@volter/supercode-teams 0.3.149 → 0.3.151

package/README.md

@@ -22,6 +22,15 @@ the matching harness SDK and native core; source capabilities and fidelity remai
 Fresh-session materialization supports Claude Code and Codex with requested `value_lossless`;
 telemetry alone does not establish resumable native history.
 
+The node door's `harness.v1.close.route` reads a remote close route and the
+verified caller at its local origin. `harness.v1.sessions.close_remote` accepts
+that forwarded caller at the target's Teams door only, under pane control. It
+retains native live-work checks, then calls the existing pane-close door to
+recheck its grant, recorded starter and host entry. It adds no caller identity
+or origin-attestation protocol. A nonstarter needs explicit
+`foreign: true` for that one pane. These are node-door methods, not additions to
+the native harness service. [Scope and qualification](../../docs/evidence/remote-pane-close-2026-10-08.md).
+
 See the [public client declarations](workspace-client.d.ts), [contracts](contracts/index.d.ts),
 and [implementation specification](../../docs/plans/teams-server-build/README.md).
 
@@ -169,6 +178,25 @@ its token or removing an origin closes the channels already admitted; a door lef
 off. While its port is taken the daemon retries every ten seconds, and `status` shows why it is not
 listening (app-door.state.json).
 
+## Native mail continuation
+
+Mail to an old Claude Code address follows only the harness's explicit terminal
+`continued-in` record to a live UUID on the same machine. It never infers a route
+from a name or working directory. The send result and receipt retain
+`continuation: { addressed, recipient, chain }`; send logs retain that metadata.
+The existing plain-text sent markers and native relay behavior are unchanged.
+If the receiver rolls over between an attempt and a same-`--id` repeat, delivery
+to its successor can duplicate the message (separate task t_65153cfb). This
+routing correction does not promise exactly-once delivery across rollover.
+The target daemon rechecks mail grants on all routed addresses. A grant on only
+the old address does not cover its continuation. Caller identity, pane ownership,
+history access and old mailbox contents are unchanged.
+
+The named lookup reads at most 64 KiB per transcript tail and follows at most
+16 links within a shared 4,096-project-entry / 750 ms work budget. Incomplete,
+changed, conflicting or cyclic records are refused. The filesystem reads are
+asynchronous; an in-progress OS read is not cancelled by the elapsed budget.
+
 ## Files (under `$SUPERCODE_HOME/teams`)
 
 `machine.key|pub` (the host key; it signs `describe` and nothing else) · `machine.sock` ·

package/machine.mjs

@@ -35,6 +35,7 @@ import { askBoardOwner, BOARD_OPERATION_VERBS, boardHome } from '@volter/teams/b
 import { openMachine, normalMachineName } from '@volter/teams/machine-door';
 import { RecordHolder, RecordProducer, RECENT_PER_MAILBOX, RECORDS_NOT_GRANTED } from './machine-records.mjs';
 import { LiveSessions, ACTING_VARIABLES } from './live-sessions.mjs';
+import { checkRemoteClose } from './remote-close.mjs';
 import { MailStore } from './mail/store.mjs';
 import { MailReads, panePrompt } from './mail/reads.mjs';
 import { render } from './mail/envelope.mjs';
@@ -796,6 +797,7 @@ export class TeamsMachine extends MachineCore {
       return result.waits ?? result;
     };
     this.mailSend = new MailSend({ machine, mailRoot, live, store: this.mailStore, agents: this.agents, relays: this.relays,
+      claudeProjects: () => [...live.claudeDirs.keys()].map((dir) => join(dirname(dir), 'projects')),
       // a send waits on its receiver's door there (a relay's receipt takes up to 90 s), never past MAIL_SEND_MS
       askMachine: (to, request) => this.#askMailDoor(to, request, MAIL_SEND_MS),
       deliverRuntime: deliverToRuntime, codexAnswer: (request) => codexQuestions(request),
@@ -1597,7 +1599,18 @@ export class TeamsMachine extends MachineCore {
     const link = linkOf(principal, entry.principalName ?? null);
     void (async () => {
       let answer;
-      try { answer = request.op === 'file' ? this.#fileHere(request, link) : await this.#sendHere(request, link); }
+      try { answer = request.op === 'file' ? this.#fileHere(request, link) : await this.#sendHere(request, link, async (addresses) => {
+        // Native continuation changes a recipient, not a grant. Re-derive this stream's admission after the named
+        // transcript read, and require mail on every address in its route before the send can file anything.
+        if (stream.closed) return 'the mail stream closed before delivery';
+        const fresh = entry.verify ? await entry.verify() : entry.admitted;
+        if (stream.closed) return 'the mail stream closed before delivery';
+        if (fresh) entry.admitted = fresh;
+        const missing = addresses.find(address => !holds(fresh, 'mail', `mail:${address}`));
+        if (!missing) return null;
+        this.log.append({ principal, cap: 'mail', target: `mail:${missing}`, outcome: 'refused', detail: 'receiver grant' });
+        return `no live mail grant for mail:${missing}`;
+      }); }
       catch (error) { answer = { outcome: 'failed', detail: error.message }; }
       this.log.append({ principal, cap: 'mail', target, outcome: answer.outcome === 'failed' || (answer.code ?? 0) !== 0 ? 'failed' : request.op, detail: answer.outcome === 'failed' ? String(answer.detail).slice(0, 200) : undefined });
       if (stream.closed) return;
@@ -1609,14 +1622,14 @@ export class TeamsMachine extends MachineCore {
   /** A send through the mail door, for a session here: one for another machine is
    *  refused when it came through a link (never forwarded on this machine's own credential), and this machine's own
    *  daemon sends on through the one way out. */
-  async #sendHere(request, link) {
+  async #sendHere(request, link, authorizeRecipients) {
     const from = parseAddress(request.from)?.address;
     if (!from) return { code: 2, text: `\`${request.from}\` is not a session address; addresses look like sc:<machine>:<harness>:<session-id>`, receipt: null };
     const text = (key) => (typeof request[key] === 'string' ? request[key] : null);
     return this.mailSend.send({ address: from, name: text('from_name') ?? '' }, text('to') ?? '', text('body') ?? '', {
       subject: text('subject'), in_reply_to: text('in_reply_to'), notify_when_idle: request.notify_when_idle === true, queue: request.queue === true,
       id: text('id'), notice: request.notice === true, thread: text('thread'),
-    }, { link });
+    }, { link, authorizeRecipients });
   }
 
