@openchambery/web 1.19.0-beta.37 → 1.19.0-beta.39

package/server/lib/notifications/apns-runtime.js

@@ -2,8 +2,9 @@
 //
 // Device tokens are persisted per UI session (mirrors push-runtime.js). Delivery has two
 // modes, chosen at send time:
-//   - Relay (default): POST tokens + generic text to the central Cloudflare relay, which
-//     holds the single project APNs key and signs+sends — so users configure nothing.
+//   - Relay (default): POST tokens + generic text to the same-origin Push service
+//     (`/v1/push/*` on the effective Relay host). The isolated Push process holds the
+//     project APNs key and signs+sends — so users configure nothing.
 //   - Direct (fallback): sign an ES256 JWT with Node crypto and send over HTTP/2 ourselves,
 //     for self-hosters who set OPENCHAMBER_APNS_* and OPENCHAMBER_PUSH_RELAY_DISABLED=true.
 // Wired into the same trigger fanout as web push (see runtime.js); the relay carries only
@@ -14,17 +15,45 @@ import {
   signRelayMessage as signRelayMessageShared,
 } from '../relay/signing-key.js';
 import { DEFAULT_RELAY_URL, derivePushSendUrlFromRelayUrl } from '../relay/service.js';
+import {
+  APNS_DEFAULT_LOCALE,
+  localizeApnsPayload,
+  normalizeApnsLocale,
+} from './apns-titles.js';
 
 const APNS_TOKENS_VERSION = 1;
 const APNS_HOST_PRODUCTION = 'https://api.push.apple.com';
 const APNS_HOST_SANDBOX = 'https://api.sandbox.push.apple.com';
 // APNs rejects auth tokens older than 1h; refresh well inside that window.
 const JWT_TTL_MS = 50 * 60 * 1000;
-const DEFAULT_BUNDLE_ID = 'com.openchamber.app';
+const DEFAULT_BUNDLE_ID = 'com.yee94.openchamber';
 const MAX_TOKENS_PER_SESSION = 10;
+const MAX_RELAY_SEND_TOKENS = 100;
+const RELAY_REGISTER_CONCURRENCY = 16;
+const APNS_COLLAPSE_ID_MAX_BYTES = 64;
 // APNs reasons that mean the token is permanently invalid → drop it.
 const DEAD_TOKEN_REASONS = new Set(['BadDeviceToken', 'Unregistered', 'DeviceTokenNotForTopic']);
 
+const mapWithBoundedConcurrency = async (items, concurrency, mapper) => {
+  const results = new Array(items.length);
+  const limit = Math.max(1, concurrency);
+  for (let start = 0; start < items.length; start += limit) {
+    const end = Math.min(start + limit, items.length);
+    await Promise.all(
+      items.slice(start, end).map(async (item, offset) => {
+        results[start + offset] = await mapper(item, start + offset);
+      }),
+    );
+  }
+  return results;
+};
+
+const apnsCollapseId = (tag) => {
+  if (typeof tag !== 'string' || tag.length === 0) return undefined;
+  if (Buffer.byteLength(tag, 'utf8') > APNS_COLLAPSE_ID_MAX_BYTES) return undefined;
+  return tag;
+};
+
 const trimmedEnv = (name) => {
   const value = process.env[name];
   return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
@@ -180,6 +209,8 @@ export const createApnsRuntime = (deps) => {
           userAgent: typeof entry.userAgent === 'string' ? entry.userAgent : undefined,
           // 'ios' (APNs) or 'android' (FCM). Older entries without one are APNs by default.
           platform: entry.platform === 'android' ? 'android' : 'ios',
+          // App UI locale at last registration; missing → English titles (legacy tokens).
+          locale: normalizeApnsLocale(entry.locale),
         };
       })
       .filter(Boolean);
@@ -191,34 +222,45 @@ export const createApnsRuntime = (deps) => {
 
