@saadnvd1/agent-os 0.3.514 → 0.3.517

package/lib/notify/push/outbox.ts

@@ -0,0 +1,238 @@
+/**
+ * The push outbox (SQLite, so a restart keeps what's waiting): one row per
+ * event and device. A row is marked `sending` before the relay is called; a
+ * restart puts it back to `pending`, and the repeat carries the same collapse
+ * id, so the phone replaces the alert rather than stacking a second.
+ */
+
+import { db } from "../../db";
+import type { PushCategory, PushLevel } from "../push-types";
+import { HOUR_MS } from "./policy";
+
+export type PushState =
+  | "pending"
+  | "sending"
+  | "sent"
+  | "failed"
+  | "gone"
+  | "capped"
+  | "superseded"
+  | "folded"
+  | "digested";
+
+export interface OutboxRow {
+  id: number;
+  event_key: string;
+  device_id: string;
+  category: PushCategory;
+  level: PushLevel;
+  payload: string;
+  collapse_id: string | null;
+  state: PushState;
+  attempts: number;
+  next_attempt_at: number;
+  created_at: number;
+  sent_at: number | null;
+  error: string | null;
+  fallback_source: string | null;
+  fallback_text: string | null;
+}
+
+/** An event older than this isn't worth buzzing about any more. */
+export const MAX_AGE_MS = HOUR_MS;
+const KEEP_MS = 7 * 24 * HOUR_MS;
+
+export const isTestKey = (eventKey: string) => eventKey.startsWith("test:");
+
+export interface NewRow {
+  eventKey: string;
+  deviceId: string;
+  category: PushCategory;
+  level: PushLevel;
+  payload: unknown;
+  collapseId: string | null;
+  state?: "pending" | "capped" | "folded";
+  now: number;
+  fallback?: { source: string; text: string } | null;
+}
+
+/** False when this event was already queued for the device. */
+export function enqueue(r: NewRow): boolean {
+  const state = r.state ?? "pending";
+  return db.transaction(() => {
+    const { changes } = db
+      .prepare(
+        `INSERT OR IGNORE INTO push_outbox
+           (event_key, device_id, category, level, payload, collapse_id, state,
+            next_attempt_at, created_at, fallback_source, fallback_text)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      )
+      .run(
+        r.eventKey,
+        r.deviceId,
+        r.category,
+        r.level,
+        JSON.stringify(r.payload),
+        r.collapseId,
+        state,
+        r.now,
+        r.now,
+        r.fallback?.source ?? null,
+        r.fallback?.text ?? null
+      );
+    if (changes && state === "pending" && r.collapseId)
+      db.prepare(
+        `UPDATE push_outbox SET state = 'superseded'
+         WHERE device_id = ? AND collapse_id = ? AND state = 'pending' AND event_key != ?`
+      ).run(r.deviceId, r.collapseId, r.eventKey);
+    return changes > 0;
+  })();
+}
+
+/** Alerting pushes made for a device in the last hour (the cap's count). */
+export function alertingSince(deviceId: string, now: number): number {
+  return (
+    db
+      .prepare(
+        `SELECT COUNT(*) AS n FROM push_outbox
+         WHERE device_id = ? AND created_at > ? AND level != 'passive'
+           AND category != 'asks' AND event_key NOT LIKE 'test:%'
+           AND state IN ('pending', 'sending', 'sent')`
+      )
+      .get(deviceId, now - HOUR_MS) as { n: number }
+  ).n;
+}
+
+/** Folded into the next Away digest: how many were waiting, now counted. */
+export function takeFolded(now: number): number {
+  return db
+    .prepare(
+      `UPDATE push_outbox SET state = 'digested', sent_at = ? WHERE state = 'folded'`
+    )
+    .run(now).changes;
+}
+
+/** Pending rows past their age limit fail; returns their event keys. */
+export function expire(now: number): string[] {
+  const rows = db
+    .prepare(
+      `SELECT DISTINCT event_key FROM push_outbox WHERE state = 'pending' AND created_at < ?`
+    )
+    .all(now - MAX_AGE_MS) as { event_key: string }[];
+  if (rows.length)
+    db.prepare(
+      `UPDATE push_outbox SET state = 'failed', error = 'too old to send'
+       WHERE state = 'pending' AND created_at < ?`
+    ).run(now - MAX_AGE_MS);
+  return rows.map((r) => r.event_key);
+}
+
+/** Due rows, marked sending with the attempt counted. */
+export function claimDue(now: number, limit = 50): OutboxRow[] {
+  return db.transaction(() => {
+    const rows = db
+      .prepare(
+        `SELECT * FROM push_outbox WHERE state = 'pending' AND next_attempt_at <= ?
+         ORDER BY id LIMIT ?`
+      )
+      .all(now, limit) as OutboxRow[];
+    const mark = db.prepare(
+      `UPDATE push_outbox SET state = 'sending', attempts = attempts + 1 WHERE id = ?`
+    );
+    for (const r of rows) {
+      mark.run(r.id);
+      r.attempts += 1;
+      r.state = "sending";
+    }
+    return rows;
+  })();
+}
+
+export function markSent(id: number, now: number): void {
+  db.prepare(
+    `UPDATE push_outbox SET state = 'sent', sent_at = ?, error = NULL WHERE id = ?`
+  ).run(now, id);
+}
+
+export function markFailed(id: number, error: string, gone = false): void {
+  db.prepare(`UPDATE push_outbox SET state = ?, error = ? WHERE id = ?`).run(
+    gone ? "gone" : "failed",
+    error.slice(0, 200),
+    id
+  );
+}
+
+export function markRetry(id: number, at: number, error: string): void {
+  db.prepare(
+    `UPDATE push_outbox SET state = 'pending', next_attempt_at = ?, error = ? WHERE id = ?`
+  ).run(at, error.slice(0, 200), id);
+}
+
+/** Everything waiting fails at once, so a dead relay is asked once, not per row. */
+export function failPending(error: string): string[] {
+  const keys = db
+    .prepare(
+      `SELECT DISTINCT event_key FROM push_outbox WHERE state = 'pending'`
+    )
+    .all() as { event_key: string }[];
+  db.prepare(
+    `UPDATE push_outbox SET state = 'failed', error = ? WHERE state = 'pending'`
+  ).run(error.slice(0, 200));
+  return keys.map((k) => k.event_key);
+}
+
+/** Every row of the event has ended and none reached a phone. */
+export function claimFallback(
+  eventKey: string
+): { source: string; text: string } | null {
+  return db.transaction(() => {
+    const rows = db
+      .prepare(
+        `SELECT state, fallback_source, fallback_text FROM push_outbox WHERE event_key = ?`
+      )
+      .all(eventKey) as Pick<
+      OutboxRow,
+      "state" | "fallback_source" | "fallback_text"
+    >[];
+    if (
+      !rows.length ||
+      !rows.every((r) => r.state === "failed" || r.state === "gone")
+    )
+      return null;
+    const row = rows.find((r) => r.fallback_text);
+    if (!row?.fallback_text) return null;
+    db.prepare(
+      `UPDATE push_outbox SET fallback_text = NULL WHERE event_key = ?`
+    ).run(eventKey);
+    return { source: row.fallback_source ?? "push", text: row.fallback_text };
+  })();
+}
+
+export function nextDueAt(): number | null {
+  const r = db
+    .prepare(
+      `SELECT MIN(next_attempt_at) AS at FROM push_outbox WHERE state = 'pending'`
+    )
+    .get() as { at: number | null };
+  return r.at;
+}
+
+export function rowsFor(eventKey: string): OutboxRow[] {
+  return db
+    .prepare(`SELECT * FROM push_outbox WHERE event_key = ? ORDER BY id`)
+    .all(eventKey) as OutboxRow[];
+}
+
+/** After a restart: what was mid-send goes again; old history is dropped. */
+export function resume(now: number): void {
+  db.prepare(
+    `UPDATE push_outbox SET state = 'pending', next_attempt_at = ? WHERE state = 'sending'`
+  ).run(now);
+  db.prepare(
+    `DELETE FROM push_outbox WHERE state NOT IN ('pending', 'sending', 'folded')
+       AND created_at < ?`
+  ).run(now - KEEP_MS);
+  db.prepare(
+    `DELETE FROM push_outbox WHERE state = 'folded' AND created_at < ?`
+  ).run(now - 24 * HOUR_MS);
+}

