shadow-claw 1.27.0 → 1.28.0

package/src/subsystems/notifications/push-client.test.ts

@@ -53,6 +53,7 @@ const {
   unsubscribeFromPush,
   getCurrentSubscription,
   urlBase64ToUint8Array,
+  getPushFetchOptions,
 } = await import("./push-client.js");
 
 describe("push-client", () => {
@@ -62,6 +63,60 @@ describe("push-client", () => {
     mockPushManager.getSubscription.mockResolvedValue(null);
   });
 
+  describe("getPushFetchOptions", () => {
+    it("sets targetAddressSpace loopback for localhost", () => {
+      expect(
+        getPushFetchOptions("http://localhost:8888/push/vapid-public-key"),
+      ).toEqual({
+        targetAddressSpace: "loopback",
+      });
+      expect(
+        getPushFetchOptions("http://127.0.0.1:8888/push/vapid-public-key"),
+      ).toEqual({
+        targetAddressSpace: "loopback",
+      });
+    });
+
+    it("sets targetAddressSpace private for private IP addresses", () => {
+      expect(
+        getPushFetchOptions("https://10.9.8.226:8888/push/vapid-public-key"),
+      ).toEqual({
+        targetAddressSpace: "private",
+      });
+      expect(
+        getPushFetchOptions("https://192.168.1.50:8888/push/vapid-public-key"),
+      ).toEqual({
+        targetAddressSpace: "private",
+      });
+    });
+
+    it("sets targetAddressSpace private for local single-label hostnames and .local domains", () => {
+      expect(
+        getPushFetchOptions("https://hostname:8888/push/vapid-public-key"),
+      ).toEqual({
+        targetAddressSpace: "private",
+      });
+      expect(
+        getPushFetchOptions(
+          "https://hostname.local:8888/push/vapid-public-key",
+        ),
+      ).toEqual({
+        targetAddressSpace: "private",
+      });
+      expect(
+        getPushFetchOptions("https://my-nas.lan:8888/push/vapid-public-key"),
+      ).toEqual({
+        targetAddressSpace: "private",
+      });
+    });
+
+    it("does not set targetAddressSpace for public domains", () => {
+      expect(
+        getPushFetchOptions("https://example.com/push/vapid-public-key"),
+      ).toEqual({});
+    });
+  });
+
   describe("urlBase64ToUint8Array", () => {
     it("converts a URL-safe base64 string to Uint8Array", () => {
       // "AQAB" in standard base64 = [1, 0, 1]
@@ -117,6 +172,21 @@ describe("push-client", () => {
       expect(postCall[1].method).toBe("POST");
       expect(postCall[1].targetAddressSpace).toBe("loopback");
     });
+
+    it("includes clientId and deviceLabel in the request body", async () => {
+      (fetch as any)
+        .mockResolvedValueOnce({
+          ok: true,
+          json: () => Promise.resolve({ publicKey: "test-vapid-key" }),
+        })
+        .mockResolvedValueOnce({ ok: true });
+
+      await subscribeToPush("client-explicit-123", "Pixel 9 Pro");
+      const postCall = (fetch as any).mock.calls[1];
+      const body = JSON.parse(postCall[1].body);
+      expect(body.clientId).toBe("client-explicit-123");
+      expect(body.deviceLabel).toBe("Pixel 9 Pro");
+    });
   });
 
   describe("unsubscribeFromPush", () => {

package/src/subsystems/notifications/push-client.ts

@@ -53,7 +53,14 @@ export function getPushFetchOptions(
       host === "[::1]"
     ) {
       opts.targetAddressSpace = "loopback";
-    } else if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host)) {
+    } else if (
+      /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host) ||
+      !host.includes(".") ||
+      host.endsWith(".local") ||
+      host.endsWith(".lan") ||
+      host.endsWith(".home") ||
+      host.endsWith(".internal")
+    ) {
       opts.targetAddressSpace = "private";
     }
   } catch (_) {}
@@ -87,7 +94,10 @@ export async function getVapidPublicKey(): Promise<string> {
  * Subscribe to push notifications.
  * Requests permission, creates a push subscription, and sends it to the server.
  */
-export async function subscribeToPush(): Promise<PushSubscription> {
+export async function subscribeToPush(
+  clientId?: string,
+  deviceLabel?: string,
+): Promise<PushSubscription> {
   const registration = await navigator.serviceWorker.ready;
   const publicKey = await getVapidPublicKey();
 
