@saadnvd1/agent-os 0.3.514 → 0.3.517

package/README.md

@@ -914,6 +914,32 @@ line at the bottom of Schedules), one of:
 - **Telegram**: a bot token and your chat id. The token is kept in the
   database and never shown again, returned by the API or logged.
 
+#### Push to the phone app
+
+A machine linked to Connect sends to the paired phones that have registered
+for push, instead of Telegram. A push is generic: the title "AgentOS", a
+category word and a link to open, no session or task text (the payload is a
+versioned envelope, so an encrypted body can replace it later). It goes
+through the Connect relay, signed with the machine key; AgentOS keeps a
+`push_outbox` that retries with backoff, forgets tokens the relay reports as
+dead, and caps alerting pushes at 10 an hour per device (one summary after).
+
+- **What pushes**: an ask raised, a session waiting on you for a minute,
+  a task ready for review, CI or a review failing, a plan ready to approve,
+  and the Away digest. Merged is off by default. Each device picks its
+  categories (`PATCH /api/devices/me/push`). A task mirrored from another
+  machine never pushes from here.
+- **Quiet rules**: waiting, review, CI and merged don't push while you're at
+  this Mac (keyboard or mouse used in the last 3 minutes). While Away is on,
+  everything except asks folds into the 10-minute digest.
+- **Fallback**: agent messages, the Away digest and machine alerts (load,
+  schedules) go to Telegram when push isn't configured or fails. The newer
+  events are push-only. If Connect says push isn't set up yet, AgentOS
+  stops asking for 10 minutes and uses Telegram meanwhile.
+- **Check it**: `aos push test` sends a real push to each registered phone
+  and prints what came back; Settings → Devices shows each device's push
+  state, categories, last error and a Send test button.
+
 ## Agent network
 
 Sessions started by AgentOS can find and talk to each other without you,
@@ -940,6 +966,7 @@ aos schedules                     # every schedule, its next run and last outcom
 aos schedule run <name>           # run a schedule now
 aos schedule add --session <s> --every 30m "prompt"  # check in on a session
 aos notify "text"                 # push a message to your phone
+aos push test                     # a real test push to the paired phones, and the result
 aos heavy -- npm test             # run it now; says first what else heavy is running
 aos stop <session>                # stop its turn now; the next message runs as a new turn
 aos done <session>                # finished: merge through the gates, archive
@@ -1585,7 +1612,13 @@ device can use AgentOS but can't add devices or change access; only this
 machine and the tailnet can.
 
 AgentOS also refuses requests addressed to any other host name (DNS rebinding),
-and API calls or terminal connections made by another website's page.
+and API calls or terminal connections made by another website's page. That
+Origin check holds whatever `AGENTOS_BIND` says: a page may write to the API
+or open a terminal, chat or status socket only from this machine's own
+addresses (loopback, the addresses it listens on, its tailnet name, its own
+Connect address and `AGENTOS_ALLOWED_HOSTS`). Another Connect machine's page
+is always refused. With `AGENTOS_BIND=0.0.0.0`, reaching it by a DNS name
+other than these needs that name in `AGENTOS_ALLOWED_HOSTS`.
 
 | Variable                               | Effect                                                                                                 |
 | -------------------------------------- | ------------------------------------------------------------------------------------------------------ |
@@ -1613,6 +1646,12 @@ While Connect is on, the production server:
 - asks the Connect service for a fresh connector token on every start and hands
   it to `cloudflared tunnel run` in `TUNNEL_TOKEN` only, never in argv, a file
   or a log;
+- starts cloudflared only once AgentOS holds the tunnel port and has seen a
+  connection to it arrive on its own listener, and stops it if the listener
+  goes, so it never publishes something else on that port;
+- runs cloudflared in a process group of its own under a small watchdog that
+  kills it the moment AgentOS exits, however it exits, and kills one a crash
+  left behind (from `cloudflared.pid`) before starting another;
 - restarts cloudflared with backoff if it exits, and stops it when Connect is
   turned off. Devices shows its state.
 

