@volter/supercode-teams 0.3.159 → 0.3.161

package/machine.mjs

@@ -654,7 +654,7 @@ export class TeamsMachine extends MachineCore {
       if (!allowed.size) return refuse(RECORDS_NOT_GRANTED);
       if (!this.records) return refuse('this machine keeps no record yet');
       accept();
-      const unsubscribe = this.records.producer.subscribe((frame) => { try { stream.write(frame); } catch { unsubscribe(); } }, allowed);
+      const unsubscribe = this.records.producer.subscribe((frame) => { stream.write(frame); }, allowed, stream.params ?? {});
       const readmit = local ? null : setInterval(() => void (async () => {
         const admitted = await entry.verify?.().catch(() => null);
         const now = admitted ? sectionsFor(admitted, false) : new Set();
@@ -663,6 +663,29 @@ export class TeamsMachine extends MachineCore {
       readmit?.unref?.();
       stream.on('close', () => { clearInterval(readmit); unsubscribe(); });
     });
+    // Held peer records never leave this OS user's local socket. Apps and the
+    // resident board follow committed row changes instead of full fleet copies.
+    this.registerDoor('machine-record-changes', (entry, stream, accept, refuse) => {
+      if (entry.principal !== 'local' || entry.appDoor) return refuse('held machine records are read only by this machine\'s own processes');
+      if (!this.records) return refuse('this daemon keeps no records yet');
+      accept();
+      const changes = this.mailStore.changes;
+      let cursor = stream.params?.after ?? null;
+      const stop = changes.follow((page) => {
+        if (page.error) return stream.close(page.error);
+        if (page.reset) {
+          const snapshot = this.#recordSnapshot();
+          cursor = changes.cursor();
+          stream.write({ type: 'snapshot', cursor, ...snapshot });
+          return cursor;
+        }
+        cursor = page.cursor;
+        stream.write({ type: 'changes', ...page });
+      }, { after: cursor, topics: ['record-head', 'record-row'], initial: true });
+      const beat = setInterval(() => { try { stream.write({ type: 'beat', cursor, at: Date.now() }); } catch { stop(); clearInterval(beat); } }, 15_000);
+      beat.unref?.();
+      stream.on('close', () => { clearInterval(beat); stop(); });
+    });
     // This machine's processes read the team's published events here, from the one stream its connector holds
     // (machine-events.mjs PublishedEvents); a caller it refuses reads the server itself.
     this.registerDoor('events', (entry, stream, accept, refuse) => {
@@ -826,13 +849,19 @@ export class TeamsMachine extends MachineCore {
       runtimeOf: (harness, id) => live.runtimeReceipt(harness, id), runtimeNamed: (receiptId) => live.receiptNamed(receiptId),
       runtimesIn: (harness, cwd) => live.runtimesIn(harness, cwd),
       endpointOf: async () => (await this.relayEndpoint)?.url ?? null,
+      inboundSettled: () => this.mailHooks?.drainPoolReplies(),
       arrived: (sessionId, landed) => claudeTranscriptHolds([...live.claudeDirs.keys()].map((dir) => join(dirname(dir), 'projects')), sessionId, landed),
       log: (line) => this.emit('mail-log', line) });
     // a turn or a wake typed into a daemon pane's empty composer, in process (as `panes.turn` types one)
-    const typeTurn = async (pane, harness, text, messageIds) => {
+    const typeTurn = async (pane, harness, text, messageIds, address) => {
       if (this.stopping) throw new Error('the daemon is stopping; no pane input was submitted');
       const session = await this.#paneByContext(pane);
       if (!session) throw new Error(`no pane with context ${pane}`);
+      const expected = parseAddress(address);
+      if (!expected || expected.machine !== machine || expected.harness !== harness) return { delivered: false, reason: 'mail recipient binding is missing' };
+      const reading = await this.#serveRequest('harness.v1.sessions.activity_under', { pids: [session.rootPid] }, 4_000);
+      const native = reading?.activities?.find(row => row.pid === session.rootPid)?.activity;
