kahme247 · Oct 8, 2026 · Oct 3, 2026 · Oct 3, 2026 · Oct 3, 2026 · Oct 3, 2026
diff --git a/AGENTS.md b/AGENTS.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/README.md b/README.md
@@ -35,6 +35,60 @@ Queue **Delete** and **Edit** additionally require `remove_queued_message`. Dele
 
 The queue panel shows omp's own queue (`queuedMessages` in `get_state` and `queue_update` events, omp 18.4.4 or later), so every device viewing a session sees the same queued messages. **Stop** moves the text of messages still waiting in the queue back into the composer instead of letting the agent run them; a steer the model already picked up through live steering still runs. Older omp runtimes show no queue panel, and Stop cannot take queued messages back.
 
+## App installation behind authentication
+
+To install the web app, sign in first and use your browser's installation menu.
+The single manifest link requests `/api/manifest` with credentials; that endpoint
+uses the existing web-password guard and private, revalidating caching. Its
+192×192 and 512×512 PNG icons are embedded from the packaged assets because
+Android's native installer fetches ordinary icon URLs without authentication
+cookies. The app still launches at `/` with scope `/`.
+
+Keep Cloudflare Access and application authentication enabled; no public
+manifest exception or Access bypass rule is needed. This does not add offline
+support. Local Chromium verification covered cookie-gated metadata with HTTP
+icon URLs blocked (zero installability errors). The owner also confirmed that
+installation on a physical phone works as expected behind Cloudflare Access.
+
+Skill startup notices require an OMP runtime with `get_skill_diagnostics`,
+`set_skill_startup_diagnostics`, and `skill_diagnostics_update`. Conflicts and
+redundant installations appear above the composer when its OMP session starts;
+an empty new-chat page does not start OMP just for diagnostics. **Details** shows
+the resolved default, variants, identical copies, backing paths, sources, and
+selection reason. The **×** button dismisses the notice for that session until
+the diagnostic report changes. **Turn off** and **Settings →
+Interface & Behavior → Skill startup notices** use OMP's persisted
+`skills.showStartupDiagnostics` preference, not a separate browser setting.
+**Settings → Extensions & Tools → Skills → View skill diagnostics** remains
+available for a selected running session when notices are off. Inspection does
+not resume stopped sessions. Missing support or no running session is unavailable,
+not a clean result.
+
+## Notifications
+
+Turn on notifications in **Settings → Notifications**. Each browser keeps its own
+settings: which events notify (task finished, waiting for input, run failed,
+model switched automatically) and what happens while you use omp-web in another
+tab (an in-app toast, or always a system notification). Nothing is shown for the
+session you are viewing. Clicking a notification opens its session.
+
+- **Push** reaches the browser even when no omp-web tab is open. It needs a
+  secure context (HTTPS through your reverse proxy, or `localhost`), and the
+  omp-web server needs outbound HTTPS access to the browser vendors' push
+  services. omp-web generates its push (VAPID) keys on first use and stores them
+  with the device list in `~/.omp/agent/omp-web/notifications.json` (mode 0600).
+- On **iPhone and iPad** (iOS 16.4 or later), push works only in the app added
+  to the Home Screen.
+- In a secure context without push support, system notifications appear while
+  an omp-web tab is open. Over plain HTTP on a non-localhost address, browsers
+  allow no system notifications: only the in-app toasts shown while you use
+  omp-web remain.
+- Desktop browsers show notifications through the operating system's
+  notification center. Push delivery needs the browser process running.
+
+Completion notifications use omp's `prompt_result` and `session_settled` RPC
+frames (omp 18.3.1 or later).
+
 ## Quick Start
 
 **Run directly without installing:**
@@ -212,7 +266,8 @@ host (KDE Plasma, and most Wayland/X11 desktops).
 - **Windows System Tray & Service**: Background service, tray icon, logon autostart, and Desktop/Start Menu shortcuts (Windows).
 - **macOS launchd Service**: LaunchAgent that starts at login, restarts on crash, and logs under `~/Library/Logs/ompweb`.
