@volter/supercode-teams 0.3.7 → 0.3.9

package/bin/teams.mjs

@@ -29,7 +29,7 @@
 // Every other verb (server, login, context, connect, disconnect, status,
 // members, groups, sources, sync, machines, sessions) is the Teams workspace
 // CLI in ./workspace.mjs.
-import { createWriteStream, readFileSync, writeFileSync } from 'node:fs';
+import { appendFileSync, createWriteStream, readFileSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
@@ -172,7 +172,9 @@ async function main() {
         return;
       }
       if (sub === 'status') { out(readJson(p.machine, { running: false })); return; }
-      die('machine start|status');
+      // `machine restart [--machine M] [--reason text]`: the daemon (this one, or M's through the server) restarts under its service.
+      if (sub === 'restart') return withNode(async (rpc) => out(await rpc.call('machine.restart', { reason: flags.reason ? String(flags.reason) : null })));
+      die('machine start|status|restart');
     }
     case 'describe':
       return withNode(async (rpc) => out(await rpc.call('describe')));
@@ -212,9 +214,17 @@ async function main() {
       if (sub === 'stat') return withNode(async (rpc) => out(await rpc.call('files.stat', { path })));
       if (sub === 'search') return withNode(async (rpc) => out(await rpc.call('files.search', { path, query: flags.query ?? '' })));
       if (sub === 'get') return withNode(async (rpc) => {
-        const result = await rpc.call('files.read', { path });
-        const bytes = Buffer.from(result.bytes, 'base64');
-        if (flags.out) writeFileSync(flags.out, bytes); else process.stdout.write(bytes);
+        // In ranges: one answer is one frame, so a file of any size is read 4 MiB at a time until it ends.
+        const { size } = await rpc.call('files.stat', { path });
+        const CHUNK = 4 * 1024 * 1024;
+        if (flags.out) writeFileSync(flags.out, Buffer.alloc(0));
+        for (let offset = 0; offset < size;) {
+          const result = await rpc.call('files.read', { path, offset, length: Math.min(CHUNK, size - offset) });
+          const bytes = Buffer.from(result.bytes, 'base64');
+          if (!bytes.length) break;
+          if (flags.out) appendFileSync(flags.out, bytes); else await new Promise((done) => process.stdout.write(bytes, done));
+          offset += bytes.length;
+        }
       });
       if (sub === 'put') return withNode(async (rpc) => {
         const bytes = flags.in ? readFileSync(flags.in) : readFileSync(0);

package/bin/workspace.mjs

@@ -1096,6 +1096,12 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     // unreachable with no remote way back (the Mac mini sat unlinked for hours while its connector lived on): a
     // daemon that died, a start that half failed or a link its backoff never recovered all end in a fresh start.
     // It exits non-zero, which every service manager here restarts.
+    // A service-run connector restarts on request through the machine's door: it exits non-zero, which every service
+    // manager here restarts (the Windows task's minute trigger starts it whatever the exit).
+    if (saved.service) machine.restartHandler = (reason) => {
+      process.stderr.write(`supercode teams: restart requested through the machine door${reason ? ` (${reason})` : ''}\n`);
+      void (async () => { await stopConnector?.(); process.exit(75); })();
+    };
     if (saved.service) {
       const linkWatch = setInterval(() => {
         if (linkReplaced || linkDownSince === null || Date.now() - linkDownSince < LINK_LOST_MS) return;

package/execution.mjs

@@ -8,7 +8,7 @@
 // so. A job ends when its stream closes, when the daemon stops, and, if the daemon died, when
 // the next daemon reaps the record it left.
 import { spawn } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
+import { accessSync, constants, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
 import { delimiter, join } from 'node:path';
 import { EXECUTION_DOORS, executionDoorFor } from '@volter/supercode-harness-sdk/execution-doors';
 import { fileURLToPath } from 'node:url';
@@ -36,9 +36,21 @@ export function sftpServer() {
   return SFTP_SERVERS.find((path) => existsSync(path)) ?? null;
 }
 
