Let outside services and computers' browser notifications give bots work

A bot hook (bot_hooks) is a secret URL, POST /api/hooks/<token>, whose
calls queue the hook's brief plus the raw body as a task, per user and
bot like a routine. Only the token's hash is kept (shown once, rotatable);
an optional HMAC-SHA256 signing secret is stored encrypted. Calls are
rate limited per address and per hook, recorded in bot_hook_events
(pruned daily), deduplicated by delivery id, and a call while the last
run still waits joins its brief instead of queueing another. The payload
is fenced data and HookRunNote tells the bot never to take instructions
from it; failed runs retry like routines.

A hook can instead watch a computer's browser notifications: the app
installs a small watcher that owns org.freedesktop.Notifications on the
sandbox's session bus, so Chrome hands it every notification (it only
looks for that service at start-up, so Chrome is restarted once, never
mid-task), and it posts each one to its hooks, optionally filtered.
Computers reach the app at COMPUTER_APP_URL or the app container's name.

Users make hooks in the conversation's Hooks modal and manage them all
on /admin/routines; bots never create or change hooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/types/index.ts

@@ -8,6 +8,7 @@ import type {
     BUN_SQLITE_COBBLE_BOTS_QUEUE_UPDATES,
     BUN_SQLITE_COBBLE_COMPUTERS,
     BUN_SQLITE_COBBLE_CRON_JOBS,
+    BUN_SQLITE_COBBLE_BOT_HOOKS,
     BUN_SQLITE_COBBLE_MEDIA,
     BUN_SQLITE_COBBLE_TASK_MEDIA,
     BUN_SQLITE_COBBLE_TASK_NOTES,
@@ -108,6 +109,58 @@ export type CronJobWithNames = BUN_SQLITE_COBBLE_CRON_JOBS & {
     workspace_name?: string | null;
 };
 
+/**
+ * A bot's hook as its owner sees it: never its token hash or signing
+ * secret, only whether it has one, with its bot (its face as the user sees
+ * it) and workspace names.
+ */
+export type BotHookWithNames = Omit<BUN_SQLITE_COBBLE_BOT_HOOKS, "token_hash" | "signing_secret" | "watch_token"> & {
+    has_signing_secret?: number | null;
+    /**
+     * For browser notifications: the watched computer's name.
+     */
+    watch_computer_name?: string | null;
+    bot_name?: string | null;
+    bot_kind?: string | null;
+    bot_hue?: string | null;
+    bot_color?: string | null;
+    bot_stone?: string | null;
+    bot_face?: string | null;
+    bot_image_media_id?: number | null;
+    workspace_name?: string | null;
+};
+
+/**
+ * What syncing a computer's notification watcher did
+ * (`syncComputerNotifyWatch`).
+ */
+export type NotifyWatchSync = {
+    ok: boolean;
+    /**
+     * Whether the watcher runs (false when no hook wants it).
+     */
+    watching: boolean;
+    /**
+     * `restarted`: Chrome was restarted so it sends notifications to the
+     * watcher. `needs_restart`: it still has to be, once the task working
+     * there is done (the next sync does it).
+     */
+    browser?: "ok" | "restarted" | "needs_restart" | "missing";
+    hooks: number;
+    error?: string;
+};
+
+/**
+ * A hook just made or given a new token. A URL hook's token is shown this
+ * once; a browser-notification hook has none to show, only how setting up
+ * its computer's watcher went.
+ */
+export type BotHookWithToken = {
+    hook: BotHookWithNames;
+    token?: string;
+    watch?: NotifyWatchSync;
+};
+
 /**
  * A task with what a list shows beside it: the bot and workspace it belongs
  * to, and its latest note.
@@ -1445,6 +1498,10 @@ export type PagePropsType = {
      * The routines page: every schedule the user's bots have.
      */
     cron_jobs?: CronJobWithNames[] | null;
+    /**
+     * The routines page: every hook the user gave their bots.
+     */
+    bot_hooks?: BotHookWithNames[] | null;
     environment?: string;
     has_password?: boolean;
     backups?: DbBackup[] | null;