@volter/supercode-teams 0.3.20 → 0.3.22

package/bin/teams.mjs

@@ -33,7 +33,7 @@ import { appendFileSync, createWriteStream, readFileSync, writeFileSync } from '
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
-import { noteStep, slowLogPath, timeCommand } from '@volter/supercode-harness-sdk/slow-log';
+import { noteStep, rotatedLogs, slowLogPath, timeCommand } from '@volter/supercode-harness-sdk/slow-log';
 
 // A Windows scheduled task keeps no output (launchd and systemd name log files), so its unit names one here.
 if (process.env.SUPERCODE_TEAMS_LOG) {
@@ -197,7 +197,7 @@ async function main() {
         return at;
       })();
       let text = '';
-      for (const file of [`${slowLogPath()}.1`, slowLogPath()]) {
+      for (const file of [...rotatedLogs(), slowLogPath()]) {
         try { text += readFileSync(file, 'utf8'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
       }
       const groups = new Map();

package/bin/workspace.mjs

@@ -16,7 +16,7 @@ import { TeamsConnector, readSyncStatus } from '../connector/index.mjs';
 import { syncStatusLines } from './workspace/sync-status.mjs';
 import { calendarCommand } from './workspace/calendar.mjs';
 import { CONTINUATION_FIDELITY, CONTINUATION_HARNESSES } from '../connector/native-continuation.mjs';
-import { MachineEvents } from '../machine-events.mjs';
+import { MachineEvents, PublishedEvents } from '../machine-events.mjs';
 import { openLocalMachine, nodeRpc } from '../client.mjs';
 import { TeamsMachine } from '../machine.mjs';
 import { teamsHome, paths } from '@volter/teams/home';
@@ -1039,6 +1039,9 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     const connector = new TeamsConnector({ server: context.origin, teamId: context.team_id, machineId: saved.machine.id, sourceId: saved.source.id, credential: saved.credential.token, stateDir: state.directory, core, largeCore, slowCore, liveCore, hostKeyId });
     // A connected machine is a person's: each pane it launches opens a window on its screen.
     const machineEvents = new MachineEvents({home:daemonHome,server:context.origin,teamId:context.team_id,credential:saved.credential.token,machineName:saved.machine.name,binary});
+    // The team's published events, one stream for this install with the connected context's credential, served to this
+    // machine's processes over the daemon's `events` door (@volter/teams/event-client reads there first).
+    if (!context.machine_only) machineEvents.published = new PublishedEvents({ supercodeHome: home, context: contextName, machineId: saved.machine.id });
     const machine = new TeamsMachine({ home: daemonHome, supercode: binary, ...(flags.tmux_socket ? { tmuxSocket: String(flags.tmux_socket) } : {}), link: { server: context.origin, teamId: context.team_id, machineId: saved.machine.id, credential: saved.credential.token, incarnationId: connector.state.incarnation_id, configuration: () => connector.configuration() }, onTurn: (turn) => connector.noteTurn(turn), onTurnWithdrawn: (turn) => connector.withdrawTurn(turn) });
     machine.machineEvents = machineEvents;
     // The machine-health probe mails as this enrolled machine (`sc:<machine>:operator:machine-health`).

package/event-client.mjs

@@ -1 +1 @@
-export { eventClient } from "@volter/teams/event-client";
+export { eventClient, retryAfterMs } from "@volter/teams/event-client";

package/machine-events.mjs

@@ -1,9 +1,13 @@
 // One retained server stream per connector. Subscriptions and pending deliveries
 // live beside the connector, so neither a restart nor a lost reply duplicates mail.
+// The team's published events are the connector's too: one stream per team install, read by this machine's own
+// processes through the daemon's `events` door (PublishedEvents), never one stream per process.
 import { mkdirSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawn } from 'node:child_process';
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
+import { fromContext } from '@volter/teams/context';
+import { retryAfterMs } from '@volter/teams/http-client';
 
