ac-teams 0.0.6 → 0.0.8

package/src/mains.ts

@@ -0,0 +1,41 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const exec = promisify(execFile);
+/** Pi custom entry in a main session's transcript: which team it belongs to. Holds no secrets. */
+export const teamEntryType = "ac-teams-team";
+export interface TeamEntry { team: string; member: string; left?: boolean }
+export const handoverPrompt = "Your process was restarted during a coordinator handover. Check your last steps and continue your current task.";
+
+/** A main session's environment: no member identity, member role, or member Herdr opt-out. */
+export function mainEnv(env: NodeJS.ProcessEnv = process.env): Record<string, string> {
+  const clean: Record<string, string> = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value === undefined || key === "ACSTACK_AGENT_ROLE" || key.startsWith("AC_TEAMS_") || (key === "HERDR_ENV" && value === "0") || key === "TMUX" || key === "TMUX_PANE") continue;
+    clean[key] = value;
+  }
+  return clean;
+}
+
+export interface MainLaunch { id: string; name: string; cwd: string; command: string[]; env: Record<string, string>; socket: string }
+/**
+ * Opens a main session where the user can switch to it: its own Herdr tab in the workspace for its worktree, or else a
+ * tmux session on a socket of its own, so the coordinator owner's tmux kill-server cannot reach it. Returns a user notice.
+ */
+export async function launchMain(spec: MainLaunch): Promise<string> {
+  if (spec.env.HERDR_ENV === "1") {
+    const herdr = async (...args: string[]) => JSON.parse((await exec("herdr", args, { env: spec.env, timeout: 10000, maxBuffer: 4 * 1024 * 1024 })).stdout);
+    const workspaces = (await herdr("workspace", "list")).result?.workspaces as { workspace_id: string; worktree?: { checkout_path?: string } }[] | undefined;
+    const workspace = workspaces?.find(entry => entry.worktree?.checkout_path === spec.cwd);
+    const created = workspace
+      ? await herdr("tab", "create", "--workspace", workspace.workspace_id, "--cwd", spec.cwd, "--label", spec.name, "--focus")
+      : await herdr("workspace", "create", "--cwd", spec.cwd, "--label", spec.name, "--focus");
+    const pane = created.result?.root_pane?.pane_id;
+    if (typeof pane !== "string") throw new Error("Herdr did not report the new tab's pane");
+    // Herdr types the command into the pane's shell, so each word is quoted for it.
+    await exec("herdr", ["pane", "run", pane, spec.command.map(word => `'${word.replaceAll("'", "'\\''")}'`).join(" ")], { env: spec.env, timeout: 10000 });
+    return `${spec.name} opened in its own Herdr tab`;
+  }
+  await exec("tmux", ["-S", spec.socket, "new-session", "-d", "-s", spec.id, "-c", spec.cwd, "--", ...spec.command], { env: spec.env, timeout: 10000 });
+  return `${spec.name} runs in tmux; attach with: tmux -S ${spec.socket} attach -t ${spec.id}`;
+}

package/src/panel.ts

@@ -93,7 +93,9 @@ export async function showTeamsPanel(ctx: ExtensionContext, host: PanelHost): Pr
       try {
         const member = snapshot.members.find(member => member.id === id);
         if (member && ["stopped", "interrupted"].includes(member.status)) await host.resume(id);
-        done(id);
+        // Main sessions run in their own terminals; resuming one opens it there.
+        if (member?.role === "main" && id !== host.self) receipt = `${name(id)} runs in its own terminal`;
+        else done(id);
       } catch (error) { receipt = `Could not open ${name(id)}: ${clean(String(error))}`; }
       finally { opening = false; refresh(); }
     }
@@ -237,6 +239,7 @@ export async function showTeamsPanel(ctx: ExtensionContext, host: PanelHost): Pr
         heading("Message with full context"), "Open the native Pi session to read its conversation and type your message there.", "",
         fg("accent", member && ["stopped", "interrupted"].includes(member.status) ? "Enter  Resume and open" : "Enter  Open full session"),
         fg("muted", "No separate message composer."),
+        ...(!host.child && member?.role === "member" ? ["", fg("accent", "P  Promote to main session"), fg("muted", "Stops it and reopens its transcript as a main session in its own terminal.")] : []),
       ], width);
     }
 
