fix(workspace): reuse directory authority for context reads

Author: lefarcen

apps/daemon/src/collab/vela-workspace-context.ts

@@ -77,6 +77,8 @@ const PROVIDER_MODES = new Set<WorkspaceProviderMode>(['platform_credits', 'pers
 interface VelaWorkspaceContextOptions {
   /** Injectable for tests. */
   fetch?: typeof fetch;
+  /** Reuse the daemon's account-scoped directory authority broker. */
+  fetchWorkspaceDirectory?: () => Promise<WorkspaceDirectoryFetchResult>;
   /** Injectable for tests; defaults to reading ~/.amr/config.json + env. */
   readSession?: typeof readVelaControlApiContext;
   /** Settings-backed AMR environment used by the daemon's agent launcher. */
@@ -230,9 +232,19 @@ export function createVelaWorkspaceContextProvider(
   const fetchImpl = options.fetch ?? fetch;
   const readSession = options.readSession ?? readVelaControlApiContext;
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  type VelaSession = NonNullable<ReturnType<typeof readVelaControlApiContext>>;
   const configuredEnv = () => typeof options.configuredEnv === 'function'
     ? options.configuredEnv()
     : (options.configuredEnv ?? {});
+  const readWorkspaceDirectory = (
+    session: VelaSession,
+    selectedEnv: Record<string, string>,
+  ) => options.fetchWorkspaceDirectory?.() ?? fetchVelaWorkspaceDirectory({
+    fetch: fetchImpl,
+    readSession: () => session,
+    configuredEnv: selectedEnv,
+    timeoutMs,
+  });
 
   /** Pick the best default membership out of an already-fetched directory list. */
   function selectDefaultCandidate(
@@ -269,12 +281,7 @@ export function createVelaWorkspaceContextProvider(
     const session = readSession(process.env, selectedEnv);
     if (!session || !session.controlKey || !session.apiUrl) return null;
     try {
-      const directory = await fetchVelaWorkspaceDirectory({
-        fetch: fetchImpl,
-        readSession: () => session,
-        configuredEnv: selectedEnv,
-        timeoutMs,
-      });
+      const directory = await readWorkspaceDirectory(session, selectedEnv);
       // A failed directory read confirms nothing. In particular, never evict
       // the local pin on a timeout, auth outage, or non-2xx response.
       if (!directory.ok) return null;
@@ -323,12 +330,7 @@ export function createVelaWorkspaceContextProvider(
     const workspaceId = req.workspaceId.trim();
     if (!session || !session.controlKey || !session.apiUrl || !workspaceId) return null;
     try {
-      const directory = await fetchVelaWorkspaceDirectory({
-        fetch: fetchImpl,
-        readSession: () => session,
-        configuredEnv: selectedEnv,
-        timeoutMs,
-      });
+      const directory = await readWorkspaceDirectory(session, selectedEnv);
       if (!directory.ok) return null;
       const item = directory.items.find(
         (entry) =>
@@ -906,7 +908,11 @@ export function createWorkspaceContextProviderFromEnv(
   env: NodeJS.ProcessEnv = process.env,
   options: Pick<
     VelaWorkspaceContextOptions,
-    'configuredEnv' | 'getActiveWorkspaceId' | 'setLocalSelection' | 'clearLocalSelection'
+    | 'configuredEnv'
+    | 'fetchWorkspaceDirectory'
+    | 'getActiveWorkspaceId'
+    | 'setLocalSelection'
+    | 'clearLocalSelection'
   > = {},
 ): WorkspaceContextProvider {
   if (env.OD_WORKSPACE_CONTEXT_SOURCE?.trim() === 'vela') {

apps/daemon/src/server.ts

@@ -3436,6 +3436,7 @@ export async function startServer({
   const workspaceContext = withLastKnownWorkspaceContext(
     createWorkspaceContextProviderFromEnv(process.env, {
       configuredEnv: configuredAmrEnv,
+      fetchWorkspaceDirectory,
       getActiveWorkspaceId: () => activeWorkspace.get(),
       setLocalSelection: (workspaceId: string) => activeWorkspace.set(workspaceId),
       // Only called after the membership directory CONFIRMS the pinned

apps/daemon/tests/vela-workspace-context.test.ts

@@ -1126,6 +1126,33 @@ describe('createVelaWorkspaceContextProvider explicit local scope', () => {
     expect(context?.planId).toBeNull();
   });
 
+  it('routes current and exact reads through the injected directory authority broker', async () => {
+    const fetchWorkspaceDirectory = vi.fn(async () => ({
+      ok: true as const,
+      items: [B_DIRECTORY_ITEM],
+    }));
+    const directFetch = vi.fn(async () => {
+      throw new Error('direct directory fetch must stay behind the broker');
+    }) as unknown as typeof fetch;
+    const provider = createVelaWorkspaceContextProvider({
+      fetch: directFetch,
+      fetchWorkspaceDirectory,
+      readSession: () => SESSION,
+      getActiveWorkspaceId: () => B_DIRECTORY_ITEM.workspaceId,
+    });
+
+    await expect(provider.current({})).resolves.toMatchObject({
+      workspaceId: B_DIRECTORY_ITEM.workspaceId,
+    });
+    await expect(provider.resolveExact?.({
+      workspaceId: B_DIRECTORY_ITEM.workspaceId,
+    })).resolves.toMatchObject({
+      workspaceId: B_DIRECTORY_ITEM.workspaceId,
+    });
+    expect(fetchWorkspaceDirectory).toHaveBeenCalledTimes(2);
+    expect(directFetch).not.toHaveBeenCalled();
+  });
+
   it('does not bootstrap when the directory returns 401', async () => {
     const fetchImpl = vi.fn(async () => jsonResponse(401, { error: 'unauthenticated' })) as unknown as typeof fetch;
     const provider = createVelaWorkspaceContextProvider({ fetch: fetchImpl, readSession: () => SESSION });