 export class MachineEvents {
   constructor({home,server,teamId,credential,machineName,binary,env=process.env}) {
@@ -15,7 +19,7 @@ export class MachineEvents {
     this.abort=new AbortController();this.connected=false;
   }
   save(){const temp=`${this.file}.${process.pid}.tmp`;writeFileSync(temp,JSON.stringify(this.state)+'\n',{mode:0o600});renameSync(temp,this.file);}
-  snapshot(){return {team_id:this.teamId,connected:this.connected,cursor:this.state.cursor,items:Object.values(this.state.items),subscriptions:this.state.subscriptions,pending:this.state.pending.length,error:this.error??null};}
+  snapshot(){return {team_id:this.teamId,connected:this.connected,cursor:this.state.cursor,items:Object.values(this.state.items),subscriptions:this.state.subscriptions,pending:this.state.pending.length,error:this.error??null,published:this.published?.status()??null};}
   subscribe(address,remove=false){
     if(!/^sc:[^:\s]+:[^:\s]+:[^\s]+$/.test(address??'')||address.split(':')[1]!==this.machine)throw new Error('subscribe a full session or board address on this connector machine');
     this.state.subscriptions=this.state.subscriptions.filter(value=>value!==address);
@@ -24,20 +28,22 @@ export class MachineEvents {
     this.save();return this.snapshot();
   }
   start(){void this.follow();this.deliveryTimer=setInterval(()=>void this.flush(),5000);this.deliveryTimer.unref?.();}
-  stop(){this.abort.abort();clearInterval(this.deliveryTimer);}
+  stop(){this.abort.abort();clearInterval(this.deliveryTimer);this.published?.stop();}
   async follow(){
+    let refused=0;
     while(!this.abort.signal.aborted){
-      const streamAbort=new AbortController();
+      const streamAbort=new AbortController();let pause=5000;
       let deadline=setTimeout(()=>streamAbort.abort(new Error('machine event stream timed out')),45000);
       try{
         const suffix=this.state.cursor==null?'':`?after=${this.state.cursor}`;
         const response=await fetch(`${this.server}/api/v1/teams/${this.teamId}/machines/events${suffix}`,{headers:{Authorization:`Bearer ${this.credential}`,Accept:'text/event-stream'},redirect:'error',signal:AbortSignal.any([this.abort.signal,streamAbort.signal])});
-        if(!response.ok||!response.headers.get('content-type')?.includes('text/event-stream'))throw new Error(`machine events returned HTTP ${response.status}, expected event stream`);
+        if(!response.ok||!response.headers.get('content-type')?.includes('text/event-stream')){const body=response.ok?null:await response.json().catch(()=>null);throw Object.assign(new Error(`machine events returned HTTP ${response.status}, expected event stream`),{retryAfterMs:retryAfterMs(body?.error,response)});}
+        refused=0;
         const reader=response.body.getReader();const decoder=new TextDecoder();let buffer='';
         try{for(;;){const {value,done}=await reader.read();if(done)break;clearTimeout(deadline);deadline=setTimeout(()=>streamAbort.abort(new Error('machine event stream timed out')),45000);buffer+=decoder.decode(value,{stream:true});if(buffer.length>2*1024*1024)throw new Error('machine event exceeded stream bound');let boundary;while((boundary=buffer.indexOf('\n\n'))>=0){const frame=buffer.slice(0,boundary);buffer=buffer.slice(boundary+2);const data=frame.split('\n').filter(line=>line.startsWith('data:')).map(line=>line.slice(5).trimStart()).join('\n');if(data)await this.receive(JSON.parse(data));}}}finally{await reader.cancel().catch(()=>{});}
-      }catch(error){if(!this.abort.signal.aborted){this.failingSince??=Date.now();if(this.error!==error.message)process.stderr.write(`${new Date().toISOString()} supercode teams machine events: ${error.message} (cursor ${this.state.cursor})\n`);this.error=error.message;}}
+      }catch(error){if(error.retryAfterMs){pause=Math.min(300000,error.retryAfterMs*2**refused);refused++;}if(!this.abort.signal.aborted){this.failingSince??=Date.now();if(this.error!==error.message)process.stderr.write(`${new Date().toISOString()} supercode teams machine events: ${error.message} (cursor ${this.state.cursor})\n`);this.error=error.message;}}
