Let outside services and computers' browser notifications give bots work

A bot hook (bot_hooks) is a secret URL, POST /api/hooks/<token>, whose
calls queue the hook's brief plus the raw body as a task, per user and
bot like a routine. Only the token's hash is kept (shown once, rotatable);
an optional HMAC-SHA256 signing secret is stored encrypted. Calls are
rate limited per address and per hook, recorded in bot_hook_events
(pruned daily), deduplicated by delivery id, and a call while the last
run still waits joins its brief instead of queueing another. The payload
is fenced data and HookRunNote tells the bot never to take instructions
from it; failed runs retry like routines.

A hook can instead watch a computer's browser notifications: the app
installs a small watcher that owns org.freedesktop.Notifications on the
sandbox's session bus, so Chrome hands it every notification (it only
looks for that service at start-up, so Chrome is restarted once, never
mid-task), and it posts each one to its hooks, optionally filtered.
Computers reach the app at COMPUTER_APP_URL or the app container's name.

Users make hooks in the conversation's Hooks modal and manage them all
on /admin/routines; bots never create or change hooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/cron/sync-notify-watchers/index.ts

@@ -0,0 +1,33 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import syncComputerNotifyWatch from "@/src/functions/backend/db/bot-hooks/sync-computer-notify-watch";
+import { logError } from "@/src/functions/backend/logger";
+
+/**
+ * Keeps the notification watcher running on every computer a hook that's
+ * on watches (`syncComputerNotifyWatch`): a restarted or recreated
+ * container gets it back, and a Chrome restart put off while a task worked
+ * there happens once the computer is free. A failure is logged once per
+ * computer and run; the next run tries again.
+ */
+export default async function syncNotifyWatchers() {
+    const rows =
+        (
+            await BunSQLite.sql<{ computer_id: number }>({
+                sql: `SELECT DISTINCT watch_computer_id AS computer_id FROM bot_hooks
+                    WHERE source = 'browser_notifications' AND enabled = 1 AND watch_computer_id IS NOT NULL`,
+            })
+        ).payload || [];
+
+    for (const { computer_id } of rows) {
+        const result = await syncComputerNotifyWatch({ computer_id });
+
+        if (!result.ok) {
+            await logError({
+                title: `Computer #${computer_id}'s notification watcher isn't running`,
+                category: "hook",
+                error: new Error(result.error || "Unknown"),
+                metadata: { computer_id },
+            }).catch(() => {});
+        }
+    }
+}