heyquilt 0.3.122 → 0.3.140

package/src/api/notify.js

@@ -0,0 +1,134 @@
+// Email notices from the website dashboard's Settings › Notifications (plans/dashboard ticket 11). Each
+// person picks what they want (kept on their account: user_metadata.notify), and the API's leader looks
+// every few minutes: messages to them nobody saw for a while (a mention or a direct message not answered
+// after MENTION_DELAY_MS), an agent asking to join a session they own, a daily digest of tasks for them,
+// and a weekly summary of their time in sessions. What's live comes from the relays (nowAsker in
+// routes/sessions.js), the week from the sessions the relays reported. What was already sent is kept on
+// the account too (user_metadata.notify_sent), so nothing is sent twice, across restarts as well.
+
+export const NOTIFY_KINDS = ['mentions', 'joins', 'tasks', 'weekly']
+export const NOTIFY_EVERY_MS = 10 * 60 * 1000
+export const MENTION_DELAY_MS = 15 * 60 * 1000
+const DAY_MS = 24 * 60 * 60 * 1000
+export const DIGEST_MS = DAY_MS
+export const WEEKLY_MS = 7 * DAY_MS
+
+/** A person's choices: each kind on or off (off unless it was turned on). */
+export function cleanNotify (v) {
+  const o = v && typeof v === 'object' ? v : {}
+  return Object.fromEntries(NOTIFY_KINDS.map((k) => [k, o[k] === true]))
+}
+
+/** What was sent already: the newest mention and join request mailed, and when the digest and summary went. */
+export function cleanSent (v) {
+  const o = v && typeof v === 'object' ? v : {}
+  const n = (x) => (Number.isFinite(x) && x > 0 ? x : 0)
+  return { mentionsAt: n(o.mentionsAt), joinsAt: n(o.joinsAt), tasksAt: n(o.tasksAt), weeklyAt: n(o.weeklyAt) }
+}
+
+const hours = (ms) => {
+  const m = Math.round(ms / 60000)
+  if (m < 60) return `${m}m`
+  return `${Math.floor(m / 60)}h${m % 60 ? ` ${m % 60}m` : ''}`
+}
+const line = (n, s) => `- ${s.name || 'Untitled session'}: ${n.by} · "${n.text}"`
+const footer = (site) => ['', `Open your dashboard: ${site}/dashboard`, `Change which emails you get: ${site}/settings/notifications`]
+
+/**
+ * The emails due for one person at `t`, and what to remember as sent. `now` is their summary of now
+ * (nowAsker), `overview` their week (overviewOf) or null; `site` the website's address.
+ */
+export function planNotices ({ notify, sent, now, overview = null, t, site }) {
+  const want = cleanNotify(notify)
+  const was = cleanSent(sent)
+  const next = { ...was }
+  const mails = []
+  const needs = []
+  for (const s of (now && now.sessions) || []) for (const n of s.needs || []) needs.push({ n, s })
+
+  if (want.mentions) {
+    const due = needs.filter(({ n }) => (n.kind === 'mention' || n.kind === 'dm') && n.at > was.mentionsAt && n.at <= t - MENTION_DELAY_MS)
+    if (due.length) {
+      next.mentionsAt = Math.max(...due.map(({ n }) => n.at))
+      mails.push({
+        subject: due.length === 1 ? `${due[0].n.by} is waiting for you in ${due[0].s.name || 'Quilt'}` : `${due.length} messages are waiting for you in Quilt`,
+        text: ['Messages to you nobody has answered yet:', '', ...due.map(({ n, s }) => line(n, s)), '', 'Answer them in the Quilt app.', ...footer(site)].join('\n')
+      })
+    }
+  }
+  if (want.joins) {
+    const due = needs.filter(({ n }) => n.kind === 'join' && n.at > was.joinsAt)
+    if (due.length) {
+      next.joinsAt = Math.max(...due.map(({ n }) => n.at))
+      mails.push({
+        subject: due.length === 1 ? `${due[0].n.by} asks to join ${due[0].s.name || 'your session'}` : `${due.length} are asking to join your sessions`,
+        text: ['Waiting for you to let them in:', '', ...due.map(({ n, s }) => `- ${n.by}${n.agent ? ' (an agent)' : ''} in ${s.name || 'Untitled session'}`), '', 'Let them in, or not, from the session in the Quilt app.', ...footer(site)].join('\n')
+      })
+    }
+  }
+  if (want.tasks && t - was.tasksAt >= DIGEST_MS) {
+    const due = needs.filter(({ n }) => n.kind === 'task')
+    if (due.length) {
+      next.tasksAt = t
+      mails.push({
+        subject: `${due.length} ${due.length === 1 ? 'task is' : 'tasks are'} waiting for you in Quilt`,
+        text: ['Tasks for you, still to do:', '', ...due.map(({ n, s }) => `- ${n.text} (${s.name || 'Untitled session'}, from ${n.by})`), ...footer(site)].join('\n')
+      })
+    }
+  }
+  if (want.weekly && t - was.weeklyAt >= WEEKLY_MS && overview) {
+    next.weeklyAt = t
+    const week = overview.sessions.filter((s) => s.lastActiveAt >= t - WEEKLY_MS)
+    const together = overview.totals?.collaboratingThisWeek || 0
+    if (week.length) {
+      const top = (overview.totals?.topCollaborators || []).slice(0, 3).map((c) => c.name)
+      mails.push({
+        subject: `Your week in Quilt: ${week.length} ${week.length === 1 ? 'session' : 'sessions'}${together ? `, ${hours(together)} together` : ''}`,
+        text: [
+          `This week you worked in ${week.length} ${week.length === 1 ? 'session' : 'sessions'}${together ? ` and spent ${hours(together)} working with others` : ''}.`,
+          ...(top.length ? [`You worked most with ${top.join(', ')}.`] : []),
+          '',
+          ...week.slice(0, 10).map((s) => `- ${s.name || 'Untitled session'}: ${hours(s.myTotalMs)} for you`),
+          ...footer(site)
+        ].join('\n')
+      })
+    }
+  }
+  return { mails, sent: next }
+}
+
+/**
+ * The job: every `everyMs` on the leading machine, each person who turned a notice on gets what's due.
+ * store.notifyUsers() lists them ({ userId, email, notify, sent }); store.setNotifySent keeps what went.
+ */
+export function notifier ({ store, mailer, ask, overview, now = Date.now, log = () => {}, site, leads = () => true, everyMs = NOTIFY_EVERY_MS }) {
+  let timer = null
+  let running = false
+  async function tick () {
+    if (running || !leads() || !store.notifyUsers) return 0
+    running = true
+    let sentCount = 0
+    try {
+      const users = await store.notifyUsers()
+      for (const u of users) {
+        const want = cleanNotify(u.notify)
+        if (!u.email || !NOTIFY_KINDS.some((k) => want[k])) continue
+        const t = now()
+        const account = `person:${u.userId}`
+        try {
+          const live = want.mentions || want.joins || want.tasks ? await ask(account, t) : null
+          const week = want.weekly && t - cleanSent(u.sent).weeklyAt >= WEEKLY_MS ? await overview(account, t) : null
+          const plan = planNotices({ notify: want, sent: u.sent, now: live, overview: week, t, site })
+          for (const m of plan.mails) { await mailer.send({ to: u.email, ...m }); sentCount++ }
+          if (JSON.stringify(plan.sent) !== JSON.stringify(cleanSent(u.sent))) await store.setNotifySent(u.userId, plan.sent)
+        } catch (err) { log(`notify ${u.userId}: ${err.message}`) }
+      }
+    } catch (err) { log(`notify: ${err.message}`) } finally { running = false }
+    return sentCount
+  }
+  return {
+    tick,
+    start () { if (!timer) { timer = setInterval(tick, everyMs); timer.unref?.() } },
+    stop () { clearInterval(timer); timer = null }
+  }
+}

