fix: isolate Web Push device failures (Closes #655)

Merge pull request 'Restrict Web Push delivery to public endpoints' (#654)

README.md

@@ -199,6 +199,9 @@ export STACKCHAIN_TRUSTED_PROXY_CIDRS='127.0.0.0/8'
 # three individual alerts followed by one private digest that opens Updates. A later
 # comment on an already-delivered thread triggers a fresh alert when Gitea advances
 # that thread's updated_at revision; unchanged and older snapshots remain silent.
+# Browser push services must resolve exclusively to public IP addresses. Stackchain
+# validates endpoints at enrollment and again before delivery, rejects redirects,
+# and removes legacy subscriptions that resolve to private or reserved networks.
 export STACKCHAIN_VAPID_PUBLIC_KEY='<url-safe-public-key>'
 export STACKCHAIN_VAPID_PRIVATE_KEY='<private-key-from-secret-manager>'
 export STACKCHAIN_VAPID_SUBJECT='mailto:ops@example.com'

frontend/dashboard.css

@@ -10,6 +10,9 @@ header { position: sticky; top: 0; z-index: 20; padding: 12px 16px; display:flex
 .app-menu > summary { display:none; }
 .app-menu-panel { display:flex; gap:10px; align-items:center; flex-wrap:wrap; }
 button { background: linear-gradient(180deg,#1f3a5f,#15324d); border:1px solid #2a496e; color:#e5e7eb; padding:8px 12px; border-radius:10px; cursor:pointer; }
+.notification-undo { position:fixed; z-index:110; left:50%; bottom:calc(88px + env(safe-area-inset-bottom)); transform:translateX(-50%); box-sizing:border-box; width:min(520px,calc(100vw - 24px)); display:flex; align-items:center; justify-content:space-between; gap:12px; padding:10px 12px; border:1px solid #60a5fa; border-radius:12px; background:#10233d; box-shadow:0 12px 36px rgba(0,0,0,.5); overflow-wrap:anywhere; }
+.notification-undo[hidden] { display:none; }
+.notification-undo button { min-height:44px; min-width:64px; flex:none; }
 .draft-capacity-sheet { position:fixed; inset:0; z-index:96; display:flex; align-items:flex-end; justify-content:center; background:rgba(5,12,21,.82); backdrop-filter:blur(4px); }
 .draft-capacity-sheet[hidden] { display:none; }
 .draft-capacity-panel { box-sizing:border-box; width:min(620px,100%); max-height:100dvh; overflow:auto; overflow-x:hidden; padding:18px; padding-bottom:calc(18px + env(safe-area-inset-bottom)); border:1px solid #b45309; border-radius:18px 18px 0 0; background:#0b1526; }
@@ -557,8 +560,7 @@ textarea { resize: vertical; min-height: 120px; }
   .my-work { margin:0; }
   .attention-interruption:not([hidden]) { position:sticky; top:64px; z-index:6; margin-inline:max(0px,env(safe-area-inset-left)) max(0px,env(safe-area-inset-right)); }
   .my-work-header { align-items:flex-start; }
-  .my-work-actions { width:100%; flex-wrap:nowrap; }
-  .my-work-actions button { min-height:44px; flex:1 1 0; padding-inline:6px; }
+  .my-work-actions { display:none; }
   .work-settings > summary { min-height:44px; display:flex; align-items:center; cursor:pointer; padding:0 10px; border:1px solid #2a496e; border-radius:10px; font-weight:700; }
   .work-settings:not([open]) > .work-settings-panel { display:none; }
   .work-settings-panel { display:grid; gap:10px; margin-top:8px; }

