diff --git a/docs/api/rest.md b/docs/api/rest.md index 3394008..6413645 100644 --- a/docs/api/rest.md +++ b/docs/api/rest.md @@ -749,16 +749,22 @@ All web sessions must be inactive at dispatch, including the runtime-native brow Each outbox row retains nullable `lastSuppressionReason`, `lastSuppressionClientKind` and server `lastSuppressedAt` for operator diagnosis, even after read cancellation or a later send. These fields record one evaluated veto, not a full session census, and do not retroactively explain older rows. Reasons are fixed codes for foreground focus, recent interaction, inactive/unknown grace, runtime active/unknown, prompt grace, startup warm-up or source/coordinator unavailability. Client kinds are `web`, `unknown`, `runtime_web`, `runtime_unknown` or `system`; no token, session/connection/installation identifier, endpoint or transcript is logged. They are internal database diagnostics, not additions to client responses. Runtime unknown also covers its independent restart/clock/source safety checks; it is not proof that a browser was active. -Alert payload identity is top-level `{version:1,sourceId,kind:"message",messageId,cursor}`. APNs adds `aps.alert` with title **Sybil Agent**, body **You have a new message.**, default sound and `thread-id:sybil-agent-root`. Web Push adds those same generic title/body strings, fixed `url:"/?agent=root"` and `tag:"sybil-agent:"+sourceId`. No transcript preview, filename, event source, token or key appears in a notification. Normal APNs alerts do not request critical/time-sensitive entitlements. +Alert payload identity is top-level `{version:1,sourceId,kind:"message",messageId,cursor}`. APNs adds `aps.alert` with title **Sybil Agent** and a native string `body` containing the actual eligible public assistant message preview, default sound and `thread-id:sybil-agent-root`. Web Push adds the same title/preview body, fixed `url:"/?agent=root"` and `tag:"sybil-agent:"+sourceId`. Enabling notifications includes message text by default, including on the lock screen when OS notification settings allow it; there is no separate preview opt-in. Explicit public assistant text is authorized content. Reasoning, tool results/arguments, worker messages, internal events, metadata and credentials are never alternative preview sources. + +Markdown is flattened to readable text: formatting and HTML tags are removed, links retain their visible labels, images retain alt text, code retains text, and whitespace is collapsed. Link/image destinations are not fetched or appended. The body is bounded to 3,000 UTF-8 bytes including JSON escaping, with `…` on truncation at a Unicode code point boundary. The complete serialized APNs JSON is at most 4,096 bytes; Web Push JSON is at most 3,993 bytes, leaving 103 bytes for `aes128gcm` overhead within the 4,096-byte encrypted request budget. Identity/escaping overhead can further shorten the body. A successfully resolved message with no displayable text uses **You have a new message.**. Missing, malformed or unavailable public text suppresses sending until a valid lookup or normal expiry. Normal APNs alerts do not request critical/time-sensitive entitlements, and existing native clients can display the string body without a notification extension or app update. Monotonic canonical read advances cancel pending alerts and broadcast `read_state` on authenticated WS. New read-aware clients pass the response's exact source/cursor to their notification manager; receiving/tapping a push does not itself mark history read. Native APNs clear payload is `{version:1,sourceId,kind:"read_state",readCursor,aps:{"content-available":1}}`, push type background/priority 5, coalesced to at most one request per minute per installation that has an earlier delivered/ambiguous alert. App foreground/background handlers reconcile delivered OS notifications by source/cursor. Silent pushes are best effort and cannot guarantee removal when an app is terminated or force-quit; foreground read sync remains required. **No silent Web Push read-clear is sent.** Safari requires visible notifications for Web Push. Authenticated foreground pages forward source-bound read state to their service worker; it closes only owned notifications at/below that read cursor. Closing while every browser client is stopped is best effort only. The service worker must never receive/store the general bearer token. Notification click uses the fixed same-origin Agent link and waits for actual rendered history before acknowledging read. +The web service worker accepts bounded nonempty preview strings, preserving the fixed title, destination, tag and identity validation. It retains the latest preview alongside its existing per-source identity so a late delivery cannot pair older text with a newer cursor, including after worker restart. Legacy stored identities without text use the generic fallback on late deliveries. Generic payloads from older servers remain supported. Deploy the web worker before the preview-producing backend; previously installed generic-only workers must update to display actual-text payloads. The worker never fetches message content or linked resources. + ### Server configuration and runtime source contract Shipping is disabled by default: `AGENT_PUSH_ENABLED=false`. Native transport requires `AGENT_PUSH_APNS_KEY_FILE` (APNs-enabled ES256 `.p8`, regular secret file 0400/0600), `AGENT_PUSH_APNS_KEY_ID`, `AGENT_PUSH_APNS_TEAM_ID`, optional `AGENT_PUSH_APNS_TOPIC` (default `net.buzzert.sybil2`) and `AGENT_PUSH_APNS_ENVIRONMENT` (`production` by default, or `sandbox`; exactly one credential environment per deployment). Web Push requires `AGENT_PUSH_VAPID_FILE`, a private regular JSON file 0400/0600 containing `publicKey`, `privateKey` (base64url P-256) and `subject` (mailto/HTTPS contact). Invalid/missing/unsafe files leave only that adapter unavailable; files and parse errors are never exposed. This implementation neither creates production keys nor changes Apple portal capabilities. Correct native team/topic is `DQQH5H6GBD` / `net.buzzert.sybil2`; parent portal work, push entitlements/provisioning and real device registration are separate prerequisites. An environment-scoped production key cannot send sandbox notifications: sandbox registrations are rejected when production is configured. Concurrent sandbox/production credentials require a future explicit per-environment credential map; do not reuse one scoped key across environments. Backend independently polls token-authenticated runtime `GET /api/notification-context?after=&limit=200` and sends `X-Sybil-Client: backend-proxy-v1` on private proxy REST/WS traffic. The marker classifies the proxy for the native attention census and never replaces runtime authentication. The runtime source is version 1 with `{sourceId,conversationId,cursor,hasMore,latestUserMessageAt,nativeReadCursor,uncertain,webPresence:{active,unknown,observedAt},candidates:[{messageId,cursor,createdAt,trigger}]}`; trigger is `user|external_event|timer|worker|unknown`. No transcript text is included. `uncertain` and `webPresence.unknown` fail closed. Candidate pages preserve all candidates belonging to each consumed cursor (max 200 candidates/page), advancing across non-candidates; omitted `after` is high-water