package/app/api/devices/me/push/route.test.ts

@@ -0,0 +1,209 @@
+import { NextRequest } from "next/server";
+import { describe, expect, it } from "vitest";
+import { DELETE, PATCH, PUT } from "./route";
+import { DELETE as SELF_DELETE } from "../route";
+import {
+  deviceForToken,
+  getDevicePush,
+  mintDevice,
+  revokeDevice,
+} from "@/lib/security/devices";
+import { DEVICE_HEADER } from "@/lib/security/auth";
+import { getDb } from "@/lib/db";
+import { defaultCategories } from "@/lib/notify/copy";
+
+const call = (
+  fn: (r: NextRequest) => Promise<Response>,
+  method: string,
+  device: string | null,
+  body?: unknown
+) =>
+  fn(
+    new NextRequest("http://x/api/devices/me/push", {
+      method,
+      headers: device ? { [DEVICE_HEADER]: device } : {},
+      body: body === undefined ? undefined : JSON.stringify(body),
+    })
+  );
+
+const tok = (n: number) => "apns" + String(n).padStart(8, "0") + "ab".repeat(8);
+
+describe("/api/devices/me/push", () => {
+  it("refuses a request that isn't from a paired device", async () => {
+    for (const [fn, m] of [
+      [PUT, "PUT"],
+      [PATCH, "PATCH"],
+      [DELETE, "DELETE"],
+    ] as const)
+      expect((await call(fn, m, null, { token: tok(1) })).status).toBe(403);
+    expect(
+      (
+        await SELF_DELETE(
+          new NextRequest("http://x/api/devices/me", { method: "DELETE" })
+        )
+      ).status
+    ).toBe(403);
+  });
+
+  it("registers, defaults the categories, and is idempotent", async () => {
+    const { device } = mintDevice("phone");
+    const res = await call(PUT, "PUT", device.id, {
+      token: tok(2),
+      environment: "sandbox",
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toMatchObject({
+      deviceId: device.id,
+      enabled: true,
+      platform: "ios",
+      environment: "sandbox",
+      categories: defaultCategories(),
+    });
+    const again = await call(PUT, "PUT", device.id, {
+      token: tok(2),
+      environment: "sandbox",
+    });
+    expect(again.status).toBe(200);
+    expect(getDevicePush(device.id)?.token).toBe(tok(2));
+  });
+
+  it("a new token replaces the old and keeps saved categories", async () => {
+    const { device } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(3) });
+    await call(PATCH, "PATCH", device.id, { categories: ["asks", "merged"] });
+    await call(PUT, "PUT", device.id, { token: tok(4) });
+    expect(getDevicePush(device.id)).toMatchObject({
+      token: tok(4),
+      categories: ["asks", "merged"],
+    });
+  });
+
+  it("moves a token from the device that held it", async () => {
+    const a = mintDevice("old pairing").device;
+    const b = mintDevice("new pairing").device;
+    await call(PUT, "PUT", a.id, { token: tok(5) });
+    await call(PUT, "PUT", b.id, { token: tok(5) });
+    expect(getDevicePush(a.id)).toBeNull();
+    expect(getDevicePush(b.id)?.token).toBe(tok(5));
+  });
+
+  it("rejects bad input", async () => {
+    const { device } = mintDevice("phone");
+    for (const b of [
+      {},
+      { token: "short" },
+      { token: "bad token with spaces!!" },
+      { token: tok(6), platform: "palm" },
+      { token: tok(6), environment: "staging" },
+      { token: tok(6), categories: ["asks", "nope"] },
+      { token: tok(6), categories: "asks" },
+    ])
+      expect((await call(PUT, "PUT", device.id, b)).status).toBe(400);
+    expect(getDevicePush(device.id)).toBeNull();
+  });
+
+  it("PATCH sets categories, needs a registration, and validates", async () => {
+    const { device } = mintDevice("phone");
+    expect(
+      (await call(PATCH, "PATCH", device.id, { categories: ["asks"] })).status