package/src/api/routes/browsers.js

@@ -0,0 +1,29 @@
+// Signing out one browser at a time (plans/dashboard ticket 12, the website's Settings › Security):
+// your browser sign-ins (Supabase Auth's sessions), and ending one. Computers are unlinked on their own
+// (the devices table). Needs the 20261026235000_my_browser_sessions migration; without it, 503.
+import { HttpError, UUID } from '../http.js'
+
+const NOT_SET_UP = 'Signing out one browser at a time is not set up on this server yet.'
+
+export function browserRoutes ({ store, person, log = () => {} }) {
+  const guard = async (fn) => {
+    try { return await fn() } catch (err) {
+      if (err instanceof HttpError) throw err
+      log(`browsers: ${err.message}`)
+      throw new HttpError(503, NOT_SET_UP)
+    }
+  }
+  return [
+    ['GET', /^\/v1\/me\/browsers$/, async (req) => {
+      const { userId } = await person(req)
+      return guard(async () => ({ browsers: await store.authSessions(userId) }))
+    }],
+    ['DELETE', /^\/v1\/me\/browsers\/([^/]+)$/, async (req, body, [id]) => {
+      const { userId } = await person(req)
+      if (!UUID.test(id)) throw new HttpError(404, 'no such sign-in')
+      const ended = await guard(() => store.endAuthSession(userId, id.toLowerCase()))
+      if (!ended) throw new HttpError(404, 'no such sign-in')
+      return { ok: true }
+    }]
+  ]
+}

package/src/api/routes/relay.js

@@ -15,6 +15,18 @@ const ROOM = /^[A-Za-z0-9_-]{1,64}$/
 const ACCOUNT = /^(person|agent):[A-Za-z0-9_-]{1,64}$/
 
 const VIA = ['app', 'hosted']
+// Relay leases (src/relay-lease.js), moved here from routes/github.js in 16's R2 so they outlive git sync.
+export const LEASE_TTL_MS = 2 * 60 * 1000
+const LEASE_KEY = /^[\x21-\x7e][\x20-\x7e]{0,599}$/
+const LEASE_REPO = /^[A-Za-z0-9.-]{1,100}\/[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/
+
+/** A lease's key: `key` as the relay names it, else (a relay from before R2) "<repo> <branch>", the same key either way; null when neither is one. */
+export function leaseKey (b) {
+  if (typeof b.key === 'string' && LEASE_KEY.test(b.key)) return b.key
+  const repo = String(b.repo || ''); const branch = String(b.branch || '')
+  if (!LEASE_REPO.test(repo) || !branch || branch.length > 255 || /\s/.test(branch)) return null
+  return `${repo} ${branch}`
+}
 /** A short label: printable, at most `n` characters. */
 const label = (x, n) => stripInvisible(x).slice(0, n).join('').replace(/[\u0000-\u001f\u007f]/g, '').trim()
 
@@ -51,9 +63,9 @@ export function cleanEvent (e, now) {
 export function relayRoutes ({ store, now, log, bearer, relaySecret }) {
   let prunedAt = 0
   const fromRelay = (req) => {
-    if (!relaySecret) throw new HttpError(503, 'presence is not set up on this server')
+    if (!relaySecret) throw new HttpError(503, 'the relay is not set up on this server')
     // Hashed first so the comparison takes the same time whatever was sent.
-    if (!crypto.timingSafeEqual(digest(bearer(req)), digest(relaySecret))) throw new HttpError(401, 'only the relay may report presence')
+    if (!crypto.timingSafeEqual(digest(bearer(req)), digest(relaySecret))) throw new HttpError(401, 'only the relay may ask for this')
   }
 