-/** `program` as this daemon's PATH finds it, or null. */
+/** `program` as this daemon's own spawn (no shell) can run it from PATH, or null: an executable file, which on
+ *  Windows is a `.exe` or `.com` (an npm `.cmd` shim or an extensionless sh script there does not start). */
 function onPath(program, env) {
-  for (const dir of (env.PATH ?? '').split(delimiter)) if (dir && existsSync(join(dir, program))) return join(dir, program);
+  const names = process.platform === 'win32' ? [`${program}.exe`, `${program}.com`] : [program];
+  for (const dir of (env.PATH ?? env.Path ?? '').split(delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      const candidate = join(dir, name);
+      try {
+        if (!statSync(candidate).isFile()) continue;
+        if (process.platform !== 'win32') accessSync(candidate, constants.X_OK);
+        return candidate;
+      } catch { /* not here, or not runnable */ }
+    }
+  }
   return null;
 }
 

package/machine-events.mjs

@@ -35,13 +35,17 @@ export class MachineEvents {
         if(!response.ok||!response.headers.get('content-type')?.includes('text/event-stream'))throw new Error(`machine events returned HTTP ${response.status}, expected event stream`);
         const reader=response.body.getReader();const decoder=new TextDecoder();let buffer='';
         try{for(;;){const {value,done}=await reader.read();if(done)break;clearTimeout(deadline);deadline=setTimeout(()=>streamAbort.abort(new Error('machine event stream timed out')),45000);buffer+=decoder.decode(value,{stream:true});if(buffer.length>2*1024*1024)throw new Error('machine event exceeded stream bound');let boundary;while((boundary=buffer.indexOf('\n\n'))>=0){const frame=buffer.slice(0,boundary);buffer=buffer.slice(boundary+2);const data=frame.split('\n').filter(line=>line.startsWith('data:')).map(line=>line.slice(5).trimStart()).join('\n');if(data)await this.receive(JSON.parse(data));}}}finally{await reader.cancel().catch(()=>{});}
-      }catch(error){if(!this.abort.signal.aborted){if(this.error!==error.message)process.stderr.write(`supercode teams machine events: ${error.message}\n`);this.error=error.message;}}
+      }catch(error){if(!this.abort.signal.aborted){this.failingSince??=Date.now();if(this.error!==error.message)process.stderr.write(`${new Date().toISOString()} supercode teams machine events: ${error.message} (cursor ${this.state.cursor})\n`);this.error=error.message;}}
       clearTimeout(deadline);this.connected=false;
       if(!this.abort.signal.aborted)await new Promise(resolve=>{const done=()=>{clearTimeout(timer);this.abort.signal.removeEventListener('abort',done);resolve();};const timer=setTimeout(done,5000);this.abort.signal.addEventListener('abort',done,{once:true});});
     }
   }
   async receive(event){
-    if(event.type==='machine_ready'){this.connected=true;this.error=null;return;}
+    if(event.type==='machine_ready'){
+      // A stream back after a failure says so, with how long it was down: a notice that arrives late is then traceable.
+      if(this.failingSince)process.stderr.write(`${new Date().toISOString()} supercode teams machine events: stream back at cursor ${event.cursor} after ${Math.round((Date.now()-this.failingSince)/1000)} s of: ${this.error}\n`);
+      this.connected=true;this.error=null;this.failingSince=null;return;
+    }
     if(event.type==='access_revoked')throw new Error('machine event subscription authorization revoked');
     if(!['machine_snapshot','machine_linked','machine_unlinked'].includes(event.type))return;
     if(!/^\d+$/.test(event.cursor??''))throw new Error('invalid machine event cursor');
@@ -74,6 +78,6 @@ export class MachineEvents {
     child.stdout.on('data',chunk=>{detail=(detail+chunk).slice(-1000);});child.stderr.on('data',chunk=>{detail=(detail+chunk).slice(-1000);});
     child.once('error',error=>{clearTimeout(timer);reject(error);});child.once('close',code=>{clearTimeout(timer);let receipt;try{receipt=JSON.parse(detail.trim().split('\n').at(-1));}catch{}code===0&&receipt?.code===0?resolve():reject(new Error(receipt?.text||detail||`exit ${code}`));});
     child.stdin.on('error',()=>{});
-    child.stdin.end(JSON.stringify({op:'send',from:`sc:${this.machine}:operator:teams-events`,from_name:'Teams machine events',to:item.to,id:item.id,queue:item.to.split(':')[2]==='board',body:item.to.split(':')[2]==='board'?JSON.stringify({machine_event:item.event,text:item.body}):item.body}));
+    child.stdin.end(JSON.stringify({op:'send',from:`sc:${this.machine}:operator:teams-events`,from_name:'Teams machine events',to:item.to,id:item.id,queue:item.to.split(':')[2]==='board',notice:true,body:item.body}));
   });}
 }

