@indigoai-us/hq-cli 5.345.178 → 5.345.180

package/dist/lib/mesh/live/daemon/owner-inbox-push.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Owner (prs_) DM doorbell state for the mesh daemon.
+ *
+ * The server publishes a wake to `hq/{prs}/dm` for each DM, thread reply and
+ * channel post the owner should see. The daemon reads only `type`,
+ * `channelId` and `eventId` from that payload, keeps a channel event only when
+ * the channel belongs to an allowed company, and bumps a content-free counter
+ * in `owner-inbox-push.json`. Message text, poster name and email are never
+ * stored, logged or forwarded.
+ */
+export { OWNER_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
+/** Heartbeat cadence while the owner DM topic is subscribed. */
+export declare const OWNER_PUSH_HEARTBEAT_MS = 5000;
+/** A heartbeat older than this means the push signal is stale. */
+export declare const OWNER_PUSH_STALE_MS = 15000;
+/** Channel list refreshes at most this often when an unknown channel arrives. */
+export declare const OWNER_CHANNEL_REFRESH_MIN_MS = 60000;
+/** A channel-list fetch that runs longer than this is abandoned. */
+export declare const OWNER_CHANNEL_REFRESH_TIMEOUT_MS = 10000;
+export type OwnerDoorbellType = "dm" | "thread" | "channel";
+export interface OwnerDoorbell {
+    type: OwnerDoorbellType;
+    channelId?: string;
+    eventId?: string;
+}
+/** Every key the state file may contain. Nothing else is ever written. */
+export declare const OWNER_INBOX_PUSH_STATE_KEYS: readonly ["connected", "heartbeatAtMs", "count", "lastAt", "lastType", "principalUid"];
+export interface OwnerInboxPushState {
+    connected: boolean;
+    heartbeatAtMs: number;
+    count: number;
+    lastAt?: string;
+    lastType?: OwnerDoorbellType;
+    principalUid?: string;
+}
+/**
+ * Read only `type`, `channelId` and `eventId`. Returns null for anything that
+ * is not a dm, thread or channel wake. Other payload fields are discarded.
+ */
+export declare function parseOwnerDoorbell(payload: Buffer | string): OwnerDoorbell | null;
+/** Read the state file. Missing, non-regular or malformed files return null. */
+export declare function readOwnerInboxPushState(meshRoot: string, onInfo?: (message: string) => void): OwnerInboxPushState | null;
+/** Atomic write (temp file plus rename), mode 0600, allowed keys only. */
+export declare function writeOwnerInboxPushState(meshRoot: string, state: OwnerInboxPushState): void;
+/**
+ * Remove the state file. Used when the account is not a person account, so a
+ * file left by an earlier person login cannot report the push as stale.
+ */
+export declare function clearOwnerInboxPushState(meshRoot: string): void;
+export type OwnerPushStatusKind = "live" | "stale" | "off";
+export interface OwnerPushStatus {
+    status: OwnerPushStatusKind;
+    connected: boolean;
+    count: number;
+    lastAt: string | null;
+    lastType: OwnerDoorbellType | null;
+    heartbeatAt: string | null;
+    heartbeatAgeMs: number | null;
+}
+/**
+ * live: connected with a fresh heartbeat. stale: the file exists but the
+ * subscriber is disconnected or its heartbeat is older than the stale window.
+ * off: no state file (the daemon never subscribed on this machine).
+ */
+export declare function ownerPushStatus(state: OwnerInboxPushState | null, nowMs: number, staleMs?: number): OwnerPushStatus;
+/**
+ * Status for the signed-in account. Only a person account has an owner DM
+ * topic, so any other account kind (agent, outpost, or no login) reports off.
+ */
+export declare function ownerPushStatusForAccount(state: OwnerInboxPushState | null, nowMs: number, actorKind: string): OwnerPushStatus;
+export declare function formatOwnerPushStatus(status: OwnerPushStatus): string;
+export interface ChannelCompanyRow {
+    channelId: string;
+    companyUid?: string;
+}
+export interface OwnerChannelScope {
+    /** True only when the channel is known and its company is allowed. */
+    isInScope(channelId: string): Promise<boolean>;
+}
+/**
+ * Channel filter backed by the owner's channel list. A channel with no
+ * company, an unknown channel, or a company outside the allowed set is
+ * dropped. The allowed set is read on every check so a session lock change
+ * applies at once. The list refreshes at most once per refresh window.
+ */
+export declare function createOwnerChannelScope(opts: {
+    listChannels: () => Promise<ChannelCompanyRow[]>;
+    allowedCompanyUids: () => readonly string[] | undefined;
+    now?: () => number;
+    refreshMinMs?: number;
+    refreshTimeoutMs?: number;
+    onInfo?: (message: string) => void;
+}): OwnerChannelScope;
+//# sourceMappingURL=owner-inbox-push.d.ts.map