+    ).toBe(404);
+    await call(PUT, "PUT", device.id, { token: tok(7) });
+    expect(
+      (await call(PATCH, "PATCH", device.id, { categories: ["x"] })).status
+    ).toBe(400);
+    expect((await call(PATCH, "PATCH", device.id, {})).status).toBe(400);
+    const res = await call(PATCH, "PATCH", device.id, {
+      categories: ["ci", "ci"],
+    });
+    expect((await res.json()).categories).toEqual(["ci"]);
+    await call(PATCH, "PATCH", device.id, { categories: [] });
+    expect(getDevicePush(device.id)?.categories).toEqual([]);
+  });
+
+  it("DELETE clears push for this device only", async () => {
+    const a = mintDevice("a").device;
+    const b = mintDevice("b").device;
+    await call(PUT, "PUT", a.id, { token: tok(8) });
+    await call(PUT, "PUT", b.id, { token: tok(9) });
+    const res = await call(DELETE, "DELETE", a.id);
+    expect(await res.json()).toMatchObject({ enabled: false });
+    expect(getDevicePush(a.id)).toBeNull();
+    expect(getDevicePush(b.id)).not.toBeNull();
+  });
+
+  it("refuses an oversized body", async () => {
+    const { device } = mintDevice("phone");
+    const res = await call(PUT, "PUT", device.id, {
+      token: tok(14),
+      pad: "x".repeat(5000),
+    });
+    expect(res.status).toBe(413);
+    expect(getDevicePush(device.id)).toBeNull();
+  });
+
+  it("reads a corrupt saved category list as the defaults", async () => {
+    const { device } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(15) });
+    for (const junk of ["{not json", '"asks"', "7"]) {
+      getDb()
+        .prepare(`UPDATE devices SET push_categories = ? WHERE id = ?`)
+        .run(junk, device.id);
+      expect(getDevicePush(device.id)?.categories).toEqual(defaultCategories());
+    }
+  });
+
+  it("never returns the token", async () => {
+    const { device } = mintDevice("phone");
+    const res = await call(PUT, "PUT", device.id, { token: tok(10) });
+    expect(JSON.stringify(await res.json())).not.toContain(tok(10));
+  });
+});
+
+describe("device revocation and push", () => {
+  it("revoking clears every push column", async () => {
+    const { device } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(11), categories: ["asks"] });
+    expect(revokeDevice(device.id)).toBe(true);
+    const row = getDb()
+      .prepare(
+        `SELECT push_token, push_platform, push_environment, push_categories,
+                push_updated_at, push_last_error FROM devices WHERE id = ?`
+      )
+      .get(device.id);
+    expect(Object.values(row as object).every((v) => v === null)).toBe(true);
+    expect(getDevicePush(device.id)).toBeNull();
+  });
+
+  it("DELETE /api/devices/me revokes the caller and its push", async () => {
+    const { device, token } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(12) });
+    const res = await SELF_DELETE(
+      new NextRequest("http://x/api/devices/me", {
+        method: "DELETE",
+        headers: { [DEVICE_HEADER]: device.id },
+      })
+    );
+    expect(res.status).toBe(200);
+    expect(deviceForToken(token)).toBeNull();
+    expect(getDevicePush(device.id)).toBeNull();
+    // A second sign-out finds nothing.
+    expect(
+      (
+        await SELF_DELETE(
+          new NextRequest("http://x/api/devices/me", {
+            method: "DELETE",
+            headers: { [DEVICE_HEADER]: device.id },
+          })
+        )
+      ).status
+    ).toBe(404);
+  });
+
+  it("a revoked device can't register push", async () => {
+    const { device } = mintDevice("phone");
+    revokeDevice(device.id);
+    expect((await call(PUT, "PUT", device.id, { token: tok(13) })).status).toBe(
+      404
+    );
+  });
+});