@@ -96,13 +106,28 @@ export async function subscribeToPush(): Promise<PushSubscription> {
     applicationServerKey: urlBase64ToUint8Array(publicKey) as any,
   });
 
+  const resolvedClientId =
+    clientId ||
+    (typeof localStorage !== "undefined"
+      ? localStorage.getItem(CONFIG_KEYS.CONTROL_PLANE_CLIENT_ID) || undefined
+      : undefined);
+
+  const subJson =
+    typeof subscription.toJSON === "function"
+      ? subscription.toJSON()
+      : JSON.parse(JSON.stringify(subscription));
+
   const url = await getPushUrl("/push/subscribe");
   await fetch(
     url,
     getPushFetchOptions(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(subscription),
+      body: JSON.stringify({
+        ...subJson,
+        ...(resolvedClientId ? { clientId: resolvedClientId } : {}),
+        ...(deviceLabel ? { deviceLabel } : {}),
+      }),
     }),
   );
 

package/src/subsystems/notifications/push-routes.test.ts

@@ -23,6 +23,8 @@ jest.unstable_mockModule("./push-store.js", () => ({
   removeSubscriptionById: jest.fn(),
   getSubscription: jest.fn(),
   getAllSubscriptions: jest.fn(() => []),
+  getSubscriptionsByClientId: jest.fn(() => []),
+  findSubscriptionsForClient: jest.fn(() => []),
 }));
 
 const { registerPushRoutes, broadcastPush } = await import("./push-routes.js");
@@ -112,6 +114,24 @@ describe("push-routes", () => {
       const req = createMockReq(subscription);
       const res = createMockRes();
       await app.routes.post["/push/subscribe"](req, res);
+      expect(store.saveSubscription).toHaveBeenCalledWith({
+        ...subscription,
+        clientId: undefined,
+        deviceLabel: undefined,
+      });
+      expect(res.statusCode).toBe(201);
+    });
+
+    it("saves the subscription with clientId and deviceLabel", async () => {
+      const subscription: any = {
+        endpoint: "https://fcm.example.com/abc-with-client",
+        keys: { p256dh: "key1", auth: "key2" },
+        clientId: "client-test-777",
+        deviceLabel: "Test Device 777",
+      };
+      const req = createMockReq(subscription);
+      const res = createMockRes();
+      await app.routes.post["/push/subscribe"](req, res);
       expect(store.saveSubscription).toHaveBeenCalledWith(subscription);
       expect(res.statusCode).toBe(201);
     });
@@ -308,6 +328,33 @@ describe("push-routes", () => {
       await app.routes.post["/push/broadcast"](req, res);
       expect(res.statusCode).toBe(400);
     });
+
+    it("targets a specific client when clientId is provided in POST /push/broadcast", async () => {
+      (store.findSubscriptionsForClient as any).mockReturnValue([
+        {
+          id: 1,
+          endpoint: "https://fcm.example.com/client-specific",
+          keys_p256dh: "k1",
+          keys_auth: "k2",
+          client_id: "client-target-99",
+        },
+      ]);
+      webpush.sendNotification.mockResolvedValueOnce({
+        statusCode: 201,
+      } as any);
+
+      const req = createMockReq({
+        body: "Specific client alert",
+        clientId: "client-target-99",
+      });
+      const res = createMockRes();
+      await app.routes.post["/push/broadcast"](req, res);
+      expect(res.statusCode).toBe(200);
+      expect(store.findSubscriptionsForClient).toHaveBeenCalledWith(
+        "client-target-99",
+      );
+      expect(res._json.sent).toBe(1);
+    });
   });
 
