@volter/supercode-teams 0.3.18 → 0.3.20

package/bin/workspace/calendar.mjs

@@ -24,7 +24,7 @@ const at = (value, name) => { const t = Date.parse(String(value ?? '')); if (!Nu
 
 function readBoard(root) {
   if (!root) usage('--root names the board\'s home');
-  const text = execFileSync(supercode(), ['workflow', 'load', '--from', 'hermes', '--json', String(root)], { encoding: 'utf8', maxBuffer: 512 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+  const text = execFileSync(supercode(), ['workflow', 'load', '--json', String(root)], { encoding: 'utf8', maxBuffer: 512 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
   const board = Object.values(JSON.parse(text).workflow.boards)[0];
   return { tasks: Object.entries(board.tasks).map(([id, task]) => ({ id, ...task })), dependencies: board.dependencies ?? [] };
 }

package/bin/workspace.mjs

@@ -1063,8 +1063,16 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
       else if (event.event === 'dropped') linkDownSince ??= Date.now();
       else if (event.event === 'replaced') linkReplaced = true;
     });
-    // The connector is the service's daemon and keeps serving; a daemon that took its socket path is the one to stop.
-    machine.on('superseded', (path) => process.stderr.write(`supercode teams: another machine daemon replaced this connector's socket at ${path}; stop it (supercode teams status)\n`));
+    // The connector is the service's daemon; a daemon that took its socket path is the one to stop. Run by a service,
+    // the connector stops a linkless one itself and restarts onto the socket: a session's supercode older than the
+    // wait for the service starts one whenever the socket does not answer, and this machine sat unlinked behind it.
+    machine.on('superseded', (path) => {
+      // A holder with a server link is another connector for this machine, which its `replaced` link says.
+      let linked = true; try { linked = Boolean(JSON.parse(readFileSync(paths(daemonHome).machine, 'utf8')).server); } catch { /* no record */ }
+      if (!saved.service || linked) { process.stderr.write(`supercode teams: another machine daemon replaced this connector's socket at ${path}; stop it (supercode teams status)\n`); return; }
+      process.stderr.write(`supercode teams: another machine daemon took this connector's socket at ${path}; restarting onto it\n`);
+      void (async () => { await retireLinklessDaemon(paths(daemonHome).machine); await stopConnector?.(); process.exit(75); })();
+    });
     const stopAll = async () => { machineEvents.stop(); await machine.stop().catch(() => {}); await connector.stop(); await core.close(); await largeCore.close(); await slowCore.close(); await liveCore.close(); await lifecycle.close(); state.update(current => current ? ({ ...current, process: undefined }) : null); };
     // A daemon with no server link holding the socket is a session's auto-start while this service was between
     // restarts (from a supercode old enough not to wait for the service): it yields to the service's connector, which

