@saadnvd1/agent-os 0.3.514 → 0.3.517

package/data/devices/queries.ts

@@ -1,5 +1,5 @@
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import type { Device } from "@/lib/security/devices";
+import type { ListedDevice } from "@/lib/security/devices";
 import type { NetworkState } from "@/lib/security/network-state";
 import type { PairingOffer } from "@/lib/security/pair-qr";
 import { deviceKeys } from "./keys";
@@ -12,7 +12,9 @@ async function json<T>(res: Response): Promise<T> {
 }
 
 export interface DevicesResponse {
-  devices: Device[];
+  devices: ListedDevice[];
+  // Whether this machine can reach the push relay at all.
+  push: { linked: boolean; unavailable: string | null };
   current: { deviceId: string | null; via: string | null };
 }
 
@@ -128,3 +130,29 @@ export function useSetCanApprove() {
       queryClient.invalidateQueries({ queryKey: deviceKeys.list() }),
   });
 }
+
+export interface PushTestResponse {
+  results: {
+    deviceId: string;
+    status: "sent" | "gone" | "failed";
+    error: string | null;
+  }[];
+  unavailable: string | null;
+}
+
+export function useSendTestPush() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (deviceId: string) =>
+      json<PushTestResponse>(
+        await fetch("/api/push/test", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ deviceId }),
+        })
+      ),
+    // A dead token is forgotten, and the last error changes.
+    onSettled: () =>
+      queryClient.invalidateQueries({ queryKey: deviceKeys.list() }),
+  });
+}

package/lib/away/run.ts

@@ -19,6 +19,7 @@ import { review } from "../orchestrator/review";
 import { repoOf } from "../orchestrator/repo";
 import { clip } from "../orchestrator/digest";
 import { notifyPhone } from "../notify";
+import { takeFoldedPushes } from "../notify/push";
 import { getProject } from "../projects";
 import { loadProjectConfig } from "../project-config";
 import { run } from "../tasks/gh";
@@ -194,7 +195,11 @@ export function turnAwayOff(
   // no report), then the summary. A second later, so the window takes
   // everything up to now.
   notifyBatch(ended, now + 1000);
-  notifyPhone(PHONE_SOURCE, phoneSummary(report));
+  notifyPhone(PHONE_SOURCE, phoneSummary(report), {
+    category: "digest",
+    key: `digest:end:${ended.id}`,
+    collapse: "digest",
+  });
   return { ...ended, report: JSON.stringify(report) };
 }
 
@@ -516,7 +521,9 @@ export function notifyBatch(away: AwayRow, now = Date.now()): string | null {
   }[];
   const deploys = held.filter((h) => h.kind === "deploy_failed");
   const notes = held.filter((h) => h.kind === "notify");
-  if (!asks.length && !held.length) return null;
+  // What push held for this digest (ready for review, CI, agent messages).
+  const pushed = takeFoldedPushes(now);
+  if (!asks.length && !held.length && !pushed) return null;
   const lines = [
     ...deploys.map(
       (d) => `- ${d.workspace}: deploy failed: ${clip(d.detail ?? "", 120)}`
@@ -534,6 +541,7 @@ export function notifyBatch(away: AwayRow, now = Date.now()): string | null {
       "note from an orchestrator",
       "notes from orchestrators"
     ),
+    ...count(pushed, "other update", "other updates"),
   ];
   const head = `While you're away: ${parts.length > 1 ? `${parts.slice(0, -1).join(", ")} and ${parts.at(-1)}` : parts[0]}`;
   const shown = lines.slice(0, PHONE_LINES);
@@ -541,7 +549,11 @@ export function notifyBatch(away: AwayRow, now = Date.now()): string | null {
   const text = [head, ...shown, ...(more ? [`- and ${more} more`] : [])].join(
     "\n"
   );
-  notifyPhone(PHONE_SOURCE, text);
+  notifyPhone(PHONE_SOURCE, text, {
+    category: "digest",
+    key: `digest:${away.id}:${now}`,
+    collapse: "digest",
+  });
   return text;
 }
 

