fix(bluebubbles): avoid stale duplicate webhook events

[jeremyknows]

Summary

BlueBubbles webhook registration now subscribes only to new-message events and replaces existing registrations for the same URL when their event set is stale. This avoids duplicate inbound handling from updated-message registrations while still reusing an already-correct webhook after restart.

Diff scope

• gateway/platforms/bluebubbles.py — register with new-message only; compare existing webhook events; delete/recreate stale registrations.
• tests/gateway/test_bluebubbles.py — regression coverage for fresh registration, stale-event replacement, existing correct registration reuse, and duplicate cleanup.

Verification

$ HOME=/Users/watson scripts/run_tests.sh tests/gateway/test_bluebubbles.py
▶ running pytest with 4 workers, hermetic env, in /tmp/hermes-bluebubbles-v014
  (TZ=UTC LANG=C.UTF-8 PYTHONHASHSEED=0; all credential env vars unset)
============================= test session starts ==============================
platform darwin -- Python 3.11.14, pytest-9.0.2, pluggy-1.6.0
rootdir: /private/tmp/hermes-bluebubbles-v014
configfile: pyproject.toml
plugins: xdist-3.8.0, split-0.11.0, asyncio-1.3.0, anyio-4.13.0
created: 4/4 workers
4 workers [50 items]

..................................................                       [100%]
============================== 50 passed in 1.00s ==============================

$ /Users/watson/.hermes/hermes-agent/venv/bin/python -m ruff check gateway/platforms/bluebubbles.py tests/gateway/test_bluebubbles.py
All checks passed!

$ git diff --check origin/main...HEAD
# no output

Real-behavior proof

• Behavior addressed: BlueBubbles webhook setup could subscribe to both new-message and updated-message, and an old same-URL webhook with stale events could be reused instead of corrected.
• Real environment tested: Local Hermes Agent checkout on macOS, Python 3.11.14, pytest 9.0.2; mocked BlueBubbles client in tests/gateway/test_bluebubbles.py.
• Exact command: HOME=/Users/watson scripts/run_tests.sh tests/gateway/test_bluebubbles.py
• Evidence after fix: full targeted suite above: 50 passed in 1.00s.
• Observed result: Fresh registration posts events == ["new-message"]; stale same-URL registrations containing updated-message are deleted and recreated; already-correct same-URL new-message registrations are reused.
• What was NOT tested: A live BlueBubbles server/device was not contacted; this PR validates the adapter behavior with mocked API responses.

Regression check against pre-fix base

I copied the updated BlueBubbles test file onto origin/main in a detached worktree and ran the two behavior tests that cover this change:

$ HOME=/Users/watson scripts/run_tests.sh \
  tests/gateway/test_bluebubbles.py::TestBlueBubblesWebhookRegistration::test_register_fresh \
  tests/gateway/test_bluebubbles.py::TestBlueBubblesWebhookRegistration::test_register_replaces_stale_event_registration
created: 4/4 workers
4 workers [2 items]

FF                                                                       [100%]
FAILED tests/gateway/test_bluebubbles.py::TestBlueBubblesWebhookRegistration::test_register_replaces_stale_event_registration
E       assert 0 == 1
E        +  where 0 = len([])
FAILED tests/gateway/test_bluebubbles.py::TestBlueBubblesWebhookRegistration::test_register_fresh
E       AssertionError: assert ['new-message...ated-message'] == ['new-message']
============================== 2 failed in 0.88s ===============================

Test plan

• Targeted BlueBubbles gateway tests pass.
• Ruff passes on changed files.
• Diff whitespace check passes.
• Regression check fails on origin/main with the updated behavior tests.

Commits

1. 3a0c51194 fix(bluebubbles): register new-message webhooks only
2. 64fb41983 fix(bluebubbles): replace stale webhook event registrations

[teknium1]

Thanks for the focused BlueBubbles fix. I verified the core premise still holds on current main: gateway/platforms/bluebubbles.py:367 registers both new-message and updated-message, and gateway/platforms/bluebubbles.py:356 reuses an existing same-URL webhook without checking its event set.

Problems

• The PR branch predates the BlueBubbles secret-redaction fix in 514f502. In PR head, gateway/platforms/bluebubbles.py:279, :298, and :338 log webhook_url directly; that URL can include the webhook password query parameter. Current main uses self._webhook_register_url_for_log at these same log sites.