bootstrap with no old candidates. The source identity survives normal runtime restarts. If an incremental context request returns 409 because its cursor exceeds a replaced/restored runtime high-water mark, the backend makes exactly one authenticated no-after probe under the same 10-second deadline. Only a candidate-free, nonpaginated snapshot proving a different source or lower cursor is accepted, solely to quarantine and cancel old pending alerts. It never resets reads/checkpoints, rebaselines, or enumerates historical candidates. Failed/invalid probes and same-source nonregressions remain unavailable and suppress delivery. Runtime native presence/read is an acknowledgment input to the existing canonical backend read state, not a second independently authoritative read store. +For an otherwise dispatchable message only, the backend resolves its text through the existing authenticated root public endpoint: `GET /api/conversations/root/messages?after=&limit=1&includeTools=false`. The URL/path is fixed to the configured runtime, redirects are rejected, the response is limited to 512 KiB and the request to 10 seconds. The page must match the observed root conversation and exact entry cursor; exactly one message must match the candidate ID, assistant role, `metadata.kind:"message"`, `status:"complete"` and entry ID. Only that message's string `content` is used. The runtime's existing root-candidate/provenance rules remain authoritative; a `worker` trigger qualifies only a later public root reply, never the worker's own output. Source/read/presence and all delivery conditions are rechecked after lookup and before committing send intent. Preview text is not persisted in backend outbox/receipt rows. No runtime change or database migration is required. + The runtime browser uses the same 15-second explicit heartbeat, 60-second lease and 5-second interaction/hidden/blur grace. Unobserved direct runtime sockets, event streams and REST pollers share one persisted 5-second introduction window per runtime source, beginning at their first establishment/observation. Polling and reconnects cannot renew it, including with fresh unobserved UUIDs. Existing source/clock uncertainty and the separate 60-second runtime restart safety interval still suppress; the backend never ignores a returned `unknown:true`. diff --git a/docs/api/streaming-chat.md b/docs/api/streaming-chat.md index 496bab6..c3309e7 100644 --- a/docs/api/streaming-chat.md +++ b/docs/api/streaming-chat.md @@ -392,3 +392,5 @@ The backend adds this optional server-to-client frame after a successful monoton Distinguish an unbound room from one already bound to a legacy absent/null source or a source UUID. Bind on the first accepted read state; if history arrives first, pin the legacy state before publishing it. A different source in a later GET, stream frame or PUT acknowledgment, including null-to-UUID or UUID-to-null, must stop stale read writes and require an explicit fresh room load. Preserve the old snapshot and cursors until that reload, then fetch read state before fresh history; never attach a new UUID to an old cursor. Ordinary foreground/network recovery must not reset this stopped room. HTTP 409, an invalid acknowledgment cursor or an acknowledgment below the requested cursor also stops the writer. A transient transport failure can retry only within the same pinned source. None of these client reloads resets server read state. Older clients may ignore unknown server frame types. `read_state` and presence are not client subscribe messages and are never forwarded to runtime as generic frames. Push consent, revoke, presence, retry/expiry and notification payload contracts live in [rest.md](./rest.md#agent-push-notifications-v1). The runtime built-in browser has its own authenticated presence/read inputs and bounded anonymous grace per runtime source. The separate 60-second restart safety intervals and source/clock uncertainty checks remain in effect. No Web Push is used for invisible read synchronization. + +Enabled notifications include a bounded plain-text preview of the eligible completed root public assistant message by default, including on the lock screen when OS settings allow it. The backend resolves only that candidate's exact public `content`, never activity/reasoning/tool/worker fields or linked resources. APNs uses a native string `aps.alert.body`; Web Push uses `body`. This does not change message IDs, stream frames, read acknowledgment or clearing semantics. See the REST contract for Markdown flattening, payload budgets and web worker update ordering. diff --git a/ios/Packages/Sybil/Sources/Sybil/SybilSettingsView.swift b/ios/Packages/Sybil/Sources/Sybil/SybilSettingsView.swift index 43bca75..d932dce 100644 --- a/ios/Packages/Sybil/Sources/Sybil/SybilSettingsView.swift +++ b/ios/Packages/Sybil/Sources/Sybil/SybilSettingsView.swift @@ -89,7 +89,7 @@ struct SybilSettingsView: View { VStack(alignment: .leading, spacing: 10) { Text("Agent Notifications").font(.sybil(.title3, weight: .semibold)) - Text("Get an alert when the Agent has a new message. Previews say only “You have a new message.” Reading elsewhere clears older alerts when iOS allows the app to sync.") + Text("Notifications include Agent message text and may appear on your lock screen. Reading elsewhere clears older alerts when iOS allows the app to sync.") .font(.sybil(.footnote)).foregroundStyle(SybilTheme.textMuted) Text(viewModel.notifications.status) .font(.sybil(.footnote)).accessibilityIdentifier("agent-push-status") diff --git a/server/package-lock.json b/server/package-lock.json index 3a9b3b9..c2aca27 100644 --- a/server/package-lock.json +++ b/server/package-lock.json @@ -19,6 +19,7 @@ "exa-js": "^2.4.0", "fastify": "^5.7.2", "html-to-text": "^9.0.5", + "marked": "17.0.2", "openai": "^6.16.0", "pino-pretty": "^13.1.3", "prisma": "^6.6.0", @@ -1741,6 +1742,18 @@ "node": "20 || >=22" } }, + "node_modules/marked": { + "version": "17.0.2", + "resolved": "https://registry.npmjs.org/marked/-/marked-17.0.2.tgz", + "integrity": "sha512-s5HZGFQea7Huv5zZcAGhJLT3qLpAfnY7v7GWkICUr0+Wd5TFEtdlRR2XUL5Gg+RH7u2Df595ifrxR03mBaw7gA==", + "license": "MIT", + "bin": { + "marked": "bin/marked.js" + }, + "engines": { + "node": ">= 20" + } + }, "node_modules/media-typer": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz", diff --git a/server/package.json b/server/package.json index 8d30fb4..7c55861 100644 --- a/server/package.json +++ b/server/package.json @@ -28,6 +28,7 @@ "exa-js": "^2.4.0", "fastify": "^5.7.2", "html-to-text": "^9.0.5", + "marked": "17.0.2", "openai": "^6.16.0", "pino-pretty": "^13.1.3", "prisma": "^6.6.0", diff --git a/server/src/agent-push-preview.ts b/server/src/agent-push-preview.ts new file mode 100644 index 0000000..f72c1cf --- /dev/null +++ b/server/src/agent-push-preview.ts @@ -0,0 +1,88 @@ +import { convert } from 'html-to-text'; +import { marked } from 'marked'; +import { z } from 'zod'; +import { Cursor, parseSafe } from './agent-push-contract.js'; + +export const MAX_PREVIEW_BYTES = 3000; +export const APNS_PAYLOAD_BYTES = 4096; +// RFC 8291: 4096 bytes less the 86-byte header, delimiter and 16-byte tag. +export const WEB_PUSH_PAYLOAD_BYTES = 3993; +const FALLBACK = 'You have a new message.'; +export type PublicMessage = { conversationId: string; messageId: string; cursor: string }; +export type MessageText = (message: PublicMessage) => Promise; + +const Page = z.object({ conversationId: z.string(), cursor: Cursor, beforeCursor: Cursor, + messages: z.array(z.unknown()).max(1000) }); +const Message = z.object({ id: z.string(), role: z.literal('assistant'), content: z.string(), + metadata: z.object({ kind: z.literal('message'), status: z.literal('complete'), entryId: z.number().int().safe() }) }); + +/** Resolve only an already eligible candidate from one immutable root public entry. */ +export function createMessageText(upstream: { baseUrl: string; apiKey?: string }): MessageText { + return async candidate => { + if (!upstream.apiKey || !Cursor.safeParse(candidate.cursor).success || Number(candidate.cursor) < 1 + || !