bom-pi 0.0.1 → 0.0.3

package/apps/web/pocket-adapter.mjs

@@ -97,7 +97,7 @@ function mapApproval(a) {
 
 const OWNER = { id: 'bom-owner', name: 'Owner', role: 'owner' };
 
-export function makePocketAdapter({ rpc, checkToken }) {
+export function makePocketAdapter({ rpc, checkToken, push }) {
   // me-shape: mọi thứ UI cần biết về server (chụp từ pocket 0.27.0 thật)
   async function mePayload() {
     const hello = await rpc('hello');
@@ -179,14 +179,14 @@ export function makePocketAdapter({ rpc, checkToken }) {
   return async function pocketRoute(req, res, url, authed) {
     const path = url.pathname.replace(/^\/api\//, '');
     const parts = path.split('/').filter(Boolean);
-    const [first, second, third] = parts;
+    const [first, second, third, fourth] = parts;
     const method = req.method;
     const isPost = method !== 'GET' && method !== 'HEAD';
 
     if (isPost && req.headers['x-pocket'] !== '1') return false; // POST pocket luôn có X-Pocket (api.ts l365)
     if (!['me', 'login', 'logout', 'sessions', 'c', 'providers', 'themes', 'theme', 'events', 'poll',
       'users', 'hooks', 'subagents', 'pip', 'extensions', 'extension-settings', 'fs', 'visibility', 'peeks',
-      'folder-favorites', 'spend', 'pi-sessions', 'x', 'repo-watches', 'approvals'].includes(first)) return false;
+      'folder-favorites', 'spend', 'pi-sessions', 'x', 'repo-watches', 'approvals', 'push'].includes(first)) return false;
 
     try {
       // ---- sign-in/lifecycle ----
@@ -243,6 +243,27 @@ export function makePocketAdapter({ rpc, checkToken }) {
         }
         if (third === 'turns' && isPost) return json(res, 200, { ok: true }), true; // PORT(bom-pi): multiplayer turns — chưa có
         if (third === 'typing' && isPost) return json(res, 200, { ok: true }), true; // PORT(bom-pi): presence
+        // ---- Files tile + Changes review (repo thật của xưởng) ----
+        if (third === 'files' && method === 'GET') {
+          const r = await rpc('fs.list', { conversationId: id });
+          const since = url.searchParams.get('since');
+          const version = String(r.files.length) + ':' + (r.files[0] ?? '') + (r.files.at(-1) ?? '');
+          if (since === version) return json(res, 200, { version, same: true }), true;
+          return json(res, 200, { files: r.files, truncated: r.truncated, version }), true;
+        }
+        if (third === 'view' && method === 'GET') {
+          const r = await rpc('fs.view', { conversationId: id, path: url.searchParams.get('path') ?? '' });
+          return json(res, 200, { path: r.path, text: r.text }), true;
+        }
+        if (third === 'changes' && fourth === undefined && method === 'GET') {
+          return json(res, 200, await rpc('changes.get', { conversationId: id })), true;
+        }
+        if (third === 'changes' && fourth === 'diff' && method === 'GET') {
+          const r = await rpc('changes.diff', { conversationId: id, path: url.searchParams.get('path') ?? '' });
+          res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' });
+          res.end(r.diff ?? '');
+          return true;
+        }
         if (isPost) { await readBody(req); return json(res, 200, { ok: true }), true; } // PORT(bom-pi): plan/chat/pin/notes/fork/... — noop
         return json(res, 200, {}), true;
       }
@@ -254,6 +275,36 @@ export function makePocketAdapter({ rpc, checkToken }) {
         return json(res, 200, true), true;
       }
 
+      // ---- push: phone notifications (Web Push RFC 8291/8292/8030 — push.mjs port pi-pocket) ----
+      if (first === 'push') {
+        if (!push) return json(res, 503, { error: 'Push notifications are not available on this server.' }), true;
+        const { store, userId } = push;
+        if (second === undefined && method === 'GET') {
+          return json(res, 200, { publicKey: store.publicKey, prefs: store.prefs(userId), devices: store.subscriptions(userId).length }), true;
+        }
+        if (second === 'subscribe' && isPost) {
+          const body = await readBody(req);
+          try { store.subscribe(userId, body.subscription, String(req.headers['user-agent'] ?? '').slice(0, 200)); }
+          catch (e) { return json(res, 400, { error: String(e?.message ?? e) }), true; }
+          return json(res, 200, { ok: true, devices: store.subscriptions(userId).length }), true;
+        }
+        if (second === 'unsubscribe' && isPost) {
+          const body = await readBody(req);
+          store.unsubscribe(String(body.endpoint ?? ''), userId);
+          return json(res, 200, { ok: true, devices: store.subscriptions(userId).length }), true;
+        }
+        if (second === 'prefs' && isPost) {
+          const body = await readBody(req);
+          return json(res, 200, { prefs: store.setPrefs(userId, body) }), true;
+        }
+        if (second === 'test' && isPost) {
+          await readBody(req);
+          const sent = await store.notify(userId, { title: 'bom', body: 'Notifications work on this device.', url: '/', tag: 'test' });
+          if (sent === 0) return json(res, 409, { error: 'No device took the test notification. Turn notifications on again on this device.' }), true;
+          return json(res, 200, { sent }), true;
+        }
+      }
+
       // ---- providers/themes ----
       if (first === 'providers' && method === 'GET') {
         const models = ((await rpc('models.list')).models ?? []).map(mapModel);