frontend/dashboard.js

@@ -37,7 +37,7 @@
       try {
         localStorage.setItem(PANEL_STATE_KEY, JSON.stringify(state));
       } catch (e) {
-        console.warn('Could not persist panel state', e);
+        console.warn('Panel state save failed', e);
       }
     });
   });
@@ -95,7 +95,7 @@
       Array.from(document.querySelectorAll('[data-mobile-queue-count]')).map(element => [element.dataset.mobileQueueCount, element])
     ),
     queueBadge: qs('#mobile-queue-count'),
-    onSelectQueue: name => mobileQueueLauncher.open(name),
+    onSelectQueue:name => name === 'recaps' ? qs('#open-today-recaps').click() : mobileQueueLauncher.open(name),
     overlays: mobileTaskOverlays,
     actions: {
       work: () => mobileWorkEntry.open(),
@@ -129,7 +129,7 @@
     const savedMilestone = sessionStorage.getItem(WORK_MILESTONE_KEY);
     if (savedMilestone) selectedWorkMilestone = savedMilestone;
   } catch (e) {
-    console.warn('Could not restore My Work filter', e);
+    console.warn('Filter restore failed', e);
   }
   let lastMyWork = [];
   let lastDrafts = [];
@@ -786,6 +786,15 @@
       if (state.message) qs('#update-sheet-status').textContent = state.message;
     },
   });
+  const notificationUndo = createDashboardNotificationUndo({
+    restore: requestNotificationUnread,
+    getItems: () => lastMyWork,
+    setItems: items => { lastMyWork = items; },
+    getNotifications: () => lastNotifications,
+    setNotifications: items => { lastNotifications = items; },
+    refresh: refreshMyWorkView,
+    select: qs,
+  });
   const notificationReader = createNotificationReader({
     load: fetchNotificationDetail,
     loadConversation: fetchNotificationConversation,
@@ -927,6 +936,7 @@
       else if (item.kind === 'issue') openIssueSheet(item, issueTrigger);
       else if (item.kind === 'pull') openPullSheet(item, pullTrigger);
     },
+    onQueue: openWorkQueueRoute,
     onClose: () => {
       if (selectedIssue) closeIssueSheet(false);
       if (selectedPull) closePullSheet(false);
@@ -3684,7 +3694,6 @@
     } else {
       setEventStreamStatus('Update failed · showing last activity');
     }
-    // Compatibility fallback for snapshots produced before section metadata.
     if (!eventsFreshness && snapshot.freshness?.degraded && !snapshot.freshness.revalidating) {
       const retrySeconds = Number(snapshot.freshness.retry_in_seconds) || 0;
       setEventStreamStatus('Refresh failed · showing last known data' +
@@ -5033,6 +5042,9 @@
       if (result?.accepted) qs('#my-work-action-status').textContent =
         result.delivery === 'posted' ? 'Reply posted and update marked read.' :
           'Reply and read acknowledgement queued for sync.';
+      if (result?.delivery === 'posted' && result?.next) {
+        notificationUndo.offer(item, result.next.items);
+      }
     } catch (error) {
       qs('#update-reply-status').textContent = error.message + ' Your draft is safe; retry.';
       qs('#update-reply').focus();
@@ -5045,7 +5057,8 @@
   qs('#mark-update-read-next').addEventListener('click', async () => {
     qs('#mark-update-read-next').disabled = true;
     try {
-      await notificationReader.markReadAndNext(lastMyWork);
+      const result = await notificationReader.markReadAndNext(lastMyWork);
+      if (result) notificationUndo.offer(result.item, result.items);
     } finally {
       qs('#mark-update-read-next').disabled = false;
     }
@@ -5055,11 +5068,17 @@
     button.disabled = true;
     try {
       const result = await notificationReader.acknowledgeAndNext(lastMyWork);
-      if (result) qs('#my-work-action-status').textContent = 'Update acknowledged with 👍.';
+      if (result) notificationUndo.offer(result.item, result.items);
     } finally {
       button.disabled = offlineWorkMode;
     }
   });
+  qs('#undo-notification').addEventListener('click', async () => {
+    const button = qs('#undo-notification');
+    button.disabled = true;
+    const restored = await notificationUndo.run();
+    button.disabled = restored;
+  });
   qs('#close-review-sheet').addEventListener('click', closeReviewSheet);
   qs('#retry-review-load').addEventListener('click', () => {
     if (selectedReview) openReviewSheet(selectedReview, reviewTrigger);
@@ -5521,25 +5540,41 @@
   document.querySelectorAll('[data-work-filter]').forEach(button => {
     button.setAttribute('aria-pressed', String(button.dataset.workFilter === selectedWorkFilter));
     button.addEventListener('click', () => {
-      const leavingUpdates = selectedWorkFilter === 'update' && button.dataset.workFilter !== 'update';
-      selectedWorkFilter = button.dataset.workFilter;
-      if (leavingUpdates && notificationSelection.snapshot().active) notificationSelection.cancel();
-      savedWorkFilter = selectedWorkFilter;
-      launchFilterResolved = true;
-      try {
-        sessionStorage.setItem(WORK_FILTER_KEY, selectedWorkFilter);
-      } catch (e) {
-        console.warn('Could not persist My Work filter', e);
-      }
-      document.querySelectorAll('[data-work-filter]').forEach(item =>
-        item.setAttribute('aria-pressed', String(item === button))
-      );
-      const selectedCount = button.querySelector('[data-work-count]').textContent;
-      qs('#active-work-queue').textContent = button.firstChild.textContent.trim() + ' (' + selectedCount + ')';
-      renderMyWork();
-      updateWorkPaginationControls();
+      selectWorkQueue(button.dataset.workFilter);
     });
   });
+  function selectWorkQueue(filter, { preserveRoute = false } = {}) {
+    const button = qs('[data-work-filter="' + filter + '"]');
+    if (!button) return false;
+    const leavingUpdates = selectedWorkFilter === 'update' && filter !== 'update';
+    selectedWorkFilter = filter;
+    if (leavingUpdates && notificationSelection.snapshot().active) notificationSelection.cancel();
+    savedWorkFilter = selectedWorkFilter;
+    launchFilterResolved = true;
+    try {
+      sessionStorage.setItem(WORK_FILTER_KEY, selectedWorkFilter);
+    } catch (e) {
+      console.warn('Filter save failed', e);
+    }
+    document.querySelectorAll('[data-work-filter]').forEach(item =>
+      item.setAttribute('aria-pressed', String(item === button))
+    );
+    const selectedCount = button.querySelector('[data-work-count]').textContent;
+    qs('#active-work-queue').textContent = button.firstChild.textContent.trim() + ' (' + selectedCount + ')';
+    renderMyWork();
+    updateWorkPaginationControls();
+    if (!preserveRoute && filter === 'update' && window.location.hash !== '#/my-work/updates') {
+      window.history.pushState({ workQueue:'update' }, '', '#/my-work/updates');
+    } else if (!preserveRoute && filter !== 'update' && window.location.hash === '#/my-work/updates') {
+      window.history.replaceState(null, '', window.location.pathname + window.location.search);
+    }
+    return true;
+  }
+  function openWorkQueueRoute(filter) {
+    if (!selectWorkQueue(filter, { preserveRoute:true })) return;
+    qs('#my-work').scrollIntoView({block:'start'});
+    qs('#my-work').focus();
+  }
   function openDeliveryReceiptRoute() {
     if (window.location.hash !== '#/my-work/drafts') return;
     qs('[data-work-filter="draft"]').click();
@@ -5551,7 +5586,7 @@
   qs('#work-milestone-filter').addEventListener('change', event => {
     selectedWorkMilestone = event.target.value;
     try { sessionStorage.setItem(WORK_MILESTONE_KEY, selectedWorkMilestone); }
-    catch (e) { console.warn('Could not persist My Work milestone lane', e); }
+    catch (e) { console.warn('Milestone save failed', e); }
     renderMyWork();
     if (workSession.active()) workSession.reconcile();
   });

frontend/index.html

@@ -688,6 +688,11 @@
   </section>
 </div>
 
+<div class="notification-undo" id="notification-undo" role="status" aria-live="assertive" hidden>
+  <span id="notification-undo-status"></span>
+  <button id="undo-notification" type="button" aria-label="Undo marking update read">Undo</button>
+</div>
+
 <div class="pull-sheet" id="pull-sheet" role="dialog" aria-modal="true" aria-labelledby="pull-sheet-title">
   <section class="pull-sheet-panel">
     <div class="pull-sheet-header">
@@ -864,6 +869,7 @@
       <button data-mobile-queue="update" type="button" aria-label="Updates, 0 unread conversations"><span><strong>Updates</strong><small>Unread conversations</small></span><span data-mobile-queue-count="update">0</span></button>
       <button data-mobile-queue="later" type="button"><span><strong>Later</strong><small>Deferred work</small></span><span data-mobile-queue-count="later">0</span></button>
       <button data-mobile-queue="draft" type="button"><span><strong>Drafts</strong><small>Unfiled captures</small></span><span data-mobile-queue-count="draft">0</span></button>
+      <button data-mobile-queue="recaps" type="button"><span><strong>Recaps</strong><small>History</small></span></button>
     </div>
   </section>
 </dialog>
@@ -899,6 +905,7 @@
 <script src="static/offline-work.js"></script>
 <script src="static/offline-today.js"></script>
 <script src="static/my-work.js"></script>
+<script src="static/notification-undo.js"></script>
 <script src="static/card-planning.js"></script>
 <script src="static/today-work.js"></script>
 <script src="static/today-timer.js"></script>