package/connector/index.mjs

@@ -1,4 +1,6 @@
 import { mkdirSync, readFileSync, writeFileSync, renameSync, existsSync, chmodSync, realpathSync, statSync, openSync, closeSync, fsyncSync, unlinkSync, readSync, readdirSync } from 'node:fs';
+import { redactionBasis } from '@volter/teams/redact';
+import { Redactor } from './redactor.mjs';
 import { basename, dirname, join } from 'node:path';
 import { randomBytes, createHash } from 'node:crypto';
 import { canonicalJson, carryDigest } from '../contracts/index.mjs';
@@ -46,7 +48,7 @@ const trailingToolResults=messages=>{
 // The kept-back digests after such a settled rewrite, or null when the kept-back history changed in any other way.
 // A baseline recorded before its tool tail was (baseline_tool_tail absent) takes the tail from the current messages.
 function settledToolTail(previous,messages){
-  const baseline=previous.baseline,count=baseline.length,digestOf=message=>hash(canonicalJson(message.value));
+  const baseline=previous.baseline,count=baseline.length;
   if(messages.length<count||baseline.some((native_key,index)=>messages[index].native_key!==native_key))return null;
   const tail=previous.baseline_tool_tail??trailingToolResults(messages.slice(0,count));
   if(!tail||!Number.isSafeInteger(tail.from)||tail.from<1||tail.from+tail.call_ids.length!==count)return null;
@@ -57,12 +59,23 @@ function settledToolTail(previous,messages){
   return messages.slice(0,count).map(digestOf);
 }
 const hash=value=>createHash('sha256').update(value).digest('hex');
+// What leaves for the server is redacted (@volter/teams/redact), and every digest this connector keeps or sends (what it
+// observed, a baseline, the carried prefix) is of that form: a digest of the local text named a prefix the server never
+// held, every carry was refused, and each session holding a secret went whole on every pass. A message is redacted once
+// per process, in the connector's redaction worker: by its digest, nothing kept for one without a secret (most), its
+// redacted form for one with. Each loaded message's digest (of the form sent) is taken once and read where needed.
+const REDACTED_MEMO=200000;
+const redactions=new Map();
+const sentDigests=new WeakMap();
+const digestOf=message=>{let digest=sentDigests.get(message);if(digest===undefined){digest=hash(canonicalJson(message.value));sentDigests.set(message,digest);}return digest;};
+const remember=(digest,redacted)=>{if(redactions.size>=REDACTED_MEMO)redactions.clear();redactions.set(digest,redacted);};
 // A capture part is one request, and the server refuses a body over 8 MiB (volter-teams request-json.mjs): a part
 // holds at most PART_MESSAGES messages (the contract's bound) and PART_BYTES of them, so a run of large tool results
 // splits across parts instead of failing the whole session. A single message larger than that goes alone.
 const PART_MESSAGES=500,PART_BYTES=6*1024*1024;
 function captureParts(captureId,messages){
   const parts=[];let current=[],bytes=0;
+  // The messages are already in the form sent (sentValue, applied as a session is loaded).
   for(const message of messages){
     const size=Buffer.byteLength(JSON.stringify(message));
     if(current.length&&(current.length>=PART_MESSAGES||bytes+size>PART_BYTES)){parts.push({capture_id:captureId,index:parts.length,messages:current});current=[];bytes=0;}
@@ -298,10 +311,18 @@ export class TeamsConnector {
         let captured = true;
         // A session whose store is unchanged since this rule last committed it is in sync, whatever it last failed.
         const changed = this.sessionChanged(options); if (!changed) this.clearSessionProblem(harness, nativeSessionId);
-        if (changed && !this.predatesWindow(options)) try { await this.capture(options); } catch (error) {
+        // A store this process may not read (macOS denies a launchd job a removable volume, whatever the owner granted
+        // the terminal) is said once with its path and skipped: asking again each pass only costs time every readable
+        // session is waiting for.
+        const unreadable = this.unreadable?.get(`${harness}:${nativeSessionId}`);
+        if (unreadable) captured = false;
+        else if (changed && !this.predatesWindow(options)) try { await this.capture(options); } catch (error) {
           if (connectionError(error) || this.abort.signal.aborted) throw error;
           captured = false; this.noteSessionProblem(options, error);
-          process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} not synced: ${error.message}\n`);
+          if (/Operation not permitted|os error 1\b|EPERM|EACCES|Permission denied/.test(String(error.message))) {
+            (this.unreadable ??= new Map()).set(`${harness}:${nativeSessionId}`, options.locator?.storage?.path ?? null);
+            process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} is skipped: this process may not read its store${options.locator?.storage?.path ? ` (${options.locator.storage.path})` : ''}: ${error.message}\n`);
+          } else process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} not synced: ${error.message}\n`);
         }
         try { await this.nativeEffects.discover(descriptor, rule.id); } catch (error) { this.lastError = error; }
         // A large transcript is never followed: its harness process would hold the whole session and compare and copy
@@ -389,7 +410,7 @@ export class TeamsConnector {
       const known=this.liveFiles?.get(key);
       if(!known||this.liveFileCaptures.has(key))continue;