@@ -294,6 +297,11 @@ export async function showTeamsPanel(ctx: ExtensionContext, host: PanelHost): Pr
         } else if (data.toLowerCase() === "g" && tab === 0 && !detail) { graph = !graph; scroll = 0; }
         else if (data.toLowerCase() === "n") begin("new");
         else if (data.toLowerCase() === "c" && tab === 0) begin("feedback");
+        else if (data.toLowerCase() === "p" && tab === 1 && !host.child) {
+          const id = memberIds()[memberIndex];
+          if (snapshot.members.find(member => member.id === id)?.role !== "member") receipt = "Only a member can be promoted.";
+          else { done(undefined); void host.promote(id).catch(error => ctx.ui.notify(`Promotion failed: ${clean(String(error))}`, "error")); return; }
+        }
         else if (matchesKey(data, "enter") || data.toLowerCase() === "o") {
           if (tab === 1 || data.toLowerCase() === "o") {
             const id = tab === 1 ? memberIds()[memberIndex] : tab === 0 ? selectedTask()?.owner : events[eventIndex]?.from;

package/src/sandbox-bridge.mjs

@@ -0,0 +1,33 @@
+// Trusted bootstrap inside a member container. It exposes the parent's egress proxy on loopback, then waits for the
+// parent to verify the container's mounts before running any member code (Pi, extensions, project files).
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { request } from "node:http";
+import { connect, createServer } from "node:net";
+import { constants } from "node:os";
+
+const launch = JSON.parse(readFileSync(process.argv[2], "utf8"));
+const fail = message => { console.error(`ac-teams sandbox bridge: ${message}`); process.exit(1); };
+const server = createServer(client => {
+  const upstream = connect(launch.socket);
+  client.pipe(upstream).pipe(client);
+  client.on("error", () => upstream.destroy());
+  upstream.on("error", () => client.destroy());
+});
+server.on("error", error => fail(error.message));
+server.listen(launch.port, "127.0.0.1", () => {
+  const gate = request({ socketPath: launch.socket, path: "http://ac-teams.invalid/start", method: "GET" }, response => {
+    let body = "";
+    response.on("data", chunk => { body += chunk; });
+    response.on("end", () => {
+      if (response.statusCode !== 200 || body !== "go") fail("the parent did not release this member");
+      const child = spawn(launch.command, launch.args, { env: launch.env, stdio: "inherit" });
+      for (const signal of ["SIGTERM", "SIGHUP"]) process.on(signal, () => child.kill(signal));
+      process.on("SIGINT", () => {}); // The terminal already delivers Ctrl+C to Pi's process group.
+      child.on("error", error => fail(error.message));
+      child.on("exit", (code, signal) => process.exit(code ?? (signal ? 128 + (constants.signals[signal] ?? 0) : 1)));
+    });
+  });
+  gate.on("error", error => fail(error.message));
+  gate.end();
+});

package/src/sandbox.Dockerfile

@@ -0,0 +1,8 @@
+# Image for enforced ac-teams members. Host code, grants, and Pi packages are mounted at run time.
+FROM node:22-bookworm-slim@sha256:4b150b48b4116e2a22f2c39cc27025fbf4f153e2078fd3b14d159fdb5c7279da
+ARG PI_VERSION
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends bash ca-certificates curl git ripgrep \
+  && rm -rf /var/lib/apt/lists/* \
+  && npm install -g --ignore-scripts "@earendil-works/pi-coding-agent@${PI_VERSION}" \
+  && npm cache clean --force

