@volter/supercode-teams 0.3.185 → 0.3.187

package/bin/teams.mjs

@@ -1,585 +1,52 @@
 #!/usr/bin/env node
-// The teams CLI. `supercode teams …` spawns this; it is also runnable directly
-// as `supercode-teams …`.
-//
-// Machine verbs act on this OS user's machine daemon through its local socket,
-// or, with `--machine NAME`, on an enrolled machine through the selected Teams
-// context's server:
-//
-//   machine start [--home dir] [--tmux-socket name] [--verbose]   run the daemon (local door only)
-//   machine status                                               the running daemon, if any
-//   describe                                     the host-key-signed statement
-//   panes ls | capture <pane> | close <pane>
-//   input <pane> <text> [--no-enter] | input <pane> --key NAMES   text, or keys by tmux name (Escape, C-c, Down …)
-//   suspend <pane> [--interrupt] | resume <pane> [--input text]   refuse/allow remote input on a pane
-//   files ls|get|put|stat|search <path> [--out f] [--in f] [--query q]
-//   ports ls | resolve <pane>          port <pane>/<n> [--listen host:port]
-//   browser <profile> [--listen host:port]   a browser-profile served here as a local CDP endpoint
-//   browser --list                          the machine's browser profiles (view on browser-profile:*)
-//   title set <pane> <text> | title ls
-//   attention ls | rank | request <pane> [--urgency now|soon|whenever] [--reason text] | clear <pane>
-//   watch [--interval ms] [--for ms]
-//   launches get <key> | cancel <key> | list   operators: keyed receipts; cancel only unissued keys
-//   health [status|features|alarms] [--json] [--all]   the machine's vitals (the machine-health pack)
-//   health subscribe|unsubscribe <address>    operators: alarm mail for a session or board address
-//   health run | once | config                this machine only: the pack's own probe verbs
-//   rpc <harness.v1 method> [json-params]   operators: one harness.v1 request
-//   log verify
-//   mail migration-check [--home dir] [--json]  local read of the legacy-wrapper guard; no daemon start
-//
-// Every other verb (server, login, context, connect, disconnect, status,
-// members, groups, sources, sync, machines, sessions) is the Teams workspace
-// CLI in ./workspace.mjs.
-import { appendFileSync, createWriteStream, readFileSync, writeFileSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
-import { noteStep, rotatedLogs, slowLogPath, timeCommand } from '@volter/supercode-harness-sdk/slow-log';
-
-import { TeamsMachine } from '../machine.mjs';
-import { harnessTransport, nodeRpc, forwardPort, watchMachine } from '../client.mjs';
-import { attachBrowserProfile, listBrowserProfiles } from '../browser-attach.mjs';
-import { openMachine } from '../machine-door.mjs';
-import { ownClaim } from '../live-sessions.mjs';
-import { moveWorkspace } from '../workspace-move.mjs';
-import { supercodeHome, teamsHome, paths, readJson, AccountLog, parseHostPort } from '@volter/teams/home';
-import { NODE_PROTOCOL } from '@volter/teams/channel';
-import { APP_DOOR_PATH, appDoorFile, appDoorLink, normalOrigin, readAppDoor, readAppDoorState, writeAppDoor } from '../app-door.mjs';
-
-const MACHINE_VERBS = new Set(['machine', 'slow', 'describe', 'records', 'panes', 'input', 'suspend', 'resume', 'files', 'ports', 'port', 'browser', 'stream', 'jobs', 'workspace', 'title', 'attention', 'watch', 'rpc', 'launches', 'log', 'mail', 'board', 'health', 'app-door']);
-// Every flag a machine verb reads; any other is refused rather than silently ignored.
-const KNOWN_FLAGS = new Set(['home', 'since', 'machine', 'context', 'floor', 'supercode', 'tmux-socket', 'verbose', 'lines', 'input', 'name', 'for', 'urgency', 'reason', 'interrupt', 'query', 'out', 'in', 'interval', 'no-enter', 'when-composer-empty', 'key', 'listen', 'list', 'from', 'to', 'path', 'to-path', 'repo', 'branch', 'solo', 'card', 'create', 'presence-only', 'processes', 'panes', 'clear-draft', 'message-ids', 'harness', 'observe', 'attach-context', 'json', 'all', 'origin', 'port', 'remove-origin', 'open', 'foreign']);
-
-const argv = process.argv.slice(2);
-const flags = {};
-const positional = [];
-for (let i = 0; i < argv.length; i += 1) {
-  const a = argv[i];
-  if (a === '--') { positional.push(...argv.slice(i + 1)); break; }
-  if (a.startsWith('--')) {
-    const eq = a.indexOf('=');
-    if (eq > 0) { flags[a.slice(2, eq)] = a.slice(eq + 1); continue; } // --args=--norc
-    const key = a.slice(2);
-    const next = argv[i + 1];
-    if (next !== undefined && !next.startsWith('--')) { flags[key] = next; i += 1; } else flags[key] = true;
-  } else positional.push(a);
-}
-const [verb, sub, ...rest] = positional;
-const migrationRead = verb === 'mail' && sub === 'migration-check';
-// A Windows scheduled task keeps no output (launchd and systemd name log files), so its unit names one here.
-// The local migration preflight does not open the service log or timing log.
-if (!migrationRead && process.env.SUPERCODE_TEAMS_LOG) {
-  const log = createWriteStream(process.env.SUPERCODE_TEAMS_LOG, { flags: 'a' });
-  for (const stream of [process.stdout, process.stderr]) stream.write = log.write.bind(log);
-  // The log is this process's own; a pane or harness it starts writes to its own terminal.
