omni-notify-mcp 1.3.289 → 1.3.291

package/dist/agentGateway.js

@@ -15,6 +15,7 @@ import { masterMuted } from "./notify.js";
 import { appendEvent, cliOwns, CONVERSATION_MUTED_MESSAGE, conversationRefusal, editOwed, GatewayError, listConversations, monotonicMs, openConversationOf, openConversationsOf, queueNoticeOf, readEvents, resolveProject, routeAsk, stopTargetOf, sendToConversation, startConversation, updateConversation, } from "./gateway/conversations.js";
 import { SessionDriver } from "./gateway/sessionDriver.js";
 import { DEFAULT_PROVIDER } from "./gateway/provider.js";
+import { turnEnded } from "./gateway/mcpEvents.js";
 export const AGENT_PREFIX = "!";
 /** A chat door's own words when a message points at a browser CLI console session: the chat does not drive a live CLI, so it says so plainly and names where that session IS reachable. */
 const CONSOLE_NOT_IN_CHAT = "That is a live CLI console session opened in the browser — this chat does not type into it. Use /terminal in BN, or reach the SAME session from MCP/REST by its id (agent_send types into it, agent_stream streams its console).";
@@ -77,6 +78,7 @@ export class AgentGateway {
     constructor(driver) {
         this.driver = driver;
         driver.onEvent((event) => this.deliver(event));
+        driver.onEvent(turnEnded);
     }
     registerDoor(platform, door) {
         this.doors.set(platform, door);

package/dist/gateway/conversations.js

@@ -42,9 +42,12 @@ export function monotonicMs() {
 /** Thrown for a request the caller got wrong; the door turns it into the status code. */
 export class GatewayError extends Error {
     status;
-    constructor(status, message) {
+    facts;
+    /** `facts` ride beside the words in the refusal's body, so a caller acts on what was refused without parsing the message. */
+    constructor(status, message, facts = {}) {
         super(message);
         this.status = status;
+        this.facts = facts;
     }
 }
 /** The service's own store for the agent-conversation On/Off switch, beside config.json in the config dir: BN's page flips it, this process reads it, and BullseyeSync carries it to every machine. */
@@ -113,9 +116,11 @@ function dropStaged(staged) {
  * its caller told, and the staged file of a write that is given up is removed.
  */
 function writeMeta(meta) {
-    const final = metaPath(meta.id);
+    writeRecordFile(metaPath(meta.id), JSON.stringify(meta, null, 2));
+}
+/** Writes one store file of the agent dir the way a record is written: staged beside itself and renamed over the old one, a refused rename tried again. */
+export function writeRecordFile(final, text) {
     const staged = `${final}.${process.pid}.tmp`;
-    const text = JSON.stringify(meta, null, 2);
     for (let attempt = 0;; attempt++) {
         try {
             writeFileSync(staged, text);

package/dist/gateway/mcpDoor.js

@@ -24,6 +24,7 @@ import { grantClient, publicBase } from "./oauthDoor.js";
 import { bearer, personId, sessionSignIn, tokenProves } from "./passkeyDoor.js";
 import { consoleSession } from "./nativeTerminal.js";
 import { agentStreamFor } from "./agentStream.js";
+import { EVENTS_CAPABILITY, serveEvents } from "./mcpEvents.js";
 import { PACKAGE_VERSION, readGatewaySettings } from "../notify.js";
 const answer = (value) => ({ content: [{ type: "text", text: JSON.stringify(value) }] });
 /** A refused act is the tool's own error result, never a protocol failure, so the calling agent can read why. */
@@ -128,7 +129,8 @@ async function consoleRead(live, after, wait) {
 }
 function buildServer(caller, base) {
     built += 1;
-    const server = new McpServer({ name: "notify-agent-gateway", version: PACKAGE_VERSION, icons: iconsFor(base) }, { instructions: INSTRUCTIONS });
+    const server = new McpServer({ name: "notify-agent-gateway", version: PACKAGE_VERSION, icons: iconsFor(base) }, { instructions: INSTRUCTIONS, capabilities: EVENTS_CAPABILITY });
+    serveEvents(server.server, caller);
     server.tool("agent_prompt", `Runs a request on this machine's own Claude Code agent — with the user's files, git repositories, shell and MCP servers — and returns the agent's answer. Each call goes on with the same agent as this connection's previous call, so the agent keeps what it already knows (a stopped one resumes); with no conversation named, new=true starts a fresh agent, and so does an ask that does not point at the work already under way while that agent is busy and is not waiting on an answer. Waits up to ${MAX_WAIT_SECONDS} seconds: the answer comes back in this call, or working=true with the id and position to read on with agent_wait. It is the convenience send-and-wait for a request expected to finish within about a minute; for a long or autonomous task use agent_start and then agent_wait, which do not hold a call open while the agent works. A call that returned working=true or timed out was received and is still running: read on with agent_wait, and do not call agent_prompt again with the same text, which would submit the task a second time. The result carries the ending event's timing, in which a reply's time is three separate figures rather than one number: bnMs, the end-to-end elapsed time from the request arriving at BN's door to the answer being stored; queuedMs (beside queued, whether it stood in line at all — false is the store's own statement that it never stood in line, absent is unmeasured), the part of it the message waited for a free slot or the turn ahead; and agentMs, the part the agent itself worked. totalMs is BN's own total from the message being stored to the answer being stored, never the agent's time, and rows carries the turn layer by layer. It also carries waitedMs, the milliseconds this call itself held on BN's own clock. When the id names a CLI console session (a full CLI opened in the browser and mirrored at /terminal), the text is typed into that SAME live CLI and the call returns at once with {console:true, sent:true, stream, after} — there is no turn to wait on, so read the CLI's answer with agent_wait or agent_stream_read at that after, or attach to stream.`, {
         text: z.string().min(1).describe("The user's request, as the user wrote it"),
         conversation: z.string().min(1).optional().describe("A 'conversation' id an earlier agent_prompt returned, to address that agent; without it the call goes on with this connection's current agent"),