   /** A message another machine's mailbox carried here, filed in a mailbox here: the
@@ -3732,6 +3745,7 @@ export class TeamsMachine extends MachineCore {
         // says so (`foreign`), one pane at a time, by name: a listing piped into close is refused pane by pane rather
         // than ending every session on the machine (docs/adr/0004-pane-close-authority.md).
         const starting = [...this.pendingStartups.values()].filter((pending) => pending.pane === params.pane);
+        if (params.expected && starting.length) throw Object.assign(new Error(`pane ${params.pane} began starting during its close check; nothing was closed`), { code: 409 });
         // only a pane here (open, or still starting) is anyone's: one this machine lacks is answered as absent, before
         // the caller is asked for
         const here = starting.length > 0 || Boolean(await this.#paneByContext(params.pane));
@@ -3750,6 +3764,10 @@ export class TeamsMachine extends MachineCore {
           act('close', `pane:${params.pane}`, 'ok', 'already absent');
           return { closed: params.pane, alreadyAbsent: true };
         }
+        // The remote session-close wrapper checked this exact host entry before reaching this existing door. A
+        // changed pane must not inherit that check; ordinary pane-close callers keep their existing behavior.
+        if (params.expected && (session.id !== params.expected.id || session.rootPid !== params.expected.rootPid
+          || session.dead !== params.expected.dead)) throw Object.assign(new Error(`pane ${params.pane} changed during its close check; nothing was closed`), { code: 409 });
         await this.host.closeSession(session.id);
         act('close', `pane:${params.pane}`, 'ok', params.foreign === true ? `foreign, by ${closeBy ?? 'a person'}` : null);
         this.#panesChanged();
@@ -4284,6 +4302,67 @@ export class TeamsMachine extends MachineCore {
         if (entry.principal !== 'local' || entry.appDoor) throw Object.assign(new Error('a caller is resolved only for a process on this machine'), { code: 403 });
         return { caller: await this.#actorOf(entry, params) };
       }
+      case 'harness.v1.close.route': {
+        if (entry.principal !== 'local' || entry.appDoor) throw Object.assign(new Error('a close route is read only at its origin machine'), { code: 403 });
+        const target = String(params.target ?? '');
+        if (!target || target.length > 500) throw Object.assign(new Error('close names one target'), { code: 400 });
+        const self = normalMachineName(machineName(this.env));
+        let machine, address = null;
+        const exact = parseAddress(target);
+        if (exact) { machine = exact.machine; address = target; }
+        else if (target.includes('@')) machine = target.slice(target.lastIndexOf('@') + 1);
+        else if (/^p_[A-Za-z0-9_-]+$/.test(target)) {
+          if (await this.#paneByContext(target)) return { remote: false };
+          const found = Object.entries(this.records?.holder.read() ?? {}).filter(([, held]) => held.record?.panes?.panes?.some(row => row.pane === target && !row.dead));
+          if (found.length > 1) throw Object.assign(new Error(`pane ${target} is recorded on more than one machine; nothing was closed`), { code: 409 });
+          machine = found[0]?.[0];
+        } else {
+          const resolved = this.mail.teamAddress(target, name => this.mailSend.remembered(name));
+          if (resolved.error) throw Object.assign(new Error(resolved.error), { code: 409 });
+          if (resolved.to) { address = resolved.to; machine = parseAddress(address)?.machine; }
+        }
+        if (!machine || normalMachineName(machine) === self) return { remote: false };
+        let caller;
+        try { caller = await this.#actorOf(entry, params); }
+        catch (error) { if (params.foreign !== true) throw error; caller = null; }
+        let identity = null;
+        if (caller) identity = readJson(join(this.home, 'agent-session-contexts.json'), { sessions: {} }).sessions[caller.split(':').slice(2).join(':')] ?? null;
+        return { remote: true, machine, target: address ?? target, caller, agent: identity?.agent ?? null, context: identity?.context ?? null };
+      }
+      case 'harness.v1.sessions.close_remote': {
+        // The same origin-resolved caller and Teams admission as remote panes.close. This wrapper adds the native
+        // session's close safeguards, then calls that existing pane door; it creates no new caller identity.
+        if (entry.principal === 'local' || entry.appDoor) throw Object.assign(new Error('remote close is called through the target machine\'s Teams door'), { code: 403 });
+        const target = String(params.target ?? '');
+        if (!target || target.length > 500) throw Object.assign(new Error('remote close names one target'), { code: 400 });
+        let pane = /^p_[A-Za-z0-9_-]+$/.test(target) ? target : null;
+        if (!pane) {
+          const resolved = this.mail.resolve(target);
+          if (resolved.error) throw Object.assign(new Error(resolved.error.replace(/Nothing was sent/g, 'Nothing was closed')), { code: 404 });
+          const live = this.live.sessions().find(row => row.address === resolved.address);
+          pane = live ? this.mail.paneOf(live) : null;
+          if (!pane) return { native: true };
+        }
+        need('control', `pane:${pane}`);
+        const caller = await this.#actorOf(entry, params);
+        const foreign = params.foreign === true;
+        const session = await this.#paneByContext(pane);
+        if (!session) return { closed: pane, alreadyAbsent: true };
+        if (this.pendingStartups && [...this.pendingStartups.values()].some(row => row.pane === pane)) throw Object.assign(new Error(`pane ${pane} is still starting; nothing was closed`), { code: 409 });
+        this.#refuseForeign(pane, caller, foreign);
+        const recheck = !foreign ? await checkRemoteClose({ pane, session, kind: this.#paneKind(pane, session),
+          live: this.live.sessions().filter(row => this.mail.paneOf(row) === pane), native: this.supercodeBin, env: this.env,
+          activity: pid => this.#serveRequest('harness.v1.sessions.activity_under', { pids: [pid] }, 4000) }) : null;
+        // Every await above can admit a replacement pane, a changed grant or a conflicting launch attempt.
+        const current = await this.#paneByContext(pane);
+        if (!current) return { closed: pane, alreadyAbsent: true };
+        if (current.id !== session.id || current.rootPid !== session.rootPid || current.dead !== session.dead) throw Object.assign(new Error(`pane ${pane} changed during its close check; nothing was closed`), { code: 409 });
+        if (recheck) await recheck();
+        // Re-enter the ordinary close door: re-admit its current grant, re-read its starter and current host entry,
+        // and close through the same host operation that already works for the starter's remote panes.close.
+        return this.#dispatch(entry, 'panes.close', { pane, caller, foreign,
+          expected: { id: session.id, rootPid: session.rootPid, dead: session.dead } });
+      }
       case 'harness.v1.boards.register': case 'harness.v1.boards.list': case 'harness.v1.boards.unregister': {
         // A board home this machine keeps, published to its team by its connector (board-events.mjs).
         if (!operator) throw Object.assign(new Error('operators only'), { code: 403 });