-  delete process.env.SUPERCODE_TEAMS_LOG;
-}
-// Each command is timed (the slow log, @volter/supercode-harness-sdk/slow-log); a service, a watch or a forward runs
-// until stopped and is timed one door at a time instead.
-const LONG_RUNNING = new Set(['connect', 'watch', 'port', 'stream', 'attach', 'serve']);
-// A service runs this entry as `teams.mjs teams connect`: the leading `teams` is the entry's own name, not a verb.
-const [timedVerb, timedSub] = verb === 'teams' ? [sub, rest[0]] : [verb, sub];
-if (!migrationRead && !LONG_RUNNING.has(timedVerb) && !(timedVerb === 'machine' && timedSub === 'start') && !(timedVerb === 'message' && timedSub === 'watch')) timeCommand(`teams ${[timedVerb, timedSub].filter(Boolean).join(' ')}`, argv);
-
-const MACHINE_HELP = 'machine verbs: machine start|status|restart, slow [--since 1h], describe, panes, input, suspend, resume, files, ports, port, stream, jobs, workspace, title, attention, watch, rpc, launches, log, health, browser, app-door on|off|rotate|status|link (add --machine NAME for an enrolled machine); local read: mail migration-check [--home dir] [--json]';
-
-if (verb === undefined || verb === 'help') {
-  process.stdout.write(`supercode teams: ${MACHINE_HELP}\n`);
-  const { workspaceMain } = await import('./workspace.mjs');
-  await workspaceMain(['--help']);
-  process.exit(0);
-}
-// A workspace verb is done when its promise settles. On Windows the process then ends on its own: Node there aborts
-// (libuv's `UV_HANDLE_CLOSING` assertion) when process.exit() follows a fetch, which every workspace verb makes.
-const workspaceVerb = !MACHINE_VERBS.has(verb);
-if (workspaceVerb) {
-  const { workspaceMain } = await import('./workspace.mjs');
-  await workspaceMain(argv).then(() => { process.exitCode = 0; }, (error) => {
-    process.stderr.write(JSON.stringify({ version: 1, error: { code: error.code ?? 'invalid_request', message: error.message } }) + '\n');
-    process.exitCode = (error.exitCode ?? ({ invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 }[error.code] ?? 1));
-  });
-  // Exit only once stdout has drained: a pipe takes 64 KB at a time, and exiting sooner cut a large --json answer off.
-  if (process.platform !== 'win32') { await new Promise((resolve) => process.stdout.write('', resolve)); process.exit(); }
-}
-
-// teamsHome() creates the default directory; the preflight only resolves it.
-const home = flags.home ? String(flags.home) : migrationRead
-  ? process.env.SUPERCODE_TEAMS_HOME ?? join(supercodeHome(), 'teams') : teamsHome();
-const p = paths(home);
-const out = (value) => process.stdout.write((typeof value === 'string' ? value : JSON.stringify(value, null, 2)) + '\n');
-const die = (message, code = 2) => { process.stderr.write(`supercode teams: ${message}\n`); process.exit(code); };
-if (!workspaceVerb) for (const flag of Object.keys(flags)) if (!KNOWN_FLAGS.has(flag)) die(`unknown flag: --${flag}`);
-
-/** Named keys (tmux's names) as the bytes a terminal sends for them: `panes.input` delivers
- *  them (`keys`) as a keystream, which every terminal host turns back into keys. */
-const KEY_BYTES = { Escape: '\u001b', Enter: '\r', Tab: '\t', BTab: '\u001b[Z', BSpace: '\u007f', Space: ' ', Up: '\u001b[A', Down: '\u001b[B', Right: '\u001b[C', Left: '\u001b[D', Home: '\u001b[H', End: '\u001b[F', PPage: '\u001b[5~', NPage: '\u001b[6~', DC: '\u001b[3~' };
-function keyBytes(names) {
-  return names.split(/[\s,]+/u).filter(Boolean).map((name) => {
-    const control = /^C-([a-z])$/iu.exec(name);
-    if (control) return String.fromCharCode(control[1].toLowerCase().charCodeAt(0) - 96);
-    if (!Object.hasOwn(KEY_BYTES, name)) die(`unknown key ${name}: one of ${Object.keys(KEY_BYTES).join(', ')}, C-a … C-z`);
-    return KEY_BYTES[name];
-  }).join('');
-}
-
-async function machineChannel() {
-  const started = performance.now();
-  try { return await openMachine({ machine: flags.machine ? String(flags.machine) : null, context: flags.context ? String(flags.context) : null, home }); }
-  finally { noteStep(flags.machine ? `open machine ${flags.machine}` : 'open the local machine', performance.now() - started); }
-}
-
-// Who this command acts for, so the pane doors can refuse a session acting on a pane it did not start. To this machine's
-// daemon, its claim (its pid, its parent, the session in its environment, a name it acts for), which the daemon holds to
-// its live-session map; to another machine, the caller this machine's daemon resolves from that claim, once per command.