package/src/schemas.ts

@@ -13,6 +13,13 @@ export const AgentSchema = Type.Object({
   worktree: Type.Optional(Type.Boolean()), base: Type.Optional(id), target: Type.Optional(id),
   limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 100 })),
   depth: Type.Optional(Type.Integer({ minimum: 0, maximum: 10 })),
+  access: Type.Optional(Type.Object({
+    read: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 4096 }), { maxItems: 32 })),
+    write: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 4096 }), { maxItems: 32 })),
+    network: Type.Optional(Type.Object({
+      allow: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 260 }), { maxItems: 64, description: "Hosts the member may reach through its proxy: host or *.host (subdomains), optionally :port; without a port, 80 and 443. [] allows only the model provider. Omit allow for any public destination." })),
+    }, { additionalProperties: false, description: "Omit to keep the requester's network access. Children can only narrow it. The model provider stays reachable." })),
+  }, { additionalProperties: false, description: "Launch only: OS-enforced directory access (Docker container). Paths are absolute or cwd-relative directories; write implies read and permits changing those live files; everything else on the host is hidden, and outbound access goes through a proxy that reaches only public addresses. Omit to inherit the requesting member's access; an unsandboxed requester then launches an unsandboxed member. Children can only narrow access. Launch fails if enforcement is unavailable; check team_agent list/limits sandbox first." })),
 }, { additionalProperties: false });
 export const TaskSchema = Type.Object({
   revision: Type.Optional(Type.Integer({ minimum: 1 })), acceptance: Type.Optional(Type.Boolean()),
@@ -30,8 +37,8 @@ export const MessageSchema = Type.Object({
   after: Type.Optional(Type.Integer({ minimum: 0 })), limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 100 })),
 }, { additionalProperties: false });
 const UserActionSchema = Type.Object({
-  action: Type.Union([Type.Literal("task_request"), Type.Literal("feedback"), Type.Literal("resume")]),
-  id: Type.Optional(id), text: Type.Optional(text),
+  action: Type.Union([Type.Literal("task_request"), Type.Literal("feedback"), Type.Literal("resume"), Type.Literal("promote"), Type.Literal("leave")]),
+  id: Type.Optional(id), text: Type.Optional(text), confirmed: Type.Optional(Type.Boolean()),
   model: Type.Optional(Type.String({ minLength: 1, maxLength: 256 })),
   thinking: AgentSchema.properties.thinking,
 }, { additionalProperties: false });
@@ -56,5 +63,6 @@ export function validate(operation: string, value: unknown): void {
     const args = value as { action: string; name?: string };
     if (args.action === "launch" && !args.name) throw new Error("A descriptive teammate name is required on launch");
     if (args.action !== "launch" && args.name !== undefined) throw new Error("A teammate name can only be set on launch");
+    if (args.action !== "launch" && (value as { access?: unknown }).access !== undefined) throw new Error("Access can only be set on launch; resume keeps the member's access");
   }
 }

package/src/store.ts

@@ -1,9 +1,10 @@
 import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
+import { stateRoot } from "./config.ts";
+import { validatePolicy } from "./egress.ts";
 import { stripVTControlCharacters } from "node:util";
-import { isDescendant, isLive, memberNamePattern, memberNameMaxLength, taskLabelMaxLength, taskLabelPattern } from "./types.ts";
+import { isDescendant, isLive, isMain, memberNamePattern, memberNameMaxLength, taskLabelMaxLength, taskLabelPattern } from "./types.ts";
 import type { TeamState, TaskArgs, MessageArgs, Task, TaskView, Message, Worktree } from "./types.ts";
 
 // UI envelopes add task context after the public 16,000-character input limit.
@@ -53,7 +54,18 @@ function taskView(state: TeamState, task: Task): TaskView {
 }
 
 function migrate(state: unknown): boolean {
-  if (!object(state) || (state.version !== 1 && state.version !== 2)) return false;
+  if (!object(state) || ![1, 2, 3].includes(state.version as number)) return false;
+  if (state.version !== 3) migrateTasks(state);
+  // Schema 4: roles replace the special root ID; the creator's record becomes a main session.
+  const root = state.root ?? "root";
+  requireValue(object(state.members) && typeof root === "string" && Object.hasOwn(state.members, root), "Invalid legacy root member");
+  for (const [key, member] of Object.entries(state.members)) if (object(member)) member.role = key === root ? "main" : "member";
+  delete state.root;
+  state.key = randomUUID();
+  state.version = 4;
+  return true;
+}
+function migrateTasks(state: Record<string, unknown>): void {
   requireValue(object(state.tasks), "Invalid legacy state tasks");
   let number = 0;
   for (const task of Object.values(state.tasks)) {
@@ -68,14 +80,12 @@ function migrate(state: unknown): boolean {
     task.number = ++number;
     task.label = stripVTControlCharacters(task.title).replace(/[\x00-\x1f\x7f-\x9f]/g, " ").trim().split(/\s+/).slice(0, 3).join(" ").slice(0, taskLabelMaxLength).trim() || "Task";
   }
-  state.version = 3;
-  return true;
 }
 