+      if (native?.harness !== expected.harness || native.session_id !== expected.session) return { delivered: false, reason: 'the pane no longer runs the addressed native session; no input submitted' };
       const result = await this.#paneTurn(session, pane, text, { messageIds, harness });
       if (result.refused) throw new Error(result.refused.reason);
       return result.waits ?? result;
@@ -859,11 +888,13 @@ export class TeamsMachine extends MachineCore {
     // minute, and before each relay's inbound call
     this.hookSpool = join(supercodeHome(this.env), 'hook-spool', 'relay-inbound');
     this.mailHooks.drainSpool(this.hookSpool);
+    this.mailHooks.drainPoolReplies();
     this.hookSpoolTimer = setInterval(() => this.mailHooks.drainSpool(this.hookSpool), 60_000); this.hookSpoolTimer.unref?.();
     // the mailbox's own delivery (step 4b): each wake attempted by its session's door, or carried to its machine
     this.carrier = new MailCarrier({ machine, mailRoot, store: this.mailStore, live,
       handOver: (address, id) => this.mailSend.handOver(address, id),
-      typeTurn, askMachine: (to, request) => this.#askMailDoor(to, request, MAIL_SEND_MS),
+      typeTurn, typeUserTurns: (address, pane) => this.mailSend.typeUserTurns(address, pane), paneOf: (session) => this.mail.paneOf(session),
+      askMachine: (to, request) => this.#askMailDoor(to, request, MAIL_SEND_MS),
       log: (line) => this.emit('mail-log', line) }).start();
     // idle notices and final replies (step 4c): each subscribed session's activity followed through harness serve
     this.idleNotices = new IdleNotices({ machine, store: this.mailStore, live,
@@ -877,26 +908,7 @@ export class TeamsMachine extends MachineCore {
       claudeProjects: () => [...live.claudeDirs.keys()].map((dir) => join(dirname(dir), 'projects')),
       lastMessageAt: (address) => this.sessionDescriptors?.get(address)?.updated_at_ms ?? null,
       program: this.supercodeBin, env: this.env, log: (line) => this.emit('mail-log', line) }).start();
-    // the user's own turns that wait in a pane session's mailbox (a draft in its composer when they came) are typed once
-    // its composer is free: tried at each change of its mailbox, and every 2 s while one waits (mail_watch.rs
-    // `deliver_waiting_user_turns` read every pane's mailbox every 2 s)
-    const turnsWaiting = new Map(); // address → timer
-    const typeWaiting = async (address) => {
-      clearTimeout(turnsWaiting.get(address)); turnsWaiting.delete(address);
-      if (this.stopping) return;
-      const session = live.sessions().find((row) => row.address === address);
-      const pane = session ? this.mail.paneOf(session) : null;
-      if (!pane || !this.mailStore.userTurns(address).length) return;
-      try { await this.mailSend.typeUserTurns(address, pane); } catch (error) { this.emit('mail-log', `the user's turns for ${address} wait: ${error.message}`); }
-      if (!this.stopping && this.mailStore.userTurns(address).length) { const timer = setTimeout(() => void typeWaiting(address), 2000); timer.unref?.(); turnsWaiting.set(address, timer); }
-    };
-    this.mailStore.on('changed', (address) => { if (address && !turnsWaiting.has(address)) void typeWaiting(address); });
-    // the turns already waiting when this listener came (the store read every mailbox at its start, before it), and every
-    // mailbox again once per 5 min, so a turn no event named is typed within that bound
-    const everyMailbox = () => { for (const address of this.mailStore.addresses()) if (!turnsWaiting.has(address)) void typeWaiting(address); };
-    everyMailbox();
-    this.turnsSweep = setInterval(everyMailbox, 300_000); this.turnsSweep.unref?.();
-    this.stopWaitingTurns = () => { clearInterval(this.turnsSweep); for (const timer of turnsWaiting.values()) clearTimeout(timer); turnsWaiting.clear(); };
+    // User turns share the persisted delivery schedule; only their own raw-input door types them.