       clearTimeout(deadline);this.connected=false;
-      if(!this.abort.signal.aborted)await new Promise(resolve=>{const done=()=>{clearTimeout(timer);this.abort.signal.removeEventListener('abort',done);resolve();};const timer=setTimeout(done,5000);this.abort.signal.addEventListener('abort',done,{once:true});});
+      if(!this.abort.signal.aborted)await new Promise(resolve=>{const done=()=>{clearTimeout(timer);this.abort.signal.removeEventListener('abort',done);resolve();};const timer=setTimeout(done,pause);this.abort.signal.addEventListener('abort',done,{once:true});});
     }
   }
   async receive(event){
@@ -81,3 +87,150 @@ export class MachineEvents {
     child.stdin.end(JSON.stringify({op:'send',from:`sc:${this.machine}:operator:teams-events`,from_name:'Teams machine events',to:item.to,id:item.id,queue:item.to.split(':')[2]==='board',notice:true,body:item.body}));
   });}
 }
+
+// What a local reader's cursor names: this connector's stream continuity (its epoch) and a server event sequence. A
+// cursor of another epoch, or one the ring no longer covers, is resync_required, as the server answers a stale one.
+const LOCAL_CURSOR=/^local\.([0-9a-f]{16})\.(\d+)$/;
+// The ring that resumes a reader from its cursor: the last 4096 events, at most 16 MB of them.
+const RING_EVENTS=4096,RING_BYTES=16*1024*1024;
+// A local reader with more than this waiting unread is slow, as the server counts one (sseRoom): it waits 30 s for
+// the backlog to drain, then resyncs.
+const READER_BACKLOG=8*1024*1024,READER_PATIENCE_MS=30000;
+const keyOf=event=>`${event.resource.kind}\0${event.resource.id}`;
+const sleep=(ms,signal)=>new Promise(resolve=>{const done=()=>{clearTimeout(timer);signal.removeEventListener('abort',done);resolve();},timer=setTimeout(done,ms);signal.addEventListener('abort',done,{once:true});});
+
+/**
+ * The team's published events (`team.events.follow`), followed once by this connector with the credential of the context
+ * it was connected with, and served to this machine's own readers over the daemon's `events` door with the server's
+ * frames and semantics: snapshot_begin, snapshot_item, snapshot_end, event, checkpoint, a terminal resync_required or
+ * access_revoked; a `kinds` filter as the server applies it; resume from a cursor. The stream opens with its first
+ * reader and is unfiltered, so every reader's view is exact; a reader of another credential, or of one source, is not
+ * this door's (it is refused, and reads the server itself).
+ */
+export class PublishedEvents {
+  constructor({supercodeHome,context,machineId=null,log=message=>process.stderr.write(`${new Date().toISOString()} supercode teams published events: ${message}\n`)}){
+    Object.assign(this,{supercodeHome,contextName:context,machineId,log});
+    this.abort=new AbortController();this.started=false;this.readers=new Set();this.catalogue=null;this.error=null;
+    // The stream's state: the server cursor it resumes from, each resource's latest event, and the recent events.
+    this.cursor=null;this.epoch=null;this.live=false;this.pending=null;this.resources=new Map();this.ring=[];this.ringBytes=0;this.head=0;this.floor=0;
+  }
+  selected(){return fromContext({supercodeHome:this.supercodeHome,name:this.contextName,fetch:globalThis.fetch});}
+  /** Whether a follow is this connector's to serve exactly: its server, team and credential, every source. */
+  serves(params){
+    let context;try{context=this.selected().context;}catch{return false;}
+    return !context.machine_only&&params.server_id===context.server_id&&params.team_id===context.team_id&&params.credential_ref===context.credential_ref&&params.source==null
+      &&(params.kinds==null||Array.isArray(params.kinds)&&params.kinds.length>0&&params.kinds.every(kind=>typeof kind==='string'&&/^[a-z_]+\.[a-z_]+$/.test(kind)))
+      &&(params.after==null||typeof params.after==='string');
+  }
+  status(){return {context:this.contextName,connected:this.live,epoch:this.epoch,head:this.head,resources:this.resources.size,ring:this.ring.length,readers:this.readers.size,error:this.error};}
+  serve(stream,accept,refuse){
