feat(one): bridge in-app notifications to native OS notifications

ObjectOS One is a desktop client, but notifications were in-app only — the
Console bell (`sys_inbox_message`, ADR-0030 L5) is invisible when the window is
backgrounded, which is exactly when notifications matter. This adds a webview
bridge that mirrors new inbox messages to native OS notifications (macOS
Notification Center / Windows toast / Linux libnotify).

`assets/notification-bridge.js` is injected into every page alongside
update-banner.js (combined into one initialization script in windows.rs). It
no-ops outside the Console and outside Tauri. On the Console it polls the
canonical inbox object via the data API (`GET /api/v1/data/sys_inbox_message`
— the dedicated `/api/v1/notifications` route isn't mounted in this runtime),
dedupes by id (localStorage, baselined on first load so the backlog isn't
replayed), and when the window is backgrounded fires a native notification per
new message, badges the dock with the count missed while away (cleared on
focus), and focuses + deep-links on click (best-effort via the plugin's action
event).

No new Rust deps or capabilities needed: tauri-plugin-notification is already
registered (lib.rs) and `notification:default` + window show/focus perms are
already granted; withGlobalTauri exposes the JS API.

Verified the data contract end-to-end against a live 9.7.0 runtime: inserting a
real sys_inbox_message row, the bridge's fetch+parse extracts
title/body(body_md)/actionUrl(action_url)/id/createdAt correctly. The native
firing path (sendNotification/badge/focus) needs an actual Tauri build to
exercise — out of reach here (no cargo); the plumbing is in place.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

