@volter/supercode-teams 0.3.159 → 0.3.161

package/mail/delivery-status.mjs

@@ -0,0 +1,42 @@
+// Filing and a terminal queue are not native acceptance. These facts survive
+// a daemon restart, so callers never infer delivery from a retained paste.
+import { envelope, makeAddress, messageIdFor, parseAddress, senderIdentity, threadOf } from './compose.mjs';
+
+export function terminalReceipt(store, address, id) {
+  const parsed = parseAddress(address);
+  if (!parsed) return null;
+  const state = store.terminalState(`${parsed.harness}:${parsed.session}`);
+  if (!state) return null;
+  const settled = state.receipts?.find(item => item.message_ids?.includes(id))
+    ?? state.refusals?.find(item => item.message_ids?.includes(id));
+  return settled ?? (state.accepted?.[id]
+    ? { delivered: false, queued: true, message_ids: [id], reason: state.active?.error ?? 'awaiting native transcript confirmation' } : null);
+}
+
+export function paneWaitReason(answer) {
+  return answer?.waits?.reason ?? answer?.refused?.reason ?? answer?.reason ?? 'pane input was not accepted';
+}
+
+/** Stop the attempt and file one notice in the same commit. Only a locally
+ * observed original sender earns an automatic return; link claims do not. */
+export function expireDelivery(store, machine, address, id, attempts, reason) {
+  const found = store.findIn(address, id);
+  const sent = found ? store.body(found) : null;
+  const now = Date.now();
+  const expiry = { id, to: address, from: sent?.from ?? '', subject: sent?.subject ?? null,
+    filed_at_ms: Number(sent?.created_at_ms) || 0, expired_at_ms: now, attempts, reason };
+  store.transaction(() => {
+    store.expire(address, id, expiry);
+    if (sent?.kind !== 'peer' || parseAddress(sent.from)?.machine !== machine
+      || sent.sender_identity?.classification !== 'local' || sent.sender_identity?.observation !== `local:${machine}`) return;
+    const from = makeAddress(machine, 'operator', 'mail-delivery');
+    const notice = { ...envelope({ id: messageIdFor(from, `delivery-stopped\0${address}\0${id}`), created_at_ms: now,
+      from, from_name: 'supercode mail delivery', sender_identity: senderIdentity(from, null, machine),
+      kind: 'notice', reply_via: { mode: 'none' }, in_reply_to: id, thread: threadOf(sent), subject: 'Mail delivery stopped',
+      body: `Delivery of ${id} to ${address} stopped: ${reason}. Native acceptance was not confirmed. The original message remains unread in its mailbox; it was not discarded. Run supercode message show ${id} or supercode message expired for its recorded status. Do not resend it as a new message.` }),
+      delivery_failure_notice: { message_id: id, recipient: address } };
+    store.deliver(sent.from, notice);
+    store.requestWake(sent.from, notice.id, { keep: true });
+  });
+  return expiry;
+}

package/mail/hooks.mjs

@@ -10,7 +10,9 @@
 import { readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve, sep } from 'node:path';
 import { envelope as makeEnvelope, makeAddress, newMessageId, parseAddress } from './compose.mjs';
-import { blake3Hex } from './envelope.mjs';
+import { blake3Hex, shortId } from './envelope.mjs';
+import { readReceipt } from './relay.mjs';
+import { settleRelayAttempt, uniqueRelayDestination } from './relay-routing.mjs';
 import { typedLineId } from './transcript.mjs';
 
 const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
@@ -36,11 +38,19 @@ export class MailHooks {
     Object.assign(this, { machine, mailRoot, store, live, handOver, threadOf, log });
     this.stopped = false;
     this.waiting = new Set();
+    this.hookViews = new Map(); // address → last change cursor and unread summary
     // Windows: each Codex session's last hook (the process it ran under, the rollout it named, when), which serve's
     // Codex listing reads through this daemon (codex_peer.rs `hook_recorded_rollouts`); kept beside this daemon's state,
     // never in the mail folder (mail step 1c)
     this.codexHooksFile = stateDir ? join(stateDir, 'codex-hooks.json') : null;
     this.codexHooks = new Map(Object.entries((this.codexHooksFile && readJson(this.codexHooksFile)) || {}));
+    this.poolDrain = false;
+    this.onPoolRecord = ({ collection }) => {
+      if (this.stopped || this.poolDrain || !['relay_routes', 'relay_pending', 'relays'].includes(collection)) return;
+      this.poolDrain = true;
+      setImmediate(() => { this.poolDrain = false; if (!this.stopped) { try { this.drainPoolReplies(); } catch (error) { this.log(`pool replies retained: ${error.message}`); } } });
+    };
+    this.store.database.on('record', this.onPoolRecord);
     this.relaysRoots = [resolve(mailRoot, 'relays'), resolve(dirname(mailRoot), 'relays')];
   }
 