 function validate(state: unknown): asserts state is TeamState {
   requireValue(object(state), "Invalid state snapshot");
   id(state.id);
-  requireValue(state.version === 3 && text(state.root) && integer(state.limit, 1) && integer(state.depth) && object(state.members) && object(state.tasks) && Array.isArray(state.messages), "Invalid state snapshot schema");
+  requireValue(state.version === 4 && text(state.key) && integer(state.limit, 1) && integer(state.depth) && object(state.members) && object(state.tasks) && Array.isArray(state.messages), "Invalid state snapshot schema");
   const members = state.members;
   const names = new Set<string>(["main", "root", ...Object.keys(members)]);
   for (const [key, member] of Object.entries(members)) {
@@ -85,15 +95,22 @@ function validate(state: unknown): asserts state is TeamState {
       names.add(member.name);
     }
     requireValue(member.parent === undefined || (text(member.parent) && Object.hasOwn(members, member.parent)), "Invalid member parent");
-    for (const field of ["identity", "sessionId", "sessionFile", "error", "model", "modelName", "thinking", "activity", "summary"]) requireValue(member[field] === undefined || typeof member[field] === "string", "Invalid member field");
+    for (const field of ["identity", "sessionId", "sessionFile", "error", "model", "modelName", "thinking", "activity", "summary", "provider"]) requireValue(member[field] === undefined || typeof member[field] === "string", "Invalid member field");
     if (member.contextUsage !== undefined) {
       const usage = member.contextUsage;
       requireValue(object(usage) && integer(usage.contextWindow, 1) && (usage.tokens === null || integer(usage.tokens)) && (usage.percent === null || typeof usage.percent === "number" && Number.isFinite(usage.percent) && usage.percent >= 0), "Invalid member context usage");
     }
+    requireValue(member.role === undefined || member.role === "main" || member.role === "member", "Invalid member role");
+    requireValue(member.role !== "main" || member.parent === undefined, "A main session has no parent");
+    requireValue(member.handover === undefined || ["busy", "idle", "input"].includes(String(member.handover)), "Invalid member handover state");
+    requireValue(member.promotion === undefined || (object(member.promotion) && ["stopped", "moved", "role", "entry"].includes(String(member.promotion.step)) && text(member.promotion.sessionFile)), "Invalid member promotion");
     requireValue(member.terminal === undefined || typeof member.terminal === "boolean", "Invalid member terminal flag");
     requireValue(member.needsInput === undefined || typeof member.needsInput === "boolean", "Invalid member input flag");
     requireValue(member.pid === undefined || integer(member.pid, 1), "Invalid member PID");
     requireValue(member.worktree === undefined || validateWorktree(member.worktree), "Invalid member worktree");
+    const paths = (value: unknown) => Array.isArray(value) && value.every(path => typeof path === "string" && path.startsWith("/"));
+    const network = (value: unknown) => { try { return object(value) && (value.allow === undefined || (Array.isArray(value.allow) && value.allow.every(entry => typeof entry === "string"))) && (validatePolicy(value), true); } catch { return false; } };
+    requireValue(member.access === undefined || (object(member.access) && paths(member.access.read) && paths(member.access.write) && network(member.access.network)), "Invalid member access");
     const seen = new Set<string>([key]);
     for (let parent: unknown = member.parent; parent !== undefined;) {
       requireValue(typeof parent === "string" && !seen.has(parent), "Cyclic member ancestry");
@@ -101,7 +118,6 @@ function validate(state: unknown): asserts state is TeamState {
       parent = (members[parent] as Record<string, unknown>).parent;
     }
   }
-  requireValue(Object.hasOwn(members, state.root), "Invalid root member");
   const tasks = state.tasks;
   const edges: Record<string, string[]> = {};
   const taskNumbers = new Set<number>();
@@ -152,13 +168,24 @@ function privateFile(path: string, flags: number): number {
   } catch (error) { closeSync(fd); throw error; }
 }
 