package/dist/lib/mesh/live/daemon/owner-inbox-push.js

@@ -0,0 +1,273 @@
+/**
+ * Owner (prs_) DM doorbell state for the mesh daemon.
+ *
+ * The server publishes a wake to `hq/{prs}/dm` for each DM, thread reply and
+ * channel post the owner should see. The daemon reads only `type`,
+ * `channelId` and `eventId` from that payload, keeps a channel event only when
+ * the channel belongs to an allowed company, and bumps a content-free counter
+ * in `owner-inbox-push.json`. Message text, poster name and email are never
+ * stored, logged or forwarded.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { OWNER_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
+export { OWNER_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
+/** Heartbeat cadence while the owner DM topic is subscribed. */
+export const OWNER_PUSH_HEARTBEAT_MS = 5_000;
+/** A heartbeat older than this means the push signal is stale. */
+export const OWNER_PUSH_STALE_MS = 15_000;
+/** Channel list refreshes at most this often when an unknown channel arrives. */
+export const OWNER_CHANNEL_REFRESH_MIN_MS = 60_000;
+/** A channel-list fetch that runs longer than this is abandoned. */
+export const OWNER_CHANNEL_REFRESH_TIMEOUT_MS = 10_000;
+/** Every key the state file may contain. Nothing else is ever written. */
+export const OWNER_INBOX_PUSH_STATE_KEYS = [
+    "connected",
+    "heartbeatAtMs",
+    "count",
+    "lastAt",
+    "lastType",
+    "principalUid",
+];
+const CHANNEL_ID_RE = /^chn_[A-Za-z0-9]+$/;
+const EVENT_ID_RE = /^[A-Za-z0-9_.:-]{1,128}$/;
+/**
+ * Read only `type`, `channelId` and `eventId`. Returns null for anything that
+ * is not a dm, thread or channel wake. Other payload fields are discarded.
+ */
+export function parseOwnerDoorbell(payload) {
+    let raw;
+    try {
+        raw = JSON.parse(typeof payload === "string" ? payload : payload.toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const record = raw;
+    const type = record.type;
+    if (type !== "dm" && type !== "thread" && type !== "channel")
+        return null;
+    const out = { type };
+    if (typeof record.channelId === "string" && CHANNEL_ID_RE.test(record.channelId)) {
+        out.channelId = record.channelId;
+    }
+    if (typeof record.eventId === "string" && EVENT_ID_RE.test(record.eventId)) {
+        out.eventId = record.eventId;
+    }
+    return out;
+}
+function ownerStatePath(meshRoot) {
+    return path.join(meshRoot, OWNER_INBOX_PUSH_STATE_BASENAME);
+}
+/** Read the state file. Missing, non-regular or malformed files return null. */
+export function readOwnerInboxPushState(meshRoot, onInfo) {
+    const target = ownerStatePath(meshRoot);
+    try {
+        const info = fs.lstatSync(target);
+        if (!info.isFile() || info.isSymbolicLink()) {
+            onInfo?.("owner inbox push state read ignored (not a regular file)");
+            return null;
+        }
+        const parsed = JSON.parse(fs.readFileSync(target, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const count = Number.isSafeInteger(parsed.count) && Number(parsed.count) >= 0
+            ? Number(parsed.count)
+            : 0;
+        const heartbeatAtMs = Number.isFinite(parsed.heartbeatAtMs)
+            ? Number(parsed.heartbeatAtMs)
+            : 0;
+        const state = {
+            connected: parsed.connected === true,
+            heartbeatAtMs,
+            count,
+        };
+        if (typeof parsed.lastAt === "string" && Number.isFinite(Date.parse(parsed.lastAt))) {
+            state.lastAt = parsed.lastAt;
+        }
+        if (parsed.lastType === "dm" || parsed.lastType === "thread" || parsed.lastType === "channel") {
+            state.lastType = parsed.lastType;
+        }
+        if (typeof parsed.principalUid === "string" && parsed.principalUid.startsWith("prs_")) {
+            state.principalUid = parsed.principalUid;
+        }
+        return state;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            const name = error instanceof Error ? error.name : "UnknownError";
+            onInfo?.(`owner inbox push state read failed (${name})`);
+        }
+        return null;
+    }
+}
+/** Atomic write (temp file plus rename), mode 0600, allowed keys only. */
+export function writeOwnerInboxPushState(meshRoot, state) {
+    fs.mkdirSync(meshRoot, { recursive: true, mode: 0o700 });
+    const target = ownerStatePath(meshRoot);
+    const temporary = `${target}.${process.pid}.tmp`;
+    const body = {
+        connected: state.connected,
+        heartbeatAtMs: state.heartbeatAtMs,
+        count: state.count,
+    };
+    if (state.lastAt)
+        body.lastAt = state.lastAt;
+    if (state.lastType)
+        body.lastType = state.lastType;
+    if (state.principalUid)
+        body.principalUid = state.principalUid;
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(body)}\n`, { mode: 0o600 });
+        fs.chmodSync(temporary, 0o600);
+        fs.renameSync(temporary, target);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (cleanupError) {
+            if (cleanupError.code !== "ENOENT")
+                throw cleanupError;
+        }
+        throw error;
+    }
+}
+/**
+ * Remove the state file. Used when the account is not a person account, so a
+ * file left by an earlier person login cannot report the push as stale.