     // an agent's verbs (3b-2): its threads, a delegation, its record
     this.agentVerbs = new AgentVerbs({ machine, store: this.mailStore, agents: this.agents, live, supercodeBin: this.supercodeBin, env: this.env,
       paneOf: (session) => this.mail.paneOf(session), mailRoot,
@@ -905,23 +917,7 @@ export class TeamsMachine extends MachineCore {
     // the names sessions ran under (`<mail>/names.json`): a name an agent was given reaches the same session after it
     // runs under another, kept from the map's changes (at most once a second)
     let naming = null;
-    // a session that has ended has its relay retired (step 4a: by its end, never a minute's sweep); the relays of
-    // sessions that ended while no daemon ran are retired once, at start, when the live sessions are known
-    let wasLive = new Map(live.sessions().map((row) => [row.address, row.name]));
-    live.on('changed', () => {
-      // while the Codex sessions are not known (a start, a serve restart) a Codex session missing has not ended: the last
-      // known view stands until they are known again
-      if (this.stopping || !live.codexKnown) return;
-      const now = new Map(live.sessions().map((row) => [row.address, row.name]));
-      // a Codex session that leaves the map has not provably ended (idle over a day, it is no longer followed): kept
-      for (const [address, name] of wasLive) if (!now.has(address) && address.split(':')[2] !== 'codex') void this.relays.retire(address, name).catch(() => {});
-      wasLive = now;
-    });
-    void live.whenCodexKnown(120_000).then((known) => {
-      if (this.stopping) return;
-      if (!known) { this.emit('mail-log', 'relays: the live sessions were not known within two minutes of start; relays of ended sessions are retired at their next end'); return; }
-      return this.relays.sweepAtStart((address) => live.sessions().some((row) => row.address === address));
-    }).catch((error) => this.emit('mail-log', `relays: the start sweep failed: ${error.message}`));
+    void this.relays.sweepAtStart().catch((error) => this.emit('mail-log', `relay pool: predecessors retained (${error.message})`));
     live.on('changed', () => {
       if (this.stopping) return;
       if (naming) return;
@@ -930,6 +926,16 @@ export class TeamsMachine extends MachineCore {
     });
   }
 
+  #recordSnapshot() {
+    const self = machineName(this.env);
+    if (!this.records) return { machine: self, at: Date.now(), records: {}, unread: 'this daemon keeps no records yet' };
+    const following = this.machineEvents ? null : 'this machine\'s daemon runs with no team connector, so it follows no other machine';
+    return { machine: self, at: Date.now(), ...(following ? { unread: following } : {}), records: {
+      [self]: { record: this.records.producer.record, stream: 'self', since: null, why: null, received_at: Date.now() },
+      ...this.records.holder.read(),
+    } };
+  }
+
   /** One send of this machine's own, made in its daemon's process (the connector's machine events): from the sender
    *  the request names, which is this machine's own operator address. */
   async sendOwn(request) {
@@ -966,7 +972,7 @@ export class TeamsMachine extends MachineCore {
 
   #startRecords() {
     const machine = machineName(this.env);
-    const producer = new RecordProducer({ machine, log: (line) => this.emit('records-log', line), readers: {
+    const producer = new RecordProducer({ machine, store: this.mailStore, log: (line) => this.emit('records-log', line), readers: {
       // this machine's sessions, from the live-session map (no process)
       sessions: async () => {
         const sessions = await this.mail.localRows();
@@ -974,18 +980,21 @@ export class TeamsMachine extends MachineCore {
         return sessions;
       },
       panes: async () => {
-        const rows = await this.attentionEvidence();
+        let rows;
+        try { rows = await this.attentionEvidence(); }
+        catch (error) { this.live?.panes([], { current: false }); throw error; }
         const titles = readJson(this.p.titles, { v: 1, titles: {} }).titles;
         const panes = rows.filter((row) => row.session?.id).map(({ session: s }) => ({ pane: s.contextKey, dead: Boolean(s.dead), pid: s.rootPid ?? null, label: s.label ?? null, title: titles[`pane:${s.contextKey}`] ?? s.label ?? null, cwd: s.cwd ?? null }));
         const live = panes.filter((pane) => !pane.dead && pane.pid);
         // the pane each session whose record names none runs in (Grok's; Claude's on Windows): the one rooted at it
-        this.live?.panes(live.map((pane) => ({ pane: pane.pane, pid: pane.pid })));
         // the harness session under each live pane, as the board reads it: unread is said, never no session
         let activities = [], sessions_unread = null;
         if (live.length) {
           try { activities = (await this.#serveRequest('harness.v1.sessions.activity_under', { pids: live.map((pane) => pane.pid) }, 30_000))?.activities ?? []; }
           catch (error) { sessions_unread = String(error?.message ?? error).slice(0, 200); }
         }
+        this.live?.panes(live.map((pane) => ({ pane: pane.pane, pid: pane.pid,
+          activity: sessions_unread ? null : activities.find(row => row.pid === pane.pid)?.activity ?? null })), { current: sessions_unread == null });
         // the sessions under the panes unread: the panes are read again on the section's backoff until they are (MR4)
         if (sessions_unread) producer.retry('panes', null);
         else this.live?.codexPanes(activities.map((row) => ({ pane: live.find((pane) => pane.pid === row.pid)?.pane ?? null, activity: row.activity })));
