samagotchi 0.112.0 → 0.113.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd818cf8fcf56a7040bdf84299d75a547b2031eb7bea13a1fdb087d12ed051d0
-  data.tar.gz: 27890e5a3913053d11b5240c66f335ac66e0c5b4e55a9c0410b7a885ec9319d3
+  metadata.gz: fc980123c32fef67a2b47defad94735286ba983537b227ba79961cf6b15f1f1a
+  data.tar.gz: 5768a7d054c2a36abd746b6a19b7126fa6e992915bbae6040d2990b1903754bf
 SHA512:
-  metadata.gz: 44e69d35e152608b949071ca95d22367115c8524c284378a1e854ab98636e40f8f53bd5644bd816bfa903a2f3125e3c09a2f297999d4c251ee1bed6bf7a10e52
-  data.tar.gz: d47e33d2b044590f507f3f551b179c60aa848e11ca79c9543d3f1af2a4b199f9ffee9bfa590488f66a0b439c65e7600a05c4c2caa335b4c26534782929d6c89e
+  metadata.gz: 906dcb1ea43aeb750b201f75ef585648c609c89e77b0a8ff2bc06e11aa06ece5bec4b7734a1ecff888099952c90e7898c1dc91d64fbe52b4ddbbf102ddefff3a
+  data.tar.gz: 05a0edaf338b7a33bb3ffa73a4b590bff8498d789004c12c3f85a7e52ccb2516c4a58c332ae7fb203b9e04131fb36d1b5bb8c1f0f2fc2373e03ef6ded9ccd366

data/CHANGELOG.md

@@ -8,6 +8,29 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.113.0] - 2026-10-25
+
+### Added
+
+- chi web: in the phone's Home Screen app the bell opens a notifications sheet: this device's switch, then every
+  device chi web pushes to with its last delivery, a "Long turns done" switch each and Remove; devices from an
+  earlier address are one line.
+- `chi web push ls|rm ID|test [ID]`: list the phones chi web pushes to, remove one, or send a test notification,
+  from the terminal (chi web need not run; never prints a push address or keys).
+
+### Fixed
+
+- chi web behind an auth proxy: a browser on this machine opening `127.0.0.1:<port>` got the token page with a paste
+  box that cannot work there (loopback takes the token as `Authorization: Bearer` only, so no cookie is traded); the
+  401 page now says chi web opens at its public address and links it, and the API's 401 detail says the same.
+- `chi web --tunnel tailscale`: a Ctrl-C while it turned Tailscale Serve on left port 443 forwarding to chi web's port
+  after it exited, and a second Ctrl-C during the teardown could cut it short with 443 still on: both now wait for the
+  command and turn 443 off.
+- `chi web --tunnel tailscale` turns Tailscale Serve on only once chi web has bound its port: a program that took the
+  port between the free-port check and the bind was reachable from the tailnet until chi web gave up.
+
+Update with `chi update` (the system bundle 0.113.0), then restart `chi web`.
+
 ## [0.112.0] - 2026-10-25
 
 ### Added
@@ -4291,7 +4314,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.112.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.113.0...HEAD
+[0.113.0]: https://github.com/dm1try/samagotchi/compare/v0.112.0...v0.113.0
 [0.112.0]: https://github.com/dm1try/samagotchi/compare/v0.111.1...v0.112.0
 [0.111.1]: https://github.com/dm1try/samagotchi/compare/v0.111.0...v0.111.1
 [0.111.0]: https://github.com/dm1try/samagotchi/compare/v0.110.0...v0.111.0

data/bin/chi

@@ -97,6 +97,14 @@ if (path, klass = SUBCOMMANDS[ARGV[0]])
   exit Samagotchi.const_get(klass).new(ARGV[1..] || []).run
 end
 
+# `chi web push ls|rm|test`: this machine's Web Push devices. Not a
+# SUBCOMMANDS key: `chi web` itself is RunOptions' (and a remote's refusal
+# came above: chi web runs on this machine only).
+if ARGV[0] == "web" && ARGV[1] == "push"
+  require "samagotchi/push_command"
+  exit Samagotchi::PushCommand.new(ARGV[2..]).run
+end
+
 # `chi scratch`: the run options below, for a session that leaves nothing
 # behind (TerminalUI scratch:). The word goes before OptionParser sees it.
 scratch = ARGV[0] == "scratch"

data/docs/cli.md

@@ -14,6 +14,7 @@
 - `chi web [--port 4567] [--open] [--scope=all]` — start the Web UI (single localhost port session control plane) on this git project's sessions (`--scope=all`, or a folder in no repo: every session); if a chi web already runs on the port, print (with `--open`, open) its page for this folder and exit. Something else on the port (an older chi web too) exits 1 with "port N is in use"
 - `chi web --web-host lan` — the Web UI on your home network too, for your phone: a link with an access token and its QR code (see [chi web on your phone](#chi-web-on-your-phone)); `chi web --new-token` replaces the token
 - `chi web --tunnel tailscale` — the Web UI over https on your tailnet, for your phone anywhere: Tailscale Serve (never Funnel) on this machine's `<machine>.<tailnet>.ts.net` name for this run, the owner your Tailscale login, turned off on exit (see [Tailscale Serve](configuration.md#tailscale-serve-your-tailnet)); `--tunnel` without `web` exits 2
+- `chi web push ls [--format json]`, `chi web push rm ID`, `chi web push test [ID]` — the phones chi web pushes to (see [Phone notifications](configuration.md#phone-notifications-web-push)): list them (short id, label, origin, added, last delivery, done turns, last error; `stale` for one made on another public URL than chi web's now: never sent to), remove one, or send a test notification to ID or to every device not stale. chi web need not run; nothing printed holds a device's push address or keys. A usage error exits 2; a store others can read, a corrupt one, an unknown device or a failed test push exit 1. This machine only: `chi --remote X web push` exits 2
 - `chi web --web-markdown` — opt in to sanitized Markdown rendering for completed assistant messages, the stage's asking text and a resolved question card's reply
 - `chi web --web-view turn` — draw turns with the turn view (each turn as one block of steps, the running one at the bottom of the history) instead of the default stage view (the running turn pinned above the composer); `?view=stage|turn` on the page URL overrides it (see [Web views](#web-views))
 - `chi web --no-web-working-set` — turns the stage view's working set off (on by default; `--web-working-set` turns a config's `web.working_set: false` back on): what each turn brought into the model's context, in the stage and under each finished turn; `?working_set=1|0` on the page URL overrides it (see [The working set](#the-working-set))
@@ -1179,8 +1180,9 @@ access token", paste the token there (the part of the link after
   name on your tailnet (Tailscale Serve) for its run and prints its link's QR
   code; see [Tailscale Serve](configuration.md#tailscale-serve-your-tailnet).
 - Notifications on the phone, also while chi web isn't open there: on the tunnel's https link, Add to Home Screen,
-  open the Chi app and tap its bell; approvals and questions then push to the phone (see
-  [Phone notifications](configuration.md#phone-notifications-web-push)).
+  open the Chi app, tap its bell and turn on **This device**; approvals, questions and failed turns then push to the
+  phone. The same sheet lists the other devices (a long-turns-done switch each, Remove), and `chi web push ls|rm|test`
+  does it from the Mac (see [Phone notifications](configuration.md#phone-notifications-web-push)).
 