package/apps/web/public/manifest.webmanifest

@@ -1,7 +1,7 @@
 {
-    "name": "Pi Pocket",
-    "short_name": "Pi Pocket",
-    "description": "Durable, multiplayer Pi agents in your browser",
+    "name": "bom",
+    "short_name": "bom",
+    "description": "bom × pi — durable factories of pi agents in your browser",
     "start_url": "/",
     "scope": "/",
     "display": "standalone",

package/apps/web/push.mjs

@@ -0,0 +1,211 @@
+// push.mjs — Web Push không dependency (port từ pi-pocket src/server/push.ts, MIT):
+// RFC 8291 aes128gcm + RFC 8292 VAPID (ES256) + RFC 8030 POST. PushStore giữ VAPID keys,
+// subscription mỗi user, prefs — push.json ở dataDir (atomic write 0600).
+import {
+  createCipheriv, createECDH, createHash, createHmac, createPrivateKey, randomBytes, sign,
+} from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const DEFAULT_PREFS = Object.freeze({ done: true, approval: true, chat: true, mention: true, limit: true });
+const DEFAULT_SUBJECT = 'mailto:bom-pi@localhost';
+const DEFAULT_RECORD_SIZE = 4096;
+const MAX_BODY = 1000;
+const MAX_TITLE = 200;
+const MAX_DEVICES = 10;
+
+const hmac = (key, ...data) => {
+  const mac = createHmac('sha256', key);
+  for (const part of data) mac.update(part);
+  return mac.digest();
+};
+const decode = (value) => Buffer.from(String(value).replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_'), 'base64url');
+const pad32 = (value) => (value.length >= 32 ? value : Buffer.concat([Buffer.alloc(32 - value.length), value]));
+
+export function generateVapidKeys() {
+  const ecdh = createECDH('prime256v1');
+  ecdh.generateKeys();
+  return { publicKey: ecdh.getPublicKey().toString('base64url'), privateKey: pad32(ecdh.getPrivateKey()).toString('base64url') };
+}
+
+/** RFC 8291 aes128gcm body cho MỘT record. */
+export function encryptPayload(plaintext, keys, options = {}) {
+  const data = typeof plaintext === 'string' ? Buffer.from(plaintext, 'utf8') : plaintext;
+  const uaPublic = decode(keys.p256dh);
+  const authSecret = decode(keys.auth);
+  if (uaPublic.length !== 65 || uaPublic[0] !== 0x04) throw new Error('p256dh must be an uncompressed P-256 point');
+  if (authSecret.length !== 16) throw new Error('auth must be 16 bytes');
+  const recordSize = options.recordSize ?? DEFAULT_RECORD_SIZE;
+  if (data.length + 1 + 16 > recordSize) throw new Error(`push payload too large: ${data.length} bytes`);
+  const salt = options.salt ?? randomBytes(16);
+  const ecdh = createECDH('prime256v1');
+  if (options.serverKeys === undefined) ecdh.generateKeys();
+  else ecdh.setPrivateKey(options.serverKeys.privateKey);
+  const asPublic = ecdh.getPublicKey();
+  const ecdhSecret = ecdh.computeSecret(uaPublic);
+  const prkKey = hmac(authSecret, ecdhSecret);
+  const keyInfo = Buffer.concat([Buffer.from('WebPush: info\0', 'latin1'), uaPublic, asPublic]);
+  const ikm = hmac(prkKey, keyInfo, Buffer.from([1]));
+  const prk = hmac(salt, ikm);
+  const cek = hmac(prk, Buffer.from('Content-Encoding: aes128gcm\0\x01', 'latin1')).subarray(0, 16);
+  const nonce = hmac(prk, Buffer.from('Content-Encoding: nonce\0\x01', 'latin1')).subarray(0, 12);
+  const cipher = createCipheriv('aes-128-gcm', cek, nonce);
+  const padded = Buffer.concat([data, Buffer.from([2])]);
+  const ciphertext = Buffer.concat([cipher.update(padded), cipher.final(), cipher.getAuthTag()]);
+  const header = Buffer.alloc(16 + 4 + 1);
+  salt.copy(header, 0);
+  header.writeUInt32BE(recordSize, 16);
+  header.writeUInt8(asPublic.length, 20);
+  return Buffer.concat([header, asPublic, ciphertext]);
+}
+
+/** Authorization `vapid t=<jwt>, k=<pub>` (ES256, ieee-p1363 raw r||s). */
+export function vapidAuthorization(endpoint, vapid, subject, now = Date.now()) {
+  const publicKey = decode(vapid.publicKey);
