@indigoai-us/hq-cli 5.345.179 → 5.345.181

package/dist/lib/mesh/live/daemon/owner-inbox-push.js

@@ -0,0 +1,273 @@
+/**
+ * Owner (prs_) DM doorbell state for the mesh daemon.
+ *
+ * The server publishes a wake to `hq/{prs}/dm` for each DM, thread reply and
+ * channel post the owner should see. The daemon reads only `type`,
+ * `channelId` and `eventId` from that payload, keeps a channel event only when
+ * the channel belongs to an allowed company, and bumps a content-free counter
+ * in `owner-inbox-push.json`. Message text, poster name and email are never
+ * stored, logged or forwarded.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { OWNER_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
+export { OWNER_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
+/** Heartbeat cadence while the owner DM topic is subscribed. */
+export const OWNER_PUSH_HEARTBEAT_MS = 5_000;
+/** A heartbeat older than this means the push signal is stale. */
+export const OWNER_PUSH_STALE_MS = 15_000;
+/** Channel list refreshes at most this often when an unknown channel arrives. */
+export const OWNER_CHANNEL_REFRESH_MIN_MS = 60_000;
+/** A channel-list fetch that runs longer than this is abandoned. */
+export const OWNER_CHANNEL_REFRESH_TIMEOUT_MS = 10_000;
+/** Every key the state file may contain. Nothing else is ever written. */
+export const OWNER_INBOX_PUSH_STATE_KEYS = [
+    "connected",
+    "heartbeatAtMs",
+    "count",
+    "lastAt",
+    "lastType",
+    "principalUid",
+];
+const CHANNEL_ID_RE = /^chn_[A-Za-z0-9]+$/;
+const EVENT_ID_RE = /^[A-Za-z0-9_.:-]{1,128}$/;
+/**
+ * Read only `type`, `channelId` and `eventId`. Returns null for anything that
+ * is not a dm, thread or channel wake. Other payload fields are discarded.
+ */
+export function parseOwnerDoorbell(payload) {
+    let raw;
+    try {
+        raw = JSON.parse(typeof payload === "string" ? payload : payload.toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const record = raw;
+    const type = record.type;
+    if (type !== "dm" && type !== "thread" && type !== "channel")
+        return null;
+    const out = { type };
+    if (typeof record.channelId === "string" && CHANNEL_ID_RE.test(record.channelId)) {
+        out.channelId = record.channelId;
+    }
+    if (typeof record.eventId === "string" && EVENT_ID_RE.test(record.eventId)) {
+        out.eventId = record.eventId;
+    }
+    return out;
+}
+function ownerStatePath(meshRoot) {
+    return path.join(meshRoot, OWNER_INBOX_PUSH_STATE_BASENAME);
+}
+/** Read the state file. Missing, non-regular or malformed files return null. */
+export function readOwnerInboxPushState(meshRoot, onInfo) {
+    const target = ownerStatePath(meshRoot);
+    try {
+        const info = fs.lstatSync(target);
+        if (!info.isFile() || info.isSymbolicLink()) {
+            onInfo?.("owner inbox push state read ignored (not a regular file)");
+            return null;
+        }
+        const parsed = JSON.parse(fs.readFileSync(target, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const count = Number.isSafeInteger(parsed.count) && Number(parsed.count) >= 0
+            ? Number(parsed.count)
+            : 0;
+        const heartbeatAtMs = Number.isFinite(parsed.heartbeatAtMs)
+            ? Number(parsed.heartbeatAtMs)
+            : 0;
+        const state = {
+            connected: parsed.connected === true,
+            heartbeatAtMs,
+            count,
+        };
+        if (typeof parsed.lastAt === "string" && Number.isFinite(Date.parse(parsed.lastAt))) {
+            state.lastAt = parsed.lastAt;
+        }
+        if (parsed.lastType === "dm" || parsed.lastType === "thread" || parsed.lastType === "channel") {
+            state.lastType = parsed.lastType;
+        }
+        if (typeof parsed.principalUid === "string" && parsed.principalUid.startsWith("prs_")) {