package/lib/notify/push/policy.ts

@@ -0,0 +1,33 @@
+/** Which events the quiet rules apply to. Pure. */
+
+import type { PushCategory } from "../push-types";
+
+/** Alerting pushes per device per rolling hour; beyond it, one summary. */
+export const CAP_PER_HOUR = 10;
+export const HOUR_MS = 3_600_000;
+/** The Mac counts as "being used" when the keyboard or mouse moved this recently. */
+export const AT_MAC_MS = 3 * 60_000;
+/** A needs-you push waits this long, and is dropped if the session moves on. */
+export const WAIT_MS = 60_000;
+
+/** At the desk he sees these there. Asks are escalations and always push. */
+const PRESENCE_GATED: ReadonlySet<PushCategory> = new Set([
+  "needs-you",
+  "review",
+  "ci",
+  "merged",
+]);
+/** While Away is on these wait for its 10-minute digest. */
+const FOLDS_WHEN_AWAY: ReadonlySet<PushCategory> = new Set([
+  "needs-you",
+  "review",
+  "ci",
+  "merged",
+  "agents",
+  "system",
+]);
+const CAP_EXEMPT: ReadonlySet<PushCategory> = new Set(["asks"]);
+
+export const presenceGated = (c: PushCategory) => PRESENCE_GATED.has(c);
+export const foldsWhenAway = (c: PushCategory) => FOLDS_WHEN_AWAY.has(c);
+export const capExempt = (c: PushCategory) => CAP_EXEMPT.has(c);

package/lib/notify/push/presence.ts

@@ -0,0 +1,45 @@
+/**
+ * Is Saad at this Mac right now? macOS reports how long the keyboard and
+ * mouse have been still. A machine with no display (or any error) is away.
+ */
+
+import { execFile } from "child_process";
+import { AT_MAC_MS } from "./policy";
+
+/** Seconds idle from `ioreg -c IOHIDSystem` output, or null. */
+export function parseHidIdle(text: string): number | null {
+  const m = /"HIDIdleTime"\s*=\s*(\d+)/.exec(text);
+  return m ? Number(m[1]) / 1e9 : null;
+}
+
+type Run = () => Promise<string>;
+
+const ioreg: Run = () =>
+  new Promise((resolve, reject) =>
+    execFile(
+      "ioreg",
+      ["-c", "IOHIDSystem"],
+      { timeout: 2000, maxBuffer: 4 * 1024 * 1024 },
+      (err, out) => (err ? reject(err) : resolve(out))
+    )
+  );
+
+const CACHE_MS = 15_000;
+let cached: { at: number; present: boolean } | null = null;
+
+export async function atMac(
+  opts: { platform?: string; run?: Run; now?: number } = {}
+): Promise<boolean> {
+  if ((opts.platform ?? process.platform) !== "darwin") return false;
+  const now = opts.now ?? Date.now();
+  if (cached && now - cached.at < CACHE_MS && !opts.run) return cached.present;
+  let present = false;
+  try {
+    const idle = parseHidIdle(await (opts.run ?? ioreg)());
+    present = idle !== null && idle * 1000 < AT_MAC_MS;
+  } catch {
+    present = false;
+  }
+  if (!opts.run) cached = { at: now, present };
+  return present;
+}