package/mail/continuation.mjs

@@ -0,0 +1,101 @@
+// Native continuation is a mail route, never a caller identity or an authority alias. Only Claude's own terminal
+// continued-in row links two UUIDs. Read the requested filenames and their tails, not every transcript in a home.
+import { open, opendir, realpath, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { makeAddress, parseAddress } from './compose.mjs';
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const TAIL_BYTES = 64 * 1024;
+const MAX_PROJECTS = 4096;
+const MAX_HOPS = 16;
+const LOOKUP_MS = 750;
+const unchanged = (a, b) => a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs && a.ino === b.ino && a.dev === b.dev;
+const problem = (reason) => Object.assign(new Error(reason), { continuation: true });
+
+/** All followed homes must agree on the named transcript: a UUID copied to another project/home is ambiguous. */
+async function namedTranscript(id, roots, budget) {
+  const found = new Set();
+  for (const root of new Set(roots)) {
+    budget.check();
+    let directory;
+    try { directory = await opendir(root); }
+    catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+    for await (const project of directory) {
+      budget.check();
+      if (++budget.projects > MAX_PROJECTS) throw problem('the named transcript lookup exceeded its project bound');
+      if (!project.isDirectory() && !project.isSymbolicLink()) continue;
+      const path = join(root, project.name, `${id}.jsonl`);
+      try {
+        if ((await stat(path)).isFile()) found.add(await realpath(path));
+      } catch (error) { if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') throw error; }
+      if (found.size > 1) throw problem('more than one native transcript has that session id');
+    }
+  }
+  budget.check();
+  return [...found][0] ?? null;
+}
+
+/** A complete, unchanged final JSONL row. A partial write, large final row or changed file cannot establish a route. */
+async function terminalContinuation(path, id, budget) {
+  budget.check();
+  const file = await open(path, 'r');
+  try {
+    const before = await file.stat({ bigint: true });
+    const size = Number(before.size);
+    if (!Number.isSafeInteger(size)) throw problem('the native transcript size is not readable');
+    if (!size) return null;
+    const start = Math.max(0, size - TAIL_BYTES);
+    const bytes = Buffer.alloc(size - start);
+    const { bytesRead } = await file.read(bytes, 0, bytes.length, start);
+    const after = await file.stat({ bigint: true });
+    budget.check();
+    if (bytesRead !== bytes.length || !unchanged(before, after)) throw problem('the native transcript changed during its continuation read');
+    let end = bytes.length;
+    if (bytes[end - 1] !== 10) throw problem('the native transcript has an incomplete final row');
+    while (end && (bytes[end - 1] === 10 || bytes[end - 1] === 13)) end--;
+    const boundary = bytes.lastIndexOf(10, end - 1);
+    if (start && boundary < 0) throw problem('the native transcript final row exceeds the continuation read bound');
+    let row;
+    try { row = JSON.parse(bytes.subarray(boundary + 1, end).toString('utf8')); }
+    catch { throw problem('the native transcript final row is unreadable'); }
+    if (row?.type !== 'continued-in') return null;
+    if (row.sessionId !== id || typeof row.continuedInSessionId !== 'string' || !UUID.test(row.continuedInSessionId) || row.continuedInSessionId === id || row.isSidechain === true) {
+      throw problem('the native continuation row does not identify a distinct continuation of that session');
+    }
+    return row.continuedInSessionId;
+  } finally { await file.close(); }
+}
+
+/** Resolve an exact old native address to a currently live receiver. No route is cached, guessed or persisted.
+ * The shared budget bounds project entries, hops and elapsed lookup work, and each file read is at most 64 KiB.
+ * Filesystem calls are asynchronous; the elapsed bound is checked after each await, not an OS I/O cancellation.
+ */
+export async function nativeMailContinuation(address, { machine, claudeProjects, sessions }) {
+  const parsed = parseAddress(address);
+  if (parsed?.machine !== machine || parsed.harness !== 'claude-code' || !UUID.test(parsed.session)) return null;
+  const budget = { projects: 0, until: performance.now() + LOOKUP_MS, check() {
+    if (performance.now() > this.until) throw problem('the named transcript continuation lookup exceeded its time bound');
+  } };
+  const chain = [address];
+  try {
+    for (let hop = 0; hop <= MAX_HOPS; hop++) {
+      // The exact address may resume while its old transcript is being read. A currently live exact receiver wins.
+      if (sessions().some((row) => row.address === address)) return null;
+      const current = chain.at(-1);
+      const session = sessions().find((row) => row.address === current);
+      if (session) return chain.length > 1 ? { session, addressed: address, chain } : null;
+      if (hop === MAX_HOPS) throw problem('the native continuation chain exceeded its hop bound');
+      const id = parseAddress(current).session;
+      const path = await namedTranscript(id, claudeProjects(), budget);
+      const next = path ? await terminalContinuation(path, id, budget) : null;
+      if (!next) {
+        if (chain.length > 1) throw problem(`the recorded continuation ${current} is not running and records no further continuation`);
+        return null;
+      }
+      const target = makeAddress(machine, 'claude-code', next);
+      if (chain.includes(target)) throw problem('the native continuation chain contains a cycle');
+      chain.push(target);
+    }
+  } catch (error) { return { error: error.continuation ? error.message : `the native continuation could not be read (${error.code ?? 'filesystem error'})` }; }
+  return null;
+}

package/mail/send.mjs

@@ -10,6 +10,7 @@ import { blake3Hex, render, shortId } from './envelope.mjs';
 import { AGENT_HARNESS, RESUME_WAIT_MS } from './agents.mjs';
 import { MAX_RELAYED_BYTES, RELAY_NAME_PREFIX } from './relay.mjs';
 import { FULL_ID_LEN, cameThroughLink, envelope as makeEnvelope, makeAddress, messageIdFor, newMessageId, normalMachineName, parseAddress, senderIdentity, subjectLine, threadOf } from './compose.mjs';
+import { nativeMailContinuation } from './continuation.mjs';
 