frontend/mobile-task-dock.js

@@ -34,7 +34,7 @@
   }
 
   function closeQueues() {
-    if (options.queueSheet?.open) options.queueSheet.close();
+    options.queueSheet?.open && options.queueSheet.close();
   }
 
   function start() {
@@ -42,8 +42,7 @@
       button.addEventListener('click', event => {
         launcher = event.currentTarget;
         select(name);
-        if (name === 'queues' && options.queueSheet) openQueues();
-        else options.actions[name]();
+        name === 'queues' && options.queueSheet ? openQueues() : options.actions[name]();
       });
     });
     if (options.queueSheet) {
@@ -56,7 +55,7 @@
       Object.entries(options.queueRows || {}).forEach(([name, row]) => {
         row.addEventListener('click', () => {
           closeQueues();
-          options.onSelectQueue?.(name);
+          options.onSelectQueue?.(name, row);
         });
       });
     }
@@ -95,10 +94,8 @@
   }
 
   function updateQueues(counts) {
-    const names = ['today', 'attention', 'update', 'later', 'draft'];
+    const names = 'today attention update later draft'.split(' ');
     const normalized = Object.fromEntries(names.map(name => [name, Math.max(0, Number(counts?.[name]) || 0)]));
-    // Updates are already represented by the Attention destination, so keep
-    // the dock aggregate non-overlapping while exposing the useful drill-down.
     const total = ['today', 'attention', 'later', 'draft'].reduce((sum, name) => sum + normalized[name], 0);
     Object.entries(options.queueCounts || {}).forEach(([name, element]) => {
       element.textContent = String(normalized[name] || 0);
@@ -110,7 +107,7 @@
       options.queueBadge.textContent = String(total);
       options.queueBadge.hidden = total === 0;
     }
-    if (buttons.queues) buttons.queues.setAttribute('aria-label', 'Queues, ' + total + ' items');
+    buttons.queues?.setAttribute('aria-label', 'Queues, ' + total + ' items');
   }
 
   return {start, select, refreshVisibility, updateAttention, updateQueues, updateWork};

frontend/my-work.js

@@ -362,7 +362,7 @@ function createNotificationReader({
       onClose();
       onStatus('Inbox cleared.');
     }
-    return { items: updated, next: next || null };
+    return { items: updated, item: current, next: next || null };
   }
 
   async function open(item, savedDetail = null) {

frontend/notification-undo.js

@@ -0,0 +1,85 @@
+function createNotificationUndo({ restore, onItems, onStatus, onOffer = () => {}, onClear = () => {} }) {
+  let offered = null;
+  let pending = false;
+
+  return {
+    offer(item, items) {
+      if (!item || !Number.isInteger(item.notification_id)) return false;
+      offered = { item, items: Array.isArray(items) ? [...items] : [] };
+      const label = item.key || 'Update';
+      onStatus(label + ' marked read. Undo?');
+      onOffer(item);
+      return true;
+    },
+    async run() {
+      if (!offered || pending) return false;
+      const current = offered;
+      const label = current.item.key || 'Update';
+      pending = true;
+      onStatus('Restoring ' + label + '…');
+      try {
+        await restore(current.item.notification_id);
+        if (offered !== current) return false;
+        const restored = [current.item].concat(current.items.filter(
+          item => item?.notification_id !== current.item.notification_id
+        ));
+        offered = null;
+        onItems(restored, current.item);
+        onStatus(label + ' is unread again.');
+        onClear();
+        return true;
+      } catch (_error) {
+        onStatus('Could not restore ' + label + '. Retry Undo.');
+        return false;
+      } finally {
+        pending = false;
+      }
+    },
+    clear() {
+      offered = null;
+      onClear();
+    },
+  };
+}
+
+async function requestNotificationUnread(notificationId) {
+  const response = await fetch('api/v1/notifications/' + encodeURIComponent(notificationId) + '/unread', {
+    method: 'PATCH', headers: { Accept: 'application/json' },
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(payload.error || 'Restore unread failed.');
+  return payload;
+}
+
+function createDashboardNotificationUndo({ restore, getItems, setItems, getNotifications, setNotifications, refresh, select }) {
+  let timer = null;
+  const controller = createNotificationUndo({
+    restore,
+    onItems: (items, restored) => {
+      setItems(items);
+      const notifications = getNotifications();
+      if (!notifications.some(item => item.id === restored.notification_id)) {
+        setNotifications([{ id:restored.notification_id }].concat(notifications));
+      }
+      refresh();
+    },
+    onStatus: message => {
+      select('#notification-undo-status').textContent = message;
+      select('#my-work-action-status').textContent = message;
+    },
+    onOffer: item => {
+      clearTimeout(timer);
+      select('#notification-undo').hidden = false;
+      select('#undo-notification').disabled = false;
+      select('#undo-notification').setAttribute('aria-label', 'Undo marking ' + (item.key || 'update') + ' read');
+      timer = setTimeout(() => controller.clear(), 10000);
+    },
+    onClear: () => { select('#notification-undo').hidden = true; },
+  });
+  return controller;
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = createNotificationUndo;
+  module.exports.createDashboardNotificationUndo = createDashboardNotificationUndo;
+}

frontend/service-worker.js

@@ -32,6 +32,7 @@ const SHELL = [
   BASE + 'static/offline-work.js',
   BASE + 'static/offline-today.js',
   BASE + 'static/my-work.js',
+  BASE + 'static/notification-undo.js',
   BASE + 'static/card-planning.js',
   BASE + 'static/today-work.js',
   BASE + 'static/today-timer.js',