   describe("POST /push/command", () => {
@@ -367,5 +414,40 @@ describe("push-routes", () => {
       expect(result.noSubscribers).toBeUndefined();
       expect(result.sent).toBe(1);
     });
+
+    it("targets a specific client and returns notFound when no subscription matches", async () => {
+      (store.findSubscriptionsForClient as any).mockReturnValue([]);
+      const result = await broadcastPush(
+        { title: "Test", body: "Hello" },
+        { clientId: "unknown-client" },
+      );
+      expect(result).toEqual({ sent: 0, failed: 0, notFound: true });
+      expect(store.findSubscriptionsForClient).toHaveBeenCalledWith(
+        "unknown-client",
+      );
+    });
+
+    it("targets a specific client and sends push when matching subscription exists", async () => {
+      (store.findSubscriptionsForClient as any).mockReturnValue([
+        {
+          id: 1,
+          endpoint: "https://fcm.example.com/target-sub",
+          keys_p256dh: "k1",
+          keys_auth: "k2",
+          client_id: "client-target-123",
+        },
+      ]);
+      webpush.sendNotification.mockResolvedValueOnce({
+        statusCode: 201,
+      } as any);
+      const result = await broadcastPush(
+        { title: "Test", body: "Hello" },
+        { clientId: "client-target-123" },
+      );
+      expect(result).toEqual({ sent: 1, failed: 0 });
+      expect(store.findSubscriptionsForClient).toHaveBeenCalledWith(
+        "client-target-123",
+      );
+    });
   });
 });

package/src/subsystems/notifications/push-routes.ts

@@ -15,25 +15,54 @@ import {
   removeSubscriptionById,
   getSubscription,
   getAllSubscriptions,
+  findSubscriptionsForClient,
+  type PushSubscriptionRow,
 } from "./push-store.js";
 import type { Express } from "express";
 
+export interface BroadcastPushOptions {
+  clientId?: string;
+}
+
+export interface BroadcastPushResult {
+  sent: number;
+  failed: number;
+  noSubscribers?: true;
+  notFound?: true;
+}
+
 /**
- * Broadcast a push notification payload to all subscriptions.
- * Used by both the /push/broadcast route and the server-side task scheduler.
+ * Broadcast a push notification payload to all subscriptions, or send to a specific client.
+ * Used by /push/broadcast, MCP send_notification tool, and the server-side task scheduler.
  */
 export async function broadcastPush(
   payload: any,
-): Promise<{ sent: number; failed: number; noSubscribers?: true }> {
-  const subs = getAllSubscriptions();
-
-  if (subs.length === 0) {
-    return { sent: 0, failed: 0, noSubscribers: true };
+  options?: BroadcastPushOptions,
+): Promise<BroadcastPushResult> {
+  const targetClientId =
+    options?.clientId ||
+    (typeof payload?.clientId === "string" &&
+    payload.type !== "remote-command" &&
+    payload.clientId.trim()
+      ? payload.clientId.trim()
+      : undefined);
+
+  let subs: PushSubscriptionRow[];
+  if (targetClientId) {
+    subs = findSubscriptionsForClient(targetClientId);
+    if (subs.length === 0) {
+      return { sent: 0, failed: 0, notFound: true };
+    }
+  } else {
+    subs = getAllSubscriptions();
+    if (subs.length === 0) {
+      return { sent: 0, failed: 0, noSubscribers: true };
+    }
   }
 
   const keys = getOrCreateVapidKeys();
   const notification = JSON.stringify(payload);
-  const options = {
+  const sendOptions = {
     TTL: 60 * 60,
     vapidDetails: {
       subject: keys.subject,
@@ -53,7 +82,11 @@ export async function broadcastPush(
       };
 
       try {
-        await webpush.sendNotification(pushSubscription, notification, options);
+        await webpush.sendNotification(
+          pushSubscription,
+          notification,
+          sendOptions,
+        );
         sent++;
       } catch (err: any) {
         failed++;
@@ -86,7 +119,25 @@ export function registerPushRoutes(app: Express): void {
       return res.status(400).json({ error: "Invalid subscription object" });
     }
 