 export const EXIT_REFUSED = 2;
 export const EXIT_UNKNOWN = 3;
@@ -56,8 +57,8 @@ export class MailSend {
    * question's answer through its app-server; `typeTurn(pane, harness, text, ids)` a user's own turn typed into a daemon
    * pane's empty composer (machine.mjs `#paneTurn`: `{ delivered }`, `{ queued }`, or neither when it waits).
    */
-  constructor({ machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, log = () => {} }) {
-    Object.assign(this, { machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, log });
+  constructor({ machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, claudeProjects = () => [], log = () => {} }) {
+    Object.assign(this, { machine, mailRoot, live, store, agents, relays, askMachine, deliverRuntime, codexAnswer, typeTurn, claudeProjects, log });
     this.handing = new Set(); // `<address>\n<id>` of each hand-over running here (handOver)
     this.relaying = new Set(); // `<address>\n<id>` of each relay send running here (route): its wake waits for it
   }
@@ -70,6 +71,16 @@ export class MailSend {
    * came through (`{ principal, name }`), or null for this machine's own callers. Answers `{ code, text, receipt }`.
    */
   async send(caller, to, body, options = {}, context = {}) {
+    if (context.link && this.#remoteMachine(to)) return outcome(EXIT_UNKNOWN, `${to} is not on this machine; a send through its mail door is for its own sessions.`);
+    // Every stream earns its current route's grants before it can join the existing same-ID send in flight.
+    let receiver = null;
+    if (!this.#remoteMachine(to)) {
+      receiver = await this.#receiver(to, this.live.sessions());
+      if (receiver.outcome && !this.live.codexKnown) { await this.#codexKnown(); receiver = await this.#receiver(to, this.live.sessions()); }
+      if (receiver.outcome) return receiver.outcome;
+      const refused = await this.#authorizeReceiver(context, receiver.continuation?.chain ?? [receiver.address]);
+      if (refused) return refused;
+    }
     // A send under an --id is held while it runs: the sent marker is written only once it is done, so a second send
     // under the same key meanwhile waits for the first and takes its outcome (sent once), never delivering it again; one
     // after a first that was not sent sends.
@@ -78,17 +89,25 @@ export class MailSend {
       const running = (this.inFlight ??= new Map()).get(key);
       if (running) {
         const first = await running.catch(() => null);
-        if (first?.code === 0) return outcome(0, `Already sent with --id ${options.id}: ${first.text} Nothing was sent again.`, first.receipt ?? null);
+        if (first?.code === 0) {
+          const addresses = [...(first.continuation?.chain ?? []), ...(first.receipt?.recipients ?? []), first.receipt?.recipient].filter(Boolean);
+          if (addresses.length) {
+            const refused = await this.#authorizeReceiver(context, addresses);
+            if (refused) return refused;
+          } else if (context.authorizeRecipients) return outcome(EXIT_REFUSED, 'Not sent: the earlier send has no recipient receipt to authorize on this stream. Nothing was sent again.');
+          return { ...outcome(0, `Already sent with --id ${options.id}: ${first.text} Nothing was sent again.`, first.receipt ?? null), ...(first.continuation ? { continuation: first.continuation } : {}) };
+        }
         return this.send(caller, to, body, options, context);
       }
     }
-    const sending = this.#send(caller, to, body, options, context);
+    const sending = this.#send(caller, to, body, options, context, receiver);
     if (!key) return sending;
     this.inFlight.set(key, sending);