package/lib/notify/push/relay.ts

@@ -0,0 +1,50 @@
+/** The Connect push relay, answered in terms the sender can act on. */
+
+import {
+  ApiError,
+  clean,
+  pushRelay,
+  type PushRequestBody,
+  type PushResult,
+} from "@/lib/connect/control-api";
+import { loadConnect } from "@/lib/connect/config";
+
+export type RelayAnswer =
+  | { kind: "results"; results: PushResult[] }
+  // Nothing will go until someone fixes it: don't ask again for a while.
+  | { kind: "unavailable"; reason: string }
+  // The request itself is wrong: retrying can't help.
+  | { kind: "invalid"; reason: string }
+  | { kind: "retry"; reason: string; afterMs?: number };
+
+export const NOT_LINKED = "this machine isn't linked to Connect";
+
+/** Whether this machine can reach the relay at all. */
+export const linked = () => loadConnect() !== null;
+
+export async function relaySend(body: PushRequestBody): Promise<RelayAnswer> {
+  const files = loadConnect();
+  if (!files) return { kind: "unavailable", reason: NOT_LINKED };
+  try {
+    const results = await pushRelay(files.config, files.machineKey, body);
+    return { kind: "results", results };
+  } catch (err) {
+    if (err instanceof ApiError) {
+      const why = clean(err.message, 120);
+      if (err.status === 503 && err.body.error === "push_not_configured")
+        return {
+          kind: "unavailable",
+          reason: "push isn't set up on the Connect service yet",
+        };
+      if (err.status === 401 || err.status === 403 || err.status === 503)
+        return { kind: "unavailable", reason: why };
+      if (err.status === 400 || err.status === 413)
+        return { kind: "invalid", reason: why };
+      return { kind: "retry", reason: why };
+    }
+    return {
+      kind: "retry",
+      reason: err instanceof Error ? clean(err.message, 120) : "network error",
+    };
+  }
+}