-    saveSubscription(subscription);
+    const clientId =
+      subscription.clientId ||
+      subscription.client_id ||
+      (typeof req.query?.clientId === "string"
+        ? req.query.clientId
+        : undefined);
+
+    const deviceLabel =
+      subscription.deviceLabel ||
+      subscription.device_label ||
+      (typeof req.query?.deviceLabel === "string"
+        ? req.query.deviceLabel
+        : undefined);
+
+    saveSubscription({
+      ...subscription,
+      clientId,
+      deviceLabel,
+    });
     res.sendStatus(201);
   });
 
@@ -177,19 +228,22 @@ export function registerPushRoutes(app: Express): void {
     res.sendStatus(200);
   });
 
-  // Broadcast a notification to all subscriptions
+  // Broadcast a notification to all subscriptions (or to a specific client if clientId is provided)
   app.post("/push/broadcast", async (req, res) => {
-    const { title, body } = req.body || {};
+    const { title, body, clientId } = req.body || {};
 
     if (!body) {
       return res.status(400).json({ error: "Missing body" });
     }
 
     try {
-      const result = await broadcastPush({
-        title: title || "ShadowClaw",
-        body,
-      });
+      const result = await broadcastPush(
+        {
+          title: title || "ShadowClaw",
+          body,
+        },
+        clientId ? { clientId } : undefined,
+      );
       res.json(result);
     } catch (err: any) {
       res.status(500).json({ error: err.message });

package/src/subsystems/notifications/push-store.test.ts

@@ -7,6 +7,8 @@ import {
   getSubscription,
   getAllSubscriptions,
   removeSubscriptionById,
+  getSubscriptionsByClientId,
+  findSubscriptionsForClient,
 } from "./push-store.js";
 
 // Use in-memory DB for tests
@@ -148,4 +150,61 @@ describe("push-store", () => {
       expect(all[0].endpoint).toBe(MOCK_SUBSCRIPTION_2.endpoint);
     });
   });
+
+  describe("client-targeted subscriptions", () => {
+    it("stores and retrieves subscriptions with clientId and deviceLabel", () => {
+      saveSubscription({
+        ...MOCK_SUBSCRIPTION,
+        clientId: "client-01jtest123",
+        deviceLabel: "Pixel 9 Pro",
+      });
+
+      const sub = getSubscription(MOCK_SUBSCRIPTION.endpoint);
+      expect(sub).toBeDefined();
+      expect(sub?.client_id).toBe("client-01jtest123");
+      expect(sub?.device_label).toBe("Pixel 9 Pro");
+
+      const byClient = getSubscriptionsByClientId("client-01jtest123");
+      expect(byClient).toHaveLength(1);
+      expect(byClient[0].endpoint).toBe(MOCK_SUBSCRIPTION.endpoint);
+    });
+
+    it("finds subscriptions by exact clientId, prefix, device label, and row ID", () => {
+      saveSubscription({
+        ...MOCK_SUBSCRIPTION,
+        clientId: "client-01jtest123",
+        deviceLabel: "Pixel 9 Pro",
+      });
+      saveSubscription({
+        ...MOCK_SUBSCRIPTION_2,
+        clientId: "client-02ktest456",
+        deviceLabel: "MacBook Air",
+      });
+
+      // Exact clientId
+      const exact = findSubscriptionsForClient("client-01jtest123");
+      expect(exact).toHaveLength(1);
+      expect(exact[0].endpoint).toBe(MOCK_SUBSCRIPTION.endpoint);
+
+      // Prefix clientId without 'client-'
+      const prefix = findSubscriptionsForClient("01jtest");
+      expect(prefix).toHaveLength(1);
+      expect(prefix[0].endpoint).toBe(MOCK_SUBSCRIPTION.endpoint);
+
+      // Device label substring (case-insensitive)
+      const byLabel = findSubscriptionsForClient("macbook");
+      expect(byLabel).toHaveLength(1);
+      expect(byLabel[0].endpoint).toBe(MOCK_SUBSCRIPTION_2.endpoint);
+
+      // Row ID
+      const all = getAllSubscriptions();
+      const byId = findSubscriptionsForClient(String(all[0].id));
+      expect(byId).toHaveLength(1);
+      expect(byId[0].id).toBe(all[0].id);
+
+      // Non-existent target
+      const notFound = findSubscriptionsForClient("nonexistent-device");
+      expect(notFound).toHaveLength(0);
+    });
+  });
 });

package/src/subsystems/notifications/push-store.ts

@@ -24,6 +24,8 @@ export interface PushSubscriptionRow {
   endpoint: string;
   keys_p256dh: string;
   keys_auth: string;
+  client_id?: string;
+  device_label?: string;
   created_at: string;
 }
 
