Notifications that reach you, and 2FA without the password twice bff9106edcba

-- Notifications (oxygenhub#183): a token an agent uses tells its owner

-- what was done with it; and owners watch their repositories by default,

-- so a watch row may now say it is muted.

ALTER TABLE tokens ADD COLUMN agent INTEGER NOT NULL DEFAULT 0;

ALTER TABLE watches ADD COLUMN muted INTEGER NOT NULL DEFAULT 0;

/// Proof, for the code step of a sign-in with two-factor authentication,

/// that `username` gave the right password: `UNTIL.MAC`, good until `until`

/// (ms) and void as soon as the account's session salt changes (a new

/// password, or everyone signed out), so the code step need not ask for

/// the password again.

pub fn pending_login(key: &CookieKey, username: &str, session_salt: &str, until: i64) -> String {

    format!("{until}.{}", key.mac(format!("pending-login:{username}:{session_salt}:{until}").as_bytes()))

}

/// Whether `token` is a [`pending_login`] for this account still in time.

pub fn pending_login_ok(key: &CookieKey, username: &str, session_salt: &str, token: &str, now: i64) -> bool {

    let Some((until, _)) = token.split_once('.') else { return false };

    let Ok(until) = until.parse::<i64>() else { return false };

    until > now && mac_equal(token, &pending_login(key, username, session_salt, until))

}

    let r: Run = sqlx::query_as("SELECT * FROM backup_runs WHERE id = ?").bind(id).fetch_one(&app.db).await?;

    } else {

        notify_recovered(app, &s, &r).await;

}

/// Who hears about `s`'s backups, and where they look: the user, or the

/// organisation's owners.

async fn told(app: &Shared, s: &Setting) -> Option<(Vec<(i64, db::notify::Reason)>, String)> {

    let p = db::notify::Reason::Participating;

    if s.kind == "org" {

        let o = db::accounts::org_by_name(&app.db, &s.owner).await.ok().flatten()?;

        let owners = db::accounts::org_members(&app.db, o.id)

            .await

            .ok()?

            .into_iter()

            .filter(|(_, r)| r == "owner")

            .map(|(a, _)| (a.id, p))

            .collect();

        Some((owners, format!("/orgs/{}/settings/backups", s.owner)))

    } else {

        let a = db::accounts::account_by_name(&app.db, &s.owner).await.ok().flatten()?;

        Some((vec![(a.id, p)], "/settings/backups".into()))

    }

}

/// The status of `owner`'s finished run before the newest.

async fn status_before(app: &Shared, owner: &str) -> Option<String> {

    sqlx::query_scalar("SELECT status FROM backup_runs WHERE owner = ? AND finished_ms IS NOT NULL ORDER BY id DESC LIMIT 1 OFFSET 1")

        .bind(owner)

        .fetch_optional(&app.db)

        .await

        .ok()

        .flatten()

/// A run that did not finish whole tells the owner (inbox and email), once

/// per spell of failures: not when the run before failed too.

    if status_before(app, &s.owner).await.is_some_and(|b| b != "ok") {

        return;

    }

    let Some((who, url)) = told(app, s).await else { return };

    let title = format!("Backup of {} {status}: {}", s.owner, detail.chars().take(160).collect::<String>());

    crate::notify::tell(app, "backup", &title, &url, "backups", None, who).await;

}

/// A whole run after one that was not: the owner hears it works again

/// (oxygenhub#183).

async fn notify_recovered(app: &Shared, s: &Setting, run: &Run) {

    if !status_before(app, &s.owner).await.is_some_and(|b| b != "ok") {

    }

    let Some((who, url)) = told(app, s).await else { return };

    let title = format!("Backup of {} works again: {} repositories to {}", s.owner, run.repos, place(s));

    crate::notify::tell(app, "backup.recovered", &title, &url, "backups", None, who).await;

}

/// The hour (UTC) each day's backup summary goes out.

const SUMMARY_HOUR: u8 = 7;

const SUMMARY_SENT: &str = "backups.summary_day";

/// One message a day per owner (oxygenhub#183): the last day's runs, how

/// they went and what they sent. Sent at the first scheduler tick from

/// SUMMARY_HOUR (UTC), once a day. How many owners were told.