+ */
+export function clearOwnerInboxPushState(meshRoot) {
+    try {
+        fs.unlinkSync(ownerStatePath(meshRoot));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+/**
+ * live: connected with a fresh heartbeat. stale: the file exists but the
+ * subscriber is disconnected or its heartbeat is older than the stale window.
+ * off: no state file (the daemon never subscribed on this machine).
+ */
+export function ownerPushStatus(state, nowMs, staleMs = OWNER_PUSH_STALE_MS) {
+    if (!state) {
+        return {
+            status: "off",
+            connected: false,
+            count: 0,
+            lastAt: null,
+            lastType: null,
+            heartbeatAt: null,
+            heartbeatAgeMs: null,
+        };
+    }
+    const heartbeatAgeMs = state.heartbeatAtMs > 0 ? Math.max(0, nowMs - state.heartbeatAtMs) : null;
+    const fresh = heartbeatAgeMs !== null && heartbeatAgeMs <= staleMs;
+    return {
+        status: state.connected && fresh ? "live" : "stale",
+        connected: state.connected,
+        count: state.count,
+        lastAt: state.lastAt ?? null,
+        lastType: state.lastType ?? null,
+        heartbeatAt: state.heartbeatAtMs > 0 ? new Date(state.heartbeatAtMs).toISOString() : null,
+        heartbeatAgeMs,
+    };
+}
+/**
+ * Status for the signed-in account. Only a person account has an owner DM
+ * topic, so any other account kind (agent, outpost, or no login) reports off.
+ */
+export function ownerPushStatusForAccount(state, nowMs, actorKind) {
+    return ownerPushStatus(actorKind === "human" ? state : null, nowMs);
+}
+export function formatOwnerPushStatus(status) {
+    const last = status.lastAt ? `last event ${status.lastAt} (${status.lastType ?? "unknown"})` : "no events yet";
+    if (status.status === "off")
+        return "owner push: off (daemon has not subscribed on this machine)";
+    const beat = status.heartbeatAgeMs === null
+        ? "no heartbeat"
+        : `heartbeat ${Math.round(status.heartbeatAgeMs / 1000)}s ago`;
+    return `owner push: ${status.status}; ${last}; count=${status.count}; ${beat}`;
+}
+/**
+ * Channel filter backed by the owner's channel list. A channel with no
+ * company, an unknown channel, or a company outside the allowed set is
+ * dropped. The allowed set is read on every check so a session lock change
+ * applies at once. The list refreshes at most once per refresh window.
+ */
+export function createOwnerChannelScope(opts) {
+    const now = opts.now ?? Date.now;
+    const refreshMinMs = opts.refreshMinMs ?? OWNER_CHANNEL_REFRESH_MIN_MS;
+    const refreshTimeoutMs = opts.refreshTimeoutMs ?? OWNER_CHANNEL_REFRESH_TIMEOUT_MS;
+    let companyByChannel = new Map();
+    let lastRefreshMs = null;
+    let inflight = null;
+    const refresh = async () => {
+        if (inflight)
+            return inflight;
+        lastRefreshMs = now();
+        inflight = (async () => {
+            try {
+                let timer;
+                const timeout = new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        const err = new Error("owner channel list timed out");
+                        err.name = "TimeoutError";
+                        reject(err);
+                    }, refreshTimeoutMs);
+                    timer.unref?.();
+                });
+                let rows;
+                try {
+                    rows = await Promise.race([opts.listChannels(), timeout]);
+                }
+                finally {
+                    if (timer)
+                        clearTimeout(timer);
+                }
+                const next = new Map();
+                for (const row of rows) {
+                    if (typeof row.channelId !== "string")
+                        continue;
+                    next.set(row.channelId, typeof row.companyUid === "string" && row.companyUid ? row.companyUid : undefined);
+                }
+                companyByChannel = next;
+            }
+            catch (error) {
+                // Keep the previous map; an unknown channel stays out of scope.
+                const name = error instanceof Error ? error.name : "UnknownError";
+                opts.onInfo?.(`owner channel list refresh failed (${name})`);
+            }
+            finally {
+                inflight = null;
+            }
+        })();
+        return inflight;
+    };
+    return {
+        async isInScope(channelId) {
+            let allowed;
+            try {
+                allowed = opts.allowedCompanyUids();
+            }
+            catch (error) {
+                const name = error instanceof Error ? error.name : "UnknownError";
+                opts.onInfo?.(`owner allowed company read failed (${name})`);
+                allowed = undefined;
+            }
+            if (!allowed || allowed.length === 0)
+                return false;
+            if (!companyByChannel.has(channelId) &&
+                (lastRefreshMs === null || now() - lastRefreshMs >= refreshMinMs || inflight)) {
+                await refresh();
+            }
+            const companyUid = companyByChannel.get(channelId);
+            return companyUid !== undefined && allowed.includes(companyUid);
+        },
+    };
+}
+//# sourceMappingURL=owner-inbox-push.js.map