       const options={...known};
-      if(!this.sessionChanged(options)||this.liveFileStamps.get(key)===options.stamp)continue;
+      if(this.unreadable?.has(key)||!this.sessionChanged(options)||this.liveFileStamps.get(key)===options.stamp)continue;
       this.liveFileStamps.set(key,options.stamp);this.liveFileCaptures.add(key);
       // Re-read authorization when a live file changes; never keep a stale rule
       // alive merely because somebody still has the transcript open.
@@ -538,11 +559,45 @@ export class TeamsConnector {
     this.save();this.pruneSpill();
   }
   // A translated bundle, spilled, in the form the cache keeps: one entry per file, primary first or not.
-  spillTranslated(translated,defaultName){
+  // Each loaded message in the form sent: the memo's; the loaded one itself when the server holds it unchanged under
+  // this redaction basis (its digest is among those last observed); else what the redaction worker makes of it, all of
+  // a capture's new messages in one request. A digest is taken once per message, of the form sent.
+  async sentMessages(raw,previous){
+    const basis=redactionBasis(),held=previous?.redaction_basis===basis&&previous?.observed_digests?.length?new Set(previous.observed_digests):null;
+    const out=new Array(raw.length),missing=[];
+    raw.forEach((message,index)=>{
+      const text=canonicalJson(message.value),digest=hash(text);
+      if(redactions.has(digest)){const kept=redactions.get(digest);out[index]=kept?{...message,value:kept.value}:message;sentDigests.set(out[index],kept?kept.digest:digest);return;}
+      if(held?.has(digest)){remember(digest,null);out[index]=message;sentDigests.set(message,digest);return;}
+      missing.push([index,digest,text]);
+    });
+    if(missing.length){
+      this.redactor??=new Redactor();
+      if(!this.redactionCounted){this.redactionCounted=true;this.syncStatus().redaction={since:new Date(this.clock.nowMs()).toISOString(),batches:0,messages:0,bytes:0,worker_ms:0,main_ms:0,max_main_ms:0};}
+      // The worker is sent each new message's canonical JSON and answers only those redaction changed.
+      let started=performance.now();const texts=missing.map(([,,text])=>text),pending=this.redactor.run('canonical',texts);let mainMs=performance.now()-started;
+      const changed=await pending;started=performance.now();
+      for(const [index,digest] of missing){remember(digest,null);out[index]=raw[index];sentDigests.set(raw[index],digest);}
+      for(const {index:at,value,digest:sent} of changed){
+        const [index,digest]=missing[at];
+        remember(digest,{value,digest:sent});out[index]={...raw[index],value};sentDigests.set(out[index],sent);
+      }
+      mainMs+=performance.now()-started;
+      // What redaction costs this connector, kept beside its sync status: the worker's busy time, and this thread's time
+      // handing new text over and taking the answer (its longest single stretch is the most a door waited on it).
+      // Since this process's worker started.
+      const cost=this.syncStatus().redaction;
+      cost.batches+=1;cost.messages+=missing.length;cost.bytes+=texts.reduce((n,text)=>n+text.length,0);
+      cost.worker_ms=Math.round(this.redactor.workerMs);cost.main_ms=Math.round((cost.main_ms+mainMs)*10)/10;cost.max_main_ms=Math.max(cost.max_main_ms,Math.round(mainMs*10)/10);
+    }
+    return out;
+  }
+  async spillTranslated(translated,defaultName){
     const files=translated.files?.length?translated.files:[{path:translated.suggested_filename??defaultName,content:translated.content,role:'primary'}];
     if(files.filter(file=>file.role==='primary').length!==1)throw Object.assign(new Error('native codec bundle must contain exactly one primary file'),{code:'fidelity_unavailable'});
     let total=0;const spilled=[];
-    for(const file of files){const bytes=Buffer.from(file.content,'utf8');total+=bytes.length;if(total>256*1024*1024)throw Object.assign(new Error('native artifact bundle exceeds 256 MiB'),{code:'request_too_large'});spilled.push({path:file.path,role:file.role,...this.spill(bytes)});}
+    this.redactor??=new Redactor();const texts=await this.redactor.run('texts',files.map(file=>file.content));
+    for(const [index,file] of files.entries()){const bytes=Buffer.from(texts[index],'utf8');total+=bytes.length;if(total>256*1024*1024)throw Object.assign(new Error('native artifact bundle exceeds 256 MiB'),{code:'request_too_large'});spilled.push({path:file.path,role:file.role,...this.spill(bytes)});}
     return {fidelity:translated.fidelity,residue:translated.residue??[],files:spilled};
   }
   // The outbox artifacts and native_bundle of one capture from a spilled bundle; every capture gets fresh upload ids.
@@ -560,6 +615,10 @@ export class TeamsConnector {
   // upload; a followed (live) session loads through a harness process of its own, so a watched session's new turn
   // never waits behind a pass's loads.
   async capture(options) {
+    // A session the server refused for size is set aside until its sync rule changes: loading and sending it again
+    // could only be refused again, and two such sessions held a core on every pass. It stays a session problem.
+    const aside=this.state.set_aside?.[`${options.harness}:${options.nativeSessionId}`];
+    if(aside&&aside.rule_revision===(options.ruleRevision??null))return null;
     if(!options.preloaded&&this.largeSession(options))return this.captureLarge(options);
     if(!options.preloaded){