package/machine.mjs

@@ -30,7 +30,7 @@ import { EventEmitter } from 'node:events';
 import { appendFileSync, readFileSync, writeFileSync, writeSync, statSync, readdirSync, mkdirSync, renameSync, rmSync, existsSync, openSync, readSync, closeSync, accessSync, constants } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { boardGuardArguments } from './board-process-guard.mjs';
+import { boardGuardArguments } from '@volter/teams/board-process-guard';
 import { homedir, hostname } from 'node:os';
 import { Workspaces, inspectCheckout } from './workspaces.mjs';
 import { WorkspaceContexts, fromContext } from '@volter/teams/context';
@@ -197,6 +197,8 @@ export class TeamsMachine extends MachineCore {
     this.onTurn = onTurn;
     this.onTurnWithdrawn = onTurnWithdrawn;
     this.tmuxSocket = tmuxSocket ?? null;
+    // Set by a service-run connector: how `machine.restart` ends this daemon so its service manager starts it again.
+    this.restartHandler = null;
     this.launches = new Launches(this.p.launches);
     // Windows has no tmux: its panes live in the machine's pane server, a process of their own that outlives this
     // daemon (a restart or an upgrade never ends a pane), as tmux panes live in tmux's server.
@@ -1215,6 +1217,7 @@ export class TeamsMachine extends MachineCore {
       execution: executionCapabilities(this.env),
       boardProcessPolicy: process.platform === 'win32' ? null : { version: 1, harnesses: ['claude-code','codex'], boundary: 'native-PreToolUse' },
       runSpec: this.env.SUPERCODE_TEAMS_RUN_SPEC_SHA256 ?? null,
+      restart: Boolean(this.restartHandler),
       at: Date.now(),
     };
     return { ...body, signature: signBytes(this.identity.privateKeyPem, Buffer.from(canonical(body))) };
@@ -1695,6 +1698,17 @@ export class TeamsMachine extends MachineCore {
       case 'harness.v1.machine.describe':
       case 'describe':
         return this.describe();
+      case 'harness.v1.machine.restart':
+      case 'machine.restart': {
+        // A stale daemon (old code, a module it failed to load) is restarted from any machine its operator reaches,
+        // never needing a person at it. Only a daemon its service manager brings back may go: one run by hand would not return.
+        if (!operator) { this.log.append({ principal, cap: method, target: '*', outcome: 'refused' }); throw Object.assign(new Error('only an operator restarts the machine daemon'), { code: 403 }); }
+        if (!this.restartHandler) throw Object.assign(new Error('this daemon runs without a service manager, so nothing would start it again; restart it where it runs'), { code: 'unsupported' });
+        act(method, '*', 'ok', params.reason ? String(params.reason).slice(0, 200) : null);
+        // The answer goes out first; the service manager starts the next daemon.
+        setTimeout(() => this.restartHandler(params.reason ? String(params.reason) : null), 500).unref?.();
+        return { restarting: true, pid: process.pid };
+      }
       case 'panes.present': {
         // No harness callback: discovery may be the harness's own caller.
         const whole = operator || holds(admitted, 'view', '*');
@@ -2292,8 +2306,8 @@ async function filesOp(method, params, to) {
     case 'files.read': {
       const fd = openSync(path, 'r');
       try {
-        // One read is at most 8 MiB (RH2's transfer chunks at 8 MiB); a caller asks again for more.
-        const length = Math.min(Number(params.length) || statSync(path).size, 8 * 1024 * 1024);
+        // One read is at most 4 MiB, so its base64 answer fits the channel's 8 MiB frame; a caller asks again for more.
+        const length = Math.min(Number(params.length) || statSync(path).size, 4 * 1024 * 1024);
         const buffer = Buffer.alloc(length);
         const read = readSync(fd, buffer, 0, length, params.offset ?? 0);
         return { bytes: buffer.subarray(0, read).toString('base64'), read };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -13,7 +13,6 @@
     "./event-client": "./event-client.mjs",
     "./bin": "./bin/teams.mjs",
     "./fleet": "./fleet.mjs",
-    "./board-process-guard": "./board-process-guard.mjs",
     "./bin/fleet": "./bin/fleet.mjs",
     "./server": {
       "types": "./server/index.d.ts",
@@ -67,7 +66,7 @@
     "@volter/supercode-health": "^0.1.0",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/supercode-trace": "^0.1.0",
-    "@volter/teams": "0.2.4",
+    "@volter/teams": "0.2.6",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",