+    const params=stream.params??{};
+    if(!this.serves(params))return refuse('this connector does not follow published events for that credential');
+    accept();
+    const kinds=params.kinds==null?null:new Set(params.kinds);
+    const reader={stream,kinds,resources:kinds&&new Set([...kinds].map(kind=>kind.split('.')[0])),after:params.after??null,at:0,ready:false,admitting:false};
+    this.readers.add(reader);stream.on('close',()=>this.readers.delete(reader));
+    this.start();
+    if(this.live)void this.admit(reader);
+  }
+  start(){if(this.started)return;this.started=true;void this.follow();}
+  stop(){this.abort.abort();for(const reader of this.readers)reader.stream.close('connector stopped');this.readers.clear();}
+  async follow(){
+    let refused=0;
+    while(!this.abort.signal.aborted){
+      let pause=5000;
+      try{
+        const {client,context}=this.selected();client.machine=this.machineId;
+        const team=client.team(context.team_id);
+        this.catalogue??=new Set((await team.events.catalogue({signal:this.abort.signal})).data.kinds);
+        for await(const frame of team.events.follow({},{signal:this.abort.signal,after:this.cursor??undefined})){refused=0;this.receive(frame);if(frame.terminal)break;}
+        this.error='event stream ended';
+      }catch(error){
+        // Refused for load, it waits out the server's retry_after, doubling while refused (to 5 min), cursor kept.
+        const asked=retryAfterMs(error);if(asked){pause=Math.min(300000,asked*2**refused);refused++;}
+        if(error.status===409){this.cursor=null;this.reset('resync_required','upstream_resync');}
+        if(!this.abort.signal.aborted){const message=`${error.code??'error'}: ${error.message}`;if(message!==this.error)this.log(`${message}${asked?` (retrying in ${Math.round(pause/1000)} s)`:''}`);this.error=message;}
+      }
+      this.down(this.error??'event stream ended');
+      if(!this.abort.signal.aborted)await sleep(pause,this.abort.signal);
+    }
+  }
+  receive(frame){
+    if(frame.type==='snapshot_begin'){if(this.epoch)this.reset('resync_required','upstream_resync');this.pending=new Map();return;}
+    if(frame.type==='snapshot_item'){(this.pending??this.resources).set(keyOf(frame.data),{key:keyOf(frame.data),sequence:frame.sequence,data:frame.data});return;}
+    if(frame.type==='snapshot_end'){
+      this.resources=this.pending??new Map();this.pending=null;this.cursor=frame.cursor;
+      this.head=0;for(const item of this.resources.values())this.head=Math.max(this.head,item.sequence);
+      this.floor=this.head;this.ring=[];this.ringBytes=0;this.epoch=randomBytes(8).toString('hex');this.up();return;
+    }
+    if(frame.type==='event'){
+      this.cursor=frame.cursor;if(!this.epoch||frame.sequence<=this.head)return;
+      const key=keyOf(frame.data),old=this.resources.get(key);
+      if(!old||old.sequence<frame.sequence)this.resources.set(key,{key,sequence:frame.sequence,data:frame.data});
+      const bytes=JSON.stringify(frame.data).length;this.ring.push({sequence:frame.sequence,data:frame.data,bytes});this.ringBytes+=bytes;this.head=frame.sequence;
+      while(this.ring.length>RING_EVENTS||this.ringBytes>RING_BYTES){const dropped=this.ring.shift();this.ringBytes-=dropped.bytes;this.floor=dropped.sequence;}
+      if(!this.live){this.up();return;}
+      for(const reader of this.readers)if(reader.ready){reader.at=frame.sequence;if(this.wants(reader,frame.data))this.put(reader,{type:'event',sequence:frame.sequence,cursor:this.local(frame.sequence),data:frame.data});}
+      return;
+    }
+    if(frame.type==='checkpoint'){
+      this.cursor=frame.cursor;if(!this.epoch)return;
+      if(!this.live){this.up();return;}
+      for(const reader of this.readers)if(reader.ready)this.put(reader,{type:'checkpoint',cursor:this.local(this.head)});
+      return;
+    }
+    if(frame.terminal){this.cursor=null;this.reset(frame.type==='access_revoked'?'access_revoked':'resync_required',frame.reason??'upstream');}
+  }
+  local(sequence){return `local.${this.epoch}.${sequence}`;}
+  wants(reader,event){return !reader.kinds||reader.kinds.has(event.kind);}
