@saadnvd1/agent-os 0.3.516 → 0.3.517

package/lib/notify/push/sender.ts

@@ -0,0 +1,271 @@
+/**
+ * Drains the push outbox into the Connect relay. Never throws at a caller and
+ * never blocks one: `kick()` starts a drain and returns. Retries back off;
+ * a relay that says push isn't set up is left alone for ten minutes instead
+ * of being asked per message, and what was waiting falls back to Telegram.
+ */
+
+import type { PushRequestBody } from "@/lib/connect/control-api";
+import {
+  getDevicePush,
+  pruneDevicePush,
+  setDevicePushError,
+} from "@/lib/security/devices";
+import * as outbox from "./outbox";
+import { relaySend, type RelayAnswer } from "./relay";
+import { isTestKey, type OutboxRow } from "./outbox";
+
+export const MAX_ATTEMPTS = 3;
+const BACKOFF_MS = [30_000, 120_000];
+const MAX_BACKOFF_MS = 600_000;
+export const UNAVAILABLE_MS = 600_000;
+const BATCH = 10;
+/** Dead tokens are hex; anything else would make the relay refuse the batch. */
+const APNS_TOKEN = /^[0-9a-fA-F]{64,200}$/;
+
+export interface SenderDeps {
+  now: () => number;
+  relay: (body: PushRequestBody) => Promise<RelayAnswer>;
+  /** Sends a held message by the other channel. */
+  fallback: (source: string, text: string) => Promise<void>;
+  log: (line: string) => void;
+}
+
+type Sink = SenderDeps["fallback"];
+// On globalThis like the sender: the app's bundles each have their own copy
+// of this module, and the one that sets the sink may not be the one that built
+// the sender.
+const sinks = globalThis as unknown as { __agentosPushFallback?: Sink };
+
+/** Where held text goes when push can't deliver it (Telegram). */
+export function setFallbackSink(fn: Sink): void {
+  sinks.__agentosPushFallback = fn;
+}
+
+const defaults = (): SenderDeps => ({
+  now: () => Date.now(),
+  relay: relaySend,
+  fallback: async (source, text) => sinks.__agentosPushFallback?.(source, text),
+  log: (line) => console.error(`[push] ${line}`),
+});
+
+export class PushSender {
+  private deps: SenderDeps;
+  private running = false;
+  private again = false;
+  private current: Promise<void> = Promise.resolve();
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private down: { until: number; reason: string } | null = null;
+
+  constructor(deps: Partial<SenderDeps> = {}) {
+    this.deps = { ...defaults(), ...deps };
+  }
+
+  /** Why pushes aren't being tried right now, or null. */
+  unavailable(): string | null {
+    if (this.down && this.deps.now() >= this.down.until) this.down = null;
+    return this.down?.reason ?? null;
+  }
+
+  clearUnavailable(): void {
+    this.down = null;
+  }
+
+  /** Stops the retry timer (a test discarding its sender). */
+  dispose(): void {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+  }
+
+  /** Starts a drain if none is running; resolves when it has caught up. */
+  kick(): Promise<void> {
+    if (this.running) {
+      this.again = true;
+      return this.current;
+    }
+    this.running = true;
+    this.current = this.drain().finally(() => {
+      this.running = false;
+      this.arm();
+    });
+    return this.current;
+  }
+
+  /** Re-arms after a restart. */
+  resume(): void {
+    outbox.resume(this.deps.now());
+    void this.kick();
+  }
+
+  private async drain(): Promise<void> {
+    try {
+      do {
+        this.again = false;
+        for (const key of outbox.expire(this.deps.now()))
+          await this.settle(key);
+        for (;;) {
+          const rows = outbox.claimDue(this.deps.now());
+          if (!rows.length) break;
+          const byEvent = new Map<string, OutboxRow[]>();
+          for (const r of rows)
+            byEvent.set(r.event_key, [...(byEvent.get(r.event_key) ?? []), r]);
+          for (const group of byEvent.values())
+            for (let i = 0; i < group.length; i += BATCH)
+              await this.sendGroup(group.slice(i, i + BATCH));
+        }
+      } while (this.again);
+    } catch (error) {
+      this.deps.log(
+        `drain failed: ${error instanceof Error ? error.message : error}`
+      );
+    }
+  }
+
+  private arm(): void {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    const at = outbox.nextDueAt();
+    if (at === null) return;
+    this.timer = setTimeout(
+      () => void this.kick(),
+      Math.max(1000, at - this.deps.now())
+    );
+    this.timer.unref?.();
+  }
+
+  private async sendGroup(rows: OutboxRow[]): Promise<void> {
+    // An earlier group in this drain found the relay unusable.
+    const down = this.unavailable();
