@volter/teams 0.2.45 → 0.2.47

package/README.md

@@ -24,3 +24,10 @@ Public Node clients are `@volter/teams/http-client` (`TeamsClient`),
 `@volter/teams/event-client` (selected-context event client), and
 `@volter/teams/machine-door` (an admitted local/remote machine channel).
 Context credentials remain inside the custody adapter; consumers use its public client.
+
+The launch journal's `Launches.find()` and `all()` retain a previously recorded
+agent across older first-input outcomes that omitted it, only within the same
+pane, kind and caller. A new issue or an explicit agent replacement/clear ends
+that continuity. Latest outcome facts remain authoritative. The reader changes
+no file or credential; [manual SDK reading and deployment limits](../../docs/evidence/launch-agent-retention-2026-10-09.md)
+are recorded separately.

package/board-process-guard.mjs

@@ -10,13 +10,27 @@ export function patternKill(command) {
   const text = String(command).replace(/\\\r?\n/g, '').replace(/\\([a-zA-Z-])/g, '$1').replace(/["']/g, '');
   const head = String.raw`(?:^|[;|&(\n{}]|\s-[a-zA-Z]*c\s+)\s*(?:(?:env|sudo|exec|command|xargs|nohup|do|then|else|!)\s+(?:--?[^\s;|&()]+\s+)*|[A-Za-z_][A-Za-z0-9_]*=[^\s;|&()]+\s+)*(?:[\w./-]+/)?`;
   return new RegExp(head + String.raw`(?:pkill|killall)(?=$|[\s;|&()])`).test(text) ||
-    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text);
+    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text) ||
+    windowsPatternKill(text);
+}
+// Windows names a process by image, title or command line through its own tools (cmd, PowerShell, Git Bash's
+// `//IM`): each such kill is refused as pkill is. A kill by PID (`taskkill /PID`, `Stop-Process -Id`) stays allowed.
+function windowsPatternKill(text) {
+  return /\btaskkill(?:\.exe)?\b[^;|&\n]*\s(?:\/{1,2}|-)(?:im|fi)\b/i.test(text) ||
+    /(?:^|[^\w-])(?:Stop-Process|spps)\b[^;|\n]*\s-(?:N[a-z]*|ProcessName)\b/i.test(text) ||
+    // PowerShell's `kill` alias; Bash's own `kill -n <signal>` is not a name
+    /(?:^|[^\w-])kill\b[^;|\n]*\s-(?:Name|ProcessName)\b/i.test(text) ||
+    /\b(?:Get-Process|gps)\b(?![^|;\n]*\s-Id\b)[^|;\n]*\|\s*(?:Stop-Process|spps|kill)\b/i.test(text) ||
+    /\bwmic\b[^;|&\n]*\bprocess\b[^;|&\n]*\bwhere\b[^;|&\n]*\b(?:name|commandline|executablepath)\b/i.test(text) ||
+    /\bWin32_Process\b[^\n]*\b(?:Name|CommandLine|ExecutablePath)\b[^\n]*\b(?:Terminate|Remove-CimInstance|Remove-WmiObject|Stop-Process)\b/i.test(text);
 }
 const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
 export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath } = {}) {
   if (!enabled) return args;
   const command = `${quote(node)} ${quote(fileURLToPath(import.meta.url))}`;
-  const hooks = [{ matcher: '^Bash$', hooks: [{ type: 'command', command, timeout: 10 }] }];
+  // Claude's exec form spawns the policy with no shell on every platform (Windows included, where its shell form
+  // runs Git Bash or PowerShell and the POSIX quoting above would not parse); its PowerShell tool is guarded as Bash is.
+  const hooks = [{ matcher: '^(Bash|PowerShell)$', hooks: [{ type: 'command', command: node, args: [fileURLToPath(import.meta.url)], timeout: 10 }] }];
   if (kind === 'claude-code') {
     const next = [...args], at = next.findIndex(arg => arg === '--settings' || arg.startsWith('--settings='));
     if (at < 0) return [...next, '--settings', JSON.stringify({ hooks: { PreToolUse: hooks } })];
@@ -30,6 +44,7 @@ export function boardGuardArguments(kind, args, { cwd, enabled, node = process.e
     // Native Codex rules cannot split substitutions such as kill $(pgrep -f …).
     // Its synchronous Bash hook can deny the entire command before execution.
     // This invocation enables and trusts the board-vetted command policy.
+    if (process.platform === 'win32') throw new Error('board process guard is unavailable for codex on Windows; no unguarded session was launched');
     const handler = `{ matcher = "^Bash$", hooks = [{ type = "command", command = ${JSON.stringify(command)}, timeout = 10 }] }`;
     // Codex's own flags go before any subcommand (`app-server`, `resume`) or prompt: after `app-server`, Codex
     // 0.159 refuses --dangerously-bypass-hook-trust and the worker never starts.

package/home.mjs

@@ -191,25 +191,42 @@ export class AccountLog {
   }
 }
 
-/** launches.jsonl: appended before a launch is issued; the last record per key wins. */
+/** Older first-input receipts omitted the launch's agent. Recover only that
+ * recorded identity, across the same pane/kind/caller, never across a new issue
+ * or an explicit replacement/clear. All other facts remain the latest record's. */
+function launchWithRecordedAgent(previous, entry) {
+  if (previous?.agent && !Object.hasOwn(entry, 'agent') && Object.hasOwn(entry, 'inputDelivered')
+      && entry.status !== 'issued' && entry.pane && entry.pane === previous.pane
+      && entry.kind === previous.kind && entry.by === previous.by) {
+    return { ...entry, agent: previous.agent };
+  }
+  return entry;
+}
+
+/** launches.jsonl: appended before a launch is issued; latest facts per key,
+ * with the recorded agent retained across old first-input receipts. */
 export class Launches {
   constructor(path) { this.path = path; }
   record(entry) { appendFileSync(this.path, JSON.stringify({ t: Date.now(), ...entry }) + '\n', { mode: 0o600 }); }
   find(key) {
     if (!existsSync(this.path)) return null;
     const lines = readFileSync(this.path, 'utf8').trimEnd().split('\n').filter(Boolean);
-    for (let i = lines.length - 1; i >= 0; i -= 1) {
-      const entry = JSON.parse(lines[i]);
-      if (entry.key === key) return entry;
+    let found = null;
+    for (const line of lines) {
+      const entry = JSON.parse(line);
+      if (entry.key === key) found = launchWithRecordedAgent(found, entry);
     }
-    return null;
+    return found;
   }
   /** Every key's last record, newest first: what this node has launched for its callers. */
   all() {
     if (!existsSync(this.path)) return [];
     const lines = readFileSync(this.path, 'utf8').trimEnd().split('\n').filter(Boolean);
     const last = new Map();
-    for (const line of lines) { const entry = JSON.parse(line); last.set(entry.key, entry); }
+    for (const line of lines) {
+      const entry = JSON.parse(line);
+      last.set(entry.key, launchWithRecordedAgent(last.get(entry.key), entry));
+    }
     return [...last.values()].sort((a, b) => b.t - a.t);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.45",
+  "version": "0.2.47",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",