+  // As the server's snapshot: a resource whose kind a subscribed kind names, or whose latest event is a subscribed kind.
+  inSnapshot(reader,event){return !reader.kinds||reader.resources.has(event.resource.kind)||reader.kinds.has(event.kind);}
+  up(){this.live=true;this.error=null;for(const reader of this.readers)if(!reader.ready&&!reader.admitting)void this.admit(reader);}
+  // The stream dropped: readers it was serving are let go (not told to resync) and resume from their cursors once it
+  // is back; a reader still waiting for it waits on.
+  down(message){this.live=false;for(const reader of [...this.readers])if(reader.ready||reader.admitting){this.readers.delete(reader);reader.stream.close(`unavailable: ${message}`);}}
+  // The stream's continuity ended (a new snapshot, a revoked credential): every reader's cursor is void.
+  reset(type,reason){this.epoch=null;this.live=false;for(const reader of [...this.readers])this.terminal(reader,type,reason);}
+  terminal(reader,type,reason){this.readers.delete(reader);if(reader.stream.closed)return;try{reader.stream.write(JSON.stringify({type,reason,terminal:true}));}catch{}reader.stream.close(type);}
+  put(reader,frame){
+    if(reader.stream.closed)return false;
+    if((reader.stream.channel?.socket?.writableLength??0)>READER_BACKLOG){this.terminal(reader,'resync_required','slow_reader');return false;}
+    try{reader.stream.write(JSON.stringify(frame));return true;}catch{return false;}
+  }
+  async write(reader,frame){
+    const socket=reader.stream.channel?.socket;
+    if(socket&&socket.writableLength>READER_BACKLOG/2){
+      const drained=await new Promise(resolve=>{const done=ok=>{clearTimeout(timer);socket.off('drain',ready);socket.off('close',gone);resolve(ok);},ready=()=>done(true),gone=()=>done(false),timer=setTimeout(()=>done(false),READER_PATIENCE_MS);socket.on('drain',ready);socket.on('close',gone);});
+      if(!drained){this.terminal(reader,'resync_required','slow_reader');return false;}
+    }
+    return this.put(reader,frame);
+  }
+  async admit(reader){
+    const epoch=this.epoch;reader.admitting=true;
+    try{
+      if(reader.kinds&&this.catalogue&&[...reader.kinds].some(kind=>!this.catalogue.has(kind))){this.readers.delete(reader);reader.stream.close('invalid_request: invalid event subscription');return;}
+      if(reader.after==null){
+        const items=[...this.resources.values()].filter(item=>this.inSnapshot(reader,item.data)).sort((a,b)=>a.key<b.key?-1:a.key>b.key?1:0);
+        reader.at=this.head;
+        if(!await this.write(reader,{type:'snapshot_begin'}))return;
+        for(const item of items){if(this.epoch!==epoch)return this.terminal(reader,'resync_required','upstream_resync');if(!await this.write(reader,{type:'snapshot_item',sequence:item.sequence,data:item.data}))return;}
+        if(this.epoch!==epoch)return this.terminal(reader,'resync_required','upstream_resync');
+        if(!await this.write(reader,{type:'snapshot_end',cursor:this.local(reader.at)}))return;
+      }else{
+        const match=LOCAL_CURSOR.exec(reader.after),at=match?Number(match[2]):NaN;
+        if(!match||match[1]!==epoch||at<this.floor||at>this.head)return this.terminal(reader,'resync_required','cursor');
+        reader.at=at;
+      }
+      // Catch up from the ring, then go live: the last step does not wait, so no event falls between the two.
+      for(;;){
+        if(this.epoch!==epoch||reader.at<this.floor)return this.terminal(reader,'resync_required','retention');
+        let low=0,high=this.ring.length;while(low<high){const mid=(low+high)>>1;if(this.ring[mid].sequence<=reader.at)low=mid+1;else high=mid;}
+        const next=this.ring[low];if(!next)break;
+        reader.at=next.sequence;
+        if(this.wants(reader,next.data)&&!await this.write(reader,{type:'event',sequence:next.sequence,cursor:this.local(next.sequence),data:next.data}))return;
+      }
+      if(!this.live||reader.stream.closed)return;
+      reader.ready=true;this.put(reader,{type:'checkpoint',cursor:this.local(this.head)});
+    }finally{reader.admitting=false;}
+  }
+}