+  if (publicKey.length !== 65 || publicKey[0] !== 0x04) throw new Error('VAPID public key must be an uncompressed P-256 point');
+  const key = createPrivateKey({
+    key: {
+      kty: 'EC', crv: 'P-256',
+      x: publicKey.subarray(1, 33).toString('base64url'),
+      y: publicKey.subarray(33, 65).toString('base64url'),
+      d: pad32(decode(vapid.privateKey)).toString('base64url'),
+    },
+    format: 'jwk',
+  });
+  const header = Buffer.from(JSON.stringify({ typ: 'JWT', alg: 'ES256' })).toString('base64url');
+  const claims = { aud: new URL(endpoint).origin, exp: Math.floor(now / 1000) + 12 * 60 * 60, sub: subject };
+  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url');
+  const signingInput = `${header}.${payload}`;
+  const signature = sign('sha256', Buffer.from(signingInput), { key, dsaEncoding: 'ieee-p1363' });
+  return `vapid t=${signingInput}.${signature.toString('base64url')}, k=${publicKey.toString('base64url')}`;
+}
+
+const topicFor = (tag) => (/^[A-Za-z0-9_-]{1,32}$/.test(tag) ? tag : createHash('sha256').update(tag).digest('base64url').slice(0, 32));
+const clip = (text, max) => (text.length > max ? `${text.slice(0, max - 1)}…` : text);
+
+/** POST bản mã tới push service — trả HTTP status. */
+export async function sendPush(subscription, message, vapid, options = {}) {
+  // JS không có type-check như TS gốc — mặc định an toàn khi trường thiếu
+  const payload = { title: clip(String(message.title ?? 'bom'), MAX_TITLE), body: clip(String(message.body ?? ''), MAX_BODY), url: message.url };
+  if (message.tag !== undefined) payload.tag = message.tag;
+  if (message.approval !== undefined) payload.approval = message.approval;
+  const body = encryptPayload(JSON.stringify(payload), subscription.keys);
+  const headers = {
+    'Content-Encoding': 'aes128gcm',
+    'Content-Type': 'application/octet-stream',
+    TTL: String(options.ttl ?? 24 * 60 * 60),
+    Urgency: options.urgency ?? 'normal',
+    Authorization: vapidAuthorization(subscription.endpoint, vapid, options.subject ?? DEFAULT_SUBJECT),
+  };
+  if (message.tag !== undefined && message.tag !== '') headers.Topic = topicFor(message.tag);
+  const doFetch = options.fetch ?? fetch;
+  const response = await doFetch(subscription.endpoint, { method: 'POST', headers, body: new Uint8Array(body) });
+  await response.arrayBuffer().catch(() => undefined);
+  return response.status;
+}
+
+// Chỉ nhận endpoint của các push service trình duyệt thật (chặn dùng server dò địa chỉ nội bộ)
+const PUSH_HOSTS = [
+  /^fcm\.googleapis\.com$/,
+  /^android\.googleapis\.com$/,
+  /(^|\.)push\.services\.mozilla\.com$/,
+  /(^|\.)notify\.windows\.com$/,
+  /(^|\.)push\.apple\.com$/,
+];
+
+export function validateSubscription(subscription) {
+  if (subscription === null || typeof subscription !== 'object') throw new Error('subscription must be an object');
+  if (typeof subscription.endpoint !== 'string') throw new Error('subscription endpoint is missing');
+  let url;
+  try { url = new URL(subscription.endpoint); } catch { throw new Error('subscription endpoint is not a valid URL'); }
+  if (url.protocol !== 'https:') throw new Error('subscription endpoint must be an https URL');
+  if (url.port !== '' || url.username !== '' || url.password !== '' || !PUSH_HOSTS.some((host) => host.test(url.hostname))) {
+    throw new Error(`${url.host} is not a browser push service`);
+  }
+  const keys = subscription.keys;
+  if (keys === null || typeof keys !== 'object' || typeof keys.p256dh !== 'string' || typeof keys.auth !== 'string') {
+    throw new Error('subscription keys.p256dh and keys.auth are required');
+  }
+  const p256dh = decode(keys.p256dh);
+  if (p256dh.length !== 65 || p256dh[0] !== 0x04) throw new Error('subscription keys.p256dh must be a 65-byte uncompressed P-256 public key');