       const key=`${options.harness}:${options.nativeSessionId}`,now=this.clock.nowMs();
@@ -636,7 +695,7 @@ export class TeamsConnector {
     const kept=previous.baseline&&!clearBaseline?new Set(previous.baseline):null;
     const held=previous.observed_keys.map((key,index)=>[key,previous.observed_digests?.[index]]).filter(([key])=>!kept?.has(key));
     const limit=Math.min(messages.length-1,held.length);let count=0;
-    while(count<limit&&messages[count].native_key===held[count][0]&&hash(canonicalJson(messages[count].value))===held[count][1])count++;
+    while(count<limit&&messages[count].native_key===held[count][0]&&digestOf(messages[count])===held[count][1])count++;
     return count>=CARRY_MIN_MESSAGES?count:0;
   }
   largeSession({locator}){
@@ -716,23 +775,24 @@ export class TeamsConnector {
         this.save();
       }
     }
-    let messages=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});
-    this.labelTurns(key,loaded.messages??loaded.turns??[],messages);
+    // The turns typed through a door here are labelled before redaction, which then reads them as sent.
+    const raw=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});this.labelTurns(key,loaded.messages??loaded.turns??[],raw);
+    let messages=await this.sentMessages(raw,previous);const loadedMessages=messages,basis=redactionBasis();
     if (harness === 'codex' && loaded.total_message_count > messages.length) coverage = { ...coverage, completeness: 'partial', reasons: [...new Set([...coverage.reasons, 'prefix_not_captured'])] };
     // A session published without its native bundle is captured again, with the same messages, once the bundle can be built.
     const nativeWanted=backfillPolicy.mode==='all'&&typeof this.core.translateSession==='function'&&!((artifactBefore?.size??0)>NATIVE_MAX_BYTES);
     const retryNative=Boolean(previous?.native_deferred&&nativeWanted&&artifactBefore?.isFile()&&!previous?.baseline&&this.nativeReady(key,artifactBefore));
-    const unchanged=previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&hash(canonicalJson(message.value))===previous.observed_digests?.[index]);
+    const unchanged=previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&digestOf(message)===previous.observed_digests?.[index]);
     if(unchanged&&!retryNative){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);await this.publishSessionProfile(key);return null;}
     let effectivePrevious=previous;const clearBaseline=backfillPolicy.mode==='all';
     // A `none` rule keeps back the history recorded before it became active (the server's capture_after), not
     // whatever a session holds when first seen: a session begun after the rule is published from its first message.
     const keptBefore=backfillPolicy.mode==='since'?backfillPolicy.since:backfillPolicy.mode==='none'&&Number.isSafeInteger(rule.capture_after)?rule.capture_after:null;
-    if(!previous&&backfillPolicy.mode==='none'&&keptBefore===null){const toolTail=trailingToolResults(messages);this.state.origins[key]={generation:1,sequence:0,digest:null,baseline:messages.map(x=>x.native_key),baseline_digests:messages.map(x=>hash(canonicalJson(x.value))),...(toolTail?{baseline_tool_tail:toolTail}:{}),observed_keys:messages.map(x=>x.native_key),observed_digests:messages.map(x=>hash(canonicalJson(x.value))),last_rule_revision:ruleRevision,backfill_mode:backfillPolicy.mode};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
+    if(!previous&&backfillPolicy.mode==='none'&&keptBefore===null){const toolTail=trailingToolResults(messages);this.state.origins[key]={generation:1,sequence:0,digest:null,baseline:messages.map(x=>x.native_key),baseline_digests:messages.map(x=>digestOf(x)),...(toolTail?{baseline_tool_tail:toolTail}:{}),observed_keys:messages.map(x=>x.native_key),observed_digests:messages.map(x=>digestOf(x)),last_rule_revision:ruleRevision,backfill_mode:backfillPolicy.mode};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
     if(!previous&&(backfillPolicy.mode==='since'||backfillPolicy.mode==='none')){
       if(!Number.isSafeInteger(keptBefore))throw Object.assign(new Error('since backfill requires an integer timestamp'),{code:'invalid_request'});
       const excluded=messages.filter(message=>message.recorded_at==null||message.recorded_at<keptBefore);
-      effectivePrevious={generation:1,sequence:0,digest:null,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>hash(canonicalJson(message.value)))};
+      effectivePrevious={generation:1,sequence:0,digest:null,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>digestOf(message))};
       this.state.origins[key]=effectivePrevious;
     }
     // A source keyed by position (a Claude Code transcript is) can change a message it already reported: the core
@@ -744,13 +804,13 @@ export class TeamsConnector {
     // timestamps; a `none` rule cannot tell old history from new, so that session waits for an explicit
     // `supercode teams sync resume RULE --backfill all` (or a since window), which republishes it whole.
     if(!clearBaseline&&effectivePrevious?.baseline?.length&&effectivePrevious.baseline.every(x=>/^\d+$/.test(x))){
-      let baselineMoved=effectivePrevious.baseline.some((native_key,index)=>messages[index]?.native_key!==native_key||hash(canonicalJson(messages[index].value))!==effectivePrevious.baseline_digests?.[index]);
+      let baselineMoved=effectivePrevious.baseline.some((native_key,index)=>messages[index]?.native_key!==native_key||digestOf(messages[index])!==effectivePrevious.baseline_digests?.[index]);