-let actingAnswer;
-async function acting() {
-  if (!flags.machine) return { claim: ownClaim() };
-  if (actingAnswer === undefined) {
-    const local = await openMachine({ machine: null, home });
-    try {
-      const answer = await (await nodeRpc(local)).call('harness.v1.caller', { claim: ownClaim() });
-      actingAnswer = answer?.caller ?? null;
-    } catch (error) {
-      die(`cannot tell which session runs this, so the pane doors cannot hold it to the panes it started; nothing was done (${String(error.message).slice(0, 200)})`, 1);
-    } finally { local.close(); }
-  }
-  return actingAnswer ? { caller: actingAnswer } : {};
-}
-
-async function withNode(fn) {
-  const channel = await machineChannel();
-  try {
-    const rpc = await nodeRpc(channel);
-    return await fn(rpc, channel);
-  } finally {
-    channel.close();
+// Keep the service bootstrap independent of candidate daemon modules. An npm
+// replacement that deferred activation must still reach its retained release
+// when the service manager next starts this canonical entry.
+import { readFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { delimiter, dirname, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const args = process.argv.slice(2), verbs = args[0] === 'teams' ? args.slice(1) : args;
+const starts = (verbs[0] === 'connect' && !verbs.includes('--install') && !verbs.includes('--add-root'))
+  || (verbs[0] === 'machine' && verbs[1] === 'start');
+const json = async path => { try { return JSON.parse(await readFile(path, 'utf8')); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } };
+let installed = null;
+for (let parent = dirname(fileURLToPath(import.meta.url)); dirname(parent) !== parent; parent = dirname(parent)) {
+  if ((await json(join(parent, 'package.json')))?.name === '@volter/supercode') { installed = await json(join(parent, 'package.json')); break; }
+}
+
+if (starts && installed && !process.env.SUPERCODE_UPGRADE_SUPERVISOR) {
+  const at = args.indexOf('--home'), inline = args.find(arg => arg.startsWith('--home='));
+  const home = resolve(at >= 0 ? args[at + 1] : inline ? inline.slice(7) : process.env.SUPERCODE_TEAMS_HOME
+    || join(process.env.SUPERCODE_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'supercode'), 'teams'));
+  const history = await json(join(home, 'service', 'release-history.json'));
+  let release = history?.candidate;
+  const fallbackController = history?.refused?.supports_ready ? history.refused : release;
+  const controller = release?.supports_ready && release.native !== history?.previous?.native ? release : fallbackController;
+  if (!release?.supervised) {
+    // Retaining packages and fetching a predecessor belong to installation,
+    // never first serving. With no history, use this installed release and
+    // keep original mail readable if migration is refused.
+    process.env.SUPERCODE_MAIL_STARTUP_RECOVERY = '1';
+    process.env.SUPERCODE_RELEASE_VERSION = installed.version;
+    await import('./teams-cli.mjs');
+    release = null;
   }
-}
-
-/** The machine-health pack's CLI: an explicit path, the installed package, else a source checkout's sibling. */
-async function healthPackEntry() {
-  const { existsSync } = await import('node:fs');
-  if (process.env.SUPERCODE_HEALTH_ENTRY) return existsSync(process.env.SUPERCODE_HEALTH_ENTRY) ? process.env.SUPERCODE_HEALTH_ENTRY : null;
-  try { const found = fileURLToPath(import.meta.resolve('@volter/supercode-health/bin')); if (existsSync(found)) return found; } catch { /* not installed */ }
-  const sibling = fileURLToPath(new URL('../../health/bin/health.mjs', import.meta.url));
-  return existsSync(sibling) ? sibling : null;
-}
-
-async function main() {
-  switch (verb) {
-    case 'machine': {
-      if (sub === 'start') {
-        const machine = new TeamsMachine({
-          home,
-          floor: flags.floor ? Number(flags.floor) : null,
-          supercode: flags.supercode ?? 'supercode',
-          // A named tmux server keeps a daemon's panes off the default socket.
-          ...(flags['tmux-socket'] ? { tmuxSocket: String(flags['tmux-socket']) } : {}),
-        });
-        // --verbose narrates every door with its latency, so a slow machine is diagnosed from its own log.
-        machine.on('door', (d) => { if (flags.verbose) process.stderr.write(`door ${d.method} ${d.outcome} ${d.ms}ms${d.detail ? ` ${d.detail}` : ''}\n`); });
-        machine.on('serve-stderr', (t) => process.stderr.write(t));
-        machine.on('mail-log', (line) => process.stderr.write(`mail: ${line}\n`));
-        machine.on('records-log', (line) => process.stderr.write(`records: ${line}\n`));
-        machine.on('serve-exit', (e) => process.stderr.write(`harness serve exited: ${JSON.stringify(e)}\n`));
-        machine.on('unrouted-notification', (m) => { if (flags.verbose) process.stderr.write(`unrouted: ${m.method}\n`); });
-        const socket = await machine.start();
-        out({ id: machine.id, socket, home, protocol: NODE_PROTOCOL, floor: machine.floor });
-        const stop = async () => { await machine.stop(); process.exit(0); };
-        // Another daemon took the socket path: this one serves nobody, and its children would run beside that one's.
-        machine.once('superseded', (path) => { process.stderr.write(`supercode teams: another machine daemon now serves ${path}; this one stops\n`); void stop(); });
-        process.on('SIGINT', stop);
-        process.on('SIGTERM', stop);
-        return;
-      }
-      if (sub === 'status') {
-        // and every supercode process here still running a release an install replaced (t_8e109edc)
-        let stale_releases = null;
-        try { stale_releases = await (await import('@volter/supercode-health/drift')).staleSupercode(); } catch { /* not read */ }
-        out({ ...readJson(p.machine, { running: false }), stale_releases }); return;
-      }
-      // `machine restart [--machine M] [--reason text]`: the daemon (this one, or M's through the server) restarts under its service.