     try { return await sending; } finally { if (this.inFlight.get(key) === sending) this.inFlight.delete(key); }
   }
 
-  async #send(caller, to, body, { subject = null, in_reply_to = null, notify_when_idle = false, queue = false, id = null, notice = false, thread = null, message_id = null } = {}, { link = null } = {}) {
+  async #send(caller, to, body, { subject = null, in_reply_to = null, notify_when_idle = false, queue = false, id = null, notice = false, thread = null, message_id = null } = {}, context = {}, receiver = null) {
+    const { link = null } = context;
     // an id its client chose (so a lost answer can name it), never an idempotency key: it marks nothing sent
     const chosen = typeof message_id === 'string' && /^m-[0-9a-f]{24}$/.test(message_id) ? message_id : null;
     const machine = this.#remoteMachine(to);
@@ -103,10 +122,25 @@ export class MailSend {
       const request = { op: 'send', from: caller.address, from_name: caller.name, to, body, subject, in_reply_to: answered.id, thread: carried, notify_when_idle, queue, id: messageId, notice };
       const sent = await this.#remoteSend(machine, request);
       // unanswered, it may have been delivered: kept in the send log, so a later reply to it resolves here
-      if (sent.code === 0 || sent.code === EXIT_STORED || sent.receipt?.unanswered === true) this.#recordSend(caller.address, to, messageId, carried ?? answered.id ?? messageId);
+      if (sent.code === 0 || sent.code === EXIT_STORED || sent.receipt?.unanswered === true) this.#recordSend(caller.address, to, messageId, carried ?? answered.id ?? messageId, sent.continuation);
       return sent;
     }
-    return this.#deliver(caller, to, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread, chosen }, link);
+    const answer = await this.#deliver(caller, receiver, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread, chosen }, link, context);
+    return this.#annotateReceiver(answer, receiver);
+  }
+
+  #annotateReceiver(answer, receiver) {
+    const continuation = receiver.continuation;
+    const alias = continuation && !answer.text.includes(receiver.alias) ? receiver.alias : '';
+    return { ...answer, text: answer.text + alias, ...(continuation ? { continuation } : {}),
+      receipt: answer.receipt ? { ...answer.receipt, recipient: receiver.address,
+        recipients: answer.receipt.recipients ?? [receiver.address], ...(continuation ? { continuation } : {}) } : null };
+  }
+
+  async #authorizeReceiver(context, addresses) {
+    if (!context.authorizeRecipients) return null;
+    const reason = await context.authorizeRecipients(addresses);
+    return reason ? outcome(EXIT_REFUSED, `Not sent: ${reason}. Nothing was filed or delivered by this request.`) : null;
   }
 
   /** The machine `to` names when it is not this one, in its normal form. */
@@ -123,7 +157,7 @@ export class MailSend {
       const answer = await this.askMachine(machine, request);
       const code = Number.isInteger(answer?.code) ? answer.code : EXIT_FAILED;
       const text = typeof answer?.text === 'string' ? answer.text : typeof answer?.detail === 'string' ? answer.detail : 'the other machine answered nothing readable';
-      return outcome(code, text, answer?.receipt ?? null);
+      return { ...outcome(code, text, answer?.receipt ?? null), ...(answer?.continuation ? { continuation: answer.continuation } : {}) };
     } catch (error) {
       const detail = String(error?.message ?? error);
       // the door took it and its answer was lost: unanswered, never refused or failed (what it did there is unknown)
@@ -147,7 +181,7 @@ export class MailSend {
   }
 