+            state.principalUid = parsed.principalUid;
+        }
+        return state;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            const name = error instanceof Error ? error.name : "UnknownError";
+            onInfo?.(`owner inbox push state read failed (${name})`);
+        }
+        return null;
+    }
+}
+/** Atomic write (temp file plus rename), mode 0600, allowed keys only. */
+export function writeOwnerInboxPushState(meshRoot, state) {
+    fs.mkdirSync(meshRoot, { recursive: true, mode: 0o700 });
+    const target = ownerStatePath(meshRoot);
+    const temporary = `${target}.${process.pid}.tmp`;
+    const body = {
+        connected: state.connected,
+        heartbeatAtMs: state.heartbeatAtMs,
+        count: state.count,
+    };
+    if (state.lastAt)
+        body.lastAt = state.lastAt;
+    if (state.lastType)
+        body.lastType = state.lastType;
+    if (state.principalUid)
+        body.principalUid = state.principalUid;
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(body)}\n`, { mode: 0o600 });
+        fs.chmodSync(temporary, 0o600);
+        fs.renameSync(temporary, target);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (cleanupError) {
+            if (cleanupError.code !== "ENOENT")
+                throw cleanupError;
+        }
+        throw error;
+    }
+}
+/**
+ * Remove the state file. Used when the account is not a person account, so a
+ * file left by an earlier person login cannot report the push as stale.
+ */
+export function clearOwnerInboxPushState(meshRoot) {
+    try {
+        fs.unlinkSync(ownerStatePath(meshRoot));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+/**
+ * live: connected with a fresh heartbeat. stale: the file exists but the
+ * subscriber is disconnected or its heartbeat is older than the stale window.
+ * off: no state file (the daemon never subscribed on this machine).
+ */
+export function ownerPushStatus(state, nowMs, staleMs = OWNER_PUSH_STALE_MS) {
+    if (!state) {
+        return {
+            status: "off",
+            connected: false,
+            count: 0,
+            lastAt: null,
+            lastType: null,
+            heartbeatAt: null,
+            heartbeatAgeMs: null,
+        };
+    }
+    const heartbeatAgeMs = state.heartbeatAtMs > 0 ? Math.max(0, nowMs - state.heartbeatAtMs) : null;
+    const fresh = heartbeatAgeMs !== null && heartbeatAgeMs <= staleMs;
+    return {
+        status: state.connected && fresh ? "live" : "stale",
+        connected: state.connected,
+        count: state.count,
+        lastAt: state.lastAt ?? null,
+        lastType: state.lastType ?? null,
+        heartbeatAt: state.heartbeatAtMs > 0 ? new Date(state.heartbeatAtMs).toISOString() : null,
+        heartbeatAgeMs,
+    };
+}
+/**
+ * Status for the signed-in account. Only a person account has an owner DM
+ * topic, so any other account kind (agent, outpost, or no login) reports off.
+ */
+export function ownerPushStatusForAccount(state, nowMs, actorKind) {
+    return ownerPushStatus(actorKind === "human" ? state : null, nowMs);
+}
+export function formatOwnerPushStatus(status) {
+    const last = status.lastAt ? `last event ${status.lastAt} (${status.lastType ?? "unknown"})` : "no events yet";
+    if (status.status === "off")
+        return "owner push: off (daemon has not subscribed on this machine)";
+    const beat = status.heartbeatAgeMs === null
+        ? "no heartbeat"
+        : `heartbeat ${Math.round(status.heartbeatAgeMs / 1000)}s ago`;
+    return `owner push: ${status.status}; ${last}; count=${status.count}; ${beat}`;
+}
+/**
+ * Channel filter backed by the owner's channel list. A channel with no
+ * company, an unknown channel, or a company outside the allowed set is
+ * dropped. The allowed set is read on every check so a session lock change
+ * applies at once. The list refreshes at most once per refresh window.