apps/objectos-one/src-tauri/assets/notification-bridge.js

@@ -0,0 +1,211 @@
+// Native OS notification bridge for ObjectOS One.
+//
+// Injected into every page of the main webview (alongside update-banner.js).
+// Activates only on the Console — where the in-app inbox lives — and only
+// inside Tauri. It polls the in-app inbox and, when the window is in the
+// background, surfaces each NEW message as a native OS notification (macOS
+// Notification Center / Windows toast / Linux libnotify), badges the dock with
+// the count missed while away, and focuses the app (deep-linking to the record
+// when the plugin reports the click).
+//
+// Source of truth is `sys_inbox_message` (ADR-0030 L5) — the same table the
+// Console bell reads. This only mirrors new rows to the OS so they reach the
+// user when the window isn't focused — the point of a desktop client. The
+// dedicated `/api/v1/notifications` route isn't mounted in this runtime, so we
+// read the canonical inbox object directly via the data API.
+(function () {
+  if (window.__objectosNotifyBridge) return;
+  // Only on the Console (its login/app routes live under /_console), and only
+  // when the Tauri bridge is present (no-op in a plain browser).
+  if (!/\/_console(\/|$)/.test(location.pathname)) return;
+  if (!window.__TAURI__) return;
+  window.__objectosNotifyBridge = true;
+
+  var T = window.__TAURI__;
+  var INBOX_URL = '/api/v1/data/sys_inbox_message?sort=-created_at&limit=25';
+  var POLL_MS = 20000;
+  var SEEN_KEY = '__objectos_notif_seen_v1';
+  var MAX_SEEN = 500;
+
+  var baselined = false; // first successful poll adopts the backlog silently
+  var inFlight = false;
+  var fatal = false; // inbox object absent → stop
+  var permission = false;
+  var unseen = 0; // count surfaced while backgrounded, cleared on focus
+  var pendingUrl = {}; // notification id → action_url, for click routing
+
+  function loadSeen() {
+    try {
+      return new Set(JSON.parse(localStorage.getItem(SEEN_KEY) || '[]'));
+    } catch (_) {
+      return new Set();
+    }
+  }
+  function saveSeen(set) {
+    try {
+      var arr = Array.from(set);
+      if (arr.length > MAX_SEEN) arr = arr.slice(arr.length - MAX_SEEN);
+      localStorage.setItem(SEEN_KEY, JSON.stringify(arr));
+    } catch (_) {}
+  }
+  var seen = loadSeen();
+
+  // Surface only when the user isn't actively looking at the window.
+  function backgrounded() {
+    return document.visibilityState === 'hidden' || !document.hasFocus();
+  }
+
+  function currentWindow() {
+    try {
+      var w = T.window;
+      if (!w) return null;
+      if (w.getCurrentWindow) return w.getCurrentWindow();
+      if (w.getCurrent) return w.getCurrent();
+    } catch (_) {}
+    return null;
+  }
+
+  async function ensurePermission() {
+    try {
+      var n = T.notification;
+      if (!n) return false;
+      if (await n.isPermissionGranted()) return true;
+      return (await n.requestPermission()) === 'granted';
+    } catch (_) {
+      return false;
+    }
+  }
+
+  async function notify(id, title, body) {
+    var opts = { title: title || 'Notification', body: body || '', tag: id };
+    try {
+      if (T.notification && T.notification.sendNotification) {
+        T.notification.sendNotification(opts);
+        return;
+      }
+    } catch (_) {}
+    // Fall back to the raw plugin command if the JS guest isn't on the global.
+    try {
+      await T.core.invoke('plugin:notification|notify', { options: opts });
+    } catch (_) {}
+  }
+
+  async function setBadge(count) {
+    var n = count > 0 ? count : null;
+    try {
+      if (T.app && T.app.setBadgeCount) {
+        await T.app.setBadgeCount(n);
+        return;
+      }
+    } catch (_) {}
+    try {
+      var w = currentWindow();
+      if (w && w.setBadgeCount) await w.setBadgeCount(n);
+    } catch (_) {}
+  }
+
+  async function focusAndOpen(actionUrl) {
+    var w = currentWindow();
+    if (w) {
+      try { await w.show(); } catch (_) {}
+      try { await w.unminimize(); } catch (_) {}
+      try { await w.setFocus(); } catch (_) {}
+    }
+    if (actionUrl) {
+      try { location.assign(actionUrl); } catch (_) {}
+    }
+  }
+
+  // Best-effort click routing: if this build exposes notification actions,
+  // clicking a toast focuses the app and deep-links to the record. When it
+  // doesn't, the OS default (focus the app) still applies; only the deep-link
+  // is lost.
+  (async function wireActions() {
+    try {
+      if (T.notification && T.notification.onAction) {
+        await T.notification.onAction(function (n) {
+          var tag = n && n.tag;
+          focusAndOpen(tag ? pendingUrl[tag] : null);
+        });
+      }
+    } catch (_) {}
+  })();
+
+  // sys_inbox_message → the minimal shape we need for a toast.
+  function view(row) {
+    return {
+      id: row && row.id,
+      title: (row && row.title) || (row && row.topic) || 'Notification',
+      body: (row && (row.body_md || row.body)) || '',
+      actionUrl: (row && row.action_url) || null,
+      createdAt: (row && row.created_at) || '',
+    };
+  }
+
+  async function poll() {
+    if (fatal || inFlight) return;
+    inFlight = true;
+    try {
+      var res = await fetch(INBOX_URL, {
+        headers: { accept: 'application/json' },
+        credentials: 'same-origin',
+      });
+      if (res.status === 401) return; // not signed in yet
+      if (res.status === 404) { fatal = true; return; } // no inbox object
+      if (!res.ok) return;
+
+      var json = await res.json();
+      var rows = (json && (json.records || json.items || json.data)) || [];
+      // Oldest-first so a burst toasts in chronological order.
+      var list = rows
+        .map(view)
+        .filter(function (v) { return v.id; })
+        .sort(function (a, b) {
+          return String(a.createdAt).localeCompare(String(b.createdAt));
+        });
+      var fresh = list.filter(function (v) { return !seen.has(v.id); });
+      if (!fresh.length) return;
+
+      if (!baselined) {
+        // First poll after a (re)load: adopt existing messages as baseline so
+        // we don't replay the backlog as a burst of toasts.
+        fresh.forEach(function (v) { seen.add(v.id); });
+        baselined = true;
+      } else {
+        var allowed = backgrounded() && permission;
+        fresh.forEach(function (v) {
+          seen.add(v.id);
+          if (allowed) {
+            pendingUrl[v.id] = v.actionUrl;
+            notify(v.id, v.title, String(v.body).slice(0, 240));
+            unseen += 1;
+          }
+        });
+        if (allowed && unseen > 0) setBadge(unseen);
+      }
+      saveSeen(seen);
+    } catch (_) {
+      // transient (offline, mid-navigation) — retry next tick
+    } finally {
+      inFlight = false;
+    }
+  }
+
+  function onForeground() {
+    // The user is looking now — clear the "missed while away" badge.
+    unseen = 0;
+    setBadge(0);
+    poll();
+  }
+
+  // Ask once up front, while the window is in the foreground, so the OS prompt
+  // isn't sprung from the background.
+  ensurePermission().then(function (g) { permission = g; });
+
+  poll();
+  setInterval(poll, POLL_MS);
+  document.addEventListener('visibilitychange', function () {
+    if (document.visibilityState === 'visible') onForeground();
+  });
+  window.addEventListener('focus', onForeground);
+})();

apps/objectos-one/src-tauri/src/windows.rs

@@ -19,15 +19,23 @@ use crate::{logger::log_line, sidecar};
 /// otherwise discard the splash page's listeners).
 const UPDATE_BANNER_JS: &str = include_str!("../assets/update-banner.js");
 
+/// Mirrors the Console's in-app inbox to native OS notifications when the
+/// window is backgrounded (and keeps the dock badge in sync). Injected into
+/// every page; it no-ops outside the Console and outside Tauri.
+const NOTIFICATION_BRIDGE_JS: &str = include_str!("../assets/notification-bridge.js");
+
 pub fn build_main(app: &AppHandle) -> tauri::Result<()> {
     let app_handle = app.clone();
+    // Combine the injected bootstrap scripts into one so both reliably run on
+    // every page the webview loads.
+    let bootstrap = format!("{UPDATE_BANNER_JS}\n{NOTIFICATION_BRIDGE_JS}");
     let _win = WebviewWindowBuilder::new(app, "main", WebviewUrl::App("index.html".into()))
         .title("ObjectOS")
         .inner_size(1280.0, 820.0)
         .min_inner_size(960.0, 600.0)
         .resizable(true)
         .center()
-        .initialization_script(UPDATE_BANNER_JS)
+        .initialization_script(bootstrap.as_str())
         .on_navigation(move |url| {
             if is_external_link(url) {
                 use tauri_plugin_opener::OpenerExt;