bom-pi 0.0.2 → 0.0.4

package/apps/web/pocket-adapter.mjs

@@ -97,7 +97,7 @@ function mapApproval(a) {
 
 const OWNER = { id: 'bom-owner', name: 'Owner', role: 'owner' };
 
-export function makePocketAdapter({ rpc, checkToken }) {
+export function makePocketAdapter({ rpc, checkToken, push }) {
   // me-shape: mọi thứ UI cần biết về server (chụp từ pocket 0.27.0 thật)
   async function mePayload() {
     const hello = await rpc('hello');
@@ -137,7 +137,7 @@ export function makePocketAdapter({ rpc, checkToken }) {
         createdAt: updatedAt,
         updatedAt,
         createdBy: OWNER.id,
-        busy: false, // PORT(bom-pi): session.list chưa báo busy — làm mới qua events.update
+        busy: c.busy === true, // LiveDoc.run — push 'done' + UI "working" dùng chung nguồn này
         waiting: appr.some((a) => Number(a.conversationId) === Number(c.id)),
         model: c.model?.modelId ?? 'glm-5.3',
         title,
@@ -158,7 +158,7 @@ export function makePocketAdapter({ rpc, checkToken }) {
       conversation: { id: Number(convId), kind: 'session', title: conv?.title ?? `session ${convId}`, cwd: conv?.cwd ?? '', archived: false },
       entries,
       order: entries.map((e) => e.id),
-      live: { busy: conv?.busy === true || conv?.running === true },
+      live: { busy: conv?.busy === true },
       agent: { model: { provider: conv?.model?.provider ?? 'zai', modelId: conv?.model?.modelId ?? 'glm-5.3' }, thinkingLevel: 'high', cwd: conv?.cwd ?? '', available: true, modelName: conv?.model?.modelId ?? 'GLM-5.3', contextWindow: 1000000, reasoning: true, images: false, levels: ['low', 'high', 'max'] },
       stats: { cost: 0 },
       clients: 1, viewers: ['Owner'],
@@ -186,7 +186,7 @@ export function makePocketAdapter({ rpc, checkToken }) {
     if (isPost && req.headers['x-pocket'] !== '1') return false; // POST pocket luôn có X-Pocket (api.ts l365)
     if (!['me', 'login', 'logout', 'sessions', 'c', 'providers', 'themes', 'theme', 'events', 'poll',
       'users', 'hooks', 'subagents', 'pip', 'extensions', 'extension-settings', 'fs', 'visibility', 'peeks',
-      'folder-favorites', 'spend', 'pi-sessions', 'x', 'repo-watches', 'approvals'].includes(first)) return false;
+      'folder-favorites', 'spend', 'pi-sessions', 'x', 'repo-watches', 'approvals', 'push'].includes(first)) return false;
 
     try {
       // ---- sign-in/lifecycle ----
@@ -275,6 +275,36 @@ export function makePocketAdapter({ rpc, checkToken }) {
         return json(res, 200, true), true;
       }
 
+      // ---- push: phone notifications (Web Push RFC 8291/8292/8030 — push.mjs port pi-pocket) ----
+      if (first === 'push') {
+        if (!push) return json(res, 503, { error: 'Push notifications are not available on this server.' }), true;
+        const { store, userId } = push;
+        if (second === undefined && method === 'GET') {
+          return json(res, 200, { publicKey: store.publicKey, prefs: store.prefs(userId), devices: store.subscriptions(userId).length }), true;
+        }
+        if (second === 'subscribe' && isPost) {
+          const body = await readBody(req);
+          try { store.subscribe(userId, body.subscription, String(req.headers['user-agent'] ?? '').slice(0, 200)); }
+          catch (e) { return json(res, 400, { error: String(e?.message ?? e) }), true; }
+          return json(res, 200, { ok: true, devices: store.subscriptions(userId).length }), true;
+        }
+        if (second === 'unsubscribe' && isPost) {
+          const body = await readBody(req);
+          store.unsubscribe(String(body.endpoint ?? ''), userId);
+          return json(res, 200, { ok: true, devices: store.subscriptions(userId).length }), true;
+        }
+        if (second === 'prefs' && isPost) {
+          const body = await readBody(req);
+          return json(res, 200, { prefs: store.setPrefs(userId, body) }), true;
+        }
+        if (second === 'test' && isPost) {
+          await readBody(req);
+          const sent = await store.notify(userId, { title: 'bom', body: 'Notifications work on this device.', url: '/', tag: 'test' });
+          if (sent === 0) return json(res, 409, { error: 'No device took the test notification. Turn notifications on again on this device.' }), true;
+          return json(res, 200, { sent }), true;
+        }
+      }
+
       // ---- providers/themes ----
       if (first === 'providers' && method === 'GET') {
         const models = ((await rpc('models.list')).models ?? []).map(mapModel);

package/apps/web/public/manifest.webmanifest

@@ -1,7 +1,7 @@
 {
-    "name": "Pi Pocket",
-    "short_name": "Pi Pocket",
-    "description": "Durable, multiplayer Pi agents in your browser",
+    "name": "bom",
+    "short_name": "bom",
+    "description": "bom × pi — durable factories of pi agents in your browser",
     "start_url": "/",
     "scope": "/",
     "display": "standalone",