+ */
+export function createOwnerChannelScope(opts) {
+    const now = opts.now ?? Date.now;
+    const refreshMinMs = opts.refreshMinMs ?? OWNER_CHANNEL_REFRESH_MIN_MS;
+    const refreshTimeoutMs = opts.refreshTimeoutMs ?? OWNER_CHANNEL_REFRESH_TIMEOUT_MS;
+    let companyByChannel = new Map();
+    let lastRefreshMs = null;
+    let inflight = null;
+    const refresh = async () => {
+        if (inflight)
+            return inflight;
+        lastRefreshMs = now();
+        inflight = (async () => {
+            try {
+                let timer;
+                const timeout = new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        const err = new Error("owner channel list timed out");
+                        err.name = "TimeoutError";
+                        reject(err);
+                    }, refreshTimeoutMs);
+                    timer.unref?.();
+                });
+                let rows;
+                try {
+                    rows = await Promise.race([opts.listChannels(), timeout]);
+                }
+                finally {
+                    if (timer)
+                        clearTimeout(timer);
+                }
+                const next = new Map();
+                for (const row of rows) {
+                    if (typeof row.channelId !== "string")
+                        continue;
+                    next.set(row.channelId, typeof row.companyUid === "string" && row.companyUid ? row.companyUid : undefined);
+                }
+                companyByChannel = next;
+            }
+            catch (error) {
+                // Keep the previous map; an unknown channel stays out of scope.
+                const name = error instanceof Error ? error.name : "UnknownError";
+                opts.onInfo?.(`owner channel list refresh failed (${name})`);
+            }
+            finally {
+                inflight = null;
+            }
+        })();
+        return inflight;
+    };
+    return {
+        async isInScope(channelId) {
+            let allowed;
+            try {
+                allowed = opts.allowedCompanyUids();
+            }
+            catch (error) {
+                const name = error instanceof Error ? error.name : "UnknownError";
+                opts.onInfo?.(`owner allowed company read failed (${name})`);
+                allowed = undefined;
+            }
+            if (!allowed || allowed.length === 0)
+                return false;
+            if (!companyByChannel.has(channelId) &&
+                (lastRefreshMs === null || now() - lastRefreshMs >= refreshMinMs || inflight)) {
+                await refresh();
+            }
+            const companyUid = companyByChannel.get(channelId);
+            return companyUid !== undefined && allowed.includes(companyUid);
+        },
+    };
+}
+//# sourceMappingURL=owner-inbox-push.js.map

package/dist/lib/mesh/live/daemon/run.js

@@ -40,6 +40,8 @@ import { resolveRunningCliEntry } from "./install.js";
 import { readDaemonConfig } from "./config.js";
 import { retireLegacyListen } from "./legacy-listen.js";
 import { startWorkCacheSubscriber } from "./work-subscribe.js";
+import { createOwnerChannelScope } from "./owner-inbox-push.js";
+import { vaultApiFetch } from "../../../../utils/vault-api.js";
 import { capacityRoot } from "../../../capacity/ledger.js";
 import { startCapacityScheduler, } from "../../../capacity/scheduler.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
@@ -616,6 +618,35 @@ export async function runMeshDaemon(deps = {}) {
                 now,
                 onInfo: (message) => log(dir, message.slice(0, 200)),
                 random: deps.random,
+                // Channel events count only when the channel's company is in the
+                // device default or recent session company set. Unknown means drop.
+                ownerChannelScope: createOwnerChannelScope({
+                    listChannels: async () => {
+                        const res = await vaultApiFetch({
+                            token: await getToken(),
+                            path: "/v1/notify/channels",
+                            baseUrl: resolveVaultApiBase(env),
+                        });
+                        if (!res.ok)
+                            throw new Error(`channel list failed (${res.status})`);
+                        const body = (await res.json());
+                        if (!Array.isArray(body.channels))
+                            return [];
+                        return body.channels.flatMap((row) => {
+                            if (!row || typeof row !== "object")
+                                return [];
+                            const record = row;
+                            if (typeof record.channelId !== "string")
+                                return [];
+                            return [{
+                                    channelId: record.channelId,
+                                    ...(typeof record.companyUid === "string" ? { companyUid: record.companyUid } : {}),
+                                }];
+                        });
+                    },
+                    allowedCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
+                    onInfo: (message) => log(dir, message.slice(0, 200)),
+                }),
             });
         }
         catch (err) {

package/dist/lib/mesh/live/daemon/work-subscribe.d.ts

@@ -1,10 +1,13 @@
 /**
  * Contract-2 subscriber for the personal work topic.