+    if (down) {
+      for (const r of rows) outbox.markFailed(r.id, down);
+      for (const key of new Set(rows.map((r) => r.event_key)))
+        await this.settle(key);
+      return;
+    }
+    const sendable: {
+      row: OutboxRow;
+      token: string;
+      env: "production" | "sandbox";
+    }[] = [];
+    for (const row of rows) {
+      const push = getDevicePush(row.device_id);
+      if (!push) outbox.markFailed(row.id, "no push token", true);
+      else if (!APNS_TOKEN.test(push.token)) {
+        outbox.markFailed(row.id, "not an APNs token");
+        setDevicePushError(
+          row.device_id,
+          "the registered token isn't an APNs token"
+        );
+      } else sendable.push({ row, token: push.token, env: push.environment });
+    }
+    // The relay folds a repeated token into one result, so send each once.
+    const seen = new Set<string>();
+    const unique = sendable.filter((s) => {
+      const k = `${s.token.toLowerCase()}:${s.env}`;
+      if (seen.has(k)) {
+        outbox.markFailed(s.row.id, "duplicate token");
+        return false;
+      }
+      seen.add(k);
+      return true;
+    });
+    if (unique.length) {
+      const first = unique[0].row;
+      const answer = await this.deps.relay({
+        v: 1,
+        devices: unique.map((s) => ({ token: s.token, env: s.env })),
+        push_type: "alert",
+        priority: first.level === "passive" ? 5 : 10,
+        level: first.level,
+        ...(first.collapse_id && { collapse_id: first.collapse_id }),
+        thread_id: first.category,
+        payload: JSON.parse(first.payload),
+      });
+      await this.apply(
+        unique.map((s) => s.row),
+        answer
+      );
+    }
+    for (const key of new Set(rows.map((r) => r.event_key)))
+      await this.settle(key);
+  }
+
+  private async apply(rows: OutboxRow[], answer: RelayAnswer): Promise<void> {
+    const now = this.deps.now();
+    if (answer.kind === "unavailable") {
+      this.down = { until: now + UNAVAILABLE_MS, reason: answer.reason };
+      this.deps.log(`push unavailable: ${answer.reason}`);
+      for (const r of rows) {
+        outbox.markFailed(r.id, answer.reason);
+        setDevicePushError(r.device_id, answer.reason);
+      }
+      for (const key of outbox.failPending(answer.reason))
+        await this.settle(key);
+      return;
+    }
+    if (answer.kind === "invalid") {
+      for (const r of rows) {
+        outbox.markFailed(r.id, answer.reason);
+        setDevicePushError(r.device_id, answer.reason);
+      }
+      return;
+    }
+    rows.forEach((r, i) => {
+      if (answer.kind === "retry")
+        return this.retry(r, now, answer.reason, answer.afterMs);
+      const res = answer.results[i];
+      if (!res) return this.retry(r, now, "no answer for this device");
+      if (res.status === "sent") {
+        outbox.markSent(r.id, now);
+        setDevicePushError(r.device_id, null);
+      } else if (res.status === "gone" || res.prune) {
+        const why = `token no longer valid${res.reason ? ` (${res.reason})` : ""}`;
+        pruneDevicePush(r.device_id, why);
+        outbox.markFailed(r.id, why, true);
+      } else if (res.status === "retry") {
+        this.retry(
+          r,
+          now,
+          res.reason ?? "try again",
+          res.retry_after ? res.retry_after * 1000 : undefined
+        );
+      } else {
+        const why = res.reason ?? "rejected";
+        outbox.markFailed(r.id, why);
+        setDevicePushError(r.device_id, why);
+      }
+    });
+  }
+
+  private retry(
+    r: OutboxRow,
+    now: number,
+    why: string,
+    afterMs?: number
+  ): void {
+    const max = isTestKey(r.event_key) ? 1 : MAX_ATTEMPTS;
+    if (r.attempts >= max) {
+      outbox.markFailed(r.id, why);
+      setDevicePushError(r.device_id, why);
+      return;
+    }
+    const wait = Math.min(
+      Math.max(BACKOFF_MS[r.attempts - 1] ?? BACKOFF_MS.at(-1)!, afterMs ?? 0),
+      MAX_BACKOFF_MS
+    );
+    outbox.markRetry(r.id, now + wait, why);
+  }
+
+  /** Once an event has ended with no phone reached, the held text goes by Telegram. */
+  private async settle(eventKey: string): Promise<void> {
+    const held = outbox.claimFallback(eventKey);
+    if (!held) return;
+    try {
+      await this.deps.fallback(held.source, held.text);
+    } catch (error) {
+      this.deps.log(
+        `fallback for ${held.source} didn't send: ${error instanceof Error ? error.message : error}`
+      );
+    }
+  }
+}