+  if (decode(keys.auth).length !== 16) throw new Error('subscription keys.auth must be 16 bytes');
+  return { endpoint: subscription.endpoint, keys: { p256dh: keys.p256dh, auth: keys.auth } };
+}
+
+/** push.json ở dataDir — VAPID sinh lần đầu, subscriptions + prefs mỗi user. */
+export class PushStore {
+  constructor(directory) {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    this.file = join(directory, 'push.json');
+    if (existsSync(this.file)) {
+      const loaded = JSON.parse(readFileSync(this.file, 'utf8'));
+      this.data = { version: 1, vapid: loaded.vapid ?? generateVapidKeys(), subscriptions: loaded.subscriptions ?? [], prefs: loaded.prefs ?? {} };
+      if (loaded.vapid === undefined) this.save();
+    } else {
+      this.data = { version: 1, vapid: generateVapidKeys(), subscriptions: [], prefs: {} };
+      this.save();
+    }
+  }
+  get publicKey() { return this.data.vapid.publicKey; }
+  get vapid() { return { ...this.data.vapid }; }
+  subscriptions(userId) {
+    return this.data.subscriptions.filter((s) => userId === undefined || s.userId === userId).map((s) => ({ ...s }));
+  }
+  subscribe(userId, subscription, userAgent) {
+    const clean = validateSubscription(subscription);
+    const stored = { ...clean, userId, createdAt: Date.now() };
+    if (userAgent !== undefined && userAgent !== '') stored.userAgent = String(userAgent).slice(0, 300);
+    const others = this.data.subscriptions.filter((s) => s.endpoint !== clean.endpoint);
+    const theirs = others.filter((s) => s.userId === userId);
+    const dropped = new Set(theirs.slice(0, Math.max(0, theirs.length - (MAX_DEVICES - 1))));
+    this.data.subscriptions = [...others.filter((s) => !dropped.has(s)), stored];
+    this.save();
+  }
+  unsubscribe(endpoint, userId) {
+    const before = this.data.subscriptions.length;
+    this.data.subscriptions = this.data.subscriptions.filter(
+      (s) => s.endpoint !== endpoint || (userId !== undefined && s.userId === userId),
+    );
+    if (this.data.subscriptions.length === before) return false;
+    this.save();
+    return true;
+  }
+  prefs(userId) { return { ...DEFAULT_PREFS, ...this.data.prefs[userId] }; }
+  setPrefs(userId, patch) {
+    const stored = { ...this.data.prefs[userId] };
+    for (const name of Object.keys(DEFAULT_PREFS)) {
+      if (typeof patch[name] === 'boolean') stored[name] = patch[name];
+    }
+    this.data.prefs[userId] = stored;
+    this.save();
+    return this.prefs(userId);
+  }
+  /** Gửi tới mọi subscription của user; bỏ subscription chết (404/410). Không throw; trả số 2xx. */
+  async notify(userId, message, options = {}) {
+    const targets = this.subscriptions(userId);
+    if (targets.length === 0) return 0;
+    const vapid = this.vapid;
+    const results = await Promise.allSettled(targets.map((sub) => sendPush(sub, message, vapid, options)));
+    let accepted = 0;
+    const gone = new Set();
+    results.forEach((r, index) => {
+      if (r.status !== 'fulfilled') return;
+      if (r.value >= 200 && r.value < 300) accepted++;
+      else if (r.value === 404 || r.value === 410) gone.add(targets[index]?.endpoint ?? '');
+    });
+    if (gone.size > 0) {
+      try {
+        this.data.subscriptions = this.data.subscriptions.filter((s) => !(s.userId === userId && gone.has(s.endpoint)));
+        this.save();
+      } catch { /* lưu fail — thử lại lần tới */ }
+    }
+    return accepted;
+  }
+  save() {
+    mkdirSync(dirname(this.file), { recursive: true, mode: 0o700 });
+    const temp = `${this.file}.${process.pid}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(this.data, null, '\t')}\n`, { mode: 0o600 });
+    renameSync(temp, this.file);
+    chmodSync(this.file, 0o600);
+  }
+}