   const listUniqueTokenEntries = (store) => {
     const unique = [];
-    const seen = new Set();
+    const seen = new Map();
     for (const record of Object.values(store.tokensBySession || {})) {
       for (const entry of normalizeTokens(record)) {
         const key = `${entry.deviceToken}\0${entry.platform}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        unique.push(entry);
+        const priorIndex = seen.get(key);
+        if (priorIndex == null) {
+          seen.set(key, unique.length);
+          unique.push(entry);
+          continue;
+        }
+        // Same device may register under multiple UI sessions; keep the freshest locale.
+        const prior = unique[priorIndex];
+        const priorSeen = typeof prior.lastSeenAt === 'number' ? prior.lastSeenAt : 0;
+        const nextSeen = typeof entry.lastSeenAt === 'number' ? entry.lastSeenAt : 0;
+        if (nextSeen >= priorSeen) unique[priorIndex] = entry;
       }
     }
     return unique;
   };
 
-  const addOrUpdateApnsToken = async (uiSessionToken, deviceToken, userAgent, platform) => {
+  const addOrUpdateApnsToken = async (uiSessionToken, deviceToken, userAgent, platform, locale) => {
     if (!uiSessionToken || typeof deviceToken !== 'string' || deviceToken.trim().length === 0) return;
     const token = deviceToken.trim();
     const tokenPlatform = normalizePlatform(platform);
+    const tokenLocale = normalizeApnsLocale(locale);
     const now = Date.now();
 
     await persistTokenUpdate((current) => {
       const tokensBySession = { ...(current.tokensBySession || {}) };
       const existing = normalizeTokens(tokensBySession[uiSessionToken]);
+      const prior = existing.find((entry) => entry.deviceToken === token);
       const filtered = existing.filter((entry) => entry.deviceToken !== token);
       filtered.unshift({
         deviceToken: token,
-        createdAt: now,
+        createdAt: typeof prior?.createdAt === 'number' ? prior.createdAt : now,
         lastSeenAt: now,
         userAgent: typeof userAgent === 'string' && userAgent.length > 0 ? userAgent : undefined,
         platform: tokenPlatform,
+        locale: tokenLocale,
       });
       tokensBySession[uiSessionToken] = filtered.slice(0, MAX_TOKENS_PER_SESSION);
       return { version: APNS_TOKENS_VERSION, tokensBySession };
@@ -361,8 +403,9 @@ export const createApnsRuntime = (deps) => {
         'apns-push-type': 'alert',
         'apns-priority': '10',
       };
-      // collapse-id dedups like web-push tags; APNs caps it at 64 bytes.
-      const collapseId = typeof config.tag === 'string' ? config.tag.slice(0, 64) : undefined;
+      // collapse-id dedups like web-push tags; APNs caps it at 64 UTF-8 bytes.
+      // Keep legal values; omit anything over the limit (do not truncate mid-codepoint).
+      const collapseId = apnsCollapseId(config.tag);
       if (collapseId) headers['apns-collapse-id'] = collapseId;
 
       let req;
@@ -408,10 +451,11 @@ export const createApnsRuntime = (deps) => {
       req.end(body);
     });
 
-  // Relay mode (default): the single APNs key lives in the central Cloudflare relay, not on
-  // each user's server — so users configure nothing. The server just POSTs device tokens +
-  // generic text; the relay signs + sends and reports which tokens to drop. Direct mode (below)
-  // is the fallback for self-hosters who set OPENCHAMBER_APNS_* and disable the relay.
+  // Relay mode (default): the single APNs key lives in the isolated Push process on the same
+  // Relay origin (`/v1/push/*`), not on each user's server — so users configure nothing. The
+  // server just POSTs device tokens + generic text; Push signs + sends and reports which tokens
+  // to drop. Direct mode (below) is the fallback for self-hosters who set OPENCHAMBER_APNS_*
+  // and disable the relay.
   const buildRelayConfig = (url) => ({
     url,
     registerUrl: url.replace(/\/send$/, '/register-token'),
@@ -430,9 +474,12 @@ export const createApnsRuntime = (deps) => {
     if (typeof resolveEffectiveRelayUrl === 'function') {
       try {
         const resolved = await resolveEffectiveRelayUrl();
-        if (typeof resolved === 'string' && resolved.trim()) relayWsUrl = resolved;
+        if (typeof resolved === 'string' && resolved.trim()) {
+          if (derivePushSendUrlFromRelayUrl(resolved)) relayWsUrl = resolved.trim();
+          else console.warn('[Push relay] resolver returned a non-WebSocket URL; falling back to default');
+        }
       } catch {
-        relayWsUrl = DEFAULT_RELAY_URL;
+        console.warn('[Push relay] resolver failed; falling back to default');
       }
     }
     const url = derivePushSendUrlFromRelayUrl(relayWsUrl) || derivePushSendUrlFromRelayUrl(DEFAULT_RELAY_URL);
@@ -441,43 +488,46 @@ export const createApnsRuntime = (deps) => {
   };
 