package/apps/web/push.mjs

@@ -0,0 +1,211 @@
+// push.mjs — Web Push không dependency (port từ pi-pocket src/server/push.ts, MIT):
+// RFC 8291 aes128gcm + RFC 8292 VAPID (ES256) + RFC 8030 POST. PushStore giữ VAPID keys,
+// subscription mỗi user, prefs — push.json ở dataDir (atomic write 0600).
+import {
+  createCipheriv, createECDH, createHash, createHmac, createPrivateKey, randomBytes, sign,
+} from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const DEFAULT_PREFS = Object.freeze({ done: true, approval: true, chat: true, mention: true, limit: true });
+const DEFAULT_SUBJECT = 'mailto:bom-pi@localhost';
+const DEFAULT_RECORD_SIZE = 4096;
+const MAX_BODY = 1000;
+const MAX_TITLE = 200;
+const MAX_DEVICES = 10;
+
+const hmac = (key, ...data) => {
+  const mac = createHmac('sha256', key);
+  for (const part of data) mac.update(part);
+  return mac.digest();
+};
+const decode = (value) => Buffer.from(String(value).replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_'), 'base64url');
+const pad32 = (value) => (value.length >= 32 ? value : Buffer.concat([Buffer.alloc(32 - value.length), value]));
+
+export function generateVapidKeys() {
+  const ecdh = createECDH('prime256v1');
+  ecdh.generateKeys();
+  return { publicKey: ecdh.getPublicKey().toString('base64url'), privateKey: pad32(ecdh.getPrivateKey()).toString('base64url') };
+}
+
+/** RFC 8291 aes128gcm body cho MỘT record. */
+export function encryptPayload(plaintext, keys, options = {}) {
+  const data = typeof plaintext === 'string' ? Buffer.from(plaintext, 'utf8') : plaintext;
+  const uaPublic = decode(keys.p256dh);
+  const authSecret = decode(keys.auth);
+  if (uaPublic.length !== 65 || uaPublic[0] !== 0x04) throw new Error('p256dh must be an uncompressed P-256 point');
+  if (authSecret.length !== 16) throw new Error('auth must be 16 bytes');
+  const recordSize = options.recordSize ?? DEFAULT_RECORD_SIZE;
+  if (data.length + 1 + 16 > recordSize) throw new Error(`push payload too large: ${data.length} bytes`);
+  const salt = options.salt ?? randomBytes(16);
+  const ecdh = createECDH('prime256v1');
+  if (options.serverKeys === undefined) ecdh.generateKeys();
+  else ecdh.setPrivateKey(options.serverKeys.privateKey);
+  const asPublic = ecdh.getPublicKey();
+  const ecdhSecret = ecdh.computeSecret(uaPublic);
+  const prkKey = hmac(authSecret, ecdhSecret);
+  const keyInfo = Buffer.concat([Buffer.from('WebPush: info\0', 'latin1'), uaPublic, asPublic]);
+  const ikm = hmac(prkKey, keyInfo, Buffer.from([1]));
+  const prk = hmac(salt, ikm);
+  const cek = hmac(prk, Buffer.from('Content-Encoding: aes128gcm\0\x01', 'latin1')).subarray(0, 16);
+  const nonce = hmac(prk, Buffer.from('Content-Encoding: nonce\0\x01', 'latin1')).subarray(0, 12);
+  const cipher = createCipheriv('aes-128-gcm', cek, nonce);
+  const padded = Buffer.concat([data, Buffer.from([2])]);
+  const ciphertext = Buffer.concat([cipher.update(padded), cipher.final(), cipher.getAuthTag()]);
+  const header = Buffer.alloc(16 + 4 + 1);
+  salt.copy(header, 0);
+  header.writeUInt32BE(recordSize, 16);
+  header.writeUInt8(asPublic.length, 20);
+  return Buffer.concat([header, asPublic, ciphertext]);
+}
+
+/** Authorization `vapid t=<jwt>, k=<pub>` (ES256, ieee-p1363 raw r||s). */
+export function vapidAuthorization(endpoint, vapid, subject, now = Date.now()) {
+  const publicKey = decode(vapid.publicKey);
+  if (publicKey.length !== 65 || publicKey[0] !== 0x04) throw new Error('VAPID public key must be an uncompressed P-256 point');
+  const key = createPrivateKey({
+    key: {
+      kty: 'EC', crv: 'P-256',
+      x: publicKey.subarray(1, 33).toString('base64url'),
+      y: publicKey.subarray(33, 65).toString('base64url'),
+      d: pad32(decode(vapid.privateKey)).toString('base64url'),
+    },
+    format: 'jwk',
+  });
+  const header = Buffer.from(JSON.stringify({ typ: 'JWT', alg: 'ES256' })).toString('base64url');
+  const claims = { aud: new URL(endpoint).origin, exp: Math.floor(now / 1000) + 12 * 60 * 60, sub: subject };
+  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url');
+  const signingInput = `${header}.${payload}`;
+  const signature = sign('sha256', Buffer.from(signingInput), { key, dsaEncoding: 'ieee-p1363' });
+  return `vapid t=${signingInput}.${signature.toString('base64url')}, k=${publicKey.toString('base64url')}`;
+}
+
+const topicFor = (tag) => (/^[A-Za-z0-9_-]{1,32}$/.test(tag) ? tag : createHash('sha256').update(tag).digest('base64url').slice(0, 32));
+const clip = (text, max) => (text.length > max ? `${text.slice(0, max - 1)}…` : text);
+
+/** POST bản mã tới push service — trả HTTP status. */
+export async function sendPush(subscription, message, vapid, options = {}) {
+  // JS không có type-check như TS gốc — mặc định an toàn khi trường thiếu
+  const payload = { title: clip(String(message.title ?? 'bom'), MAX_TITLE), body: clip(String(message.body ?? ''), MAX_BODY), url: message.url };
+  if (message.tag !== undefined) payload.tag = message.tag;
+  if (message.approval !== undefined) payload.approval = message.approval;
+  const body = encryptPayload(JSON.stringify(payload), subscription.keys);
+  const headers = {
+    'Content-Encoding': 'aes128gcm',
+    'Content-Type': 'application/octet-stream',
+    TTL: String(options.ttl ?? 24 * 60 * 60),
+    Urgency: options.urgency ?? 'normal',
+    Authorization: vapidAuthorization(subscription.endpoint, vapid, options.subject ?? DEFAULT_SUBJECT),
+  };