-      if (sub === 'restart') return withNode(async (rpc) => out(await rpc.call('machine.restart', { reason: flags.reason ? String(flags.reason) : null })));
-      // `machine boards [list]` and `machine boards unregister <root>`: the board homes this machine's connector follows
-      // and publishes, and one no longer followed (a proof's scratch home: t_f7b219b8)
-      if (sub === 'boards') {
-        const [action = 'list', root] = rest;
-        if (action === 'list') return withNode(async (rpc) => out(await rpc.call('harness.v1.boards.list', {})));
-        if (action === 'unregister' && root) return withNode(async (rpc) => out(await rpc.call('harness.v1.boards.unregister', { root: resolve(root) })));
-        die('machine boards [list] | machine boards unregister <root>');
-      }
-      // `machine pane-of <pid>`: the pane this daemon launched that the process runs in, and who launched it, from the
-      // daemon's own record (the native's acting caller asks it for its own pid; never what a command sets for itself)
-      if (sub === 'pane-of') return withNode(async (rpc) => out(await rpc.call('harness.v1.pane_of', { pid: Number(rest[0]) })));
-      die('machine start|status|restart|boards|pane-of');
-    }
-    case 'slow': {
-      // `slow [--since 1h|30m|<iso>]`: the slow log on this machine, grouped by what was slow (kind and name), the
-      // slowest first, each with its count, median and longest time and its usual slowest step. The audit reads this.
-      const since = (() => {
-        const value = String(flags.since ?? '24h');
-        const relative = /^(\d+)([smhd])$/.exec(value);
-        if (relative) return Date.now() - Number(relative[1]) * { s: 1e3, m: 6e4, h: 36e5, d: 864e5 }[relative[2]];
-        const at = Date.parse(value);
-        if (Number.isNaN(at)) die('slow --since takes 30m, 2h, 1d or a date');
-        return at;
-      })();
-      let text = '';
-      for (const file of [...rotatedLogs(), slowLogPath()]) {
-        try { text += readFileSync(file, 'utf8'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
-      }
-      const groups = new Map();
-      for (const line of text.split('\n')) {
-        let row; try { row = JSON.parse(line); } catch { continue; }
-        if (!(Date.parse(row.at) >= since)) continue;
-        const key = `${row.kind} ${row.name}`;
-        const group = groups.get(key) ?? { kind: row.kind, name: row.name, count: 0, ms: [], steps: new Map(), last: null };
-        group.count += 1; group.ms.push(row.ms); group.last = row.at;
-        if (row.slowest?.step) group.steps.set(row.slowest.step, (group.steps.get(row.slowest.step) ?? 0) + 1);
-        groups.set(key, group);
-      }
-      out([...groups.values()].map((group) => {
-        const sorted = group.ms.sort((a, b) => a - b);
-        const step = [...group.steps].sort((a, b) => b[1] - a[1])[0];
-        return { kind: group.kind, name: group.name, count: group.count, median_ms: sorted[Math.floor(sorted.length / 2)], max_ms: sorted.at(-1), usual_slowest_step: step ? step[0] : null, last: group.last };
-      }).sort((a, b) => b.max_ms * b.count - a.max_ms * a.count));
-      return;
-    }
-    case 'describe':
-      return withNode(async (rpc) => out(await rpc.call('describe')));
-    case 'panes': {
-      // `--processes`: each pane and its root pid (no screens read); `--presence-only [--panes a,b]`: whether each pane's
-      // composer is idle, for the named panes only when named.
-      if (sub === 'ls') return withNode(async (rpc) => out(await rpc.call(
-        flags.processes ? 'panes.processes' : flags['presence-only'] ? 'panes.present' : 'panes.list',
-        flags['presence-only'] && typeof flags.panes === 'string' ? { panes: flags.panes.split(',').filter(Boolean) } : {})));
-      if (sub === 'capture') return withNode(async (rpc) => out((await rpc.call('panes.capture', { pane: rest[0], lines: Number(flags.lines ?? 200) })).text));
-      // One pane, named: `--foreign` closes a pane another session started, and is said for that pane alone.
-      if (sub === 'close') {
-        // the flag parser takes `--foreign p_…` as the flag's value: that pane is the one named
-        const named = typeof flags.foreign === 'string' ? [flags.foreign, ...rest] : rest;
-        if (named.length !== 1) die('panes close <pane> [--foreign]: one pane per close');
-        return withNode(async (rpc) => out(await rpc.call('panes.close', { pane: named[0], foreign: flags.foreign !== undefined, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-      }
-      // `window <pane> [machine]`: a terminal window on this machine's screen showing the pane, this machine's or, named,
-      // another machine's (attached through Teams, in that machine's Teams context `--attach-context`); `--observe` shows it
-      // read-only.
-      if (sub === 'window') return withNode(async (rpc) => out(await rpc.call('panes.window', { pane: rest[0], machine: rest[1] ?? null, mode: flags.observe ? 'observe' : 'control', context: typeof flags['attach-context'] === 'string' ? flags['attach-context'] : null })));
-      die('panes ls|capture|close|window');
-    }
-    case 'title': {
-      if (sub === 'set') return withNode(async (rpc) => out(await rpc.call('title.set', { target: `pane:${rest[0]}`, title: rest.slice(1).join(' ') || null })));
-      if (sub === 'ls' || sub === undefined) return withNode(async (rpc) => out(await rpc.call('title.list')));
-      die('title set <pane> <text> | title ls');
-    }
-    case 'attention': {
-      // The machine computes the label; this prints it. Sorted by rank so the most
-      // urgent pane is the first line, which is the only ordering a person
-      // reading a fleet list ever wants.