   const sendViaRelay = async (deviceTokens, payload, relay) => {
-    const tokens = deviceTokens.slice(0, 100);
+    if (!Array.isArray(deviceTokens) || deviceTokens.length === 0) return;
     const title = typeof payload?.title === 'string' && payload.title.length > 0 ? payload.title : 'OpenChamber';
     const { privateKey, publicJwk } = await getOrCreateRelayKeypair();
-    const ts = Date.now();
-    // Sign over the same canonical form the relay verifies: ts.sortedTokens.title.
-    const sig = signRelayMessage(privateKey, `${ts}.${[...tokens].sort().join(',')}.${title}`);
-    const requestBody = JSON.stringify({
-      tokens,
-      title,
-      body: typeof payload?.body === 'string' ? payload.body : '',
-      badge: Number.isFinite(payload?.badge) && payload.badge >= 0 ? Math.trunc(payload.badge) : undefined,
-      collapseId: typeof payload?.tag === 'string' ? payload.tag.slice(0, 64) : undefined,
-      env: relay.environment,
-      data: payload?.data && typeof payload.data === 'object' ? payload.data : undefined,
-      publicKeyJwk: relayPublicJwk(publicJwk),
-      ts,
-      sig,
-    });
-    try {
-      const res = await fetch(relay.url, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: requestBody,
+    for (let start = 0; start < deviceTokens.length; start += MAX_RELAY_SEND_TOKENS) {
+      const tokens = deviceTokens.slice(start, start + MAX_RELAY_SEND_TOKENS);
+      const ts = Date.now();
+      // Sign over the same canonical form the relay verifies: ts.sortedTokens.title.
+      const sig = signRelayMessage(privateKey, `${ts}.${[...tokens].sort().join(',')}.${title}`);
+      const requestBody = JSON.stringify({
+        tokens,
+        title,
+        body: typeof payload?.body === 'string' ? payload.body : '',
+        badge: Number.isFinite(payload?.badge) && payload.badge >= 0 ? Math.trunc(payload.badge) : undefined,
+        collapseId: apnsCollapseId(payload?.tag),
+        env: relay.environment,
+        data: payload?.data && typeof payload.data === 'object' ? payload.data : undefined,
+        publicKeyJwk: relayPublicJwk(publicJwk),
+        ts,
+        sig,
       });
-      if (!res.ok) {
-        console.warn(`[APNs relay] send failed status=${res.status}`);
-        return;
-      }
-      const data = await res.json().catch(() => null);
-      const results = Array.isArray(data?.results) ? data.results : [];
-      for (const result of results) {
-        if (result && result.drop === true && typeof result.token === 'string') {
-          await removeApnsTokenFromAllSessions(result.token);
+      try {
+        const res = await fetch(relay.url, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: requestBody,
+        });
+        if (!res.ok) {
+          console.warn(`[APNs relay] send failed status=${res.status}`);
+          continue;
         }
+        const data = await res.json().catch(() => null);
+        const results = Array.isArray(data?.results) ? data.results : [];
+        for (const result of results) {
+          if (result && result.drop === true && typeof result.token === 'string') {
+            await removeApnsTokenFromAllSessions(result.token);
+          }
+        }
+      } catch (error) {
+        console.warn('[APNs relay] request failed:', error?.message ?? error);
       }
-    } catch (error) {
-      console.warn('[APNs relay] request failed:', error?.message ?? error);
     }
   };
 