package/lib/notify/push/testing.ts

@@ -0,0 +1,30 @@
+// Test fixtures for the push sender: paired phones with push tokens.
+
+import crypto from "crypto";
+import { db } from "../../db";
+import { mintDevice, setDevicePush } from "@/lib/security/devices";
+import type { PushCategory } from "../push-types";
+
+export function pairPhone(categories?: PushCategory[]): string {
+  const { device } = mintDevice("phone");
+  setDevicePush(device.id, {
+    token: crypto.randomBytes(32).toString("hex"),
+    platform: "ios",
+    environment: "production",
+    categories,
+  });
+  return device.id;
+}
+
+export function resetPush(): void {
+  db.prepare(`DELETE FROM push_outbox`).run();
+  db.prepare(`DELETE FROM devices`).run();
+  const g = globalThis as { __agentosPush?: { dispose(): void } };
+  g.__agentosPush?.dispose();
+  g.__agentosPush = undefined;
+}
+
+export const outboxRows = (where = "1=1") =>
+  db
+    .prepare(`SELECT * FROM push_outbox WHERE ${where} ORDER BY id`)
+    .all() as import("./outbox").OutboxRow[];

package/lib/notify/push/waiting.ts

@@ -0,0 +1,29 @@
+/**
+ * "Needs you" is a session that has waited on Saad for a minute. A timer
+ * starts when it begins waiting and is cancelled by any change, so a quick
+ * permission prompt that he answers never buzzes.
+ */
+
+import { pushNeedsYou } from "./events";
+import { WAIT_MS } from "./policy";
+
+const timers = new Map<string, ReturnType<typeof setTimeout>>();
+
+export function noteWaiting(sessionId: string, waiting: boolean): void {
+  const armed = timers.get(sessionId);
+  if (!waiting) {
+    if (armed) {
+      clearTimeout(armed);
+      timers.delete(sessionId);
+    }
+    return;
+  }
+  if (armed) return;
+  const armedAt = Date.now();
+  const timer = setTimeout(() => {
+    timers.delete(sessionId);
+    pushNeedsYou(sessionId, armedAt);
+  }, WAIT_MS);
+  timer.unref?.();
+  timers.set(sessionId, timer);
+}

package/lib/notify/push-types.ts

@@ -74,4 +74,6 @@ export interface PushEvent {
   id?: string | null;
   /** Dedupe key, e.g. `ask:<id>` or `review:<task>:<sha>`. */
   key?: string | null;
+  /** Events sharing this replace each other on the phone. Defaults to key. */
+  collapse?: string | null;
 }

package/lib/notify/redact.ts

@@ -16,6 +16,17 @@ const SECRET_PATTERNS: RegExp[] = [
   /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g,
 ];
 
