Let outside services and computers' browser notifications give bots work

A bot hook (bot_hooks) is a secret URL, POST /api/hooks/<token>, whose
calls queue the hook's brief plus the raw body as a task, per user and
bot like a routine. Only the token's hash is kept (shown once, rotatable);
an optional HMAC-SHA256 signing secret is stored encrypted. Calls are
rate limited per address and per hook, recorded in bot_hook_events
(pruned daily), deduplicated by delivery id, and a call while the last
run still waits joins its brief instead of queueing another. The payload
is fenced data and HookRunNote tells the bot never to take instructions
from it; failed runs retry like routines.

A hook can instead watch a computer's browser notifications: the app
installs a small watcher that owns org.freedesktop.Notifications on the
sandbox's session bus, so Chrome hands it every notification (it only
looks for that service at start-up, so Chrome is restarted once, never
mid-task), and it posts each one to its hooks, optionally filtered.
Computers reach the app at COMPUTER_APP_URL or the app container's name.

Users make hooks in the conversation's Hooks modal and manage them all
on /admin/routines; bots never create or change hooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/bot-hook-dict.ts

@@ -0,0 +1,60 @@
+/**
+ * What calls a hook: an outside service at its URL, or the watcher on a
+ * computer forwarding that computer's browser notifications
+ * (`syncComputerNotifyWatch`).
+ */
+export const BotHookSources = [
+    { title: "Calls to its URL", value: "url" },
+    { title: "Browser notifications on a computer", value: "browser_notifications" },
+] as const;
+
+export type BotHookSource = (typeof BotHookSources)[number]["value"];
+
+/**
+ * How a hook's sender writes its HMAC-SHA256 signature of the raw body in
+ * the signature header: plain hex, GitHub's `sha256=<hex>`, or base64
+ * (Shopify and others).
+ */
+export const BotHookSignatureFormats = [
+    { title: "Hex", value: "hex" },
+    { title: "sha256=hex (GitHub)", value: "sha256=hex" },
+    { title: "Base64", value: "base64" },
+] as const;
+
+export type BotHookSignatureFormat = (typeof BotHookSignatureFormats)[number]["value"];
+
+/**
+ * What became of one call to a hook: it queued a run, joined a run still
+ * waiting, was refused (a bad signature, a paused hook), repeated a call
+ * already taken, or was a notification the hook's filter left out.
+ */
+export const BotHookEventStatuses = [
+    { title: "Queued", value: "queued" },
+    { title: "Merged", value: "merged" },
+    { title: "Rejected", value: "rejected" },
+    { title: "Duplicate", value: "duplicate" },
+    { title: "Ignored", value: "ignored" },
+] as const;
+
+export type BotHookEventStatus = (typeof BotHookEventStatuses)[number]["value"];
+
+/**
+ * Every hook token starts with this, so a leaked one is easy to spot.
+ */
+export const BotHookTokenPrefix = "cbh_";
+
+/**
+ * The public path a hook is called at: `<BotHookPath>/<token>`.
+ */
+export const BotHookPath = "/api/hooks";
+
+/**
+ * Headers a sender may use to name a delivery, so a retried call isn't
+ * run twice. The first one present wins.
+ */
+export const BotHookIdempotencyHeaders = [
+    "idempotency-key",
+    "x-github-delivery",
+    "x-request-id",
+    "x-webhook-id",
+] as const;

src/dict/env-dict.ts

@@ -66,6 +66,12 @@ export const EnvDict: readonly KnownEnv[] = [
         required: false,
         secret: false,
     },
+    {
+        key: "COMPUTER_APP_URL",
+        description: `Where computers reach this app, for hooks they call (browser notifications), e.g. http://172.17.0.1:7000 for a server running outside docker. Empty uses the app's container on the docker network.`,
+        required: false,
+        secret: false,
+    },
     {
         key: "MAIN_COMPUTER_DATA_DIR",
         description: `Where the main computer's workspace (/home/gem/workspace, the only folder bots work in) is on this server's disk, for a computer the app didn't create itself (see MAIN_COMPUTER_URL), e.g. the bind mount your sandbox's compose file uses. Empty reads DATA_DIR/computers/<id>.`,

src/dict/log-categories.ts

@@ -11,6 +11,10 @@ export const LogCategories = [
         title: "Cron",
         value: "cron",
     },
+    {
+        title: "Hook",
+        value: "hook",
+    },
     {
         title: "System",
         value: "system",

src/dict/private-tables.ts

@@ -2,7 +2,8 @@ import type { TableType } from "@/src/types";
 
 /**
  * Tables holding secrets (password hashes, pending login codes, model
- * provider keys, envs, MCP servers' headers and env). They are never reachable through the admin CRUD API, not
+ * provider keys, envs, MCP servers' headers and env, hooks' token hashes
+ * and signing secrets). They are never reachable through the admin CRUD API, not
  * even by super admins.
  */
 export const PrivateTables: TableType[] = [
@@ -11,4 +12,5 @@ export const PrivateTables: TableType[] = [
     "harness_providers",
     "envs",
     "mcp_servers",
+    "bot_hooks",
 ];