package/apps/web/server.mjs

@@ -15,6 +15,7 @@ import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
 import { COOKIE, makePocketAdapter } from './pocket-adapter.mjs';
+import { PushStore } from './push.mjs';
 
 // UI pocket (clone từ TannerMidd/pi-pocket, MIT) nằm ở public/ — serve tĩnh
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -122,7 +123,8 @@ const authorized = async (req, url) => {
 };
 
 // ---- Events fan-out cho pocket adapter: một socket dài, events.update của daemon
-// báo mọi client SSE pocket làm mới (pull-on-push). ----
+// báo mọi client SSE pocket làm mới (pull-on-push). Socket sống độc lập SSE client —
+// push notification phải nổ khi KHÔNG ai mở web, nên tạo ngay từ boot + tự nối lại. ----
 const eventListeners = new Set();
 const watchedConvs = new Set();
 let eventsSocket = null;
@@ -145,18 +147,26 @@ async function ensureEventsSocket(cid) {
       const line = buf.slice(0, nl); buf = buf.slice(nl + 1);
       try {
         const msg = JSON.parse(line);
-        if (msg.method === 'events.update') for (const fn of eventListeners) fn(msg.params);
+        if (msg.method === 'events.update') {
+          for (const fn of eventListeners) fn(msg.params);
+          pushApprovalWatch(); // push "needs approval" — kể cả khi tab đóng
+        }
       } catch { /* dòng chưa trọn */ }
     }
   });
-  conn.on('close', () => { eventsSocket = null; watchedConvs.clear(); });
-  conn.on('error', () => { eventsSocket = null; });
+  conn.on('close', () => { eventsSocket = null; watchedConvs.clear(); scheduleEventsReconnect(); });
+  conn.on('error', () => { eventsSocket = null; scheduleEventsReconnect(); });
   conn.write(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'events.subscribe', params: {} }) + '\n');
   if (Number.isInteger(cid) && cid > 0) {
     watchedConvs.add(cid);
     conn.write(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'events.subscribe', params: { conversationId: cid } }) + '\n');
   }
 }
+let reconnectTimer = null;
+function scheduleEventsReconnect() {
+  if (reconnectTimer) return;
+  reconnectTimer = setTimeout(() => { reconnectTimer = null; ensureEventsSocket().catch(() => scheduleEventsReconnect()); }, 2000);
+}
 rpc.__subscribeEvents = async (cid, onChange) => {
   await ensureEventsSocket(cid);
   eventListeners.add(onChange);
@@ -166,7 +176,51 @@ rpc.__subscribeEvents = async (cid, onChange) => {
 // ---- pocket wire (cookie pocket_auth — sign-in qua /login?token= sau khi pair) ----
 const cookieToken = (req) => (req.headers.cookie ?? '').match(new RegExp(`${COOKIE}=([^;]+)`))?.[1] ?? null;
 const pocketCookieOk = async (req) => { const t = cookieToken(req); return t && (TOKEN ? t === TOKEN || await verifyDeviceToken(t) : await verifyDeviceToken(t)); };
-const pocketRoute = makePocketAdapter({ rpc, checkToken: async (t) => (TOKEN ? t === TOKEN : false) || (await verifyDeviceToken(t)) });
+
+// ---- Web Push (port pi-pocket: RFC 8291/8292/8030, không dependency — push.mjs) ----
+// push.json ở dataDir daemon (~/.local/state/bom-pi) — VAPID keys ổn định qua restart,
+// subscriptions + prefs mỗi user. pushApprovalWatch() theo dõi approval mới qua events.update
+// và bắn notification "bom needs approval" tới mọi thiết bị đã subscribe (kể cả tab đóng). ----
+const DATA_DIR = resolve(process.env.BOM_PI_STATE_DIR || process.env.XDG_STATE_HOME || join(process.env.HOME ?? '/home', '.local', 'state'), 'bom-pi');
+let pushStore = null;
+try { pushStore = new PushStore(DATA_DIR); } catch (e) { console.error(`push disabled: ${e.message}`); }
+const PUSH_USER = 'bom-owner';
+let knownApprovalIds = null; // null = chưa nạp mốc — lần đầu không bắn loạt approval cũ
+let approvalWatchTimer = null;
+function pushApprovalWatch() {
+  if (!pushStore || approvalWatchTimer) return;
+  approvalWatchTimer = setTimeout(() => {
+    approvalWatchTimer = null;
+    void (async () => {
+      try {
+        if (pushStore.subscriptions(PUSH_USER).length === 0) { knownApprovalIds = null; return; } // chưa ai subscribe — bỏ qua
+        const pending = (await rpc('approvals.list')).pending ?? [];
+        const ids = new Set(pending.map((a) => String(a.id)));
+        if (knownApprovalIds === null) { knownApprovalIds = ids; return; }
+        const fresh = pending.filter((a) => !knownApprovalIds.has(String(a.id)));
+        knownApprovalIds = ids;
+        if (fresh.length === 0 || !pushStore.prefs(PUSH_USER).approval) return;
+        for (const a of fresh) {
+          // Khuôn alerts.ts của pocket: Allow từ notification chỉ khi cả call ngắn + không ký tự ngụy trang
+          const subject = String(a.command ?? a.summary ?? '');
+          const call = `${a.tool ?? 'call'}: ${subject}`.slice(0, 120);
+          const shown = call.length <= 120 && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(subject);
+          void pushStore.notify(PUSH_USER, {
+            title: 'bom needs approval',
+            body: call || 'A tool call is waiting for you.',
+            url: `/s/${Number(a.conversationId ?? 0)}`,
+            tag: `approval-${a.id}`,
+            approval: { id: String(a.id), allow: shown },
+          }, { urgency: 'high' })
+            .then((sent) => console.error(`push approval ${String(a.id).slice(0, 24)} → ${sent} thiết bị`))
+            .catch((e) => console.error(`push approval ${String(a.id).slice(0, 24)} lỗi: ${e.message}`));
+        }
+      } catch { /* daemon bận — events.update kế tiếp thử lại */ }
+    })();
+  }, 500);
+}
+
+const pocketRoute = makePocketAdapter({ rpc, checkToken: async (t) => (TOKEN ? t === TOKEN : false) || (await verifyDeviceToken(t)), push: pushStore ? { store: pushStore, userId: PUSH_USER } : null });
 
