Let outside services and computers' browser notifications give bots work

A bot hook (bot_hooks) is a secret URL, POST /api/hooks/<token>, whose
calls queue the hook's brief plus the raw body as a task, per user and
bot like a routine. Only the token's hash is kept (shown once, rotatable);
an optional HMAC-SHA256 signing secret is stored encrypted. Calls are
rate limited per address and per hook, recorded in bot_hook_events
(pruned daily), deduplicated by delivery id, and a call while the last
run still waits joins its brief instead of queueing another. The payload
is fenced data and HookRunNote tells the bot never to take instructions
from it; failed runs retry like routines.

A hook can instead watch a computer's browser notifications: the app
installs a small watcher that owns org.freedesktop.Notifications on the
sandbox's session bus, so Chrome hands it every notification (it only
looks for that service at start-up, so Chrome is restarted once, never
mid-task), and it posts each one to its hooks, optionally filtered.
Computers reach the app at COMPUTER_APP_URL or the app container's name.

Users make hooks in the conversation's Hooks modal and manage them all
on /admin/routines; bots never create or change hooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/bot-hooks/delete-bot-hook.ts

@@ -0,0 +1,38 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import grabUserBotHook from "./grab-user-bot-hook";
+import syncComputerNotifyWatch from "./sync-computer-notify-watch";
+
+type Params = {
+    user_id: number | string;
+    hook_id: number | string;
+};
+
+/**
+ * Deletes one of the user's hooks and its recorded calls (foreign keys
+ * are off outside the server, so the calls go first, explicitly). A run
+ * already queued carries on. A notification hook's URL is taken off its
+ * computer's watcher.
+ */
+export default async function deleteBotHook({ user_id, hook_id }: Params) {
+    const hook = await grabUserBotHook({ user_id, hook_id });
+
+    await BunSQLite.sql({
+        sql: `DELETE FROM bot_hook_events WHERE hook_id = ?`,
+        values: [hook.id!],
+    });
+
+    const res = await BunSQLite.sql({
+        sql: `DELETE FROM bot_hooks WHERE id = ?`,
+        values: [hook.id!],
+    });
+
+    if (!res.success) {
+        throw new Error(`Couldn't delete the hook: ${res.error}`);
+    }
+
+    if (hook.source == "browser_notifications" && hook.watch_computer_id) {
+        await syncComputerNotifyWatch({ computer_id: hook.watch_computer_id });
+    }
+
+    return hook;
+}