+export const teamsHome = () => join(stateRoot(), "teams");
+/** Reads a team snapshot without taking ownership, for sessions that connect to its coordinator as clients. */
+export function readState(dir: string): TeamState {
+  const fd = privateFile(join(dir, "state.json"), constants.O_RDONLY);
+  try {
+    const stored: unknown = JSON.parse(readFileSync(fd, "utf8"));
+    migrate(stored); validate(stored);
+    return stored;
+  } finally { closeSync(fd); }
+}
+
 export class Store {
   readonly dir: string;
   state: TeamState;
   private lock?: number;
   private closed = false;
 
-  constructor(initial: TeamState, home = join(homedir(), ".acstack", "ac-teams", "teams")) {
+  constructor(initial: TeamState, home = teamsHome()) {
     validate(initial);
     this.dir = join(resolve(home), initial.id);
     this.state = structuredClone(initial);
@@ -295,12 +322,12 @@ export class Store {
       } else if (args.action === "release") {
         requireValue(task.owner, "Task has no owner to release");
         const interrupted = ["interrupted", "stopped"].includes(state.members[task.owner].status);
-        requireValue(task.owner === actor || (interrupted && (actor === state.root || isDescendant(state, task.owner, actor))), "Only the owner can release this task; ancestors may release interrupted descendants");
+        requireValue(task.owner === actor || (interrupted && (isMain(state.members[actor]) || isDescendant(state, task.owner, actor))), "Only the owner can release this task; ancestors may release interrupted descendants");
         if (task.status === "in_progress") task.status = "todo";
         delete task.owner;
       } else if (args.action === "reopen") {
         requireValue(task.status === "done", "Only done tasks can be reopened");
-        requireValue(!task.owner || task.owner === actor || actor === state.root, "Only the owner or root can reopen an owned task");
+        requireValue(!task.owner || task.owner === actor || isMain(state.members[actor]), "Only the owner or a main session can reopen an owned task");
         const dependents = Object.values(state.tasks).filter(other => other.dependencies.includes(task.id) && other.status !== "todo");
         requireValue(dependents.length === 0, `Cannot reopen task with active or done dependents: ${dependents.map(t => t.id).join(", ")}`);
         task.status = "todo";

package/src/terminal-agent.ts

@@ -44,7 +44,7 @@ export class TerminalAgent extends EventEmitter {
       writeFileSync(config, "set -g status off\nset -g prefix None\nset -s extended-keys always\nbind-key -n C-S-Left detach-client\n", { flag: "wx", mode: 0o600 });
       this.files.push(config);
       const exports = Object.entries(this.options.env)
-        .filter(([key, value]) => (key.startsWith("AC_TEAMS_") || key === "HERDR_ENV") && value !== undefined)
+        .filter(([key, value]) => (key.startsWith("AC_TEAMS_") || key === "HERDR_ENV" || key === "ACSTACK_AGENT_ROLE") && value !== undefined)
         .map(([key, value]) => `export ${key}=${quote(value!)}`);
       const command = this.options.command ?? process.env.AC_TEAMS_PI ?? "pi";
       writeFileSync(script, [...exports,

package/src/terminal-ui.ts

@@ -14,10 +14,13 @@ export async function visitMember(ctx: ExtensionContext, host: PanelHost, socket
   if (ctx.mode !== "tui") throw new Error("Live sessions require an interactive terminal");
   if (id === host.self) return;
   const member = (await host.snapshot()).members.find(member => member.id === id);
+  // A member returns to whichever main session attached it by detaching.
+  if (host.child && member?.role === "main") { await exec("tmux", ["-S", socket, "detach-client", "-s", host.self], { timeout: 5000, maxBuffer: 65536 }); return; }
   if (!member || !isLive(member)) throw new Error(`Member ${id} is stopped or unavailable; resume it from /teams`);
-  if (id !== "root" && !member.terminal) throw new Error("This member has no live terminal (it was launched headlessly)");
-  if (host.self !== "root") {
-    await exec("tmux", ["-S", socket, ...(id === "root" ? ["detach-client", "-s", host.self] : ["switch-client", "-t", id])], { timeout: 5000, maxBuffer: 65536 });
+  if (member.role === "main") throw new Error(`${memberName(member)} is a main session in its own terminal; switch to it there`);
+  if (!member.terminal) throw new Error("This member has no live terminal (it was launched headlessly)");
+  if (host.child) {
+    await exec("tmux", ["-S", socket, "switch-client", "-t", id], { timeout: 5000, maxBuffer: 65536 });
     return;
   }
   const code = await ctx.ui.custom<number>((tui, _theme, _keys, done) => {