frontend/work-route.js

@@ -15,6 +15,9 @@
   function parse(fragment) {
     const parts = String(fragment || '').split('/');
     if (parts[0] !== '#' || parts[1] !== 'my-work') return null;
+    if (parts[2] === 'updates' && parts.length === 3) {
+      return { kind: 'queue', filter: 'update' };
+    }
     if (parts[2] === 'update' && parts.length === 4) {
       const notificationId = positiveInteger(parts[3]);
       return notificationId ? { kind: 'update', notification_id: notificationId } : null;
@@ -38,6 +41,7 @@
   }
 
   function sameRoute(item, route) {
+    if (route.kind === 'queue') return false;
     if (route.kind === 'update') {
       return Number(item.notification_id) === route.notification_id;
     }
@@ -48,6 +52,7 @@
 
   function createController({
     location, history, eventTarget, onOpen, onClose, onInvalid,
+    onQueue = function () {},
     resolve, onResolving = function () {}, onError = function () {},
   }) {
     let items = [];
@@ -100,6 +105,16 @@
         active = '';
         return;
       }
+      if (route.kind === 'queue') {
+        if (!ready) return;
+        resolution += 1;
+        resolving = '';
+        if (active && active !== fragment) onClose();
+        if (active === fragment) return;
+        active = fragment;
+        onQueue(route.filter);
+        return;
+      }
       const item = items.find(candidate => sameRoute(candidate, route));
       if (!item) {
         if (ready) resolveMissing(fragment, route);

src/frontend_bundle.py

@@ -28,7 +28,7 @@ FEATURE_SOURCES = {
     "device-setup": ("static/install-app.js", "static/mobile-device-setup.js"),
     "security-center": ("static/security-center.js",),
     "today-timer": (
-        "static/mobile-task-dock.js", "static/today-timer.js", "static/today-recap.js",
+        "static/mobile-task-dock.js", "static/notification-undo.js", "static/today-timer.js", "static/today-recap.js",
         "static/today-rollover.js", "static/drafts.js", "static/unfiled-captures.js",
         "static/draft-filing-session.js", "static/draft-capacity-dialog.js",
     ),

src/gitea_proxy.py

@@ -804,6 +804,14 @@ async def mark_notification_read(thread_id: int) -> None:
     response.raise_for_status()
 
 
+async def mark_notification_unread(thread_id: int) -> None:
+    response = await _get_client().patch(
+        f"/api/v1/notifications/threads/{thread_id}?to-status=unread",
+        headers=_auth(),
+    )
+    response.raise_for_status()
+
+
 async def acknowledge_notification(thread_id: int) -> dict:
     thread = await fetch(f"notifications/threads/{thread_id}")
     if not isinstance(thread, dict):

src/main.py

@@ -48,6 +48,7 @@ from src.live_snapshot_store import (
 from src.models import Issue, Milestone, PullRequest, Repo, User
 from src.passkey_store import PasskeyStore
 from src.push_notifications import PushConfiguration, dispatch_unread_updates
+from src.push_endpoint_policy import UnsafePushEndpoint, validate_public_push_endpoint
 from src.push_subscription_store import PushSubscriptionStore
 from src.request_boundary import RequestBodyLimitMiddleware, request_body_limit
 from src.security_event_store import SecurityEventStore, SecurityEventStoreError
@@ -1808,6 +1809,10 @@ async def push_status(request: Request):
 async def subscribe_push(payload: PushSubscriptionPayload, request: Request):
     if not _push_configuration().enabled:
         raise HTTPException(status_code=503, detail="Push notifications are not configured")
+    try:
+        await validate_public_push_endpoint(payload.endpoint)
+    except UnsafePushEndpoint as error:
+        raise HTTPException(status_code=422, detail=str(error)) from error
     device_id = await dashboard_auth.session_management_id(
         request.state.dashboard_session
     )
@@ -3452,6 +3457,27 @@ async def read_notification(thread_id: int = PathParam(gt=0)) -> JSONResponse:
     return JSONResponse({"id": thread_id, "status": "read"})
 
 
+@app.patch("/api/v1/notifications/{thread_id}/unread")
+async def unread_notification(thread_id: int = PathParam(gt=0)) -> JSONResponse:
+    try:
+        await asyncio.wait_for(
+            gitea_proxy.mark_notification_unread(thread_id),
+            timeout=NOTIFICATION_MUTATION_TIMEOUT_SECONDS,
+        )
+    except TimeoutError:
+        return JSONResponse(
+            {"error": "Restoring the update timed out. Retry Undo."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    except Exception:
+        return JSONResponse(
+            {"error": "The update could not be restored. Retry Undo."},
+            status_code=503,
+        )
+    return JSONResponse({"id": thread_id, "status": "unread"})
+
+
 @app.patch("/api/v1/notifications/{thread_id}/later")
 async def defer_notification(
     payload: NotificationLaterRequest,

src/push_endpoint_policy.py

@@ -0,0 +1,62 @@
+import asyncio
+import ipaddress
+import socket
+from collections.abc import Awaitable, Callable
+from urllib.parse import urlsplit
+
+
+class UnsafePushEndpoint(ValueError):
+    """Raised when a Web Push endpoint could reach a non-public service."""
+
+
+Resolver = Callable[[str, int], Awaitable[list[str]]]
+
+
+async def _resolve(host: str, port: int) -> list[str]:
+    loop = asyncio.get_running_loop()
+    records = await loop.getaddrinfo(
+        host,
+        port,
+        family=socket.AF_UNSPEC,
+        type=socket.SOCK_STREAM,
+    )
+    return sorted({record[4][0] for record in records})
+
+
+async def validate_public_push_endpoint(
+    endpoint: str,
+    *,
+    resolver: Resolver = _resolve,
+    timeout_seconds: float = 2.0,
+) -> str:
+    """Return a canonical public HTTPS push endpoint or fail closed."""
+    parsed = urlsplit(endpoint)
+    try:
+        port = parsed.port
+    except ValueError as error:
+        raise UnsafePushEndpoint(
+            "Endpoint must be a canonical public Web Push service URL"
+        ) from error
+    if (
+        parsed.scheme != "https"
+        or not parsed.hostname
+        or parsed.username is not None
+        or parsed.password is not None
+        or parsed.fragment
+        or port not in {None, 443}
+    ):
+        raise UnsafePushEndpoint("Endpoint must be a canonical public Web Push service URL")
+    try:
+        addresses = await asyncio.wait_for(
+            resolver(parsed.hostname, port or 443),
+            timeout=max(0.01, timeout_seconds),
+        )
+    except (OSError, asyncio.TimeoutError) as error:
+        raise UnsafePushEndpoint("Endpoint must resolve to a public Web Push service") from error
+    try:
+        public = addresses and all(ipaddress.ip_address(address).is_global for address in addresses)
+    except ValueError as error:
+        raise UnsafePushEndpoint("Endpoint must resolve to a public Web Push service") from error
+    if not public:
+        raise UnsafePushEndpoint("Endpoint must resolve to a public Web Push service")
+    return endpoint