(candidate.messageId === `outbound:${candidate.cursor}` || new RegExp(`^entry:${candidate.cursor}:\\d+$`).test(candidate.messageId))) { + throw new Error('Public Agent message unavailable'); + } + const url = new URL('/api/conversations/root/messages', upstream.baseUrl); + url.searchParams.set('after', String(Number(candidate.cursor) - 1)); + url.searchParams.set('limit', '1'); url.searchParams.set('includeTools', 'false'); + const response = await fetch(url, { headers: { Authorization: `Bearer ${upstream.apiKey}`, 'X-Sybil-Client': 'backend-proxy-v1' }, + signal: AbortSignal.timeout(10_000), redirect: 'error' }); + if (!response.ok) { await response.body?.cancel(); throw new Error('Public Agent message unavailable'); } + const reader = response.body?.getReader(); + if (!reader) throw new Error('Public Agent message unavailable'); + const chunks: Uint8Array[] = []; let length = 0; + try { + for (;;) { + const { done, value } = await reader.read(); if (done) break; + length += value.length; + if (length > 512 * 1024) throw new Error('Public Agent message unavailable'); + chunks.push(value); + } + } finally { await reader.cancel(); } + const page = parseSafe(Page, JSON.parse(Buffer.concat(chunks).toString('utf8'))); + if (page.conversationId !== candidate.conversationId || page.cursor !== candidate.cursor || page.beforeCursor !== candidate.cursor) { + throw new Error('Public Agent message unavailable'); + } + const matches = page.messages.filter(value => value && typeof value === 'object' && 'id' in value && value.id === candidate.messageId); + const message = matches.length === 1 ? Message.safeParse(matches[0]) : undefined; + if (!message?.success || message.data.metadata.entryId !== Number(candidate.cursor)) throw new Error('Public Agent message unavailable'); + // Never inspect metadata, tool results, activity, reasoning blocks or linked resources for text. + return message.data.content; + }; +} + +export function previewText(message: string): string { + const html = marked.parse(message, { async: false }); + const text = convert(html, { wordwrap: false, + selectors: [ + { selector: 'a', options: { ignoreHref: true } }, + { selector: 'img', format: 'imageAlt' }, + ...['h1', 'h2', 'h3', 'h4', 'h5', 'h6'].map(selector => ({ selector, options: { uppercase: false } })), + { selector: 'hr', format: 'skip' }, + ], + formatters: { imageAlt: (element: { attribs: { alt?: string } }, _walk: unknown, builder: { addInline: (text: string) => void }) => builder.addInline(element.attribs.alt || '') }, + }); + // A string body for native OS display; normalize whitespace/control characters and malformed UTF-16. + return Buffer.from(text).toString('utf8').replace(/[\u0000-\u001f\u007f-\u009f\s]+/gu, ' ').trim(); +} + +/** Budget the complete serialized UTF-8 payload, including JSON escaping and identity overhead. */ +export function previewPayload(message: string | undefined, payload: (body: string) => unknown, maxBytes: number): Buffer { + const text = (message === undefined ? '' : previewText(message)) || FALLBACK; + const budget = Math.min(MAX_PREVIEW_BYTES, maxBytes - Buffer.byteLength(JSON.stringify(payload('')))); + if (budget < 3) throw new Error('Agent push identity exceeds payload budget'); + let body = text; + if (Buffer.byteLength(JSON.stringify(text)) - 2 > budget) { + body = ''; let bytes = 0; + for (const character of text) { + const size = Buffer.byteLength(JSON.stringify(character)) - 2; + if (bytes + size > budget - 3) break; + body += character; bytes += size; + } + body = body.trimEnd() + '…'; + } + const result = Buffer.from(JSON.stringify(payload(body))); + if (result.length > maxBytes) throw new Error('Agent push exceeds payload budget'); + return result; +} diff --git a/server/src/agent-push-transports.ts b/server/src/agent-push-transports.ts index 900fea7..54d6fd1 100644 --- a/server/src/agent-push-transports.ts +++ b/server/src/agent-push-transports.ts @@ -6,12 +6,13 @@ import { isIP } from 'node:net'; import webpush from 'web-push'; import type { PushConfig } from './agent-push-config.js'; import { validatePushEndpoint, type Identity, type Registration } from './agent-push-contract.js'; +import { APNS_PAYLOAD_BYTES, previewPayload, WEB_PUSH_PAYLOAD_BYTES } from './agent-push-preview.js'; export type SendResult = { outcome: 'accepted' | 'retry' | 'invalid' | 'failed' | 'ambiguous'; retryAfterMs?: number }; export type ProviderRequest = { endpoint: string; headers: Record; body: Buffer }; export type ProviderResponse = { status: number; body?: string; retryAfter?: string }; export type RequestTransport = (request: ProviderRequest) => Promise; -export type PushSend = (registration: Registration, identity: Identity, expiresAt: number, now: number) => Promise; +export type PushSend = (registration: Registration, identity: Identity, expiresAt: number, now: number, messageText?: string) => Promise; function boundedRetry(value?: string): number | undefined { if (!value || !/^\d+$/.test(value)) return undefined; @@ -104,7 +105,7 @@ export const webRequest = createWebRequest(); export function createPushSender(config: PushConfig, adapters: { apns?: RequestTransport; web?: RequestTransport } = {}): PushSend { let jwt: { value: string; issuedAt: number } | undefined; - return async (registration, identity, expiresAt, now) => { + return async (registration, identity, expiresAt, now, messageText) => { if (!config.enabled || !config.adminToken || expiresAt <= now) return { outcome: 'failed' }; try { if (registration.transport === 'apns') { @@ -117,7 +118,8 @@ export function createPushSender(config: PushConfig, adapters: { apns?: RequestT jwt = { value: `${value}.${sign('sha256', Buffer.from(value), { key: credential.key, dsaEncoding: 'ieee-p1363' }).toString('base64url')}`, issuedAt: now }; } const clear = identity.kind === 'read_state'; - const body = Buffer.from(JSON.stringify({ aps: clear ? { 'content-available': 1 } : { alert: { title: 'Sybil Agent', body: 'You have a new message.' }, sound: 'default', 'thread-id': 'sybil-agent-root' }, ...identity })); + const body = clear ? Buffer.from(JSON.stringify({ aps: { 'content-available': 1 }, ...identity })) + : previewPayload(messageText, body => ({ aps: { alert: { title: 'Sybil Agent', body }, sound: 'default', 'thread-id': 'sybil-agent-root' }, ...identity }), APNS_PAYLOAD_BYTES); const response = await (adapters.apns || apnsRequest)({ endpoint: `https://${registration.environment === 'sandbox' ? 