+  if (message.tag !== undefined && message.tag !== '') headers.Topic = topicFor(message.tag);
+  const doFetch = options.fetch ?? fetch;
+  const response = await doFetch(subscription.endpoint, { method: 'POST', headers, body: new Uint8Array(body) });
+  await response.arrayBuffer().catch(() => undefined);
+  return response.status;
+}
+
+// Chỉ nhận endpoint của các push service trình duyệt thật (chặn dùng server dò địa chỉ nội bộ)
+const PUSH_HOSTS = [
+  /^fcm\.googleapis\.com$/,
+  /^android\.googleapis\.com$/,
+  /(^|\.)push\.services\.mozilla\.com$/,
+  /(^|\.)notify\.windows\.com$/,
+  /(^|\.)push\.apple\.com$/,
+];
+
+export function validateSubscription(subscription) {
+  if (subscription === null || typeof subscription !== 'object') throw new Error('subscription must be an object');
+  if (typeof subscription.endpoint !== 'string') throw new Error('subscription endpoint is missing');
+  let url;
+  try { url = new URL(subscription.endpoint); } catch { throw new Error('subscription endpoint is not a valid URL'); }
+  if (url.protocol !== 'https:') throw new Error('subscription endpoint must be an https URL');
+  if (url.port !== '' || url.username !== '' || url.password !== '' || !PUSH_HOSTS.some((host) => host.test(url.hostname))) {
+    throw new Error(`${url.host} is not a browser push service`);
+  }
+  const keys = subscription.keys;
+  if (keys === null || typeof keys !== 'object' || typeof keys.p256dh !== 'string' || typeof keys.auth !== 'string') {
+    throw new Error('subscription keys.p256dh and keys.auth are required');
+  }
+  const p256dh = decode(keys.p256dh);
+  if (p256dh.length !== 65 || p256dh[0] !== 0x04) throw new Error('subscription keys.p256dh must be a 65-byte uncompressed P-256 public key');
+  if (decode(keys.auth).length !== 16) throw new Error('subscription keys.auth must be 16 bytes');
+  return { endpoint: subscription.endpoint, keys: { p256dh: keys.p256dh, auth: keys.auth } };
+}
+
+/** push.json ở dataDir — VAPID sinh lần đầu, subscriptions + prefs mỗi user. */
+export class PushStore {
+  constructor(directory) {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    this.file = join(directory, 'push.json');
+    if (existsSync(this.file)) {
+      const loaded = JSON.parse(readFileSync(this.file, 'utf8'));
+      this.data = { version: 1, vapid: loaded.vapid ?? generateVapidKeys(), subscriptions: loaded.subscriptions ?? [], prefs: loaded.prefs ?? {} };
+      if (loaded.vapid === undefined) this.save();
+    } else {
+      this.data = { version: 1, vapid: generateVapidKeys(), subscriptions: [], prefs: {} };
+      this.save();
+    }
+  }
+  get publicKey() { return this.data.vapid.publicKey; }
+  get vapid() { return { ...this.data.vapid }; }
+  subscriptions(userId) {
+    return this.data.subscriptions.filter((s) => userId === undefined || s.userId === userId).map((s) => ({ ...s }));
+  }
+  subscribe(userId, subscription, userAgent) {
+    const clean = validateSubscription(subscription);
+    const stored = { ...clean, userId, createdAt: Date.now() };
+    if (userAgent !== undefined && userAgent !== '') stored.userAgent = String(userAgent).slice(0, 300);
+    const others = this.data.subscriptions.filter((s) => s.endpoint !== clean.endpoint);
+    const theirs = others.filter((s) => s.userId === userId);
+    const dropped = new Set(theirs.slice(0, Math.max(0, theirs.length - (MAX_DEVICES - 1))));
+    this.data.subscriptions = [...others.filter((s) => !dropped.has(s)), stored];
+    this.save();
+  }
+  unsubscribe(endpoint, userId) {
+    const before = this.data.subscriptions.length;
+    this.data.subscriptions = this.data.subscriptions.filter(
+      (s) => s.endpoint !== endpoint || (userId !== undefined && s.userId === userId),
+    );
+    if (this.data.subscriptions.length === before) return false;
+    this.save();
+    return true;
+  }
+  prefs(userId) { return { ...DEFAULT_PREFS, ...this.data.prefs[userId] }; }
+  setPrefs(userId, patch) {
+    const stored = { ...this.data.prefs[userId] };
+    for (const name of Object.keys(DEFAULT_PREFS)) {
+      if (typeof patch[name] === 'boolean') stored[name] = patch[name];
+    }
+    this.data.prefs[userId] = stored;
+    this.save();
+    return this.prefs(userId);
+  }
+  /** Gửi tới mọi subscription của user; bỏ subscription chết (404/410). Không throw; trả số 2xx. */
+  async notify(userId, message, options = {}) {
+    const targets = this.subscriptions(userId);
+    if (targets.length === 0) return 0;
+    const vapid = this.vapid;
+    const results = await Promise.allSettled(targets.map((sub) => sendPush(sub, message, vapid, options)));
+    let accepted = 0;
+    const gone = new Set();
+    results.forEach((r, index) => {
+      if (r.status !== 'fulfilled') return;
+      if (r.value >= 200 && r.value < 300) accepted++;
+      else if (r.value === 404 || r.value === 410) gone.add(targets[index]?.endpoint ?? '');
+    });
+    if (gone.size > 0) {
+      try {
+        this.data.subscriptions = this.data.subscriptions.filter((s) => !(s.userId === userId && gone.has(s.endpoint)));
+        this.save();
+      } catch { /* lưu fail — thử lại lần tới */ }
+    }
+    return accepted;
+  }
+  save() {
+    mkdirSync(dirname(this.file), { recursive: true, mode: 0o700 });
+    const temp = `${this.file}.${process.pid}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(this.data, null, '\t')}\n`, { mode: 0o600 });
+    renameSync(temp, this.file);
+    chmodSync(this.file, 0o600);
+  }
+}