 ### Remote sessions
 

data/docs/configuration.md

@@ -1618,7 +1618,8 @@ What changes once `web.public_url` is set:
   its defaults) would otherwise look like this machine. On this machine the page opens through the proxy too: a
   request that didn't come through it takes the token only as `Authorization: Bearer` (no cookie: a cookie for
   127.0.0.1 would go to every server on any local port; a phone on the LAN, with `web.host: lan`, keeps its LAN link
-  and cookie). chi's own probe of the port (a second `chi web`, `chi share`,
+  and cookie). A browser on this machine that opens the port directly gets a 401 page with no paste box: it links
+  `web.public_url`, the address to open instead. chi's own probe of the port (a second `chi web`, `chi share`,
   `chi update`) sends no token; chi web answers it the few fields it checks. Links and the start line come from this
   machine's config, never from whatever answers on the port.
 - **A request through the proxy** (it carries `X-Forwarded-For`, `Forwarded`, `X-Real-IP`, a known identity header,
@@ -1733,8 +1734,9 @@ Tailnet Lock is off: a device Tailscale's servers add to your tailnet could reac
 ```
 
 - It checks before it changes anything: Tailscale is connected, this machine has its `ts.net` name and a certificate
-  for it, and what Serve already has on port 443. Nothing there: it runs
-  `tailscale serve --bg --https=443 http://127.0.0.1:<port>`. Exactly that one handler for this port (a leftover of an
+  for it, and what Serve already has on port 443. Nothing there: once chi web has bound its port (so Serve never
+  forwards your tailnet to another program that took the port first), it runs
+  `tailscale serve --bg --https=443 http://127.0.0.1:<port>`, then prints its lines. Exactly that one handler for this port (a leftover of an
   earlier run killed hard, or step 3 done by hand): it adopts it. Anything else on 443 (another port, other paths, TCP
   forwarding, Funnel) is refused and left alone. Serve's other ports are never touched.
 - The owner is `web.proxy.owner` if config.yml has it, else this machine's own Tailscale login (a tagged machine has
@@ -1742,7 +1744,9 @@ Tailnet Lock is off: a device Tailscale's servers add to your tailnet could reac
   config.yml: a `web.public_url` or `web.proxy.identity_header` that says otherwise (in config.yml or the environment)
   is refused, so a config from step 4 with this machine's name works as it is.
 - On exit (Ctrl-C, a kill, closing the terminal) it runs `tailscale serve --https=443 off`, but only while 443 still
-  serves exactly what it set; if you changed 443 meanwhile it leaves it and says so. Killed hard (`kill -9`, a power
+  serves exactly what it set; if you changed 443 meanwhile it leaves it and says so. A Ctrl-C while it turns Serve on
+  or off waits for that command (at most 15 s each) and the teardown still runs; a teardown that fails is one warning
+  line. Killed hard (`kill -9`, a power
   loss) the serve stays on: Serve answers 502 for the name while nothing listens on the port, and whatever later
   listens on 127.0.0.1:<port> is reachable from your tailnet; the next `chi web --tunnel tailscale` adopts it and
   turns it off on exit, a plain `chi web` doesn't look.
@@ -1784,9 +1788,17 @@ What it needs:
 - No Apple account or registration: chi web signs its pushes with a key of its own (VAPID).
 
 Turning it on, on the phone: open the `Proxied:` link in Safari → Share → **Add to Home Screen** → open the **Chi**
-app → tap the **bell** at the top → Allow. A test notification arrives at once. Tap the
-bell again to turn it off on that phone. In a browser tab the bell stays the tab's own notifications (while the tab
-is in the background), as before.
+app → tap the **bell** at the top → turn on **This device** in the sheet → Allow. A test notification arrives at once.
+In a browser tab the bell stays the tab's own notifications (while the tab is in the background), as before.
+
+**The devices** (the bell's sheet in the app; a bottom sheet on the phone): this device first, with its switch (off
+removes it from chi web and is the same as the bell turned off), then every other device chi web pushes to: its label,
+the last delivery and the last error, a **Long turns done** switch each, and **Remove** (it can turn its bell on again
+to come back). Devices made on an earlier public URL show as one line ("1 more device from an earlier address"): they
+are never sent to; `chi web push rm ID` removes them. From the Mac: `chi web push ls` lists them, `chi web push test
+[ID]` sends a test notification, `chi web push rm ID` removes one ([CLI](cli.md)). A device iOS dropped silently still
+shows a recent delivery (Apple keeps accepting pushes for it): if one stops getting notifications, switch it off and on
+there; the new subscription replaces the dead one.
 
 - **What is sent**: the session's name and the reason ("needs approval", "needs an answer", "hit its step limit",
   "needs you", "turn failed", "done in N s"), never the question or the command, as the tab's notification on the
@@ -1798,8 +1810,7 @@ is in the background), as before.
 - **When**: the same things the tab notifies for, still open 3 s after they came (3.5 s for a delegated child's
   approval, which its parent may relay instead); one push each. A delegated child's failed or finished turn is its
   parent's to report. **Done turns** (10 s or longer, or one nobody started: a delegate's report, a context change, a
-  finished task) are **off** by default, per device; the switch comes with the devices list (for now:
-  `PATCH /api/push/subscriptions/ID {"prefs": {"done": true}}`, the id from `GET /api/push`'s `devices`).
+  finished task) are **off** by default, per device: the **Long turns done** switch in the devices sheet turns them on.
 - **Quiet while you look**: nothing is pushed while any chi web page (a tab on the Mac, or the app) is in front and
   was touched in the last 2 minutes; what came meanwhile is never pushed later (the page has it). A page left in
   front untouched stops quieting the phone after about 2 minutes.

data/docs/internals/web-push.md

@@ -4,8 +4,8 @@ chi web pushes to the owner's phone when a session needs them, for what the tab
 question, a step-limit question, a card with actions, a failed turn, and (per device, off by default) a done one. The
 phone runs chi web as a Home Screen app (iOS 16.4+), its bell subscribes the device, and chi web, the only sender,
 pushes through the device's push service (Apple's `web.push.apple.com`). The user side is in
-[configuration.md](../configuration.md#phone-notifications-web-push). This page is how it is built (P1 and P2a of the
-plan; the devices list in the page and `chi web push` come later).
+[configuration.md](../configuration.md#phone-notifications-web-push). This page is how it is built (P1, P2a and P2b of the
+plan: P2b is the devices sheet and `chi web push`).
 
