Let outside services and computers' browser notifications give bots work

A bot hook (bot_hooks) is a secret URL, POST /api/hooks/<token>, whose
calls queue the hook's brief plus the raw body as a task, per user and
bot like a routine. Only the token's hash is kept (shown once, rotatable);
an optional HMAC-SHA256 signing secret is stored encrypted. Calls are
rate limited per address and per hook, recorded in bot_hook_events
(pruned daily), deduplicated by delivery id, and a call while the last
run still waits joins its brief instead of queueing another. The payload
is fenced data and HookRunNote tells the bot never to take instructions
from it; failed runs retry like routines.

A hook can instead watch a computer's browser notifications: the app
installs a small watcher that owns org.freedesktop.Notifications on the
sandbox's session bus, so Chrome hands it every notification (it only
looks for that service at start-up, so Chrome is restarted once, never
mid-task), and it posts each one to its hooks, optionally filtered.
Computers reach the app at COMPUTER_APP_URL or the app container's name.

Users make hooks in the conversation's Hooks modal and manage them all
on /admin/routines; bots never create or change hooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/hook-subtitle.ts

@@ -0,0 +1,37 @@
+import type { BotHookWithNames } from "@/src/types";
+import relativeTime from "./relative-time";
+
+type Params = {
+    hook: BotHookWithNames;
+    now?: number;
+    /**
+     * Shown by default; left out where the conversation already is the
+     * bot's (or the workspace's).
+     */
+    show_bot?: boolean;
+    show_workspace?: boolean;
+};
+
+/**
+ * The line under a hook's name: whose it is, where it runs, which
+ * computer's notifications it gets (and its filter), how many runs
+ * it started and when it was last called, whether calls must be signed,
+ * then why its last call or run failed.
+ */
+export default function hookSubtitle({ hook, now = Date.now(), show_bot = true, show_workspace = true }: Params) {
+    const runs = Number(hook.run_count || 0);
+
+    return [
+        show_bot ? hook.bot_name || "A bot" : "",
+        show_workspace ? hook.workspace_name || "" : "",
+        hook.source == "browser_notifications"
+            ? `notifications on ${hook.watch_computer_name || "a computer"}${hook.watch_filter ? ` with "${hook.watch_filter}"` : ""}`
+            : "",
+        `${runs} ${runs == 1 ? "run" : "runs"}`,
+        hook.last_called_at ? `called ${relativeTime({ at: hook.last_called_at, now })}` : "never called",
+        hook.has_signing_secret ? "signed" : "",
+        hook.last_error || "",
+    ]
+        .filter(Boolean)
+        .join(" · ");
+}