package/lib/notify/push/sender.ts

@@ -0,0 +1,271 @@
+/**
+ * Drains the push outbox into the Connect relay. Never throws at a caller and
+ * never blocks one: `kick()` starts a drain and returns. Retries back off;
+ * a relay that says push isn't set up is left alone for ten minutes instead
+ * of being asked per message, and what was waiting falls back to Telegram.
+ */
+
+import type { PushRequestBody } from "@/lib/connect/control-api";
+import {
+  getDevicePush,
+  pruneDevicePush,
+  setDevicePushError,
+} from "@/lib/security/devices";
+import * as outbox from "./outbox";
+import { relaySend, type RelayAnswer } from "./relay";
+import { isTestKey, type OutboxRow } from "./outbox";
+
+export const MAX_ATTEMPTS = 3;
+const BACKOFF_MS = [30_000, 120_000];
+const MAX_BACKOFF_MS = 600_000;
+export const UNAVAILABLE_MS = 600_000;
+const BATCH = 10;
+/** Dead tokens are hex; anything else would make the relay refuse the batch. */
+const APNS_TOKEN = /^[0-9a-fA-F]{64,200}$/;
+
+export interface SenderDeps {
+  now: () => number;
+  relay: (body: PushRequestBody) => Promise<RelayAnswer>;
+  /** Sends a held message by the other channel. */
+  fallback: (source: string, text: string) => Promise<void>;
+  log: (line: string) => void;
+}
+
+type Sink = SenderDeps["fallback"];
+// On globalThis like the sender: the app's bundles each have their own copy
+// of this module, and the one that sets the sink may not be the one that built
+// the sender.
+const sinks = globalThis as unknown as { __agentosPushFallback?: Sink };
+
+/** Where held text goes when push can't deliver it (Telegram). */
+export function setFallbackSink(fn: Sink): void {
+  sinks.__agentosPushFallback = fn;
+}
+
+const defaults = (): SenderDeps => ({
+  now: () => Date.now(),
+  relay: relaySend,
+  fallback: async (source, text) => sinks.__agentosPushFallback?.(source, text),
+  log: (line) => console.error(`[push] ${line}`),
+});
+
+export class PushSender {
+  private deps: SenderDeps;
+  private running = false;
+  private again = false;
+  private current: Promise<void> = Promise.resolve();
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private down: { until: number; reason: string } | null = null;
+
+  constructor(deps: Partial<SenderDeps> = {}) {
+    this.deps = { ...defaults(), ...deps };
+  }
+
+  /** Why pushes aren't being tried right now, or null. */
+  unavailable(): string | null {
+    if (this.down && this.deps.now() >= this.down.until) this.down = null;
+    return this.down?.reason ?? null;
+  }
+
+  clearUnavailable(): void {
+    this.down = null;
+  }
+
+  /** Stops the retry timer (a test discarding its sender). */
+  dispose(): void {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+  }
+
+  /** Starts a drain if none is running; resolves when it has caught up. */
+  kick(): Promise<void> {
+    if (this.running) {
+      this.again = true;
+      return this.current;
+    }
+    this.running = true;
+    this.current = this.drain().finally(() => {
+      this.running = false;
+      this.arm();
+    });
+    return this.current;
+  }
+
+  /** Re-arms after a restart. */
+  resume(): void {
+    outbox.resume(this.deps.now());
+    void this.kick();
+  }
+
+  private async drain(): Promise<void> {
+    try {
+      do {
+        this.again = false;
+        for (const key of outbox.expire(this.deps.now()))
+          await this.settle(key);
+        for (;;) {
+          const rows = outbox.claimDue(this.deps.now());
+          if (!rows.length) break;
+          const byEvent = new Map<string, OutboxRow[]>();
+          for (const r of rows)
+            byEvent.set(r.event_key, [...(byEvent.get(r.event_key) ?? []), r]);
+          for (const group of byEvent.values())
+            for (let i = 0; i < group.length; i += BATCH)
+              await this.sendGroup(group.slice(i, i + BATCH));
+        }
+      } while (this.again);
+    } catch (error) {
+      this.deps.log(
+        `drain failed: ${error instanceof Error ? error.message : error}`
+      );
+    }
+  }
+
+  private arm(): void {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    const at = outbox.nextDueAt();
+    if (at === null) return;
+    this.timer = setTimeout(
+      () => void this.kick(),
+      Math.max(1000, at - this.deps.now())
+    );
+    this.timer.unref?.();
+  }
+
+  private async sendGroup(rows: OutboxRow[]): Promise<void> {
+    // An earlier group in this drain found the relay unusable.
+    const down = this.unavailable();