src/push_notifications.py

@@ -6,6 +6,7 @@ from dataclasses import dataclass
 from typing import Awaitable, Callable
 
 from src.push_subscription_store import PushSubscriptionStore
+from src.push_endpoint_policy import UnsafePushEndpoint, validate_public_push_endpoint
 
 
 @dataclass(frozen=True)
@@ -22,8 +23,12 @@ class PushConfiguration:
 async def send_web_push(
     subscription: dict, payload: str, configuration: PushConfiguration
 ) -> None:
+    import requests
     from pywebpush import webpush
 
+    session = requests.Session()
+    session.max_redirects = 0
+
     await asyncio.to_thread(
         webpush,
         subscription_info=subscription,
@@ -31,6 +36,8 @@ async def send_web_push(
         vapid_private_key=configuration.private_key,
         vapid_claims={"sub": configuration.subject},
         ttl=300,
+        timeout=10,
+        requests_session=session,
     )
 
 
@@ -45,6 +52,7 @@ async def dispatch_unread_updates(
     send_timeout_seconds: float = 10.0,
     max_concurrency: int = 8,
     max_individual_notifications: int = 3,
+    endpoint_validator: Callable[[str], Awaitable[str]] | None = None,
 ) -> int:
     if not configuration.enabled:
         return 0
@@ -90,6 +98,15 @@ async def dispatch_unread_updates(
             async with semaphore:
                 if ownership_lost.is_set():
                     return 0
+                validate_endpoint = endpoint_validator
+                if validate_endpoint is None and send is None:
+                    validate_endpoint = validate_public_push_endpoint
+                try:
+                    if validate_endpoint is not None:
+                        await validate_endpoint(delivery.subscription["endpoint"])
+                except UnsafePushEndpoint:
+                    await asyncio.to_thread(store.delete_session, delivery.session_id)
+                    return 0
                 count = 0
                 digest_pending = set(delivery.digest_revisions)
                 new_revisions = tuple(
@@ -202,8 +219,17 @@ async def dispatch_unread_updates(
                     count += 1
                 return count
 
+        async def dispatch_device_safely(delivery) -> int:
+            try:
+                return await dispatch_device(delivery)
+            except Exception:
+                # Device-specific validation, persistence, or provider failures
+                # must not cancel healthy siblings. Leave any uncheckpointed
+                # revisions unseen so a later poll can retry them.
+                return 0
+
         counts = await asyncio.gather(
-            *(dispatch_device(delivery) for delivery in deliveries)
+            *(dispatch_device_safely(delivery) for delivery in deliveries)
         )
         return sum(counts)
     finally:

tests/test_mobile_launch.py

@@ -69,4 +69,4 @@ async def test_mobile_launch_progressively_discloses_secondary_controls():
     assert "header { min-height:56px; max-height:64px;" in html
     assert ".work-settings:not([open]) > .work-settings-panel { display:none; }" in html
     assert ".app-menu:not([open]) > .app-menu-panel { display:none; }" in html
-    assert ".my-work-actions button { min-height:44px;" in html
+    assert ".my-work-actions { display:none; }" in html

tests/test_mobile_task_dock.py

@@ -293,13 +293,14 @@ sheet.showModal = function () {{ this.open = true; }};
 sheet.close = function () {{ this.open = false; this.listeners.close?.(); }};
 const close = new FakeElement();
 const badge = new FakeElement();
-const rows = Object.fromEntries(['today','attention','update','later','draft'].map(name => [name, new FakeElement()]));
+const rows = Object.fromEntries(['today','attention','update','later','draft','recaps'].map(name => [name, new FakeElement()]));
 const counts = Object.fromEntries(Object.keys(rows).map(name => [name, new FakeElement()]));
 const selected = [];
+const utilities = [];
 const dock = createDock({{
   nav, buttons:{{queues}}, actions:{{queues:()=>{{}}}}, overlays:[sheet],
   queueSheet:sheet, queueClose:close, queueRows:rows, queueCounts:counts, queueBadge:badge,
-  onSelectQueue:name=>selected.push(name),
+  onSelectQueue:(name,row)=>name === 'recaps' ? utilities.push(row === rows.recaps ? 'recaps:trigger' : 'recaps:missing-trigger') : selected.push(name),
   observe() {{}},
 }});
 dock.start();
@@ -308,9 +309,11 @@ queues.click();
 const opened = sheet.open;
 rows.update.click();
 const closedAfterSelect = !sheet.open;
+queues.click(); rows.recaps.click();
+const closedAfterUtility = !sheet.open;
 queues.click(); close.click();
 process.stdout.write(JSON.stringify({{
-  opened, closedAfterSelect, selected,
+  opened, closedAfterSelect, closedAfterUtility, selected, utilities,
   badge:badge.textContent, badgeLabel:queues.attributes['aria-label'],
   counts:Object.fromEntries(Object.entries(counts).map(([name, node]) => [name, node.textContent])),
   updateLabel:rows.update.attributes['aria-label'],
@@ -324,13 +327,15 @@ process.stdout.write(JSON.stringify({{
     assert json.loads(result.stdout) == {
         "opened": True,
         "closedAfterSelect": True,
+        "closedAfterUtility": True,
         "selected": ["update"],
+        "utilities": ["recaps:trigger"],
         # Updates are a drill-down within Attention and must not inflate the aggregate badge.
         "badge": "10",
         "badgeLabel": "Queues, 10 items",
-        "counts": {"today": "2", "attention": "1", "update": "5", "later": "3", "draft": "4"},
+        "counts": {"today": "2", "attention": "1", "update": "5", "later": "3", "draft": "4", "recaps": "0"},
         "updateLabel": "Updates, 5 unread conversations",
-        "queueFocuses": 2,
+        "queueFocuses": 3,
         "columnState": None,
     }
 
