feat(notifications): topic-only input (drop URL validation)

The Settings field is now a plain topic name (e.g. `my-secret-topic`)
instead of a full URL. The transport always posts to
`https://ntfy.sh/<topic>` (URL-encoded), and the only server-side check
is "non-empty when enabled". Removes the user-visible
"string does not match the expected pattern" error people hit when
typing a bare topic.

- packages/core/src/notifications/ntfy.ts: drop validateTopicUrl;
  add buildNtfyUrl(topic) + exported NTFY_BASE_URL.
- packages/core/src/notifications/types.ts, config.ts: rename
  topicUrl -> topic; update docs.
- packages/api/src/routes/notifications.ts: only validates non-empty
  topic when enabled. Also fixes a latent bug where notifySubagents
  was dropped on every PUT (was not passed to normalizeNtfyConfig).
- packages/frontend/src/lib/components/SettingsPanel.svelte: relabel
  field "Topic URL" -> "Topic"; placeholder "your-secret-topic";
  updated helper copy.
- Tests updated: rewrote validateTopicUrl coverage as buildNtfyUrl
  coverage + proof that previously-rejected topics (dots, spaces,
  unicode, "Any Topic Whatsoever") now POST cleanly.
- HANDOFF.md: added a short "topic-only input" section.

3 files changed, 50 insertions, 57 deletions

diff --git a/packages/core/tests/notifications/config.test.ts b/packages/core/tests/notifications/config.test.ts
index c110788..71dc00c 100644
--- a/packages/core/tests/notifications/config.test.ts
+++ b/packages/core/tests/notifications/config.test.ts
@@ -28,7 +28,7 @@ describe("defaultNtfyConfig", () => {
 	it("disables notifications and ships sane per-event defaults", () => {
 		const cfg = defaultNtfyConfig();
 		expect(cfg.enabled).toBe(false);
-		expect(cfg.topicUrl).toBe("");
+		expect(cfg.topic).toBe("");
 		expect(cfg.authToken).toBe("");
 		expect(cfg.events["turn-completed"]).toBe(true);
 		expect(cfg.events["turn-error"]).toBe(true);
@@ -48,7 +48,7 @@ describe("normalizeNtfyConfig", () => {
 	it("fills in missing event toggles with defaults (newly-added types default OFF)", () => {
 		const normalized = normalizeNtfyConfig({
 			enabled: true,
-			topicUrl: "https://ntfy.sh/x",
+			topic: "https://ntfy.sh/x",
 			events: { "turn-completed": false },
 		});
 		expect(normalized.events["turn-completed"]).toBe(false);
@@ -60,13 +60,13 @@ describe("normalizeNtfyConfig", () => {
 	it("ignores extraneous fields and wrong-typed values", () => {
 		const normalized = normalizeNtfyConfig({
 			enabled: "yes", // wrong type ⇒ default
-			topicUrl: 42, // wrong type ⇒ default
+			topic: 42, // wrong type ⇒ default
 			authToken: null, // wrong type ⇒ default
 			events: { "turn-completed": "no", bogus: true },
 			extra: "ignored",
 		});
 		expect(normalized.enabled).toBe(false);
-		expect(normalized.topicUrl).toBe("");
+		expect(normalized.topic).toBe("");
 		expect(normalized.authToken).toBe("");
 		expect(normalized.events["turn-completed"]).toBe(true); // default kept
 		expect((normalized.events as Record<string, boolean>).bogus).toBeUndefined();
@@ -77,7 +77,7 @@ describe("normalizeNtfyConfig — notifySubagents", () => {
 	it("defaults notifySubagents to false when absent", () => {
 		const normalized = normalizeNtfyConfig({
 			enabled: true,
-			topicUrl: "https://ntfy.sh/x",
+			topic: "https://ntfy.sh/x",
 		});
 		expect(normalized.notifySubagents).toBe(false);
 	});
@@ -85,7 +85,7 @@ describe("normalizeNtfyConfig — notifySubagents", () => {
 	it("respects an explicit notifySubagents=true", () => {
 		const normalized = normalizeNtfyConfig({
 			enabled: true,
-			topicUrl: "https://ntfy.sh/x",
+			topic: "https://ntfy.sh/x",
 			notifySubagents: true,
 		});
 		expect(normalized.notifySubagents).toBe(true);
@@ -94,7 +94,7 @@ describe("normalizeNtfyConfig — notifySubagents", () => {
 	it("falls back to default when notifySubagents is wrong-typed", () => {
 		const normalized = normalizeNtfyConfig({
 			enabled: true,
-			topicUrl: "https://ntfy.sh/x",
+			topic: "https://ntfy.sh/x",
 			notifySubagents: "yes" as unknown,
 		});
 		expect(normalized.notifySubagents).toBe(false);
@@ -113,7 +113,7 @@ describe("load/save round-trip", () => {
 	it("round-trips a complete config", () => {
 		const cfg = {
 			enabled: true,
-			topicUrl: "https://ntfy.sh/team",
+			topic: "https://ntfy.sh/team",
 			authToken: "tk_abc",
 			events: {
 				"turn-completed": false,
@@ -136,7 +136,7 @@ describe("load/save round-trip", () => {
 	});
 