       // A rule that started mid tool call kept back the core's placeholder result; the real result replaces it.
       const settled=baselineMoved&&backfillPolicy.mode==='none'?settledToolTail(effectivePrevious,messages):null;
       if(settled){baselineMoved=false;effectivePrevious={...effectivePrevious,baseline_digests:settled};this.state.origins[key]={...this.state.origins[key],baseline_digests:settled};this.save();}
       if(baselineMoved&&Number.isSafeInteger(keptBefore)){
         const excluded=messages.filter(message=>message.recorded_at==null||message.recorded_at<keptBefore);
-        effectivePrevious={...effectivePrevious,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>hash(canonicalJson(message.value)))};
+        effectivePrevious={...effectivePrevious,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>digestOf(message))};
         // A tool tail recorded for the old baseline describes positions that no longer hold; it goes with it.
         delete effectivePrevious.baseline_tool_tail;
         this.state.origins[key]={...this.state.origins[key],baseline:effectivePrevious.baseline,baseline_digests:effectivePrevious.baseline_digests};delete this.state.origins[key].baseline_tool_tail;
@@ -791,7 +851,7 @@ export class TeamsConnector {
         else try{
           const translated=(await this.core.translateSession({locator,target_harness:harness},{timeoutMs:translateTimeoutMs})).artifact;
           if(fileStamp(statSync(artifactSource))===onDisk){
-            bundle={stamp:onDisk,...this.spillTranslated(translated,basename(artifactSource))};
+            bundle={stamp:onDisk,...await this.spillTranslated(translated,basename(artifactSource))};
             // Only a translation that took real time is worth keeping; a small file translates again in no time.
             if(artifactBefore.size>=this.nativeIdleBytes){this.state.native_cache[key]=bundle;this.save();this.pruneSpill();}
           }
@@ -810,11 +870,11 @@ export class TeamsConnector {
     }else if(sqliteSource&&nativeWanted&&!effectivePrevious?.baseline){
       const translated=(await this.core.translateSession({locator,target_harness:harness},{timeoutMs:translateTimeoutMs})).artifact;
       const digest=entries=>hash(canonicalJson((entries.messages??entries.turns??[]).map(entry=>entry.value??entry)));if(digest(await this.core.session(locator).load())!==digest(loaded))throw Object.assign(new Error('native session changed while it was being captured'),{code:'resync_required'});
-      ({artifacts,nativeBundle}=this.bundleArtifacts(this.spillTranslated(translated,`${nativeSessionId}.json`),harness));
+      ({artifacts,nativeBundle}=this.bundleArtifacts(await this.spillTranslated(translated,`${nativeSessionId}.json`),harness));
     }
     const recordedTimes=messages.map(message=>message.recorded_at).filter(Number.isSafeInteger),commit={capture_id:captureId,parts:parts.length,digest:'',title:descriptor?.title??null,repository:null,reported_user:null,recorded_activity_at:recordedTimes.length?Math.max(...recordedTimes):null,parent_native_id:descriptor?.parent_session_id??null,coverage:effectivePrevious?.baseline&&!clearBaseline?{...coverage,completeness:'partial',reasons:[...new Set([...coverage.reasons,'prefix_not_captured'])]}:coverage,artifacts:artifacts.map(item=>item.manifest),...(nativeBundle?{native_bundle:nativeBundle}:{})};
     const digestCommit={...commit};delete digestCommit.digest;commit.digest=hash(canonicalJson({begin,parts,commit:digestCommit}));
-    this.state.outbox.push({begin,parts,commit,artifacts,clearBaseline,backfillMode:backfillPolicy.mode,stamp,nativeDeferred,observed:{keys:(loaded.messages??loaded.turns??[]).map((entry,index)=>entry.id??entry.native_key??String(index)),digests:(loaded.messages??loaded.turns??[]).map(entry=>hash(canonicalJson(entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key))))))}});this.save();const receipt=await this.flushSerial();await this.publishSessionProfile(key);return receipt;
+    this.state.outbox.push({begin,parts,commit,artifacts,clearBaseline,backfillMode:backfillPolicy.mode,stamp,nativeDeferred,observed:{keys:loadedMessages.map(message=>message.native_key),digests:loadedMessages.map(digestOf)},redactionBasis:basis});this.save();const receipt=await this.flushSerial();await this.publishSessionProfile(key);return receipt;
   }
   async publishSessionProfile(session){
     const observation=this.state.profile_outbox?.find(item=>item.session===session);if(!observation)return;
@@ -936,7 +996,14 @@ export class TeamsConnector {
     if(!Array.isArray(configuration?.rules))return false;
     return !configuration.rules.some(rule=>rule.id===item.begin.rule_id&&rule.revision===item.begin.rule_revision&&rule.state==='active');
   }