 ```
 SessionHub ──emit──▶ Notifier#call(event) ──Queue──▶ sender thread
@@ -55,6 +55,8 @@ files, one per machine, never in config.yml:
   endpoint's SHA-256: the only name of a device outside the store. `Sub#public_h` (id, label, origin, the dates,
   `last_error`, `prefs: {done:}`) and `#inspect` never carry the endpoint or the keys; neither do the log lines.
   `prefs` is `{"done": false}` until `Store#set_prefs(id, done:, origin:)` (the PATCH route) sets it; `Sub#done?`.
+  `Store#remove_device(id, origin:)` removes by short id only on that origin (nil: any; the DELETE route, `chi web
+  push rm`); `#subscriptions!` is `#subscriptions` that raises `Corrupt` instead of reading none (the CLI says so).
 - `sent.json`: `{"version": 1, "keys": {KEY: iso time}}`, the attention keys already handled (a device took the
   show, or it was skipped while a page was in front, or capped), written by `Store#mark_sent` under `store.lock`,
   keys older than a day (`SENT_KEEP`) pruned on each write. `Store#sent_keys` reads it; one that doesn't read is
@@ -201,7 +203,10 @@ public URL, or `web.push.enabled: false`):
 - `POST /api/push/subscriptions {subscription: {endpoint, keys}, replaces?: id}` → 201 `{id, label}`; the label is
   chi's own ("iPhone · <date>", from the User-Agent's device class: iPhone, iPad, Mac, else Browser); `replaces`
   drops the device's earlier entry (`Store#add`).
-- `DELETE /api/push/subscriptions {endpoint}` → 204.
+- `DELETE /api/push/subscriptions {endpoint}` → 204: this device's bell turned off.
+- `DELETE /api/push/subscriptions/ID` → 204, 404 `unknown_device` (another origin's, or not a short id); logs
+  `push_removed`. The devices sheet's Remove for another device; this device's own row never uses it (its switch is
+  the bell, so the page's state and the store stay one).
 - `PATCH /api/push/subscriptions/ID {prefs: {done: true|false}}` → 200 the device's `Sub#public_h`; 404
   `unknown_device` (not this origin's, or not a short id: the id is a `([^/]+)` capture checked in the handler, as
   `participant_gate_spec`'s `path_for` fills only those), 400 `invalid_prefs`; logs `push_prefs`. ROUTES' first
@@ -209,7 +214,8 @@ public URL, or `web.push.enabled: false`):
 - `POST /api/push/presence {page, front}` → 204 (also with push off: a desk tab has nothing to be told), 400
   `invalid_presence`.
 - `POST /api/push/test {endpoint?}` → a test push to that device or every one on this origin, answered per device
-  (`{devices: [{id, label, status, code, ms}]}`); the bell sends one after subscribing.
+  (`{devices: [{id, label, status, code, ms}]}`); the bell sends one after subscribing. The payload is
+  `Push::TEST_PAYLOAD` (TTL `TEST_TTL`), shared with `chi web push test`.
 
 With push off the subscription writes and the test answer 409 `push_off`.
 
@@ -240,6 +246,24 @@ a test push; a tap when on unsubscribes and deletes, and forgets the id, unless
 delete (revoked meanwhile): then the id stays for the next subscribe to replace. The tab's own OS notification is left to the push there; the title count stays. In a browser tab, or with
 chi web not pushing, the bell is the in-tab one, unchanged (no duplicate desktop pushes).
 
+**The devices sheet** (`public/push_devices.js`, `createPushDevices` on `chip_popover.js`'s shell: a bottom sheet
+under 600 px, else a popover at the bell; made once chi web says it pushes, so a tab never gets one): in push mode
+the bell's tap opens it (`toggleNotify` → `sheet.toggle()`), and it reads `GET /api/push?endpoint=` on each open.
+This device's row has the switch, the bell's own `togglePush` (permission from that tap; off forgets
+`PUSH_DEVICE_KEY`), never Remove; every device has a **Long turns done** switch (`PATCH …/ID {prefs: {done}}`),
+another device Remove (`DELETE …/ID`); `GET`'s `stale` is one line. One change at a time, the list read again after
+each; a failure is said in the sheet (and the bell's tooltip). Pure `deviceRows` / `staleText` / `sheetModel` /
+`sheetTemplate` run under node (push_devices.test.js); notifications.js takes the sheet as a `devices` factory.
+
+**`chi web push`** (`lib/samagotchi/push_command.rb`, `PushCommand`): `ls [--format json]`, `rm ID`, `test [ID]` on
+this machine's `Store` directly (chi web need not run). "Stale" is another origin than
+`PushCommand.current_origin`: the running chi web's (`Web::Running.live_public_url`), else `web.public_url`'s, none
+marked when neither. `test` builds a `Client` per device (`Push.load_key`, `Push.contact(sub.origin)`), stamps the
+delivery (`Store#mark`) and removes a `:gone` device, as the route does. bin/chi branches on `ARGV[0..1] == web
+push` after the `SUBCOMMANDS` dispatch and before `RunOptions.parse` (which refuses a stray word after `web`); it is
+no `SUBCOMMANDS` key (`web` is RunOptions', and the contract spec would want a TABLE/MACHINE entry). `chi --remote X
+web push …` is refused before that by `SessionAccess::Dispatch` (`web` is local only).
+
 **The device's tidy-up** (`syncDevice`, the Home Screen app with the bell on): closes the shown notifications whose
 tag is a waiting key (`push.js isWaitingTag`, so `chi:test` and a failed or done turn's stay) and isn't open in the
 page's `byId` (`push.js openPushKeys`: `Attention.open_keys`'s rule), and sets or clears the app

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.112.0
+version: 0.113.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/push_command.rb