Suggested changes

• Preserve the PR’s new-message-only registration and stale-event replacement behavior, but keep current main’s _webhook_register_url_for_log usage for all registration/unregistration logs.
• Keep the regression coverage for the exact payload events and stale same-URL registration cleanup; those tests cover the verified bug class at gateway/platforms/bluebubbles.py:356-367.

This is an automated hermes-sweeper review.

[teknium1]

Thanks for the focused BlueBubbles fix. The core premise remains valid on current main: gateway/platforms/bluebubbles.py:365-377 reuses same-URL webhooks without validating event sets and registers both message event types.

Problems

• PR head regresses the password-redaction fix: its gateway/platforms/bluebubbles.py:279, :298, and :338 log the password-bearing webhook_url. Current main commit 514f5020c uses _webhook_register_url_for_log for these sites.
• At PR-head gateway/platforms/bluebubbles.py:282, a failed _unregister_webhook() is ignored before the replacement POST. Since _unregister_webhook() suppresses delete exceptions and returns False (:327-345), this can leave the stale webhook in place and add another duplicate. The new test covers only successful deletion (tests/gateway/test_bluebubbles.py:602-626).

Suggested changes

• Preserve current main's masked log URL at all registration and unregistration log sites.
• Do not POST a replacement when stale-registration deletion fails; add a failed-delete/no-POST regression test.

This is an automated hermes-sweeper review.

[teknium1]

_unregister_webhook() catches delete failures and returns False, but this result is ignored before creating a new registration. If deletion fails, the old stale webhook remains and this POST creates the duplicate this change is meant to avoid. Return failure/retry without POSTing, and add a failed-delete regression test.

[GottZ]

This was generated by AI during triage.

Summary

Three PRs address overlapping BlueBubbles duplicate-delivery and webhook-lifecycle causes. #27985 narrowly changes subscriptions and stale-registration replacement, #34183 combines event-aware registration with broader inbound deduplication and listener ownership, and #43672 separates outbound-only lifecycle while adding a dedupe implementation and an unrelated title-warning change.

Related pull requests

• #27985 related — (+69/-7) — keep open, but update before merge: the diff directly removes updated-message from the desired subscription and replaces stale same-URL registrations, matching the reported duplicate-event cause. Consistent with the keep_open reviews, it must preserve current main's redacted webhook logging and must not POST a replacement when stale-webhook deletion fails; add coverage for that failure path.
• #34183 [closed] related — (+535/-34) — closed, useful as a broader reference implementation superseded by #45317: the diff covers new-message-only defaults, event-aware registration, listener ownership, status-update filtering, and DM-variant deduplication. Its scope substantially exceeds the focused registration cause, and its stale-webhook deletion path also continues after deletion failures.
• #43672 related — (+117/-9) — keep open only for selective salvage: the outbound-only connect(start_webhook=False) path directly prevents standalone sends from registering or unregistering the gateway webhook. Despite the keep_open review on #43672, the full diff should not be consolidated as-is because its sender/text fallback can discard distinct same-text messages with different stable IDs, it lacks dedupe behavior tests, and its title-generation warning suppression contradicts existing failure-visibility behavior.

Duplicates

#27985, #34183, and #43672 overlap on BlueBubbles duplicate delivery, but they are not exact duplicates: #27985 is the focused stale-event registration fix, #34183 is a closed broader hardening implementation, and #43672 uniquely contains the explicit outbound-only lifecycle path.

Suggested consolidation

Merge #27985 after rebasing it onto current main, preserving masked log URLs, aborting replacement when stale-webhook deletion fails, and adding the failed-delete/no-POST regression test. Use closed #34183 as reference and selectively port #43672's outbound-only lifecycle fix with tests, but do not port its lossy fallback dedupe or title-warning suppression; #34183 requires no further closure, and #43672 should only be closed as superseded once its valid lifecycle change is represented in the consolidated implementation.

Cross-PR triage: Reviewed 3 pull requests and 0 issues in this complex. Each diff was read against this issue; Assessment working set: 45 kB of PR diffs, 5 kB of issue/PR text, 5 kB of discussion (7 comments), 0 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.