 - **Linux systemd Service & Tray**: User service that starts at login and restarts on crash, plus a StatusNotifierItem tray icon with service controls (KDE Plasma and compatible desktops).
-- **Web-based Settings** (8 tabs): Interface & Behavior, Safety & Approvals, AI Model Defaults, API Keys & Providers, Usage, Agent & Intelligence (advisor, memory, compaction), Agents, Extensions & Tools (MCP, skills, plugins), System & Updates.
+- **Notifications**: Desktop and mobile (PWA) notifications for finished tasks, questions waiting for an answer, failed runs, and automatic model switches, with Web Push when served over HTTPS. See [Notifications](#notifications).
+- **Web-based Settings** (10 tabs): Interface & Behavior, Safety & Approvals, AI Model Defaults, API Keys & Providers, Usage, Agent & Intelligence (advisor, memory, compaction), Agents, Extensions & Tools (MCP, skills, plugins), Notifications, System & Updates.
 - **Slash Commands & Shortcuts**: Quick prompts (`/plan`, `/review`, `/fix`, `/test`, etc.), `⌘K` / `Ctrl+K` palette, and model/reasoning cycling.
 - **UI Themes & Localization**: Warm paper light/dark themes plus an omp.sh-inspired midnight (`omp`) theme, chat font size & interface scale, with full English, Chinese (简体中文), and Japanese (日本語) translations.
 
@@ -226,6 +281,7 @@ host (KDE Plasma, and most Wayland/X11 desktops).
 | `OMP_WEB_NO_OPEN` | Set to `1` to prevent auto-opening browser | `0` |
 | `OMP_WEB_DISABLE_AUTOUPDATE` | Set to `1` to disable update checks and in-app updates; restart after changing | `0` |
 | `OMP_WEB_OMP_BIN` | Path to `omp` binary if not on `PATH` | _auto-detected_ |
+| `OMP_WEB_DEV_ORIGIN` | Additional allowed hostname for the development server (no scheme or port); ignored in production | _None_ |
 | `PI_CODING_AGENT_DIR` | Custom omp agent directory | `~/.omp/agent` |
 | `OMP_WEB_STT_ENDPOINT` | OpenAI-compatible transcription endpoint URL | _None (disabled)_ |
 | `OMP_WEB_STT_KEY` | Optional API key for the STT endpoint | _None_ |
@@ -242,6 +298,19 @@ npm run dev
 
 The dev server runs at [http://127.0.0.1:30178](http://127.0.0.1:30178).
 
+The development server allows loopback and RFC1918 private IPv4 origins
+(`10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`). When using a tunnel
+or reverse proxy with a custom hostname, set it without editing `next.config.ts`:
+
+```bash
+OMP_WEB_DEV_ORIGIN=dev.example.com npm run dev
+```
+
+For a persistent setup, set the variable in your local environment or service
+configuration and restart the dev server. This does not change the bind address
+or enable authentication. Next.js hostname patterns cannot express IPv6 CIDRs;
+a private IPv6 origin must be supplied explicitly (for example, `[fd00::1]`).
+
 ### Checks
 
 ```bash

diff --git a/app/api/agent/[id]/route.ts b/app/api/agent/[id]/route.ts
@@ -18,6 +18,13 @@ const NO_SPAWN_REPLIES: Record<string, unknown> = {
   btw_cancel: { cancelled: false },
 };
 
+// Live diagnostics of a skill-resolving omp. A saved or exited session has none,
+// and resuming a full child (MCP, LSP) just to answer a read-only inspection or
+// flip one setting is not what the click asked for: with no live wrapper these
+// answer 409 instead of starting omp, and a live idle child is never replaced
+// because the advisor flag differs.