@@ -0,0 +1,188 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require_relative "cli/command"
+require_relative "cli/exit"
+require_relative "cli/flags"
+require_relative "config"
+require_relative "web/push"
+require_relative "web/running"
+
+module Samagotchi
+  # `chi web push`: this machine's Web Push devices (Web::Push::Store),
+  # without chi web running: list them, remove one, send a test push.
+  # Never prints an endpoint or keys: a device is its short id and chi's
+  # label. bin/chi branches here on `web push` before RunOptions (which
+  # would refuse the word); `chi --remote X web push` is refused before
+  # that (chi web runs on this machine only). See docs/cli.md.
+  class PushCommand
+    include CLI::Command
+
+    USAGE = <<~TEXT
+      Usage: chi web push <ls|rm|test> [options]
+        ls [--format json]   the devices chi web pushes to: id, label, origin, added, last delivery,
+                             last error, done turns; "stale" for another origin's (never sent to)
+        rm ID                remove a device (it turns the bell on again to come back)
+        test [ID]            a test push to ID, or to every device not stale (chi web need not run)
+      A device is added by the bell in the phone's Home Screen app (docs/configuration.md, Phone notifications).
+    TEXT
+
+    SUBCOMMANDS = %w[ls rm test].freeze
+
+    FLAGS = {
+      "ls" => CLI::Flags.new(help: HELP_WORDS) { |f| f.value "--format" },
+      "rm" => CLI::Flags.new(help: HELP_WORDS),
+      "test" => CLI::Flags.new(help: HELP_WORDS)
+    }.freeze
+
+    # @param store [Web::Push::Store, nil] this machine's by default
+    # @param origin [#call] → the public origin chi web runs on now (the
+    #   running one's, else web.public_url's), nil when neither
+    # @param client [#call, nil] (sub) → a Client for its origin; one
+    #   signed with the store's key by default
+    def initialize(argv, stdout: $stdout, stderr: $stderr, store: nil, origin: nil, client: nil)
+      @argv = argv.dup
+      @stdout = stdout
+      @stderr = stderr
+      @store = store || Web::Push::Store.new
+      @origin = origin || -> { PushCommand.current_origin }
+      @client = client
+    end
+
+    # The running chi web's https origin (a --tunnel's too), else
+    # web.public_url's; nil when neither.
+    def self.current_origin
+      Web::Running.live_public_url&.origin || Web::PublicUrl.from_config(url: Config.get("web.public_url"))&.origin
+    rescue Web::PublicUrl::Invalid
+      nil
+    end
+
+    # @return [Integer] 0 done, 1 refused (a store others can read, a
+    #   corrupt one, an unknown device, a failed test), 2 usage
+    def run
+      @sub = @argv[0]
+      if @sub.nil? || HELP_WORDS.include?(@sub)
+        @stdout.puts(USAGE)
+        return 0
+      end
+      return usage_error("unknown subcommand #{@sub}") unless SUBCOMMANDS.include?(@sub)
+
+      parsed = parse_flags(FLAGS.fetch(@sub), @argv[1..])
+      return parsed if parsed.is_a?(Integer)
+
+      send(:"run_#{@sub}", parsed.options, parsed.args)
+    rescue Web::Push::Store::Insecure, Web::Push::Store::Corrupt, Web::Push::Refused => e
+      error_line("#{command_name}: #{e.message}")
+      CLI::Exit::FAILED
+    end
+
+    private
+
+    def command_name = @sub && SUBCOMMANDS.include?(@sub) ? "chi web push #{@sub}" : "chi web push"
+    def usage_on_error = nil
+
+    def run_ls(options, args)
+      return usage_error("ls takes no arguments") unless args.empty?
+
+      format = options[:format]
+      return usage_error("unknown format #{format.inspect}: use --format text|json") unless [nil, "text", "json"].include?(format)
+
+      subs = devices
+      origin = @origin.call
+      if format == "json"
+        @stdout.puts(JSON.generate(subs.map { |sub| sub.public_h.merge(stale: stale?(sub, origin)) }))
+      elsif subs.empty?
+        @stdout.puts("no devices (turn the bell on in the phone's Home Screen app)")
+      else
+        print_table(subs, origin)
+      end
+      0
+    end
+
+    def run_rm(_options, args)
+      return usage_error("give one device ID (chi web push ls)") unless args.size == 1
+
+      devices
+      id = args.first
+      gone = Web::Push::Store.short_id?(id) && @store.remove_device(id)
+      return no_device(id) unless gone
+
+      @stdout.puts("#{gone.id}  #{gone.label}  removed")
+      0
+    end
+
+    def run_test(_options, args)
+      return usage_error("give at most one device ID (chi web push ls)") if args.size > 1
+
+      subs = devices
+      if args.empty?
+        origin = @origin.call
+        subs = subs.reject { |sub| stale?(sub, origin) }
+        if subs.empty?
+          error_line("#{command_name}: no device to push to (chi web push ls)")
+          return CLI::Exit::FAILED
+        end
+      else
+        subs = subs.select { |sub| sub.id == args.first }
+        return no_device(args.first) if subs.empty?
+      end
+      results = subs.map { |sub| test(sub) }
+      results.all? ? 0 : CLI::Exit::FAILED
+    end
+
+    # One test push, its line printed; a :gone device is removed (as the
+    # route does). @return [Boolean] delivered
+    def test(sub)
+      result = client_for(sub).deliver(sub, Web::Push::TEST_PAYLOAD, ttl: Web::Push::TEST_TTL, urgency: "high")
+      words = "#{result.status} #{result.code}#{" (#{result.ms} ms)" if result.ms}"
+      words += ": #{result.error}" if result.error && !result.ok?
+      if result.status == :gone
+        @store.remove(sub.id)
+        words += ": removed (the push service no longer knows it)"
+      else
+        @store.mark(sub.id, ok: result.ok?, error: result.ok? ? nil : (result.error || result.code))
+      end
+      @stdout.puts("#{sub.id}  #{sub.label}  #{words}")
+      result.ok?
+    end
+
+    def client_for(sub)
+      return @client.call(sub) if @client
+
+      Web::Push::Client.new(key: Web::Push.load_key(@store), contact: Web::Push.contact(sub.origin))
+    end
+
+    # The store's devices, after its permission check.
+    def devices
+      @store.check_permissions!
+      @store.subscriptions!
+    end
+
+    def no_device(id)
+      error_line("#{command_name}: no device #{id[0, 16]} (chi web push ls)")
+      CLI::Exit::FAILED
+    end
+
+    # Stale: made on another origin than chi web's now; none is when that
+    # isn't known.
+    def stale?(sub, origin) = !origin.nil? && sub.origin != origin
+
+    def print_table(subs, origin)
+      rows = subs.map do |sub|
+        [sub.id, sub.label.to_s, sub.origin.to_s, when_text(sub.created_at), when_text(sub.last_ok_at) || "never",
+         sub.done? ? "on" : "off", [stale?(sub, origin) ? "stale" : nil, sub.last_error].compact.join(", ")]
+      end
+      rows.unshift(["ID", "LABEL", "ORIGIN", "ADDED", "LAST OK", "DONE", "NOTE"])
+      widths = rows.transpose.map { |column| column.map(&:length).max }
+      rows.each { |row| @stdout.puts(row.zip(widths).map { |cell, width| cell.ljust(width) }.join("  ").rstrip) }
+    end
+
+    # An iso time as local "YYYY-MM-DD HH:MM"; nil for none.
+    def when_text(iso)
+      iso && Time.iso8601(iso).localtime.strftime("%Y-%m-%d %H:%M")
+    rescue ArgumentError
+      iso
+    end
+  end
+end

data/lib/samagotchi/run_options.rb

@@ -154,6 +154,7 @@ module Samagotchi
                  chi bootstrap [HOST[:PORT]|URL]  first setup: find the model server, write config.yml
                  chi scratch [options]            a one-time session in this terminal: nothing is kept
                  chi web [--port PORT] [--open] [--scope=all]   the web UI
+                 chi web push <ls|rm|test>        the phones chi web pushes notifications to
                  chi sessions <list|stop|restart|archive|unarchive|delete|prune|clean|stats>
                  chi note [--source NAME] [-m TEXT] ID...|--all   background context for sessions
                  chi broadcast [-m TEXT] [--all] [--dry-run] | log | deliver   a note for every session it may concern

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.112.0"
+  VERSION = "0.113.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -273,6 +273,7 @@ module Samagotchi
         ["DELETE", %r{\A/api/push/subscriptions\z}, :handle_push_unsubscribe, :owner],
         # The id checked in the handler (participant_gate_spec fills ([^/]+) captures only).
         ["PATCH", %r{\A/api/push/subscriptions/([^/]+)\z}, :handle_push_prefs, :owner],
+        ["DELETE", %r{\A/api/push/subscriptions/([^/]+)\z}, :handle_push_remove, :owner],
         ["POST", %r{\A/api/push/test\z}, :handle_push_test, :owner],
         ["POST", %r{\A/api/push/presence\z}, :handle_push_presence, :owner],
         ["GET", %r{\A/api/sessions/([^/]+)\z}, :handle_show, :participant, :session],
@@ -617,16 +618,58 @@ module Samagotchi
         log_refused(refused_peer(req), req.path_info, reason)
         return error_response(401, "unauthorized", unauthorized_detail(req, reason)) if req.path_info.start_with?("/api/")
 
-        body = @public_url ? PUBLIC_UNAUTHORIZED_PAGE : UNAUTHORIZED_PAGE
+        body = unauthorized_page(req)
         [401, { "Content-Type" => "text/html; charset=utf-8", "Content-Length" => body.bytesize.to_s, "Cache-Control" => "no-store" },
          [body]]
       end
 