@@ -541,8 +591,10 @@ export const createApnsRuntime = (deps) => {
     const store = await readTokensFromDisk();
     const entries = listUniqueTokenEntries(store);
     boundRegistrationCache(relay.registerUrl, entries);
-    const outcomes = await Promise.all(
-      entries.map((entry) => registerTokenWithRelay(entry.deviceToken, entry.platform, relay)),
+    const outcomes = await mapWithBoundedConcurrency(
+      entries,
+      RELAY_REGISTER_CONCURRENCY,
+      (entry) => registerTokenWithRelay(entry.deviceToken, entry.platform, relay),
     );
     let succeeded = 0;
     let failed = 0;
@@ -553,6 +605,24 @@ export const createApnsRuntime = (deps) => {
     return { attempted: entries.length, succeeded, failed };
   };
 
+  // Group ready device tokens by app locale so each batch can carry a localized title.
+  // Relay signatures cover title, so mixed-locale tokens must not share one send body.
+  const groupTokensByLocale = (entries) => {
+    const groups = new Map();
+    for (const entry of entries) {
+      const locale = entry?.locale ? normalizeApnsLocale(entry.locale) : APNS_DEFAULT_LOCALE;
+      const token = entry?.deviceToken;
+      if (typeof token !== 'string' || token.length === 0) continue;
+      let list = groups.get(locale);
+      if (!list) {
+        list = [];
+        groups.set(locale, list);
+      }
+      list.push(token);
+    }
+    return groups;
+  };
+
   const sendApnsToAllUiSessions = async (payload, _options = {}) => {
     const store = await readTokensFromDisk();
     const uniqueEntries = listUniqueTokenEntries(store);
@@ -561,31 +631,31 @@ export const createApnsRuntime = (deps) => {
     const relay = await resolveRelayConfig();
     if (relay) {
       boundRegistrationCache(relay.registerUrl, uniqueEntries);
-      const outcomes = await Promise.all(
-        uniqueEntries.map(async (entry) => {
+      const outcomes = await mapWithBoundedConcurrency(
+        uniqueEntries,
+        RELAY_REGISTER_CONCURRENCY,
+        async (entry) => {
           const registered = await registerTokenWithRelay(entry.deviceToken, entry.platform, relay);
-          return registered ? entry.deviceToken : null;
-        }),
+          return registered ? entry : null;
+        },
       );
-      const readyTokens = [];
+      const readyEntries = [];
       const readySeen = new Set();
-      for (const token of outcomes) {
-        if (!token || readySeen.has(token)) continue;
-        readySeen.add(token);
-        readyTokens.push(token);
+      for (const entry of outcomes) {
+        if (!entry?.deviceToken || readySeen.has(entry.deviceToken)) continue;
+        readySeen.add(entry.deviceToken);
+        readyEntries.push(entry);
+      }
+      if (readyEntries.length === 0) return;
+      for (const [locale, tokens] of groupTokensByLocale(readyEntries)) {
+        await sendViaRelay(tokens, localizeApnsPayload(payload, locale), relay);
       }
-      if (readyTokens.length === 0) return;
-      await sendViaRelay(readyTokens, payload, relay);
       return;
     }
-    const deviceTokens = [];
-    const seen = new Set();
-    for (const entry of uniqueEntries) {
-      if (seen.has(entry.deviceToken)) continue;
-      seen.add(entry.deviceToken);
-      deviceTokens.push(entry.deviceToken);
+    const byLocale = groupTokensByLocale(uniqueEntries);
+    for (const [locale, deviceTokens] of byLocale) {
+      await sendViaDirectApns(deviceTokens, localizeApnsPayload(payload, locale));
     }
-    await sendViaDirectApns(deviceTokens, payload);
   };
 