'api.sandbox.push.apple.com' : 'api.push.apple.com'}/3/device/${registration.token}`, headers: { authorization: `bearer ${jwt.value}`, 'apns-topic': credential.topic, 'apns-push-type': clear ? 'background' : 'alert', @@ -130,10 +132,11 @@ export function createPushSender(config: PushConfig, adapters: { apns?: RequestT // Safari requires visible pushes; there is deliberately no Web Push read-clear transport. if (!config.web || identity.kind !== 'message') return { outcome: 'failed' }; validatePushEndpoint(registration.subscription.endpoint); - const payload = JSON.stringify({ ...identity, title: 'Sybil Agent', body: 'You have a new message.', url: '/?agent=root', tag: `sybil-agent:${identity.sourceId}` }); + const payload = previewPayload(messageText, body => ({ ...identity, title: 'Sybil Agent', body, url: '/?agent=root', tag: `sybil-agent:${identity.sourceId}` }), WEB_PUSH_PAYLOAD_BYTES); const details = webpush.generateRequestDetails(registration.subscription, payload, { vapidDetails: config.web, contentEncoding: 'aes128gcm', TTL: Math.max(1, Math.min(60, Math.floor((expiresAt - now) / 1000))), urgency: 'normal', topic: createHash('sha256').update(identity.sourceId).digest('base64url').slice(0,32) }); + if (!details.body || details.body.length > 4096) return { outcome: 'failed' }; const response = await (adapters.web || webRequest)({ endpoint: details.endpoint, headers: details.headers, body: details.body! }); return classify(response, false); } catch { diff --git a/server/src/agent-push.ts b/server/src/agent-push.ts index 389bf65..76ac635 100644 --- a/server/src/agent-push.ts +++ b/server/src/agent-push.ts @@ -8,10 +8,11 @@ import { loadPushConfig } from './agent-push-config.js'; import { Cursor, InstallationBody, InstallationId, MAX_AGE_MS, MAX_ATTEMPTS, NotificationContext, PresenceBody, PUSH_POLICY, digest, fail, ownerEpoch, parseSafe, validateSubscription, type Context, type Identity, type Presence, type Registration } from './agent-push-contract.js'; import { createPushSender, type PushSend } from './agent-push-transports.js'; +import { createMessageText, type MessageText } from './agent-push-preview.js'; type Tx = Prisma.TransactionClient; export type ReadState = { cursor: string; updatedAt: string | null; sourceId: string | null }; -type Options = { db: PrismaClient; config: PushConfig; context: (after?: string, sourceId?: string) => Promise; send: PushSend; now?: () => number; +type Options = { db: PrismaClient; config: PushConfig; context: (after?: string, sourceId?: string) => Promise; messageText: MessageText; send: PushSend; now?: () => number; broadcast?: (state: ReadState) => void; warmupMs?: number }; const date = (ms: number) => new Date(ms); const activeStatuses = ['pending', 'intent']; @@ -28,6 +29,7 @@ export class AgentPushCoordinator { private running = false; private timer?: ReturnType; private stopped = false; + private observedRoot?: { sourceId: string; conversationId: string }; constructor(readonly options: Options) { this.epoch = ownerEpoch(options.config.adminToken || 'disabled'); this.now = options.now || Date.now; @@ -261,6 +263,7 @@ export class AgentPushCoordinator { return changedRead; }); if (read) this.options.broadcast?.(read); + this.observedRoot = { sourceId: context.sourceId, conversationId: context.conversationId }; return context.hasMore; } private async browserSuppression(tx: Tx, now: number): Promise { @@ -278,8 +281,8 @@ export class AgentPushCoordinator { if (state.unknownSince!.getTime() + PUSH_POLICY.unknownGraceMs > now) return { reason: 'unknown_client_grace', clientKind: unobserved[0]?.kind === 'web' ? 'web' : firstUntracked?.kind || 'unknown' }; } - private async dispatch(id: string) { - const claim = await this.options.db.$transaction(async tx => { + private async claim(id: string, commit: boolean) { + return this.options.db.$transaction(async tx => { const now = this.now(); const state = await tx.agentPushCoordinator.findUniqueOrThrow({ where: { id: 'root' } }); const row = await tx.agentPushDelivery.findUnique({ where: { id } }); @@ -313,17 +316,31 @@ export class AgentPushCoordinator { await tx.agentPushInstallation.update({ where: { id: installation.id }, data: { enabled: false } }); await tx.agentPushDelivery.update({ where: { id }, data: { status: 'cancelled', outcome: 'expired_subscription' } }); return; } + const identity: Identity = row.kind === 'read_state' ? { version: 1, sourceId: row.sourceId, kind: 'read_state', readCursor: read.cursor } + : { version: 1, sourceId: row.sourceId, kind: 'message', messageId: row.messageId, cursor: row.cursor }; + if (!commit) return { row, registration, identity, now }; // Durable crossing intent is committed BEFORE invoking an external adapter. A crash here is ambiguous, never replayed. await tx.agentPushDelivery.update({ where: { id }, data: { status: 'intent', attempts: { increment: 1 }, outcome: null } }); await tx.agentPushCoordinator.update({ where: { id: 'root' }, data: { lockUntil: date(now + 30_000) } }); if (row.kind === 'read_state') await tx.agentPushInstallation.update({ where: { id: installation.id }, data: { lastClearAt: date(now) } }); - const identity: Identity = row.kind === 'read_state' ? { version: 1, sourceId: row.sourceId, kind: 'read_state', readCursor: read.cursor } - : { version: 1, sourceId: row.sourceId, kind: 'message', messageId: row.messageId, cursor: row.cursor }; return { row, registration, identity, now }; }); + } + private async dispatch(id: string) { + // Only resolve text for an otherwise dispatchable candidate, outside the DB transaction. + // Recheck source/read/presence and every claim condition after the bounded public lookup. + const ready = await this.claim(id, false); + if (!ready) return; + let messageText: string | undefined; + if (ready.identity.kind === 'message') { + if (this.observedRoot?.sourceId !== ready.identity.sourceId) throw new Error('Public Agent source unavailable'); + messageText = await this.options.messageText({ ...ready.identity, conversationId: this.observedRoot.conversationId }); + if (await this.observe()) return; + } + const claim = await this.claim(id, true); if (!claim) return; let result; - try { result = await this.options.send(claim.registration, claim.identity, claim.row.expiresAt.getTime(), claim.now); } + try { result = await this.options.send(claim.registration, claim.identity, claim.row.expiresAt.getTime(), claim.now, messageText); } catch { result = { outcome: 'ambiguous' as const }; } await this.options.db.