+      # Which page a refused page request gets: the LAN page with no
+      # web.public_url, the proxy page for a request that came through it,
+      # and for a browser on this machine the one pointing at the public
+      # address (#direct_public?): there the paste box can't help.
+      def unauthorized_page(req)
+        return direct_public_page if direct_public?(req)
+        return PUBLIC_UNAUTHORIZED_PAGE if @public_url
+
+        UNAUTHORIZED_PAGE
+      end
+
+      # A browser on this machine, with web.public_url set: the gate refuses
+      # it like every other request, and no trade can fix it here — loopback
+      # takes the token as Bearer only, so there is no cookie for it to keep
+      # (a cookie for 127.0.0.1 reaches every server on any local port). The
+      # page says where to open chi web instead. The origin is this machine's
+      # config, not a secret; it is escaped all the same, and no token or
+      # link code is in it.
+      def direct_public_page
+        origin = CGI.escapeHTML(@public_url.origin)
+        <<~HTML
+          <!doctype html>
+          <html lang="en"><head><meta charset="utf-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1">
+          <title>chi web: open it at its public address</title>
+          <style>
+            :root { color-scheme: light dark; }
+            body { font: 16px/1.5 -apple-system, system-ui, sans-serif; max-width: 30rem; margin: 3rem auto; padding: 0 1rem; }
+            a { color: inherit; }
+          </style></head>
+          <body>
+          <h1>chi web</h1>
+          <p>chi web is behind an access proxy, so every request needs its access token, this machine's too.
+          A browser here can't trade a token for a cookie on 127.0.0.1, so this page can't let you in: open
+          chi web at its public address instead.</p>
+          <p><a href="#{origin}/">#{origin}/</a></p>
+          <p>chi web prints a link to it in its terminal every time it starts.</p>
+          </body></html>
+        HTML
+      end
+
       def unauthorized_detail(req, reason)
         return "chi web behind the proxy: #{reason || "needs its access token"}" if proxied?(req)
-        return "chi web with web.public_url needs its access token, on this machine too" if @public_url
+        return "chi web on the LAN needs its access token" unless @public_url
 
-        "chi web on the LAN needs its access token"
+        detail = "chi web with web.public_url needs its access token, on this machine too"
+        direct_public?(req) ? "#{detail}; open its public address #{@public_url.origin}/ instead" : detail
       end
 
       # Who a refusal is logged as: the peer, or behind a proxy (every peer

data/lib/samagotchi/web/public/index.html

@@ -1183,6 +1183,37 @@ body.has-session.composer-folded #infoBar{border-top-color:transparent}
 .pp-foot{display:flex;align-items:center;gap:8px;justify-content:flex-end;padding-top:4px}
 .pp-view{font-size:12px;color:var(--accent);text-decoration:none}
 .pp-view:hover{text-decoration:underline}
+/* The Home Screen app's notifications sheet (push_devices.js): the bell opens it; a bottom sheet on a phone. */
+.push-devices .ctx-pop-head strong{font-family:inherit}
+.push-devices.sheet{border-radius:14px;padding:14px 16px;font-size:14px}
+.pd-list{list-style:none;display:flex;flex-direction:column;gap:8px;margin:2px 0;padding:0}
+.pd-row{display:grid;grid-template-columns:1fr auto;align-items:center;gap:2px 10px;padding:8px 10px;border-radius:10px;background:var(--bg-inset)}
+.pd-who{display:flex;align-items:center;gap:6px;min-width:0;color:var(--text)}
+.pd-who b{font-weight:600;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.pd-tag{font-size:10.5px;padding:0 6px;border-radius:999px;background:var(--accent-bg);color:var(--accent);white-space:nowrap}
+.pd-act{grid-column:2;grid-row:1/3;display:flex;align-items:center}
+.pd-meta{grid-column:1;font-size:11.5px;color:var(--text-muted)}
+.pd-error{color:var(--danger-text)}
+.pd-done{grid-column:1/3;display:flex;align-items:center;justify-content:space-between;gap:8px;margin-top:4px;padding-top:6px;border-top:1px solid var(--border);font-size:12px;color:var(--text-3)}
+.pd-remove{padding:3px 10px;border-radius:7px;font-size:12px;background:var(--bg-raised);color:var(--danger-text);border:1px solid var(--border-strong);cursor:pointer}
+.pd-remove:hover{color:var(--text-hover)}
+.pd-switch{appearance:none;-webkit-appearance:none;position:relative;flex-shrink:0;width:34px;height:20px;margin:0;border-radius:999px;background:var(--bg-raised);border:1px solid var(--border-strong);cursor:pointer;transition:background .15s}
+.pd-switch::after{content:"";position:absolute;top:2px;left:2px;width:14px;height:14px;border-radius:50%;background:var(--text-muted);transition:transform .15s,background .15s}
+.pd-switch:checked{background:var(--accent-strong);border-color:var(--accent-strong)}
+.pd-switch:checked::after{transform:translateX(14px);background:var(--on-solid)}
+.pd-switch:disabled{opacity:.5;cursor:default}
+.pd-switch:focus-visible{outline:2px solid var(--accent-ring);outline-offset:2px}
+.pd-done .pd-switch{width:30px;height:18px}
+.pd-done .pd-switch::after{width:12px;height:12px}
+.pd-done .pd-switch:checked::after{transform:translateX(12px)}
+.pd-note{font-size:11.5px;color:var(--text-muted)}
+.pd-note.pd-error{color:var(--danger-text)}
+.push-devices.sheet .pd-switch{width:42px;height:26px}
+.push-devices.sheet .pd-switch::after{width:20px;height:20px}
+.push-devices.sheet .pd-switch:checked::after{transform:translateX(16px)}
+.push-devices.sheet .pd-done{font-size:13px}
+.push-devices.sheet .pd-meta,.push-devices.sheet .pd-note{font-size:12.5px}
+.push-devices.sheet .pd-remove{padding:6px 12px;font-size:13px}
 .ctx-pop-head{display:flex;align-items:baseline;gap:8px}
 .ctx-pop-head strong{font-family:ui-monospace,monospace;color:var(--text-bright)}
 .ctx-pop-kind{font-size:11px;color:var(--text-muted)}

data/lib/samagotchi/web/public/notifications.js

@@ -12,7 +12,9 @@
 // leaves the bell as it is in a tab. With the bell on, the app also tidies
 // the device (syncDevice): it closes the pushed notifications whose
 // question or card isn't open any more and sets the app's badge, as chi
-// web sends no close push (WebKit's silent-push quota).
+// web sends no close push (WebKit's silent-push quota). There the bell
+// opens the notifications sheet (push_devices.js): this device's switch,
+// the other devices with their "long turns done" switch and Remove.
 //
 // Every page, in a tab or the app, also tells chi web whether the user is
 // at it (POST /api/push/presence, reportPresence): chi web pushes nothing
@@ -30,6 +32,7 @@ import {
 import {
   isWaitingTag, openPushKeys, pushSupported, subscribe as pushSubscribe, unsubscribe as pushUnsubscribe,
 } from "./push.js";
+import { createPushDevices } from "./push_devices.js";
 
 export const NOTIFY_KEY = "chi_notify";
 // The device id chi web gave this app's subscription (POST subscribe's
@@ -53,8 +56,8 @@ const NOTIFY_TITLES = {
 };
 
 const PUSH_TITLES = {
-  on: "Notifications to this phone: on (a session that needs you or failed, also while the app is closed). Tap to turn off",
-  off: "Notify this phone when a session needs you or a turn fails, also while the app is closed",
+  on: "Notifications to this phone: on (a session that needs you or failed, also while the app is closed). Tap for the devices",
+  off: "Notify this phone when a session needs you or a turn fails, also while the app is closed. Tap to turn it on",
   denied: "Notifications are blocked for this app in the phone's settings",
 };
 