 // ---- HTML (mobile-first, không framework) ----
 const HTML = `<!doctype html>
@@ -593,18 +647,6 @@ async function go(){
 }
 </script></body></html>`;
 
-// ---- PWA (M8): install màn hình chính + notification approvals ----
-const MANIFEST = {
-  name: 'bom', short_name: 'bom', start_url: '/', display: 'standalone',
-  background_color: '#101418', theme_color: '#101418',
-  icons: [{ src: '/icon.svg', sizes: 'any', type: 'image/svg+xml', purpose: 'any' }],
-};
-const ICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><rect width="100" height="100" rx="20" fill="#101418"/><text x="50" y="68" font-size="56" text-anchor="middle" fill="#58a6ff" font-family="monospace" font-weight="bold">b</text></svg>`;
-const SW_JS = `// bom service worker — network-first, không cache (app luôn tươi; SW chỉ để installable PWA)
-self.addEventListener('install', () => self.skipWaiting());
-self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
-self.addEventListener('fetch', () => {});`;
-
 const http = createHttpServer(async (req, res) => {
   const url = new URL(req.url, 'http://x');
   if (req.method === 'OPTIONS') { res.writeHead(204, CORS); return res.end(); }
@@ -626,19 +668,9 @@ const http = createHttpServer(async (req, res) => {
     try { return json2(res, 200, await rpc('pair.poll', { enrollId: p.enrollId })); }
     catch (e) { return json2(res, 404, { error: e.message.replace(/^\d+: /, '') }); }
   }
-  if (req.method === 'GET' && url.pathname === '/manifest.webmanifest') {
-    res.writeHead(200, { 'content-type': 'application/manifest+json', ...CORS });
-    return res.end(JSON.stringify(MANIFEST));
-  }
-  if (req.method === 'GET' && url.pathname === '/icon.svg') {
-    res.writeHead(200, { 'content-type': 'image/svg+xml', ...CORS });
-    return res.end(ICON_SVG);
-  }
-  if (req.method === 'GET' && url.pathname === '/sw.js') {
-    res.writeHead(200, { 'content-type': 'application/javascript', ...CORS });
-    return res.end(SW_JS);
-  }
   // ---- UI pocket (public/): shell + module + vendor tĩnh, KHÔNG cần token ----
+  // serveStatic phục vụ cả sw.js/manifest/icon của pocket (public/) — không còn hằng
+  // SW cũ: sw.js pocket có push handler (notification từ push service).
   if (req.method === 'GET' && await serveStatic(res, url)) return;
   // ---- /login?token= : sign-in pocket UI bằng device token (sau pair) hoặc master ----
   if (req.method === 'GET' && url.pathname === '/login') {
@@ -770,5 +802,7 @@ const http = createHttpServer(async (req, res) => {
 });
 
 http.listen(PORT, LISTEN, () => {
-  console.error(`bom-web listening http://${LISTEN}:${PORT} — bom-core at ${socketPath}${TOKEN ? ' — token required' : ' — NO TOKEN (loopback only)'}`);
+  console.error(`bom-web listening http://${LISTEN}:${PORT} — bom-core at ${socketPath}${TOKEN ? ' — token required' : ' — NO TOKEN (loopback only)'}${pushStore ? ` — push ${pushStore.publicKey.slice(0, 12)}…` : ' — push OFF'}`);
+  // Socket events sống từ boot: push approval phải nổ khi không ai mở web
+  ensureEventsSocket().catch(() => scheduleEventsReconnect());
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bom-pi",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "type": "module",
   "description": "bom × pi — hệ sinh thái durable cho pi trên nền pi-durable: core daemon + web UI pocket + CLI",
   "engines": {
@@ -17,6 +17,7 @@
     "packages/cli/templates",
     "apps/web/server.mjs",
     "apps/web/pocket-adapter.mjs",
+    "apps/web/push.mjs",
     "apps/web/public",
     "systemd",
     "README.md"

package/packages/cli/src/bom-pi.mjs

@@ -27,6 +27,25 @@ const cid = arg('cid', null); // conversation id cho submit/transcript/reset/wat
 const cidParams = () => (cid ? { conversationId: Number(cid) } : {});
 const cmd = process.argv[2] ?? 'status';
 