+const LIVE_SESSION_ONLY = new Set(["get_skill_diagnostics", "set_skill_startup_diagnostics"]);
+
 /** omp-web's own failures carry a stable code the client can localize; omp's
  * errors stay opaque English text. */
 function commandErrorResponse(error: unknown) {
@@ -60,14 +67,21 @@ export async function POST(
     // running and pick the flag up at the next natural respawn.
     const existing = getRpcSession(id);
     const noSpawn = Object.hasOwn(NO_SPAWN_REPLIES, body.type);
+    const liveOnly = LIVE_SESSION_ONLY.has(body.type);
     if (existing?.isAlive()) {
-      if (noSpawn || existing.advisorSpawned === advisor || existing.isRunning()) {
+      if (noSpawn || liveOnly || existing.advisorSpawned === advisor || existing.isRunning()) {
         const result = await existing.send(body);
         return NextResponse.json({ success: true, data: result });
       }
       await existing.destroyAndWait();
     }
     if (noSpawn) return NextResponse.json({ success: true, data: NO_SPAWN_REPLIES[body.type] });
+    if (liveOnly) {
+      return NextResponse.json(
+        { error: "Skill diagnostics require a running session", code: "skill_diagnostics_unavailable" },
+        { status: 409 },
+      );
+    }
 
     const resolved = await resolveSessionPathOr404(id);
     if ("response" in resolved) return resolved.response;

diff --git a/app/api/agent/running/events/route.ts b/app/api/agent/running/events/route.ts
@@ -1,12 +1,17 @@
 import { getExitedRpcSessions, getRunningRpcSessions, subscribeRunningSessions } from "@/lib/rpc-manager";
+import { isValidNotificationId } from "@/lib/notification-events";
+import { attachNotificationClient } from "@/lib/notification-hub";
 import { subscribeSessionFileChanges } from "@/lib/session-watcher";
 
 export const dynamic = "force-dynamic";
 
 // GET /api/agent/running/events - SSE stream of the set of currently-running
 // session ids. Also carries refresh hints when a live session's file metadata
-// changes, so the sidebar can show a newly-started session immediately.
+// changes, so the sidebar can show a newly-started session immediately, and
+// this tab's notifications when `clientId` is given (one stream per tab:
+// browsers allow only six HTTP/1.1 connections per host).
 export async function GET(req: Request) {
+  const clientId = new URL(req.url).searchParams.get("clientId");
   // Hoisted so the stream's cancel() (half-open disconnects that never fire
   // the abort signal) can release the heartbeat and the subscriber.
   let streamCleanup: (() => void) | null = null;
@@ -18,6 +23,7 @@ export async function GET(req: Request) {
       let cleaned = false;
       let unsubscribeRunning: (() => void) | null = null;
       let unsubscribeFiles: (() => void) | null = null;
+      let detachNotifications: (() => void) | null = null;
       let heartbeatTimer: ReturnType<typeof setInterval> | null = null;
 
       const cleanup = () => {
@@ -36,6 +42,8 @@ export async function GET(req: Request) {
           try { unsubscribeFiles(); } catch {}
           unsubscribeFiles = null;
         }
+        detachNotifications?.();
+        detachNotifications = null;
         req.signal?.removeEventListener("abort", cleanup);
         try {
           controller.close();
@@ -77,6 +85,10 @@ export async function GET(req: Request) {
         encode({ type: "sessions-changed", sessionIds, refreshSessionList: true });
       });
 
+      if (isValidNotificationId(clientId)) {
+        detachNotifications = attachNotificationClient(clientId, (message) => encode({ type: "notification", ...message }));
+      }
+
       // Initial snapshot so the client renders the correct state immediately.
       const initialRunning = getRunningRpcSessions();
       encode({

diff --git a/app/api/manifest/route.ts b/app/api/manifest/route.ts
@@ -0,0 +1,33 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { MetadataRoute } from "next";
+import { getInstallName } from "@/lib/install-name";
+
+// Packaged public assets are read/encoded once per server module. Native
+// installers fetch HTTP icons without cookies, even with a credentialed manifest.
+const pngDataUrl = (filename: string) =>
+  `data:image/png;base64,${readFileSync(join(process.cwd(), "public", filename)).toString("base64")}`;
+
+const manifest: MetadataRoute.Manifest = {
+  description: "Web UI for the oh-my-pi (omp) coding agent",
+  start_url: "/",
+  scope: "/",
+  display: "standalone",
+  background_color: "#000000",
+  theme_color: "#000000",
+  icons: [
+    { src: pngDataUrl("icon-192.png"), sizes: "192x192", type: "image/png" },
+    { src: pngDataUrl("icon.png"), sizes: "512x512", type: "image/png" },
+  ],
+};
+
+// Authentication is enforced by the existing /api/ web-password proxy guard.