   /** The receiver `to` names here: `{ address, name, session (its live row, when it runs) }`, or an outcome. */
-  #receiver(to, sessions) {
+  async #receiver(to, sessions) {
     const operator = String(to).startsWith('operator:') ? makeAddress(this.machine, 'operator', String(to).slice('operator:'.length)) : null;
     const parsed = parseAddress(operator ?? to);
     // an operator (a board, a script) is not a listed session: its address is taken as given
@@ -158,7 +192,9 @@ export class MailSend {
       return { address: parsed.address, name: `agent ${parsed.session}@${parsed.machine}` };
     }
     if (parsed) {
-      const session = sessions.find((row) => row.address === parsed.address);
+      const resolved = await this.#nativeReceiver(parsed.address, sessions);
+      if (resolved) return resolved;
+      const session = this.live.sessions().find((row) => row.address === parsed.address);
       if (!session) return { outcome: outcome(EXIT_UNKNOWN, this.#notYetKnown(to) ?? `${to} is no longer running. Nothing was sent. Run supercode message list for the live sessions.`) };
       return { address: session.address, name: session.name, session };
     }
@@ -172,7 +208,9 @@ export class MailSend {
     if (!matching.length) {
       const remembered = this.#rememberedAddress(wanted);
       if (remembered) {
-        const session = sessions.find((row) => row.address === remembered);
+        const resolved = await this.#nativeReceiver(remembered, sessions);
+        if (resolved) return resolved;
+        const session = this.live.sessions().find((row) => row.address === remembered);
         if (!session) return { outcome: outcome(EXIT_UNKNOWN, `${wanted} was ${remembered}, which is not running. Nothing was sent. Run supercode message list for the live sessions.`) };
         return { address: session.address, name: session.name, session, alias: ` "${wanted}" is a name it ran under before; it runs as ${session.name} now.` };
       }
@@ -190,6 +228,18 @@ export class MailSend {
     return { outcome: outcome(EXIT_UNKNOWN, this.#notYetKnown(wanted) ?? `No session named "${wanted}" is reachable.${hint} Run supercode message list. Nothing was sent.`) };
   }
 
+  async #nativeReceiver(address, sessions) {
+    const live = sessions.find((row) => row.address === address);
+    if (live) return { address: live.address, name: live.name, session: live };
+    const continued = await nativeMailContinuation(address, { machine: this.machine, claudeProjects: this.claudeProjects, sessions: () => this.live.sessions() });
+    if (continued?.error) return { outcome: outcome(EXIT_UNKNOWN, `Not sent: ${address}'s continuation is unresolved: ${continued.error}. Nothing was sent.`) };
+    if (!continued) return null;
+    const { session, addressed, chain } = continued;
+    return { address: session.address, name: session.name, session,
+      continuation: { addressed, recipient: session.address, chain },
+      alias: ` Addressed to ${address}; its native continued-in record routes it to ${session.address}.` };
+  }
+
   /** In a daemon's first moments the Codex sessions are not known yet (its session index and their activity still being
    *  read): a send waits for them, at most CODEX_KNOWN_WAIT_MS. */
   async #codexKnown() { if (!this.live.codexKnown) await this.live.whenCodexKnown?.(CODEX_KNOWN_WAIT_MS); }
@@ -219,12 +269,8 @@ export class MailSend {
   }
 