   return [
@@ -71,6 +83,17 @@ export function relayRoutes ({ store, now, log, bearer, relaySecret }) {
           .catch((err) => log(`could not prune session activity: ${err?.message || err}`))
       }
       return { ok: true, applied, skipped: body.events.length - events.length }
-    }, { maxBody: PRESENCE_BODY }]
+    }, { maxBody: PRESENCE_BODY }],
+    // One holder at a time per key, across relay machines (relay-lease.js). Leases lapse LEASE_TTL_MS after the last heartbeat.
+    ['POST', /^\/v1\/relay\/leases\/(take|heartbeat|release)$/, async (req, b, [what]) => {
+      fromRelay(req)
+      const key = leaseKey(b); const room = String(b.room || '')
+      if (!key || !/^[A-Za-z0-9_-]{1,64}$/.test(room)) throw new HttpError(400, 'give key (or repo as host/owner/name and branch) and room')
+      const ttlMs = Math.max(1000, Math.min(10 * 60_000, Number(b.ttlMs) || LEASE_TTL_MS))
+      const generation = Number.isInteger(b.generation) ? b.generation : 0
+      if (what === 'take') return store.takeLease({ key, room, holder: String(b.holder || '').slice(0, 100), ttlMs })
+      if (what === 'heartbeat') return store.heartbeatLease({ key, room, generation, ttlMs })
+      return store.releaseLease({ key, room, generation })
+    }]
   ]
 }

package/src/api/routes/session-migrate.js

@@ -1,6 +1,7 @@
-// Making a session a quilt (plans/quilt-source-control/16, "How a session becomes a quilt"):
+// Making a session a quilt (Seam's plans/quilt-source-control/16, "How a session becomes a quilt"):
 // POST /v1/sessions/:room/migrate { dry_run, token, step }. The session's owner, signed in, asks here
-// (step 'switch' moves the session's files into its squares, layout 3; 'unswitch' goes back);
+// (step 'make' is "Make this a quilt": made and moved into its squares in one go; 'switch' moves the session's files into its squares, layout 3; 'unswitch' goes back;
+// 'shadow' links a session with a git remote to the quilt its import fills, 16 step 1);
 // the relay machine holding the room does the work (POST /quilt/migrate, with the relay secret),
 // so this is the same operation as the MCP tool and `quilt session migrate`. Seam is called as the
 // owner: with `token` (their Seam sign-in) when given, else the sign-in they used here. The relay
@@ -23,8 +24,10 @@ export function sessionMigrateRoutes ({ store, person, bearer, relaySecret, clus
       const dry = body && body.dry_run === true
       const token = body && typeof body.token === 'string' && body.token ? body.token : bearer(req)
       const where = await store.relayRoom(room).catch(() => null)
-      const step = body && (body.step === 'switch' || body.step === 'unswitch') ? body.step : null
-      const ask = { room, account, ...(dry ? { dry_run: true } : { token }), ...(step && !dry ? { step } : {}) }
+      const step = body && (body.step === 'make' || body.step === 'switch' || body.step === 'unswitch' || body.step === 'shadow') ? body.step : null
+      // step 'shadow' (16 step 1): `quilt` names the quilt an import of the session's git remote fills; null unlinks.
+      const quilt = step === 'shadow' && typeof body.quilt === 'string' && body.quilt ? body.quilt.slice(0, 200) : null
+      const ask = { room, account, ...(dry ? { dry_run: true } : { token }), ...(step && !dry ? { step } : {}), ...(step === 'shadow' && !dry ? { quilt } : {}), ...(step === 'unswitch' && !dry && Array.isArray(body.carried) ? { carried: body.carried.filter((x) => typeof x === 'string').slice(0, 200) } : {}) }
       try {
         return await cluster.callRelay((where && where.machineId) || '', 'POST', '/quilt/migrate', ask, { timeoutMs: MIGRATE_TIMEOUT_MS })
       } catch (err) {

package/src/api/routes/sessions.js

@@ -3,7 +3,7 @@
 // who were there at the same time as you.
 import { HttpError, Raw } from '../http.js'
 import { auditTrail, auditCsv, MAX_ACTIONS } from '../audit.js'
-import { summarize, collaborators, myVisits, isTimeZone, weekStart, monthStart, MAX_SESSIONS } from '../activity.js'
+import { summarize, collaborators, myVisits, isTimeZone, weekStart, monthStart, MAX_SESSIONS, DAY_MS } from '../activity.js'
 import { cleanSessionName, BAD_SESSION_NAME } from '../../session-name.js'
 
