@cfio/cohort-sync 0.15.0 → 0.17.0

package/dist/index.js

@@ -11826,7 +11826,13 @@ function createClient(convexUrl) {
   }
   savedConvexUrl = convexUrl;
   authCircuitOpen = false;
-  client = new ConvexClient(convexUrl);
+  const nativeWS = globalThis.WebSocket;
+  delete globalThis.WebSocket;
+  try {
+    client = new ConvexClient(convexUrl);
+  } finally {
+    if (nativeWS) globalThis.WebSocket = nativeWS;
+  }
   return client;
 }
 function getClient() {
@@ -11855,7 +11861,10 @@ function closeBridge() {
 }
 var authCircuitOpen = false;
 function isUnauthorizedError(err) {
-  return String(err).includes("Unauthorized");
+  if (!(err instanceof ConvexError)) return false;
+  const data = err.data;
+  if (!data || typeof data !== "object") return false;
+  return data.code === "UNAUTHORIZED";
 }
 function tripAuthCircuit() {
   if (authCircuitOpen) return;
@@ -11874,6 +11883,7 @@ var markDeliveredByPlugin = makeFunctionReference("notifications:markDeliveredBy
 var getPendingCommandsForPlugin = makeFunctionReference("gatewayCommands:getPendingForPlugin");
 var acknowledgeCommandRef = makeFunctionReference("gatewayCommands:acknowledgeCommand");
 var failCommandRef = makeFunctionReference("gatewayCommands:failCommand");
+var getChannelsForPlugin = makeFunctionReference("cloudGatewayChannels:listForPlugin");
 var addCommentFromPluginRef = makeFunctionReference("comments:addCommentFromPlugin");
 async function pushTelemetry(apiKey2, data) {
   if (authCircuitOpen) return;
@@ -12204,6 +12214,41 @@ function startCommandSubscription(cfg, logger, resolveAgentName, gwClient) {
   logger.info("cohort-sync: command subscription active");
   return unsubscribe;
 }
+function subscribeChannels(apiKey2, onUpdate, logger) {
+  const c = getClient();
+  if (!c) {
+    (logger ?? getLogger()).warn(
+      "cohort-sync: no ConvexClient \u2014 channels subscription skipped"
+    );
+    return null;
+  }
+  const apiKeyHash = hashApiKey(apiKey2);
+  const unsubscribe = c.onUpdate(
+    getChannelsForPlugin,
+    { apiKeyHash },
+    (rows) => {
+      try {
+        onUpdate(rows);
+      } catch (err) {
+        (logger ?? getLogger()).error(
+          `cohort-sync: channels onUpdate handler threw: ${String(err)}`
+        );
+      }
+    },
+    (err) => {
+      if (isUnauthorizedError(err)) {
+        tripAuthCircuit();
+        return;
+      }
+      (logger ?? getLogger()).error(
+        `cohort-sync: channels subscription error: ${String(err)}`
+      );
+    }
+  );
+  unsubscribers.push(unsubscribe);
+  (logger ?? getLogger()).info("cohort-sync: channels subscription active");
+  return unsubscribe;
+}
 