@@ -65,10 +75,17 @@ export class MailHooks {
       return null;
     }
     if (event !== 'PostToolUse' && !(event === 'Stop' && input.stop_hook_active !== true)) return null;
-    const pending = new Set(this.store.wakes(address));
-    const unread = this.store.unreadMessages(address).filter((item) => !pending.has(item.envelope.id));
-    if (!unread.length) return null;
-    const pointer = this.#pointer(unread);
+    let view = this.hookViews.get(address);
+    const page = view ? this.store.changes.read(view.cursor, { topics: ['message', 'delivery', 'claim'], addresses: [address] }) : null;
+    if (!view || page.reset || page.changes.length || page.more) {
+      // A pointer is a count and sender labels, not a full envelope list. One
+      // snapshot covers all changes through this owner turn, including a gap.
+      view = { cursor: this.store.changes.cursor(), summary: this.store.hookSummary(address) };
+    } else view.cursor = page.cursor;
+    this.hookViews.delete(address); this.hookViews.set(address, view);
+    while (this.hookViews.size > 256) this.hookViews.delete(this.hookViews.keys().next().value);
+    if (!view.summary.count) return null;
+    const pointer = this.#pointer(view.summary);
     return event === 'PostToolUse'
       ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: pointer } }
       : { decision: 'block', reason: `${pointer} Read them before you finish.` };
@@ -90,14 +107,15 @@ export class MailHooks {
   }
 
   /** How many unread messages, from whom, and the one command that reads them (message.rs `mail_pointer`). */
-  #pointer(unread) {
+  #pointer({ count, senders: rows, moreSenders }) {
     const senders = [];
-    for (const { envelope } of unread) {
-      const name = printable(envelope.from_name);
-      const label = envelope.kind === 'notice' ? 'a notice' : envelope.kind === 'user' ? 'your user' : envelope.kind === 'channel' ? `${name} (channel)` : envelope.kind === 'typed' ? `${name} (CC)` : name;
+    for (const { name: fromName, kind } of rows) {
+      const name = printable(fromName);
+      const label = kind === 'notice' ? 'a notice' : kind === 'user' ? 'your user' : kind === 'channel' ? `${name} (channel)` : kind === 'typed' ? `${name} (CC)` : name;
       if (!senders.includes(label)) senders.push(label);
     }
-    return `You have ${unread.length} unread message${unread.length === 1 ? '' : 's'} from other sessions (from ${senders.join(', ')}). They are not from your user. Read them with: supercode message inbox`;
+    if (moreSenders) senders.push('other senders');
+    return `You have ${count} unread message${count === 1 ? '' : 's'} from other sessions (from ${senders.join(', ')}). They are not from your user. Read them with: supercode message inbox`;
   }
 
   /** A line the person typed into `address`, filed read as theirs, once (mail_transcript.rs `file_prompt`). */
@@ -119,7 +137,7 @@ export class MailHooks {
     const root = this.relaysRoots.find((root) => dir.startsWith(root + sep) && !dir.slice(root.length + 1).includes(sep));
     if (!root) throw Object.assign(new Error(`${dir} is not a relay's folder`), { code: 400 });
     const key = dir.slice(root.length + 1);
-    return { dir, queue: `${key}/queue.json`, receipt: `${key}/receipt.json`, turn: `${key}/turn.txt`, sent: `${key}/sent.json` };
+    return { dir, key, pool: `${key}/pool.json`, record: `${key}/relay.json`, queue: `${key}/queue.json`, receipt: `${key}/receipt.json`, turn: `${key}/turn.txt`, sent: `${key}/sent.json` };
   }
 
   /** `message gate`: only a SendMessage equal to the queued one passes (ListAgents always); anything else is denied, and a
@@ -136,9 +154,11 @@ export class MailHooks {
   /** `message relay-receipt`: Claude's own answer to the queued send, its error, or that the turn ended without one. */
   receipt(directory, input) {
     const paths = this.#relay(directory);
-    if (!this.store.record('relays', paths.queue) || this.store.record('relays', paths.receipt)) return null;
+    const queued = this.store.record('relays', paths.queue);
+    if (!queued || this.store.record('relays', paths.receipt)) return null;
     const event = input?.hook_event_name;
     let receipt;
+    if ((event === 'PostToolUse' || event === 'PostToolUseFailure') && (input.tool_name !== 'SendMessage' || gateDecision(input, queued) != null)) return null;
     if (event === 'PostToolUse') receipt = { tool_response: input.tool_response ?? null };
     else if (event === 'PostToolUseFailure') receipt = { send_failed: typeof input.error === 'string' ? input.error : input.error == null ? '' : JSON.stringify(input.error) };
     else if (event === 'Stop' || event === 'StopFailure') {
@@ -150,7 +170,10 @@ export class MailHooks {
       const said = event === 'StopFailure' ? `${text('error_details') ?? text('last_assistant_message') ?? ''} (${text('error') ?? 'error'})` : text('last_assistant_message');
       receipt = { turn_ended: true, said: said == null ? null : Array.from(said).slice(0, 300).join('') };
     } else return null;
-    this.store.putRecord('relays', paths.receipt, receipt, { create: true });
+    this.store.transaction(() => {
+      this.store.putRecord('relays', paths.receipt, receipt, { create: true });
+      settleRelayAttempt(this.store, queued, readReceipt(receipt));
+    });
     return null;
   }
 