@@ -376,13 +381,16 @@ async def test_dashboard_renders_and_wires_mobile_queue_switcher():
     assert '<strong>Updates</strong><small>Unread conversations</small>' in html
     assert 'data-mobile-queue="later"' in html
     assert 'data-mobile-queue="draft"' in html
+    assert 'data-mobile-queue="recaps"' in html
+    assert '<strong>Recaps</strong><small>History</small>' in html
     assert 'id="mobile-queue-count"' in html
     assert 'mobileTaskDock.updateQueues(counts)' in html
     assert '<script src="static/mobile-queue-launcher.js"></script>' in html
     assert "const mobileQueueLauncher = createMobileQueueLauncher({" in html
     assert "firstAction: name => qs('#my-work-list .my-work-card-main, #my-work-list .draft-resume, #my-work-list .draft-continue, #my-work-list .draft-edit')" in html
-    assert "onSelectQueue: name => mobileQueueLauncher.open(name)" in html
+    assert "onSelectQueue:name => name === 'recaps' ? qs('#open-today-recaps').click() : mobileQueueLauncher.open(name)" in html
     assert '.mobile-queue-sheet' in html
+    assert '.my-work-actions { display:none;' in html
     assert 'padding-bottom:calc(16px + env(safe-area-inset-bottom))' in html
     assert '.mobile-task-dock[data-attention="true"]' not in html
 
@@ -426,7 +434,7 @@ async def test_dashboard_renders_and_wires_phone_safe_task_dock():
     assert '<script src="static/mobile-task-dock.js"></script>' in html
     assert "createMobileTaskDock({" in html
     assert "work: () => mobileWorkEntry.open()" in html
-    assert "onSelectQueue: name => mobileQueueLauncher.open(name)" in html
+    assert "onSelectQueue:name => name === 'recaps' ? qs('#open-today-recaps').click() : mobileQueueLauncher.open(name)" in html
     assert "qs('[data-work-filter=\"' + name + '\"]').click()" in html
     assert "find: () => qs('#find-work').click()" in html
     assert "new: () => qs('#new-issue').click()" in html

tests/test_my_work.py

@@ -9,6 +9,7 @@ from tests.dashboard_bundle import dashboard
 
 
 MY_WORK = Path(__file__).parents[1] / "frontend" / "my-work.js"
+NOTIFICATION_UNDO = Path(__file__).parents[1] / "frontend" / "notification-undo.js"
 TODAY_TIMER = Path(__file__).parents[1] / "frontend" / "today-timer.js"
 LATER_WORK = Path(__file__).parents[1] / "frontend" / "later-work.js"
 DETAIL_DEFER = Path(__file__).parents[1] / "frontend" / "detail-defer.js"
@@ -395,6 +396,49 @@ process.stdout.write(JSON.stringify({{calls, hash:location.hash}}));
     assert output["hash"] == "#/my-work/review/stackchain/dashboard/10"
 
 
+def test_updates_inbox_route_survives_hydration_and_detail_back_navigation():
+    script = f"""
+const routes = require({json.dumps(str(WORK_ROUTE))});
+const listeners = {{}};
+const location = {{hash:'#/my-work/updates'}};
+const calls = [];
+const stack = ['#/my-work/updates'];
+let cursor = 0;
+const history = {{
+  pushState(state, _, hash) {{ stack.splice(cursor + 1); stack.push(hash); cursor += 1; location.hash = hash; }},
+  replaceState(state, _, hash) {{ stack[cursor] = hash; location.hash = hash; }},
+  back() {{ cursor -= 1; location.hash = stack[cursor]; listeners.popstate(); }},
+}};
+const controller = routes.createController({{
+  location, history,
+  eventTarget: {{addEventListener(name, fn) {{ listeners[name] = fn; }}}},
+  onQueue: queue => calls.push(['queue', queue]),
+  onOpen: item => calls.push(['open', item.notification_id]),
+  onClose: () => calls.push(['close']),
+  onInvalid: () => calls.push(['invalid']),
+}});
+controller.start();
+controller.setItems([]);
+controller.open({{kind:'update', notification_id:42}});
+controller.close();
+process.stdout.write(JSON.stringify({{calls, hash:location.hash, parsed:routes.parse(location.hash)}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "calls": [
+            ["queue", "update"],
+            ["open", 42],
+            ["close"],
+            ["queue", "update"],
+        ],
+        "hash": "#/my-work/updates",
+        "parsed": {"kind": "queue", "filter": "update"},
+    }
+
+
 def test_work_route_controller_resolves_cold_routes_without_erasing_the_fragment():
     script = f"""
 const routes = require({json.dumps(str(WORK_ROUTE))});
@@ -507,6 +551,10 @@ async def test_dashboard_wires_addressable_work_sheets_back_navigation_and_share
     assert html.count('class="share-work-route"') == 4
     assert 'createWorkRoute.share(window.location.href, navigator, navigator.clipboard)' in html
     assert 'Route unavailable · this item is no longer in My Work.' in html
+    assert "onQueue: openWorkQueueRoute" in html
+    assert "selectWorkQueue(filter, { preserveRoute:true })" in html
+    assert "filter === 'update' && window.location.hash !== '#/my-work/updates'" in html
+    assert "window.history.pushState({ workQueue:'update' }, '', '#/my-work/updates')" in html
 
 
 def test_my_work_queue_prioritizes_labels_then_reviews_and_keeps_repo_identity():
@@ -4076,6 +4124,58 @@ const reader = buildMyWork.createNotificationReader({{
     assert output["results"][1] is False
 