 	it("clearNtfyConfig removes the persisted entry", () => {
-		saveNtfyConfig({ ...defaultNtfyConfig(), enabled: true, topicUrl: "https://ntfy.sh/x" });
+		saveNtfyConfig({ ...defaultNtfyConfig(), enabled: true, topic: "https://ntfy.sh/x" });
 		expect(fakeSettings.has(NTFY_CONFIG_KEY)).toBe(true);
 		clearNtfyConfig();
 		expect(fakeSettings.has(NTFY_CONFIG_KEY)).toBe(false);
diff --git a/packages/core/tests/notifications/dispatcher.test.ts b/packages/core/tests/notifications/dispatcher.test.ts
index 750552c..c2faba6 100644
--- a/packages/core/tests/notifications/dispatcher.test.ts
+++ b/packages/core/tests/notifications/dispatcher.test.ts
@@ -17,7 +17,7 @@ const { NotificationDispatcher } = await import("../../src/notifications/dispatc
 function makeConfig(overrides: Partial<NtfyConfig> = {}): NtfyConfig {
 	return {
 		enabled: true,
-		topicUrl: "https://ntfy.sh/topic",
+		topic: "test-topic",
 		authToken: "",
 		events: {
 			"turn-completed": true,
diff --git a/packages/core/tests/notifications/ntfy.test.ts b/packages/core/tests/notifications/ntfy.test.ts
index c183847..5f14a60 100644
--- a/packages/core/tests/notifications/ntfy.test.ts
+++ b/packages/core/tests/notifications/ntfy.test.ts
@@ -1,11 +1,11 @@
 import { describe, expect, it, vi } from "vitest";
-import { sendNtfy, validateTopicUrl } from "../../src/notifications/ntfy.js";
+import { buildNtfyUrl, NTFY_BASE_URL, sendNtfy } from "../../src/notifications/ntfy.js";
 import type { NotificationEvent, NtfyConfig } from "../../src/notifications/types.js";
 
 function makeConfig(overrides: Partial<NtfyConfig> = {}): NtfyConfig {
 	return {
 		enabled: true,
-		topicUrl: "https://ntfy.sh/my-topic",
+		topic: "my-topic",
 		authToken: "",
 		events: {
 			"turn-completed": true,
@@ -13,6 +13,7 @@ function makeConfig(overrides: Partial<NtfyConfig> = {}): NtfyConfig {
 			"permission-required": true,
 			"agent-spawned": true,
 		},
+		notifySubagents: false,
 		...overrides,
 	};
 }
@@ -38,54 +39,26 @@ function makeFetch(
 	return fetchImpl;
 }
 
-describe("validateTopicUrl", () => {
-	it("accepts ntfy.sh-style URLs", () => {
-		expect(validateTopicUrl("https://ntfy.sh/my-topic")).toBeNull();
-		expect(validateTopicUrl("http://ntfy.example.com/team-alerts")).toBeNull();
+describe("buildNtfyUrl", () => {
+	it("prefixes the public ntfy.sh host", () => {
+		expect(buildNtfyUrl("my-topic")).toBe(`${NTFY_BASE_URL}/my-topic`);
 	});
 
-	it("rejects empty / whitespace", () => {
-		expect(validateTopicUrl("")).toMatch(/required/);
-		expect(validateTopicUrl("   ")).toMatch(/required/);
+	it("trims surrounding whitespace", () => {
+		expect(buildNtfyUrl("  hello  ")).toBe(`${NTFY_BASE_URL}/hello`);
 	});
 