package/dist/gateway/mcpEvents.js

@@ -0,0 +1,390 @@
+/**
+ * MCP Events on the MCP door (#3666): the host path OpenAI documents for waking a ChatGPT chat when work it dispatched
+ * ends (developers.openai.com/plugins/build/mcp-events). The door advertises `capabilities.events` and answers
+ * `events/list`, `events/subscribe` and `events/unsubscribe`; a subscription to `agent.turn_completed` names one
+ * conversation the subscribing connection itself started, and when a turn of it answers or fails BN POSTs one
+ * Standard-Webhooks-signed event to the callback, which ChatGPT acts on in the subscribed chat.
+ *
+ * Subscriptions are kept in one store file beside the conversations (`<config dir>/agent/event-subscriptions.json`), so
+ * a BN restart keeps them. A callback is HTTPS only, every address its host resolves to must be public, the connection
+ * is made to the address that was checked, and a redirect is never followed — the verification challenge included.
+ */
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+import { lookup } from "dns/promises";
+import { existsSync, readFileSync } from "fs";
+import { request } from "https";
+import { BlockList, isIP } from "net";
+import { join } from "path";
+import { z } from "zod";
+import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
+import { agentDir, GatewayError, readConversation, requireConversationEnabled, writeRecordFile } from "./conversations.js";
+/** What the door adds to the capabilities its initialize answers: `events`, a key the SDK's capability type does not name. */
+export const EVENTS_CAPABILITY = { events: {} };
+const TURN_COMPLETED = "agent.turn_completed";
+const EVENT_DEFINITION = {
+    name: TURN_COMPLETED,
+    description: "A turn of a BN agent conversation ended: the agent answered it or it failed. conversation_id is a conversation this connection opened with agent_start, agent_open or agent_prompt.",
+    delivery: ["webhook"],
+    inputSchema: {
+        type: "object",
+        properties: { conversation_id: { type: "string" } },
+        required: ["conversation_id"],
+        additionalProperties: false,
+    },
+    payloadSchema: {
+        type: "object",
+        properties: {
+            conversation_id: { type: "string" },
+            turn: { type: "integer" },
+            outcome: { type: "string", enum: ["answered", "failed"] },
+            text: { type: "string" },
+            text_truncated: { type: "boolean", description: "true when text was cut to fit one event; agent_wait reads it whole" },
+            ended_at: { type: "string", format: "date-time" },
+        },
+        required: ["conversation_id", "turn", "outcome", "text", "text_truncated", "ended_at"],
+        additionalProperties: false,
+    },
+};
+/** The documented JSON-RPC error for a callback that could not be verified or reached. */
+const CALLBACK_ENDPOINT_ERROR = -32015;
+// GATE: one event request is at most 256 KiB, the documented limit; a longer answer is cut so the body fits and is marked text_truncated.
+const MAX_EVENT_BYTES = 262_144;
+// GATE: a callback request is over within 10 s of its start, the documented sample client's timeout; one still open then is cut and is a timeout.
+const CALLBACK_TIMEOUT_MS = 10_000;
+// GATE: an event is tried at most 5 times, waiting 1, 2, 4 and 8 s between tries, when the callback's failure is transient (network, timeout, 408, 429, 5xx).
+const DELIVERY_TRIES = 5;
+const DELIVERY_FIRST_WAIT_MS = 1_000;
+// GATE: a callback's answer is read up to 64 KiB; the challenge echo is all that is ever read from it.
+const MAX_REPLY_BYTES = 65_536;
+/** A callback that cannot be used, with the documented reason category. */
+class CallbackFailure extends Error {
+    reason;
+    constructor(reason, detail) {
+        super(detail);
+        this.reason = reason;
+    }
+}
+const storePath = () => join(agentDir(), "event-subscriptions.json");
+function storedSubscriptions() {
+    if (!existsSync(storePath()))
+        return [];
+    return JSON.parse(readFileSync(storePath(), "utf8")).subscriptions;
+}
+/** The subscriptions whose granted lifetime has not passed. */
+function liveSubscriptions(now = Date.now()) {
+    return storedSubscriptions().filter((s) => s.refreshBefore === null || Date.parse(s.refreshBefore) > now);
+}
+/** Rewrites the store from the live subscriptions with `change` applied, so an expired one leaves it on the next write. */
+function editStore(change) {
+    writeRecordFile(storePath(), JSON.stringify({ subscriptions: change(liveSubscriptions()) }, null, 2));