-      if (sub === 'ls' || sub === undefined) {
-        return withNode(async (rpc) => {
-          const rows = await rpc.call('attention.snapshot');
-          out([...rows].sort((a, b) => a.rank - b.rank));
-        });
-      }
-      if (sub === 'rank') return withNode(async (rpc) => out(await rpc.call('attention.rank')));
-      if (sub === 'request') return withNode(async (rpc) => out(await rpc.call('attention.request', { pane: rest[0], urgency: flags.urgency ? String(flags.urgency) : undefined, reason: flags.reason ? String(flags.reason) : null })));
-      if (sub === 'clear') return withNode(async (rpc) => out(await rpc.call('attention.clear', { pane: rest[0] })));
-      die('attention ls | rank | request <pane> [--urgency now|soon|whenever] [--reason text] | clear <pane>');
-    }
-    case 'suspend':
-      return withNode(async (rpc) => out(await rpc.call('panes.suspend', { pane: sub, interrupt: Boolean(flags.interrupt), ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-    case 'resume':
-      return withNode(async (rpc) => out(await rpc.call('panes.resume', { pane: sub, input: flags.input ? String(flags.input) : null, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-    case 'files': {
-      const path = rest[0];
-      if (sub === 'ls') return withNode(async (rpc) => out(await rpc.call('files.list', { path })));
-      if (sub === 'stat') return withNode(async (rpc) => out(await rpc.call('files.stat', { path })));
-      if (sub === 'search') return withNode(async (rpc) => out(await rpc.call('files.search', { path, query: flags.query ?? '' })));
-      if (sub === 'get') return withNode(async (rpc) => {
-        // In ranges: one answer is one frame, so a file of any size is read 4 MiB at a time until it ends.
-        const { size } = await rpc.call('files.stat', { path });
-        const CHUNK = 4 * 1024 * 1024;
-        if (flags.out) writeFileSync(flags.out, Buffer.alloc(0));
-        for (let offset = 0; offset < size;) {
-          const result = await rpc.call('files.read', { path, offset, length: Math.min(CHUNK, size - offset) });
-          const bytes = Buffer.from(result.bytes, 'base64');
-          if (!bytes.length) break;
-          if (flags.out) appendFileSync(flags.out, bytes); else await new Promise((done) => process.stdout.write(bytes, done));
-          offset += bytes.length;
-        }
-      });
-      if (sub === 'put') return withNode(async (rpc) => {
-        const bytes = flags.in ? readFileSync(flags.in) : readFileSync(0);
-        out(await rpc.call('files.write', { path, bytes: bytes.toString('base64'), truncate: true }));
-      });
-      die('files ls|stat|search|get|put <path>');
-    }
-    case 'ports': {
-      if (sub === 'ls' || sub === undefined) return withNode(async (rpc) => out(await rpc.call('ports.list')));
-      if (sub === 'resolve') return withNode(async (rpc) => out(await rpc.call('ports.resolve', { pane: rest[0] })));
-      die('ports ls|resolve <pane>');
-    }
-    case 'watch': {
-      // `watch [--interval ms]`: the machine's live state as JSON lines — one snapshot, then deltas — until ctrl-c.
-      const channel = await machineChannel();
-      const w = await watchMachine(channel, { intervalMs: Number(flags.interval ?? 1000) });
-      w.on('snapshot', (s) => out(JSON.stringify(s)));
-      w.on('delta', (d) => out(JSON.stringify(d)));
-      w.on('error-message', (m) => process.stderr.write(`[watch: ${m}]\n`));
-      w.on('close', (reason) => { process.stderr.write(`[watch ended${reason ? `: ${reason}` : ''}]\n`); channel.close(); process.exit(0); });
-      if (typeof flags.for === 'string') setTimeout(() => { w.close(); }, Number(flags.for));
-      return;
-    }
-    case 'input':
-      // `input <pane> <text>`: one delivery through the host's own sendInput; gated like control.
-      // `--when-composer-empty`: a user's own turn, typed only into an empty composer
-      // (answers `delivered: false` with the reason when it holds a draft).
-      // `--harness NAME` (with it): the addressed session's harness; the daemon refuses a pane running another program.
-      if (flags['clear-draft']) {
-        if (rest.length || flags.key || flags['no-enter'] || flags['when-composer-empty']) die('input <pane> --clear-draft only clears the current draft; send a new message separately');
-        return withNode(async rpc => out(await rpc.call('panes.clearDraft', { pane: sub, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-      }
-      if (flags.key !== undefined) {
-        if (flags.key === true || rest.length) die('input <pane> --key NAMES: keys by tmux name, space- or comma-separated (Escape, Enter, Tab, BTab, BSpace, Space, Up, Down, Left, Right, Home, End, PPage, NPage, DC, C-a … C-z)');
-        return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: keyBytes(String(flags.key)), submit: false, keys: true, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-      }
-      if (flags['when-composer-empty']) return withNode(async (rpc) => out(await rpc.call('panes.turn', { pane: sub, text: rest.join(' '), message_ids: flags['message-ids'] ? String(flags['message-ids']).split(',') : undefined, harness: typeof flags.harness === 'string' ? flags.harness : undefined, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-      return withNode(async (rpc) => out(await rpc.call('panes.input', { pane: sub, text: rest.join(' '), submit: !flags['no-enter'], message_ids: flags['message-ids'] ? String(flags['message-ids']).split(',') : undefined, ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-    case 'port': {
-      // `port <pane>/<n> [--listen host:port]`: a machine port forwarded here. Stays up until ctrl-c.