package/apps/web/server.mjs

@@ -15,6 +15,7 @@ import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
 import { COOKIE, makePocketAdapter } from './pocket-adapter.mjs';
+import { PushStore } from './push.mjs';
 
 // UI pocket (clone từ TannerMidd/pi-pocket, MIT) nằm ở public/ — serve tĩnh
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -110,7 +111,7 @@ async function verifyDeviceToken(token) {
 }
 const authorized = async (req, url) => {
   if (url.pathname === '/api/pair/start') return true; // public — tự vệ bằng code + rate-limit daemon
-  if (!url.pathname.startsWith('/api/')) return true; // static UI/PWA — không dữ liệu
+  if (!url.pathname.startsWith('/api/') && url.pathname !== '/rpc') return true; // static UI/PWA — không dữ liệu
   const header = req.headers.authorization ?? '';
   const bearer = header.startsWith('Bearer ') ? header.slice(7) : null;
   const qToken = url.searchParams.get('token');
@@ -122,7 +123,8 @@ const authorized = async (req, url) => {
 };
 
 // ---- Events fan-out cho pocket adapter: một socket dài, events.update của daemon
-// báo mọi client SSE pocket làm mới (pull-on-push). ----
+// báo mọi client SSE pocket làm mới (pull-on-push). Socket sống độc lập SSE client —
+// push notification phải nổ khi KHÔNG ai mở web, nên tạo ngay từ boot + tự nối lại. ----
 const eventListeners = new Set();
 const watchedConvs = new Set();
 let eventsSocket = null;
@@ -145,18 +147,27 @@ async function ensureEventsSocket(cid) {
       const line = buf.slice(0, nl); buf = buf.slice(nl + 1);
       try {
         const msg = JSON.parse(line);
-        if (msg.method === 'events.update') for (const fn of eventListeners) fn(msg.params);
+        if (msg.method === 'events.update') {
+          for (const fn of eventListeners) fn(msg.params);
+          pushApprovalWatch(); // push "needs approval" — kể cả khi tab đóng
+          pushDoneWatch(); // push "bom finished" khi conv busy→idle
+        }
       } catch { /* dòng chưa trọn */ }
     }
   });
-  conn.on('close', () => { eventsSocket = null; watchedConvs.clear(); });
-  conn.on('error', () => { eventsSocket = null; });
+  conn.on('close', () => { eventsSocket = null; watchedConvs.clear(); scheduleEventsReconnect(); });
+  conn.on('error', () => { eventsSocket = null; scheduleEventsReconnect(); });
   conn.write(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'events.subscribe', params: {} }) + '\n');
   if (Number.isInteger(cid) && cid > 0) {
     watchedConvs.add(cid);
     conn.write(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'events.subscribe', params: { conversationId: cid } }) + '\n');
   }
 }
+let reconnectTimer = null;
+function scheduleEventsReconnect() {
+  if (reconnectTimer) return;
+  reconnectTimer = setTimeout(() => { reconnectTimer = null; ensureEventsSocket().catch(() => scheduleEventsReconnect()); }, 2000);
+}
 rpc.__subscribeEvents = async (cid, onChange) => {
   await ensureEventsSocket(cid);
   eventListeners.add(onChange);
@@ -166,7 +177,108 @@ rpc.__subscribeEvents = async (cid, onChange) => {
 // ---- pocket wire (cookie pocket_auth — sign-in qua /login?token= sau khi pair) ----
 const cookieToken = (req) => (req.headers.cookie ?? '').match(new RegExp(`${COOKIE}=([^;]+)`))?.[1] ?? null;
 const pocketCookieOk = async (req) => { const t = cookieToken(req); return t && (TOKEN ? t === TOKEN || await verifyDeviceToken(t) : await verifyDeviceToken(t)); };
-const pocketRoute = makePocketAdapter({ rpc, checkToken: async (t) => (TOKEN ? t === TOKEN : false) || (await verifyDeviceToken(t)) });
+
+// ---- Web Push (port pi-pocket: RFC 8291/8292/8030, không dependency — push.mjs) ----
+// push.json ở dataDir daemon (~/.local/state/bom-pi) — VAPID keys ổn định qua restart,
+// subscriptions + prefs mỗi user. pushApprovalWatch() theo dõi approval mới qua events.update
+// và bắn notification "bom needs approval" tới mọi thiết bị đã subscribe (kể cả tab đóng). ----
+const DATA_DIR = resolve(process.env.BOM_PI_STATE_DIR || process.env.XDG_STATE_HOME || join(process.env.HOME ?? '/home', '.local', 'state'), 'bom-pi');
+let pushStore = null;
+try { pushStore = new PushStore(DATA_DIR); } catch (e) { console.error(`push disabled: ${e.message}`); }
+const PUSH_USER = 'bom-owner';
+let knownApprovalIds = null; // null = chưa nạp mốc — lần đầu không bắn loạt approval cũ
+let approvalWatchTimer = null;
+function pushApprovalWatch() {
+  if (!pushStore || approvalWatchTimer) return;
+  approvalWatchTimer = setTimeout(() => {
+    approvalWatchTimer = null;
+    void (async () => {
+      try {
+        if (pushStore.subscriptions(PUSH_USER).length === 0) { knownApprovalIds = null; return; } // chưa ai subscribe — bỏ qua