-  async flushOutbox(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];let receipt;this.dropLostArtifacts(item);this.refitParts(item);try{receipt=await this.sendCapture(item);}catch(error){if(error.code==='storage_pressure'&&this.deferNativeUnderPressure(item))continue;if(error.status===409&&error.code==='carry_mismatch'){const key=`${item.begin.harness}:${item.begin.native_session_id}`;this.lastError=error;process.stderr.write(`supercode teams: the server does not hold what a capture of ${item.begin.harness} session ${item.begin.native_session_id} carried; it goes whole next time\n`);this.state.outbox.shift();if(this.state.origins[key])this.state.origins[key]={...this.state.origins[key],observed_keys:[],observed_digests:[],carry_refused:true};this.save();continue;}if(error.status===400&&error.code==='invalid_request'||error.status===413){this.lastError=error;this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id??null},error);(this.droppedCaptures??=new Set()).add(`${item.begin.harness}:${item.begin.native_session_id}`);process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id} the server refused${error.status===413?' (one message is larger than a request may be)':' as malformed'}: ${error.message}\n`);this.state.outbox.shift();this.save();continue;}if(!await this.ruleRejected(item,error))throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.state.outbox.shift();this.save();continue;}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;delete next.baseline_tool_tail;}if(item.nativeDeferred)next.native_deferred=true;else delete next.native_deferred;if(!item.begin.carry)delete next.carry_refused;if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.state.origins[key]=next;this.state.outbox.shift();this.save();// A queued capture is often flushed by another session's capture: its own session's problem ends with it.
+  async flushOutbox(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];let receipt;this.dropLostArtifacts(item);this.refitParts(item);try{receipt=await this.sendCapture(item);}catch(error){if(error.code==='storage_pressure'&&this.deferNativeUnderPressure(item))continue;if(error.status===409&&error.code==='carry_mismatch'){const key=`${item.begin.harness}:${item.begin.native_session_id}`;this.lastError=error;process.stderr.write(`supercode teams: the server does not hold what a capture of ${item.begin.harness} session ${item.begin.native_session_id} carried; it goes whole next time\n`);this.state.outbox.shift();if(this.state.origins[key])this.state.origins[key]={...this.state.origins[key],observed_keys:[],observed_digests:[],carry_refused:true};this.save();continue;}if(error.status===409&&error.code==='batch_gap'&&error.details&&Number.isSafeInteger(error.details.sequence)){
+          // The server holds a different last capture of this session than this connector recorded (a capture it
+          // committed while the connector stopped before recording it, for one): this connector takes the server's
+          // revision, drops the stale capture and sends the session whole on its next pass.
+          const key=`${item.begin.harness}:${item.begin.native_session_id}`,expected=error.details;this.lastError=error;
+          process.stderr.write(`supercode teams: ${item.begin.harness} session ${item.begin.native_session_id} resumes at the server's revision ${expected.generation}/${expected.sequence}; it goes whole next time\n`);
+          this.state.outbox.shift();this.state.origins[key]={...this.state.origins[key],generation:expected.generation,sequence:expected.sequence-1,digest:expected.digest??null,observed_keys:[],observed_digests:[],carry_refused:true};this.save();continue;}
+        if(error.status===400&&error.code==='invalid_request'||error.status===413){this.lastError=error;this.noteSessionProblem({harness:item.begin.harness,nativeSessionId:item.begin.native_session_id,ruleId:item.begin.rule_id??null},error);(this.droppedCaptures??=new Set()).add(`${item.begin.harness}:${item.begin.native_session_id}`);if(error.status===413)(this.state.set_aside??={})[`${item.begin.harness}:${item.begin.native_session_id}`]={at:this.clock.nowMs(),rule_revision:item.begin.rule_revision??null,reason:error.message};process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id} the server refused${error.status===413?' (one message is larger than a request may be)':' as malformed'}: ${error.message}\n`);this.state.outbox.shift();this.save();continue;}if(!await this.ruleRejected(item,error))throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.state.outbox.shift();this.save();continue;}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,redaction_basis:item.redactionBasis??null,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;delete next.baseline_tool_tail;}if(item.nativeDeferred)next.native_deferred=true;else delete next.native_deferred;if(!item.begin.carry)delete next.carry_refused;if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.state.origins[key]=next;this.state.outbox.shift();this.save();// A queued capture is often flushed by another session's capture: its own session's problem ends with it.
 this.clearSessionProblem(item.begin.harness,item.begin.native_session_id);if(item.artifacts?.length)this.pruneSpill();latest=receipt;}return latest;}
-  stop(){this.core.off?.('sessionActivityEvent',this.activityEvent);if(this.activitySubscription)void this.core.unsubscribeSessionActivity(this.activitySubscription).catch(()=>{});try{this.flushState();}catch{}if(this.timer)clearInterval(this.timer);if(this.liveCaptureTimer)clearInterval(this.liveCaptureTimer);if(this.heartbeatTimer)clearInterval(this.heartbeatTimer);this.abort.abort();for(const follower of this.followers?.values()??[])follower.controller.abort();return this.nativeEffects.close();}
+  stop(){void this.redactor?.close();this.core.off?.('sessionActivityEvent',this.activityEvent);if(this.activitySubscription)void this.core.unsubscribeSessionActivity(this.activitySubscription).catch(()=>{});try{this.flushState();}catch{}if(this.timer)clearInterval(this.timer);if(this.liveCaptureTimer)clearInterval(this.liveCaptureTimer);if(this.heartbeatTimer)clearInterval(this.heartbeatTimer);this.abort.abort();for(const follower of this.followers?.values()??[])follower.controller.abort();return this.nativeEffects.close();}
 }