  * Owns live-cache.json writes. Presence publish stays on PresenceClient.
+ * On a person (prs_) account it also subscribes to the owner DM topic and
+ * keeps the content-free owner-inbox-push.json counter.
  */
 import type { IClientOptions } from "mqtt";
 import type { MeshMqttEventClient } from "./mqtt-events.js";
 import { type PersonalCredentialsFetcher } from "./credentials.js";
+import { type OwnerChannelScope } from "./owner-inbox-push.js";
 export interface WorkCacheMqtt extends MeshMqttEventClient {
     subscribe(topic: string, opts: {
         qos: 0 | 1;
@@ -19,6 +22,12 @@ export type SyncWakeVaults = Record<string, {
     wakeSequence: number;
     head?: number;
 }>;
+/**
+ * Owner DM subscribe retries per connection. The owner signal is best-effort:
+ * after this many failures it stays off until the next broker reconnect, and
+ * the work topic keeps running.
+ */
+export declare const OWNER_SUBSCRIBE_MAX_RETRIES = 6;
 export declare function startWorkCacheSubscriber(opts: {
     meshRoot: string;
     fetchCredentials?: PersonalCredentialsFetcher;
@@ -32,5 +41,10 @@ export declare function startWorkCacheSubscriber(opts: {
     };
     onInfo?: (message: string) => void;
     random?: () => number;
+    /**
+     * Company filter for channel events on the owner DM topic. Without it every
+     * event that names a channel is dropped.
+     */
+    ownerChannelScope?: OwnerChannelScope;
 }): Promise<WorkCacheSubscriber>;
 //# sourceMappingURL=work-subscribe.d.ts.map

package/dist/lib/mesh/live/daemon/work-subscribe.js

@@ -1,6 +1,8 @@
 /**
  * Contract-2 subscriber for the personal work topic.
  * Owns live-cache.json writes. Presence publish stays on PresenceClient.
+ * On a person (prs_) account it also subscribes to the owner DM topic and
+ * keeps the content-free owner-inbox-push.json counter.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -10,6 +12,7 @@ import { presignIotWssUrl } from "./presign.js";
 import { applyProjectViewPush, parseProjectViewPush } from "./live-cache.js";
 import { backoffDelayMs, RECONNECT_MIN_DELAY_MS } from "./presence.js";
 import { AGENT_INBOX_PUSH_STATE_BASENAME, SYNC_WAKE_STATE_BASENAME } from "../paths.js";
+import { clearOwnerInboxPushState, parseOwnerDoorbell, readOwnerInboxPushState, writeOwnerInboxPushState, } from "./owner-inbox-push.js";
 export { AGENT_INBOX_PUSH_STATE_BASENAME, SYNC_WAKE_STATE_BASENAME } from "../paths.js";
 const INBOX_PUSH_HEARTBEAT_MS = 5_000;
 const SYNC_WAKE_KEYS = new Set(["v", "type", "vault", "head", "rootId"]);
@@ -57,6 +60,13 @@ function readVaultSequences(raw) {
     }
     return vaults;
 }
+const OWNER_SEEN_EVENT_LIMIT = 500;
+/**
+ * Owner DM subscribe retries per connection. The owner signal is best-effort:
+ * after this many failures it stays off until the next broker reconnect, and
+ * the work topic keeps running.
+ */
+export const OWNER_SUBSCRIBE_MAX_RETRIES = 6;
 function readWakeSequence(meshRoot, basename, label, onInfo) {
     const target = path.join(meshRoot, basename);
     try {
@@ -163,6 +173,39 @@ export async function startWorkCacheSubscriber(opts) {
     let syncWakeSequence = syncWakeState.sequence;
     const syncWakeVaults = { ...syncWakeState.vaults };
     const syncStateWritable = syncWakeState.writable;
+    let ownerSubscribed = false;
+    let ownerUid;
+    // Carry the owner counter forward across restarts. The file holds counts
+    // and timestamps only.