+}
+const invalid = (message) => new McpError(ErrorCode.InvalidParams, message);
+/** Arguments compared as canonical JSON, so key order never makes two subscriptions of one identity. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value !== null && typeof value === "object")
+        return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}`;
+    return JSON.stringify(value);
+}
+/** The deterministic subscription id: the principal, the callback URL, the event name and the canonical arguments. */
+function subscriptionId(principal, url, name, args) {
+    return `sub_${createHash("sha256").update([principal, url, name, canonical(args)].join("\n")).digest("hex").slice(0, 32)}`;
+}
+function eventNamed(name) {
+    if (name !== TURN_COMPLETED)
+        throw invalid(`no event named ${JSON.stringify(name)}: this server offers ${TURN_COMPLETED}`);
+}
+const ArgumentsSchema = z.object({ conversation_id: z.string().min(1) }).strict();
+function argumentsOf(value) {
+    const parsed = ArgumentsSchema.safeParse(value);
+    if (!parsed.success)
+        throw invalid(`arguments must be exactly {conversation_id: string}: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
+    return parsed.data;
+}
+/** The conversation is one this connection itself started; any other, or one that does not exist, is refused alike. */
+function requireOwned(principal, conversationId) {
+    let owner;
+    try {
+        const meta = readConversation(conversationId);
+        owner = meta.shelf === "deleted" ? undefined : meta.chat;
+    }
+    catch (err) {
+        if (!(err instanceof GatewayError) || err.status !== 404)
+            throw err;
+        owner = undefined;
+    }
+    if (owner !== principal)
+        throw invalid(`no conversation ${conversationId} was started by this connection`);
+}
+const DeliverySchema = z.object({ mode: z.literal("webhook"), url: z.string().min(1) }).passthrough();
+function deliveryOf(value) {
+    const parsed = DeliverySchema.safeParse(value);
+    if (!parsed.success)
+        throw invalid("delivery must be {mode: \"webhook\", url, secret}");
+    return { url: parsed.data.url, secret: parsed.data.secret };
+}
+/** The signing key a `whsec_` secret carries: base64 decoding to 24 to 64 bytes. */
+function signingKey(secret) {
+    if (typeof secret !== "string" || !secret.startsWith("whsec_"))
+        throw invalid("delivery.secret must start with whsec_");
+    const encoded = secret.slice("whsec_".length);
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 !== 0)
+        throw invalid("delivery.secret must be whsec_ followed by base64");
+    const key = Buffer.from(encoded, "base64");
+    if (key.length < 24 || key.length > 64)
+        throw invalid(`delivery.secret decodes to ${key.length} bytes; 24 to 64 are accepted`);
+    return key;
+}
+/** Standard Webhooks headers for one attempt: the id, the signing time, and v1 HMAC-SHA256 over `id.timestamp.body`. */
+function signedHeaders(key, id, body, subscription) {
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const signature = createHmac("sha256", key).update(`${id}.${timestamp}.`).update(body).digest("base64");
+    return { "content-type": "application/json", "webhook-id": id, "webhook-timestamp": timestamp, "webhook-signature": `v1,${signature}`, "x-mcp-subscription-id": subscription };
+}
+// GATE: loopback callbacks and one extra trusted CA are honoured ONLY under NOTIFY_MCP_TEST_ENDPOINTS=1 with NOTIFY_EVENTS_TEST_LOOPBACK=1 and NOTIFY_EVENTS_TEST_CA; without them every loopback address is refused and only the system's CAs are trusted.
+const TEST_LOOPBACK = process.env.NOTIFY_MCP_TEST_ENDPOINTS === "1" && process.env.NOTIFY_EVENTS_TEST_LOOPBACK === "1";
+const TEST_CA = process.env.NOTIFY_MCP_TEST_ENDPOINTS === "1" && process.env.NOTIFY_EVENTS_TEST_CA ? readFileSync(process.env.NOTIFY_EVENTS_TEST_CA, "utf8") : undefined;
+/** Every address that is not on the public internet: private, loopback, link-local, shared, documentation, benchmark, multicast, reserved, and the IPv6 translation forms. No ::ffff:0:0/96 rule: a BlockList judges an IPv4-mapped address by the IPv4 rules itself, and that rule would match every IPv4 address. */
+const NON_PUBLIC = (() => {
+    const list = new BlockList();
+    const v4 = [["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24], ["192.88.99.0", 24], ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24], ["203.0.113.0", 24], ["224.0.0.0", 4], ["240.0.0.0", 4]];