 const ROOM = /^[A-Za-z0-9_-]{1,64}$/
@@ -90,3 +90,75 @@ export function sessionRoutes ({ store, now, person }) {
     ['GET', /^\/v1\/me\/collaborators$/, async (req) => ({ collaborators: await collaboratorsOf(store, await me(req), now()) })]
   ]
 }
+
+export const NOW_CACHE_MS = 10 * 1000
+export const NOW_TIMEOUT_MS = 5 * 1000
+const NOW_ROOMS = 40
+
+/**
+ * Asks the relay machines holding an account's recent sessions for its summary of now, and merges their
+ * answers: (account, t) → { sessions, at, live, partial? }. The dashboard's route and the email notices
+ * (notify.js) both use it.
+ */
+export function nowAsker ({ store, cluster, relayOn = false, log = () => {} }) {
+  return async (account, t) => {
+    if (!relayOn) return { sessions: [], at: t, live: false }
+    // The sessions that can be live: the latest ones, and every one active in the last day.
+    const sessions = await store.accountSessions(account, { since: t - DAY_MS, limit: 20 })
+    const rooms = sessions.map((s) => s.room).slice(0, NOW_ROOMS)
+    const byMachine = new Map()
+    await Promise.all(rooms.map(async (room) => {
+      const placed = await store.relayRoom(room).catch(() => null)
+      const id = (placed && placed.machineId) || ''
+      if (!byMachine.has(id)) byMachine.set(id, [])
+      byMachine.get(id).push(room)
+    }))
+    let partial = false
+    const answers = await Promise.all([...byMachine].map(([id, list]) =>
+      cluster.callRelay(id, 'POST', '/now', { account, rooms: list }, { timeoutMs: NOW_TIMEOUT_MS })
+        .catch((err) => { partial = true; log(`now from relay ${id || ''}: ${err.message}`); return null })))
+    return { sessions: answers.flatMap((a) => (a && Array.isArray(a.sessions) ? a.sessions : [])), at: t, live: true, ...(partial ? { partial: true } : {}) }
+  }
+}
+
+/**
+ * The website dashboard's summary of now (plans/dashboard ticket 9): for each of my sessions a relay
+ * holds, who is in it, what each AI is doing, the board in brief, held files and what needs me
+ * (src/now-summary.js on the relay). The relay machines holding my recent sessions are asked, at most
+ * once every NOW_CACHE_MS per person (the page asks every 15 to 30 seconds), and their answers merged.
+ * `relayOn` false (no relay or no relay secret): nothing to ask, so nothing is live.
+ */
+export function nowRoutes ({ store, now, person, cluster, relayOn = false, log = () => {} }) {
+  const cache = new Map() // account -> { at, out }
+  const ask = nowAsker({ store, cluster, relayOn, log })
+  return [
+    ['GET', /^\/v1\/me\/now$/, async (req) => {
+      const account = `person:${(await person(req)).userId}`
+      const t = now()
+      const hit = cache.get(account)
+      if (hit && t - hit.at < NOW_CACHE_MS) return hit.out
+      const out = await ask(account, t)
+      cache.set(account, { at: t, out })
+      if (cache.size > 5000) for (const [k, v] of cache) if (t - v.at >= NOW_CACHE_MS) cache.delete(k)
+      return out
+    }],
+
+    // One session I was in, in more detail (its page's Activity tab): { session } or { session: null } when
+    // nobody is in it now. 404 for a session I was never in, whether or not it exists.
+    ['GET', /^\/v1\/me\/now\/([^/]+)$/, async (req, body, [room]) => {
+      const account = `person:${(await person(req)).userId}`
+      if (!ROOM.test(room)) throw new HttpError(404, NO_SESSION)
+      const visits = await store.visitsInRooms([room])
+      if (!visits.some((v) => v.account === account)) throw new HttpError(404, NO_SESSION)
+      if (!relayOn) return { session: null, live: false }
+      const placed = await store.relayRoom(room).catch(() => null)
+      try {
+        const a = await cluster.callRelay((placed && placed.machineId) || '', 'POST', '/now', { account, rooms: [room], detail: true }, { timeoutMs: NOW_TIMEOUT_MS })
+        return { session: (a && Array.isArray(a.sessions) && a.sessions[0]) || null, live: true }
+      } catch (err) {
+        log(`now for ${room}: ${err.message}`)
+        return { session: null, live: true, partial: true }
+      }
+    }]
+  ]
+}

package/src/api/routes/teams.js

@@ -37,8 +37,6 @@ export function teamRoutes ({ store, user, policyChanged = null }) {
           name: t.name,
           createdAt: t.createdAt,
           access: mine.get(t.id) || null,
-          // The team's git rule (git for everyone: '' sets nothing, off, branches or any).
-          git: (await store.teamGithub(t.id)).agentCommits,
           members: a.can('team_members', 'r') || mine.has(t.id)
             ? (await store.listTeamMembers(t.id)).map((m) => ({ memberId: m.memberId, name: m.name, access: m.access, kind: m.kind, scopes: m.scopes || [] }))
             : null
@@ -98,27 +96,6 @@ export function teamRoutes ({ store, user, policyChanged = null }) {
       return { member: memberView(tm) }
     }],
 
-    // The team's git rule (docs/superpowers/specs/2026-10-17-git-for-everyone.md): whether git is on for
-    // everyone in the sessions its people own in the org's workspaces, and what agents may push there.
-    // '' sets nothing; off, branches or any is a ceiling for the workspaces' and sessions' own choices.
-    ['GET', /^\/v1\/orgs\/([^/]+)\/teams\/([^/]+)\/github$/, async (req, body, [slug, id]) => {
-      const a = await orgFor(req, slug)
-      const team = await teamIn(a, id)
-      const mine = (await store.teamsOfMember(a.me.id)).some((x) => x.teamId === team.id)
-      if (!a.can('teams', 'r') && !mine) throw new HttpError(404, 'no such team')
-      return store.teamGithub(team.id)
-    }],
-    ['PUT', /^\/v1\/orgs\/([^/]+)\/teams\/([^/]+)\/github$/, async (req, body, [slug, id]) => {
-      const a = await orgFor(req, slug)
-      a.need('teams', 'u')
-      const team = await teamIn(a, id)
-      if (!('agentCommits' in body)) throw new HttpError(400, 'Give agentCommits: "" (the team sets nothing), off, branches or any.')
-      const v = body.agentCommits === null ? '' : body.agentCommits
-      if (!['', 'off', 'branches', 'any'].includes(v)) throw new HttpError(400, 'agentCommits is "" (the team sets nothing), off, branches or any.')
-      await store.setTeamGithub(team.id, { agentCommits: v })
-      if (policyChanged) policyChanged()
-      return store.teamGithub(team.id)
-    }],
 
