineName(machineName(this.env)) ? named : null);
+    }
     // A page the app door relays is an origin and a token, not this OS user: whatever it says of itself, it is a person.
     if (entry.appDoor) return Promise.resolve(null);
     const claim = params.claim && typeof params.claim === 'object' ? params.claim : null;
     if (!claim) return Promise.reject(Object.assign(new Error('this client did not say which session it runs in (a supercode older than this daemon); update it. Nothing was done'), { code: 403 }));
-    try { return Promise.resolve(this.live.callerOf(claim)); } catch (error) { return Promise.reject(error); }
+    // the session the claim's process runs under, as its ancestry says; else, in a pane this daemon launched, who
+    // launched it (this daemon's own record, never what the command set for itself: #1245 review)
+    return (async () => {
+      // the claim's pid stands only when it is this connection's other end, as the kernel says: a client that names
+      // another process (a session's) is no one (#1245 review). A connection made inside this daemon has no socket.
+      const pid = Number(claim.pid);
+      const proven = !entry.socket || await peerIs(entry.socket, pid);
+      const caller = await this.live.callerOf(proven ? claim : { ...claim, pid: null, ppid: null });
+      if (caller) return caller;
+      const pane = proven && Number.isSafeInteger(pid) && pid > 1 ? await this.#paneOfPid(pid) : null;
+      // a pane's launcher, but never a board's name: a board acts only under its own process, and a session on its card
+      // that is no session (its id unset) is no one, not its board (#1245 review P0)
+      return pane?.launched && pane.by && !/^sc:[^:]+:board:/.test(pane.by) ? pane.by : null;
+    })();
   }
 
   /** Whether `pid` holds the board lock of the home at `root` (`board.lock`, held by its owner's lock holder child): the
@@ -2100,7 +2171,10 @@ export class TeamsMachine extends MachineCore {
     });
   }
 
-  #refuseForeign(pane, caller) {
+  #refuseForeign(pane, caller, foreign = false) {
+    if (foreign) return;
+    // no caller is no authority: it types into, suspends or turns another's pane only with --foreign (#1245 review)
+    if (caller == null) throw Object.assign(new Error(`pane ${pane}: no session or pane is behind this command, so nothing says it may act on that pane. Nothing was done; say --foreign to act on another's pane`), { code: 403 });
     const starter = this.#foreignStarter(pane, caller);
     if (starter) throw Object.assign(new Error(`pane ${pane} ${starter}, not by ${caller}: a session acts only on the panes it started. Nothing was done; reach that session through its own doors (supercode message send)`), { code: 403 });
   }
@@ -3313,7 +3387,7 @@ export class TeamsMachine extends MachineCore {
         if (programName === 'codex') params = { ...params, kind: 'codex' };
         const key = params.key ?? `lk_${randomBytes(9).toString('base64url')}`;
         // who starts it: a claim the map refuses refuses the launch, never records it as a person's
-        const by = await this.#callerOf(entry, params);
+        const by = await this.#actorOf(entry, params);
         // A pane that reopens an existing session (`supercode open <id>`) is that session's resume, by `by`: kept as
         // `resumes`, with the session as its native session, so the row joins to its session without the pane and the
         // session's first starter stays the `by` of its own launch. `by` stays who started this pane (#refuseForeign).
@@ -3364,8 +3438,11 @@ export class TeamsMachine extends MachineCore {
             command: this.#nativeQuestionCommand(params, contextKey, by, (value) => { nativeInput = value; }),
             contextKey,
             cwd: params.cwd,
-            // A pane that runs one verb for its launcher (`close`/`stop` on another machine) acts as that launcher.
-            env: this.#paneEnv(contextKey, params.actForCaller && by ? { ...params.env, SUPERCODE_CALLER: by } : params.env),
+            // A pane that runs one verb for its launcher (`close`/`stop` on another machine) is told who that is; what a
+            // process in any pane acts for is read from this daemon's own record (harness.v1.pane_of), never its
+            // environment. Neither variable is taken from the request's own env, where a session could name another.
+            env: this.#paneEnv(contextKey, (({ SUPERCODE_CALLER: _caller, SUPERCODE_LAUNCHED_BY: _launched, ...asked }) =>
+              params.actForCaller && by ? { ...asked, SUPERCODE_CALLER: by } : asked)(params.env ?? {})),
             // The pane's own tmux session is always its key: the exit hooks record and clean up p_* sessions only, and
             // a pane named otherwise lingered dead with its exit status lost. A launch's name is its title.
             name: contextKey,
@@ -3426,7 +3503,7 @@ export class TeamsMachine extends MachineCore {
       case 'launches.cancel': {
         if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });
         if (typeof params.key !== 'string' || !params.key.trim()) throw Object.assign(new Error('launch cancellation requires a nonempty key'), { code: 400 });
-        const by = await this.#callerOf(entry, params);
+        const by = await this.#actorOf(entry, params);
         // Retire only an absent key. An issued, live or failed launch keeps its actual
         // receipt; cancellation never closes a pane or guesses that issuance did not happen.