+// Không thấy daemon: hướng dẫn theo nơi đang chạy — máy chủ (chưa start?) hay
+// thiết bị khác (Windows/phone: bom-core là daemon unix-socket systemd, chưa port).
+function unreachable(e) {
+  const head = `cannot reach bom-core at ${socketPath}: ${e.message}`;
+  if (process.platform === 'win32') {
+    return `${head}
+
+  bom-core chạy trên máy chủ Linux (unix socket + systemd) — CLI chưa chạy được trên Windows.
+  Từ thiết bị khác, dùng WEB thay CLI: mở http://<ip-máy-chạy-daemon>:8791 (hoặc URL tunnel
+  https://… nếu có) rồi pair bằng code in ra từ lệnh 'bom-pi pair' chạy TRÊN MÁY CHỦ đó.`;
+  }
+  return `${head}
+
+  daemon chưa chạy? thử:  systemctl --user start bom-core   (xem trạng thái: bom-pi status)
+  chưa cài daemon?:      bom-pi setup
+  ở THIẾT BỊ KHÁC?:      CLI nói chuyện daemon trên MÁY NÀY — từ phone/laptop hãy mở
+                         http://<ip-máy-chạy-daemon>:8791 và pair bằng code từ 'bom-pi pair'.`;
+}
+
 function rpc(method, params) {
   return new Promise((done, fail) => {
     const conn = connect(socketPath);
@@ -57,7 +76,7 @@ function rpc(method, params) {
     });
     // Daemon chết giữa chừng / đóng connection không trả lời
     conn.on('close', () => settle(fail, new Error('bom-core closed the connection without a reply')));
-    conn.on('error', (e) => settle(fail, new Error(`cannot reach bom-core at ${socketPath}: ${e.message}`)));
+    conn.on('error', (e) => settle(fail, new Error(unreachable(e))));
   });
 }
 
@@ -99,7 +118,7 @@ function watch() {
       }
     }
   });
-  conn.on('error', (e) => { console.error(`cannot reach bom-core at ${socketPath}: ${e.message}`); process.exit(1); });
+  conn.on('error', (e) => { console.error(unreachable(e)); process.exit(1); });
   conn.on('close', () => { if (!gotReply) { console.error('bom-core closed the connection without a reply'); process.exit(1); } process.exit(0); });
 }
 const printEntry = (e) => console.log(`[${e.kind}]${e.role ? ` ${e.role}:` : ''} ${e.text ?? ''}`);