@@ -108,6 +111,8 @@ function defaultChannel() {
 // @param sendPresence (body, leaving) => void (presenceSender's by default)
 // @param every (fn, ms) => void, a repeating timer (presence's tick)
 // @param pageId this page load's id in its presence reports
+// @param devices (hooks) => the notifications sheet ({toggle, refresh}),
+//   made once chi web says it pushes (push_devices.js by default)
 // @return {noticeSessions(type, data), noticeList(sessions), setBaseTitle(title), clearBadge()}
 export function createNotifications({
   button,
@@ -124,12 +129,15 @@ export function createNotifications({
   sendPresence = presenceSender({ nav, api }),
   every = (fn, ms) => setInterval(fn, ms),
   pageId = randomTabId(),
+  devices = (hooks) => createPushDevices({ ...hooks, doc, win }),
 }) {
   let attention = initialAttentionState();
   // Web Push in the Home Screen app: null until chi web says it pushes
   // ({reg, key, on}), and for good in a tab or without push.
   let push = null;
   let pushBusy = false;
+  // The notifications sheet the bell opens in push mode.
+  let sheet = null;
   let syncing = null;
   let syncAgain = false;
   // When this page last had the browser check for a newer sw.js.
@@ -186,7 +194,7 @@ export function createNotifications({
   }
 
   async function toggleNotify() {
-    if (push) return togglePush();
+    if (push) return sheet?.toggle();
     const state = notifyState();
     if (state === "unsupported" || state === "denied") return;
     let wanted = state !== "on";
@@ -197,10 +205,11 @@ export function createNotifications({
     renderNotifyBtn();
   }
 
-  // This device's subscription on (permission from the tap: iOS asks only
-  // from one), a test push to show it works; or off.
+  // This device's subscription on (permission from the tap on the sheet's
+  // switch: iOS asks only from one), a test push to show it works; or off.
+  // @return the failure's message, or null
   async function togglePush() {
-    if (pushBusy || notifyState() === "denied") return;
+    if (pushBusy || notifyState() === "denied") return null;
     pushBusy = true;
     let failed = null;
     try {
@@ -228,8 +237,9 @@ export function createNotifications({
       pushBusy = false;
     }
     renderNotifyBtn();
-    // Said on the bell (its tooltip); the next tap tries again.
+    // Said on the bell (its tooltip) and in the sheet; the next tap tries again.
     if (failed) button.title = `Notifications to this phone failed: ${failed}`;
+    return failed && `Notifications to this phone failed: ${failed}`;
   }
 
   // The Home Screen app: its service worker, chi web's key, and whether
@@ -243,6 +253,10 @@ export function createNotifications({
       const info = await api("GET", `/api/push${query}`);
       if (!info?.enabled || !info.public_key) return;
       push = { reg, key: info.public_key, on: !!(sub && info.this) };
+      sheet = devices({
+        button, api, state: notifyState, toggleThis: togglePush,
+        endpoint: async () => (await push.reg.pushManager.getSubscription())?.endpoint || null,
+      });
       // register() has just checked for a newer sw.js.
       swCheckedAt = now();
       renderNotifyBtn();

data/lib/samagotchi/web/public/push_devices.js

@@ -0,0 +1,187 @@
+// The Home Screen app's notifications sheet (Web Push; notifications.js
+// opens it from the bell when chi web pushes): this device's switch (the
+// bell's subscribe / unsubscribe), then every device chi web pushes to from
+// this origin (GET /api/push's devices): its label, "this device", the last
+// delivery and the last error, a "Long turns done" switch (PATCH
+// /api/push/subscriptions/ID {prefs: {done}}), Remove for another device
+// (DELETE /api/push/subscriptions/ID), and the stale ones (another origin's,
+// never sent to) as one line. A phone gets it as a bottom sheet, a wider
+// window as a popover at the bell (chip_popover.js), small enough to need
+// no scrolling for a few devices.
+//
+// This device's row has the switch and never Remove: turning it off is the
+// bell turned off (the page forgets its device id), so the page's state and
+// chi web's store stay one. A device iOS revoked silently still shows a
+// recent delivery (Apple keeps answering 201): the list can't tell; switch
+// it off and on there.
+//
+// Pure templates and models, plus createPushDevices (the injected api and
+// the popover shell), so the specs run them under node --test.
+
+import { html, nothing, render } from "./vendor/lit-html.js";
+import { createChipPopover } from "./chip_popover.js";
+import { relativeTime } from "./format.js";
+
+export const DEVICE_PATH = "/api/push/subscriptions";
+
+// The rows GET /api/push's +info+ gives, this device first.
+// @return [{id, label, this, last, error, done}]
+export function deviceRows(info, now) {
+  const devices = Array.isArray(info?.devices) ? info.devices : [];
+  const rows = devices.map((d) => ({
+    id: String(d.id || ""),
+    label: d.label || d.id || "device",
+    this: d.this === true,
+    last: d.last_ok_at ? `last delivery ${relativeTime(d.last_ok_at, now)}` : "no delivery yet",
+    error: d.last_error ? `last error ${d.last_error}` : "",
+    done: d.prefs?.done === true,
+  }));
+  return [...rows.filter((r) => r.this), ...rows.filter((r) => !r.this)];
+}
+
+// "2 more devices from an earlier address, never sent to" (another origin's:
+// a renamed machine or tailnet), "" for none.
+export function staleText(count) {
+  const n = Number(count) || 0;
+  if (n <= 0) return "";
+  return `${n === 1 ? "1 more device" : `${n} more devices`} from an earlier address, never sent to (chi web push rm)`;
+}
+
+// What the sheet draws: +state+ the bell's ("on" | "off" | "denied"),
+// +info+ GET /api/push's answer (null before the first), +busy+ a change
+// in flight, +error+ the last one's failure.
+export function sheetModel({ state, info, busy = false, error = "", now = Date.now() }) {
+  const rows = deviceRows(info, now);
+  const mine = rows.find((r) => r.this) || null;
+  const thisRow = mine || {
+    id: "", label: "This device", this: true, done: false, error: "",
+    last: state === "denied" ? "notifications are blocked for this app in the phone's settings" : "off: nothing is pushed here",
+  };
+  return {
+    on: state === "on" && !!mine,
+    denied: state === "denied",
+    busy,
+    error,
+    thisRow,
+    others: rows.filter((r) => !r.this),
+    stale: staleText(info?.stale),
+    loading: !info,
+  };
+}
+
+const doneSwitch = (row, busy) => html`<label class="pd-done"><span>Long turns done (10 s or more)</span
+  ><input type="checkbox" class="pd-switch" role="switch" data-pd="done" data-id=${row.id} .checked=${row.done}
+    ?disabled=${busy}></label>`;
+
+function rowTemplate(row, model) {
+  const mine = row.this;
+  const subscribed = !mine || model.on;
+  return html`<li class=${`pd-row${mine ? " this" : ""}`} data-id=${row.id || nothing}>
+    <div class="pd-who"><b>${row.label}</b>${mine ? html`<span class="pd-tag">this device</span>` : nothing}</div>
+    <div class="pd-act">${mine
+      ? html`<input type="checkbox" class="pd-switch" role="switch" data-pd="this" aria-label="Notifications to this device"
+          .checked=${model.on} ?disabled=${model.busy || model.denied}>`
+      : html`<button type="button" class="pd-remove" data-pd="remove" data-id=${row.id} ?disabled=${model.busy}>Remove</button>`}</div>
+    <div class="pd-meta">${row.last}${row.error ? html` · <span class="pd-error">${row.error}</span>` : nothing}</div>
+    ${subscribed ? doneSwitch(row, model.busy) : nothing}
+  </li>`;
+}
+
+// The sheet's content (a lit-html template).
+export function sheetTemplate(model) {
+  return html`<div class="ctx-pop-head"><strong>Notifications</strong><span class="ctx-pop-kind">devices</span
+    ><button type="button" class="ctx-pop-close" data-act="close" aria-label="Close">×</button></div
+    ><ul class="pd-list">${rowTemplate(model.thisRow, model)}${model.others.map((row) => rowTemplate(row, model))}</ul
+    >${model.loading ? html`<div class="pd-note">Loading the devices…</div>` : nothing
+    }${model.stale ? html`<div class="pd-note">${model.stale}</div>` : nothing
+    }${model.error ? html`<div class="pd-note pd-error" role="alert">${model.error}</div>` : nothing
+    }<div class="pd-note">Approvals, questions, step limits, cards and failed turns; quiet while a chi web page is in front.</div>`;
+}
+
+// The sheet at the bell. +state+() the bell's state; +endpoint+() this
+// device's push endpoint (a Promise; null without a subscription);
+// +toggleThis+() the bell's subscribe / unsubscribe (resolves to its
+// failure's message, or null); +api+ chi web's JSON (notifications.js's).
+// @return {toggle(), refresh(), isOpen(), pop}
+export function createPushDevices({ button, api, state, endpoint, toggleThis, now = () => Date.now(),
+                                    doc = globalThis.document, win = globalThis.window }) {
+  let info = null;
+  let busy = false;
+  let error = "";
+  // Each load's turn: an older answer that arrives late is dropped.
+  let loads = 0;
+
+  const draw = () => {
+    if (shell.isOpen()) render(sheetTemplate(sheetModel({ state: state(), info, busy, error, now: now() })), shell.pop);
+  };
+
+  const shell = createChipPopover({
+    id: "pushDevices", className: "ctx-popover push-devices", width: 340, el: doc.createElement("span"),
+    anchor: "#notifyBtn", openers: "#notifyBtn", summary: () => ({}), sheet: true, label: "Notifications", doc, win,
+    show: () => render(sheetTemplate(sheetModel({ state: state(), info, busy, error, now: now() })), shell.pop),
+    onClose: () => { error = ""; },
+  });
+
+  async function load() {
+    const turn = ++loads;
+    try {
+      const at = await endpoint();
+      const answer = await api("GET", `/api/push${at ? `?endpoint=${encodeURIComponent(at)}` : ""}`);
+      if (turn !== loads) return;
+      info = answer;
+    } catch (e) {
+      if (turn !== loads) return;
+      error = `Can't read the devices: ${e?.message || e}`;
+    }
+    draw();
+    shell.replace();
+  }
+
+  // One change at a time; the list is read again after it.
+  async function change(run) {
+    if (busy) return;
+    busy = true;
+    error = "";
+    draw();
+    try {
+      error = (await run()) || "";
+    } catch (e) {
+      error = e?.message || String(e);
+    } finally {
+      busy = false;
+    }
+    await load();
+  }
+
+  shell.pop.addEventListener("change", (e) => {
+    const input = e.target.closest?.("[data-pd]");
+    if (!input) return;
+    if (input.dataset.pd === "this") change(toggleThis);
+    else if (input.dataset.pd === "done") {
+      const id = input.dataset.id;
+      const done = input.checked;
+      change(() => api("PATCH", `${DEVICE_PATH}/${encodeURIComponent(id)}`, { prefs: { done } }).then(() => null));
+    }
+  });
+  shell.pop.addEventListener("click", (e) => {
+    const remove = e.target.closest?.('[data-pd="remove"]');
+    if (!remove) return;
+    const id = remove.dataset.id;
+    change(() => api("DELETE", `${DEVICE_PATH}/${encodeURIComponent(id)}`).then(() => null));
+  });
+
+  return {
+    pop: shell.pop,
+    isOpen: shell.isOpen,
+    // The bell's tap: open (drawn from what is known, then read again) or close.
+    toggle() {
+      if (shell.isOpen()) return shell.close();
+      shell.open(button);
+      return load();
+    },
+    // The bell's state changed elsewhere: redraw an open sheet.
+    refresh: draw,
+    // Read the devices again (specs await it).
+    load,
+  };
+}