+    const v6 = [["::", 128], ["64:ff9b::", 96], ["64:ff9b:1::", 48], ["100::", 64], ["2001::", 23], ["2001:db8::", 32], ["2002::", 16], ["fc00::", 7], ["fe80::", 10], ["ff00::", 8]];
+    if (!TEST_LOOPBACK) {
+        v4.push(["127.0.0.0", 8]);
+        v6.push(["::1", 128]);
+    }
+    for (const [net, prefix] of v4)
+        list.addSubnet(net, prefix, "ipv4");
+    for (const [net, prefix] of v6)
+        list.addSubnet(net, prefix, "ipv6");
+    return list;
+})();
+/** Checks a callback URL at the moment of use: HTTPS, no credentials, and every address its host resolves to public. */
+async function callbackTarget(raw) {
+    if (!URL.canParse(raw))
+        throw new CallbackFailure("invalid_url", "the callback is not a URL");
+    const url = new URL(raw);
+    if (url.protocol !== "https:")
+        throw new CallbackFailure("not_https", "the callback must be an https URL");
+    if (url.username !== "" || url.password !== "")
+        throw new CallbackFailure("invalid_url", "the callback URL must carry no credentials");
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const literal = isIP(host);
+    let addresses;
+    if (literal !== 0)
+        addresses = [{ address: host, family: literal }];
+    else {
+        try {
+            addresses = await lookup(host, { all: true, verbatim: true });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "ENOTFOUND" && code !== "ENODATA" && code !== "EAI_AGAIN" && code !== "ESERVFAIL")
+                throw err;
+            throw new CallbackFailure("unresolvable", `the callback host ${host} does not resolve (${code})`);
+        }
+    }
+    const refused = addresses.find((a) => NON_PUBLIC.check(a.address, a.family === 6 ? "ipv6" : "ipv4"));
+    // NULL-OK: field refused is OPTIONAL and therefore it is ok to check for NULL
+    if (refused !== undefined)
+        throw new CallbackFailure("non_public_address", `the callback host ${host} resolves to ${refused.address}, which is not a public address`);
+    const [first] = addresses;
+    return { url, host, address: first.address, family: first.family === 6 ? 6 : 4 };
+}
+/** One POST to the checked address with no redirect followed: the status and up to MAX_REPLY_BYTES of the answer. */
+function post(target, headers, body) {
+    const pinned = (_host, options, done) => {
+        if (options.all === true)
+            done(null, [{ address: target.address, family: target.family }]);
+        else
+            done(null, target.address, target.family);
+    };
+    return new Promise((resolve, reject) => {
+        const req = request({
+            host: target.host,
+            port: target.url.port === "" ? 443 : Number(target.url.port),
+            path: `${target.url.pathname}${target.url.search}`,
+            method: "POST",
+            agent: false,
+            lookup: pinned,
+            servername: isIP(target.host) === 0 ? target.host : undefined,
+            ca: TEST_CA,
+            headers: { ...headers, "content-length": String(body.length) },
+        }, (res) => {
+            const chunks = [];
+            let size = 0;
+            res.on("data", (chunk) => {
+                if (size < MAX_REPLY_BYTES)
+                    chunks.push(chunk);
+                size += chunk.length;
+            });
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, text: Buffer.concat(chunks).subarray(0, MAX_REPLY_BYTES).toString("utf8") }));
+            res.on("error", (err) => reject(err instanceof CallbackFailure ? err : new CallbackFailure("unreachable", `the callback's answer broke off: ${err.code ?? err.message}`)));
+        });
+        const deadline = setTimeout(() => req.destroy(new CallbackFailure("timeout", `the callback did not finish answering within ${CALLBACK_TIMEOUT_MS / 1000} s`)), CALLBACK_TIMEOUT_MS);
+        req.on("close", () => clearTimeout(deadline));
+        req.on("error", (err) => reject(err instanceof CallbackFailure ? err : new CallbackFailure("unreachable", `the callback could not be reached: ${err.code ?? err.message}`)));
+        req.end(body);
+    });
+}
+/** The challenge the callback echoed: a JSON body's `challenge`, else the body's text. */
+function echoOf(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed !== null && typeof parsed === "object" && typeof parsed.challenge === "string")
+            return parsed.challenge;
+        if (typeof parsed === "string")
+            return parsed;
+    }
+    catch (err) {
+        if (!(err instanceof SyntaxError))
+            throw err;
+    }
+    return text.trim();
+}