-	it("rejects malformed URLs", () => {
-		expect(validateTopicUrl("not a url")).toMatch(/valid URL/);
-	});
-
-	it("rejects non-http(s) schemes", () => {
-		expect(validateTopicUrl("ftp://ntfy.sh/topic")).toMatch(/http/);
-	});
-
-	it("rejects URLs missing a topic path", () => {
-		expect(validateTopicUrl("https://ntfy.sh")).toMatch(/topic/);
-		expect(validateTopicUrl("https://ntfy.sh/")).toMatch(/topic/);
-	});
-
-	it("rejects multi-segment paths (topic must be a single segment)", () => {
-		expect(validateTopicUrl("https://ntfy.sh/team/sub")).toMatch(/single topic/);
-	});
-
-	it("rejects topic names with disallowed characters", () => {
-		expect(validateTopicUrl("https://ntfy.sh/has.dot")).toMatch(/letters\/numbers/);
-		expect(validateTopicUrl("https://ntfy.sh/has space")).toMatch(/letters\/numbers/);
-		expect(validateTopicUrl("https://ntfy.sh/has%20enc")).toMatch(/letters\/numbers/);
-	});
-
-	it("rejects topic names longer than 64 chars", () => {
-		const long = "a".repeat(65);
-		expect(validateTopicUrl(`https://ntfy.sh/${long}`)).toMatch(/64/);
-	});
-
-	it("accepts 64-char topic names and underscore/hyphen mixes", () => {
-		const maxlen = "a".repeat(64);
-		expect(validateTopicUrl(`https://ntfy.sh/${maxlen}`)).toBeNull();
-		expect(validateTopicUrl("https://ntfy.sh/My_Topic-123")).toBeNull();
+	it("URL-encodes the topic so any string yields a valid URL", () => {
+		// Spaces, slashes, unicode — all preserved as encoded bytes; the ntfy
+		// server is the final authority on what it accepts.
+		expect(buildNtfyUrl("has space")).toBe(`${NTFY_BASE_URL}/has%20space`);
+		expect(buildNtfyUrl("a/b")).toBe(`${NTFY_BASE_URL}/a%2Fb`);
+		expect(buildNtfyUrl("日本語")).toBe(`${NTFY_BASE_URL}/${encodeURIComponent("日本語")}`);
 	});
 });
 
 describe("sendNtfy", () => {
-	it("POSTs to the topic URL with Title/Priority/Tags/Content-Type headers and body", async () => {
+	it("POSTs to https://ntfy.sh/<topic> with Title/Priority/Tags/Content-Type headers and body", async () => {
 		const fetchImpl = makeFetch();
 		const result = await sendNtfy(
 			makeConfig(),
@@ -95,7 +68,7 @@ describe("sendNtfy", () => {
 		expect(result.ok).toBe(true);
 		expect(fetchImpl).toHaveBeenCalledTimes(1);
 		const [url, init] = fetchImpl.mock.calls[0];
-		expect(url).toBe("https://ntfy.sh/my-topic");
+		expect(url).toBe(`${NTFY_BASE_URL}/my-topic`);
 		expect(init.method).toBe("POST");
 		expect(init.headers.Title).toBe("Hello");
 		expect(init.headers.Priority).toBe("4");
@@ -104,6 +77,21 @@ describe("sendNtfy", () => {
 		expect(init.body).toBe("World");
 	});
 
+	it("accepts arbitrary topic strings without a client-side pattern check", async () => {
+		const fetchImpl = makeFetch();
+		// Things the old validator would have rejected — dots, spaces, unicode,
+		// a single-word "any topic". All should POST and let ntfy decide.
+		await sendNtfy(makeConfig({ topic: "release.notes" }), makeEvent(), fetchImpl);
+		await sendNtfy(makeConfig({ topic: "with space" }), makeEvent(), fetchImpl);
+		await sendNtfy(makeConfig({ topic: "Any Topic Whatsoever" }), makeEvent(), fetchImpl);
+		await sendNtfy(makeConfig({ topic: "日本語" }), makeEvent(), fetchImpl);
+		expect(fetchImpl).toHaveBeenCalledTimes(4);
+		expect(fetchImpl.mock.calls[0][0]).toBe(`${NTFY_BASE_URL}/release.notes`);
+		expect(fetchImpl.mock.calls[1][0]).toBe(`${NTFY_BASE_URL}/with%20space`);
+		expect(fetchImpl.mock.calls[2][0]).toBe(`${NTFY_BASE_URL}/Any%20Topic%20Whatsoever`);
+		expect(fetchImpl.mock.calls[3][0]).toBe(`${NTFY_BASE_URL}/${encodeURIComponent("日本語")}`);
+	});
+
 	it("uses per-event-type defaults for priority and tags", async () => {
 		const fetchImpl = makeFetch();
 		await sendNtfy(makeConfig(), makeEvent({ type: "turn-error" }), fetchImpl);
@@ -183,11 +171,16 @@ describe("sendNtfy", () => {
 		expect(fetchImpl).not.toHaveBeenCalled();
 	});
 
-	it("returns ok:false on invalid topic URL without calling fetch", async () => {
+	it("returns ok:false when topic is empty / whitespace, without calling fetch", async () => {
 		const fetchImpl = makeFetch();
-		const result = await sendNtfy(makeConfig({ topicUrl: "not a url" }), makeEvent(), fetchImpl);
-		expect(result.ok).toBe(false);
-		expect(result.error).toBeDefined();
+		const empty = await sendNtfy(makeConfig({ topic: "" }), makeEvent(), fetchImpl);
+		expect(empty.ok).toBe(false);
+		expect(empty.error).toMatch(/required/i);
+
+		const ws = await sendNtfy(makeConfig({ topic: "   " }), makeEvent(), fetchImpl);
+		expect(ws.ok).toBe(false);
+		expect(ws.error).toMatch(/required/i);
+
 		expect(fetchImpl).not.toHaveBeenCalled();
 	});