@@ -172,6 +195,14 @@ export class MailHooks {
       // the replying Claude session runs beside the relay, on this machine
       const sender = this.live.sessions().find((row) => row.door === 'native' && row.socket && row.socket === event.from.replace(/^uds:/, ''));
       const sessionId = sender ? sender.address.split(':').slice(3).join(':') : null;
+      // A spooled input can arrive between handle retirement and the next
+      // successful start. Its durable pool identity still selects the route
+      // ledger and the writer notice, never the legacy operator inbox path.
+      if (this.store.record('relays', paths.pool)?.pool === true || this.store.record('relays', paths.record)?.pool === true) {
+        const incoming = { represented, id, event, sender: sender ? { address: sender.address, name: sender.name, sessionId } : null };
+        if (!this.#routePoolReply(incoming)) this.store.putRecord('relay_pending', id, incoming, { create: true });
+        return { decision: 'block', reason: 'native reply processed by the shared pool; ambiguous replies are undelivered and the writer is notified through its own door' };
+      }
       const lastSent = this.store.record('relays', paths.sent) ?? {};
       const inReplyTo = sessionId ? lastSent[sessionId] ?? null : null;
       this.#fileHome(represented, makeEnvelope({ id, from: makeAddress(this.machine, 'claude-code', sessionId ?? 'unknown'),
@@ -185,6 +216,49 @@ export class MailHooks {
     return INBOUND_BLOCK;
   }
 
+  /** A reply during a native send waits for its receipt, not for a guess about
+   * the intended origin. Deferred inputs survive a daemon restart. */
+  drainPoolReplies() {
+    if (this.stopped) return;
+    const rows = this.store.statement("SELECT key, record FROM mail_records WHERE collection = 'relay_pending' ORDER BY key LIMIT 256").all();
+    let routed = 0;
+    for (const row of rows) {
+      if (this.#routePoolReply(JSON.parse(row.record))) { this.store.removeRecord('relay_pending', row.key); routed++; }
+    }
+    if (routed && rows.length === 256) this.onPoolRecord({ collection: 'relay_pending' });
+  }
+
+  #routePoolReply({ represented, id, event, sender }) {
+    const route = sender ? uniqueRelayDestination(this.store, sender.sessionId) : { origin: null, candidates: [] };
+    if (route.pending) return false;
+    const from = sender?.address ?? makeAddress(this.machine, 'claude-code', 'unknown');
+    if (route.origin) {
+      this.#fileHome(route.origin.sender, makeEnvelope({ id, from, from_name: sender.name, kind: 'peer', reply_via: { mode: 'command' },
+        in_reply_to: route.origin.id, in_reply_to_inferred: true, thread: this.threadOf(route.origin.id), native_from: event.from, body: event.body }));
+      return true;
+    }
+    const candidates = route.candidates.map(({ sender: address, id: message }) => ({ address, id: message }));
+    const held = { ...makeEnvelope({ id, from, from_name: sender?.name ?? event.fromName ?? 'unverified native writer', kind: 'peer',
+      reply_via: { mode: 'none' }, native_from: event.from, body: event.body }),
+      pool_reply_undelivered: { reason: sender ? 'there is no single proven sender destination' : 'the native writer is unverified', candidates } };
+    this.store.transaction(() => {
+      // Retention of the exact reply is diagnostics, never a delivery to any
+      // possible sender. The writer's notice has its own distinct message id.
+      this.store.deliver(represented, held);
+      if (sender) {
+        const noticeId = `m-${blake3Hex(`pool-undelivered\0${id}`).slice(0, 24)}`;
+        const examples = candidates.map((candidate) => `supercode message reply ${candidate.id}`).join(' or ');
+        const notice = { ...makeEnvelope({ id: noticeId, from: represented, from_name: 'supercode mail relay', kind: 'notice', reply_via: { mode: 'none' },
+          body: `Your native reply ${shortId(id)} was NOT DELIVERED to a sender: this shared relay has no single proven reply destination. None of the possible senders was marked delivered. Use supercode message reply <original-message-id>, or the send_message MCP tool with in_reply_to naming that id. ${examples ? `Known message ids: ${examples}. ` : ''}The original incoming envelope names its reply door. Do not send a plain native reply to the relay.` }),
+          pool_reply_failure_notice: { reply_id: id } };
+        this.store.deliver(sender.address, notice);
+        this.store.requestWake(sender.address, noticeId, { keep: true });
+      }
+    });
+    this.log(`pool reply ${id} undelivered: ${sender ? `writer ${sender.address}'s notice waits for its own delivery door` : 'the native writer could not be verified; exact reply retained with the refusal'}`);
+    return true;
+  }
+
   /** A relay's inbound mail its hook kept while this daemon did not answer it (the front door's spool, outside the mail
    *  folder): each filed as the hook would have filed it, then let go; oldest first. */
   drainSpool(dir) {
@@ -215,8 +289,7 @@ export class MailHooks {
   #fileHome(represented, envelope) {
     // not filed is a failed filing, never a quiet one: the hook keeps the mail (its spool), and a drain keeps its file
     this.store.deliver(represented, envelope);
-    if (parseAddress(represented).machine === this.machine) void Promise.resolve(this.handOver(represented, envelope.id)).catch((error) => this.log(`relay inbound: ${envelope.id} stays in ${represented}'s mailbox: ${error.message}`));
-    else this.store.requestWake(represented, envelope.id);
+    this.store.requestWake(represented, envelope.id, { keep: true });
   }
 