         let found = this.launches.find(params.key);
@@ -3496,12 +3573,14 @@ export class TeamsMachine extends MachineCore {
         // only a pane here (open, or still starting) is anyone's: one this machine lacks is answered as absent, before
         // the caller is asked for
         const here = starting.length > 0 || Boolean(await this.#paneByContext(params.pane));
-        const closeBy = here ? await this.#callerOf(entry, params) : null;
-        const starter = params.foreign === true || !here ? null : this.#foreignStarter(params.pane, closeBy);
+        const closeBy = here ? await this.#actorOf(entry, params) : null;
+        // no caller (a command with no session behind it, in no pane a session launched) is no authority: a session that
+        // left its own ancestry looks the same, so closing what nobody shown started needs --foreign too (#1245 review)
+        const starter = params.foreign === true || !here ? null : closeBy == null ? 'was not started by this command (no session or pane is behind it)' : this.#foreignStarter(params.pane, closeBy);
         // the pane the caller runs in: a Claude row names it as its tmux locator (`p_…:@window.%pane`), the others as the pane
         if (starter && !this.live.sessions().some((live) => live.address === closeBy && String(live.pane ?? '').split(':')[0] === params.pane)) {
           act('close', `pane:${params.pane}`, 'refused', `foreign: ${starter}`);
-          throw Object.assign(new Error(`pane ${params.pane} ${starter}, not by ${closeBy}. Nothing was closed. A session closes the panes it started; closing another's is deliberate: read what the pane holds, settle it with whoever started it, then close that one pane with --foreign`), { code: 403 });
+          throw Object.assign(new Error(`pane ${params.pane} ${starter}${closeBy ? `, not by ${closeBy}` : ""}. Nothing was closed. A session closes the panes it started; closing another's is deliberate: read what the pane holds, settle it with whoever started it, then close that one pane with --foreign`), { code: 403 });
         }
         for (const pending of starting) pending.abort.abort();
         const session = await this.#paneByContext(params.pane);
@@ -3520,8 +3599,8 @@ export class TeamsMachine extends MachineCore {
         // working, only `{input}` is refused — until `resume`, which may carry
         // the input that hands the pane back. Local tmux input is never touched.
         need('control', `pane:${params.pane}`);
-        const resumeBy = await this.#callerOf(entry, params);
-        this.#refuseForeign(params.pane, resumeBy);
+        const resumeBy = await this.#actorOf(entry, params);
+        this.#refuseForeign(params.pane, resumeBy, params.foreign === true);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         // the input a resume carries is a turn like any other: a session's is mail, and the door's is recorded first
@@ -3550,8 +3629,8 @@ export class TeamsMachine extends MachineCore {
         // mechanics) for callers that are services rather than terminals. Same gate as an
         // attachment in control mode, same suspend rule as remote input everywhere.
         need('control', `pane:${params.pane}`);
-        const inputBy = await this.#callerOf(entry, params);
-        this.#refuseForeign(params.pane, inputBy);
+        const inputBy = await this.#actorOf(entry, params);
+        this.#refuseForeign(params.pane, inputBy, params.foreign === true);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw Object.assign(new Error(`no pane with context ${params.pane}`), { code: 404 });
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });
@@ -3580,7 +3659,7 @@ export class TeamsMachine extends MachineCore {
       }
       case 'panes.clearDraft': {
         need('control', `pane:${params.pane}`);
-        this.#refuseForeign(params.pane, await this.#callerOf(entry, params));
+        this.#refuseForeign(params.pane, await this.#actorOf(entry, params), params.foreign === true);
         const session = await this.#paneByContext(params.pane);
         if (!session) throw new Error(`no pane with context ${params.pane}`);
         if (this.suspended.has(params.pane)) throw new Error('pane is suspended; resume remote input first');
@@ -3640,8 +3719,8 @@ export class TeamsMachine extends MachineCore {
         // answer, not an error: the caller keeps the turn and asks again. Its own
         // method, so a daemon without it refuses instead of typing into a draft.
         need('control', `pane:${params.pane}`);
-        const turnBy = await this.#callerOf(entry, params);
-        this.#refuseForeign(params.pane, turnBy);
+        const turnBy = await this.#actorOf(entry, params);
+        this.#refuseForeign(params.pane, turnBy, params.foreign === true);
         // a refused turn acts on nothing: the refusal comes before any capture, wait or key in the pane
         const sessionTurn = this.#sessionTurn(params, turnBy);
         if (sessionTurn?.refused) { act('control', `pane:${params.pane}`, 'refused', JSON.stringify(sessionTurn.refused)); return sessionTurn.refused; }
@@ -4030,9 +4109,18 @@ export class TeamsMachine extends MachineCore {
       }
       // Who a local client is, from its claim (live-sessions.mjs callerOf): what a command acting on another machine sends
       // there as its caller, resolved here, where the map that holds it is. Local only; never the app door's.