     ['DELETE', /^\/v1\/orgs\/([^/]+)\/teams\/([^/]+)\/members\/([^/]+)$/, async (req, body, [slug, id, memberId]) => {
       const a = await orgFor(req, slug)

package/src/api/server.js

@@ -25,10 +25,10 @@ import { relayRoutes } from './routes/relay.js'
 import { relayClusterRoutes } from './routes/relay-cluster.js'
 import { relayCluster } from './relay-cluster.js'
 import crypto from 'node:crypto'
-import { githubRoutes } from './routes/github.js'
-import { githubApp, ensureWebhookSecret, redeliverFailed } from './github-app.js'
 import { releaseSource } from './releases.js'
-import { sessionRoutes } from './routes/sessions.js'
+import { sessionRoutes, nowRoutes, nowAsker, overviewOf } from './routes/sessions.js'
+import { notifier, NOTIFY_EVERY_MS } from './notify.js'
+import { browserRoutes } from './routes/browsers.js'
 import { sessionMigrateRoutes } from './routes/session-migrate.js'
 import { accessTypeRoutes } from './routes/access-types.js'
 import { grantRoutes } from './routes/grants.js'
@@ -74,7 +74,7 @@ const MCP_TIMEOUT_MS = 30 * 1000
 // a change to its grant reaches it as soon as it reaches a connected app.
 const PASS_REUSE_MARGIN_MS = 5 * 60 * 1000
 
-export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, siteUrl, apiUrl = 'https://api.heyquilt.com', mailer = { send: async () => { throw new Error('no mailer configured') } }, now = Date.now, log = () => {}, startLimit = 10, inviteLimit = 10, inviteSendLimit = 20, tokenLimit = 30, joinLimit = 20, trustProxy = false, maxStartKeys = 10_000, passKey = '', passLimit = 60, relayUrl = HOSTED_RELAY, mcpLimit = 600, reportKey = '', reportLimit = 10, slowMs = 2000, pruneEveryMs = 60 * 60 * 1000, keepEventsMs = 30 * 24 * 60 * 60 * 1000, keepIssuesMs = 90 * 24 * 60 * 60 * 1000, pruneStartMs = 10_000, relaySecret = '', workspaces = false, fileStore = null, maxFileBytes = 500 * 1024 * 1024, workspaceQuotaBytes = 5 * 1024 * 1024 * 1024, maxWorkspaceFiles = 2000, webhookFetch = globalThis.fetch, webhookLookup, allowLocalWebhooks = false, github = null, githubFetch = globalThis.fetch, fly = null, aiVmWaitMs = AI_VM_WAIT_MS, aiVmSpareSuspendMs, relayFetch = null, relayFly = null, heavy = null, relayTargets = null, clusterTiming = {}, vaultSecret = '', vaultUrl = 'https://vault.heyquilt.com', allowLocalUpstreams = false, secretWaitMs, voice = {}, voiceFetch = globalThis.fetch, mail = {}, mailFetch = globalThis.fetch, machineId = '', leaderTiming = {}, autoscaleTiming = {}, exit = () => process.exit(0), apiFly = null, maxMachines, seamUrl = 'https://api.seam.heyquilt.com', seamFetch = globalThis.fetch, seamClientId = '', seamSiteUrl = 'https://seam.heyquilt.com', seamConnectSecret = '' }) {
+export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, siteUrl, apiUrl = 'https://api.heyquilt.com', mailer = { send: async () => { throw new Error('no mailer configured') } }, now = Date.now, log = () => {}, startLimit = 10, inviteLimit = 10, inviteSendLimit = 20, tokenLimit = 30, joinLimit = 20, trustProxy = false, maxStartKeys = 10_000, passKey = '', passLimit = 60, relayUrl = HOSTED_RELAY, mcpLimit = 600, reportKey = '', reportLimit = 10, slowMs = 2000, pruneEveryMs = 60 * 60 * 1000, keepEventsMs = 30 * 24 * 60 * 60 * 1000, keepIssuesMs = 90 * 24 * 60 * 60 * 1000, pruneStartMs = 10_000, relaySecret = '', workspaces = false, quiltSourceDefault = false, fileStore = null, maxFileBytes = 500 * 1024 * 1024, workspaceQuotaBytes = 5 * 1024 * 1024 * 1024, maxWorkspaceFiles = 2000, webhookFetch = globalThis.fetch, webhookLookup, allowLocalWebhooks = false, github = null, githubFetch = globalThis.fetch, fly = null, aiVmWaitMs = AI_VM_WAIT_MS, aiVmSpareSuspendMs, relayFetch = null, relayFly = null, heavy = null, relayTargets = null, clusterTiming = {}, vaultSecret = '', vaultUrl = 'https://vault.heyquilt.com', allowLocalUpstreams = false, secretWaitMs, voice = {}, voiceFetch = globalThis.fetch, mail = {}, mailFetch = globalThis.fetch, machineId = '', leaderTiming = {}, autoscaleTiming = {}, exit = () => process.exit(0), apiFly = null, maxMachines, seamUrl = 'https://api.seam.heyquilt.com', seamFetch = globalThis.fetch, seamClientId = '', seamSiteUrl = 'https://seam.heyquilt.com', seamConnectSecret = '', notifyEveryMs = NOTIFY_EVERY_MS }) {
   // PASS_SIGNING_KEY. A bad one should stop the API at start, not fail every pass later.
   if (passKey) passPublicKey(passKey)
   const site = String(siteUrl || '').replace(/\/+$/, '')
@@ -223,7 +223,8 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
     ['GET', /^\/healthz$/, async () => ({ ok: true })],
 
     // Which optional parts this API has on, for the app and the MCPs to decide what to show. Public.
-    ['GET', /^\/v1\/features$/, async () => ({ workspaces: !!workspaces, secrets: !!vaultSecret })],
+    // quilt_source_default (QUILT_SOURCE_DEFAULT, Seam's plans/quilt-source-control/16 flags order 8): apps make the sessions they start quilts from the start.
+    ['GET', /^\/v1\/features$/, async () => ({ workspaces: !!workspaces, secrets: !!vaultSecret, quilt_source_default: !!quiltSourceDefault })],
 