package/src/types.ts

@@ -1,3 +1,4 @@
+import type { Access, AccessRequest } from "./access.ts";
 export interface Worktree {
   repo: string;
   path: string;
@@ -39,10 +40,25 @@ export interface Member {
   summary?: string;
   terminal?: boolean;
   needsInput?: boolean;
+  access?: Access;
+  /** Provider fixed at an enforced member's first launch; member telemetry cannot change it. */
+  provider?: string;
+  /** Authority: a main session or a member. Absent once a main session has left the team. */
+  role?: "main" | "member";
+  /** State recorded when the coordinator owner stopped this member; the next owner's resume pass consumes it. */
+  handover?: "busy" | "idle" | "input";
+  /** Promotion in progress: the last completed step and what a rollback restores. */
+  promotion?: { step: "stopped" | "moved" | "role" | "entry"; sessionFile: string; parent?: string; access?: Access; provider?: string };
 }
 export const memberNameMaxLength = 40;
 export const memberNamePattern = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)?(?![\s\S])/;
 export function memberName(member: Pick<Member, "id" | "name">): string { return member.id === "root" ? "Main" : member.name ?? member.id; }
+export function isMain(member: Pick<Member, "role"> | undefined): boolean { return member?.role === "main"; }
+/** Mains control every member and other mains; members control only their descendants, never a main. */
+export function canControl(state: TeamState, actor: string, id: string): boolean {
+  const target = state.members[id];
+  return !!target && id !== actor && (isMain(state.members[actor]) ? target.role !== undefined : !isMain(target) && isDescendant(state, id, actor));
+}
 export const taskLabelMaxLength = 60;
 export const taskLabelPattern = /^[^\s\x00-\x1f\x7f-\x9f]+(?: [^\s\x00-\x1f\x7f-\x9f]+){0,2}(?![\s\S])/;
 export function taskName(task: Pick<Task, "number" | "label">): string { return `#${task.number} ${task.label}`; }
@@ -71,9 +87,10 @@ export interface Message {
   time: string;
 }
 export interface TeamState {
-  version: 3;
+  version: 4;
   id: string;
-  root: string;
+  /** Lets an unsandboxed session of the same user add itself as a main session. */
+  key: string;
   limit: number;
   depth: number;
   members: Record<string, Member>;
@@ -113,15 +130,18 @@ export interface AgentArgs {
   target?: string;
   limit?: number;
   depth?: number;
+  access?: AccessRequest;
 }
 export interface UserAction {
-  action: "task_request" | "feedback" | "resume";
+  action: "task_request" | "feedback" | "resume" | "promote" | "leave";
   id?: string;
+  /** Promote: the user approved running a sandboxed member with full access. */
+  confirmed?: boolean;
   text?: string;
   model?: string;
   thinking?: string;
 }
-export type Operation = "agent" | "task" | "message" | "join" | "ack" | "event" | "control_result" | "ui";
+export type Operation = "agent" | "task" | "message" | "join" | "ack" | "event" | "control_result" | "ui" | "add_main";
 export function isLive(member: Pick<Member, "status">): boolean {
   return ["starting", "busy", "idle", "stopping"].includes(member.status);
 }

package/src/ui-types.ts

@@ -10,10 +10,14 @@ export interface TeamSnapshot {
 
 export interface PanelHost {
   self: string;
+  /** True in a member session; false in a main session. */
+  child: boolean;
   snapshot(): Promise<TeamSnapshot>;
   visit(id: string): Promise<void>;
   requestTask(text: string): Promise<string>;
   feedback(task: TaskView, text: string): Promise<string>;
   resume(memberId: string): Promise<void>;
+  /** Stops a member and relaunches it as a main session (user only). */
+  promote(memberId: string): Promise<void>;
   drafts: Map<string, string>;
 }