+        const pending = (await rpc('approvals.list')).pending ?? [];
+        const ids = new Set(pending.map((a) => String(a.id)));
+        if (knownApprovalIds === null) { knownApprovalIds = ids; return; }
+        const fresh = pending.filter((a) => !knownApprovalIds.has(String(a.id)));
+        knownApprovalIds = ids;
+        if (fresh.length === 0 || !pushStore.prefs(PUSH_USER).approval) return;
+        for (const a of fresh) {
+          // Khuôn alerts.ts của pocket: Allow từ notification chỉ khi cả call ngắn + không ký tự ngụy trang
+          const subject = String(a.command ?? a.summary ?? '');
+          const call = `${a.tool ?? 'call'}: ${subject}`.slice(0, 120);
+          const shown = call.length <= 120 && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(subject);
+          void pushStore.notify(PUSH_USER, {
+            title: 'bom needs approval',
+            body: call || 'A tool call is waiting for you.',
+            url: `/s/${Number(a.conversationId ?? 0)}`,
+            tag: `approval-${a.id}`,
+            approval: { id: String(a.id), allow: shown },
+          }, { urgency: 'high' })
+            .then((sent) => console.error(`push approval ${String(a.id).slice(0, 24)} → ${sent} thiết bị`))
+            .catch((e) => console.error(`push approval ${String(a.id).slice(0, 24)} lỗi: ${e.message}`));
+        }
+      } catch { /* daemon bận — events.update kế tiếp thử lại */ }
+    })();
+  }, 500);
+}
+
+const pocketRoute = makePocketAdapter({ rpc, checkToken: async (t) => (TOKEN ? t === TOKEN : false) || (await verifyDeviceToken(t)), push: pushStore ? { store: pushStore, userId: PUSH_USER } : null });
+
+// ---- push 'done' (khuôn alerts.ts: runChanged + DONE_DELAY 3s): conv busy→idle và Ở YÊN
+// 3s (follow-up queued thường chạy ngay) ⇒ "bom finished · <title>". Abort không bắn —
+// người dùng tự dừng, không phải tin; error đổi tiêu đề. ----
+const DONE_DELAY_MS = 3000;
+let busyByConv = null; // null = chưa nạp mốc — không bắn trạng thái cũ lúc web mới lên
+const doneTimers = new Map(); // convId → timeout đợi-yên
+let doneWatchTimer = null;
+function pushDoneWatch() {
+  if (!pushStore || doneWatchTimer) return;
+  doneWatchTimer = setTimeout(() => {
+    doneWatchTimer = null;
+    void (async () => {
+      try {
+        if (pushStore.subscriptions(PUSH_USER).length === 0) { busyByConv = null; return; }
+        const convs = (await rpc('session.list')).conversations ?? [];
+        const now = new Map(convs.map((c) => [Number(c.id), c.busy === true]));
+        if (busyByConv === null) { busyByConv = now; return; }
+        for (const [id, busy] of now) {
+          const was = busyByConv.get(id);
+          if (was === undefined || was === busy) continue;
+          clearTimeout(doneTimers.get(id));
+          doneTimers.delete(id);
+          if (!busy) {
+            const t = setTimeout(() => { doneTimers.delete(id); void pushDone(id); }, DONE_DELAY_MS);
+            t.unref?.();
+            doneTimers.set(id, t);
+          }
+        }
+        busyByConv = now;
+      } catch { /* daemon bận — events.update kế tiếp */ }
+    })();
+  }, 500);
+}
+async function pushDone(convId) {
+  try {
+    if (!pushStore.prefs(PUSH_USER).done) return;
+    const conv = ((await rpc('session.list')).conversations ?? []).find((c) => Number(c.id) === Number(convId));
+    if (!conv || conv.busy === true) return; // đã chạy tiếp — không phải "xong"
+    const entries = (await rpc('transcript.raw', { conversationId: convId })).entries ?? [];
+    let title = `session ${convId}`;
+    const m0 = entries.find((e) => e.kind === 'pi.user')?.model?.[0];
+    const text0 = typeof m0?.content === 'string' ? m0.content : Array.isArray(m0?.content) ? m0.content.filter((p) => p?.type === 'text').map((p) => p.text).join(' ') : '';
+    if (text0) title = text0.split('\n')[0].slice(0, 60);
+    const ma = [...entries].reverse().find((e) => e.kind === 'pi.assistant')?.model?.[0];
+    if (ma?.stopReason === 'aborted') return;
+    const failed = ma?.stopReason === 'error' || Boolean(ma?.errorMessage);
+    const bodyText = ma ? (Array.isArray(ma.content) ? ma.content.filter((p) => p?.type === 'text').map((p) => p.text).join('\n') : String(ma.text ?? '')) : '';
+    const sent = await pushStore.notify(PUSH_USER, {
+      title: failed ? `bom stopped with an error · ${title}` : `bom finished · ${title}`,
+      body: String(failed ? ma.errorMessage ?? 'The model request failed.' : bodyText || 'Done.').slice(0, 400),
+      url: `/s/${Number(convId)}`,
+      tag: `done-${convId}`,
+    });
+    console.error(`push done ${convId}${failed ? ' (error)' : ''} → ${sent} thiết bị`);
+  } catch (e) { console.error(`push done ${convId} lỗi: ${e.message}`); }
+}
 