     ['POST', /^\/v1\/device\/start$/, async (req, body) => {
       limitStarts(req)
@@ -358,8 +359,6 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
   // The relay on many machines: where each room lives, and heavy rooms' own machines (relay-cluster.js).
   const cluster = relayCluster({ store, relayUrl: relay, relaySecret, fetch: relayFetch || githubFetch, now, log, fly: relayFly, ...(heavy ? { limits: heavy } : {}), ...(relayTargets ? { targets: relayTargets } : {}), ...clusterTiming })
   const ctx = { store, user, person, device, bearer, now, site, apiUrl: api, mailer, log, limit: limitInvites, limitSend: limitInviteSend, limitTokens, limitStarts, spendResume, resumeWindowMs: RESUME_WINDOW_MS, limitJoin, agentAuth, reportKey, limitReports, relaySecret, files, maxFileBytes, workspaceQuotaBytes, maxWorkspaceFiles }
-  // GitHub's webhook secret: set on the app by this API at start (github-app.js), kept in the store when the environment gives none.
-  const hookSecret = { value: (github && github.webhookSecret) || '' }
   // On several machines, one leads what lives in a machine's memory (leader.js); alone, this one does.
   const lead = leader({ store, machineId, log, ...leaderTiming })
   // Scaling down (autoscale.js): an idle machine shuts itself down cleanly when the others can carry
@@ -378,24 +377,17 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
       exit()
     }
   })
-  const githubReady = (async () => {
-    if (!github) return
-    const app = githubApp(github, { fetch: githubFetch, now })
-    await ensureWebhookSecret({ cfg: github, app, store, hook: hookSecret, log })
-    // Asking GitHub for failed deliveries again is done once, by the leader, not by every machine.
-    await lead.ready
-    if (lead.leads()) await redeliverFailed({ app, log })
-  })().catch((err) => log(`github at start: ${err.message}`))
+  // Sessions are quilts (Seam): nothing waits on GitHub at start.
+  const githubReady = Promise.resolve()
   // A person's AI on its own cloud machine (routes/ai-vm.js): off (503) without Fly set up. Only the leader runs it.
   const aiVm = aiVmRoutes({ ...ctx, relayUrl, fly, waitMs: aiVmWaitMs, spareSuspendMs: aiVmSpareSuspendMs, leads: lead.leads })
   routes.push(...aiVm.routes)
-  // A team's git rule or who is on a team changed: the relay asks its sessions' rules again now (relay /github/policy).
-  // With a room (a session put in or taken out of a workspace), only that session asks.
-  const policyChanged = (room = '') => {
-    if (!relay || !relaySecret) return
-    cluster.tellRelays('/github/policy', room ? { room } : {}).catch((err) => log(`git rules to relay: ${err.message}`))
-  }
-  routes.push(...orgRoutes(ctx), ...memberRoutes(ctx), ...teamRoutes({ ...ctx, policyChanged }), ...inviteRoutes(ctx), ...agentRoutes({ ...ctx, passKey }), ...agentInviteRoutes({ ...ctx, workspaces }), ...joinRoutes(ctx), ...relayRoutes(ctx), ...githubRoutes({ ...ctx, github, githubFetch, relayHttp: relay, relayFetch: githubFetch, tellRelays: (path, body) => cluster.tellRelays(path, body), hookSecret, workspaces }), ...relayClusterRoutes({ ...ctx, cluster }), ...sessionRoutes(ctx), ...sessionMigrateRoutes({ ...ctx, cluster }), ...accessTypeRoutes(ctx), ...grantRoutes({ ...ctx, workspaces }), ...sessionInviteRoutes({ ...ctx, workspaces }), ...issueRoutes(ctx))
+  // Email notices people turned on in the website's Settings › Notifications (notify.js): the leader sends them.
+  const notices = notifier({ store, mailer, ask: nowAsker({ store, cluster, relayOn: !!(relay && relaySecret), log }), overview: (account, t) => overviewOf(store, account, 'UTC', t), now, log, site, leads: lead.leads, everyMs: notifyEveryMs })
+  if (notifyEveryMs > 0) notices.start()
+  // Git rules went with git mode (R3): nothing to tell the relay.
+  const policyChanged = () => {}
+  routes.push(...orgRoutes(ctx), ...memberRoutes(ctx), ...teamRoutes({ ...ctx, policyChanged }), ...inviteRoutes(ctx), ...agentRoutes({ ...ctx, passKey }), ...agentInviteRoutes({ ...ctx, workspaces }), ...joinRoutes(ctx), ...relayRoutes(ctx), ...relayClusterRoutes({ ...ctx, cluster }), ...sessionRoutes(ctx), ...nowRoutes({ ...ctx, cluster, relayOn: !!(relay && relaySecret) }), ...browserRoutes(ctx), ...sessionMigrateRoutes({ ...ctx, cluster }), ...accessTypeRoutes(ctx), ...grantRoutes({ ...ctx, workspaces }), ...sessionInviteRoutes({ ...ctx, workspaces }), ...issueRoutes(ctx))
   // Always routed: with the flag off each answers a plain 404 of its own, so the app's
   // check at every launch isn't filed as a missing route.
   // Only these take a hosted agent's pass (workspaceReach), so they alone get the pass key.
@@ -417,7 +409,7 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
   routes.push(...mailRoutes({ ...ctx, passKey, mail, mailFetch, makeLimiter, tellRoom }))
   // How Quilt wakes each agent (routes/agent-wake.js): step 2 of joining.
   routes.push(...agentWakeRoutes({ ...ctx, passKey, mail, mailFetch, makeLimiter }))
-  // Seam (src/quilts/, plans/quilt-source-control/) is its own service at seamUrl. This API is its
+  // Seam (src/quilts/, Seam's plans/quilt-source-control/) is its own service at seamUrl. This API is its
   // identity service for Quilt accounts: GET /v1/seam/me says who is calling, as a quilt member
   // { member_id, kind, name, tool?, on_behalf_of? }, for a person's sign-in, an agent key or a pass.
   const seamCaller = workspaceReach({ ...ctx, passKey })
@@ -519,7 +511,7 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
     }
   })
 