package/app/api/devices/me/push/route.ts

@@ -0,0 +1,115 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  clearDevicePush,
+  getDevicePush,
+  setDevicePush,
+  setDevicePushCategories,
+} from "@/lib/security/devices";
+import { callingDevice, needsDevice } from "@/lib/security/device-me";
+import { readCapped } from "@/lib/security/read-capped";
+import { isPushCategory } from "@/lib/notify/copy";
+import {
+  PUSH_ENVIRONMENTS,
+  PUSH_PLATFORMS,
+  type PushCategory,
+  type PushEnvironment,
+  type PushPlatform,
+} from "@/lib/notify/push-types";
+
+const bad = (error: string) => NextResponse.json({ error }, { status: 400 });
+
+const MAX_BODY_BYTES = 4096;
+
+/** The JSON body, or null when it's over the cap. Bad JSON reads as empty. */
+async function body(request: NextRequest) {
+  const text = await readCapped(request, MAX_BODY_BYTES);
+  if (text === null) return null;
+  try {
+    const v = JSON.parse(text || "{}");
+    return (v && typeof v === "object" ? v : {}) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+const tooBig = () => NextResponse.json({ error: "Too large" }, { status: 413 });
+
+/** Undefined if absent, null if present but invalid. */
+function categoriesOf(v: unknown): PushCategory[] | undefined | null {
+  if (v === undefined) return undefined;
+  if (!Array.isArray(v) || !v.every(isPushCategory)) return null;
+  return [...new Set(v)];
+}
+
+const view = (id: string) => {
+  const p = getDevicePush(id);
+  return {
+    deviceId: id,
+    enabled: !!p,
+    categories: p?.categories ?? [],
+    environment: p?.environment ?? null,
+    platform: p?.platform ?? null,
+    lastError: p?.lastError ?? null,
+  };
+};
+
+// PUT /api/devices/me/push - register or refresh this device's push token
+export async function PUT(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  const b = await body(request);
+  if (!b) return tooBig();
+  const token = b.token;
+  if (
+    typeof token !== "string" ||
+    token.length < 8 ||
+    token.length > 512 ||
+    !/^[A-Za-z0-9:_.\-]+$/.test(token)
+  )
+    return bad("token must be a device push token");
+  const platform = b.platform ?? "ios";
+  const environment = b.environment ?? "production";
+  if (!PUSH_PLATFORMS.includes(platform as PushPlatform))
+    return bad("platform must be ios or android");
+  if (!PUSH_ENVIRONMENTS.includes(environment as PushEnvironment))
+    return bad("environment must be production or sandbox");
+  const categories = categoriesOf(b.categories);
+  if (categories === null) return bad("categories must be known names");
+  // Intended: a phone re-paired to this machine gets a new device row and the
+  // same APNs token, which must move to it so the old row stops getting sends.
+  // Only a holder of a valid device token can register one.
+  if (
+    !setDevicePush(id, {
+      token,
+      platform: platform as PushPlatform,
+      environment: environment as PushEnvironment,
+      categories,
+    })
+  )
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json(view(id));
+}
+
+// PATCH /api/devices/me/push - choose which categories to receive
+export async function PATCH(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  const b = await body(request);
+  if (!b) return tooBig();
+  const categories = categoriesOf(b.categories);
+  if (!categories) return bad("categories must be a list of known names");
+  if (!setDevicePushCategories(id, categories))
+    return NextResponse.json(
+      { error: "Push isn't registered" },
+      { status: 404 }
+    );
+  return NextResponse.json(view(id));
+}
+
+// DELETE /api/devices/me/push - stop pushing to this device
+export async function DELETE(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  clearDevicePush(id);
+  return NextResponse.json(view(id));
+}

package/app/api/devices/me/route.ts

@@ -0,0 +1,12 @@
+import { NextRequest, NextResponse } from "next/server";
+import { revokeDevice } from "@/lib/security/devices";
+import { callingDevice, needsDevice } from "@/lib/security/device-me";
+
+// DELETE /api/devices/me - the device signs itself out ("Forget machine")
+export async function DELETE(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  if (!revokeDevice(id))
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json({ ok: true });
+}

package/app/api/devices/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { listDevices } from "@/lib/security/devices";
 import { DEVICE_HEADER, TRUST_HEADER } from "@/lib/security/auth";
 import { demoMode } from "@/lib/security/demo";
+import { pushStatus } from "@/lib/notify/push";
 
 // GET /api/devices - paired devices, and how this request was trusted
 export async function GET(request: NextRequest) {
@@ -10,6 +11,7 @@ export async function GET(request: NextRequest) {
     devices: demoMode()
       ? listDevices().map(({ last_address: _a, user_agent: _u, ...d }) => d)
       : listDevices(),
+    push: pushStatus(),
     current: {
       deviceId: request.headers.get(DEVICE_HEADER),
       via: request.headers.get(TRUST_HEADER),