 // ---- HTML (mobile-first, không framework) ----
 const HTML = `<!doctype html>
@@ -593,18 +705,6 @@ async function go(){
 }
 </script></body></html>`;
 
-// ---- PWA (M8): install màn hình chính + notification approvals ----
-const MANIFEST = {
-  name: 'bom', short_name: 'bom', start_url: '/', display: 'standalone',
-  background_color: '#101418', theme_color: '#101418',
-  icons: [{ src: '/icon.svg', sizes: 'any', type: 'image/svg+xml', purpose: 'any' }],
-};
-const ICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><rect width="100" height="100" rx="20" fill="#101418"/><text x="50" y="68" font-size="56" text-anchor="middle" fill="#58a6ff" font-family="monospace" font-weight="bold">b</text></svg>`;
-const SW_JS = `// bom service worker — network-first, không cache (app luôn tươi; SW chỉ để installable PWA)
-self.addEventListener('install', () => self.skipWaiting());
-self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
-self.addEventListener('fetch', () => {});`;
-
 const http = createHttpServer(async (req, res) => {
   const url = new URL(req.url, 'http://x');
   if (req.method === 'OPTIONS') { res.writeHead(204, CORS); return res.end(); }
@@ -626,19 +726,9 @@ const http = createHttpServer(async (req, res) => {
     try { return json2(res, 200, await rpc('pair.poll', { enrollId: p.enrollId })); }
     catch (e) { return json2(res, 404, { error: e.message.replace(/^\d+: /, '') }); }
   }
-  if (req.method === 'GET' && url.pathname === '/manifest.webmanifest') {
-    res.writeHead(200, { 'content-type': 'application/manifest+json', ...CORS });
-    return res.end(JSON.stringify(MANIFEST));
-  }
-  if (req.method === 'GET' && url.pathname === '/icon.svg') {
-    res.writeHead(200, { 'content-type': 'image/svg+xml', ...CORS });
-    return res.end(ICON_SVG);
-  }
-  if (req.method === 'GET' && url.pathname === '/sw.js') {
-    res.writeHead(200, { 'content-type': 'application/javascript', ...CORS });
-    return res.end(SW_JS);
-  }
   // ---- UI pocket (public/): shell + module + vendor tĩnh, KHÔNG cần token ----
+  // serveStatic phục vụ cả sw.js/manifest/icon của pocket (public/) — không còn hằng
+  // SW cũ: sw.js pocket có push handler (notification từ push service).
   if (req.method === 'GET' && await serveStatic(res, url)) return;
   // ---- /login?token= : sign-in pocket UI bằng device token (sau pair) hoặc master ----
   if (req.method === 'GET' && url.pathname === '/login') {
@@ -657,6 +747,17 @@ const http = createHttpServer(async (req, res) => {
   }
   if (!(await authorized(req, url))) { res.writeHead(401, { 'content-type': 'application/json', ...CORS }); return res.end(JSON.stringify({ error: 'unauthorized — open /pair and enter the code from `bom-pi pair`' })); }
 