   return {

package/server/lib/notifications/apns-runtime.test.js

@@ -72,6 +72,43 @@ afterEach(() => {
   delete process.env.OPENCHAMBER_PUSH_RELAY_URL;
   delete process.env.OPENCHAMBER_PUSH_RELAY_DISABLED;
   delete process.env.OPENCHAMBER_RELAY_URL;
+  delete process.env.OPENCHAMBER_APNS_KEY_ID;
+  delete process.env.OPENCHAMBER_APNS_TEAM_ID;
+  delete process.env.OPENCHAMBER_APNS_P8;
+  delete process.env.OPENCHAMBER_APNS_BUNDLE_ID;
+});
+
+describe('apns runtime bundle ID', () => {
+  it('defaults to the current product bundle ID when env and settings omit it', async () => {
+    process.env.OPENCHAMBER_APNS_KEY_ID = 'KEY123';
+    process.env.OPENCHAMBER_APNS_TEAM_ID = 'TEAM123';
+    process.env.OPENCHAMBER_APNS_P8 = P8;
+    const runtime = createApnsRuntime(makeDeps());
+    await expect(runtime.resolveApnsConfig()).resolves.toMatchObject({ bundleId: 'com.yee94.openchamber' });
+  });
+
+  it('prefers OPENCHAMBER_APNS_BUNDLE_ID over the default and settings', async () => {
+    process.env.OPENCHAMBER_APNS_BUNDLE_ID = 'com.example.app';
+    const runtime = createApnsRuntime(
+      makeDeps({
+        readSettingsFromDiskMigrated: vi.fn(async () => ({
+          apnsConfig: { ...APNS_CONFIG, bundleId: 'com.example.settings' },
+        })),
+      }),
+    );
+    await expect(runtime.resolveApnsConfig()).resolves.toMatchObject({ bundleId: 'com.example.app' });
+  });
+
+  it('prefers settings.apnsConfig.bundleId over the default', async () => {
+    const runtime = createApnsRuntime(
+      makeDeps({
+        readSettingsFromDiskMigrated: vi.fn(async () => ({
+          apnsConfig: { ...APNS_CONFIG, bundleId: 'com.example.settings' },
+        })),
+      }),
+    );
+    await expect(runtime.resolveApnsConfig()).resolves.toMatchObject({ bundleId: 'com.example.settings' });
+  });
 });
 
 describe('apns runtime relay mode (default)', () => {
@@ -154,6 +191,36 @@ describe('apns runtime relay mode (default)', () => {
     await runtime.sendApnsToAllUiSessions({ title: 't', body: 'b' });
     expect(fetchMock).not.toHaveBeenCalled();
   });
+
+  it('omits relay collapseId when CJK/emoji tags exceed 64 UTF-8 bytes', async () => {
+    const fetchMock = vi.fn(async () => jsonResponse({ ok: true, results: [] }));
+    vi.stubGlobal('fetch', fetchMock);
+    process.env.OPENCHAMBER_PUSH_RELAY_URL = 'https://relay.test/v1/push/send';
+    const runtime = createApnsRuntime(makeDeps());
+    await runtime.addOrUpdateApnsToken('s1', 'tokenA');
+
+    const sendTag = async (tag) => {
+      fetchMock.mockClear();
+      await runtime.sendApnsToAllUiSessions({ title: 't', body: 'b', tag });
+      const sent = JSON.parse(fetchMock.mock.calls.find(isSend)[1].body);
+      return Object.prototype.hasOwnProperty.call(sent, 'collapseId') ? sent.collapseId : undefined;
+    };
+
+    const cjkKeep = '会话'.repeat(10); // 60 bytes
+    const cjkOmit = '会话'.repeat(11); // 66 bytes
+    const emojiKeep = '🎉'.repeat(16); // 64 bytes
+    const emojiOmit = '🎉'.repeat(17); // 68 bytes
+    expect(Buffer.byteLength(cjkKeep, 'utf8')).toBeLessThanOrEqual(64);
+    expect(Buffer.byteLength(cjkOmit, 'utf8')).toBeGreaterThan(64);
+    expect(Buffer.byteLength(emojiKeep, 'utf8')).toBe(64);
+    expect(Buffer.byteLength(emojiOmit, 'utf8')).toBeGreaterThan(64);
+
+    expect(await sendTag('ready-x')).toBe('ready-x');
+    expect(await sendTag(cjkKeep)).toBe(cjkKeep);
+    expect(await sendTag(cjkOmit)).toBeUndefined();
+    expect(await sendTag(emojiKeep)).toBe(emojiKeep);
+    expect(await sendTag(emojiOmit)).toBeUndefined();
+  });
 });
 