package/machine.mjs

@@ -15,6 +15,7 @@
 //   stream "product"   a target another product serves here (products.mjs), admitted first
 //   stream "exec" | "sftp" | "exec-server"   operators: a pilot's tool process or file view
 //   stream "workspace" operators: a project leaving or arriving
+//   stream "events"    local callers only: the team's published events from the one stream the connector holds
 //
 // Two doors reach it. The LOCAL door is an owner-only Unix socket in the home:
 // whoever can open it is this OS user, an operator. The REMOTE door is the
@@ -267,6 +268,14 @@ export class TeamsMachine extends MachineCore {
     for (const name of ['exec', 'sftp', 'exec-server']) this.registerDoor(name, (entry, stream, accept, refuse) => this.#serveExecution(entry, stream, accept, refuse));
     this.registerDoor('workspace', (entry, stream, accept, refuse) => this.#serveWorkspace(entry, stream, accept, refuse));
     this.registerDoor('mail', (entry, stream, accept, refuse) => this.#serveMail(entry, stream, accept, refuse));
+    // This machine's processes read the team's published events here, from the one stream its connector holds
+    // (machine-events.mjs PublishedEvents); a caller it refuses reads the server itself.
+    this.registerDoor('events', (entry, stream, accept, refuse) => {
+      if (entry.principal !== 'local') return refuse('published events are served to this machine\'s own processes');
+      const published = this.machineEvents?.published;
+      if (!published) return refuse('this daemon is not a connector following published events');
+      return published.serve(stream, accept, refuse);
+    });
   }
 