package/server/node-upgrade.mjs

@@ -22,11 +22,14 @@ export function createMachineUpgradeHandler(api, { authenticate }) {
     socket.end(`HTTP/1.1 ${status} ${code}\r\nContent-Type: application/json\r\nContent-Length: ${Buffer.byteLength(body)}\r\nConnection: close\r\n\r\n${body}`);
   };
   const handler = async (req, socket, head) => {
+    // A caller that drops its connection mid-handshake (or later) ends only its own socket: an unheard socket error
+    // would end the whole server (measured: a client's ECONNRESET during authorization stopped the Node host).
+    socket.on('error', () => socket.destroy());
     try {
       const decision = await authorizeMachineUpgrade(api, { authenticate, url: req.url, headers: req.headers });
       if (decision.status) return refuse(socket, decision.status, decision.code, decision.message);
       return wss.handleUpgrade(req, socket, head, (ws) => {
-        ws.alive = true; ws.on('pong', () => { ws.alive = true; });
+        ws.alive = true; ws.on('pong', () => { ws.alive = true; }); ws.on('error', () => ws.terminate());
         void acceptMachineSocket(api, decision, createWebSocketStream(ws), (reason) => ws.close(1000, String(reason ?? 'closed').slice(0, 100)));
       });
     } catch (error) {

package/workspaces.mjs

@@ -20,7 +20,9 @@ export function repositoryId(value) {
 export function inspectCheckout(path) {
   const raw = git(path, ['rev-parse', '--path-format=absolute', '--show-toplevel', '--git-dir', '--git-common-dir']);
   const [root, dir, common] = raw.split('\n').map(p => realpathSync(resolve(path, p)));
-  const remote = git(root, ['remote', 'get-url', 'origin'], true);
+  // The repository the checkout declares (remote.origin.url), not where a URL rewrite (insteadOf: a mirror, a proxy, a
+  // World's twin) sends its transport.
+  const remote = git(root, ['config', '--get', 'remote.origin.url'], true);
   return { path: realpathSync(path), root, linked: dir !== common, repository: remote ? repositoryId(remote) : null, branch: git(root, ['branch', '--show-current']) || null };
 }
 export class Workspaces {