$transaction(async tx => { const pending = result.outcome === 'retry' && claim.row.attempts + 1 < MAX_ATTEMPTS; @@ -398,7 +415,7 @@ export async function registerPushRoutes(app: FastifyInstance, db: PrismaClient, if (probe && (!sourceId || context.hasMore || context.candidates.length > 0 || (context.sourceId === sourceId && Number(context.cursor) >= Number(after)))) throw new Error('Runtime cursor unavailable'); return context; - }, send: createPushSender(config), ...overrides }); + }, messageText: createMessageText(upstream), send: createPushSender(config), ...overrides }); const auth = (req: FastifyRequest) => { if (!env.ADMIN_TOKEN) throw fail(503, 'Agent push requires authenticated access'); requireAdmin(req); }; const safe = (fn: () => Promise): Promise => fn().catch(error => { if (error?.statusCode) throw error; throw fail(503, 'Agent push is unavailable'); }); const routeOptions = { bodyLimit: 16 * 1024 }; diff --git a/server/tests/agent-push-preview.test.ts b/server/tests/agent-push-preview.test.ts new file mode 100644 index 0000000..2457366 --- /dev/null +++ b/server/tests/agent-push-preview.test.ts @@ -0,0 +1,111 @@ +import assert from 'node:assert/strict'; +import { createECDH, generateKeyPairSync, randomUUID } from 'node:crypto'; +import { once } from 'node:events'; +import { createServer } from 'node:http'; +import { createRequire } from 'node:module'; +import test from 'node:test'; +import webpush from 'web-push'; +import { createMessageText, MAX_PREVIEW_BYTES, previewPayload, previewText, WEB_PUSH_PAYLOAD_BYTES } from '../src/agent-push-preview.js'; +import { createPushSender, type ProviderRequest } from '../src/agent-push-transports.js'; + +const { decrypt } = createRequire(import.meta.url)('http_ece'); + +test('preview lookup uses only the exact eligible completed root assistant content on the fixed public endpoint', async t => { + const requests: string[] = []; + const message = { id: 'outbound:11', role: 'assistant', content: 'Your **public answer** includes the requested passphrase: sky-blue.', + metadata: { kind: 'message', status: 'complete', entryId: 11, reasoning: 'private reasoning', resultPreview: 'tool secret', output: 'worker output' } }; + const original = { conversationId: '1', cursor: '11', beforeCursor: '11', messages: [message] }; + let page: unknown = original, status = 200; + const server = createServer((req, res) => { + requests.push(req.url!); + assert.equal(req.headers.authorization, 'Bearer fixture-key'); + assert.equal(req.headers['x-sybil-client'], 'backend-proxy-v1'); + res.writeHead(status, { 'Content-Type': 'application/json', Location: 'http://never-fetch.invalid/' }); + res.end(JSON.stringify(page)); + }); + server.listen(0, '127.0.0.1'); await once(server, 'listening'); + t.after(async () => { server.closeAllConnections(); await new Promise(resolve => server.close(() => resolve())); }); + const load = createMessageText({ baseUrl: `http://127.0.0.1:${(server.address() as { port: number }).port}`, apiKey: 'fixture-key' }); + const candidate = { conversationId: '1', cursor: '11', messageId: 'outbound:11' }; + assert.equal(await load(candidate), message.content, 'explicit public assistant text is authorized without guessing/redacting secrets'); + assert.deepEqual(requests, ['/api/conversations/root/messages?after=10&limit=1&includeTools=false']); + page = { ...original, messages: [{ ...message, id: 'entry:11:0' }] }; + assert.equal(await load({ ...candidate, messageId: 'entry:11:0' }), message.content); + for (const invalid of [ + { ...original, conversationId: 'worker-conversation' }, { ...original, cursor: '12' }, { ...original, beforeCursor: '10' }, + { ...original, messages: [] }, { ...original, messages: [message, message] }, + ...['tool', 'user', 'system', 'reasoning'].map(role => ({ ...original, messages: [{ ...message, role }] })), + ...[{ kind: 'tool_call' }, { kind: 'worker' }, { status: 'initiated' }, { entryId: 12 }].map(metadata => ({ ...original, messages: [{ ...message, metadata: { ...message.metadata, ...metadata } }] })), + { ...original, messages: [{ ...message, content: [{ type: 'reasoning', text: 'private reasoning' }] }] }, + { ...original, messages: [{ ...message, id: 'tool:1:11' }] }, + ]) { page = invalid; await assert.rejects(load(candidate)); } + page = { ...original, messages: [{ ...message, content: '' }] }; + assert.equal(await load(candidate), '', 'empty content never borrows metadata, tool output or reasoning'); + const before = requests.length; + for (const messageId of ['tool:1:11', 'outbound:12', 'https://never-fetch.invalid/', 'entry:11:0/../../state']) { + await assert.rejects(load({ ...candidate, messageId })); + } + assert.equal(requests.length, before); + page = { ...original, messages: [{ ...message, content: 'x'.repeat(512 * 1024) }] }; + await assert.rejects(load(candidate)); + status = 302; page = original; await assert.rejects(load(candidate)); + status = 503; await assert.rejects(load(candidate)); + assert.ok(requests.every(url => url === requests[0]), 'no worker/raw-state/event/linked-resource requests or redirects'); +}); + +test('Markdown becomes readable message text without link destinations, image sources or HTML internals', () => { + const markdown = '# Status\n\nThe **report** is _ready_ & checked.\n\n- Read [the summary](https://private.invalid/secret)\n- `keep_snake_case()`\n\n> Done.\n\n```ts\nconst answer = 42;\n```\n\n![Chart](https://private.invalid/image)\n\n'; + const result = previewText(markdown); + for (const text of ['Status', 'The report is ready & checked.', 'Read the summary', 'keep_snake_case()', 'Done.', 'const answer = 42;', 'Chart']) assert.ok(result.includes(text), result); + for (const hidden of ['https://', 'private.invalid', 'secret', 'hidden comment', 'internal script', '**', '```', '# Status']) assert.ok(!result.includes(hidden), result); + assert.equal(previewText('Plain text: 日本語 🌧️ — keep_this_path.txt'), 'Plain text: 日本語 🌧️ — keep_this_path.txt'); + assert.equal(previewText('A\u0000B\n\tC\ud800'), 'A B C�'); +}); + +test('actual APNs and decrypted Web Push bodies carry public text with UTF-8/JSON/encryption bounds', async () => { + const apnsKey = generateKeyPairSync('ec', { namedCurve: 'prime256v1' }); + const receiver = createECDH('prime256v1'); receiver.generateKeys(); + const auth = Buffer.alloc(16, 1).toString('base64url'); + const native = { transport: 'apns' as const, enabled: true as const, token: 'a'.repeat(64), environment: 'sandbox' as const, topic: 'net.buzzert.sybil2' }; + const browser = { transport: 'web' as const, enabled: true as const, subscription: { endpoint: 'https://web.push.apple.com/fixture', + keys: { p256dh: receiver.getPublicKey().toString('base64url'), auth } } }; + const apns: ProviderRequest[] = [], web: ProviderRequest[] = []; + const sender = createPushSender({ enabled: true, adminToken: 'fixture', + apns: { key: apnsKey.privateKey.export({ format: 'pem', type: 'pkcs8' }).toString(), keyId: 'ABCDEFGHIJ', teamId: 'DQQH5H6GBD', environment: 'sandbox', topic: native.topic }, + web: { ...webpush.generateVAPIDKeys(), subject: 'mailto:tests@example.com' } }, { + apns: async request => { apns.push(request); return { status: 200 }; }, web: async request => { web.push(request); return { status: 201 }; }, + }); + const identity = { version: 1 as const, kind: 'message' as const, sourceId: randomUUID(), messageId: 'outbound:11', cursor: '11' }; + const now = Date.now(); + for (const content of ['The **report** is ready. 