data/lib/samagotchi/web/push/store.rb

@@ -163,6 +163,10 @@ module Samagotchi
           []
         end
 
+        # As #subscriptions, but a corrupt file raises (chi web push says so).
+        # @raise [Corrupt]
+        def subscriptions! = read
+
         # The subscriptions for +origin+ (the ones chi web sends to now).
         def for_origin(origin) = subscriptions.select { |sub| sub.origin == origin }
 
@@ -206,6 +210,16 @@ module Samagotchi
           end
         end
 
+        # Removes the device with this short id, only one subscribed on
+        # +origin+ (nil: any; chi web push rm).
+        # @return [Sub, nil] the one removed
+        def remove_device(id, origin: nil)
+          update do |subs|
+            gone = subs.find { |sub| sub.id == id && (origin.nil? || sub.origin == origin) }
+            [subs - [gone], gone]
+          end
+        end
+
         # Sets the device's prefs (+done+: a push for a long turn done).
         # @param origin [String, nil] only a device subscribed there
         # @return [Sub, nil] the device as it is now, nil when there is none

data/lib/samagotchi/web/push.rb

@@ -29,6 +29,11 @@ module Samagotchi
         def initialize(presence: Presence.new, **) = super
       end
 
+      # The test push (POST /api/push/test, chi web push test): no badge
+      # (it would clear the app's) and no open list (no cleanup).
+      TEST_PAYLOAD = { v: 1, kind: "show", tag: "chi:test", title: "chi", body: "test notification", url: "/" }.freeze
+      TEST_TTL = 600
+
       module_function
 
       # Push runs for +public_url+ (nil: none) when web.push.enabled.

data/lib/samagotchi/web/push_routes.rb

@@ -67,12 +67,25 @@ module Samagotchi
         end
 
         sub = Push::Store.short_id?(id) && @push.store.set_prefs(id, done: prefs["done"], origin: @push.origin)
-        return error_response(404, "unknown_device", "no device #{id[0, 16]} pushes from this origin") unless sub
+        return unknown_device(id) unless sub
 
         Log.info(:web, "push_prefs", device: sub.id, done: sub.done?)
         json_response(200, sub.public_h)
       end
 
+      # DELETE …/subscriptions/ID → 204: the devices list's Remove for
+      # another device (this device's row turns the bell off instead, so
+      # the page and the store agree).
+      def handle_push_remove(_req, id)
+        return push_off unless @push
+
+        sub = Push::Store.short_id?(id) && @push.store.remove_device(id, origin: @push.origin)
+        return unknown_device(id) unless sub
+
+        Log.info(:web, "push_removed", device: sub.id)
+        [204, { "Cache-Control" => "no-store" }, []]
+      end
+
       # {endpoint} → 204: this device's bell turned off.
       def handle_push_unsubscribe(req)
         return push_off unless @push
@@ -95,9 +108,8 @@ module Samagotchi
         endpoint = body["endpoint"] if body.is_a?(Hash)
         subs = @push.store.for_origin(@push.origin)
         subs = subs.select { |sub| sub.endpoint == endpoint } if endpoint.is_a?(String) && !endpoint.empty?
-        payload = { v: 1, kind: "show", tag: "chi:test", title: "chi", body: "test notification", url: "/" }
         results = subs.map do |sub|
-          result = @push.client.deliver(sub, payload, ttl: 600, urgency: "high")
+          result = @push.client.deliver(sub, Push::TEST_PAYLOAD, ttl: Push::TEST_TTL, urgency: "high")
           Log.info(:web, "push_test", device: sub.id, code: result.code, ms: result.ms)
           @push.store.remove(sub.id) if result.status == :gone
           { id: sub.id, label: sub.label, status: result.status.to_s, code: result.code, ms: result.ms }
@@ -116,6 +128,8 @@ module Samagotchi
         [204, { "Cache-Control" => "no-store" }, []]
       end
 