   /** Deliver from `caller` to `to` on this machine (mail_send.rs `deliver`). */
-  async #deliver(caller, to, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread: carried, chosen }, link) {
-    let sessions = this.live.sessions();
-    let receiver = this.#receiver(to, sessions);
-    // only a receiver not found waits for the Codex sessions to be known (one the map holds is reached at once)
-    if (receiver.outcome && !this.live.codexKnown) { await this.#codexKnown(); sessions = this.live.sessions(); receiver = this.#receiver(to, sessions); }
-    if (receiver.outcome) return receiver.outcome;
+  async #deliver(caller, receiver, body, { subject, in_reply_to, notify_when_idle, queue, id, notice, thread: carried, chosen }, link, context) {
+    const sessions = this.live.sessions();
     const { address, name } = receiver;
     if (address === caller.address) return outcome(EXIT_REFUSED, 'Not sent: that address is your own session.');
     const door = parseAddress(address).harness === AGENT_HARNESS ? null : this.#door(address, sessions);
@@ -250,7 +296,14 @@ export class MailSend {
     });
     const plan = await this.#plan(sent, address, {});
     if (plan.outcome) return plan.outcome;
-    if (plan.plan) return this.#deliverPlanned(caller, sent, plan.plan, { queue, notify_when_idle });
+    const recipients = plan.plan ? [...new Set([address, ...(plan.plan.agent ? [plan.plan.agent] : []),
+      ...plan.plan.recipients.filter(item => item.address !== caller.address).map(item => item.address)])] : [address];
+    const refused = await this.#authorizeReceiver(context, [...(receiver.continuation?.chain ?? []), ...recipients]);
+    if (refused) return refused;
+    if (plan.plan) {
+      const answer = await this.#deliverPlanned(caller, sent, plan.plan, { queue, notify_when_idle, continuation: receiver.continuation });
+      return { ...answer, receipt: answer.receipt ? { ...answer.receipt, recipients } : null };
+    }
     // the thread this message is in, kept in the send log: a later reply to it continues that thread
     const sentIn = threadOf(sent);
     if (!door || door.kind === 'other_machine') return outcome(EXIT_UNKNOWN, this.#notYetKnown(name) ?? `${name} is no longer running. Nothing was sent. Run supercode message list for the live sessions.`);
@@ -263,7 +316,7 @@ export class MailSend {
       if (error instanceof Refused && error.kind === 'queue') return outcome(EXIT_REFUSED, `Not sent: ${name} is idle, and a Claude session always starts a turn when a message arrives, so --queue cannot hold it. Send without --queue to wake it.`);
       if (error instanceof Refused) return outcome(EXIT_REFUSED, `Not sent: the message is ${error.bytes} bytes; the limit is ${MAX_RELAYED_BYTES}. Write it to a file and send its path instead.`);
       // may have arrived: kept filed, and said unanswered with its id (sent again with the same id, nothing is sent twice)
-      if (error.unanswered) { this.#recordSend(caller.address, address, messageId, sentIn); return outcome(EXIT_UNANSWERED, unansweredText(`${name}'s Claude relay`, error.message, messageId)); }
+      if (error.unanswered) { this.#recordSend(caller.address, address, messageId, sentIn, receiver.continuation); return outcome(EXIT_UNANSWERED, unansweredText(`${name}'s Claude relay`, error.message, messageId)); }
       return outcome(EXIT_FAILED, `Not sent to ${name}: ${error.message}`);
     }
     const [code, what] = {
@@ -281,7 +334,7 @@ export class MailSend {
       pane_waits: [EXIT_STORED, 'Stored (not failed): its pane\'s composer was not empty, so the message waits in its mailbox; it sees it with supercode message inbox. Don\'t resend'],
       stored: [EXIT_STORED, `Stored (not failed): it has no delivery door, so it sees this only if it runs supercode message inbox${parseAddress(address).harness === 'codex' ? ' (a Codex session gets one with: supercode message setup codex)' : ''}. Don't resend, and don't wait for a reply`],
     }[delivered];
-    this.#recordSend(caller.address, address, messageId, sentIn);
+    this.#recordSend(caller.address, address, messageId, sentIn, receiver.continuation);
     const harness = parseAddress(address).harness;
     const text = code === 0
       ? `sent to ${name} (${harness}, ${door.kind}): ${what}. Message id ${shortId(messageId)}.${receiver.alias ?? ''}${idleNote} Don't poll; carry on.`
@@ -408,7 +461,7 @@ export class MailSend {
    */
   async deliverPlanned(caller, sent, plan, { queue = false, notify_when_idle = false } = {}) { return this.#deliverPlanned(caller, sent, plan, { queue, notify_when_idle }); }
 
-  async #deliverPlanned(caller, sent, plan, { queue, notify_when_idle }) {
+  async #deliverPlanned(caller, sent, plan, { queue, notify_when_idle, continuation = null }) {
     const reached = [], copied = [], failed = [];
     let recorded = false;
     const held = []; // recipients whose own copy is held unread with its wake (an unanswered relay)
@@ -428,7 +481,7 @@ export class MailSend {
     const sessions = this.live.sessions();
     for (const recipient of plan.recipients.filter((item) => item.address !== caller.address)) {
       const label = this.#label(sessions, recipient.address);
-      this.#recordSend(caller.address, recipient.address, sent.id, threadOf(sent));
+      this.#recordSend(caller.address, recipient.address, sent.id, threadOf(sent), continuation);
       if (!recipient.wake) {
         try { this.#fileUnread(recipient.address, sent); copied.push(label); } catch (error) { failed.push(`${label} (${error.message})`); }
         continue;
@@ -914,10 +967,10 @@ export class MailSend {
     return depth;
   }
 
-  #recordSend(sender, to, id, thread) {
+  #recordSend(sender, to, id, thread, continuation = null) {
     try {
       mkdirSync(this.#sentDir(sender), { recursive: true });
-      appendFileSync(join(this.#sentDir(sender), 'log.jsonl'), `${JSON.stringify({ to, at_ms: Date.now(), id, thread })}\n`);
+      appendFileSync(join(this.#sentDir(sender), 'log.jsonl'), `${JSON.stringify({ to, at_ms: Date.now(), id, thread, ...(continuation ? { continuation } : {}) })}\n`);
     } catch { /* the log is best kept */ }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.149",
+  "version": "0.3.151",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/remote-close.mjs

