Web Push notifications

ShellWatch is a Progressive Web App. With Web Push enabled, sign requests fired by AI agents or local ssh clients on any of your machines can land as native OS-level notifications on your phone — and tapping the notification takes you straight to /sign/:id to approve.

On app.shellwatch.ai, Web Push is ready to go — you just need to subscribe.

Subscribe

1. In the Web UI, go to Settings → Notifications.
2. The browser will prompt for notification permission. Allow it.
3. ShellWatch stores the push subscription against your account.
4. Optionally install the app to your home screen / dock (see below) so the icon launches the PWA shell instead of a browser tab.

You can subscribe from multiple devices — each gets its own subscription. Sign requests fan out to all of them.

Install as a PWA

• iOS Safari: Share → “Add to Home Screen”. Web Push on iOS requires the PWA to be installed; a regular Safari tab won’t work.
• Android Chrome: address-bar menu → “Install app” / “Add to Home screen”.
• macOS / Windows: most desktop browsers offer “Install ShellWatch” in the address bar / app menu.

What you’ll see

When a sign request fires for your account and no live tab is connected:

• iOS / Android: a native notification with the endpoint label (or agent-proxy source) and a “Tap to approve” body. Tapping it opens /sign/:id in the PWA.
• macOS / Windows: a notification-center toast with the same content. Click to open.

If a tab is open, you get the in-app toast instead — no duplicate push.

Caveats

• Push delivery depends on the OS push service (APNs, FCM). Latency varies — usually under a second, sometimes longer on cellular.
• Approval still has the 60-second TTL. If the push takes 30 seconds to arrive and you take 35 to react, you’ll miss it. The agent’s ssh will see a sign failure and either retry or fail.
• Disable per-device in Settings → Notifications by removing the subscription, or revoke browser-side via your OS settings.

Combine with the agent proxy

This pairs especially well with the SSH agent proxy. With any local ssh (workstation, dev box, the host running your AI coding agent) signing through the broker, your phone effectively becomes the approval device — those sessions can’t open without you tapping a passkey on your phone.