package/app/api/push/test/route.test.ts

@@ -0,0 +1,112 @@
+import { NextRequest } from "next/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const relaySend = vi.fn();
+vi.mock("@/lib/notify/push/relay", () => ({
+  linked: () => true,
+  NOT_LINKED: "this machine isn't linked to Connect",
+  relaySend: (...a: unknown[]) => relaySend(...a),
+}));
+
+const { POST } = await import("./route");
+const { GET } = await import("../../devices/route");
+const { pairPhone, resetPush } = await import("@/lib/notify/push/testing");
+const { db } = await import("@/lib/db");
+
+const post = (body?: unknown) =>
+  POST(
+    new NextRequest("http://x/api/push/test", {
+      method: "POST",
+      body: body === undefined ? undefined : JSON.stringify(body),
+    })
+  );
+
+beforeEach(() => {
+  resetPush();
+  relaySend.mockReset();
+  relaySend.mockImplementation(async (b: { devices: unknown[] }) => ({
+    kind: "results",
+    results: b.devices.map(() => ({ status: "sent" })),
+  }));
+});
+
+describe("POST /api/push/test", () => {
+  it("409s with no phone registered", async () => {
+    expect((await post({})).status).toBe(409);
+    expect(relaySend).not.toHaveBeenCalled();
+  });
+
+  it("404s for a device with no push", async () => {
+    pairPhone();
+    expect((await post({ deviceId: "nope" })).status).toBe(404);
+  });
+
+  it("sends to the named device only and says what happened", async () => {
+    const a = pairPhone();
+    pairPhone();
+    const res = await post({ deviceId: a });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({
+      results: [{ deviceId: a, status: "sent", error: null }],
+      unavailable: null,
+    });
+    expect(relaySend).toHaveBeenCalledTimes(1);
+  });
+
+  it("explains when push isn't set up", async () => {
+    pairPhone();
+    relaySend.mockResolvedValue({
+      kind: "unavailable",
+      reason: "push isn't set up on the Connect service yet",
+    });
+    const res = await post({});
+    const body = await res.json();
+    expect(body.results[0].status).toBe("failed");
+    expect(body.unavailable).toMatch(/isn't set up/);
+  });
+});
+
+describe("GET /api/devices push status", () => {
+  it("lists each device's push state and categories, never the token", async () => {
+    const id = pairPhone(["asks", "review"]);
+    const res = await GET(new NextRequest("http://x/api/devices"));
+    const body = await res.json();
+    const device = body.devices.find((d: { id: string }) => d.id === id);
+    expect(device.push).toEqual({
+      enabled: true,
+      categories: ["asks", "review"],
+      lastError: null,
+      updatedAt: expect.any(String),
+    });
+    expect(body.push).toEqual({ linked: true, unavailable: null });
+    const token = (
+      db.prepare(`SELECT push_token FROM devices WHERE id = ?`).get(id) as {
+        push_token: string;
+      }
+    ).push_token;
+    expect(JSON.stringify(body)).not.toContain(token);
+    expect(Object.keys(device)).not.toContain("push_token");
+  });
+
+  it("shows a device with no push as off, and a pruned one with its error", async () => {
+    const { mintDevice, pruneDevicePush } =
+      await import("@/lib/security/devices");
+    const off = mintDevice("laptop").device.id;
+    const dead = pairPhone();
+    pruneDevicePush(dead, "token no longer valid (Unregistered)");
+    const body = await (
+      await GET(new NextRequest("http://x/api/devices"))
+    ).json();
+    const by = (id: string) =>
+      body.devices.find((d: { id: string }) => d.id === id).push;
+    expect(by(off)).toMatchObject({
+      enabled: false,
+      categories: [],
+      lastError: null,
+    });
+    expect(by(dead)).toMatchObject({
+      enabled: false,
+      lastError: expect.stringMatching(/Unregistered/),
+    });
+  });
+});

package/app/api/push/test/route.ts

@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { sendTestPush } from "@/lib/notify/push";
+import { listPushDevices } from "@/lib/security/devices";
+import { readCapped } from "@/lib/security/read-capped";
+
+// POST /api/push/test { deviceId? } - a real push to the registered phones
+// now, ignoring the quiet rules, and what the relay said about each.
+export async function POST(request: NextRequest) {
+  let deviceId: string | undefined;
+  try {
+    const text = await readCapped(request, 1024);
+    if (text === null)
+      return NextResponse.json({ error: "Too large" }, { status: 413 });
+    const v = JSON.parse(text || "{}");
+    if (typeof v?.deviceId === "string") deviceId = v.deviceId;
+  } catch {
+    return NextResponse.json({ error: "Bad JSON" }, { status: 400 });
+  }
+  const devices = listPushDevices().filter(
+    (d) => !deviceId || d.id === deviceId
+  );
+  if (!devices.length)
+    return NextResponse.json(
+      {
+        error: deviceId
+          ? "That device has no push registered"
+          : "No phone has push registered yet",
+      },
+      { status: deviceId ? 404 : 409 }
+    );
+  const { results, unavailable } = await sendTestPush(deviceId);
+  if (unavailable && !results.length)
+    return NextResponse.json(
+      { error: `Push isn't available: ${unavailable}` },
+      { status: 409 }
+    );
+  return NextResponse.json({ results, unavailable });
+}