package/connector/redactor.mjs

@@ -0,0 +1,67 @@
+// Redaction runs in a worker thread of its own: the connector's thread also serves this machine's socket and its link
+// to the Teams server, and a capture's redaction (all of a session's new text through gitleaks' rules) held both for
+// seconds at a time. One request per capture: the messages it found new, or the files of a native bundle.
+import { Worker, isMainThread, parentPort } from 'node:worker_threads';
+
+if (!isMainThread && parentPort) {
+  const { redactText, redactValue } = await import('@volter/teams/redact');
+  const { canonicalJson } = await import('../contracts/index.mjs');
+  const { createHash } = await import('node:crypto');
+  // 'canonical': each item is a message value's canonical JSON (the connector has it already, for its digest), a string
+  // copied to this thread for little more than its bytes, where a value's object graph costs the connector's thread a
+  // walk each way. Only what redaction changed comes back, with its new digest.
+  const changedOf = (items) => {
+    const changed = [];
+    items.forEach((text, index) => {
+      const value = redactValue(JSON.parse(text)), sent = canonicalJson(value);
+      if (sent !== text) changed.push({ index, value, digest: createHash('sha256').update(sent).digest('hex') });
+    });
+    return changed;
+  };
+  const { performance } = await import('node:perf_hooks');
+  parentPort.on('message', ({ id, kind, items }) => {
+    // Its own busy time rides back with each answer: what redaction costs, apart from the connector's other work.
+    const started = performance.now();
+    try { const answer = kind === 'canonical' ? changedOf(items) : items.map((item) => (kind === 'texts' ? redactText(item) : redactValue(item))); parentPort.postMessage({ id, items: answer, busy: performance.now() - started }); }
+    catch (error) { parentPort.postMessage({ id, error: String(error?.message ?? error) }); }
+  });
+}
+
+export class Redactor {
+  constructor() { this.worker = null; this.next = 0; this.waiting = new Map(); this.workerMs = 0; }
+
+  start() {
+    // The connector's own node flags are not the worker's (one meant for the entry script refuses to start it).
+    const worker = new Worker(new URL(import.meta.url), { execArgv: [] });
+    worker.on('message', ({ id, items, error, busy }) => {
+      const waiter = this.waiting.get(id); if (!waiter) return;
+      this.waiting.delete(id);
+      this.workerMs += busy ?? 0;
+      if (error) waiter.reject(Object.assign(new Error(`redaction failed: ${error}`), { code: 'redaction_failed' }));
+      else waiter.resolve(items);
+      if (!this.waiting.size) worker.unref();
+    });
+    // A worker that dies fails what it held (nothing leaves unredacted); the next request starts another.
+    const fail = (error) => {
+      if (this.worker === worker) this.worker = null;
+      for (const waiter of this.waiting.values()) waiter.reject(Object.assign(new Error(`redaction failed: ${error?.message ?? error}`), { code: 'redaction_failed' }));
+      this.waiting.clear();
+    };
+    worker.on('error', fail);
+    worker.on('exit', (code) => fail(`its worker exited (${code})`));
+    worker.unref();
+    this.worker = worker;
+  }
+
+  /** `items` redacted, in order: `kind` 'values' (JSON values, every string in them) or 'texts'; for 'canonical' (canonical
+   *  JSON texts) only the changed ones, as `{ index, value, digest }`. */
+  run(kind, items) {
+    if (!items.length) return Promise.resolve([]);
+    if (!this.worker) this.start();
+    const id = this.next++;
+    this.worker.ref();
+    return new Promise((resolve, reject) => { this.waiting.set(id, { resolve, reject }); this.worker.postMessage({ id, kind, items }); });
+  }
+
+  close() { const worker = this.worker; this.worker = null; return worker ? worker.terminate().then(() => {}) : Promise.resolve(); }
+}