-      const spec = String(sub ?? '');
-      const slash = spec.lastIndexOf('/');
-      const pane = slash > 0 ? spec.slice(0, slash) : null;
-      const portNumber = Number(slash >= 0 ? spec.slice(slash + 1) : spec);
-      if (!Number.isInteger(portNumber)) die('port <pane>/<n> [--listen host:port]');
-      const channel = await machineChannel();
-      const fwd = await forwardPort(channel, { pane, port: portNumber, listen: parseHostPort(flags.listen) });
-      out({ local: fwd.address, remote: `${pane ?? '*'}/${portNumber}` });
-      const stop = async () => { await fwd.close(); channel.close(); process.exit(0); };
-      process.on('SIGINT', stop);
-      process.on('SIGTERM', stop);
-      // The machine's channel gone, no connection can ride it: the forward ends, saying so, for whatever keeps it to start
-      // it again (it stayed listening and refused every connection until one refusal crashed it).
-      channel.once('close', async () => { process.stderr.write("supercode teams port: the machine's channel closed\n"); await fwd.close(); process.exit(1); });
-      return;
-    }
-    case 'browser': {
-      // `browser <profile> [--listen host:port]`: a machine's browser profile as a local CDP
-      // endpoint (connectOverCDP to the printed address). Stays up until ctrl-c.
-      if (flags.list) {
-        const channel = await machineChannel();
-        try { out(await listBrowserProfiles(channel)); } finally { channel.close(); }
-        return;
-      }
-      if (!sub) die('browser <profile> [--listen host:port] [--machine NAME] | browser --list [--machine NAME]');
-      const attached = await attachBrowserProfile(() => machineChannel(), { profile: String(sub), listen: parseHostPort(flags.listen) });
-      out({ cdp: attached.address, target: `browser-profile:${sub}` });
-      const stop = async () => { await attached.close(); process.exit(0); };
-      process.on('SIGINT', stop);
-      process.on('SIGTERM', stop);
-      return;
-    }
-    case 'stream': {
-      // `stream exec|sftp [--machine NAME]`: this process's stdin and stdout carried to one of the
-      // machine's execution streams, the transport a pilot's exec client and SSHFS (passive) use.
-      if (sub !== 'exec' && sub !== 'sftp') die('stream exec|sftp [--machine NAME]');
-      const channel = await machineChannel();
-      let stream;
-      try { stream = await channel.open(sub, {}); } catch (error) { die(error.message, 1); }
-      stream.on('data', (chunk) => process.stdout.write(Buffer.from(chunk, 'base64')));
-      stream.on('close', () => { channel.close(); process.stdout.end(() => process.exit(0)); });
-      process.stdin.on('data', (bytes) => { if (!stream.closed) stream.write(bytes.toString('base64')); });
-      process.stdin.on('end', () => stream.close('input ended'));
-      return;
-    }
-    case 'mail': {
-      if (sub === 'migration-check') {
-        if (Object.keys(flags).some((flag) => !['home', 'json'].includes(flag)) || rest.length || flags.home === true) die('mail migration-check is a local read and takes only --home and --json');
-        const { inspectLegacyMaildir } = await import('../mail/migration-readiness.mjs');
-        const result = await inspectLegacyMaildir(join(dirname(resolve(home)), 'mail'));
-        out(result); process.exitCode = result.admitted ? 0 : 1; return;
-      }
-      // `mail --machine NAME`: one `supercode message` request (JSON on stdin) to that
-      // machine's mail door, and its answer (one JSON line) on stdout.
-      const chunks = [];
-      for await (const chunk of process.stdin) chunks.push(chunk);
-      let request;
-      try { request = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { die('mail reads one JSON request on stdin'); }
-      const channel = await machineChannel();
-      let stream;
-      // A typed line waits as long as the server retries it on a loaded machine (2 minutes), and a little longer.
-      const timeoutMs = request?.op === 'turn' ? 150_000 : undefined;
-      try { stream = await channel.open('mail', { request }, { timeoutMs }); } catch (error) { die(error.message, 1); }
-      let answered = false;
-      stream.on('data', (chunk) => { answered = true; process.stdout.write(`${chunk}\n`); });
-      stream.on('close', (reason) => {
-        channel.close();
-        if (!answered) process.stdout.write(`${JSON.stringify({ outcome: 'failed', detail: String(reason ?? 'the mail door closed without answering') })}\n`);
-        process.exit(0);
-      });
-      return;
-    }
-    case 'board': {
-      // `board`: one `supercode workflow` verb for a board, `{board, argv}` as JSON on stdin, to this machine's board door,
-      // which names the calling session and reaches the machine the board's address names. Never another machine's door
-      // directly: that machine cannot name the caller, so it refuses every verb. The answer, `{code, stdout, stderr}`, is
-      // one JSON line.