 // src/gateway-client.ts
 import crypto2 from "node:crypto";
@@ -12299,7 +12344,13 @@ var ALLOWED_METHODS = /* @__PURE__ */ new Set([
   "agent",
   "snapshot",
   "system.presence",
-  "gateway.restart"
+  "gateway.restart",
+  // `secrets.reload` re-resolves SecretRefs and atomically swaps the runtime
+  // snapshot. The plugin's `cohort-sync/secrets-reload` gateway-method wrapper
+  // (see `gateway-methods.ts`) proxies inbound calls to this outbound RPC so
+  // the Cohort web app (and #608 channel attach/detach flows) can trigger a
+  // reload without minting an admin-scope key.
+  "secrets.reload"
 ]);
 function buildConnectFrame(id, token, pluginVersion, identity, nonce) {
   const signedAtMs = Date.now();
@@ -13372,7 +13423,7 @@ function dumpCtx(ctx) {
 function dumpEvent(event) {
   return dumpCtx(event);
 }
-var PLUGIN_VERSION = true ? "0.15.0" : "unknown";
+var PLUGIN_VERSION = true ? "0.17.0" : "unknown";
 function resolveGatewayToken(api) {
   const token = api.config?.gateway?.auth?.token;
   return typeof token === "string" ? token : null;
@@ -13501,6 +13552,19 @@ function initGatewayClient(port, token, cfg, resolveAgentName, logger) {
   });
   return client2;
 }
+function applyChannelRowsToBridge(rows, setChannel, resolveAgentName) {
+  let count = 0;
+  for (const row of rows) {
+    const agentName = resolveAgentName(row.agentId);
+    setChannel(row.kind, agentName);
+    count++;
+    if (row.accountId) {
+      setChannel(`${row.kind}:${row.accountId}`, agentName);
+      count++;
+    }
+  }
+  return count;
+}
 async function handleGatewayStart(event, state) {
   if (!state) {
     return;
@@ -13561,6 +13625,39 @@ async function handleGatewayStart(event, state) {
   for (const agentId of allAgentIds) {
     resolvedNameMap[agentId] = state.resolveAgentName(agentId);
   }
+  if (state.channelsUnsubscriber) {
+    state.channelsUnsubscriber();
+    state.channelsUnsubscriber = null;
+  }
+  try {
+    const unsubChannels = subscribeChannels(
+      cfg.apiKey,
+      (rows) => {
+        try {
+          const count = applyChannelRowsToBridge(
+            rows,
+            setChannelAgent,
+            state.resolveAgentName
+          );
+          logger.debug("cohort-sync: channels snapshot applied", {
+            rowCount: rows.length,
+            bridgeEntries: count,
+            bridge: Object.fromEntries(getChannelAgentBridge())
+          });
+        } catch (err) {
+          logger.warn(
+            `cohort-sync: applyChannelRowsToBridge failed: ${String(err)}`
+          );
+        }
+      },
+      logger
+    );
+    if (unsubChannels) state.channelsUnsubscriber = unsubChannels;
+  } catch (err) {
+    logger.warn(
+      `cohort-sync: channels subscription init failed: ${String(err)}`
+    );
+  }
   await startNotificationSubscription(
     event.port,
     cfg,
@@ -14003,6 +14100,13 @@ function registerHookHandlers(api, logger, getState) {
       clearInterval(state.keepaliveInterval);
       state.keepaliveInterval = null;
     }
+    if (state.channelsUnsubscriber) {
+      try {
+        state.channelsUnsubscriber();
+      } catch {
+      }
+      state.channelsUnsubscriber = null;
+    }
     state.activityBatch.drain();
     if (!isRestart) {
       const shutdownConfigIds = (config?.agents?.list ?? []).map((a) => a.id);
@@ -14150,11 +14254,47 @@ function initializeHookState(api, cfg) {
     gwClientInitialized,
     keepaliveInterval: null,
     commandUnsubscriber: commandUnsub,
+    channelsUnsubscriber: null,
     api,
     latestPluginVersion: null
   };
 }
 
+// src/gateway-methods.ts
+async function invokeSecretsReload(gwClient) {
+  if (!gwClient || !gwClient.isAlive()) {
+    return { ok: false, error: "gateway client not connected" };
+  }
+  try {
+    const result = await gwClient.request(
+      "secrets.reload",
+      void 0,
+      3e4
+      // Channel restart can take a few seconds — give it headroom.
+    );
+    const warningCount = typeof result?.warningCount === "number" ? result.warningCount : 0;
+    return { ok: true, warningCount };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function registerGatewayMethods(api, getGatewayClient) {
+  api.registerGatewayMethod(
+    "cohort-sync/secrets-reload",
+    async ({ respond }) => {
+      const result = await invokeSecretsReload(getGatewayClient());
+      respond(true, result);
+    },
+    // operator.write is the channel attach/detach surface — same scope used
+    // for any write-side channels operation. Admins also pass (admin is a
+    // superset).
+    { scope: "operator.write" }
+  );
+}
+
 // src/pocket-guide.ts
 var POCKET_GUIDE = `# Cohort Agent Guide (Pocket Version)
 
@@ -14230,6 +14370,7 @@ var plugin = {
       return;
     }
     registerHookHandlers(api, api.logger, () => sharedHookState);
+    registerGatewayMethods(api, () => sharedHookState?.persistentGwClient ?? null);
     const gatewayPort = api.config?.gateway?.port ?? 18789;
     api.registerHook(
       "gateway:startup",

package/dist/openclaw.plugin.json

@@ -55,5 +55,5 @@
       }
     }
   },
-  "version": "0.15.0"
+  "version": "0.17.0"
 }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cfio/cohort-sync",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "OpenClaw plugin — syncs agent telemetry, sessions, and activity to the Cohort dashboard",
   "type": "module",
   "main": "index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cfio/cohort-sync",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "OpenClaw plugin — syncs agent telemetry, sessions, and activity to the Cohort dashboard",
   "license": "MIT",
   "homepage": "https://docs.cohort.bot/gateway",