package/machine.mjs

@@ -72,6 +72,16 @@ const INITIAL_INPUT_READY_DEADLINE_MS = 90_000;
 const INITIAL_INPUT_POLL_MS = 250;
 /** The pause between the two composer readings a user's turn waits on. */
 const COMPOSER_RECHECK_MS = 400;
+// Claude Code waits out a usage limit and queues every message typed meanwhile until the limit's reset ("new messages
+// wait for your usage limit to reset"; esc or /rate-limit-options ends the wait). A limit raised early, or a weekly
+// one past 24 hours, never ends that wait, so a session sat with every turn it was sent queued behind it. Read from the
+// bottom of the screen, where the wait is shown, never from the conversation above it.
+export function claudeUsageLimitWait(screen) {
+  const rows = String(screen).replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').split('\n').map((line) => line.trim()).filter(Boolean);
+  const status = rows.slice(-6).join('\n');
+  // the wait's own banner on the status rows, never words in the conversation, and never a turn that is running
+  return /usage limit to reset/i.test(status) && /rate-limit-options/i.test(status) && !/esc to interrupt/i.test(status);
+}
 
 /** The settle floor for a pane whose kind has no composer pattern: the screen
  *  must have stopped changing for this long before the pane counts as ready. */
@@ -2035,6 +2045,13 @@ export class TeamsMachine extends MachineCore {
         if (this.suspended.has(params.pane)) throw Object.assign(new Error(`pane ${params.pane} is suspended: remote input is refused until resume`), { code: 423 });
         const kind = this.#paneKind(params.pane, session);
         if (kind === 'claude-code') {
+          // A usage-limit wait would queue this turn until the limit's reset: esc ends the wait first. A limit that
+          // still holds refuses the turn at once and the session waits again, for the next turn to try.
+          const queued = [...this.terminalMailboxes.values()].some(queue => queue.session?.id === session.id && (queue.state.active || queue.state.pending.length));
+          if (!this.inputInFlight.has(session.id) && !queued && claudeUsageLimitWait(await this.host.capture(session.id, { lines: 60 }))) {
+            await this.host.sendInput(session.id, '\u001b', { submitMode: 'single', deadlineMs: Date.now() + 5_000 });
+            await new Promise(resolve => setTimeout(resolve, COMPOSER_RECHECK_MS));
+          }
           const draftOf = async () => composerHoldsDraft(kind, await this.host.capture(session.id, { lines: 200, preserveEscapes: true }));
           const first = await draftOf();
           await new Promise(resolve => setTimeout(resolve, COMPOSER_RECHECK_MS));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -66,7 +66,7 @@
     "@volter/supercode-health": "^0.1.0",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/supercode-trace": "^0.1.0",
-    "@volter/teams": "0.2.9",
+    "@volter/teams": "0.2.11",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",

package/workspaces.mjs

@@ -4,27 +4,13 @@ import { join, dirname, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 export { teamsHome } from '@volter/teams/home';
 
+import { inspectCheckout, repositoryId } from '@volter/teams/checkout';
 const git = (path, args, optional = false) => {
   const r = spawnSync('git', ['-C', path, ...args], { encoding: 'utf8', timeout: 30_000 });
   if (r.status !== 0) { if (optional) return null; throw new Error(`git ${args[0]} in ${path}: ${(r.stderr || r.error?.message || 'failed').trim()}`); }
   return r.stdout.trim();
 };
-export function repositoryId(value) {
-  let s = String(value ?? '').trim().replace(/\.git\/?$/, '').replace(/\/$/, '');
-  if (/^[^/@]+@[^:]+:/.test(s)) s = s.replace(/^[^@]+@/, '').replace(':', '/');
-  else if (/^[a-z]+:\/\//i.test(s)) { const u = new URL(s); s = u.host + u.pathname; }
-  s = s.replace(/^github\.com\//i, '');
-  if (!/^[\w.-]+(?:\/[\w.-]+)+$/.test(s) || s.split('/').some(p => p === '.' || p === '..')) throw new Error('repository must be a git remote identity, for example volter-ai/editor; not a machine path');
-  return s;
-}
-export function inspectCheckout(path) {
-  const raw = git(path, ['rev-parse', '--path-format=absolute', '--show-toplevel', '--git-dir', '--git-common-dir']);
-  const [root, dir, common] = raw.split('\n').map(p => realpathSync(resolve(path, p)));
-  // The repository the checkout declares (remote.origin.url), not where a URL rewrite (insteadOf: a mirror, a proxy, a
-  // World's twin) sends its transport.
-  const remote = git(root, ['config', '--get', 'remote.origin.url'], true);
-  return { path: realpathSync(path), root, linked: dir !== common, repository: remote ? repositoryId(remote) : null, branch: git(root, ['branch', '--show-current']) || null };
-}
+export { inspectCheckout, repositoryId };
 export class Workspaces {
   constructor(home) { this.file = join(home, 'workspaces.jsonl'); }
   // Every registration stands until its checkout is registered again or unregistered; the newest standing row