-  // Seam's routes moved to Seam's own server (docs/seam-service.md): old seam commands and sites
+  // Seam's routes moved to Seam's own server (Seam's docs/seam-service.md): old seam commands and sites
   // still call them here, so they go on to seamUrl as sent, and Seam's answer comes straight back.
   async function forwardSeam (req, res) {
     if (!seamUrl) throw new HttpError(404, 'not found')
@@ -698,7 +690,7 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
 
   return new Promise((resolve) => server.listen(port, host, () => {
     const p = server.address().port
-    resolve({ port: p, url: `http://${host}:${p}`, cluster, lead, scaler, grow, fillSpares: aiVm.fillSpares, close: () => { clearInterval(prune); clearTimeout(firstPrune); aiVm.close(); lead.close(); scaler.close(); grow.close(); return new Promise((r) => server.close(r)) }, startKeys: () => limitStarts.size(), sweepFiles: (at) => wsFiles.sweep(at), flushWebhooks, githubReady })
+    resolve({ port: p, url: `http://${host}:${p}`, cluster, lead, scaler, grow, fillSpares: aiVm.fillSpares, notices, close: () => { clearInterval(prune); clearTimeout(firstPrune); aiVm.close(); notices.stop(); lead.close(); scaler.close(); grow.close(); return new Promise((r) => server.close(r)) }, startKeys: () => limitStarts.size(), sweepFiles: (at) => wsFiles.sweep(at), flushWebhooks, githubReady })
   }))
 }
 

package/src/api/supabase-store.js

@@ -69,6 +69,14 @@ export const rowFrom = (row) => row && Object.fromEntries(Object.entries(toCamel
 export function createSupabaseStore ({ url, serviceKey, client }) {
   const db = client || createClient(url, serviceKey, { auth: { persistSession: false, autoRefreshToken: false } })
   const one = async (q) => { const { data, error } = await q; if (error) throw error; return data }
+  // A lease call (relay_leases), or the git_sync_leases one while the relay_leases migration is not applied (PGRST202: no such function).
+  const leaseRpc = async (what, key, args, oldArgs) => {
+    const { data, error } = await db.rpc(`${what}_relay_lease`, args)
+    if (!error) return data
+    const at = String(key).indexOf(' ')
+    if (error.code !== 'PGRST202' || at < 1) throw error
+    return one(db.rpc(`${what}_git_sync_lease`, oldArgs(key.slice(0, at), key.slice(at + 1))))
+  }
   const memberOf = async (orgId, userId) => rowFrom(await one(db.from('org_members').select(MEMBER).eq('org_id', orgId).eq('user_id', userId).maybeSingle()))
   // Every row of a query, a page at a time. `build` makes a fresh query (with a stable order) per page.
   const pages = async (build) => {
@@ -290,63 +298,12 @@ export function createSupabaseStore ({ url, serviceKey, client }) {
       if (error) throw error
     },
 