-      if (flags.machine) die('board takes no --machine: the board address names its machine, and this machine\'s door names you and reaches it');
-      const chunks = [];
-      for await (const chunk of process.stdin) chunks.push(chunk);
-      let request;
-      try { request = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { die('board reads one JSON request on stdin'); }
-      // the caller is this process's own claim, never one the request carries
-      request = { ...request, claim: ownClaim() };
-      const channel = await machineChannel();
-      let stream;
-      try { stream = await channel.open('board', { request }, { timeoutMs: 600_000 }); } catch (error) { die(error.message, 1); }
-      let answer = '';
-      stream.on('data', (chunk) => { answer += chunk; });
-      stream.on('close', (reason) => {
-        channel.close();
-        // Exit once the answer is written: a pipe takes 64 KiB at a time, and an exit before then drops the rest.
-        // the door accepted the verb, then closed with no answer: whether it ran is unknown (`unanswered`), never a plain failure
-        process.stdout.write(`${answer.trim() || JSON.stringify({ code: 1, stdout: '', stderr: String(reason ?? 'the board door closed without answering'), unanswered: true })}\n`, () => process.exit(0));
-      });
-      return;
-    }
-    case 'workspace': {
-      if (sub === 'list') return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.list', {})));
-      if (sub === 'register' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.register', { path: rest[0], repository: flags.repo ?? null })));
-      if (sub === 'unregister' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.unregister', { path: rest[0] })));
-      if (sub === 'resolve' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.resolve', { repository: rest[0], branch: flags.branch ?? null, solo: Boolean(flags.solo), card: flags.card ?? null, create: Boolean(flags.create) })));
-      if (sub === 'inspect' && rest[0]) return withNode(async (rpc) => out(await rpc.call('harness.v1.workspaces.inspect', { path: rest[0] })));
-      // `workspace move --from A --to B --path P [--to-path Q]`: the project leaves A and arrives
-      // at B, published there only if every byte arrived (sha256 on commit) and neither machine
-      // runs an exec job. A is left as it was; B's path must not exist.
-      if (sub !== 'move' || !flags.from || !flags.to || !flags.path) die('workspace list | register PATH [--repo R] | unregister PATH | resolve REPO | inspect PATH | move --from MACHINE --to MACHINE --path P [--to-path Q]');
-      try {
-        out(await moveWorkspace({ from: String(flags.from), to: String(flags.to), path: String(flags.path), toPath: String(flags['to-path'] ?? flags.path), context: flags.context ? String(flags.context) : null, home }));
-      } catch (error) { die(error.message, error.exitCode ?? 1); }
-      return;
-    }
-    case 'jobs':
-      // `jobs [--machine NAME]`: the execution jobs the machine's daemon owns now.
-      return withNode(async (rpc) => out(await rpc.call('jobs.list', {})));
-    case 'launches': {
-      if (sub === 'get' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.get', { key: rest[0] })));
-      if (sub === 'cancel' && rest[0]) return withNode(async (rpc) => out(await rpc.call('launches.cancel', { key: rest[0], ...(await acting()), ...(flags.foreign ? { foreign: true } : {}) })));
-      if (sub === 'list') return withNode(async (rpc) => out(await rpc.call('launches.list', {})));
-      die('launches get <key> | cancel <key> | list [--machine NAME]');
-      return;
-    }
-    case 'health': {
-      // This machine's vitals are read from the pack's own files, not through the daemon: the reading has to
-      // work when the daemon is what is sick. `--machine NAME` reads an enrolled machine through its doors.
-      const local = !flags.machine;
-      if (local || ['run', 'once', 'config'].includes(sub)) {
-        if (!local) die(`health ${sub} runs on the machine itself; read another machine with health status --machine NAME`);
-        const entry = await healthPackEntry();
-        if (!entry) die('the machine-health pack (@volter/supercode-health) is not installed; set SUPERCODE_HEALTH_ENTRY to its bin/health.mjs', 1);
-        const r = spawnSync(process.execPath, [entry, ...(sub ? [sub] : []), ...rest, ...(flags.json ? ['--json'] : []), ...(flags.all ? ['--all'] : [])], { stdio: 'inherit' });
-        process.exit(r.status ?? 1);
-      }
-      if (sub === 'subscribe' || sub === 'unsubscribe') {
-        if (!rest[0]) die(`health ${sub} <sc:machine:harness:id> --machine NAME`);
-        return withNode(async (rpc) => out(await rpc.call(`health.${sub}`, { address: rest[0] })));
-      }
-      if (sub && !['status', 'features', 'alarms'].includes(sub)) die('health [status|features|alarms] [--machine NAME] | health subscribe|unsubscribe <address> | health run|once|config');
-      return withNode(async (rpc) => {
-        const answer = await rpc.call('health.read', {});
-        const s = answer.snapshot;
-        const entry = await healthPackEntry();
-        const fmt = entry ? await import(new URL('../lib/format.mjs', pathToFileURL(entry)).href).catch(() => null) : null;
-        if (flags.json || !fmt) { out(sub === 'features' ? s?.features ?? null : sub === 'alarms' ? s?.alarms ?? null : answer); return; }
-        if (sub === 'features') { out(s ? fmt.formatFeatures(s.features) : 'no reading yet'); return; }
-        if (sub === 'alarms') { out(s?.alarms?.length ? s.alarms.map((a) => `${a.level.toUpperCase()} ${a.key}: ${a.summary} (since ${a.since})`).join('\n') : 'no alarms raised'); return; }
-        out(fmt.formatStatus(s, { all: Boolean(flags.all) }));
-        if (!answer.probe?.running) out(`probe: not run by that machine's daemon (${answer.probe?.reason ?? 'unknown'})`);
-      });
-    }
-    case 'records':
-      // this machine's record and the records its daemon holds of the machines it follows, each with how current it is
-      // (order 3 PR 3): what `message list`, `show` and the board read instead of asking those machines
-      return withNode(async (rpc) => out(await rpc.call('machine.records', {})));
-    case 'rpc': {
-      if (!sub) die('rpc <method> [JSON params] [--machine NAME]');
-      const method = sub.startsWith('harness.v1.') ? sub : `harness.v1.${sub}`;
-      const params = rest[0] ? JSON.parse(rest[0]) : {};
-      const channel = await machineChannel();
-      // Mail operations were ported to the node door. Keep their operator CLI
-      // on that door; native sessions.* requests retain the harness transport.