+function sameText(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+/** Sends the signed single-use challenge and accepts the callback only when a 2xx answer echoes it. */
+async function verifyCallback(target, key, subscription) {
+    const challenge = randomBytes(32).toString("base64url");
+    const body = Buffer.from(JSON.stringify({ type: "verification", challenge }));
+    const reply = await post(target, signedHeaders(key, `msg_verification_${randomUUID()}`, body, subscription), body);
+    if (reply.status >= 300 && reply.status < 400)
+        throw new CallbackFailure("redirect", `the callback answered the challenge with a redirect (HTTP ${reply.status}), which is never followed`);
+    if (reply.status < 200 || reply.status >= 300)
+        throw new CallbackFailure("challenge_failed", `the callback answered the challenge with HTTP ${reply.status}`);
+    if (!sameText(echoOf(reply.text), challenge))
+        throw new CallbackFailure("challenge_failed", "the callback's answer did not echo the challenge");
+}
+/** The lifetime granted: exactly the ttlMs asked for, and no expiry when ttlMs is null or not sent. */
+function grantedRefreshBefore(ttlMs) {
+    // NULL-OK: field ttlMs is OPTIONAL and therefore it is ok to check for NULL
+    if (ttlMs === undefined || ttlMs === null)
+        return null;
+    if (typeof ttlMs !== "number" || !Number.isFinite(ttlMs) || ttlMs < 0)
+        throw invalid("ttlMs must be a non-negative number, or null for no expiry");
+    const expiry = new Date(Date.now() + ttlMs);
+    if (Number.isNaN(expiry.getTime()))
+        throw invalid(`ttlMs ${ttlMs} is past the last date a timestamp can hold; send null for no expiry`);
+    return expiry.toISOString();
+}
+async function subscribe(principal, params) {
+    requireConversationEnabledAsMcp();
+    eventNamed(params.name);
+    const args = argumentsOf(params.arguments);
+    requireOwned(principal, args.conversation_id);
+    const delivery = deliveryOf(params.delivery);
+    const key = signingKey(delivery.secret);
+    const id = subscriptionId(principal, delivery.url, TURN_COMPLETED, args);
+    const refreshBefore = grantedRefreshBefore(params.ttlMs);
+    try {
+        await verifyCallback(await callbackTarget(delivery.url), key, id);
+    }
+    catch (err) {
+        if (!(err instanceof CallbackFailure))
+            throw err;
+        throw new McpError(CALLBACK_ENDPOINT_ERROR, err.message, { reason: err.reason });
+    }
+    const subscription = { id, principal, name: TURN_COMPLETED, arguments: args, url: delivery.url, secret: delivery.secret, refreshBefore };
+    editStore((live) => [...live.filter((s) => s.id !== id), subscription]);
+    process.stderr.write(`[agent-gateway] mcp events subscribed ${id} conv=${args.conversation_id} refreshBefore=${refreshBefore ?? "none"}\n`);
+    return { id, refreshBefore, cursor: null, truncated: false };
+}
+function unsubscribe(principal, params) {
+    eventNamed(params.name);
+    const args = argumentsOf(params.arguments);
+    const { url } = deliveryOf(params.delivery);
+    const id = subscriptionId(principal, url, TURN_COMPLETED, args);
+    editStore((live) => live.filter((s) => s.id !== id));
+    return {};
+}
+/** The conversation switch refuses a new subscription as it refuses a tool call, in the switch's own words. */
+function requireConversationEnabledAsMcp() {
+    try {
+        requireConversationEnabled();
+    }
+    catch (err) {
+        if (!(err instanceof GatewayError))
+            throw err;
+        throw new McpError(ErrorCode.InvalidRequest, err.message);
+    }
+}
+const ListRequest = z.object({ method: z.literal("events/list"), params: z.object({}).passthrough().optional() });
+const SubscribeRequest = z.object({ method: z.literal("events/subscribe"), params: z.object({}).passthrough() });
+const UnsubscribeRequest = z.object({ method: z.literal("events/unsubscribe"), params: z.object({}).passthrough() });
+/** Puts the three event methods on a door server, for the connection `principal` names. */
+export function serveEvents(server, principal) {
+    server.setRequestHandler(ListRequest, () => ({ events: [EVENT_DEFINITION] }));
+    server.setRequestHandler(SubscribeRequest, (req) => subscribe(principal, req.params));
+    server.setRequestHandler(UnsubscribeRequest, (req) => unsubscribe(principal, req.params));
+}
+/** The event body, serialized once: the answer is cut, and marked, only as far as the 256 KiB limit needs. */
+function eventBody(eventId, event) {
+    let text = event.text;