@@ -33,6 +35,10 @@ export interface PushSubscriptionInput {
     p256dh: string;
     auth: string;
   };
+  clientId?: string;
+  client_id?: string;
+  deviceLabel?: string;
+  device_label?: string;
 }
 
 /**
@@ -62,10 +68,20 @@ export function openPushStore(
       endpoint TEXT NOT NULL UNIQUE,
       keys_p256dh TEXT NOT NULL,
       keys_auth TEXT NOT NULL,
+      client_id TEXT,
+      device_label TEXT,
       created_at TEXT NOT NULL DEFAULT (datetime('now'))
     )
   `);
 
+  try {
+    db.exec(`ALTER TABLE subscriptions ADD COLUMN client_id TEXT`);
+  } catch (_) {}
+
+  try {
+    db.exec(`ALTER TABLE subscriptions ADD COLUMN device_label TEXT`);
+  } catch (_) {}
+
   return db;
 }
 
@@ -112,6 +128,18 @@ export function getOrCreateVapidKeys(
   };
 }
 
+function rowToSubscription(row: any): PushSubscriptionRow {
+  return {
+    id: Number(row.id),
+    endpoint: `${row.endpoint}`,
+    keys_p256dh: `${row.keys_p256dh}`,
+    keys_auth: `${row.keys_auth}`,
+    client_id: row.client_id ? `${row.client_id}` : undefined,
+    device_label: row.device_label ? `${row.device_label}` : undefined,
+    created_at: `${row.created_at}`,
+  };
+}
+
 /**
  * Save a push subscription (upsert by endpoint).
  */
@@ -120,12 +148,26 @@ export function saveSubscription(subscription: PushSubscriptionInput): void {
     throw new Error("Push store not opened.");
   }
 
+  const clientId = subscription.clientId || subscription.client_id || null;
+  const deviceLabel =
+    subscription.deviceLabel || subscription.device_label || null;
+
   db.prepare(
-    "INSERT OR REPLACE INTO subscriptions (endpoint, keys_p256dh, keys_auth) VALUES (?, ?, ?)",
+    `
+    INSERT INTO subscriptions (endpoint, keys_p256dh, keys_auth, client_id, device_label)
+    VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(endpoint) DO UPDATE SET
+      keys_p256dh = excluded.keys_p256dh,
+      keys_auth = excluded.keys_auth,
+      client_id = COALESCE(excluded.client_id, subscriptions.client_id),
+      device_label = COALESCE(excluded.device_label, subscriptions.device_label)
+  `,
   ).run(
     subscription.endpoint,
     subscription.keys.p256dh,
     subscription.keys.auth,
+    clientId,
+    deviceLabel,
   );
 }
 
@@ -165,15 +207,7 @@ export function getSubscription(
     .prepare("SELECT * FROM subscriptions WHERE endpoint = ?")
     .get(endpoint);
 
-  return result
-    ? {
-        id: Number(result.id),
-        endpoint: `${result.endpoint}`,
-        keys_p256dh: `${result.keys_p256dh}`,
-        keys_auth: `${result.keys_auth}`,
-        created_at: `${result.created_at}`,
-      }
-    : undefined;
+  return result ? rowToSubscription(result) : undefined;
 }
 
 /**
@@ -188,13 +222,73 @@ export function getAllSubscriptions(): PushSubscriptionRow[] {
     .prepare("SELECT * FROM subscriptions ORDER BY created_at DESC, id DESC")
     .all();
 