 describe('apns runtime direct fallback (relay disabled)', () => {
@@ -189,6 +256,57 @@ describe('apns runtime direct fallback (relay disabled)', () => {
     expect(targeted).toEqual(['tokenDirect']);
   });
 
+  it('keeps direct APNs collapse-id within 64 UTF-8 bytes and omits CJK/emoji over the limit', async () => {
+    process.env.OPENCHAMBER_PUSH_RELAY_DISABLED = 'true';
+    const collapseIds = [];
+    const http2 = {
+      connect: () => ({
+        on: () => {},
+        close: () => {},
+        request: (headers) => {
+          collapseIds.push(headers['apns-collapse-id']);
+          const listeners = {};
+          const req = {
+            on: (event, cb) => { listeners[event] = cb; return req; },
+            setEncoding: () => req,
+            end: () => {
+              queueMicrotask(() => {
+                listeners.response?.({ ':status': '200' });
+                listeners.end?.();
+              });
+            },
+          };
+          return req;
+        },
+      }),
+    };
+    const runtime = createApnsRuntime(
+      makeDeps({ http2, readSettingsFromDiskMigrated: vi.fn(async () => ({ apnsConfig: APNS_CONFIG })) }),
+    );
+    await runtime.addOrUpdateApnsToken('s', 'tokenDirect');
+
+    const sendTag = async (tag) => {
+      collapseIds.length = 0;
+      await runtime.sendApnsToAllUiSessions({ title: 't', body: 'b', tag });
+      return collapseIds[0];
+    };
+
+    const cjkKeep = '会话'.repeat(10); // 60 bytes
+    const cjkOmit = '会话'.repeat(11); // 66 bytes
+    const emojiKeep = '🎉'.repeat(16); // 64 bytes
+    const emojiOmit = '🎉'.repeat(17); // 68 bytes
+    expect(Buffer.byteLength(cjkKeep, 'utf8')).toBeLessThanOrEqual(64);
+    expect(Buffer.byteLength(cjkOmit, 'utf8')).toBeGreaterThan(64);
+    expect(Buffer.byteLength(emojiKeep, 'utf8')).toBe(64);
+    expect(Buffer.byteLength(emojiOmit, 'utf8')).toBeGreaterThan(64);
+
+    expect(await sendTag('ready-x')).toBe('ready-x');
+    expect(await sendTag(cjkKeep)).toBe(cjkKeep);
+    expect(await sendTag(cjkOmit)).toBeUndefined();
+    expect(await sendTag(emojiKeep)).toBe(emojiKeep);
+    expect(await sendTag(emojiOmit)).toBeUndefined();
+  });
+
   it('signApnsJwt produces a 3-part ES256 token with the expected header/claims', () => {
     const runtime = createApnsRuntime(makeDeps());
     const parts = runtime.signApnsJwt(APNS_CONFIG).split('.');
@@ -352,4 +470,174 @@ describe('apns runtime push relay derivation and re-register', () => {
     expect(retryRegister).toEqual(['tokenB']);
     expect(JSON.parse(fetchMock.mock.calls.find(([url]) => String(url).endsWith('/v1/push/send'))[1].body).tokens).toEqual(['tokenA']);
   });
+
+  it('warns without leaking the URL when the resolver returns a non-WebSocket URL, then falls back to default', async () => {
+    const fetchMock = vi.fn(async () => jsonResponse({ ok: true, results: [] }));
+    vi.stubGlobal('fetch', fetchMock);
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const leaked = 'https://evil.example/v1/push/send?token=secret';
+    const runtime = createApnsRuntime(makeDeps({
+      resolveEffectiveRelayUrl: async () => leaked,
+    }));
+
+    try {
+      await runtime.addOrUpdateApnsToken('s1', 'tokenA');
+      expect(registerUrls(fetchMock)).toEqual(['https://relay.openchamber.dev/v1/push/register-token']);
+      expect(warn).toHaveBeenCalled();
+      const messages = warn.mock.calls.map((args) => args.map(String).join(' ')).join('\n');