+/**
+ * An id or key made by the app: no known token shape, and no single
+ * segment (split on - _ : .) that is a long hex or base64 run. A uuid or a
+ * timestamped id passes; a pasted key or a 40-character sha does not.
+ */
+function plainIdent(text: string): boolean {
+  if (SECRET_PATTERNS.some((re) => ((re.lastIndex = 0), re.test(text))))
+    return false;
+  return !text.split(/[-_:.]/).some((seg) => seg.length >= 24);
+}
+
 /** True when the string looks like a token, key or JWT. */
 export function looksSecret(text: string): boolean {
   return [...SECRET_PATTERNS, LONG_RUN].some((re) => {
@@ -42,7 +53,7 @@ export function safeId(id: unknown): string | null {
   if (typeof id !== "string" || id.length === 0 || id.length > MAX_ID)
     return null;
   if (!SAFE_ID.test(id)) return null;
-  return looksSecret(id) ? null : id;
+  return plainIdent(id) ? id : null;
 }
 
 /**
@@ -53,5 +64,5 @@ export function safeKey(key: unknown): string | null {
   if (typeof key !== "string" || key.length === 0 || key.length > 128)
     return null;
   if (!/^[A-Za-z0-9_:.-]+$/.test(key)) return null;
-  return looksSecret(key) ? null : key;
+  return plainIdent(key) ? key : null;
 }

package/lib/orchestrator/asks.ts

@@ -6,6 +6,7 @@
  * gate or brake ask is spent on that one item: never standing permission.
  */
 
+import { pushAskRaised } from "../notify/push/events";
 import { db } from "../db";
 import { answerKey, queueEvent } from "./events";
 import { addNote } from "./notes";
@@ -167,7 +168,7 @@ export function raiseAsk(input: {
   const sha = input.sha ?? null;
   const brakeKey = input.brakeKey ?? null;
   const raisedBy = input.raisedBy ?? null;
-  return db.transaction(() => {
+  const result = db.transaction(() => {
     const open = openBySubject(input.workspaceId, input.subject);
     if (open) {
       db.prepare(
@@ -209,6 +210,9 @@ export function raiseAsk(input: {
       created: true,
     };
   })();
+  // A new ask buzzes the phone; a refresh of an open one doesn't.
+  if (result.created) pushAskRaised(result.ask.id, input.workspaceId);
+  return result;
 }
 
 export function openAsks(workspaceId: string): AskRow[] {

package/lib/orchestrator/review.ts

@@ -10,6 +10,7 @@
  * the orchestrator hears the verdict as an event.
  */
 
+import { pushReviewBlocked, pushReviewReady } from "../notify/push/events";
 import { db, type Session } from "../db";
 import { amendmentsOf } from "./amendments";
 import type { TaskPR } from "../tasks/state";
@@ -275,6 +276,8 @@ export async function reviewAt(
     .then((done) => {
       if (done.status === "pass" && target.task)
         noteQuickReview(target.task, sha);
+      if (done.status === "pass") pushReviewReady(target.id, sha);
+      else if (done.status === "block") pushReviewBlocked(target.id, sha);
       const said =
         done.status === "pass"
           ? "passed"

package/lib/program-status/tap.ts

@@ -24,7 +24,9 @@ import {
   applyProgramReport,
   dropProgramTransient,
   programSessions,
+  programSummary,
 } from "./store";
+import { noteWaiting } from "../notify/push/waiting";
 
 const execFileAsync = promisify(execFile);
 const tmux = (args: string[]) =>
@@ -85,7 +87,15 @@ async function handle(name: string, event: OscEvent): Promise<void> {
             ? await foreground(name)
             : undefined
         );
-  if (changed) notifyStatusChanged();
+  if (changed) {
+    notifyStatusChanged();
+    const id = (
+      getDb()
+        .prepare(`SELECT id FROM sessions WHERE tmux_name = ?`)
+        .get(name) as { id: string } | undefined
+    )?.id;
+    if (id) noteWaiting(id, programSummary(name)?.state === "blocked");
+  }
 }
 