@@ -0,0 +1,81 @@
+// A remote session closes its recorded pane here, without launching a second command that has to rediscover the
+// original caller. Caller admission and pane ownership stay in machine.mjs. This module only reads the target-side
+// close safeguards; its native invocation is --check, never an action or a caller-identity bridge.
+import { execFile } from 'node:child_process';
+
+const refusal = (message) => Object.assign(new Error(`${message}. Nothing was closed`), { code: 409 });
+const HARNESSES = new Set(['claude-code', 'claude', 'codex', 'gemini', 'gemini-cli', 'goose', 'opencode', 'pi', 'grok', 'hermes', 'openclaw']);
+
+function read(program, args, env, timeout = 4000) {
+  return new Promise((resolve, reject) => execFile(program, args, {
+    env, encoding: 'utf8', timeout, maxBuffer: 1024 * 1024, windowsHide: true,
+  }, (error, stdout, stderr) => {
+    if (error) reject(refusal(`target close check failed: ${String(stderr || error.message).trim()}`));
+    else resolve(String(stdout));
+  }));
+}
+
+// The native reader's self-close exemption must never bypass the work check because the daemon happened to start
+// below the target session. Check that boundary from OS parents, not from an environment variable or caller claim.
+async function outsideTarget(pid, env) {
+  let rows;
+  if (process.platform === 'win32') {
+    const script = 'Get-CimInstance Win32_Process -ErrorAction Stop | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId)" }';
+    rows = await read('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], env);
+  } else if (['darwin', 'linux'].includes(process.platform)) {
+    rows = await read('ps', ['-A', '-o', 'pid=,ppid='], env);
+  } else throw refusal('this platform cannot read the close checker\'s ancestry');
+  const parents = new Map(rows.trim().split('\n').map(line => line.trim().split(/\s+/).map(Number))
+    .filter(([child, parent]) => Number.isSafeInteger(child) && child > 0 && Number.isSafeInteger(parent) && parent >= 0));
+  const seen = new Set();
+  let at = process.pid;
+  while (at > 1 && seen.size < 128) {
+    if (at === pid) throw refusal('the target contains the machine daemon; its work must be closed from outside that session');
+    if (!parents.has(at) || seen.has(at)) throw refusal('the close checker\'s ancestry could not be confirmed');
+    seen.add(at);
+    at = parents.get(at);
+  }
+  if (at !== 0 && at !== 1) throw refusal('the close checker\'s ancestry did not reach its root');
+}
+
+/** A known pane's native session must be idle and pass the existing native live-work check. A plain command has
+ * no session exemption to check. `activity` always reads this exact root, and a missing harness observation refuses. */
+export async function checkRemoteClose({ pane, session, kind, activity, live, native, env }) {
+  if (session.dead) return async () => {};
+  if (!Number.isSafeInteger(session.rootPid) || session.rootPid <= 1) throw refusal(`pane ${pane} names no root process to check`);
+  const page = await activity(session.rootPid);
+  if (!Array.isArray(page?.activities)) throw refusal(`pane ${pane}'s session activity could not be read`);
+  const found = page.activities.filter(row => row.pid === session.rootPid);
+  if (found.length > 1) throw refusal(`pane ${pane} has ambiguous session activity`);
+  const observed = found[0]?.activity;
+  if (!observed) {
+    if (HARNESSES.has(kind)) throw refusal(`pane ${pane} runs ${kind}, whose native session could not be read`);
+    // A live-map session missed by activity_under is unknown, never a plain command.
+    if (live.length) throw refusal(`pane ${pane}'s known native session has no activity reading`);
+    return async () => {
+      const again = await activity(session.rootPid);
+      if (!Array.isArray(again?.activities) || again.activities.some(row => row.pid === session.rootPid && row.activity)) {
+        throw refusal(`pane ${pane}'s session changed during its close check`);
+      }
+    };
+  }
+  if (observed.presence !== 'running' || observed.turn !== 'idle') {
+    throw refusal(`pane ${pane}'s session is ${observed.presence ?? 'unknown'}, turn ${observed.turn ?? 'unknown'}; finish or stop its turn first`);
+  }
+  const address = live.find(row => row.address.split(':').slice(2).join(':') === `${observed.harness}:${observed.session_id}`)?.address;
+  if (!address || live.length !== 1) throw refusal(`pane ${pane}'s native session binding could not be confirmed`);
+  // No ambient identity reaches the native read. It decides neither the forwarded caller nor pane authority.
+  const cleanEnv = { ...env };
+  for (const key of ['CLAUDE_CODE_SESSION_ID', 'CODEX_THREAD_ID', 'SUPERCODE_CALLER', 'SUPERCODE_BOARD_OWNER_PID']) delete cleanEnv[key];
+  await outsideTarget(live[0].pid ?? session.rootPid, cleanEnv);
+  const answer = await read(native, ['close', address, '--check'], cleanEnv);
+  // --check may instead resolve a process, another pane or an ended session. Only this exact pane's check stands.
+  if (!answer.trim().endsWith(`(pane ${pane}, through the machine daemon)`)) throw refusal(`the native close check did not name pane ${pane}`);
+  return async () => {
+    const again = await activity(session.rootPid);
+    const rows = again?.activities?.filter(row => row.pid === session.rootPid);
+    const current = rows?.length === 1 ? rows[0].activity : null;
+    if (!current || current.harness !== observed.harness || current.session_id !== observed.session_id
+      || current.presence !== 'running' || current.turn !== 'idle') throw refusal(`pane ${pane}'s session or turn changed during its close check`);
+  };
+}