-  return result
-    ? result.map((row) => ({
-        id: Number(row.id),
-        endpoint: `${row.endpoint}`,
-        keys_p256dh: `${row.keys_p256dh}`,
-        keys_auth: `${row.keys_auth}`,
-        created_at: `${row.created_at}`,
-      }))
-    : [];
+  return result ? result.map(rowToSubscription) : [];
+}
+
+/**
+ * Get subscriptions matching a specific client ID.
+ */
+export function getSubscriptionsByClientId(
+  clientId: string,
+): PushSubscriptionRow[] {
+  if (!db) {
+    throw new Error("Push store not opened.");
+  }
+
+  const result = db
+    .prepare(
+      "SELECT * FROM subscriptions WHERE client_id = ? ORDER BY created_at DESC, id DESC",
+    )
+    .all(clientId);
+
+  return result ? result.map(rowToSubscription) : [];
+}
+
+/**
+ * Find subscriptions for a client by exact ID, row ID, ID prefix, or device label.
+ */
+export function findSubscriptionsForClient(
+  target: string,
+): PushSubscriptionRow[] {
+  if (!db) {
+    throw new Error("Push store not opened.");
+  }
+
+  const all = getAllSubscriptions();
+  if (!target || !target.trim()) {
+    return all;
+  }
+
+  const trimmed = target.trim();
+
+  // 1. Exact match on client_id
+  const exact = all.filter((s) => s.client_id === trimmed);
+  if (exact.length > 0) return exact;
+
+  // 2. Exact match on row ID if target is numeric
+  const numericId = parseInt(trimmed, 10);
+  if (!isNaN(numericId) && numericId.toString() === trimmed) {
+    const byId = all.filter((s) => s.id === numericId);
+    if (byId.length > 0) return byId;
+  }
+
+  // 3. Prefix match on client_id (e.g. ULID prefix or client- prefix)
+  const prefix = all.filter(
+    (s) =>
+      s.client_id &&
+      (s.client_id.startsWith(trimmed) ||
+        s.client_id.replace(/^client-/, "").startsWith(trimmed) ||
+        trimmed.startsWith(s.client_id)),
+  );
+  if (prefix.length > 0) return prefix;
+
+  // 4. Case-insensitive substring match on device_label
+  const byLabel = all.filter(
+    (s) =>
+      s.device_label &&
+      s.device_label.toLowerCase().includes(trimmed.toLowerCase()),
+  );
+  if (byLabel.length > 0) return byLabel;
+
+  return [];
 }

package/src/testing/jest-setup.ts

@@ -514,9 +514,11 @@ const expectedLogs = [
   "PeerTaskManager: task",
   "[ShadowClaw] Failed to load models from",
   "PeerJsChannel: connected to signaling server",
+  "PeerJsChannel: disconnected from signaling server",
   "PeerJsChannel: connection opened with",
   "PeerJsChannel: rejecting connection from untrusted peer:",
   "PeerJsChannel: connection closed with",
+  "[ControlPlaneClient] SSE connection error:",
   "[WebVM] Ignoring invalid VM boot host:",
   "[WebVM] Ignoring invalid VM relay URL:",
   "[WebVM]",
@@ -566,6 +568,8 @@ const expectedLogs = [
   "Failed to check Prompt API onboarding:",
   "[webrtc-listen]",
   "[ShadowClaw MCP]",
+  "fatal: not a git repository",
+  "Stopping at filesystem boundary",
 ];
 
 function isExpectedLog(...args: any[]) {
@@ -577,6 +581,17 @@ function isExpectedLog(...args: any[]) {
   return expectedLogs.some((expected) => str.includes(expected));
 }
 
+const originalStderrWrite = process.stderr.write.bind(process.stderr);
+(process.stderr as any).write = (chunk: any, ...args: any[]): boolean => {
+  const str = typeof chunk === "string" ? chunk : (chunk?.toString?.() ?? "");
+  if (isExpectedLog(str)) {
+    const cb = args.find((a) => typeof a === "function");
+    if (cb) cb();
+    return true;
+  }
+  return (originalStderrWrite as any)(chunk, ...args);
+};
+
 console.error = (...args: any[]) => {
   if (isExpectedLog(...args)) return;
   originalConsoleError(...args);