apps/web/src/components/EntryNavRail.tsx

@@ -469,8 +469,8 @@ export type WorkspaceInviteTarget =
  * Direct invites and billing recovery are separate capabilities. A Personal
  * Free owner (or a full Team owner) can still enter Vela's upgrade/seat flow
  * without direct invite capability, but an admin never acquires billing power
- * from role alone. Unknown seat state fails closed until the context refresh
- * supplies an authoritative answer.
+ * from role alone. Unknown capacity remains usable for a member with explicit
+ * invite permission; the invite API is still the authority if the plan is full.
  */
 export function canAccessWorkspaceInviteFlow(
   context: WorkspaceCollabContext | null | undefined,
@@ -494,25 +494,37 @@ export function canAccessWorkspaceInviteFlow(
   if (context.workspaceType === 'personal') return canInviteMembers;
 
   const isSeatFull = workspaceSeatFull(context);
-  if (isSeatFull === undefined) return false;
+  if (isSeatFull === undefined) return canInviteMembers;
   if (!isSeatFull) return canInviteMembers;
   return context.role === 'owner' && canManageBilling;
 }
 
 function workspaceSeatFull(
   context: WorkspaceCollabContext,
 ): boolean | undefined {
+  // Directory-derived contexts use 0/0 because the removed account-global
+  // context projection no longer supplies seat accounting. That pair means
+  // unknown, not a proven zero-seat plan. Explicit invite permission may still
+  // open the form; the invite API remains the capacity authority.
+  if (
+    context.seatSummary?.seatLimit === 0
+    && context.seatSummary.usedSeats === 0
+  ) {
+    return undefined;
+  }
   const availableSeats = context.seatSummary?.availableSeats;
   if (availableSeats !== undefined) return availableSeats <= 0;
   return context.seatSummary?.isSeatFull;
 }
 
 /**
- * Chooses the first safe invite surface. The local form is only valid when a
- * team is positively known to have direct invite capability and capacity.
- * Personal, Free-plan, and full-seat owner states go to Vela, whose dashboard
- * owns the authoritative upgrade/seat/invite decision. Missing routing or seat
- * data fails closed.
+ * Chooses the first safe invite surface. The local form requires direct invite
+ * capability and no proof that the team is already full; unknown capacity is
+ * resolved by the invite API when the form is submitted.
+ * Personal, Free-plan, and proven full-seat owner states go to Vela, whose
+ * dashboard owns the authoritative upgrade/seat/invite decision. Unknown seat
+ * data stays on the local permission-gated flow and lets the invite API return
+ * an authoritative capacity result.
  */
 export function resolveWorkspaceInviteTarget(
   context: WorkspaceCollabContext | null | undefined,
@@ -525,7 +537,7 @@ export function resolveWorkspaceInviteTarget(
   if (
     context.workspaceType === 'team' &&
     !needsTeamUpgrade &&
-    workspaceSeatFull(context) === false &&
+    workspaceSeatFull(context) !== true &&
     context.permissions.canInviteMembers === true
   ) {
     return { kind: 'local' };

apps/web/tests/components/EntryNavRail.invite-seat-gate.test.tsx

@@ -144,11 +144,35 @@ describe('EntryNavRail workspace-switcher invite target (recvqgbyLNk4eE)', () =>
     expect(openSpy).not.toHaveBeenCalled();
   });
 
-  it('fails closed while the team seat state is unknown', () => {
+  it('keeps the permission-gated local invite when team seat state is unknown', () => {
+    const openSpy = vi.spyOn(window, 'open').mockReturnValue(null);
     renderRail(teamContextWithUnknownSeats());
 
     fireEvent.click(screen.getByTestId('workspace-switcher'));
-    expect(menu().queryByRole('menuitem', { name: /邀请同事/ })).toBeNull();
+    fireEvent.click(menu().getByRole('menuitem', { name: /邀请同事/ }));
+
+    expect(screen.getByRole('dialog')).toBeTruthy();
+    expect(openSpy).not.toHaveBeenCalled();
+  });
+
+  it('treats the directory-derived zero/zero seat sentinel as unknown', () => {
+    const openSpy = vi.spyOn(window, 'open').mockReturnValue(null);
+    const context = teamContext(3);
+    renderRail({
+      ...context,
+      role: 'admin',
+      seatSummary: { seatLimit: 0, usedSeats: 0, availableSeats: 0, isSeatFull: true },
+      permissions: {
+        ...context.permissions,
+        canManageBilling: false,
+      },
+    } as WorkspaceCollabContext);
+
+    fireEvent.click(screen.getByTestId('workspace-switcher'));
+    fireEvent.click(menu().getByRole('menuitem', { name: /邀请同事/ }));
+
+    expect(screen.getByRole('dialog')).toBeTruthy();
+    expect(openSpy).not.toHaveBeenCalled();
   });
 
   it('hides the invite entry when neither local capacity nor a safe Vela URL exists', () => {