+    const priorOwnerState = readOwnerInboxPushState(opts.meshRoot, opts.onInfo);
+    let ownerKnown = priorOwnerState !== null;
+    let ownerState = {
+        connected: false,
+        heartbeatAtMs: priorOwnerState?.heartbeatAtMs ?? 0,
+        count: priorOwnerState?.count ?? 0,
+        ...(priorOwnerState?.lastAt ? { lastAt: priorOwnerState.lastAt } : {}),
+        ...(priorOwnerState?.lastType ? { lastType: priorOwnerState.lastType } : {}),
+    };
+    const seenOwnerEventIds = new Set();
+    let ownerRetryTimer = null;
+    let ownerRetryAttempt = 0;
+    // Each distinct owner subscribe failure is logged once per daemon lifetime.
+    const ownerFailuresLogged = new Set();
+    let ownerGiveUpLogged = false;
+    const clearOwnerRetry = () => {
+        if (ownerRetryTimer !== null)
+            timers.clearTimeout(ownerRetryTimer);
+        ownerRetryTimer = null;
+    };
+    const reportOwnerSubscribeFailure = (err) => {
+        // Log the error name only; the message can carry the topic and its uid.
+        const key = `${err.name}:${err.message}`;
+        if (ownerFailuresLogged.has(key))
+            return;
+        ownerFailuresLogged.add(key);
+        opts.onInfo?.(`owner inbox push subscribe failed (${err.name}); retrying with backoff, ` +
+            `up to ${OWNER_SUBSCRIBE_MAX_RETRIES} times per connection`);
+    };
     const clearInboxHeartbeat = () => {
         if (heartbeatTimer !== null)
             timers.clearTimeout(heartbeatTimer);
@@ -199,30 +242,79 @@ export async function startWorkCacheSubscriber(opts) {
     const persistSyncState = (connected, durable = true) => syncStateWritable
         ? persistState(SYNC_WAKE_STATE_BASENAME, "sync wake", connected, syncWakeSequence, undefined, durable, syncWakeVaults)
         : undefined;
+    const persistOwnerState = (connected) => {
+        if (!ownerKnown)
+            return;
+        ownerState = {
+            ...ownerState,
+            connected,
+            heartbeatAtMs: now().getTime(),
+        };
+        if (connected && ownerUid)
+            ownerState.principalUid = ownerUid;
+        else
+            delete ownerState.principalUid;
+        try {
+            writeOwnerInboxPushState(opts.meshRoot, ownerState);
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : "UnknownError";
+            opts.onInfo?.(`owner inbox push state write failed (${name})`);
+        }
+    };
     const scheduleInboxHeartbeat = () => {
-        if (stopped || (!inboxSubscribed && !syncSubscribed))
+        if (stopped || (!inboxSubscribed && !syncSubscribed && !ownerSubscribed))
             return;
         clearInboxHeartbeat();
         heartbeatTimer = timers.setTimeout(() => {
             heartbeatTimer = null;
-            if (!stopped && (inboxSubscribed || syncSubscribed)) {
+            if (!stopped && (inboxSubscribed || syncSubscribed || ownerSubscribed)) {
                 if (inboxSubscribed)
                     persistInboxState(true, false);
                 if (syncSubscribed)
                     persistSyncState(true, false);
+                if (ownerSubscribed)
+                    persistOwnerState(true);
                 scheduleInboxHeartbeat();
             }
         }, INBOX_PUSH_HEARTBEAT_MS);
     };
+    const bumpOwnerCount = (type) => {
+        ownerState = {
+            ...ownerState,
+            count: ownerState.count + 1,
+            lastAt: now().toISOString(),
+            lastType: type,
+        };
+        persistOwnerState(true);
+    };
+    const rememberOwnerEvent = (eventId) => {
+        if (!eventId)
+            return true;
+        if (seenOwnerEventIds.has(eventId))
+            return false;
+        seenOwnerEventIds.add(eventId);
+        if (seenOwnerEventIds.size > OWNER_SEEN_EVENT_LIMIT) {
+            const oldest = seenOwnerEventIds.values().next().value;
+            if (oldest !== undefined)
+                seenOwnerEventIds.delete(oldest);
+        }
+        return true;
+    };
     const connect = async () => {
         if (stopped)
             return;
         inboxSubscribed = false;
         syncSubscribed = false;
         actorUid = undefined;
+        ownerSubscribed = false;
+        ownerUid = undefined;
+        ownerRetryAttempt = 0;
+        clearOwnerRetry();
         clearInboxHeartbeat();
         persistInboxState(false);
         persistSyncState(false);
+        persistOwnerState(false);
         const gen = ++generation;
         let bundle;
         try {
@@ -241,7 +333,25 @@ export async function startWorkCacheSubscriber(opts) {
             : undefined;
         const syncTopic = syncStateWritable ? `hq/${bundle.actorUid}/sync` : undefined;