pub async fn daily_summary(app: &Shared, now_ms: i64, force: bool) -> sqlx::Result<usize> {

    let t = time::OffsetDateTime::from_unix_timestamp_nanos(now_ms as i128 * 1_000_000).unwrap_or(time::OffsetDateTime::UNIX_EPOCH);

    let day = format!("{:04}-{:02}-{:02}", t.year(), u8::from(t.month()), t.day());

    if !force && (t.hour() < SUMMARY_HOUR || db::accounts::setting(&app.db, SUMMARY_SENT).await?.as_deref() == Some(day.as_str())) {

        return Ok(0);

    db::accounts::set_setting(&app.db, SUMMARY_SENT, &day).await?;

    let settings: Vec<Setting> = sqlx::query_as("SELECT * FROM backup_settings WHERE updated_ms > 0").fetch_all(&app.db).await?;

    let mut sent = 0;

    for s in settings {

        let runs: Vec<Run> = sqlx::query_as("SELECT * FROM backup_runs WHERE owner = ? AND started_ms >= ? ORDER BY id")

            .bind(&s.owner)

            .bind(now_ms - 86_400_000)

            .fetch_all(&app.db)

            .await?;

        if runs.is_empty() {

            continue;

        let ok = runs.iter().filter(|r| r.status == "ok").count();

        let bytes: i64 = runs.iter().map(|r| r.bytes).sum();

        let repos = runs.iter().rev().find(|r| r.status == "ok").map_or(0, |r| r.repos);

        let how = if ok == runs.len() { "all ok".to_string() } else { format!("{} not whole", runs.len() - ok) };

        let title = format!(

            "Backups of {} today: {} runs, {how}, {repos} repositories, {:.1} MiB sent to {}",

            s.owner,

            runs.len(),

            bytes as f64 / 1_048_576.0,

            place(&s)

        );

        let Some((who, url)) = told(app, &s).await else { continue };

        crate::notify::tell(app, "backup.summary", &title, &url, "backups", None, who).await;

        sent += 1;

    Ok(sent)

        if let Err(e) = daily_summary(&app, db::now_ms(), false).await {

            tracing::warn!("backup summary: {e}");

        }

    /// An agent uses it: what is done with it is told to its owner

    /// (migration 0065, oxygenhub#183).

    #[sqlx(default)]

    pub agent: bool,

}

/// Mark one of `account_id`'s tokens as an agent's, or not.

pub async fn set_token_agent(pool: &Pool, account_id: i64, id: i64, agent: bool) -> sqlx::Result<bool> {

    let r = sqlx::query("UPDATE tokens SET agent = ? WHERE id = ? AND account_id = ?")

        .bind(agent)

        .bind(id)

        .bind(account_id)

        .execute(pool)

        .await?;

    Ok(r.rows_affected() > 0)

/// The accounts that own repository `repo_id`: its owner, or the owners of

/// the organisation that owns it. They watch it unless they mute it

/// (oxygenhub#183).

pub async fn owners_of(pool: &Pool, repo_id: i64) -> sqlx::Result<Vec<i64>> {

    let owner: Option<String> =

        sqlx::query_scalar("SELECT owner FROM repositories WHERE id = ?").bind(repo_id).fetch_optional(pool).await?;

    let Some(owner) = owner else { return Ok(Vec::new()) };

    if let Some(a) = super::accounts::account_by_name(pool, &owner).await? {

        return Ok(vec![a.id]);

    }

    match super::accounts::org_by_name(pool, &owner).await? {

        Some(o) => {

            Ok(super::accounts::org_members(pool, o.id).await?.into_iter().filter(|(_, r)| r == "owner").map(|(a, _)| a.id).collect())

        }

        None => Ok(Vec::new()),

    }

}

/// Whether `account_id` watches `repo_id`: a watch it chose, or, for an

/// owner, unless it muted it.

    let muted: Option<bool> = sqlx::query_scalar("SELECT muted FROM watches WHERE account_id = ? AND repo_id = ?")