   // ---- `message native-question-hook <binding>` ---------------------------------------------------------------------
@@ -273,6 +346,8 @@ export class MailHooks {
 
   stop() {
     this.stopped = true;
+    this.store.database.off('record', this.onPoolRecord);
+    this.hookViews.clear();
     for (const key of this.waiting) this.store.removeRecord('native_questions', key);
     this.waiting.clear();
   }

package/mail/reads.mjs

@@ -140,7 +140,8 @@ export class MailReads {
   paneOf(session) { return this.#paneOf(session); }
 
   #paneOf(session) {
-    const pane = typeof session.pane === 'string' ? session.pane.split(':')[0] : null;
+    const selected = session.door === 'native' ? session.delivery_pane : session.pane;
+    const pane = typeof selected === 'string' ? selected.split(':')[0] : null;
     return pane && isDaemonPane(pane) ? pane : null;
   }
 

package/mail/relay-routing.mjs

@@ -0,0 +1,41 @@
+// A shared native identity carries no per-sender reply address. Keep at most two
+// origins per recipient: a second origin makes ambiguity permanent. Never evict
+// ambiguity and then infer a fresh unique origin for that same session id.
+const COLLECTION = 'relay_routes';
+const MAX_ROUTES = 1_000_000;
+
+export function relayRoute(store, receiver) { return store.record(COLLECTION, receiver); }
+
+export function beginRelayAttempt(store, queued) {
+  if (!queued.expects_reply) return;
+  const route = relayRoute(store, queued.receiver) ?? { origins: [], ambiguous: false };
+  if (!relayRoute(store, queued.receiver) && store.statement('SELECT count(*) AS count FROM mail_records WHERE collection = ?').get(COLLECTION).count >= MAX_ROUTES) {
+    throw new Error('the pool reply-address ledger reached its bound; no send was submitted');
+  }
+  if (route.pending && route.pending.id !== queued.message_id) throw new Error('the receiver has an unresolved pooled send; no send was submitted');
+  store.putRecord(COLLECTION, queued.receiver, { ...route, pending: { sender: queued.sender, id: queued.message_id } });
+}
+
+export function settleRelayAttempt(store, queued, outcome) {
+  if (!queued?.expects_reply) return;
+  const route = relayRoute(store, queued.receiver);
+  if (!route || route.pending?.id !== queued.message_id) return;
+  const origins = [...route.origins];
+  if (outcome.delivered || outcome.unknown) {
+    const index = origins.findIndex((origin) => origin.sender === queued.sender);
+    const origin = { sender: queued.sender, id: queued.message_id, confirmed: outcome.delivered === true };
+    if (index >= 0) {
+      // An unanswered attempt never replaces the last confirmed message id.
+      if (outcome.delivered || !origins[index].confirmed) origins[index] = origin;
+    } else if (origins.length < 2) origins.push(origin);
+    route.ambiguous ||= origins.some((item) => item.sender !== queued.sender);
+  }
+  store.putRecord(COLLECTION, queued.receiver, { origins, ambiguous: route.ambiguous, pending: null });
+}
+
+export function uniqueRelayDestination(store, receiver) {
+  const route = relayRoute(store, receiver);
+  if (route?.pending) return { pending: true, candidates: route.origins };
+  const origin = !route?.ambiguous && route?.origins.length === 1 && route.origins[0].confirmed ? route.origins[0] : null;
+  return { origin, candidates: route?.origins ?? [], ambiguous: Boolean(route?.ambiguous) };
+}