package/board-process-guard.mjs

@@ -1,52 +0,0 @@
-#!/usr/bin/env node
-// The board's native PreToolUse command policy. No process lookup or signal occurs here.
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { resolve } from 'node:path';
-export const processGuardReason = 'Pattern kills are refused for board sessions. Kill only the PID this session recorded when it started that process; use the owning service door for a service.';
-export function patternKill(command) {
-  // Inspect shell bodies as well as nested `sh -c` / substitutions. Removing shell
-  // escapes and quotes catches split words, paths and quoted embedded commands.
-  const text = String(command).replace(/\\\r?\n/g, '').replace(/\\([a-zA-Z-])/g, '$1').replace(/["']/g, '');
-  const head = String.raw`(?:^|[;|&(\n{}]|\s-[a-zA-Z]*c\s+)\s*(?:(?:env|sudo|exec|command|xargs|nohup|do|then|else|!)\s+(?:--?[^\s;|&()]+\s+)*|[A-Za-z_][A-Za-z0-9_]*=[^\s;|&()]+\s+)*(?:[\w./-]+/)?`;
-  return new RegExp(head + String.raw`(?:pkill|killall)(?=$|[\s;|&()])`).test(text) ||
-    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text);
-}
-const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
-export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath } = {}) {
-  if (!enabled) return args;
-  const command = `${quote(node)} ${quote(fileURLToPath(import.meta.url))}`;
-  const hooks = [{ matcher: '^Bash$', hooks: [{ type: 'command', command, timeout: 10 }] }];
-  if (kind === 'claude-code') {
-    const next = [...args], at = next.findIndex(arg => arg === '--settings' || arg.startsWith('--settings='));
-    if (at < 0) return [...next, '--settings', JSON.stringify({ hooks: { PreToolUse: hooks } })];
-    const inline = next[at].startsWith('--settings='), value = inline ? next[at].slice(11) : next[at + 1];
-    const settings = JSON.parse(value?.trimStart().startsWith('{') ? value : readFileSync(resolve(cwd || process.cwd(), value), 'utf8'));
-    settings.hooks ??= {}; settings.hooks.PreToolUse = [...(settings.hooks.PreToolUse ?? []), ...hooks];
-    next.splice(at, inline ? 1 : 2, '--settings', JSON.stringify(settings));
-    return next;
-  }
-  if (kind === 'codex') {
-    // Native Codex rules cannot split substitutions such as kill $(pgrep -f …).
-    // Its synchronous Bash hook can deny the entire command before execution.
-    // This invocation enables and trusts the board-vetted command policy.
-    const handler = `{ matcher = "^Bash$", hooks = [{ type = "command", command = ${JSON.stringify(command)}, timeout = 10 }] }`;
-    // Codex's own flags go before any subcommand (`app-server`, `resume`) or prompt: after `app-server`, Codex
-    // 0.159 refuses --dangerously-bypass-hook-trust and the worker never starts.
-    return [...(args.includes('--dangerously-bypass-hook-trust') ? [] : ['--dangerously-bypass-hook-trust']), '-c', 'features.hooks=true', '-c', `hooks.PreToolUse=[${handler}]`, ...args];
-  }
-  throw new Error(`board process guard is unavailable for ${kind}; no unguarded session was launched`);
-}
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    const input = JSON.parse(readFileSync(0, 'utf8'));
-    const command = input.tool_input?.command ?? input.tool_input?.cmd;
-    if (typeof command !== 'string') throw new Error('Bash hook input has no command');
-    if (patternKill(command)) process.stdout.write(JSON.stringify({ hookSpecificOutput: {
-      hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: processGuardReason,
-    } }) + '\n');
-  } catch (error) {
-    process.stderr.write(`Board process policy could not read the command: ${error.message}. ${processGuardReason}\n`);
-    process.exitCode = 2;
-  }
-}