tim plugin, chat bot sync notifications, test fixes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/inc/bootstrap.php

@@ -189,6 +189,12 @@ $chatColNames = array_column($chatCols, 'name');
 if (!in_array('seen', $chatColNames)) {
     $db->exec('ALTER TABLE chat_messages ADD COLUMN seen INTEGER NOT NULL DEFAULT 0');
 }
+// Bot notifications: automated sync confirmations ("alice synced: My Card").
+// `bot` column = 1 means the UI renders it as a system notification in the
+// orange accent color instead of a regular chat bubble.
+if (!in_array('bot', $chatColNames)) {
+    $db->exec('ALTER TABLE chat_messages ADD COLUMN bot INTEGER NOT NULL DEFAULT 0');
+}
 $db->exec('CREATE INDEX IF NOT EXISTS idx_chat_sender_state ON chat_messages(sender_id, id)');
 
 // Collaborative buckets: shared among multiple tenants. Each bucket has one

relay/inc/routes/chat.php

@@ -62,7 +62,7 @@ if ($route === '/api/chat/history' && $method === 'GET' && $sessionTenant) {
     if (!$peerTenant) jsonResponse(['error' => 'unknown peer'], 404);
     $peerId = $peerTenant['id'];
     $stmt = $db->prepare('
-        SELECT id, sender_id, sender_username, body, created_at, seen
+        SELECT id, sender_id, sender_username, body, created_at, seen, bot
         FROM chat_messages
         WHERE (recipient_id = :r AND sender_id = :p) OR (recipient_id = :p2 AND sender_id = :s)
         ORDER BY created_at ASC LIMIT 500
@@ -78,6 +78,7 @@ if ($route === '/api/chat/history' && $method === 'GET' && $sessionTenant) {
             'body' => clientDecrypt($row['body'] ?? '', $interKey),
             'created_at' => $row['created_at'],
             'seen' => (int)$row['seen'],
+            'bot' => (int)($row['bot'] ?? 0),
         ];
     }
     // Mark incoming as seen
@@ -106,6 +107,29 @@ if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
 
 $clientTenant = $clientTenant ?? authClient($db);
 
+// Bot notification: client announces "I synced a card" to the sender.
+// No encryption — body is a short system-generated string like
+// "alice synced: Card Title". bot=1 flags it so the UI renders in
+// the orange accent color.
+if ($route === '/api/chat/bot' && $method === 'POST') {
+    if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
+    $input = json_decode(file_get_contents('php://input'), true) ?: [];
+    $body = trim((string)($input['body'] ?? ''));
+    $recipientName = trim((string)($input['recipient'] ?? ''));
+    if ($body === '') jsonResponse(['error' => 'body required'], 400);
+    if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
+    if ($recipientName === $clientTenant['username']) jsonResponse(['ok' => true, 'id' => 0]); // no self-notifications
+    $recipient = getTenantByUsername($db, $recipientName);
+    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $stored = clientEncrypt($body, $interKey);
+    $db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body, bot) VALUES (:r, :s, :sn, :b, 1)')
+        ->execute(['r' => $recipient['id'], 's' => $clientTenant['id'], 'sn' => $clientTenant['username'], 'b' => $stored]);
+    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
+}
+
+
 if ($route === '/api/chat' && $method === 'POST') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
     $input = json_decode(file_get_contents('php://input'), true) ?: [];