 
+def test_notification_undo_restores_exact_item_once_and_keeps_failure_retryable():
+    script = f"""
+const createNotificationUndo = require({json.dumps(str(NOTIFICATION_UNDO))});
+const states = [];
+const statuses = [];
+const calls = [];
+let attempts = 0;
+const item = {{kind:'update', key:'repo#7', notification_id:42, has_update:true}};
+const undo = createNotificationUndo({{
+  restore: async id => {{ calls.push(id); attempts += 1; if (attempts === 1) throw new Error('offline'); }},
+  onItems: items => states.push(items.map(value => value.notification_id)),
+  onStatus: status => statuses.push(status),
+}});
+(async () => {{
+  undo.offer(item, [{{kind:'update', notification_id:43, has_update:true}}]);
+  const first = undo.run();
+  const duplicate = undo.run();
+  const firstResults = await Promise.all([first, duplicate]);
+  const retry = await undo.run();
+  process.stdout.write(JSON.stringify({{calls, states, statuses, firstResults, retry}}));
+}})();
+"""
+    output = json.loads(subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    ).stdout)
+
+    assert output["calls"] == [42, 42]
+    assert output["states"] == [[42, 43]]
+    assert output["firstResults"] == [False, False]
+    assert output["retry"] is True
+    assert output["statuses"] == [
+        "repo#7 marked read. Undo?",
+        "Restoring repo#7…",
+        "Could not restore repo#7. Retry Undo.",
+        "Restoring repo#7…",
+        "repo#7 is unread again.",
+    ]
+
+
+@pytest.mark.anyio
+async def test_mobile_update_undo_is_accessible_and_safe_area_aware():
+    html = await dashboard()
+
+    assert 'id="notification-undo"' in html
+    assert 'id="undo-notification" type="button"' in html
+    assert "requestNotificationUnread" in html
+    assert "createDashboardNotificationUndo({" in html
+    assert ".notification-undo { position:fixed;" in html
+    assert "env(safe-area-inset-bottom)" in html
+    assert ".notification-undo button { min-height:44px;" in html
+
+
 @pytest.mark.anyio
 async def test_mobile_update_sheet_wires_touch_safe_online_acknowledge_and_next():
     html = await dashboard()
@@ -4354,7 +4454,9 @@ reader.open(item, [item]).then(() => {{
     )
     output = json.loads(result.stdout)
 
-    assert output["result"] == {"items": [], "next": None}
+    assert output["result"] == {"items": [], "item": {
+        "kind": "update", "notification_id": 42, "has_update": True,
+    }, "next": None}
     assert output["events"] == [
         ["status", "Marking update read…"],
         ["items", []],

tests/test_notification_read.py

@@ -41,6 +41,29 @@ async def test_mark_notification_read_calls_supported_gitea_thread_endpoint(monk
     ]
 
 
+@pytest.mark.anyio
+async def test_mark_notification_unread_calls_supported_gitea_thread_endpoint(monkeypatch):
+    calls = []
+
+    class Response:
+        def raise_for_status(self):
+            return None
+
+    class Client:
+        async def patch(self, path, headers):
+            calls.append((path, headers))
+            return Response()
+
+    monkeypatch.setattr(gitea_proxy, "_get_client", lambda: Client())
+    monkeypatch.setattr(gitea_proxy, "_auth", lambda: {"Authorization": "token test"})
+
+    await gitea_proxy.mark_notification_unread(42)
+
+    assert calls == [
+        ("/api/v1/notifications/threads/42?to-status=unread", {"Authorization": "token test"})
+    ]
+
+
 @pytest.mark.anyio
 async def test_acknowledge_notification_resolves_latest_comment_and_adds_one_reaction(monkeypatch):
     calls = []
@@ -172,6 +195,26 @@ async def test_mark_notification_read_api_is_bounded_and_never_cacheable(monkeyp
     assert marked == [42]
 
 
+@pytest.mark.anyio
+async def test_mark_notification_unread_api_is_bounded_and_never_cacheable(monkeypatch):
+    restored = []
+
+    async def mark_unread(thread_id):
+        restored.append(thread_id)
+
+    monkeypatch.setattr(main.gitea_proxy, "mark_notification_unread", mark_unread, raising=False)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.patch("/api/v1/notifications/42/unread")
+        invalid = await client.patch("/api/v1/notifications/0/unread")
+
+    assert response.status_code == 200
+    assert response.json() == {"id": 42, "status": "unread"}
+    assert response.headers["cache-control"] == "no-store"
+    assert invalid.status_code == 422
+    assert restored == [42]
+
+
 @pytest.mark.anyio
 async def test_acknowledge_notification_api_confirms_reaction_and_removes_snapshot_item(monkeypatch):
     calls = []

tests/test_push_endpoint_policy.py

@@ -0,0 +1,37 @@
+import pytest
+
+from src.push_endpoint_policy import UnsafePushEndpoint, validate_public_push_endpoint
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    "address",
+    ["127.0.0.1", "::1", "10.0.0.4", "169.254.169.254", "fc00::1"],
+)
+async def test_push_endpoint_rejects_every_non_public_resolved_address(address):
+    async def resolve(_host, _port):
+        return [address]
+
+    with pytest.raises(UnsafePushEndpoint, match="public Web Push service"):
+        await validate_public_push_endpoint(
+            "https://push.example/device", resolver=resolve
+        )
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    "endpoint",
+    [
+        "http://push.example/device",
+        "https://user@push.example/device",
+        "https://push.example:8443/device",
+        "https://push.example:not-a-port/device",
+        "https://push.example/device#fragment",
+    ],
+)
+async def test_push_endpoint_rejects_noncanonical_authorities_without_resolving(endpoint):
+    async def must_not_resolve(_host, _port):
+        raise AssertionError("invalid URL reached DNS")
+
+    with pytest.raises(UnsafePushEndpoint, match="canonical public Web Push"):
+        await validate_public_push_endpoint(endpoint, resolver=must_not_resolve)

tests/test_push_notifications.py

@@ -2,6 +2,7 @@ import json
 import asyncio
 import os
 import sqlite3
+import time
 from types import SimpleNamespace
 
 import httpx
@@ -10,6 +11,15 @@ import pytest
 from src import dashboard_auth, gitea_proxy, main
 from src.push_notifications import PushConfiguration, dispatch_unread_updates
 from src.push_subscription_store import PushSubscriptionStore
+from src.push_endpoint_policy import UnsafePushEndpoint
+
+
+@pytest.fixture(autouse=True)
+def resolve_test_push_endpoints_publicly(monkeypatch):
+    async def accept(endpoint):
+        return endpoint
+
+    monkeypatch.setattr(main, "validate_public_push_endpoint", accept)
 
 
 def test_dispatch_lease_is_exclusive_recoverable_and_owner_fenced(tmp_path):
@@ -508,6 +518,32 @@ async def test_dispatch_removes_an_expired_push_endpoint(tmp_path):
     assert store.is_subscribed("session-a") is False
 