        .fetch_optional(pool)

    match muted {

        Some(m) => Ok(!m),

        None => Ok(owners_of(pool, repo_id).await?.contains(&account_id)),

    }

/// Watch `repo_id`, or stop: for an owner, stopping mutes it.

    sqlx::query("INSERT INTO watches (account_id, repo_id, muted) VALUES (?, ?, ?) ON CONFLICT (account_id, repo_id) DO UPDATE SET muted = excluded.muted")

        .bind(account_id)

        .bind(repo_id)

        .bind(!on)

        .execute(pool)

        .await?;

/// Everyone watching `repo_id`: those who chose to, and its owners who

/// have not muted it.

    let rows: Vec<(i64, bool)> =

        sqlx::query_as("SELECT account_id, muted FROM watches WHERE repo_id = ?").bind(repo_id).fetch_all(pool).await?;

    let mut out: Vec<i64> = rows.iter().filter(|(_, m)| !m).map(|(a, _)| *a).collect();

    for o in owners_of(pool, repo_id).await? {

        if !rows.iter().any(|(a, _)| *a == o) && !out.contains(&o) {

            out.push(o);

        }

    }

    Ok(out)

    let watchers = super::notify::watchers(pool, repo_id).await?.len() as i64;

            // Told as a proposal opened on the web is (oxygenhub#183).

            crate::notify::deliver(

                app,

                crate::notify::Event {

                    kind: "proposal.opened",

                    title: format!("{}/{}#{}: {}", consumer.owner, consumer.name, p.number, p.title),

                    url: format!("/{}/{}/proposal/{}", consumer.owner, consumer.name, p.number),

                    actor: &me,

                    repo_id: consumer.id,

                    thread: Some(("proposal", p.id)),

                    mention_text: "",

                    direct: vec![],

                },

            )

            .await;

        // A pass after a failure on the same bookmark: fixed (#183).

        if done.status == "passed" {

            let before: Option<String> = sqlx::query_scalar(

                "SELECT status FROM flow_runs WHERE repo_id = ? AND bookmark = ? AND id < ? AND status IN ('passed', 'failed')

                 ORDER BY id DESC LIMIT 1",

            )

            .bind(done.repo_id)

            .bind(&done.bookmark)

            .bind(done.id)

            .fetch_optional(&app.db)

            .await?;

            // Or this very run failed and a job of it was run again.

            let url = format!("/{}/{}/flow/{}", row.owner, row.name, done.number);

            let failed_here: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM notifications WHERE kind = 'flow.failed' AND url = ?")

                .bind(&url)

                .fetch_one(&app.db)

                .await?;

            if before.as_deref() == Some("failed") || failed_here > 0 {

                tell_fixed(app, &row, &done).await;

            }

        }

            url: format!("/{}/{}/flow/{}", row.owner, row.name, run.number),

            actor: &me,

            repo_id: row.id,

            thread: None,

            mention_text: "",

            direct: pusher.into_iter().map(|a| a.id).collect(),

        },

    )

    .await;

}

/// A run that passes after its bookmark's last one failed (oxygenhub#183):

/// its pusher and the repository's watchers hear it is green again.

async fn tell_fixed(app: &Shared, row: &db::repos::RepoRow, run: &fdb::Run) {

    let Some(me) = flow_account(&app.db).await else { return };

    let pusher = db::accounts::account_by_name(&app.db, &run.actor).await.ok().flatten();

    let on = if run.bookmark.is_empty() { String::new() } else { format!(" on {}", run.bookmark) };

    crate::notify::deliver(

        app,

        crate::notify::Event {

            kind: "flow.fixed",

            title: format!("{}/{}: run #{}{on} passed: fixed", row.owner, row.name, run.number),

    web::router(app.clone())

        .layer(axum::middleware::from_fn_with_state(app, agent_requests))

        .layer(axum::middleware::from_fn(private_pages))

        .layer(axum::middleware::from_fn(slow_requests))

/// A request made with a token its owner marked as an agent's runs with

/// that token's name in [`notify::AGENT`], so what the agent does is told

/// to its owner (oxygenhub#183).

async fn agent_requests(

    axum::extract::State(app): axum::extract::State<Shared>,

    req: axum::extract::Request,

    next: axum::middleware::Next,

) -> axum::response::Response {

    let token = req

        .headers()

        .get(axum::http::header::AUTHORIZATION)

        .and_then(|v| v.to_str().ok())

        .and_then(|v| v.strip_prefix("Bearer "))

        .map(|t| auth::token_hash(t.trim()));

    let agent = match token {

        Some(hash) => db::accounts::token_by_hash(&app.db, &hash).await.ok().flatten().filter(|t| t.agent).map(|t| t.name),

        None => None,

    };

    notify::AGENT.scope(agent, next.run(req)).await

}

tokio::task_local! {

    /// The name of the agent-marked token this request came with, if any

    /// (oxygenhub#183): what an agent does with it is told to the token's

    /// owner too, though the owner is the actor.

    pub static AGENT: Option<String>;

}

/// The agent token acting now, when there is one.