+    for (;;) {
+        const data = { conversation_id: event.id, turn: event.turn, outcome: event.kind === "answer" ? "answered" : "failed", text, text_truncated: text.length < event.text.length, ended_at: event.ts };
+        const body = Buffer.from(JSON.stringify({ eventId, name: TURN_COMPLETED, timestamp: event.ts, data, cursor: null }));
+        if (body.length <= MAX_EVENT_BYTES)
+            return body;
+        text = text.slice(0, Math.max(0, text.length - (body.length - MAX_EVENT_BYTES) - 64));
+    }
+}
+const logDelivery = (eventId, subscription, what) => {
+    const line = `[agent-gateway] mcp event ${eventId} sub=${subscription.id} conv=${subscription.arguments.conversation_id} ${what}`;
+    process.stderr.write(`${line.length > 200 ? `${line.slice(0, 197)}...` : line}\n`);
+};
+/** Retriable: a host that did not resolve, a callback not reached or not answering in time, 408, 429 and 5xx. A refused address and every other status are the last word on this event. */
+const TRANSIENT_FAILURES = new Set(["unresolvable", "unreachable", "timeout"]);
+const transient = (outcome) => (typeof outcome === "number" ? outcome === 408 || outcome === 429 || outcome >= 500 : TRANSIENT_FAILURES.has(outcome.reason));
+/** One try: the callback's HTTP status, or why no status came back. */
+async function attemptDelivery(subscription, key, eventId, body) {
+    try {
+        return (await post(await callbackTarget(subscription.url), signedHeaders(key, eventId, body, subscription.id), body)).status;
+    }
+    catch (err) {
+        if (!(err instanceof CallbackFailure))
+            throw err;
+        return err;
+    }
+}
+/** Posts one event to one subscription, the same body and id on every try with a fresh signature, until it lands or a final answer comes. */
+async function deliver(subscription, event) {
+    const eventId = `evt_${createHash("sha256").update(`${subscription.id}\n${event.id}\n${event.turn}`).digest("hex").slice(0, 32)}`;
+    const body = eventBody(eventId, event);
+    const key = signingKey(subscription.secret);
+    for (let attempt = 1;; attempt++) {
+        const outcome = await attemptDelivery(subscription, key, eventId, body);
+        if (typeof outcome === "number" && outcome >= 200 && outcome < 300)
+            return logDelivery(eventId, subscription, `delivered HTTP ${outcome} on try ${attempt}`);
+        if (outcome === 410) {
+            editStore((live) => live.filter((s) => s.id !== subscription.id));
+            return logDelivery(eventId, subscription, "the callback answered 410 Gone: the subscription is removed");
+        }
+        const answered = typeof outcome === "number" ? `HTTP ${outcome}` : `${outcome.reason}: ${outcome.message}`;
+        if (!transient(outcome))
+            return logDelivery(eventId, subscription, `refused by the callback (${answered}) on try ${attempt}; not retried`);
+        if (attempt === DELIVERY_TRIES)
+            return logDelivery(eventId, subscription, `not delivered after ${attempt} tries, last ${answered}`);
+        await new Promise((r) => setTimeout(r, DELIVERY_FIRST_WAIT_MS << (attempt - 1)));
+    }
+}
+/** Reads the live subscriptions of the turn's conversation and delivers to each, after the session driver's own emit has returned. */
+async function reportTurn(event) {
+    await Promise.resolve();
+    for (const subscription of liveSubscriptions().filter((s) => s.arguments.conversation_id === event.id)) {
+        // OWNER: each delivery runs on its own and nothing awaits it — a failure no retry clears is written to the console with its event's conversation, turn and subscription.
+        void deliver(subscription, event).catch((err) => logDelivery(`turn=${event.turn}`, subscription, `not delivered: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+/** The session driver's listener: a turn that answered or failed is reported to every live subscription of its conversation. */
+export function turnEnded(event) {
+    // NULL-OK: field turn is OPTIONAL and therefore it is ok to check for NULL
+    if (event.turn === undefined || (event.kind !== "answer" && event.kind !== "failed"))
+        return;
+    // OWNER: the report runs on its own after the turn is stored and nothing awaits it — a store that cannot be read is written to the console with the conversation and turn.
+    void reportTurn(event).catch((err) => process.stderr.write(`[agent-gateway] mcp events for conv=${event.id} turn=${event.turn} not reported: ${err instanceof Error ? err.message : String(err)}\n`));
+}