+  // ---- /rpc: JSON-RPC 2.0 qua HTTP cho CLI từ thiết bị khác (BOM_PI_URL + device token) ----
+  // Cùng cổng auth /api/* (master BOM_PI_TOKEN hoặc device token bom_…); web-devices pair
+  // trước rồi đặt env. Trả JSON-RPC error shape để CLI hiển thị như lỗi local.
+  if (req.method === 'POST' && url.pathname === '/rpc') {
+    const raw = await new Promise((done) => { let b = ''; req.on('data', (c) => (b += c)); req.on('end', () => done(b)); });
+    let p; try { p = JSON.parse(raw || '{}'); } catch { return json2(res, 400, { error: { code: -32700, message: 'invalid JSON' } }); }
+    if (typeof p.method !== 'string') return json2(res, 400, { error: { code: -32600, message: 'method (string) required' } });
+    try { return json2(res, 200, await rpc(p.method, p.params)); }
+    catch (e) { return json2(res, 502, { error: { code: -32000, message: String(e?.message ?? e).replace(/^\d+: /, '') } }); }
+  }
+
   if (req.method === 'GET' && url.pathname === '/') {
     res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...CORS });
     return res.end(HTML);
@@ -770,5 +871,11 @@ const http = createHttpServer(async (req, res) => {
 });
 
 http.listen(PORT, LISTEN, () => {
-  console.error(`bom-web listening http://${LISTEN}:${PORT} — bom-core at ${socketPath}${TOKEN ? ' — token required' : ' — NO TOKEN (loopback only)'}`);
+  console.error(`bom-web listening http://${LISTEN}:${PORT} — bom-core at ${socketPath}${TOKEN ? ' — token required' : ' — NO TOKEN (loopback only)'}${pushStore ? ` — push ${pushStore.publicKey.slice(0, 12)}…` : ' — push OFF'}`);
+  // Socket events sống từ boot: push approval phải nổ khi không ai mở web
+  ensureEventsSocket().catch(() => scheduleEventsReconnect());
+  // eventsSocket chỉ watch conv active — conv khác (factory) kết thúc turn không sinh
+  // event cho web ⇒ poll 5s mọi conv cho push done/approval (chỉ khi có subscription,
+  // hai watch đều debounce + early-return nên gần như miễn phí khi không ai đăng ký).
+  setInterval(() => { pushApprovalWatch(); pushDoneWatch(); }, 5000).unref?.();
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bom-pi",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "type": "module",
   "description": "bom × pi — hệ sinh thái durable cho pi trên nền pi-durable: core daemon + web UI pocket + CLI",
   "engines": {
@@ -17,6 +17,7 @@
     "packages/cli/templates",
     "apps/web/server.mjs",
     "apps/web/pocket-adapter.mjs",
+    "apps/web/push.mjs",
     "apps/web/public",
     "systemd",
     "README.md"

package/packages/cli/src/bom-pi.mjs

@@ -27,7 +27,36 @@ const cid = arg('cid', null); // conversation id cho submit/transcript/reset/wat
 const cidParams = () => (cid ? { conversationId: Number(cid) } : {});
 const cmd = process.argv[2] ?? 'status';
 
-function rpc(method, params) {
+// Remote (thiết bị khác — Windows/phone đã pair): BOM_PI_URL=http://host:8791 (+ BOM_PI_TOKEN
+// device token bom_… copy sau khi pair qua browser). CLI nói chuyện web /rpc thay unix socket.
+const REMOTE_URL = arg('url', process.env.BOM_PI_URL || null);
+const REMOTE_TOKEN = arg('token', process.env.BOM_PI_TOKEN || null);
+
+// Không thấy daemon: hướng dẫn theo nơi đang chạy — máy chủ (chưa start?) hay
+// thiết bị khác (Windows/phone: bom-core là daemon unix-socket systemd, chưa port).
+function unreachable(e) {
+  const head = `cannot reach bom-core at ${socketPath}: ${e.message}`;
+  if (process.platform === 'win32') {
+    return `${head}
+
+  bom-core chạy trên máy chủ Linux (unix socket + systemd) — CLI chưa chạy được trên Windows.
+  Hai đường từ máy khác:
+  · WEB (đầy đủ nhất):  mở http://<ip-máy-chạy-daemon>:8791 (hoặc tunnel https://…) rồi pair
+                         bằng code in ra từ lệnh 'bom-pi pair' chạy TRÊN MÁY CHỦ đó.
+  · CLI REMOTE:         pair qua browser trước, copy device token bom_…, rồi đặt:
+                         set BOM_PI_URL=http://<ip>:8791  &  set BOM_PI_TOKEN=bom_…
+                         (PowerShell: $env:BOM_PI_URL=…; $env:BOM_PI_TOKEN=…) rồi chạy bom-pi status`;
+  }
+  return `${head}
+
+  daemon chưa chạy? thử:  systemctl --user start bom-core   (xem trạng thái: bom-pi status)
+  chưa cài daemon?:      bom-pi setup
+  ở THIẾT BỊ KHÁC?:      CLI có thể nói chuyện daemon từ xa — pair qua browser trước
+                         (http://<ip-máy-chạy-daemon>:8791), copy device token, rồi:
+                         BOM_PI_URL=http://<ip>:8791 BOM_PI_TOKEN=bom_… bom-pi status`;
+}
+
+function rpcSocket(method, params) {
   return new Promise((done, fail) => {
     const conn = connect(socketPath);
     let buf = '';
@@ -57,12 +86,25 @@ function rpc(method, params) {
     });
     // Daemon chết giữa chừng / đóng connection không trả lời
     conn.on('close', () => settle(fail, new Error('bom-core closed the connection without a reply')));
-    conn.on('error', (e) => settle(fail, new Error(`cannot reach bom-core at ${socketPath}: ${e.message}`)));
+    conn.on('error', (e) => settle(fail, new Error(unreachable(e))));
   });
 }
 
 const pretty = (o) => console.log(JSON.stringify(o, null, 2));
 