pub fn agent_acting() -> Option<String> {

    AGENT.try_with(|a| a.clone()).ok().flatten()

}

    // Never the actor, unless an agent acted with their token: then they

    // hear what their agent did.

    let agent = agent_acting();

    if agent.is_none() {

        targets.retain(|(id, _)| *id != ev.actor.id);

    }

    let actor = match &agent {

        Some(token) => format!("{} (agent token {token})", ev.actor.username),

        None => ev.actor.username.clone(),

    };

    tell(app, ev.kind, &ev.title, &ev.url, &actor, (ev.repo_id > 0).then_some(ev.repo_id), targets).await;

}

/// Tell each of `targets` about something: an inbox row, and an email

/// where the account asked for them and has proven its address.

pub async fn tell(app: &Shared, kind: &str, title: &str, url: &str, actor: &str, repo_id: Option<i64>, targets: Vec<(i64, ndb::Reason)>) {

    let pool = &app.db;

        ndb::add(pool, ndb::New { account_id: id, repo_id, reason, kind, title, url, actor }).await.ok();

                email(app, &a, title, url, actor).await;

        .route("/settings/tokens/{id}/agent", post(settings::tokens_agent))

    /// That step's proof of the password (`auth::pending_login`), so it

    /// asks only for the code.

    pending: String,

        pending: String::new(),

    #[serde(default)]

    /// The code step's proof of the password (`auth::pending_login`).

    #[serde(default)]

    pending: String,

    // The code step carries proof of the password, good for a few minutes;

    // a fresh one goes with each retry of the code.

    let now_ms = db::now_ms();

    let proven = !f.pending.is_empty()

        && account.as_ref().is_some_and(|a| auth::pending_login_ok(&app.cookie_key, &a.username, &a.session_salt, &f.pending, now_ms));

    let pending = account

        .as_ref()

        .map(|a| auth::pending_login(&app.cookie_key, &a.username, &a.session_salt, now_ms + PENDING_LOGIN_MS))

        .unwrap_or_default();

    let fail = |msg: &str, totp_for: Option<String>| {

        Page(LoginPage {

            shell: shell.clone(),

            error: Some(msg.into()),

            next: next.clone(),

            totp_for,

            pending: pending.clone(),

            reset: false,

            providers: vec![],

        })

        .into_response()

    };

    if !f.pending.is_empty() && !proven {

        return Ok(fail("That took too long: sign in again.", None));

    }

    let Some(account) = account.filter(|a| proven || auth::verify_password(&a.password_hash, &f.password)) else {

/// How long the code step of a sign-in may take after the password.

const PENDING_LOGIN_MS: i64 = 5 * 60 * 1000;

    }

    // The site's administrators hear of each new account (oxygenhub#183).

    if !first {

        let admins: Vec<(i64, crate::db::notify::Reason)> = accounts::accounts(&app.db)

            .await

            .unwrap_or_default()

            .into_iter()

            .filter(|a| a.is_admin)

            .map(|a| (a.id, crate::db::notify::Reason::Participating))

            .collect();

        let title = format!("New account: {username} signed up on {}", app.config.site.name);

        crate::notify::tell(&app, "account.registered", &title, &format!("/{username}"), &username, None, admins).await;

    /// An agent uses it: tell me what it does (oxygenhub#183).

    #[serde(default)]

    agent: String,

    if !f.agent.is_empty() {

        if let Ok(Some(t)) = accounts::token_by_hash(&app.db, &hash).await {

            accounts::set_token_agent(&app.db, me.account.id, t.id, true).await.map_err(|e| Error::from_db(shell.clone(), e))?;

        }

    }

}

/// Mark a token as an agent's, or not (oxygenhub#183): what is done with

/// an agent's token is told to its owner, as anyone else's doing is.

pub async fn tokens_agent(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<i64>,

    Form(f): Form<super::session::CsrfForm>,

) -> Result<Page<TokensPage>, Error> {

    let shell = Shell::new(&app, "/settings/tokens", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf, &shell)?;

    let tokens = accounts::tokens_of(&app.db, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let Some(t) = tokens.iter().find(|t| t.id == id) else {

        return tokens_page(&app, shell, me.account, None, None, Some("No such token.".into())).await;

    };

    accounts::set_token_agent(&app.db, me.account.id, id, !t.agent).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "token.agent", &t.name, if t.agent { "off" } else { "on" }).await.ok();

    let notice = if t.agent {

        format!("{} is no longer marked as an agent's.", t.name)