+export function GET(request: Request) {
+  const name = getInstallName(request.headers);
+  return Response.json({ ...manifest, name, short_name: name }, {
+    headers: {
+      "Content-Type": "application/manifest+json",
+      "Cache-Control": "private, no-cache, max-age=0, must-revalidate",
+    },
+  });
+}
diff --git a/app/api/models/route.ts b/app/api/models/route.ts
@@ -3,6 +3,7 @@ import { invalidateModelsCache, loadModelsWithCache, withModelRuntimeError, with
 import { disposeUtilityRpc, runUtilityCommand, type OmpModel } from "@/lib/omp/rpc-utility";
 import { getModelsConfigPath } from "@/lib/omp/paths";
 import { readDisabledProviders } from "@/lib/omp/model-roles";
+import { readAnthropicSlowMode } from "@/lib/omp/settings-config";
 
 export const dynamic = "force-dynamic";
 
@@ -60,6 +61,12 @@ function supportsFastMode(model: OmpModel): boolean {
   return model.provider === "anthropic" || model.provider === "openai" || model.provider === "google";
 }
 
+// Copy of omp's AgentSession#slowModeTarget for the composer's Slow toggle
+// before omp runs: Claude low priority on `anthropic`, else the flex tier of
+// the OpenAI/Google service-tier families. Live get_state wins once omp runs.
+// ponytail: provider-only; OpenRouter's openai/google ids need omp's model identity.
+const SLOW_MODE_PROVIDERS: Record<string, true> = { anthropic: true, openai: true, "openai-codex": true, google: true, "google-vertex": true };
+
 async function loadModels(): Promise<ModelsData> {
   const availableResponse = await runUtilityCommand<{ models?: unknown }>(
     { type: "get_available_models" },
@@ -81,7 +88,7 @@ async function loadModels(): Promise<ModelsData> {
   const nameMap = new Map<string, string>();
   const thinkingLevels: Record<string, string[]> = {};
   const modelList = available
-    .map((m) => ({ id: m.id, name: m.name, provider: m.provider, thinkingLevels: thinkingLevelsFor(m), supportsFastMode: supportsFastMode(m), contextWindow: m.contextWindow ?? undefined, maxTokens: m.maxTokens ?? undefined }))
+    .map((m) => ({ id: m.id, name: m.name, provider: m.provider, thinkingLevels: thinkingLevelsFor(m), supportsFastMode: supportsFastMode(m), supportsSlowMode: SLOW_MODE_PROVIDERS[m.provider] === true, contextWindow: m.contextWindow ?? undefined, maxTokens: m.maxTokens ?? undefined }))
     .sort(compareModelEntries);
   const loginResponse = await runUtilityCommand<{ providers?: unknown }>(
     { type: "get_login_providers" },
@@ -137,9 +144,11 @@ const EMPTY_MODELS: ModelsData = {
 
 export async function GET() {
   refreshModelsIfConfigChanged();
+  // Outside the cache: `/slow` on a Claude model rewrites config.yml.