+      expect(messages).toContain('falling back to default');
+      expect(messages).not.toContain(leaked);
+      expect(messages).not.toContain('evil.example');
+      expect(messages).not.toContain('secret');
+      expect(messages).not.toContain('token=');
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('warns without leaking the error when the resolver throws, then falls back to default', async () => {
+    const fetchMock = vi.fn(async () => jsonResponse({ ok: true, results: [] }));
+    vi.stubGlobal('fetch', fetchMock);
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const leaked = 'wss://evil.example/ws?token=secret';
+    const runtime = createApnsRuntime(makeDeps({
+      resolveEffectiveRelayUrl: async () => {
+        throw new Error(leaked);
+      },
+    }));
+
+    try {
+      await runtime.addOrUpdateApnsToken('s1', 'tokenA');
+      expect(registerUrls(fetchMock)).toEqual(['https://relay.openchamber.dev/v1/push/register-token']);
+      expect(warn).toHaveBeenCalled();
+      const messages = warn.mock.calls.map((args) => args.map(String).join(' ')).join('\n');
+      expect(messages).toContain('falling back to default');
+      expect(messages).not.toContain(leaked);
+      expect(messages).not.toContain('evil.example');
+      expect(messages).not.toContain('secret');
+      expect(messages).not.toContain('token=');
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('sends more than 100 tokens in batches of at most 100, each token exactly once', async () => {
+    process.env.OPENCHAMBER_PUSH_RELAY_URL = 'https://relay.test/v1/push/send';
+    const fetchMock = vi.fn(async (url) =>
+      String(url).endsWith('/register-token')
+        ? jsonResponse({ ok: true })
+        : jsonResponse({ results: [] }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+    const runtime = createApnsRuntime(makeDeps());
+    const tokens = Array.from({ length: 101 }, (_, i) => `token${String(i).padStart(3, '0')}`);
+    for (const [i, token] of tokens.entries()) {
+      await runtime.addOrUpdateApnsToken(`s${i}`, token);
+    }
+
+    fetchMock.mockClear();
+    await runtime.sendApnsToAllUiSessions({ title: 't', body: 'b' });
+
+    const sendCalls = fetchMock.mock.calls.filter(([url]) => String(url).endsWith('/v1/push/send'));
+    expect(sendCalls).toHaveLength(2);
+    const batches = sendCalls.map(([, init]) => JSON.parse(init.body).tokens);
+    expect(batches.every((batch) => Array.isArray(batch) && batch.length > 0 && batch.length <= 100)).toBe(true);
+    const sent = batches.flat();
+    expect(sent).toHaveLength(101);
+    expect(new Set(sent).size).toBe(101);
+    expect(new Set(sent)).toEqual(new Set(tokens));
+    for (const [, init] of sendCalls) {
+      const sentBody = JSON.parse(init.body);
+      const sendMessage = `${sentBody.ts}.${[...sentBody.tokens].sort().join(',')}.${sentBody.title}`;
+      expect(await verifyRelaySignature(sentBody.publicKeyJwk, sendMessage, sentBody.sig)).toBe(true);
+    }
+  });
+
+  it('continues remaining send batches when one batch fails', async () => {
+    process.env.OPENCHAMBER_PUSH_RELAY_URL = 'https://relay.test/v1/push/send';
+    let sendCount = 0;
+    const fetchMock = vi.fn(async (url) => {
+      if (String(url).endsWith('/register-token')) return jsonResponse({ ok: true });
+      sendCount += 1;
+      if (sendCount === 1) return jsonResponse({ error: true }, 500);
+      return jsonResponse({ results: [{ token: 'token100', ok: false, drop: true }] });