+    if (down) {
+      for (const r of rows) outbox.markFailed(r.id, down);
+      for (const key of new Set(rows.map((r) => r.event_key)))
+        await this.settle(key);
+      return;
+    }
+    const sendable: {
+      row: OutboxRow;
+      token: string;
+      env: "production" | "sandbox";
+    }[] = [];
+    for (const row of rows) {
+      const push = getDevicePush(row.device_id);
+      if (!push) outbox.markFailed(row.id, "no push token", true);
+      else if (!APNS_TOKEN.test(push.token)) {
+        outbox.markFailed(row.id, "not an APNs token");
+        setDevicePushError(
+          row.device_id,
+          "the registered token isn't an APNs token"
+        );
+      } else sendable.push({ row, token: push.token, env: push.environment });
+    }
+    // The relay folds a repeated token into one result, so send each once.
+    const seen = new Set<string>();
+    const unique = sendable.filter((s) => {
+      const k = `${s.token.toLowerCase()}:${s.env}`;
+      if (seen.has(k)) {
+        outbox.markFailed(s.row.id, "duplicate token");
+        return false;
+      }
+      seen.add(k);
+      return true;
+    });
+    if (unique.length) {
+      const first = unique[0].row;
+      const answer = await this.deps.relay({
+        v: 1,
+        devices: unique.map((s) => ({ token: s.token, env: s.env })),
+        push_type: "alert",
+        priority: first.level === "passive" ? 5 : 10,
+        level: first.level,
+        ...(first.collapse_id && { collapse_id: first.collapse_id }),
+        thread_id: first.category,
+        payload: JSON.parse(first.payload),
+      });
+      await this.apply(
+        unique.map((s) => s.row),
+        answer
+      );
+    }
+    for (const key of new Set(rows.map((r) => r.event_key)))
+      await this.settle(key);
+  }
+
+  private async apply(rows: OutboxRow[], answer: RelayAnswer): Promise<void> {
+    const now = this.deps.now();
+    if (answer.kind === "unavailable") {
+      this.down = { until: now + UNAVAILABLE_MS, reason: answer.reason };
+      this.deps.log(`push unavailable: ${answer.reason}`);
+      for (const r of rows) {
+        outbox.markFailed(r.id, answer.reason);
+        setDevicePushError(r.device_id, answer.reason);
+      }
+      for (const key of outbox.failPending(answer.reason))
+        await this.settle(key);
+      return;
+    }
+    if (answer.kind === "invalid") {
+      for (const r of rows) {
+        outbox.markFailed(r.id, answer.reason);
+        setDevicePushError(r.device_id, answer.reason);
+      }
+      return;
+    }
+    rows.forEach((r, i) => {
+      if (answer.kind === "retry")
+        return this.retry(r, now, answer.reason, answer.afterMs);
+      const res = answer.results[i];
+      if (!res) return this.retry(r, now, "no answer for this device");
+      if (res.status === "sent") {
+        outbox.markSent(r.id, now);
+        setDevicePushError(r.device_id, null);
+      } else if (res.status === "gone" || res.prune) {
+        const why = `token no longer valid${res.reason ? ` (${res.reason})` : ""}`;
+        pruneDevicePush(r.device_id, why);
+        outbox.markFailed(r.id, why, true);
+      } else if (res.status === "retry") {
+        this.retry(
+          r,
+          now,
+          res.reason ?? "try again",
+          res.retry_after ? res.retry_after * 1000 : undefined
+        );
+      } else {
+        const why = res.reason ?? "rejected";
+        outbox.markFailed(r.id, why);
+        setDevicePushError(r.device_id, why);
+      }
+    });
+  }
+
+  private retry(
+    r: OutboxRow,
+    now: number,
+    why: string,
+    afterMs?: number
+  ): void {
+    const max = isTestKey(r.event_key) ? 1 : MAX_ATTEMPTS;
+    if (r.attempts >= max) {
+      outbox.markFailed(r.id, why);
+      setDevicePushError(r.device_id, why);
+      return;
+    }
+    const wait = Math.min(
+      Math.max(BACKOFF_MS[r.attempts - 1] ?? BACKOFF_MS.at(-1)!, afterMs ?? 0),
+      MAX_BACKOFF_MS
+    );
+    outbox.markRetry(r.id, now + wait, why);
+  }
+
+  /** Once an event has ended with no phone reached, the held text goes by Telegram. */
+  private async settle(eventKey: string): Promise<void> {
+    const held = outbox.claimFallback(eventKey);
+    if (!held) return;
+    try {
+      await this.deps.fallback(held.source, held.text);
+    } catch (error) {
+      this.deps.log(
+        `fallback for ${held.source} didn't send: ${error instanceof Error ? error.message : error}`
+      );
+    }
+  }
+}