日本語 🌧️', 'Requested public passphrase: sky-blue.', 'a'.repeat(3000), + 'a'.repeat(3001), '世界🌧️é'.repeat(2000), '"\\'.repeat(4000), '\ud800'.repeat(4000), ' ']) { + assert.equal((await sender(native, identity, now + 60_000, now, content)).outcome, 'accepted'); + assert.equal((await sender(browser, identity, now + 60_000, now, content)).outcome, 'accepted'); + const apnsBytes = apns.at(-1)!.body, encrypted = web.at(-1)!.body; + const plaintext: Buffer = decrypt(encrypted, { version: 'aes128gcm', privateKey: receiver, authSecret: auth }); + const apnsPayload = JSON.parse(apnsBytes.toString()), webPayload = JSON.parse(plaintext.toString()); + const body = apnsPayload.aps.alert.body; + assert.equal(typeof body, 'string'); assert.equal(webPayload.body, body); + assert.ok(Buffer.byteLength(body) <= MAX_PREVIEW_BYTES); + assert.ok(apnsBytes.length <= 4096); assert.ok(plaintext.length <= 3993); assert.ok(encrypted.length <= 4096); + assert.equal(encrypted.length, plaintext.length + 103); + assert.equal(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.from(body)), body); + for (const [key, value] of Object.entries(identity)) { assert.equal(apnsPayload[key], value); assert.equal(webPayload[key], value); } + assert.equal(webPayload.url, '/?agent=root'); assert.equal(webPayload.tag, `sybil-agent:${identity.sourceId}`); + const flattened = previewText(content) || 'You have a new message.'; + if (Buffer.byteLength(JSON.stringify(flattened)) - 2 <= MAX_PREVIEW_BYTES) assert.equal(body, flattened); + else { assert.ok(body.endsWith('…')); assert.ok(flattened.startsWith(body.slice(0, -1))); } + assert.ok(!encrypted.includes(Buffer.from(body)), 'Web Push plaintext is encrypted'); + } + await sender(native, { version: 1, kind: 'read_state', sourceId: identity.sourceId, readCursor: '11' }, now + 60_000, now, 'never include text in a clear'); + assert.deepEqual(JSON.parse(apns.at(-1)!.body.toString()).aps, { 'content-available': 1 }); + assert.ok(!apns.at(-1)!.body.includes('never include')); +}); + +test('payload budget includes identity overhead and JSON escaping before truncating on a Unicode boundary', () => { + const result = previewPayload('界"\\🌧'.repeat(2000), body => ({ messageId: '"'.repeat(1000), body }), WEB_PUSH_PAYLOAD_BYTES); + assert.ok(result.length <= WEB_PUSH_PAYLOAD_BYTES); + const body = JSON.parse(result.toString()).body; + assert.ok(body.endsWith('…')); assert.equal(body.includes('�'), false); + assert.throws(() => previewPayload('hello', body => ({ extra: 'x'.repeat(5000), body }), 4096)); +}); diff --git a/server/tests/agent-push.test.ts b/server/tests/agent-push.test.ts index b7c5358..29cc9da 100644 --- a/server/tests/agent-push.test.ts +++ b/server/tests/agent-push.test.ts @@ -40,12 +40,13 @@ async function fixture(options: { warmupMs?: number; config?: PushConfig } = {}) let context: Context = { version: 1, sourceId: source, conversationId: '1', cursor: '10', hasMore: false, latestUserMessageAt: new Date(now - 30_000).toISOString(), nativeReadCursor: '0', uncertain: false, webPresence: { active: false, unknown: false, observedAt: new Date(now).toISOString() }, candidates: [] }; - const sent: { registration: Registration; identity: any }[] = [], reads: any[] = []; + const sent: { registration: Registration; identity: any; messageText?: string }[] = [], reads: any[] = []; let result: SendResult = { outcome: 'accepted' }, failure = false; const manager = new AgentPushCoordinator({ db: prisma, config: options.config || config, now: () => now, warmupMs: options.warmupMs ?? 0, context: async after => { if (failure) throw new Error('upstream secret must not leak'); return { ...context, webPresence: { ...context.webPresence, observedAt: new Date(now).toISOString() }, candidates: after === undefined ? [] : context.candidates.filter(c => Number(c.cursor) > Number(after)) }; }, - send: async (registration, identity) => { sent.push({ registration, identity }); return result; }, broadcast: value => reads.push(value) }); + messageText: async () => 'The Agent finished the requested work.', + send: async (registration, identity, _expiresAt, _now, messageText) => { sent.push({ registration, identity, messageText }); return result; }, broadcast: value => reads.push(value) }); await manager.initialize(); const installationId = randomUUID(); await manager.register(installationId, apns); await manager.tick(); return { manager, installationId, source, sent, reads, get now() { return now; }, advance(ms: number) { now += ms; }, @@ -66,10 +67,50 @@ test('first source bootstrap never alerts history; later durable candidates debo f.advance(2_000); await f.manager.tick(); assert.equal(f.sent.length, 1); await f.manager.tick(); assert.equal(f.sent.length, 1); assert.deepEqual(f.sent[0].identity, { version: 1, sourceId: f.source, kind: 'message', messageId: 'outbound:11', cursor: '11' }); + assert.equal(f.sent[0].messageText, 'The Agent finished the requested work.'); assert.equal((await prisma.agentPushDelivery.findFirst())?.status, 'accepted'); const restarted = new AgentPushCoordinator({ ...f.manager.options, warmupMs: 0 }); await restarted.tick(); assert.equal(f.sent.length, 1); }); +test('preview resolves only the coalesced eligible root candidate after attention clears and survives a pending restart', async () => { + const f = await fixture(), tab = randomUUID(), lookups: unknown[] = []; + f.manager.options.messageText = async candidate => { lookups.push(candidate); return `Public reply ${candidate.messageId}`; }; + f.candidate('11', 'unknown'); await f.manager.tick(); f.advance(2_000); await f.manager.tick(); + assert.equal(lookups.length, 0); + await f.manager.presence(tab, { sequence: 1, visibility: 'visible', focused: true, interacted: false }); + f.candidate('12', 'worker'); await f.manager.tick(); f.candidate('13', 'timer'); await f.manager.tick(); f.advance(2_000); await f.manager.tick(); + assert.equal(lookups.length, 0, 'focused clients do not cause repeated message fetches'); + await f.manager.retirePresence(tab); f.advance(6_000); + const restarted = new AgentPushCoordinator({ ...f.manager.options, warmupMs: 0 }); await restarted.tick(); + assert.equal(f.sent.length, 1); assert.equal(f.sent[0].messageText, 'Public reply outbound:13'); + assert.equal((lookups[0] as any).conversationId, '1'); assert.equal((lookups[0] as any).messageId, 'outbound:13'); + assert.ok(!JSON.stringify(await prisma.agentPushDelivery.findMany()).includes('Public reply'), 'receipts contain no preview text'); +}); + +for (const change of ['read', 'focus', 'source', 'revoke']) test(`preview lookup cannot bypass ${change} changes before the send intent`, async () => { + const f = await fixture(); f.candidate(); await f.manager.tick(); f.advance(2_000); + f.manager.options.messageText = async () => { + if (change === 'read') f.context({ nativeReadCursor: '11' }); + if (change === 'source') f.context({ sourceId: randomUUID() }); + if (change === 'focus') await f.manager.presence(randomUUID(), { sequence: 1, visibility: 'visible', focused: true, interacted: false }); + if (change === 'revoke') await f.manager.revoke(f.installationId); + return 'Public text that must not be sent now'; + }; + await f.manager.tick(); assert.equal(f.sent.length, 0); + assert.equal((await prisma.agentPushDelivery.findFirstOrThrow()).attempts, 0); +}); + +test('unavailable public text suppresses without claiming a provider send; the next valid lookup sends actual text', async () => { + const f = await fixture(); f.candidate(); await f.manager.tick(); f.advance(2_000); + f.manager.options.messageText = async () => { throw new Error('private upstream detail'); }; + await f.manager.tick(); assert.equal(f.sent.length, 0); + const pending = await prisma.agentPushDelivery.findFirstOrThrow(); + assert.equal(pending.status, 'pending'); assert.equal(pending.attempts, 0); + assert.equal(pending.lastSuppressionReason, 