package/components/Devices/DeviceRow.tsx

@@ -2,8 +2,13 @@
 
 import { Laptop, Smartphone, Tablet, Trash2 } from "lucide-react";
 import { Button } from "@/components/ui/button";
-import type { Device } from "@/lib/security/devices";
-import { useRevokeDevice, useSetCanApprove } from "@/data/devices";
+import type { ListedDevice } from "@/lib/security/devices";
+import { CATEGORIES } from "@/lib/notify/copy";
+import {
+  useRevokeDevice,
+  useSendTestPush,
+  useSetCanApprove,
+} from "@/data/devices";
 import { Switch } from "@/components/ui/switch";
 
 // SQLite's datetime('now') is UTC without a zone.
@@ -31,13 +36,22 @@ export function DeviceRow({
   isCurrent,
   canManage,
 }: {
-  device: Device;
+  device: ListedDevice;
   isCurrent: boolean;
   // Only this machine or the tailnet may let a device approve asks.
   canManage: boolean;
 }) {
   const revoke = useRevokeDevice();
   const setCanApprove = useSetCanApprove();
+  const sendTest = useSendTestPush();
+  const tested = sendTest.data?.results[0];
+  const testNote = sendTest.isError
+    ? sendTest.error.message
+    : tested
+      ? tested.status === "sent"
+        ? "Test sent"
+        : `Test failed: ${tested.error}`
+      : null;
 
   const onRevoke = () => {
     if (
@@ -64,7 +78,42 @@ export function DeviceRow({
           {lastSeen(device.last_seen_at)}
           {device.last_address ? ` · ${device.last_address}` : ""}
         </p>
+        {device.push.enabled && (
+          <p className="text-muted-foreground truncate text-xs">
+            Push on ·{" "}
+            {device.push.categories
+              .map((c) => CATEGORIES[c].label)
+              .join(", ") || "nothing selected"}
+          </p>
+        )}
+        {device.push.lastError && (
+          <p
+            className="text-destructive truncate text-xs"
+            title={device.push.lastError}
+          >
+            Push error: {device.push.lastError}
+          </p>
+        )}
+        {testNote && (
+          <p
+            className={`truncate text-xs ${tested?.status === "sent" ? "text-muted-foreground" : "text-destructive"}`}
+            role="status"
+          >
+            {testNote}
+          </p>
+        )}
       </div>
+      {device.push.enabled && (
+        <Button
+          variant="outline"
+          size="sm"
+          className="h-11 shrink-0 sm:h-8"
+          onClick={() => sendTest.mutate(device.id)}
+          disabled={sendTest.isPending}
+        >
+          {sendTest.isPending ? "Sending…" : "Send test"}
+        </Button>
+      )}
       <label className="text-muted-foreground flex min-h-11 shrink-0 items-center gap-2 text-xs sm:min-h-8">
         Can approve
         <Switch

package/components/Devices/DevicesPanel.tsx

@@ -43,6 +43,19 @@ export function DevicesPanel() {
         )
       )}
 
+      {data && !data.push.linked && (
+        <p className="text-muted-foreground text-sm">
+          Phone push needs this machine linked to Connect. Until then,
+          notifications go to Telegram if it&apos;s set up.
+        </p>
+      )}
+      {data?.push.unavailable && (
+        <p className="text-destructive text-sm">
+          Push is paused: {data.push.unavailable}. Notifications go to Telegram
+          meanwhile.
+        </p>
+      )}
+
       <div className="space-y-2">
         {isPending && (
           <div className="bg-muted/40 h-14 animate-pulse rounded-lg" />