   // ---- lifecycle ------------------------------------------------------------
@@ -808,8 +817,12 @@ export class TeamsMachine extends MachineCore {
     // A reused pane key still gets a new receipt baseline. A late hook from
     // its previous process cannot publish evidence for this launch.
     const binding = join(dir, `${pane}-${randomBytes(9).toString('base64url')}.json`);
-    const initialInput = params.initialInput && !args.includes('--') &&
-      !args.some((arg) => arg === '--remote' || arg.startsWith('--remote=')) ? params.initialInput : null;
+    // Claude records an argv prompt verbatim when it runs at once, but trimmed
+    // when it queues behind work restored on resume (a pending task
+    // notification). Sending the trimmed text makes both records equal it.
+    const prompt = params.kind === 'claude-code' && typeof params.initialInput === 'string' ? params.initialInput.trim() : params.initialInput;
+    const initialInput = prompt && !args.includes('--') &&
+      !args.some((arg) => arg === '--remote' || arg.startsWith('--remote=')) ? prompt : null;
     writeFileSync(binding, JSON.stringify({ kind: params.kind, pane, by, program: params.program, arguments: args, initialInput }), { mode: 0o600 });
     if (initialInput) nativeInput({ binding, kind: params.kind, text: initialInput, startedAt: Date.now() });
     const claudeCommand = (next) => launchCommand(params.program, initialInput ? [...next, '--', initialInput] : next);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -66,7 +66,7 @@
     "@volter/supercode-health": "^0.1.0",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/supercode-trace": "^0.1.0",
-    "@volter/teams": "0.2.11",
+    "@volter/teams": "0.2.12",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",

package/server/event-routes.mjs

@@ -3,21 +3,18 @@ import { appAuthentication } from '@volter/teams/server/apps';
 import { createHash } from 'node:crypto';
 import { validateListQuery } from '../contracts/index.mjs';
 import { cursorHash, cursorToken, liveBindings } from './catalog.mjs';
-import { sseRoom, writeSse } from '@volter/teams/server/events';
+import { sseRoom, writeSse, holdStream } from '@volter/teams/server/events';
 
-function openStream(api, req, res, auth, requestId, fail) {
-  const count = api.openStreams.get(auth.credential_id) ?? 0;
-  if (count >= 10) fail(429, 'rate_limited', 'too many open event streams', { retry_after_seconds: 1 });
-  api.openStreams.set(auth.credential_id, count + 1);
+// Counted per team install (holdStream): a refusal names the server's retry-after, never a tight retry.
+async function openStream(api, req, res, auth, requestId) {
+  const release = await holdStream(api, auth, req);
   let closed = false;
   const cleanups = [];
   const close = () => {
     if (closed) return;
     closed = true;
     for (const cleanup of cleanups) cleanup();
-    const next = (api.openStreams.get(auth.credential_id) ?? 1) - 1;
-    if (next > 0) api.openStreams.set(auth.credential_id, next);
-    else api.openStreams.delete(auth.credential_id);
+    release();
     res.end();
   };
   req.once('close', close);
@@ -124,7 +121,7 @@ export async function handleSessionEvents({ api, req, res, auth, id, url, reques
     ]);
     if (delivered > team.journal_revision || delivered < team.journal_revision && (retained.first_revision === null || delivered < retained.first_revision - 1)) fail(409, 'resync_required', 'event cursor is outside retained journal');
   }
-  const stream = openStream(api, req, res, auth, requestId, fail);
+  const stream = await openStream(api, req, res, auth, requestId);
   if (after === null && !await stream.write({ type: 'snapshot', cursor: initial.event_cursor, revision: initial.revision, data: initial })) return;
   const enqueue = streamQueue(stream, async () => {
     if(!auth.bound&&!await appAuthentication(api,auth))fail(401,'authentication_required','app authorization changed');
@@ -221,7 +218,7 @@ export async function handleCatalogEvents({ api, req, res, auth, url, requestId,
   const query = qobj(url); delete query.after;
   validateListQuery(query);
   if (query.cursor) fail(400, 'invalid_request', 'catalog streams use current windows, not page cursors');
-  const stream = openStream(api, req, res, auth, requestId, fail);
+  const stream = await openStream(api, req, res, auth, requestId);
   let lastCursor = null;
   const enqueue = streamQueue(stream, async () => {
     const page = await catalogWindow(api, auth, query);