 // What one pane has said but isn't applied yet: the latest report per

package/lib/schedules/start.ts

@@ -237,7 +237,11 @@ function notify(schedule: Schedule, why: string, paused?: boolean): void {
     const text = `Schedule "${schedule.name}" is paused: ${why}. Point it at another session or delete it.`;
     console.error(`[schedules] ${text}`);
     addNote(schedule.workspace_id, text, "pause");
-    notifyPhone(`schedule:${schedule.id}`, text);
+    notifyPhone(`schedule:${schedule.id}`, text, {
+      category: "system",
+      key: `system:schedule:${schedule.id}:${Date.now()}`,
+      collapse: `system:schedule:${schedule.id}`,
+    });
     return;
   }
   console.error(`[schedules] ${schedule.name} failed: ${why}`);
@@ -248,7 +252,12 @@ function notify(schedule: Schedule, why: string, paused?: boolean): void {
   );
   notifyPhone(
     `schedule:${schedule.id}`,
-    `Schedule "${schedule.name}" failed: ${why}`
+    `Schedule "${schedule.name}" failed: ${why}`,
+    {
+      category: "system",
+      key: `system:schedule:${schedule.id}:${Date.now()}`,
+      collapse: `system:schedule:${schedule.id}`,
+    }
   );
 }
 

package/lib/security/devices.ts

@@ -86,13 +86,52 @@ export function touchDevice(id: string, address?: string): boolean {
   return true;
 }
 
-export function listDevices(): Device[] {
-  return getDb()
+/** What the Devices page shows of a device's push: never the token. */
+export interface DevicePushView {
+  enabled: boolean;
+  categories: PushCategory[];
+  lastError: string | null;
+  updatedAt: string | null;
+}
+
+export type ListedDevice = Device & { push: DevicePushView };
+
+export function listDevices(): ListedDevice[] {
+  const rows = getDb()
     .prepare(
-      `SELECT id, name, user_agent, created_at, last_seen_at, last_address, revoked_at, can_approve
+      `SELECT id, name, user_agent, created_at, last_seen_at, last_address, revoked_at, can_approve,
+         ${PUSH_COLS}
        FROM devices WHERE revoked_at IS NULL ORDER BY created_at DESC`
     )
-    .all() as Device[];
+    .all() as (Device & PushRow)[];
+  return rows.map((r) => {
+    const {
+      push_token,
+      push_platform,
+      push_environment,
+      push_categories,
+      push_updated_at,
+      push_last_error,
+      ...device
+    } = r;
+    const push = pushOf({
+      push_token,
+      push_platform,
+      push_environment,
+      push_categories,
+      push_updated_at,
+      push_last_error,
+    });
+    return {
+      ...device,
+      push: {
+        enabled: !!push,
+        categories: push?.categories ?? [],
+        lastError: push_last_error,
+        updatedAt: push?.updatedAt ?? null,
+      },
+    };
+  });
 }
 
 export function renameDevice(id: string, name: string): boolean {
@@ -301,3 +340,17 @@ function dropDeviceSockets(id: string): void {
   for (const s of sockets.get(id) ?? []) s.destroy();
   sockets.delete(id);
 }
+
+/**
+ * The relay said this token is dead: forget it, keep the chosen categories,
+ * say why. The app registers a fresh token on its next launch.
+ */
+export function pruneDevicePush(id: string, reason: string): void {
+  getDb()
+    .prepare(
+      `UPDATE devices SET push_token = NULL, push_platform = NULL,
+         push_environment = NULL, push_last_error = ?
+       WHERE id = ?`
+    )
+    .run(reason.slice(0, 200), id);
+}