+// Dispatcher: remote (/rpc qua HTTP) khi BOM_PI_URL đặt — thiết bị khác không có unix socket
+async function rpcRemote(method, params) {
+  const r = await fetch(`${REMOTE_URL.replace(/\/+$/, '')}/rpc`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...(REMOTE_TOKEN ? { Authorization: `Bearer ${REMOTE_TOKEN}` } : {}) },
+    body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params: params ?? {} }),
+  });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(`bom-web ${REMOTE_URL} ${r.status}: ${j?.error?.message ?? r.statusText}`);
+  return j;
+}
+const rpc = REMOTE_URL ? rpcRemote : rpcSocket;
+
 // Kiểm protocol sau hello — mọi lệnh đều chạy qua đây
 function checkProtocol(hello) {
   if (typeof hello?.protocol === 'number' && hello.protocol > CLIENT_PROTOCOL) {
@@ -74,6 +116,10 @@ function checkProtocol(hello) {
 
 // ---- watch: mở 1 connection, subscribe, in transcript live đến khi Ctrl+C ----
 function watch() {
+  if (REMOTE_URL) {
+    console.error('watch cần kết nối socket local — từ thiết bị khác hãy mở web (transcript live có sẵn trong UI)');
+    process.exit(64);
+  }
   const conn = connect(socketPath);
   let gotReply = false;
   conn.on('connect', () => {
@@ -99,7 +145,7 @@ function watch() {
       }
     }
   });
-  conn.on('error', (e) => { console.error(`cannot reach bom-core at ${socketPath}: ${e.message}`); process.exit(1); });
+  conn.on('error', (e) => { console.error(unreachable(e)); process.exit(1); });
   conn.on('close', () => { if (!gotReply) { console.error('bom-core closed the connection without a reply'); process.exit(1); } process.exit(0); });
 }
 const printEntry = (e) => console.log(`[${e.kind}]${e.role ? ` ${e.role}:` : ''} ${e.text ?? ''}`);

package/packages/core/src/daemon.mjs

@@ -71,6 +71,12 @@ async function shutdown(reason) {
   if (closing) return;
   closing = true;
   log('đóng:', reason);
+  // Turn đang chờ approval không bao giờ settle ⇒ Session.close kẹt mãi.
+  // Từ chối hết mọi approval treo để turn kết thúc, rồi mới đóng storage.
+  for (const [, p] of pendingApprovals) {
+    try { p.resolve({ allow: false, reason: 'daemon shutdown' }); } catch { /* resolve rồi */ }
+  }
+  pendingApprovals.clear();
   let failed = false;
   if (heartbeatTimer) clearInterval(heartbeatTimer);
   if (scheduleTimer) clearInterval(scheduleTimer);
@@ -618,6 +624,10 @@ function clearWatchState(ownerKey) {
 async function agentStateOf(id) {
   try { return await harness.snapshot(AgentDoc, id, BACKGROUND_CONTEXT); } catch { return undefined; }
 }
+// Busy = LiveDoc.run đang chạy (khuôn pocket app.ts #busy) — turn đang stream / tool đang chạy
+async function busyOf(id) {
+  try { return (await harness.snapshot(LiveDoc, id, BACKGROUND_CONTEXT))?.run !== undefined; } catch { return false; }
+}
 // factory của conversation gọi (gốc hoặc con); null = orphan (K7 — vẫn chạy, không thuộc xưởng)
 function deriveFactory(cid) {
   return factories.find((f) => f.conversationId === cid || f.childConversationIds.includes(cid)) ?? null;
@@ -1045,7 +1055,7 @@ let taskRegistry = null; // gán trong boot sau createRegistry (registry là loc
 // ---- Mở Harness (pin exact @earendil-works 1.4.0 — xem DECISIONS.md) ----
 const { Harness } = await import('@earendil-works/pi-durable');
 const { openNodeSqliteStorage } = await import('@earendil-works/pi-durable/storage/sqlite/node');
-const { createRegistry, AgentDoc, defineExtension, wrapTool } = await import('@earendil-works/pi-durable');
+const { createRegistry, AgentDoc, LiveDoc, defineExtension, wrapTool } = await import('@earendil-works/pi-durable');
 const { CodingTools } = await import('@earendil-works/pi-durable/tools');
 const { NodeExecutionEnv } = await import('@earendil-works/pi-durable/env/node');
 const { ModelRuntime } = await import('@earendil-works/pi-coding-agent');
@@ -1465,6 +1475,7 @@ const methods = {
         model: agentState?.model ?? null,
         cwd: agentState?.cwd ?? null,
         instructions: agentState?.instructions ?? null, // M5a: smoke kiểm instructions của factory conv
+        busy: await busyOf(id), // web/UI + push 'done' theo dõi busy→idle
       });
     }
     return { active: activeConvId, count: out.length, conversations: out };