package/server/harness-routes.mjs

@@ -440,7 +440,7 @@ async function captureCommit(api,req,res,auth,sourceId,captureId,requestId){cons
  */
 async function viewBindingRoute(api,req,res,auth,ref,requestId){
   if(!['user','service'].includes(auth.kind))fail(403,'forbidden','credential cannot bind sessions');
-  const session=await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref,now:api.clock.nowMs()});
+  const session=await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref,now:api.clock.nowMs(),forInstaller:true});
   const list=async()=>api.store.query('SELECT issuer,room,conversation,bound_by,created_at FROM session_view_bindings WHERE team_id=? AND session_id=? ORDER BY created_at',[auth.team_id,session.id]);
   if(req.method==='GET'){
     const bindings=await list();

package/server/store-core.mjs

@@ -28,7 +28,7 @@ export function createStoreHandlers({ all, get, run, tx }) {
     const {teamId,principalId,credentialId,ref,now,bound}=args;
     // `bound`: a workplace's session-view token ({issuer, room, conversation, expiresAt}), which reads only a
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
-    let membership=null,appFence=null,grantSource=null,agentGrantSource=null,agentReader=false;
+    let membership=null,appFence=null,grantSource=null,agentGrantSource=null,agentReader=false,installerFor=null;
     if((args.delegationDepth??0)>16)domainError(401,'authentication_required','delegation lineage is too deep');
     if(bound){
       if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.id=? AND i.created_at=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer,bound.installationId,bound.installedAt]))domainError(401,'authentication_required','integration was uninstalled');
@@ -38,11 +38,15 @@ export function createStoreHandlers({ all, get, run, tx }) {
       membership=get('SELECT role FROM memberships WHERE team_id=? AND principal_id=? AND active=1',[teamId,principalId]);
       const identity=get(`SELECT i.state,a.state app_state,m.active,m.role FROM identity_app_credentials c JOIN app_installations i ON i.id=c.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.installer_id WHERE c.credential_id=?`,[credentialId]);
       if(identity&&(identity.state!=='active'||identity.app_state!=='active'||!identity.active||!['owner','admin'].includes(identity.role)))domainError(401,'authentication_required','identity integration revoked');
-      const app=get('SELECT ac.*,i.state,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
+      const app=get('SELECT ac.*,i.state,i.installer_id,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
       if(app){
         if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');
         if(get(APP_LINEAGE_REVOKED,[credentialId,now]))domainError(401,'authentication_required','delegation authority revoked');
         appFence=JSON.parse(app.grants_json);
+        // `forInstaller` (the view-binding route only): an app its installer consented to `sessions.access` reaches the
+        // installer's own sessions to bind them, as that route already lets it act for them (ADR 0034). Every other read,
+        // a transcript, its messages and events, keeps the ordinary grants.
+        if(args.forInstaller&&appFence===null&&JSON.parse(app.actions_json).includes('sessions.access'))installerFor=app.installer_id;
         if(appFence!==null)grantSource=get('SELECT id,principal_id FROM credentials WHERE id=?',[app.subject_credential_id??app.parent_id]);
       }
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
@@ -72,6 +76,7 @@ export function createStoreHandlers({ all, get, run, tx }) {
       const readable=bound?Boolean(get('SELECT 1 ok FROM session_view_bindings WHERE team_id=? AND session_id=? AND issuer=? AND room=? AND conversation=?',[teamId,root.id,bound.issuer,bound.room,bound.conversation]))&&family.every(session=>session.deleted_at==null):family.every(session=>{
         if(session.deleted_at!=null)return false;
         if(!appGrantAllows({app_grants:appFence},'session',session.id,'sessions.read'))return false;
+        if(installerFor&&session.custodian_id===installerFor)return true;
         if(appFence!==null){
           if(!grantSource)return false;
           try{authorizedSession({teamId,principalId:grantSource.principal_id,credentialId:grantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}