-    // The GitHub account a person connected (routes/github.js): { githubId, login, linkedAt } or null.
-    async githubLink (userId) { return rowFrom(await one(db.from('github_links').select('github_id, login, linked_at').eq('user_id', userId).maybeSingle())) },
-    async setGithubLink (userId, { githubId, login }) {
-      await one(db.from('github_links').upsert({ user_id: userId, github_id: githubId, login, linked_at: new Date().toISOString() }, { onConflict: 'user_id' }))
-    },
-    async deleteGithubLink (userId) { await one(db.from('github_links').delete().eq('user_id', userId)) },
-    // GitHub connected for a scope (github_connections), newest first.
-    async githubConnections ({ scope, scopeId }) {
-      const rows = await one(db.from('github_connections').select('scope, scope_id, connected_by, installation_id, created_at').eq('scope', scope).eq('scope_id', scopeId).order('created_at', { ascending: false }))
-      return rows.map((r) => ({ scope: r.scope, scopeId: r.scope_id, connectedBy: r.connected_by, installationId: r.installation_id == null ? null : Number(r.installation_id), createdAt: Date.parse(r.created_at) }))
-    },
-    async addGithubConnection ({ scope, scopeId, connectedBy, installationId = null }) {
-      await one(db.from('github_connections').upsert({ scope, scope_id: scopeId, connected_by: connectedBy, installation_id: installationId, created_at: new Date().toISOString() }, { onConflict: 'scope,scope_id,connected_by' }))
-    },
-    async removeGithubConnection ({ scope, scopeId, connectedBy }) { await one(db.from('github_connections').delete().eq('scope', scope).eq('scope_id', scopeId).eq('connected_by', connectedBy)) },
-    async workspaceGithub (workspaceId) {
-      const r = await one(db.from('workspace_github').select('access, repos, agent_commits').eq('workspace_id', workspaceId).maybeSingle())
-      return r ? { access: r.access, repos: r.repos || [], agentCommits: r.agent_commits || '' } : { access: 'open', repos: [], agentCommits: '' }
-    },
-    // Only what is given changes: { access, repos } and/or { agentCommits } ('' for each session to decide).
-    async setWorkspaceGithub (workspaceId, { access, repos, agentCommits }) {
-      const row = { workspace_id: workspaceId, updated_at: new Date().toISOString() }
-      if (access !== undefined) { row.access = access; row.repos = repos || [] }
-      if (agentCommits !== undefined) row.agent_commits = agentCommits || null
-      await one(db.from('workspace_github').upsert(row, { onConflict: 'workspace_id' }))
-    },
-    async teamGithub (teamId) {
-      const r = await one(db.from('team_github').select('agent_commits').eq('team_id', teamId).maybeSingle())
-      return { agentCommits: (r && r.agent_commits) || '' }
-    },
-    async setTeamGithub (teamId, { agentCommits }) {
-      await one(db.from('team_github').upsert({ team_id: teamId, agent_commits: agentCommits || null, updated_at: new Date().toISOString() }, { onConflict: 'team_id' }))
-    },
-    // The rules of the teams `memberId` is on: [{ teamId, name, agentCommits }], only those that set one.
-    async teamGitRules (memberId) {
-      const rows = await one(db.from('team_members').select('team_id, teams (name, team_github (agent_commits))').eq('member_id', memberId))
-      return rows.map((r) => {
-        const g = r.teams && r.teams.team_github
-        const mode = Array.isArray(g) ? (g[0] && g[0].agent_commits) : (g && g.agent_commits)
-        return mode ? { teamId: r.team_id, name: (r.teams && r.teams.name) || '', agentCommits: mode } : null
-      }).filter(Boolean)
-    },
-    async orgGithub (orgId) {
-      const r = await one(db.from('org_github').select('require_github, agent_commits').eq('org_id', orgId).maybeSingle())
-      return { requireGithub: !!(r && r.require_github), agentCommits: (r && r.agent_commits) || '' }
-    },
-    async setOrgGithub (orgId, { requireGithub, agentCommits }) {
-      const row = { org_id: orgId, updated_at: new Date().toISOString() }
-      if (requireGithub !== undefined) row.require_github = !!requireGithub
-      if (agentCommits !== undefined) row.agent_commits = agentCommits || null
-      await one(db.from('org_github').upsert(row, { onConflict: 'org_id' }))
-    },
     // The API's own settings (app_settings): a value it keeps across starts, such as the webhook secret it set on GitHub.
-    // One live session per repository and branch (git_sync_leases, through its locking functions).
-    async takeLease ({ repo, branch, room, holder = '', ttlMs }) { return await one(db.rpc('take_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_holder: holder, p_ttl_ms: ttlMs })) },
-    async heartbeatLease ({ repo, branch, room, generation, ttlMs }) { return await one(db.rpc('heartbeat_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_generation: generation, p_ttl_ms: ttlMs })) },
-    async releaseLease ({ repo, branch, room, generation }) { return await one(db.rpc('release_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_generation: generation })) },
+    // Relay leases (relay_leases, through its locking functions; 16 R2). `key`: the relay's name for what it holds.
+    // Before the migration that makes relay_leases is applied, a git branch's key ("<repo> <branch>") goes to the old functions.
+    async takeLease ({ key, room, holder = '', ttlMs }) { return await leaseRpc('take', key, { p_key: key, p_room: room, p_holder: holder, p_ttl_ms: ttlMs }, (repo, branch) => ({ p_repo: repo, p_branch: branch, p_room: room, p_holder: holder, p_ttl_ms: ttlMs })) },
+    async heartbeatLease ({ key, room, generation, ttlMs }) { return await leaseRpc('heartbeat', key, { p_key: key, p_room: room, p_generation: generation, p_ttl_ms: ttlMs }, (repo, branch) => ({ p_repo: repo, p_branch: branch, p_room: room, p_generation: generation, p_ttl_ms: ttlMs })) },
+    async releaseLease ({ key, room, generation }) { return await leaseRpc('release', key, { p_key: key, p_room: room, p_generation: generation }, (repo, branch) => ({ p_repo: repo, p_branch: branch, p_room: room, p_generation: generation })) },
     async getSetting (key) { const r = await one(db.from('app_settings').select('value').eq('key', key).maybeSingle()); return r ? r.value : null },
     async setSetting (key, value) { await one(db.from('app_settings').upsert({ key, value: String(value), updated_at: new Date().toISOString() }, { onConflict: 'key' })) },
     async setSettingIfAbsent (key, value) {
@@ -417,6 +374,36 @@ export function createSupabaseStore ({ url, serviceKey, client }) {
       return u ? { email: u.email || '', confirmed: !!u.email_confirmed_at } : null
     },
 
+    // Email notices (notify.js): kept on each account, so no table is needed. user_metadata.notify is what
+    // the person turned on (the website writes it); user_metadata.notify_sent what was sent already.
+    async notifyUsers () {
+      const out = []
+      for (let page = 1; page < 1000; page++) {
+        const { data, error } = await db.auth.admin.listUsers({ page, perPage: 1000 })
+        if (error) throw error
+        const list = data?.users || []
+        for (const u of list) {
+          const m = u.user_metadata || {}
+          if (u.email && u.email_confirmed_at && m.notify && typeof m.notify === 'object') out.push({ userId: u.id, email: u.email, notify: m.notify, sent: m.notify_sent || {} })
+        }
+        if (list.length < 1000) break
+      }
+      return out
+    },
+    async setNotifySent (userId, sent) {
+      const { data, error } = await db.auth.admin.getUserById(userId)
+      if (error) throw error
+      const meta = data?.user?.user_metadata || {}
+      const { error: e2 } = await db.auth.admin.updateUserById(userId, { user_metadata: { ...meta, notify_sent: sent } })
+      if (e2) throw e2
+    },
+
+    // A person's browser sign-ins (20261026235000_my_browser_sessions.sql), for signing out one at a time.
+    async authSessions (userId) {
+      return (await one(db.rpc('auth_sessions_of', { p_user: userId }))).map((r) => ({ id: r.id, createdAt: ms(r.created_at), lastActiveAt: ms(r.updated_at || r.created_at), userAgent: r.user_agent || '', ip: r.ip || '' }))
+    },
+    async endAuthSession (userId, id) { return !!(await one(db.rpc('end_auth_session', { p_user: userId, p_id: id }))) },
+
     // Session activity (see 20261002000000_session_activity.sql). Event times are epoch ms.
     async ingestPresence (events, receivedAt) {
       return await one(db.rpc('ingest_presence', { p_events: events, p_received_at: ts(receivedAt) }))