@@ -1001,12 +1010,12 @@ export class TeamsMachine extends MachineCore {
         return answer.mail;
       },
     } });
-    const holder = new RecordHolder({ self: machine, file: join(this.home, 'machine-records.json'), log: (line) => this.emit('records-log', line),
+    const holder = new RecordHolder({ self: machine, store: this.mailStore, file: join(this.home, 'machine-records.json'), log: (line) => this.emit('records-log', line),
       // the holder's sink is attached at once, in the same turn the stream is handed over: nothing it delivers is missed
       open: async (peer, sink) => {
         const channel = await openMachine({ machine: peer, env: this.env });
         let stream;
-        try { stream = await channel.open('machine-records', {}); } catch (error) { channel.close(); throw error; }
+        try { stream = await channel.open('machine-records', sink.resume ?? {}); } catch (error) { channel.close(); throw error; }
         stream.on('data', sink.data);
         stream.on('close', (reason) => { channel.close(); sink.close(reason); });
         stream.on('error', (error) => sink.close(error?.message));
@@ -1121,9 +1130,15 @@ export class TeamsMachine extends MachineCore {
       start();
     };
     this.recordsWatches = new Set(); this.recordsRetries = new Set();
-    // the mail folder's changes, as the header index takes them (its own watch; the mailbox each names), and its state
+    // Mail rows follow their durable sequence. Reconciliation/gaps name a
+    // snapshot; ordinary pages touch only the mailboxes whose rows changed.
     const mailState = () => producer.note('mail_watch', this.mailStore.unread ?? null);
-    this.mailStore.on('changed', (address) => { mailState(); producer.touch('mail', address); });
+    this.stopRecordMail = this.mailStore.changes.follow((page) => {
+      if (this.recordsStopped || page.error) return;
+      mailState();
+      if (page.reset) producer.touch('mail');
+      else for (const address of new Set(page.changes.map((change) => change.key.address).filter(Boolean))) producer.touch('mail', address);
+    }, { after: this.mailStore.changes.cursor(), topics: ['message', 'delivery', 'claim'] });
     mailState();
     // the live sessions' changes, as the live-session map takes them (Claude's registry in every home it follows, the
     // hosted runtimes, Codex), and whether each of its sources is current
@@ -1208,6 +1223,7 @@ export class TeamsMachine extends MachineCore {
     for (const retry of this.recordsRetries ?? []) clearTimeout(retry);
     for (const watcher of this.recordsWatches ?? []) { try { watcher.close(); } catch { /* closed */ } }
     this.records?.producer.stop(); this.records?.holder.close();
+    this.stopRecordMail?.();
     for (const child of this.voiceProcesses.values()) child.kill('SIGTERM');
     this.voiceProcesses.clear();
     this.jobs?.stopAll();
@@ -1215,7 +1231,6 @@ export class TeamsMachine extends MachineCore {
     this.stopLiveFollow?.();
     this.#stopMailWorkers();
     this.mailStore?.stop();
-    clearInterval(this.turnsSweep);
     this.stoppingServe = true;
     clearTimeout(this.serveRestart);
     // said, so a stop reads as one in the log and never as a serve that broke
@@ -1237,7 +1252,6 @@ export class TeamsMachine extends MachineCore {
     this.nativeQuestions?.stop();
     this.mailHooks?.stop();
     this.relays?.stop();
-    this.stopWaitingTurns?.();
   }
 
   connectionClosed(index) {
@@ -3580,11 +3594,7 @@ export class TeamsMachine extends MachineCore {
         // this machine's record and the held records of the machines it follows, each with how current it is: for this
         // machine's own processes only (the records it holds are other machines', given to it, never passed on)
         if (principal !== 'local') { this.log.append({ principal, cap: method, target: '*', outcome: 'refused' }); throw Object.assign(new Error('machine records are read by this machine\'s own processes'), { code: 403 }); }
-        if (!this.records) return { machine: machineName(this.env), at: Date.now(), records: {}, unread: 'this daemon keeps no records yet' };
-        const self = machineName(this.env);
-        // a daemon with no team presence stream follows no other machine: said, so no reader takes the team as empty
-        const following = this.machineEvents ? null : 'this machine\'s daemon runs with no team connector, so it follows no other machine';
-        return { machine: self, at: Date.now(), ...(following ? { unread: following } : {}), records: { [self]: { record: this.records.producer.record, stream: 'self', since: null, why: null, received_at: Date.now() }, ...this.records.holder.read() } };
+        return { ...this.#recordSnapshot(), cursor: this.mailStore.changes.cursor() };
       }
       case 'harness.v1.panes.list':
       case 'panes.list': {
@@ -4220,8 +4230,8 @@ export class TeamsMachine extends MachineCore {
         // `via`: the door the claims record (`inbox`, or `read_messages` for `message mcp`'s tool)
         return this.#claimInbox(caller, { all: params.all === true, last, pid: Number(params.claim?.pid) || process.pid, via: params.via === 'read_messages' ? 'read_messages' : 'inbox' });
       }
-      // `message wait` (step 1): the caller's next unread mail (from one sender, with `from`), waited for on the store's
-      // own change events, at most 100 s, then claimed as its inbox claims it; nothing polls
+      // `message wait`: one durable cursor followed for the caller's mailbox,
+      // then the ordinary tokenized claim. No folder scan or read/listen gap.