+      def unknown_device(id) = error_response(404, "unknown_device", "no device #{id[0, 16]} pushes from this origin")
+
       def push_off
         error_response(409, "push_off", "push needs an https public URL (chi web --tunnel tailscale, or web.public_url) " \
                                         "and web.push.enabled")

data/lib/samagotchi/web/server.rb

@@ -130,7 +130,9 @@ module Samagotchi
                       annotate_presets: annotate_presets, editor: editor, lan: lan, working_set: working_set,
                       public_url: public_url }
           started = if plan
-                      with_tunnel(provider, plan) { start(**options, public_notes: provider.start_lines(plan)) }
+                      with_tunnel(provider, plan) do |up|
+                        start(**options, public_notes: provider.start_lines(plan), on_bound: up)
+                      end
                     else
                       start(**options)
                     end
@@ -147,25 +149,43 @@ module Samagotchi
       end
 
       # The tunnel on while the block runs (the server), off after it
-      # whatever ends it (Ctrl-C, SIGTERM, SIGHUP, a port taken), and only
-      # once #up succeeded: a refusal before it, or a failed #up, turns off
-      # nothing (a live tunnel of another chi web stays).
+      # whatever ends it (Ctrl-C, SIGTERM, SIGHUP), once #up may have taken
+      # effect: a refusal before it turns off nothing (a live tunnel of
+      # another chi web stays). The block gets #up to call once the port is
+      # bound (start's on_bound), so Serve never forwards the tailnet to a
+      # listener that took the port first. A signal during #up waits for it
+      # (its command runs in its own process group, and Serve keeps what it
+      # set even if chi stopped waiting), so it can't land between the serve
+      # going on and the teardown being due; #up is bounded by its timeout.
       def self.with_tunnel(provider, plan)
-        provider.up(plan)
-        upped = true
-        yield
+        attempted = false
+        yield(lambda do
+          Thread.handle_interrupt(SignalException => :never) do
+            attempted = true
+            provider.up(plan)
+          end
+        end)
       ensure
-        tunnel_down(provider, plan) if upped
+        tunnel_down(provider, plan) if attempted
       end
 
       # The tunnel's teardown, before any line (a hung-up terminal can't
       # write): a failure is one warning line, never a crash or another exit
-      # status, and a second Ctrl-C during it only cuts it short.
+      # status. A second Ctrl-C (SIGTERM, SIGHUP) during it waits for it
+      # (bounded by its commands' timeouts) and is then dropped: the run
+      # already ends the way the first signal ends it.
       def self.tunnel_down(provider, plan)
-        line = begin
-          provider.down_line(plan, provider.down(plan))
-        rescue Tunnel::Refused, SignalException => e
-          provider.down_warning(plan, e)
+        line = nil
+        begin
+          Thread.handle_interrupt(SignalException => :never) do
+            line = begin
+              provider.down_line(plan, provider.down(plan))
+            rescue Tunnel::Refused => e
+              provider.down_warning(plan, e)
+            end
+          end
+        rescue SignalException
+          nil
         end
         say(line) if line
       end
@@ -187,11 +207,14 @@ module Samagotchi
       #   (web.public_url, or --tunnel's): every request needs the access token
       # @param public_notes [Array<String>] lines after the proxied link's
       #   (the tunnel's)
+      # @param on_bound [#call, nil] run once the port is bound, before any
+      #   line (the tunnel's #up); what it raises ends the run
       # @return [Boolean] false when the port was taken (said so on stderr)
       def self.start(port: nil, host: nil, url: nil, open_browser: false, state_dir: nil, manager: nil, markdown: false,
                      view: Config::BY_KEY["web.view"].default, annotate_presets: Config::BY_KEY["web.annotate_presets"].default, hub: nil, lan: nil,
                      editor: Config::BY_KEY["web.editor"].default, token_path: Token.path,
-                     working_set: Config::BY_KEY["web.working_set"].default, public_url: nil, public_notes: [])
+                     working_set: Config::BY_KEY["web.working_set"].default, public_url: nil, public_notes: [],
+                     on_bound: nil)
         config_restart_unsubscribe = ConfigFile.watch_restart_settings!(process: :web) do |message|
           Samagotchi::Log.warn(:config, "restart_required", echo: "Warning: config: #{message}")
         end
@@ -227,7 +250,11 @@ module Samagotchi
         # Said once the port is bound: a second chi web racing for it gets
         # the in-use line instead.
         running_path = Running.path(state_dir: state_dir)
+        webrick = nil
+        callback_unfinished = false
         started = lambda do
+          callback_unfinished = true
+          on_bound&.call
           record_running(running_path, port, public_url)
           puts "Chi Web on #{url} (public: #{File.expand_path("public", __dir__)})"
           puts lan_lines(ip: lan.ip, port: port, token: Token.read(token_path), others: lan.others, public: lan.public) if lan
@@ -244,12 +271,14 @@ module Samagotchi
               open_url(open_target)
             end
           end
+          callback_unfinished = false
         end
 
         # The event loops (GET /api/events) end once WEBrick leaves
         # :Running: it joins every request thread before run returns.
         Rackup::Handler::WEBrick.run(app, Host: host, Port: port, AccessLog: [], Logger: Log.new($stderr, WEBrick::Log::WARN),
                                           StartCallback: started) do |server|
+          webrick = server
           app.server_running = -> { server.status == :Running }
           listen_lan(server, lan, port) if lan
         end
@@ -261,6 +290,9 @@ module Samagotchi
         warn "Error: can't listen on #{lan.ip}:#{port} (#{e.message}); did the address change? Run chi web again"
         false
       ensure
+        # A start callback that raised (on_bound's refusal, a Ctrl-C) leaves
+        # WEBrick :Running with its sockets open.
+        webrick&.listeners&.each { |socket| socket.close unless socket.closed? } if callback_unfinished
         Running.clear(path: running_path) if running_path
         config_restart_unsubscribe&.call
         notifier&.stop

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samagotchi
 version: !ruby/object:Gem::Version
-  version: 0.112.0
+  version: 0.113.0
 platform: ruby
 authors:
 - Dmitry Dedov
@@ -503,6 +503,7 @@ files:
 - lib/samagotchi/prompt_note.rb
 - lib/samagotchi/prompt_warmup.rb
 - lib/samagotchi/proxy_trace.rb
+- lib/samagotchi/push_command.rb
 - lib/samagotchi/question_answer.rb
 - lib/samagotchi/question_asked.rb
 - lib/samagotchi/question_desk.rb
@@ -780,6 +781,7 @@ files:
 - lib/samagotchi/web/public/plain_line.js
 - lib/samagotchi/web/public/prompt_history.js
 - lib/samagotchi/web/public/push.js
+- lib/samagotchi/web/public/push_devices.js
 - lib/samagotchi/web/public/question_card.js
 - lib/samagotchi/web/public/question_cards.js
 - lib/samagotchi/web/public/read_view.js