+  const anthropicSlowMode = readAnthropicSlowMode();
   try {
-    return Response.json(await loadModelsWithCache(MODELS_CACHE_KEY, () => loadModels()));
+    return Response.json({ ...await loadModelsWithCache(MODELS_CACHE_KEY, () => loadModels()), anthropicSlowMode });
   } catch {
-    return Response.json(withSafeModelLoadFailure(EMPTY_MODELS));
+    return Response.json({ ...withSafeModelLoadFailure(EMPTY_MODELS), anthropicSlowMode });
   }
 }
diff --git a/app/api/notifications/devices/route.ts b/app/api/notifications/devices/route.ts
@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { isValidNotificationId, parseNotificationPrefs } from "@/lib/notification-events";
+import { getNotificationDevice, getVapidPublicKey, parsePushSubscription, saveNotificationDevice } from "@/lib/notification-hub";
+import { isRecord } from "@/lib/type-guards";
+
+export const dynamic = "force-dynamic";
+
+/** GET /api/notifications/devices?deviceId= — VAPID public key and whether this device has a push subscription. */
+export async function GET(req: Request) {
+  const deviceId = new URL(req.url).searchParams.get("deviceId");
+  const device = isValidNotificationId(deviceId) ? getNotificationDevice(deviceId) : undefined;
+  return NextResponse.json({ publicKey: getVapidPublicKey(), subscribed: Boolean(device?.subscription) });
+}
+
+/** PUT /api/notifications/devices { deviceId, prefs, subscription? } — an omitted subscription keeps the stored one. */
+export async function PUT(req: Request) {
+  const body: unknown = await req.json().catch(() => null);
+  if (!isRecord(body) || !isValidNotificationId(body.deviceId)) {
+    return NextResponse.json({ error: "deviceId is required", code: "invalid_device" }, { status: 400 });
+  }
+  const subscription = body.subscription === undefined ? undefined : parsePushSubscription(body.subscription);
+  if (subscription === null) return NextResponse.json({ error: "Invalid push subscription", code: "invalid_subscription" }, { status: 400 });
+  const device = saveNotificationDevice(body.deviceId, parseNotificationPrefs(body.prefs), subscription);
+  return NextResponse.json({ subscribed: Boolean(device.subscription) });
+}
diff --git a/app/api/notifications/presence/route.ts b/app/api/notifications/presence/route.ts
@@ -0,0 +1,20 @@
+import { NextResponse } from "next/server";
+import { isValidNotificationId } from "@/lib/notification-events";
+import { reportPresence } from "@/lib/notification-hub";
+import { isRecord } from "@/lib/type-guards";
+
+export const dynamic = "force-dynamic";
+
+/** POST /api/notifications/presence { clientId, deviceId, visible, sessionId, seq } — which session this tab shows. */
+export async function POST(req: Request) {
+  const body: unknown = await req.json().catch(() => null);
+  if (
+    !isRecord(body) || !isValidNotificationId(body.clientId) || !isValidNotificationId(body.deviceId)
+    || typeof body.visible !== "boolean" || !Number.isSafeInteger(body.seq)
+  ) {
+    return NextResponse.json({ error: "Invalid presence report", code: "invalid_presence" }, { status: 400 });
+  }
+  const sessionId = typeof body.sessionId === "string" && body.sessionId ? body.sessionId : null;
+  reportPresence({ clientId: body.clientId, deviceId: body.deviceId, visible: body.visible, sessionId, seq: Number(body.seq) });
+  return new NextResponse(null, { status: 204 });
+}
diff --git a/app/api/notifications/test/route.ts b/app/api/notifications/test/route.ts
@@ -0,0 +1,16 @@
+import { NextResponse } from "next/server";
+import { isValidNotificationId } from "@/lib/notification-events";
+import { sendTestPush } from "@/lib/notification-hub";
+import { isRecord } from "@/lib/type-guards";
+
+export const dynamic = "force-dynamic";
+
+/** POST /api/notifications/test { deviceId } — one push to this device; 502 when the push service refuses it. */
+export async function POST(req: Request) {
+  const body: unknown = await req.json().catch(() => null);
+  if (!isRecord(body) || !isValidNotificationId(body.deviceId)) {
+    return NextResponse.json({ error: "deviceId is required", code: "invalid_device" }, { status: 400 });
+  }
+  const result = await sendTestPush(body.deviceId);
+  return result.ok ? new NextResponse(null, { status: 204 }) : NextResponse.json({ error: result.error, code: "push_failed" }, { status: 502 });
+}
diff --git a/app/api/provider-usage/route.ts b/app/api/provider-usage/route.ts
@@ -27,7 +27,7 @@ export async function GET(request: Request) {
   }
 
   try {
-    return NextResponse.json(await getProviderUsage({ provider, modelId }));
+    return NextResponse.json(await getProviderUsage({ provider, modelId }, searchParams.get("refresh") === "true"));
   } catch {
     return NextResponse.json(
       { error: "Provider usage is currently unavailable", code: "provider_usage_unavailable" },