-      if (method.startsWith('harness.v1.mail.')) {
-        try { out(await (await nodeRpc(channel)).call(method, params)); }
-        finally { channel.close(); }
-        return;
-      }
-      const client = new SupercodeHarnessClient({ transport: harnessTransport(channel) });
-      try {
-        await client.start?.();
-        out(await client.request(method, params));
-      } finally {
-        await client.close?.();
-        channel.close();
-      }
-      return;
-    }
-    case 'app-door': {
-      // `app-door on [--origin O[,O…]] [--port N]`, `off`, `rotate`, `status`, `link <app url> [--open]`: the door
-      // web apps on this machine use, off until turned on (../app-door.mjs). This machine's own setting: no --machine.
-      if (flags.machine) die('app-door is set on the machine itself');
-      const origins = (value) => (value === undefined || value === true ? [] : String(value).split(',').map((item) => item.trim()).filter(Boolean));
-      const show = (setting) => {
-        const served = readAppDoorState(home);
-        out({
-          enabled: setting.enabled,
-          door: `ws://127.0.0.1:${setting.port}${APP_DOOR_PATH}`,
-          origins: setting.origins,
-          // What the daemon itself last said: listening on the port, or why not.
-          listening: served?.listening ?? null,
-          ...(served?.failure ? { failure: served.failure } : {}),
-          file: appDoorFile(home),
-        });
-      };
-      if (sub === 'on' || sub === 'off' || sub === 'rotate') {
-        const port = flags.port === undefined ? undefined : Number(flags.port);
-        if (port !== undefined && !(Number.isInteger(port) && port > 0 && port < 65536)) die('--port takes a port number');
-        const add = origins(flags.origin);
-        const remove = origins(flags['remove-origin']);
-        if (sub === 'on') {
-          const dropped = new Set(remove.map(normalOrigin));
-          const kept = readAppDoor(home).origins.filter((item) => !dropped.has(item));
-          if (!kept.length && !add.length) die('the app door admits only the origins it names: add one with --origin http://127.0.0.1:PORT');
-        }
-        const setting = writeAppDoor(home, { enabled: sub === 'rotate' ? undefined : sub === 'on', port, add, remove, rotate: sub === 'rotate' });
-        show(setting);
-        if (sub === 'rotate') out('a new token: every link handed out before no longer opens the door; open the app again with app-door link');
-        return;
-      }
-      if (sub === 'status' || sub === undefined) { show(readAppDoor(home)); return; }
-      if (sub === 'link') {
-        // `--open` takes no value; `link --open URL` reads the URL as one.
-        const target = rest[0] ?? (typeof flags.open === 'string' ? flags.open : null);
-        if (!target) die('app-door link <app url> [--open]');
-        const setting = readAppDoor(home);
-        if (!setting.enabled) die('the app door is off: app-door on --origin <the app\'s origin>');
-        const link = appDoorLink(setting, target);
-        if (flags.open) spawnSync(process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'explorer' : 'xdg-open', [link], { stdio: 'ignore', windowsHide: true });
-        out(link);
-        return;
-      }
-      die('app-door on [--origin ORIGIN[,ORIGIN]] [--remove-origin ORIGIN] [--port N] | app-door off | app-door rotate | app-door status | app-door link <app url> [--open]');
-      return;
-    }
-    case 'log': {
-      if (sub !== 'verify') die('log verify');
-      out(AccountLog.verify(p.log));
-      return;
-    }
-    default:
-      die(MACHINE_HELP);
+  if (release) {
+    const selected = [...args], nativeAt = selected.indexOf('--supercode');
+    if (nativeAt >= 0) selected[nativeAt + 1] = release.native;
+    const inlineNative = selected.findIndex(arg => arg.startsWith('--supercode='));
+    if (inlineNative >= 0) selected[inlineNative] = `--supercode=${release.native}`;
+    const child = spawn(process.execPath, [controller.supervised, ...selected], { stdio: 'inherit', windowsHide: true,
+      env: { ...process.env, SUPERCODE_BIN: release.native,
+        PATH: [join(release.root, 'bin'), process.env.PATH].filter(Boolean).join(delimiter) } });
+    for (const signal of ['SIGINT', 'SIGTERM', ...(process.platform === 'win32' ? ['SIGBREAK'] : [])]) process.once(signal, () => child.kill(signal));
+    const outcome = await new Promise(done => {
+      child.once('error', error => { process.stderr.write(`supercode: retained startup failed: ${error.message}\n`); done(1); });
+      child.once('exit', code => done(code ?? 1));
+    });
+    process.exitCode = outcome;
   }
-}
-
-if (!workspaceVerb) main().catch((error) => die(error.message ?? String(error), error.code === 'machine_offline' ? 5 : 1));
+} else await import('./teams-cli.mjs');