package/dist/gateway/nativeTerminal.js

@@ -372,7 +372,7 @@ export function attachNativeTerminal(owner, spec) {
     const turn = turnInFlight(readEvents(meta.id), meta);
     // NULL-OK: field turn is OPTIONAL and therefore it is ok to check for NULL
     if (turn !== undefined)
-        throw new GatewayError(409, `Turn ${turn.turn} is ${turn.started ? "running" : "waiting to start"} since ${clockOf(turn.startedAt)} on this conversation, so a CLI cannot attach: an agent is already working its session, and a second one on the same session would be two agents on one job. Wait for that turn to end.`);
+        throw new GatewayError(409, `Turn ${turn.turn} is ${turn.started ? "running" : "waiting to start"} since ${clockOf(turn.startedAt)} on this conversation, so a CLI cannot attach: an agent is already working its session, and a second one on the same session would be two agents on one job. Wait for that turn to end.`, { turn: turn.turn });
     const native = spec.provider.nativeSession;
     if (native === undefined)
         throw new GatewayError(409, `${spec.provider.label} keeps no resumable session, so a browser CLI cannot run this conversation's own session — BN's turn driver answers its messages.`);

package/dist/gateway/restDoor.js

@@ -285,7 +285,7 @@ export function startRestDoor(settings) {
                     return;
                 }
                 if (err instanceof GatewayError) {
-                    reply(res, err.status, { error: err.message });
+                    reply(res, err.status, { ...err.facts, error: err.message });
                     return;
                 }
                 process.stderr.write(`[agent-gateway] ${req.method} ${req.url} failed: ${err instanceof Error ? err.message : String(err)}\n`);