package/dist/lib/mesh/live/daemon/run.js

@@ -40,6 +40,8 @@ import { resolveRunningCliEntry } from "./install.js";
 import { readDaemonConfig } from "./config.js";
 import { retireLegacyListen } from "./legacy-listen.js";
 import { startWorkCacheSubscriber } from "./work-subscribe.js";
+import { createOwnerChannelScope } from "./owner-inbox-push.js";
+import { vaultApiFetch } from "../../../../utils/vault-api.js";
 import { capacityRoot } from "../../../capacity/ledger.js";
 import { startCapacityScheduler, } from "../../../capacity/scheduler.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
@@ -616,6 +618,35 @@ export async function runMeshDaemon(deps = {}) {
                 now,
                 onInfo: (message) => log(dir, message.slice(0, 200)),
                 random: deps.random,
+                // Channel events count only when the channel's company is in the
+                // device default or recent session company set. Unknown means drop.
+                ownerChannelScope: createOwnerChannelScope({
+                    listChannels: async () => {
+                        const res = await vaultApiFetch({
+                            token: await getToken(),
+                            path: "/v1/notify/channels",
+                            baseUrl: resolveVaultApiBase(env),
+                        });
+                        if (!res.ok)
+                            throw new Error(`channel list failed (${res.status})`);
+                        const body = (await res.json());
+                        if (!Array.isArray(body.channels))
+                            return [];
+                        return body.channels.flatMap((row) => {
+                            if (!row || typeof row !== "object")
+                                return [];
+                            const record = row;
+                            if (typeof record.channelId !== "string")
+                                return [];
+                            return [{
+                                    channelId: record.channelId,
+                                    ...(typeof record.companyUid === "string" ? { companyUid: record.companyUid } : {}),
+                                }];
+                        });
+                    },
+                    allowedCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
+                    onInfo: (message) => log(dir, message.slice(0, 200)),
+                }),
             });
         }
         catch (err) {

package/dist/lib/mesh/live/daemon/work-subscribe.d.ts

@@ -1,10 +1,13 @@
 /**
  * Contract-2 subscriber for the personal work topic.
  * Owns live-cache.json writes. Presence publish stays on PresenceClient.
+ * On a person (prs_) account it also subscribes to the owner DM topic and
+ * keeps the content-free owner-inbox-push.json counter.
  */
 import type { IClientOptions } from "mqtt";
 import type { MeshMqttEventClient } from "./mqtt-events.js";
 import { type PersonalCredentialsFetcher } from "./credentials.js";
+import { type OwnerChannelScope } from "./owner-inbox-push.js";
 export interface WorkCacheMqtt extends MeshMqttEventClient {
     subscribe(topic: string, opts: {
         qos: 0 | 1;
@@ -19,6 +22,12 @@ export type SyncWakeVaults = Record<string, {
     wakeSequence: number;
     head?: number;
 }>;
+/**
+ * Owner DM subscribe retries per connection. The owner signal is best-effort:
+ * after this many failures it stays off until the next broker reconnect, and
+ * the work topic keeps running.
+ */
+export declare const OWNER_SUBSCRIBE_MAX_RETRIES = 6;
 export declare function startWorkCacheSubscriber(opts: {
     meshRoot: string;
     fetchCredentials?: PersonalCredentialsFetcher;
@@ -32,5 +41,10 @@ export declare function startWorkCacheSubscriber(opts: {
     };
     onInfo?: (message: string) => void;
     random?: () => number;
+    /**
+     * Company filter for channel events on the owner DM topic. Without it every
+     * event that names a channel is dropped.
+     */
+    ownerChannelScope?: OwnerChannelScope;
 }): Promise<WorkCacheSubscriber>;
 //# sourceMappingURL=work-subscribe.d.ts.map