 
+@pytest.mark.anyio
+async def test_dispatch_removes_an_endpoint_that_rebinds_private_without_contacting_it(tmp_path):
+    store = PushSubscriptionStore(tmp_path / "push.sqlite3")
+    store.upsert("unsafe-device", {
+        "endpoint": "https://push.example/rebound",
+        "keys": {"p256dh": "public-key", "auth": "auth-secret"},
+    })
+    contacted = []
+
+    async def unread():
+        return {"items": [{"id": 8}]}
+
+    async def reject_rebound(_endpoint):
+        raise UnsafePushEndpoint("Endpoint must resolve to a public Web Push service")
+
+    async def send(subscription, _payload):
+        contacted.append(subscription["endpoint"])
+
+    config = PushConfiguration("public", "private", "mailto:ops@example.com")
+    assert await dispatch_unread_updates(
+        store, config, unread, send, endpoint_validator=reject_rebound
+    ) == 0
+    assert contacted == []
+    assert store.is_subscribed("unsafe-device") is False
+
+
 @pytest.mark.anyio
 async def test_transient_endpoint_failure_does_not_block_healthy_devices(tmp_path):
     store = PushSubscriptionStore(tmp_path / "push.sqlite3")
@@ -532,6 +568,75 @@ async def test_transient_endpoint_failure_does_not_block_healthy_devices(tmp_pat
     assert store.claim_unseen({8})[0].session_id == "session-a"
 
 
+@pytest.mark.anyio
+async def test_unexpected_device_failure_waits_for_siblings_and_retries_only_that_device(tmp_path):
+    path = tmp_path / "push.sqlite3"
+    store = PushSubscriptionStore(path)
+    competitor = PushSubscriptionStore(path)
+    for session_id in ("failing-device", "healthy-device"):
+        store.upsert(session_id, {
+            "endpoint": f"https://push.example/{session_id}",
+            "keys": {"p256dh": "public-key", "auth": "auth-secret"},
+        })
+    healthy_started = asyncio.Event()
+    release_healthy = asyncio.Event()
+    sent = []
+
+    async def unread():
+        return {"items": [{"id": 8, "updated_at": "r1"}], "complete": True}
+
+    async def validate(endpoint):
+        if endpoint.endswith("failing-device"):
+            raise TimeoutError("endpoint validation unavailable")
+        return endpoint
+
+    async def send(subscription, _payload):
+        sent.append(subscription["endpoint"])
+        healthy_started.set()
+        await release_healthy.wait()
+
+    config = PushConfiguration("public", "private", "mailto:ops@example.com")
+    dispatch = asyncio.create_task(dispatch_unread_updates(
+        store,
+        config,
+        unread,
+        send,
+        endpoint_validator=validate,
+    ))
+    await asyncio.wait_for(healthy_started.wait(), timeout=0.2)
+    await asyncio.sleep(0)
+
+    assert dispatch.done() is False
+    assert competitor.acquire_dispatch_lease(
+        "competing-worker", now=time.time(), lease_seconds=60
+    ) is False
+
+    release_healthy.set()
+    assert await dispatch == 1
+    remaining = store.claim_unseen({8: "r1"})
+    assert [(item.session_id, item.thread_ids) for item in remaining] == [
+        ("failing-device", (8,))
+    ]
+
+    retried = []
+
+    async def validate_recovered(endpoint):
+        return endpoint
+
+    async def send_retry(subscription, _payload):
+        retried.append(subscription["endpoint"])
+
+    assert await dispatch_unread_updates(
+        store,
+        config,
+        unread,
+        send_retry,
+        endpoint_validator=validate_recovered,
+    ) == 1
+    assert retried == ["https://push.example/failing-device"]
+    assert sent == ["https://push.example/healthy-device"]
+
+
 @pytest.mark.anyio
 async def test_transient_failure_stops_that_device_until_the_next_poll(tmp_path):
     store = PushSubscriptionStore(tmp_path / "push.sqlite3")
@@ -722,6 +827,37 @@ async def test_authenticated_device_can_subscribe_report_status_and_unsubscribe(
     assert (await main.push_status(request))["subscribed"] is False
 
 
+@pytest.mark.anyio
+async def test_subscription_rejects_an_unsafe_endpoint_before_persistence(tmp_path, monkeypatch):
+    store = PushSubscriptionStore(tmp_path / "push.sqlite3")
+    monkeypatch.setattr(main, "_push_subscription_store", store)
+    monkeypatch.setattr(
+        main, "_push_configuration",
+        lambda: PushConfiguration("public", "private", "mailto:ops@example.com"),
+    )
+
+    async def management_id(_session):
+        return "unsafe-device"
+
+    async def reject_private(_endpoint):
+        raise UnsafePushEndpoint("Endpoint must resolve to a public Web Push service")
+
+    monkeypatch.setattr(main.dashboard_auth, "session_management_id", management_id)
+    monkeypatch.setattr(main, "validate_public_push_endpoint", reject_private)
+    request = SimpleNamespace(state=SimpleNamespace(dashboard_session=object()))
+    payload = main.PushSubscriptionPayload(
+        endpoint="https://push.example/device-a",
+        keys={"p256dh": "public-key", "auth": "auth-secret"},
+    )
+
+    with pytest.raises(main.HTTPException) as rejected:
+        await main.subscribe_push(payload, request)
+
+    assert rejected.value.status_code == 422
+    assert rejected.value.detail == "Endpoint must resolve to a public Web Push service"
+    assert store.is_subscribed("unsafe-device") is False
+
+
 @pytest.mark.anyio
 async def test_subscription_baselines_every_revision_from_the_complete_snapshot(tmp_path, monkeypatch):
     store = PushSubscriptionStore(tmp_path / "push.sqlite3")

tests/test_service_worker.py

@@ -695,6 +695,7 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/static/offline-work.js",
         "/dashboard/static/offline-today.js",
         "/dashboard/static/my-work.js",
+        "/dashboard/static/notification-undo.js",
         "/dashboard/static/card-planning.js",
         "/dashboard/static/today-work.js",
         "/dashboard/static/today-timer.js",