package/lib/notify/push/testing.ts

@@ -0,0 +1,30 @@
+// Test fixtures for the push sender: paired phones with push tokens.
+
+import crypto from "crypto";
+import { db } from "../../db";
+import { mintDevice, setDevicePush } from "@/lib/security/devices";
+import type { PushCategory } from "../push-types";
+
+export function pairPhone(categories?: PushCategory[]): string {
+  const { device } = mintDevice("phone");
+  setDevicePush(device.id, {
+    token: crypto.randomBytes(32).toString("hex"),
+    platform: "ios",
+    environment: "production",
+    categories,
+  });
+  return device.id;
+}
+
+export function resetPush(): void {
+  db.prepare(`DELETE FROM push_outbox`).run();
+  db.prepare(`DELETE FROM devices`).run();
+  const g = globalThis as { __agentosPush?: { dispose(): void } };
+  g.__agentosPush?.dispose();
+  g.__agentosPush = undefined;
+}
+
+export const outboxRows = (where = "1=1") =>
+  db
+    .prepare(`SELECT * FROM push_outbox WHERE ${where} ORDER BY id`)
+    .all() as import("./outbox").OutboxRow[];

package/lib/notify/push/waiting.ts

@@ -0,0 +1,29 @@
+/**
+ * "Needs you" is a session that has waited on Saad for a minute. A timer
+ * starts when it begins waiting and is cancelled by any change, so a quick
+ * permission prompt that he answers never buzzes.
+ */
+
+import { pushNeedsYou } from "./events";
+import { WAIT_MS } from "./policy";
+
+const timers = new Map<string, ReturnType<typeof setTimeout>>();
+
+export function noteWaiting(sessionId: string, waiting: boolean): void {
+  const armed = timers.get(sessionId);
+  if (!waiting) {
+    if (armed) {
+      clearTimeout(armed);
+      timers.delete(sessionId);
+    }
+    return;
+  }
+  if (armed) return;
+  const armedAt = Date.now();
+  const timer = setTimeout(() => {
+    timers.delete(sessionId);
+    pushNeedsYou(sessionId, armedAt);
+  }, WAIT_MS);
+  timer.unref?.();
+  timers.set(sessionId, timer);
+}