@volter/teams 0.2.58 → 0.2.60

package/board-process-guard.mjs

@@ -20,6 +20,7 @@ import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { resolve } from 'node:path';
+import { currentRelease } from './stable-release.mjs';
 export const processGuardReason = 'Pattern kills are refused for board sessions. Kill only the PID this session recorded when it started that process; use the owning service door for a service.';
 export const computedKillReason = `A kill names each process by the PID this session recorded when it started it, written out as a number. A PID taken from a variable, a loop or a command's output is a pattern kill: one over a match that came out empty ended every process of a machine's user. ${processGuardReason}`;
 export const foreignKillReason = (pid) => `PID ${pid} is not a process this session started: it is neither running under this session nor marked by it (its environment names no session of this one). Kill only what this session started, by the PID it recorded; a process another session or the person started is theirs to end, through its owning service door or by asking them.`;
@@ -192,12 +193,18 @@ export function killDecision(command, { table, session, sessionId, platform = pr
   return foreign.length ? { decision: 'deny', reason: foreign.map(foreignKillReason).join(' ') } : null;
 }
 const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
-export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath } = {}) {
+export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath, env = process.env } = {}) {
   if (!enabled) return args;
-  const command = `${quote(node)} ${quote(fileURLToPath(import.meta.url))}`;
+  // A session holds this command for as long as it runs, and the release that launched it is removed two installs
+  // later: the policy is named through the machine's stable launcher, which runs it out of the release installed when
+  // the hook fires (stable-release.mjs). Where the machine's stable supercode runs no front door (a checkout's home,
+  // which keeps no releases) there is no launcher, and this file is named.
+  const stable = currentRelease({ env, node });
+  const [program, ...leading] = stable ? [...stable, '@volter/teams/board-process-guard'] : [node, fileURLToPath(import.meta.url)];
+  const command = [program, ...leading].map(quote).join(' ');
   // Claude's exec form spawns the policy with no shell on every platform (Windows included, where its shell form
   // runs Git Bash or PowerShell and the POSIX quoting above would not parse); its PowerShell tool is guarded as Bash is.
-  const hooks = [{ matcher: '^(Bash|PowerShell)$', hooks: [{ type: 'command', command: node, args: [fileURLToPath(import.meta.url)], timeout: 10 }] }];
+  const hooks = [{ matcher: '^(Bash|PowerShell)$', hooks: [{ type: 'command', command: program, args: leading, timeout: 10 }] }];
   if (kind === 'claude-code') {
     const next = [...args], at = next.findIndex(arg => arg === '--settings' || arg.startsWith('--settings='));
     if (at < 0) return [...next, '--settings', JSON.stringify({ hooks: { PreToolUse: hooks } })];

package/home.mjs

@@ -231,6 +231,27 @@ export class Launches {
     }
     return [...last.values()].sort((a, b) => b.t - a.t);
   }
+  /** No launch rests at `issued` once its handler is gone (its daemon ended between that write and the next; `issuing`
+   *  holds the keys a live handler still has): with its pane live in `panes` it is ready, and `ready(launch, pane)` is
+   *  told; with its pane kept dead it ended as `exit(pane)` ({ failed, how }) says; with no pane it exited when its
+   *  input had been confirmed, and failed otherwise. Answers the records it wrote. */
+  settleIssued(panes, { issuing = new Set(), onlyKey = null, exit, ready = () => {} }) {
+    const restarted = 'the daemon restarted before this launch became ready';
+    const settled = [];
+    for (const launch of this.all()) {
+      if (launch.status !== 'issued' || (onlyKey && launch.key !== onlyKey) || issuing.has(launch.key)) continue;
+      const { t: _previousAt, ...facts } = launch;
+      const pane = panes.find((row) => row.contextKey === launch.pane) ?? null;
+      const ended = pane?.dead ? exit(pane) : null;
+      const entry = pane && !pane.dead ? { ...facts, status: 'ready' }
+        : ended?.failed === false ? { ...facts, status: 'finished', completion: ended }
+          : ended ? { ...facts, status: 'exited', error: `${restarted}; its pane ended with ${ended.how}` }
+            : { ...facts, status: launch.inputDelivered === true ? 'exited' : 'failed', error: `${restarted}; its pane is gone` };
+      if (entry.status === 'ready') ready(launch, pane);
+      this.record(entry); settled.push(entry);
+    }
+    return settled;
+  }
 }
 
 /** `host:port` or `[v6]:port` → { host, port }. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.58",
+  "version": "0.2.60",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -49,6 +49,7 @@
     "./machine-door": "./machine-door.mjs",
     "./sender-identity": "./sender-identity.mjs",
     "./board-process-guard": "./board-process-guard.mjs",
+    "./stable-release": "./stable-release.mjs",
     "./server/agent-authority": "./server/agent-authority.mjs",
     "./redact": {
       "default": "./redact.mjs"