       case 'harness.v1.mail.wait': {
         if (entry.principal !== 'local' || entry.appDoor) throw Object.assign(new Error('mail is read here by this machine\'s own processes'), { code: 403 });
         const caller = await this.#callerOf(entry, params);
@@ -4233,16 +4243,12 @@ export class TeamsMachine extends MachineCore {
         // waiting for its pane, so a wait never wakes for mail it then cannot claim; an abandoned claim is given back first
         const waiting = () => this.mailStore.hasClaimable(caller, wanted ? (envelope) => envelope.from === wanted || String(envelope.from_name ?? '').startsWith(wanted) : null);
         if (!waiting()) {
-          const arrived = await new Promise((resolve) => {
-            const changed = (address) => { if (address === caller && waiting()) done(true); };
-            const done = (value) => { clearTimeout(timer); this.mailStore.off('changed', changed); resolve(value); };
-            const timer = setTimeout(() => done(false), seconds * 1000);
-            this.mailStore.on('changed', changed);
-          });
+          const arrived = await this.mailStore.changes.wait(waiting, { topics: ['message', 'claim'], addresses: [caller], timeoutMs: seconds * 1000 });
+          if (this.stopping) throw Object.assign(new Error('the daemon is stopping; the wait ended without claiming mail'), { code: 503 });
           if (!arrived) return { code: 6, timeout: true, text: `No mail within ${seconds} seconds; nothing is lost.` };
         }
         // everything unread is handed over, not only the awaited sender's: a message not shown now would stay silent
-        return this.#claimInbox(caller, { all: false, last: null, pid: Number(params.claim?.pid) || process.pid, via: 'wait' });
+        return { ...await this.#claimInbox(caller, { all: false, last: null, pid: Number(params.claim?.pid) || process.pid, via: 'wait' }), cursor: this.mailStore.changes.cursor() };
       }
       // harness serve's `sessions.inbox` (step 1), asked here by serve: an operator's own mailbox (`from_name`) has its
       // unread mail claimed and acknowledged, so a second read does not return it; any other address (`address`) is only
@@ -4402,6 +4408,12 @@ export class TeamsMachine extends MachineCore {
         if (entry.principal !== 'local' || entry.appDoor) throw Object.assign(new Error('mail storage diagnostics are read only by this machine\'s own processes'), { code: 403 });
         return this.mailStore.statistics();
       }
+      case 'harness.v1.mail.changes': {
+        if (entry.principal !== 'local' || entry.appDoor) throw Object.assign(new Error('mail changes are read by this machine\'s own processes'), { code: 403 });
+        const addresses = params.addresses ?? [];
+        if (!Array.isArray(addresses) || addresses.length > 256 || addresses.some((address) => !parseAddress(address))) throw Object.assign(new Error('changes takes at most 256 mailbox addresses'), { code: 400 });
+        return this.mailStore.changes.read(params.after, { topics: ['message', 'delivery', 'claim', 'subscription'], addresses });
+      }
       // Who a local client is, from its claim (live-sessions.mjs callerOf): what a command acting on another machine sends
       // there as its caller, resolved here, where the map that holds it is. Local only; never the app door's.
       // The pane this daemon launched that a local process runs in, and who started that pane: what a process with no