package/dist/gateway/terminalPage.js

@@ -96,7 +96,7 @@ function show(name,heading){
   return view;
 }
 
-async function api(method,path,body,signal){var response=await fetch(path,{method:method,headers:{authorization:"Bearer "+token,"content-type":"application/json"},body:body===undefined?undefined:JSON.stringify(body),signal:signal});var data=await response.json();if(!response.ok){if(response.status===401)signIn("Sign in again to reach your CLI.");var error=Error(data.error||"Request failed");error.status=response.status;throw error;}return data;}
+async function api(method,path,body,signal){var response=await fetch(path,{method:method,headers:{authorization:"Bearer "+token,"content-type":"application/json"},body:body===undefined?undefined:JSON.stringify(body),signal:signal});var data=await response.json();if(!response.ok){if(response.status===401)signIn("Sign in again to reach your CLI.");var error=Error(data.error||"Request failed");error.status=response.status;error.turn=data.turn;throw error;}return data;}
 function fail(error){note.textContent=error.message;}
 function ordered(id,act,body){if(!socket||socket.readyState!==WebSocket.OPEN)return;socket.send(JSON.stringify(Object.assign({kind:act},body)));}
 /** The last folder of a path, so a row names its project without printing the whole path. */
@@ -156,9 +156,48 @@ async function openCli(meta){
   }catch(error){
     if(mine!==view)return;
     if(error.status===404)return goneView(meta);
+    if(error.status===409&&error.turn!==undefined)return turnMirror(meta,error.turn);
     goneView(meta,error.message);
   }
 }
+/** A conversation whose turn is still running opens on that turn's own live output, drawn in the terminal pane (#3662):
+ * a turn started over MCP runs its CLI headless, so there is no terminal to attach to until it ends, and a second CLI on
+ * the same session would be two agents on one job. The moment that turn ends, openCli runs again and attaches the
+ * native CLI of this SAME session — its prompt, its history, its slash commands — with no second agent and nothing stopped. */
+function turnMirror(meta,turn){
+  var mine=show("terminal","Native CLI · "+meta.id),toolbar=el("div","setup"),back=el("button","","↩ Back"),host=el("div");host.id="terminal";
+  main.style.display="flex";main.style.flexDirection="column";host.style.flex="1";host.style.minHeight="0";
+  toolbar.append(back,el("span","origin",originOf(meta)));main.append(toolbar,host);
+  var term=new Terminal({disableStdin:true,theme:{background:"#101217"},allowProposedApi:true}),fit=new FitAddon.FitAddon();
+  term.loadAddon(fit);term.loadAddon(new Unicode11Addon.Unicode11Addon());term.unicode.activeVersion="11";term.open(host);fit.fit();
+  var resized=new ResizeObserver(function(){fit.fit();});resized.observe(host);
+  var reading=new AbortController();
+  stopStream=function(){reading.abort();resized.disconnect();term.dispose();};
+  back.onclick=goBack;
+  note.textContent="Turn "+turn+" is running — its live output is shown here, and this session's native CLI opens here the moment it ends.";
+  var STYLE={thinking:"\\x1b[2;3m",doing:"\\x1b[36m⏺ ",turn:"\\x1b[1m",output:""};
+  function draw(frame){term.write((STYLE[frame.kind]||"")+String(frame.text).replace(/\\r?\\n/g,"\\r\\n")+"\\x1b[0m\\r\\n");}
+  function ends(frame){return frame.kind==="turn"&&frame.turn===turn&&(frame.event==="answer"||frame.event==="failed"||frame.event==="stopped");}
+  (async function(){
+    var response=await fetch("/v1/conversations/"+meta.id+"/stream",{headers:{authorization:"Bearer "+token},signal:reading.signal});
+    if(!response.ok)throw Error((await response.json()).error||"The live output could not be read.");
+    var reader=response.body.getReader(),decoder=new TextDecoder(),pending="";
+    for(;;){
+      var chunk=await reader.read();
+      if(chunk.done||mine!==view)return;
+      pending+=decoder.decode(chunk.value,{stream:true});
+      var blocks=pending.split("\\n\\n");pending=blocks.pop();
+      for(var block of blocks){
+        if(block.indexOf("data: ")!==0)continue;
+        var frame=JSON.parse(block.slice(6));draw(frame);
+        if(!ends(frame))continue;
+        var fresh=await api("GET","/v1/conversations/"+meta.id);
+        if(mine===view)openCli(fresh);
+        return;
+      }
+    }
+  })().catch(function(error){if(mine===view&&error.name!=="AbortError")note.textContent="The live output stopped: "+error.message;});
+}
 /** A conversation whose CLI is not there and cannot be opened right now, in plain words: the reason is the refusal when
  * the attach was tried and said no, and absent when the CLI this machine held for it is simply gone — it ended, or BN
  * was restarted past it (terminalDoor closes every console session as the gateway comes up). Its screen was never

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omni-notify-mcp",
-  "version": "1.3.289",
+  "version": "1.3.291",
   "description": "Reach your AI agents from anywhere — and let them reach you. One stdio process serves the whole tool surface to Claude Code, GitHub Copilot Chat and Codex: desktop, Telegram, Slack, ntfy, Discord, Teams and SMS are configured in one file, and agents notify you when long work finishes or a decision is needed, ask you a question and wait for your answer, and receive and reply to the messages you send them — with Do Not Disturb and idle detection deciding what actually gets through.",
   "main": "dist/index.js",
   "type": "module",
@@ -42,13 +42,14 @@
   },
   "devDependencies": {
     "@types/mailparser": "^3.4.6",
-    "esbuild": "^0.24.0",
     "@types/node": "^20.0.0",
     "@types/node-notifier": "^8.0.5",
     "@types/nodemailer": "^7.0.2",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",
+    "esbuild": "^0.24.0",
     "playwright": "^1.59.1",
+    "standardwebhooks": "^1.0.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.0"
   },