         actorUid = inboxTopic || syncTopic ? bundle.actorUid : undefined;
-        if (!topic && !inboxTopic && !syncTopic) {
+        const ownerTopic = bundle.actorUid.startsWith("prs_") &&
+            bundle.topics.dm === `hq/${bundle.actorUid}/dm`
+            ? bundle.topics.dm
+            : undefined;
+        const ownerActorUid = ownerTopic ? bundle.actorUid : undefined;
+        ownerUid = ownerActorUid;
+        if (!ownerTopic && ownerKnown) {
+            // Not a person account (or no owner DM topic): drop a file left by an
+            // earlier person login so push-status reports off rather than stale.
+            try {
+                clearOwnerInboxPushState(opts.meshRoot);
+                ownerKnown = false;
+            }
+            catch (error) {
+                const name = error instanceof Error ? error.name : "UnknownError";
+                opts.onInfo?.(`owner inbox push state clear failed (${name})`);
+            }
+        }
+        if (!topic && !inboxTopic && !syncTopic && !ownerTopic) {
             opts.onInfo?.("work cache subscribe skipped: credentials have no supported topic");
             return;
         }
@@ -257,6 +367,8 @@ export async function startWorkCacheSubscriber(opts) {
             if (stopped || gen !== generation)
                 return;
             reconnectLogged = false;
+            // The owner DM topic is best-effort and is not counted here: its failure
+            // retries on its own and never ends the connection.
             let pendingSubscriptions = Number(Boolean(topic)) + Number(Boolean(inboxTopic)) +
                 Number(Boolean(syncTopic));
             let subscriptionFailed = false;
@@ -282,6 +394,46 @@ export async function startWorkCacheSubscriber(opts) {
                 if (pendingSubscriptions === 0)
                     attempt = 0;
             };
+            if (pendingSubscriptions === 0)
+                attempt = 0;
+            const subscribeOwner = () => {
+                if (!ownerTopic)
+                    return;
+                next.subscribe(ownerTopic, { qos: 1 }, (err) => {
+                    if (stopped || gen !== generation)
+                        return;
+                    if (err) {
+                        ownerSubscribed = false;
+                        ownerUid = undefined;
+                        persistOwnerState(false);
+                        reportOwnerSubscribeFailure(err);
+                        if (ownerRetryAttempt >= OWNER_SUBSCRIBE_MAX_RETRIES) {
+                            if (!ownerGiveUpLogged) {
+                                ownerGiveUpLogged = true;
+                                opts.onInfo?.(`owner inbox push subscribe gave up after ${OWNER_SUBSCRIBE_MAX_RETRIES} retries; ` +
+                                    "owner push stays off until the next reconnect");
+                            }
+                            return;
+                        }
+                        const delay = backoffDelayMs(ownerRetryAttempt, 1000, 60_000, random, 0, RECONNECT_MIN_DELAY_MS);
+                        ownerRetryAttempt += 1;
+                        clearOwnerRetry();
+                        ownerRetryTimer = timers.setTimeout(() => {
+                            ownerRetryTimer = null;
+                            if (stopped || gen !== generation)
+                                return;
+                            subscribeOwner();
+                        }, delay);
+                        return;
+                    }
+                    ownerRetryAttempt = 0;
+                    ownerSubscribed = true;
+                    ownerKnown = true;
+                    ownerUid = ownerActorUid;
+                    persistOwnerState(true);
+                    scheduleInboxHeartbeat();
+                });
+            };
             if (topic) {
                 next.subscribe(topic, { qos: 1 }, (err) => finishSubscription(err));
             }
@@ -320,6 +472,7 @@ export async function startWorkCacheSubscriber(opts) {
                     finishSubscription();
                 });
             }
+            subscribeOwner();
         });
         next.on("message", (_topic, payload) => {
             if (stopped || gen !== generation)
@@ -344,6 +497,48 @@ export async function startWorkCacheSubscriber(opts) {
                 persistSyncState(true);
                 return;
             }
+            if (ownerTopic && _topic === ownerTopic) {
+                if (!ownerSubscribed)
+                    return;
+                // Read only type, channelId and eventId. Message text, poster name
+                // and email are never stored, logged or forwarded.