'source_or_coordinator_unavailable'); + f.manager.options.messageText = async () => 'Recovered public reply'; + await f.manager.tick(); assert.equal(f.sent[0].messageText, 'Recovered public reply'); +}); + test('all tabs veto while focused; hidden heartbeats and stale sequences cannot extend short transition grace', async () => { const f = await fixture(), tab1 = randomUUID(), tab2 = randomUUID(); await f.manager.presence(tab1, { sequence: 1, visibility: 'hidden', focused: false, interacted: false }); @@ -243,20 +284,20 @@ test('provider endpoint validation rejects SSRF targets and private/reserved DNS assert.equal(isPublicAddress('8.8.8.8'), true); assert.equal(isPublicAddress('2606:4700::1111'), true); }); -test('real APNs ES256 request construction uses generic alerts, explicit environment and background clear headers through injected HTTP2 boundary', async () => { +test('real APNs ES256 request construction uses message text, explicit environment and background clear headers through injected HTTP2 boundary', async () => { const key = generateKeyPairSync('ec', { namedCurve: 'prime256v1' }); const requests: any[] = []; const now = Date.now(), sourceId = randomUUID(); const sender = createPushSender({ ...config, apns: { ...config.apns!, key: key.privateKey.export({ format: 'pem', type: 'pkcs8' }).toString() } }, { apns: async request => { requests.push(request); return { status: 200 }; } }); const identity = { version: 1 as const, sourceId, kind: 'message' as const, messageId: 'outbound:12', cursor: '12' }; - assert.equal((await sender(apns, identity, now + 300_000, now)).outcome, 'accepted'); + assert.equal((await sender(apns, identity, now + 300_000, now, 'Your **report** is ready.')).outcome, 'accepted'); assert.equal(requests[0].endpoint, `https://api.sandbox.push.apple.com/3/device/${apns.token}`); assert.equal(requests[0].headers['apns-push-type'], 'alert'); assert.equal(requests[0].headers['apns-topic'], apns.topic); const [header, claims, signature] = requests[0].headers.authorization.slice(7).split('.'); assert.equal(JSON.parse(Buffer.from(header, 'base64url').toString()).kid, 'ABCDEFGHIJ'); assert.equal(JSON.parse(Buffer.from(claims, 'base64url').toString()).iss, 'DQQH5H6GBD'); assert.equal(verify('sha256', Buffer.from(`${header}.${claims}`), { key: key.publicKey, dsaEncoding: 'ieee-p1363' }, Buffer.from(signature, 'base64url')), true); - assert.deepEqual(JSON.parse(requests[0].body).aps.alert, { title: 'Sybil Agent', body: 'You have a new message.' }); + assert.deepEqual(JSON.parse(requests[0].body).aps.alert, { title: 'Sybil Agent', body: 'Your report is ready.' }); await sender(apns, { version: 1, sourceId, kind: 'read_state', readCursor: '12' }, now + 60_000, now); assert.equal(requests[1].headers['apns-push-type'], 'background'); assert.equal(requests[1].headers['apns-priority'], '5'); assert.deepEqual(JSON.parse(requests[1].body).aps, { 'content-available': 1 }); @@ -277,7 +318,7 @@ test('standard encrypted aes128gcm + VAPID Web Push uses library request constru test('production-scoped APNs configuration refuses sandbox registration and cannot send it', async () => { const production = { ...config, apns: { ...config.apns!, environment: 'production' as const } }; - const manager = new AgentPushCoordinator({ db: prisma, config: production, context: async () => { throw new Error(); }, send: async () => { throw new Error('must not send'); } }); + const manager = new AgentPushCoordinator({ db: prisma, config: production, context: async () => { throw new Error(); }, messageText: async () => { throw new Error(); }, send: async () => { throw new Error('must not send'); } }); await assert.rejects(manager.register(randomUUID(), apns), { statusCode: 400 }); let requests = 0; const sender = createPushSender(production, { apns: async () => { requests++; throw new Error('must not send'); } }); diff --git a/web/public/sw.js b/web/public/sw.js index 7a462da..0ac2709 100644 --- a/web/public/sw.js +++ b/web/public/sw.js @@ -17,6 +17,8 @@ self.addEventListener("fetch", (event) => { // Safari requires a visible notification for each valid message push. Reads are // reconciled only by foreground page messages, never an invisible Web Push. const PUSH_TITLE = "Sybil Agent", PUSH_BODY = "You have a new message.", PUSH_URL = "/?agent=root"; +const bytes = value => new TextEncoder().encode(value).length; +const preview = value => typeof value === "string" && value.trim().length > 0 && bytes(value) <= 3000; const sourceId = value => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value); const cursor = value => typeof value === "string" && /^\d{1,16}$/.test(value) && Number.isSafeInteger(Number(value)); const messageId = value => typeof value === "string" && /^[A-Za-z0-9:_-]{1,200}$/.test(value); @@ -67,20 +69,24 @@ async function announce(type) { self.addEventListener("push", event => { event.waitUntil(serial(async () => { let value; - try { const raw = event.data?.text(); if (!raw || raw.length > 4096) return; value = JSON.parse(raw); } catch { return; } + try { const raw = event.data?.text(); if (!raw || bytes(raw) > 3993) return; value = JSON.parse(raw); } catch { return; } if (!owned(value) || value.url !== PUSH_URL || value.tag !== `sybil-agent:${value.sourceId}` - || value.title !== PUSH_TITLE || value.body !== PUSH_BODY) return; + || value.title !== PUSH_TITLE || !preview(value.body)) return; const previous = await stored(value.sourceId).catch(() => null); // Re-delivery replaces the same owned tag without regressing its cursor. // Still show it visibly: local read state is not a reason for an invisible push. - const identity = owned(previous?.latest) && BigInt(previous.latest.cursor) > BigInt(value.cursor) ? previous.latest : { + const stale = owned(previous?.latest) && BigInt(previous.latest.cursor) > BigInt(value.cursor); + const identity = stale ? previous.latest : { version: 1, kind: "message", sourceId: value.sourceId, messageId: value.messageId, cursor: BigInt(value.cursor).toString(), }; + // Keep the displayed text paired with the retained identity across late pushes/restarts. + // Older workers persisted identity only, so their retained notifications use the fallback. + const body = stale ? preview(previous.latestBody) ? previous.latestBody : PUSH_BODY : value.body; await self.registration.showNotification(PUSH_TITLE, { - body: PUSH_BODY, tag: `sybil-agent:${identity.sourceId}`, icon: "/icons/icon-192.png", badge: "/icons/icon-192.png", + body, tag: `sybil-agent:${identity.sourceId}`, icon: "/icons/icon-192.png", badge: "/icons/icon-192.png", renotify: false, data: identity, }); - await save({ ...previous, sourceId: identity.sourceId, latest: identity }).catch(() => undefined); + await save({ ...previous, sourceId: identity.sourceId, latest: identity, latestBody: body }).catch(() => undefined); await announce("sybil-push-shown"); })); }); diff --git a/web/src/components/agent/agent-notifications.tsx b/web/src/components/agent/agent-notifications.tsx index 99f6e8c..a9d2eb3 100644 --- a/web/src/components/agent/agent-notifications.tsx +++ b/web/src/components/agent/agent-notifications.tsx @@ -9,6 +9,7 @@ export function AgentNotifications({ onLogout }: { onLogout: () => Promise return
Agent notifications
+

Notifications include Agent message text and may appear on your lock screen.