+    });
+    vi.stubGlobal('fetch', fetchMock);
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const runtime = createApnsRuntime(makeDeps());
+    const tokens = Array.from({ length: 101 }, (_, i) => `token${String(i).padStart(3, '0')}`);
+    for (const [i, token] of tokens.entries()) {
+      await runtime.addOrUpdateApnsToken(`s${i}`, token);
+    }
+
+    try {
+      fetchMock.mockClear();
+      await runtime.sendApnsToAllUiSessions({ title: 't', body: 'b' });
+      const sendCalls = fetchMock.mock.calls.filter(([url]) => String(url).endsWith('/v1/push/send'));
+      expect(sendCalls).toHaveLength(2);
+      expect(sendCalls.map(([, init]) => JSON.parse(init.body).tokens).flat()).toHaveLength(101);
+
+      fetchMock.mockClear();
+      await runtime.sendApnsToAllUiSessions({ title: 't', body: 'b' });
+      const retryTokens = fetchMock.mock.calls
+        .filter(([url]) => String(url).endsWith('/v1/push/send'))
+        .flatMap(([, init]) => JSON.parse(init.body).tokens);
+      expect(retryTokens).not.toContain('token100');
+      expect(retryTokens).toHaveLength(100);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('sends localized scenario titles grouped by stored token locale', async () => {
+    const fetchMock = vi.fn(async () => jsonResponse({ ok: true, results: [] }));
+    vi.stubGlobal('fetch', fetchMock);
+    process.env.OPENCHAMBER_PUSH_RELAY_URL = 'https://relay.test/v1/push/send';
+
+    const runtime = createApnsRuntime(makeDeps());
+    await runtime.addOrUpdateApnsToken('s1', 'tokenEn', undefined, 'ios', 'en');
+    await runtime.addOrUpdateApnsToken('s2', 'tokenZh', undefined, 'ios', 'zh-CN');
+    await runtime.addOrUpdateApnsToken('s3', 'tokenJa', undefined, 'android', 'ja');
+
+    fetchMock.mockClear();
+    await runtime.sendApnsToAllUiSessions({
+      type: 'ready',
+      sessionName: 'My session',
+      badge: 2,
+      tag: 'ready-x',
+      data: { sessionId: 'sess1' },
+    });
+
+    const sendBodies = fetchMock.mock.calls
+      .filter(isSend)
+      .map(([, init]) => JSON.parse(init.body));
+    expect(sendBodies).toHaveLength(3);
+
+    const byTitle = Object.fromEntries(sendBodies.map((body) => [body.title, body]));
+    expect(byTitle['Agent response is ready']?.tokens).toEqual(['tokenEn']);
+    expect(byTitle['智能体回复已就绪']?.tokens).toEqual(['tokenZh']);
+    expect(byTitle['エージェントの応答が準備できました']?.tokens).toEqual(['tokenJa']);
+    for (const body of sendBodies) {
+      expect(body.body).toBe('My session');
+      expect(body.badge).toBe(2);
+      const sendMessage = `${body.ts}.${[...body.tokens].sort().join(',')}.${body.title}`;
+      expect(await verifyRelaySignature(body.publicKeyJwk, sendMessage, body.sig)).toBe(true);
+    }
+  });
+
+  it('defaults missing token locale to English titles', async () => {
+    const fetchMock = vi.fn(async () => jsonResponse({ ok: true, results: [] }));
+    vi.stubGlobal('fetch', fetchMock);
+    process.env.OPENCHAMBER_PUSH_RELAY_URL = 'https://relay.test/v1/push/send';
+
+    const runtime = createApnsRuntime(makeDeps());
+    await runtime.addOrUpdateApnsToken('s1', 'tokenLegacy');
+
+    fetchMock.mockClear();
+    await runtime.sendApnsToAllUiSessions({ type: 'permission', sessionName: 'S' });
+
+    const sent = JSON.parse(fetchMock.mock.calls.find(isSend)[1].body);
+    expect(sent.title).toBe('Agent needs permission');
+    expect(sent.body).toBe('S');
+  });
 });