package/release-launcher.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// The machine's current release, for a command recorded outside it. A session holds the hook commands it was launched
+// with for as long as it runs, and the release that launched it is removed two installs later: a command naming a file
+// inside that release fails from then on. This file is kept at `<SUPERCODE_HOME>/bin/supercode-release.mjs`
+// (stable-release.mjs), beside the machine's stable `supercode` shim, and names no release: it reads the shim each time
+// it runs, and runs out of the release the shim names then.
+//
+//   node supercode-release.mjs supercode <args…>         that release's front door (the shim itself, for a caller
+//                                                        that can start a program but not a `.cmd`)
+//   node supercode-release.mjs @volter/<module> <args…>  a module of that release, as if started by its own path
+//
+// With no release to run (no shim, a shim that runs no front door, a release without the module) it says so and exits 1.
+// A harness reads that from a hook as an error that blocks nothing, so the line says what did not happen: for the
+// board's process guard, that the command it was asked about runs unguarded.
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const shim = join(dirname(fileURLToPath(import.meta.url)), process.platform === 'win32' ? 'supercode.cmd' : 'supercode');
+
+/** The front door the shim runs (`exec '<node>' '<front door>' "$@"`, Windows `@"<node>" "<front door>" %*`), or null. */
+function frontDoor() {
+  let text;
+  try { text = readFileSync(shim, 'utf8'); } catch { return null; }
+  for (const line of text.split(/\r?\n/).map((row) => row.trimEnd())) {
+    const parts = line.startsWith("exec '") && line.endsWith("' \"$@\"")
+      ? line.slice(6, -6).replaceAll("'\\''", '\0').split("' '").map((part) => part.replaceAll('\0', "'"))
+      : line.startsWith('@"') && line.endsWith('" %*') ? line.slice(2, -4).split('" "') : null;
+    if (parts) return parts.length === 2 && /\.js$/i.test(parts[1]) && existsSync(parts[1]) ? parts[1] : null;
+  }
+  return null;
+}
+
+const [what, ...rest] = process.argv.slice(2);
+const front = frontDoor();
+let target = null;
+if (front && what === 'supercode') target = front;
+else if (front && /^@volter\//.test(what ?? '')) {
+  try { target = createRequire(front).resolve(what); } catch { /* not in that release */ }
+}
+if (!target) {
+  const why = front ? `the release at ${front} has no such module` : `${shim} names no installed release's front door`;
+  process.stderr.write(what === '@volter/teams/board-process-guard'
+    ? `supercode: the board process guard did NOT run, and this command is running unguarded: ${what} was not run: ${why}.\n`
+    : `supercode: ${what ?? 'nothing'} was not run: ${why}.\n`);
+  process.exit(1);
+}
+process.argv.splice(1, process.argv.length - 1, target, ...rest);
+await import(pathToFileURL(target).href);

package/stable-release.mjs

@@ -0,0 +1,54 @@
+// What a command recorded outside a release names so that it outlives the release: a session's hook commands, held in
+// its launch flags for as long as it runs. The machine's stable `supercode` (`<SUPERCODE_HOME>/bin/supercode`, a shim
+// claude_relay.rs ensure_stable_program points at the installed release at each install and daemon start) is such a
+// name, but a shell script: a hook's exec form cannot start its `.cmd` on Windows, and it runs only the front door.
+// The launcher kept beside it (release-launcher.mjs) is a file Node runs on every platform; it reads the shim when it
+// runs and so finds the release installed then.
+import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, rmSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { supercodeHome } from './home.mjs';
+
+const LAUNCHER = fileURLToPath(new URL('./release-launcher.mjs', import.meta.url));
+
+/** Whether the shim at `path` runs a front door that is there: the launcher runs out of that front door's release. */
+function runsFrontDoor(path) {
+  let text;
+  try { text = readFileSync(path, 'utf8'); } catch { return false; }
+  for (const line of text.split(/\r?\n/).map((row) => row.trimEnd())) {
+    const parts = line.startsWith("exec '") && line.endsWith("' \"$@\"")
+      ? line.slice(6, -6).replaceAll("'\\''", '\0').split("' '").map((part) => part.replaceAll('\0', "'"))
+      : line.startsWith('@"') && line.endsWith('" %*') ? line.slice(2, -4).split('" "') : null;
+    if (parts) return parts.length === 2 && /\.js$/i.test(parts[1]) && parts.every((part) => existsSync(part));
+  }
+  return false;
+}
+
+/**
+ * The start of a recorded command that runs the machine's current release: `[node, launcher]`, followed by `supercode`
+ * and a command line for its front door, or by a module of the release (`@volter/teams/board-process-guard`). The
+ * launcher is this release's copy, written whole when the one there differs. Null where the machine has no stable
+ * front door (a checkout's or a cargo install's home, which keeps no releases and removes none): the caller names its
+ * own file there.
+ */
+export function currentRelease({ env = process.env, node = process.execPath, platform = process.platform } = {}) {
+  const bin = join(supercodeHome(env), 'bin');
+  if (!runsFrontDoor(join(bin, platform === 'win32' ? 'supercode.cmd' : 'supercode'))) return null;
+  const stable = join(bin, 'supercode-release.mjs'), staged = `${stable}.${process.pid}.tmp`;
+  let current = null;
+  try { current = readFileSync(stable); } catch { /* not there yet */ }
+  try {
+    const launcher = readFileSync(LAUNCHER);
+    if (!current?.equals(launcher)) {
+      mkdirSync(dirname(stable), { recursive: true });
+      writeFileSync(staged, launcher, { mode: 0o755 });
+      renameSync(staged, stable);
+    }
+  } catch {
+    // the launcher already there is kept and named: another release's copy still finds the installed release, and a
+    // path into this one would not outlive it
+    rmSync(staged, { force: true });
+    if (!current) return null;
+  }
+  return [node, stable];
+}