{state.message}

{state.error ?

{state.error}

: null}
diff --git a/web/src/lib/agent-push.ts b/web/src/lib/agent-push.ts index 479f427..5358670 100644 --- a/web/src/lib/agent-push.ts +++ b/web/src/lib/agent-push.ts @@ -135,7 +135,7 @@ export function createAgentPushController(options: { : cleanupFull ? "Notification cleanup is full. Sign in to a previous server to finish removing old registrations before enabling more." : consent?.revocationPending ? "Notifications are off here. Server removal will retry when connected." : !available ? "Notifications are not configured on this server yet." - : enabled ? "Notifications are on for this browser. Alerts use a private, generic preview." + : enabled ? "Notifications are on for this browser." : "Get an alert for unread Agent replies when all your web sessions are inactive."; return { busy, enabled, canEnable: !busy && available && support === "supported" && permission !== "denied" && !consent?.revocationPending && !cleanupFull, message, error }; }; diff --git a/web/tests/agent-push-worker.test.mjs b/web/tests/agent-push-worker.test.mjs index a6f4b09..1089e15 100644 --- a/web/tests/agent-push-worker.test.mjs +++ b/web/tests/agent-push-worker.test.mjs @@ -45,7 +45,7 @@ function fixture(sharedRecords = new Map()) { getNotifications: async ({ tag } = {}) => notifications.filter(value => !value.closed && (!tag || value.tag === tag)), }, }; - vm.runInNewContext(workerSource, { self, indexedDB: idb(sharedRecords), URL, Date, Promise, BigInt, + vm.runInNewContext(workerSource, { self, indexedDB: idb(sharedRecords), URL, Date, Promise, BigInt, TextEncoder, fetch: async request => { fetches.push(request); throw new Error("Network blocked in worker tests"); }, Request }); const emit = async (type, properties = {}) => { const waits = []; handlers.get(type)?.({ ...properties, waitUntil: value => waits.push(value) }); await Promise.all(waits); @@ -58,9 +58,9 @@ function fixture(sharedRecords = new Map()) { }; } -test("actual worker push handler shows fixed generic notification and never fetches credentials", async () => { - const f = fixture(); await f.push(payload()); - assert.equal(f.shown.length, 1); assert.equal(f.shown[0].title, "Sybil Agent"); assert.equal(f.shown[0].body, "You have a new message."); +test("actual worker push handler displays supplied public message text and never fetches credentials", async () => { + const f = fixture(); await f.push(payload("5", { body: "Your report is ready. 日本語 🌧️" })); + assert.equal(f.shown.length, 1); assert.equal(f.shown[0].title, "Sybil Agent"); assert.equal(f.shown[0].body, "Your report is ready. 日本語 🌧️"); assert.deepEqual(f.shown[0].data, { version: 1, kind: "message", sourceId, messageId: "outbound:5", cursor: "5" }); assert.equal(f.shown[0].tag, `sybil-agent:${sourceId}`); assert.equal(f.shown[0].renotify, false); assert.deepEqual(f.fetches, []); assert.ok(!JSON.stringify([...f.records]).includes("token")); @@ -69,22 +69,36 @@ test("actual worker push handler shows fixed generic notification and never fetc test("every valid message push remains visible, including read or duplicate deliveries; stale payload never regresses identity", async () => { const records = new Map(), f = fixture(records); await f.message({ type: "sybil-agent-read", version: 1, sourceId, cursor: "10" }); - await f.push(payload("8")); await f.push(payload("8")); await f.push(payload("5")); + await f.push(payload("8", { body: "Latest reply" })); await f.push(payload("8", { body: "Latest reply" })); await f.push(payload("5", { body: "Older reply" })); assert.equal(f.shown.length, 3, "Safari visibility requirement is preserved"); assert.ok(f.shown.every(notification => notification.data.cursor === "8")); + assert.ok(f.shown.every(notification => notification.body === "Latest reply")); const restarted = fixture(records); await restarted.push(payload("6")); assert.equal(restarted.shown[0].data.cursor, "8"); + assert.equal(restarted.shown[0].body, "Latest reply"); assert.equal(records.get(sourceId).readCursor, "10"); }); -test("malformed/unexpected payloads cannot supply text, destinations, cross-source tags or silent read pushes", async () => { +test("malformed/unexpected payloads cannot supply invalid bodies, destinations, cross-source tags or silent read pushes", async () => { const f = fixture(); - for (const value of ["not-json", "x".repeat(5000), payload("1", { title: "sensitive text" }), payload("1", { body: "transcript" }), + for (const value of ["not-json", "x".repeat(5000), payload("1", { title: "sensitive text" }), payload("1", { body: { text: "invalid" } }), + payload("1", { body: " " }), payload("1", { body: "界".repeat(1001) }), payload("1", { body: "x".repeat(3001) }), + payload("1", { body: "界".repeat(900), extra: "界".repeat(500) }), payload("1", { url: "https://evil.example/" }), payload("1", { tag: "some-other-app" }), payload("-1"), payload("9007199254740992"), payload("1", { sourceId: "../../bad" }), payload("1", { messageId: "