package/lib/tasks/finish.ts

@@ -12,6 +12,7 @@ import { itemName, liveChildren, signOffRefusal } from "../stacks/guard";
 import { resolveMergedTaskAsks } from "../orchestrator/ask-settle";
 import { endSessionAgent } from "../sessions/end";
 import { run } from "./gh";
+import { pushMerged } from "../notify/push/events";
 import { gitFetch, gitPush } from "../git-exec";
 import {
   mergePolicy,
@@ -155,6 +156,7 @@ export async function signOffTask(
     signingOff.delete(id);
   }
   syncTaskCardInBackground(session, "merged", pr);
+  pushMerged(id);
   // Reads the plan file now: cleanup below removes the worktree.
   void captureMergedTask(id, { head: opts.head ?? pr!.head ?? null });
   const head = opts.head ?? pr!.head;

package/lib/tasks/session.ts

@@ -16,6 +16,12 @@ import { findPRStrict } from "./gh";
 import { currentBranch, git } from "../git-exec";
 import { lookupPR } from "./pr-poll";
 import { captureMergedTask } from "../session-logs";
+import { getOrchestrator } from "../orchestrator/home";
+import {
+  pushCiFailed,
+  pushMerged,
+  pushReviewReady,
+} from "../notify/push/events";
 import { notifyStatusChanged } from "../status/hub";
 import type { TaskPR } from "./state";
 import { markStatusDirty } from "../status/dirty";
@@ -193,14 +199,19 @@ export async function prFor(
   prCache.set(session.id, { at: Date.now(), pr });
   markStatusDirty(session.id);
   // A PR whose stage inputs moved is news for the sidebar's badge.
-  if (prSignature(before) !== prSignature(pr)) notifyStatusChanged();
+  if (prSignature(before) !== prSignature(pr)) {
+    notifyStatusChanged();
+    if (pr) pushPrChange(session, pr);
+  }
   if (pr) {
     db.prepare(
       `UPDATE sessions SET pr_url = ?, pr_number = ?, pr_status = ? WHERE id = ?`
     ).run(pr.url, pr.number, pr.state.toLowerCase(), session.id);
     // Merged on GitHub rather than through AgentOS: its log is due too.
-    if (pr.state === "MERGED")
+    if (pr.state === "MERGED") {
+      if (session.pr_status !== "merged") pushMerged(session.id);
       void captureMergedTask(session.id, { head: pr.head });
+    }
   }
   // Only an answer just read from GitHub: a cached one may predate a
   // retarget AgentOS made itself (a restack).
@@ -283,3 +294,16 @@ export function forgetPR(sessionId: string): void {
   prCache.delete(sessionId);
   markStatusDirty(sessionId);
 }
+
+// CI failing is news for the phone in any workspace. Green is "ready for
+// review" only where no orchestrator runs a review of its own (its verdict is
+// the signal there). Each head is pushed once: the event key holds the sha.
+export function pushPrChange(session: Session, pr: TaskPR): void {
+  if (pr.state !== "OPEN" || !pr.head) return;
+  if (pr.checks === "fail") pushCiFailed(session.id, pr.head);
+  else if (
+    pr.checks === "pass" &&
+    !(session.workspace_id && getOrchestrator(session.workspace_id))
+  )
+    pushReviewReady(session.id, pr.head);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.516",
+  "version": "0.3.517",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/server.ts

@@ -15,6 +15,7 @@ import { startOrchestratorWatcher } from "./lib/orchestrator/watcher";
 import { realDeps, schedulesEnabled, startScheduler } from "./lib/schedules";
 import { startUsageRollup, usageRollupEnabled } from "./lib/usage/nightly";
 import { resumePhoneOutbox } from "./lib/notify";
+import { resumePushOutbox } from "./lib/notify/push";
 import {
   bindAddresses,
   requestAllowed,
@@ -395,6 +396,7 @@ app.prepare().then(async () => {
   // Schedules tick here, once a minute, and nowhere else.
   if (schedulesEnabled(process.env)) startScheduler(realDeps);
   resumePhoneOutbox();
+  resumePushOutbox();
   // The usage ledger's daily rollup and its ratchet alerts.
   if (usageRollupEnabled(process.env)) startUsageRollup();
   // Machine load: a gauge, notes on heavy commands, one alert when red.