package/packages/core/src/daemon.mjs

@@ -26,7 +26,7 @@
 import { connect, createServer } from 'node:net';
 import { mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { chmodSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join, relative, resolve, sep } from 'node:path';
 import { homedir, userInfo } from 'node:os';
 import process from 'node:process';
 import { execFile as execFileCb } from 'node:child_process';
@@ -71,6 +71,12 @@ async function shutdown(reason) {
   if (closing) return;
   closing = true;
   log('đóng:', reason);
+  // Turn đang chờ approval không bao giờ settle ⇒ Session.close kẹt mãi.
+  // Từ chối hết mọi approval treo để turn kết thúc, rồi mới đóng storage.
+  for (const [, p] of pendingApprovals) {
+    try { p.resolve({ allow: false, reason: 'daemon shutdown' }); } catch { /* resolve rồi */ }
+  }
+  pendingApprovals.clear();
   let failed = false;
   if (heartbeatTimer) clearInterval(heartbeatTimer);
   if (scheduleTimer) clearInterval(scheduleTimer);
@@ -1614,6 +1620,91 @@ const methods = {
     const entries = (view.entries ?? []).map((e) => ({ id: e.id, kind: e.kind, model: e.model ?? null }));
     return { conversationId: conv.id, count: entries.length, entries };
   },
+  // ---- Files & Changes (pocket Files tile / Changes review) ----
+  // cwd của conversation từ agent config; path client bị nhốt trong cwd (traversal chặn).
+  async convCwd(params) {
+    const conv = await convFor(params);
+    const agent = await conv.agent(BACKGROUND_CONTEXT);
+    return { conversationId: conv.id, cwd: agent?.cwd ?? process.env.HOME ?? process.cwd() };
+  },
+  async fsList(params) {
+    const { cwd } = await methods.convCwd(params);
+    const files = [];
+    let truncated = false;
+    const SKIP = new Set(['node_modules', '.git', 'dist', 'build', '.cache']);
+    const walk = async (rel) => {
+      if (files.length >= 2000) { truncated = true; return; }
+      let entries;
+      try { entries = await readdir(join(cwd, rel), { withFileTypes: true }); } catch { return; }
+      entries.sort((a, b) => a.name.localeCompare(b.name));
+      for (const e of entries) {
+        if (e.name.startsWith('.') || SKIP.has(e.name)) continue;
+        const p = rel ? `${rel}/${e.name}` : e.name;
+        if (e.isDirectory()) await walk(p);
+        else { files.push(p); if (files.length >= 2000) { truncated = true; break; } }
+      }
+    };
+    await walk('');
+    return { files, truncated };
+  },
+  async fsView(params) {
+    const { cwd } = await methods.convCwd(params);
+    const p = resolve(cwd, String(params?.path ?? ''));
+    if (p !== cwd && !p.startsWith(cwd + sep)) throw new Error('path ngoài thư mục làm việc');
+    const st = await stat(p);
+    if (st.size > 1_000_000) throw new Error('file quá lớn (>1MB)');
+    return { path: String(params.path), text: await readFile(p, 'utf8') };
+  },
+  async changesGet(params) {
+    const { cwd } = await methods.convCwd(params);
+    let root = '';
+    try { root = (await execFileAsync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], { timeout: 10_000 })).stdout.trim(); } catch { return { repo: null, files: [], more: 0, piOnly: [] }; }
+    const branch = (await execFileAsync('git', ['-C', cwd, 'rev-parse', '--abbrev-ref', 'HEAD'], { timeout: 10_000 })).stdout.trim();
+    const head = (await execFileAsync('git', ['-C', cwd, 'rev-parse', 'HEAD'], { timeout: 10_000 })).stdout.trim();
+    const st = (await execFileAsync('git', ['-C', cwd, 'status', '--porcelain=v1', '-uall'], { timeout: 10_000 })).stdout;
+    let numstat = '';
+    try { numstat = (await execFileAsync('git', ['-C', cwd, 'diff', 'HEAD', '--numstat'], { timeout: 10_000 })).stdout; } catch { numstat = ''; }
+    const statMap = new Map();
+    for (const line of numstat.split('\n').filter(Boolean)) {
+      const [a, r, p] = line.split('\t');
+      statMap.set(p, { added: a === '-' ? 0 : Number(a), removed: r === '-' ? 0 : Number(r) });
+    }
+    const KIND = { M: 'modified', A: 'new', '?': 'new', D: 'deleted', R: 'renamed' };
+    const files = [];
+    for (const line of st.split('\n').filter(Boolean)) {
+      const x = line[0] === ' ' ? '?' : line[0]; // staged letter; '?' = untracked
+      const path = line.slice(3).trim();
+      let s = statMap.get(path) ?? { added: 0, removed: 0 };
+      if (s.added === 0 && s.removed === 0 && (KIND[x] === 'new')) {
+        // untracked: numstat không có — đếm dòng file (diff full là +all)
+        try { s = { added: (await readFile(join(cwd, path), 'utf8')).split('\n').filter(Boolean).length, removed: 0 }; } catch { /* binary/đã đổi */ }
+      }
+      files.push({ path, kind: KIND[x] ?? 'modified', added: s.added, removed: s.removed, byPi: false, version: `1:${Date.now()}` });
+    }
+    return { repo: { root, branch, head }, files, more: 0, piOnly: [] };
+  },
+  async changesDiff(params) {
+    const { cwd } = await methods.convCwd(params);
+    const p = resolve(cwd, String(params?.path ?? ''));
+    if (p !== cwd && !p.startsWith(cwd + sep)) throw new Error('path ngoài thư mục làm việc');
+    const rel = relative(cwd, p);
+    try {
+      const tracked = (await execFileAsync('git', ['-C', cwd, 'ls-files', '--error-unmatch', rel], { timeout: 10_000 })).stdout.trim();
+      if (tracked) {
+        const { stdout } = await execFileAsync('git', ['-C', cwd, 'diff', 'HEAD', '--', rel], { timeout: 20_000, maxBuffer: 4 * 1024 * 1024 });
+        return { diff: stdout };
+      }
+    } catch { /* untracked hoặc lỗi — rơi về --no-index */ }
+    try {
+      // -C + path relative để header diff đúng b/<rel> (absolute path làm header a/<cwd>/...)
+      const { stdout } = await execFileAsync('git', ['-C', cwd, 'diff', '--no-index', '--', '/dev/null', rel], { timeout: 20_000, maxBuffer: 4 * 1024 * 1024 });
+      return { diff: stdout };
+    } catch (e) {
+      // git diff --no-index exit 1 khi CÓ khác biệt — stdout vẫn chứa diff
+      if (e?.stdout) return { diff: String(e.stdout) };
+      throw e;
+    }
+  },
   async eventsSubscribe(params, ctx) {
     const conv = await convFor(params);
     const w = await ensureWatch(conv.id, conv);