    } else {

        format!("{} is an agent's: you will hear what it does.", t.name)

    };

    tokens_page(&app, shell, me.account, None, Some(notice), None).await

    // The code step asks for the code alone: the password is not typed

    // again, the step carries proof of it instead.

    assert!(!names.contains(&"password"), "{names:?}");

    let pending = form.split("name=\"pending\" value=\"").nth(1).unwrap().split('"').next().unwrap().to_string();

    let fill = |pending: &str| -> String {

        names

            .iter()

            .map(|n| match *n {

                "username" => "username=andy".to_string(),

                "pending" => format!("pending={pending}"),

                "code" => format!("code={code}"),

                other => format!("{other}="),

            })

            .collect::<Vec<_>>()

            .join("&")

    };

    // A forged or stale proof starts again.

    let r = post(app, "/login", None, &fill("1.forged")).await;

    assert!(r.body.contains("sign in again") && r.cookie.is_none(), "{}", r.body);

    let r = post(app, "/login", None, &fill(&pending)).await;

    // A whole run after a failed one says it works again; the day's

    // summary tells the owner what ran (#183).

    sqlx::query("INSERT INTO backup_runs (owner, started_ms, finished_ms, status, at, trigger, detail) VALUES ('andy', 1, 2, 'failed', 'x', 'schedule', 'GCS refused')")

        .execute(&h.app.db)

        .await

        .unwrap();

    tokio::time::sleep(std::time::Duration::from_millis(1100)).await;

    let again = backups::run(&h.app, "andy", "now").await.unwrap();

    assert_eq!(again.status, "ok");

    let told = |db: sqlx::SqlitePool| async move { db::notify::inbox(&db, andy.id, 20).await.unwrap() };

    assert!(told(h.app.db.clone()).await.iter().any(|n| n.kind == "backup.recovered" && n.title.contains("works again")));

    assert_eq!(backups::daily_summary(&h.app, db::now_ms(), true).await.unwrap(), 1);

    let summary = told(h.app.db.clone()).await.into_iter().find(|n| n.kind == "backup.summary").expect("a summary");

    assert!(summary.title.contains("Backups of andy today") && summary.title.contains("runs"), "{}", summary.title);

    // Andy owns it: told it failed, then that it is fixed (#183).

    let andy_id = db::accounts::account_by_name(&h.app.db, "andy").await.unwrap().unwrap().id;

    let kinds: Vec<String> = db::notify::inbox(&h.app.db, andy_id, 20).await.unwrap().into_iter().map(|n| n.kind).collect();

    assert!(kinds.contains(&"flow.failed".to_string()) && kinds.contains(&"flow.fixed".to_string()), "{kinds:?}");

/// oxygenhub#183: an owner hears about their repository by default, until

/// they mute it; what an agent does with a token its owner marked is told

/// to that owner; the administrators hear of each new account.

#[tokio::test(flavor = "multi_thread")]

async fn owners_hear_by_default_and_agents_tell_their_owner() {

    let h = hub().await;

    let app = &h.app;

    let andy = register(app, "andy").await;

    let bob = register(app, "bob").await;

    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;

    let kinds = |id: i64| {

        let db = app.db.clone();

        async move { db::notify::inbox(&db, id, 50).await.unwrap().into_iter().map(|n| (n.kind, n.title, n.actor)).collect::<Vec<_>>() }

    };

    assert!(kinds(andy_id).await.iter().any(|(k, t, _)| k == "account.registered" && t.contains("bob")), "the administrator hears of bob");

    let repo = RepoName::parse("andy/demo").unwrap();

    app.repos.create(&repo, None).unwrap();

    db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();

    let open = |who: &'static str, title: &'static str| {

        let (app, cookie) = (app.clone(), if who == "bob" { bob.clone() } else { andy.clone() });

        async move {

            let csrf = csrf_of(&get(&app, "/andy/demo/issues/new", Some(&cookie)).await.body);

            post(&app, "/andy/demo/issues/new", Some(&cookie), &format!("_csrf={csrf}&title={title}&body=x")).await

        }

    };

    // Andy never pressed Watch, but owns it: he hears of bob's issue.

    assert!(get(app, "/andy/demo", Some(&andy)).await.body.contains("UNWATCH"), "an owner watches by default");

    open("bob", "First").await;

    assert!(kinds(andy_id).await.iter().any(|(k, t, _)| k == "issue.opened" && t.contains("First")));

