openvisio-agent 0.19.12 → 0.20.0

package/src/ws.mjs

@@ -1,7 +1,7 @@
 // The backend agent WebSocket — a BYO agent's real-time event channel. Connects
 // to the org's API Gateway WS with the agent's api_key + identifier (NOT a JWT),
 // keeps the connection warm with keepalives, auto-reconnects with backoff, and
-// hands targeted dispatches (task:assigned / agent:mention) to a callback.
+// hands targeted dispatches and verified organization fanout to a callback.
 //
 // Uses the built-in global WebSocket (Node >= 21). Zero dependencies — see
 // `assertWebSocket` for the version guard.
@@ -9,6 +9,7 @@
 // Docs: agent-websocket.md
 //   wss://<api-gw>.execute-api.<region>.amazonaws.com/<stage>/?api_key=…&identifier=…
 //   client → { "type": "keepalive" }         (refreshes last_seen_at)
+//   client → { "type": "subscribe", "organization_id": 3 } (verified profile only)
 //   server → { "k": "<kind>", "d": <payload> }
 
 import { stripSlash } from './lib.mjs'
@@ -45,6 +46,14 @@ export function connectAgentWs({ wsUrl, apiKey, identifier, onEvent, onConnect,
   let reconnectTimer = null
   let backoff = BACKOFF_MIN_MS
   let closed = false // set once .close() is called — stops reconnects
+  let organizationId = null
+  let subscribedOrganizationId = null
+
+  const subscribe = () => {
+    if (closed || organizationId == null || !ws || ws.readyState !== 1 || subscribedOrganizationId === organizationId) return
+    try { ws.send(JSON.stringify({ type: 'subscribe', organization_id: organizationId })); subscribedOrganizationId = organizationId }
+    catch { /* the retained organization is retried on reconnect */ }
+  }
 
   const clearKeepalive = () => { if (keepalive) { clearInterval(keepalive); keepalive = null } }
 
@@ -65,6 +74,8 @@ export function connectAgentWs({ wsUrl, apiKey, identifier, onEvent, onConnect,
     sock.addEventListener('open', () => {
       if (sock !== ws) return
       backoff = BACKOFF_MIN_MS // healthy connection → reset the backoff ramp
+      subscribedOrganizationId = null
+      subscribe()
       log(`connected as @${identifier}`)
       try { onConnect && onConnect() } catch { /* reconciliation is best-effort */ }
       clearKeepalive()
@@ -99,6 +110,14 @@ export function connectAgentWs({ wsUrl, apiKey, identifier, onEvent, onConnect,
   open()
 
   const api = {
+    // Call only with organization identity read from the authenticated agent's
+    // own profile, never an incoming message or an arbitrary project record.
+    subscribeOrganization(value) {
+      if (closed || !((typeof value === 'number' || (typeof value === 'string' && /^\d+$/.test(value))) && Number.isSafeInteger(Number(value)) && Number(value) > 0)) return false
+      organizationId = Number(value)
+      subscribe()
+      return true
+    },
     /** Fire-and-forget send (no-op if the socket isn't open). */
     send(obj) { try { if (ws && ws.readyState === 1) ws.send(JSON.stringify(obj)) } catch { /* closing */ } },
     close() {