+                const doorbell = parseOwnerDoorbell(payload);
+                if (!doorbell)
+                    return;
+                if (doorbell.channelId) {
+                    const scope = opts.ownerChannelScope;
+                    if (!scope)
+                        return;
+                    if (doorbell.eventId && seenOwnerEventIds.has(doorbell.eventId))
+                        return;
+                    const channelId = doorbell.channelId;
+                    void scope
+                        .isInScope(channelId)
+                        .catch((error) => {
+                        const name = error instanceof Error ? error.name : "UnknownError";
+                        opts.onInfo?.(`owner channel scope check failed (${name})`);
+                        return false;
+                    })
+                        .then((inScope) => {
+                        if (!inScope || stopped || gen !== generation || !ownerSubscribed)
+                            return;
+                        // Record the event only once it counts, so a redelivery after a
+                        // failed or out-of-scope check is evaluated again.
+                        if (!rememberOwnerEvent(doorbell.eventId))
+                            return;
+                        bumpOwnerCount(doorbell.type);
+                    });
+                    return;
+                }
+                // A channel event must name its channel; without one its company is
+                // unknown, so it is dropped.
+                if (doorbell.type === "channel")
+                    return;
+                if (!rememberOwnerEvent(doorbell.eventId))
+                    return;
+                bumpOwnerCount(doorbell.type);
+                return;
+            }
             if (_topic !== topic)
                 return;
             const push = parseProjectViewPush(payload);
@@ -360,9 +555,13 @@ export async function startWorkCacheSubscriber(opts) {
             inboxSubscribed = false;
             syncSubscribed = false;
             actorUid = undefined;
+            ownerSubscribed = false;
+            ownerUid = undefined;
+            clearOwnerRetry();
             clearInboxHeartbeat();
             persistInboxState(false);
             persistSyncState(false);
+            persistOwnerState(false);
             opts.onInfo?.("work cache mqtt error");
             schedule();
             try {
@@ -378,9 +577,13 @@ export async function startWorkCacheSubscriber(opts) {
             inboxSubscribed = false;
             syncSubscribed = false;
             actorUid = undefined;
+            ownerSubscribed = false;
+            ownerUid = undefined;
+            clearOwnerRetry();
             clearInboxHeartbeat();
             persistInboxState(false);
             persistSyncState(false);
+            persistOwnerState(false);
             schedule();
         });
     };
@@ -408,12 +611,16 @@ export async function startWorkCacheSubscriber(opts) {
             generation += 1;
             if (timer !== null)
                 timers.clearTimeout(timer);
+            clearOwnerRetry();
             clearInboxHeartbeat();
             inboxSubscribed = false;
             syncSubscribed = false;
             actorUid = undefined;
+            ownerSubscribed = false;
+            ownerUid = undefined;
             persistInboxState(false);
             persistSyncState(false);
+            persistOwnerState(false);
             const current = client;
             client = null;
             if (!current)