+      // The pane this daemon launched that a local process runs in, and who started that pane: what a process with no
+      // session above it acts for (main.rs acting_caller), read here from the daemon's own launches and its tmux server,
+      // never from the asking process's environment, which its command sets (#1245 review: `env SUPERCODE_CALLER=…`).
+      case 'harness.v1.pane_of': {
+        if (entry.principal !== 'local' || entry.appDoor) throw Object.assign(new Error('a pane is resolved only for a process on this machine'), { code: 403 });
+        const pid = Number(params.pid);
+        if (!Number.isSafeInteger(pid) || pid <= 1) throw Object.assign(new Error('name the process (pid)'), { code: 400 });
+        return { pane: await this.#paneOfPid(pid) };
+      }
       case 'harness.v1.caller': {
         if (entry.principal !== 'local' || entry.appDoor) throw Object.assign(new Error('a caller is resolved only for a process on this machine'), { code: 403 });
-        return { caller: await this.#callerOf(entry, params) };
+        return { caller: await this.#actorOf(entry, params) };
       }
       case 'harness.v1.boards.register': case 'harness.v1.boards.list': case 'harness.v1.boards.unregister': {
         // A board home this machine keeps, published to its team by its connector (board-events.mjs).
@@ -4354,6 +4442,48 @@ function healthEntry(env) {
   return existsSync(sibling) ? sibling : null;
 }
 
+/**
+ * Whether process `pid` is the other end of local connection `socket`, as the kernel says: the daemon's socket for it
+ * and a socket of `pid` paired (macOS: lsof's own address and its peer's; Linux: the socket inodes ss pairs). Unknown
+ * (no fd, no tool) is no.
+ */
+async function peerIs(socket, pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 1) return false;
+  const fd = socket?._handle?.fd;
+  if (!Number.isInteger(fd) || fd < 0) return false;
+  const read = (program, args) => new Promise((done) => execFile(program, args, { encoding: 'utf8', timeout: 5000, maxBuffer: 16 * 1024 * 1024 }, (error, out) => done(error && !out ? '' : String(out ?? ''))));
+  if (process.platform === 'darwin') {
+    const own = /\nd(0x[0-9a-f]+)/.exec(await read(tool('lsof'), ['-a', '-p', String(process.pid), '-d', String(fd), '-U', '-F', 'd']))?.[1];
+    if (!own) return false;
+    return (await read(tool('lsof'), ['-a', '-p', String(pid), '-U', '-F', 'n'])).split('\n').includes(`n->${own}`);
+  }
+  if (process.platform === 'linux') {
+    let inode = null;
+    try { inode = /socket:\[(\d+)\]/.exec(readlinkSync(`/proc/self/fd/${fd}`))?.[1] ?? null; } catch { return false; }
+    if (!inode) return false;
+    // ss -xp: a row per socket, its own inode and its peer's; the peer's row names its process
+    const rows = (await read(tool('ss'), ['-xpn'])).split('\n');
+    const mine = rows.find((row) => new RegExp(`\\s${inode}\\s+\\S+\\s+(\\d+)`).test(row));
+    const peer = mine ? new RegExp(`\\s${inode}\\s+\\S+\\s+(\\d+)`).exec(mine)?.[1] : null;
+    if (!peer) return false;
+    return rows.some((row) => new RegExp(`\\s${peer}\\s+\\S+\\s+${inode}\\b`).test(row) && row.includes(`pid=${pid},`));
+  }
+  return false;
+}
+
+/** Whether process `pid` has a controlling terminal (a person's command has; one detached with setsid has none). */
+async function holdsTerminal(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 1) return false;
+  const tty = await new Promise((done) => execFile(tool('ps'), ['-o', 'tty=', '-p', String(pid)], { encoding: 'utf8', timeout: 5000 }, (_error, out) => done(String(out ?? '').trim())));
+  return Boolean(tty) && !/^[?-]+$/.test(tty);
+}
+
+/** A system tool by its own path: a daemon's PATH (a service's) may hold no /usr/sbin, where macOS keeps lsof. */
+function tool(name) {
+  const at = { lsof: ['/usr/sbin/lsof', '/usr/bin/lsof', '/sbin/lsof'], ps: ['/bin/ps', '/usr/bin/ps'], ss: ['/usr/bin/ss', '/bin/ss', '/usr/sbin/ss', '/sbin/ss'] }[name] ?? [];
+  return at.find((path) => existsSync(path)) ?? name;
+}
+
 /** What supercode's Windows shim runs, from its one line (`@"<node>" "<front door>" %*`, or `@"<native>" %*`;
  *  claude_relay.rs writes it): `[program, ...args]`, or null for a shim of another form. */
 function shimTarget(path) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.133",
+  "version": "0.3.134",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",