Notifications from a Windows machine (from #115)

README.md

@@ -90,6 +90,8 @@ New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value 'C:\Prog
 
 Then pair as above with `python herdr-push pair`. For a user in Administrators, Windows' sshd reads keys from `C:\ProgramData\ssh\administrators_authorized_keys`, so run `pair` in a terminal opened as administrator too (or add the key there by hand).
 
+For notifications, the PC has to be awake and signed in: the watcher runs in your signed-in session, and herdr-push needs a Python 3 there (the app finds `python3`, `python` or `py -3`, and skips the Microsoft Store's stand-in). See [Notifications while the app is closed](#notifications-while-the-app-is-closed).
+
 Machines reachable only through another one can use it as a jump host ("Connect through"). For zero-touch or read-only machines, **Allow host scripts** (on by default) can be turned off so the app skips copying its helper scripts (`herdr-usage`, `herdr-logins`, `herdr-push`) there. From a machine's menu, **Import herdr machines** adds the machines its herdr already knows (`herdr machine list`).
 
 ## How it talks to herdr
@@ -218,6 +220,8 @@ Two ways in, both on every machine the app knows:
 
 Each state is shown once, however it arrives, and comes down again when it is over (answered on the desktop, the agent back at work). The switch next to a machine in Settings leaves it out.
 
+**On a Windows PC** the app sets herdr-push up the same way, with no administrator rights: a `Run` entry under your user starts it when you sign in, and a scheduled task of yours starts it right away in your desktop session. It reads the Herdr desktop app's herdr-core (where one runs), RAM, CPU, drives and the biggest processes, and tells the phone how long ago you last used the keyboard or mouse and whether the session is locked. The PC has to be awake and signed in: with nobody signed in, herdr-push's install says so (and its `status` shows `interactive: false`), and it starts with the next sign-in. The phone needs ntfy (or another UnifiedPush app), as for any machine. Classic herdr, Shepherdr and App change are not there.
+
 ### What reaches the phone
 
 **Settings → Notifications → What reaches the phone** has a switch for each kind: **Needs you** (an agent asks, a machine runs low), **Finished** (an agent ended its turn), **Went wrong** (a review or a check failed) and **Limits** (an AI provider at 80% or 95% of a limit or out of it; see Usage and limits). Finished is off unless you turn it on: a ping for every finished turn teaches you to ignore the ones that matter. What is switched off isn't shown, and turning it on later starts from then.

core/src/test/kotlin/com/makefunstuff/herdr/core/PushTest.kt

@@ -217,7 +217,7 @@ class HerdrPushTest {
     @Test
     fun bundledScriptIsTheOneInHost() {
         assertEquals(script.readText(), HerdrPush.script)
-        assertEquals("12", HerdrPush.version)
+        assertEquals("13", HerdrPush.version)
     }
 
     @Test

host/herdr-push/README.md

@@ -36,6 +36,21 @@ A machine that is offline is set up the next time the app connects to it. Machin
 
 The app also **looks at its machines itself** while it is closed (every 15 minutes by default; Settings → Notifications → The app also looks), with an exact alarm. That covers a machine without python3, or a push that got lost. Pushes arrive within seconds; the app's own looks only as often as you set.
 
+## On Windows
+
+herdr-push runs on a Windows PC with Git Bash under OpenSSH Server (see the README's "A Windows machine"), with Python 3.6 or newer. The app installs it as it does elsewhere; by hand, `python herdr-push install` does the same.
+
+It starts without administrator rights, in two ways:
+
+- A `Run` value under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, `"<pythonw.exe>" "<script>" run`, starts it when you sign in.
+- A scheduled task of yours named `herdr-push`, with no time limit, which `install` and `ensure` run to start it now. It starts in your desktop session, because a process started from the SSH session ends with it.
+
+`uninstall` removes both. `status` says `"autostart": "windows-run"` and `"interactive": true` when the watcher can run in a signed-in session, `false` when nobody is signed in: the PC has to be awake and signed in for pushes to come.
+
+`presence` run over SSH on Windows reads as away and locked (an SSH session has no input desktop); the watcher, running in the signed-in session, sends the real value.
+
+What works there: agents in herdr-core (read through `herdr-core connect`, only where `herdr-core server status` says a core runs; classic herdr is not on Windows), RAM, CPU, each fixed drive (as `/c`, `/d`…) and the top processes, and presence: how long ago the PC had keyboard or mouse input, and whether the session is locked. Shepherdr and App change are not there.
+
 ## What it puts on the machine
 
 | Path | What |
@@ -46,14 +61,15 @@ The app also **looks at its machines itself** while it is closed (every 15 minut
 | `~/.config/systemd/user/herdr-push.service` | Linux with systemd: a user service, `Restart=always` |
 | `~/Library/LaunchAgents/dev.herdr.push.plist` | macOS: a launchd agent |
 | an `@reboot` line in your crontab | elsewhere, when there is `crontab` |
+| the `Run` value and the `herdr-push` scheduled task of your user | Windows (see above) |
 
 On Linux, a user service stops when your last login ends unless lingering is on. herdr-push turns it on (`loginctl enable-linger`) where the system lets you; where it doesn't, the app's Settings say "it stops when you log out", and an admin can run `loginctl enable-linger <you>`. Without any of these, the app starts herdr-push again whenever it connects.
 
 ## By hand
 
 ```sh
 P=~/.local/share/herdr-push/herdr-push
-python3 $P status          # running?, start-up entry, phones, last error
+python3 $P status          # running?, start-up entry, phones, last error (on Windows also interactive: whether a user is signed in)
 python3 $P once --dry-run  # one look: what it would send now (the first look only learns how things stand)
 python3 $P test            # a test notification to every phone
 python3 $P journal         # what it kept for the brief (--since <unix seconds>)
@@ -103,7 +119,7 @@ Anyone who sees the code within its five minutes could pair with it, as with any
 
 It touches one line in `~/.ssh/authorized_keys` while it waits (then the phone's key is there instead), and `pair-<token>.json` and `pair.lock` in `~/.local/state/herdr-push/`. It needs neither the watcher running nor a phone subscribed.
 
-On Windows (OpenSSH Server with Git Bash as its `DefaultShell`), `pair` is the one command that runs: `python herdr-push pair`. It reads the host keys and `sshd_config` in `C:\ProgramData\ssh`, writes the one-time key's command with forward-slash paths for Bash, and, for a user in Administrators while the stock `Match Group administrators` block is there, uses `administrators_authorized_keys`, which only a terminal opened as administrator can change.
+On Windows (OpenSSH Server with Git Bash as its `DefaultShell`), `python herdr-push pair` works too. It reads the host keys and `sshd_config` in `C:\ProgramData\ssh`, writes the one-time key's command with forward-slash paths for Bash, and, for a user in Administrators while the stock `Match Group administrators` block is there, uses `administrators_authorized_keys`, which only a terminal opened as administrator can change.
 
 It can't help when sshd reads keys from elsewhere (`AuthorizedKeysFile` in `/etc/ssh/sshd_config`; the phone then says the machine still refuses its key), or when the phone reaches the machine only through another one (a jump host): add those by hand.