    // Muted, he does not.

    let csrf = csrf_of(&get(app, "/andy/demo", Some(&andy)).await.body);

    post(app, "/andy/demo/watch", Some(&andy), &format!("_csrf={csrf}")).await;

    assert!(get(app, "/andy/demo", Some(&andy)).await.body.contains(">WATCH<"), "muted");

    open("bob", "Second").await;

    assert!(!kinds(andy_id).await.iter().any(|(_, t, _)| t.contains("Second")));

    post(app, "/andy/demo/watch", Some(&andy), &format!("_csrf={csrf}")).await;

    // His own doing is not told to him; his agent's is.

    let token = |agent: bool| {

        let db = app.db.clone();

        async move {

            let (t, hash) = oxygenhub::auth::new_token();

            db::accounts::create_token(&db, andy_id, if agent { "Claude" } else { "laptop" }, &hash, "repo:read,repo:write", "", None)

                .await

                .unwrap();

            if agent {

                let id = db::accounts::token_by_hash(&db, &hash).await.unwrap().unwrap().id;

                db::accounts::set_token_agent(&db, andy_id, id, true).await.unwrap();

            }

            t

        }

    };

    let api_issue = |t: String, title: &'static str| {

        let app = app.clone();

        async move {

            use tower::ServiceExt;

            let req = axum::http::Request::post("/api/v1/repos/andy/demo/issues")

                .header("authorization", format!("Bearer {t}"))

                .header("content-type", "application/json")

                .body(axum::body::Body::from(serde_json::json!({ "title": title, "body": "" }).to_string()))

                .unwrap();

            oxygenhub::router(app).oneshot(req).await.unwrap().status()

        }

    };

    assert_eq!(api_issue(token(false).await, "By hand").await, StatusCode::CREATED);

    assert!(!kinds(andy_id).await.iter().any(|(_, t, _)| t.contains("By hand")), "his own doing");

    assert_eq!(api_issue(token(true).await, "By the agent").await, StatusCode::CREATED);

    let told = kinds(andy_id).await;

    let agent = told.iter().find(|(_, t, _)| t.contains("By the agent")).expect("told of his agent's issue");

    assert_eq!(agent.2, "andy (agent token Claude)");

    // The tokens page marks and unmarks one.

    let page = get(app, "/settings/tokens", Some(&andy)).await;

    assert!(page.body.contains("agent ✓") && page.body.contains("mark as agent"), "{}", page.body);

}

**Who hears, and of what** (oxygenhub#183, 2026-10-14). A repository's owners (the user, or an organisation's owners) watch it by default and stop by unwatching it, which mutes it (`watches.muted`, migration 0065); others watch by choice. A proposal Diffusion opens is told as one opened on the web is. The actor is never told of their own doing, except through a token they marked as an agent's (Settings › Tokens, "an agent uses this token"): a request with it runs with the token's name in `notify::AGENT`, and its events reach the owner like anyone else's, the actor shown as `andymccall (agent token Claude)`. OxygenFlow tells a run's pusher and the watchers when it fails (`flow.failed`) and when a bookmark is green again (`flow.fixed`: the run before on it failed, or this run had failed and a job of it was run again). Backups tell the owner when a run is not whole (once per spell), when one is whole again (`backup.recovered`), and once a day from 07:00 UTC with the day's runs, outcome, repositories and bytes sent (`backup.summary`). The site's administrators hear of each new account (`account.registered`). Each goes to the inbox, and by email to accounts that turned email on and verified their address.

  <input type="hidden" name="pending" value="{{ pending }}">

  <p>Password accepted for <strong>{{ u }}</strong>. Enter the six-digit code from your authenticator app, or a recovery code.</p>

<tr><th>Name</th><th>Scopes</th><th>Repositories</th><th>Created</th><th>Last used</th><th>Expires</th><th title="What an agent does with this token is told to you">Agent</th><th></th></tr>

<td><form class="tiny" method="post" action="/settings/tokens/{{ t.id }}/agent"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button title="{% if t.agent %}Stop telling me what is done with it{% else %}An agent uses this token: tell me what it does{% endif %}">{% if t.agent %}agent ✓{% else %}mark as agent{% endif %}</button></form></td>

  <label class="choice"><input type="checkbox" name="agent" value="1"> An agent uses this token: tell me what it does <span class="small mute">(proposals it opens, comments it makes and the rest reach your inbox and email like anyone else's would)</span></label>