package/lib/chat/registry.ts

@@ -1,3 +1,4 @@
+import { noteWaiting } from "../notify/push/waiting";
 import { db, type Session } from "../db";
 import type { WorkerClient } from "./worker/client";
 import { notifyStatusChanged } from "../status/hub";
@@ -90,6 +91,7 @@ export function emit(sessionId: string, m: ChatServerMessage): void {
   // Items come from the worker, which writes them a moment after saying so.
   if (m.type === "state" || m.type === "compacting" || m.type === "item")
     markStatusDirty(sessionId, EMIT_SETTLE_MS);
+  if (m.type === "state") noteWaiting(sessionId, m.state === "waiting");
   registry.listeners.get(sessionId)?.forEach((fn) => fn(m));
   // Idle, running, waiting and back, and a finished turn (unread): the
   // sidebar hears at once.

package/lib/chat/runner.ts

@@ -5,6 +5,7 @@
  * events to whoever is watching. Restarting the server leaves turns running.
  */
 
+import { pushPlanReady } from "../notify/push/events";
 import { handoffAfterPlan } from "../models/plan-step";
 import { randomUUID } from "crypto";
 import os from "os";
@@ -152,6 +153,8 @@ function onWorkerEvent(sessionId: string, live: Live, e: WorkerEvent): void {
   if (e.type === "item" && e.item.kind === "task")
     retireIfStale(sessionId, live);
   if (e.type === "item") {
+    if (e.item.kind === "plan" && !e.item.carried)
+      pushPlanReady(sessionId, e.item.id);
     if ("streaming" in e.item && e.item.streaming)
       live.streaming.set(e.item.id, e.item);
     else live.streaming.delete(e.item.id);

package/lib/connect/control-api.ts

@@ -226,3 +226,41 @@ export async function heartbeat(
   );
   return (await res.json()) as { enabled: boolean };
 }
+
+export interface PushRequestBody {
+  v: 1;
+  devices: { token: string; env: "production" | "sandbox" }[];
+  push_type: "alert" | "background";
+  priority: 10 | 5;
+  level: "passive" | "active" | "time-sensitive";
+  collapse_id?: string;
+  thread_id?: string;
+  payload: Record<string, unknown>;
+}
+
+export interface PushResult {
+  status: "sent" | "gone" | "retry" | "rejected";
+  apns_status?: number;
+  reason?: string;
+  prune?: boolean;
+  retry_after?: number;
+}
+
+/** One APNs send per device, answered in device order. Signed. */
+export async function pushRelay(
+  config: ConnectConfig,
+  privateKey: string,
+  body: PushRequestBody
+): Promise<PushResult[]> {
+  const res = await signed(config, privateKey)(
+    "POST",
+    `/api/v1/machines/${config.machineId}/push`,
+    body
+  );
+  const r = (await res.json().catch(() => null)) as {
+    results?: PushResult[];
+  } | null;
+  if (!Array.isArray(r?.results))
+    throw new Error("the Connect service sent no push results");
+  return r.results;
+}

package/lib/connect/serve.ts

@@ -8,6 +8,10 @@
  *   - takes only the machine's own Host (cloudflared pins it) and strips
  *     X-Forwarded-Host, Forwarded and X-Original-Host before any handler.
  *
+ * cloudflared starts only once that listener is bound and a connection to
+ * the port is seen to arrive on it, and stops if the listener goes: it must
+ * never publish whatever else holds the port.
+ *
  * Connect follows connect.json while running: `agent-os disconnect` or the
  * switch in Devices stops cloudflared and closes every tunnel connection at
  * once. Nothing here may stop AgentOS from starting.
@@ -15,6 +19,7 @@
 
 import fs from "fs";
 import http from "http";
+import net from "net";
 import path from "path";
 import type { IncomingMessage, ServerResponse } from "http";
 import type { Socket } from "net";
@@ -36,7 +41,13 @@ import {
 } from "./control-api";
 import { appVersion, startHeartbeat } from "./heartbeat";
 import { ensureCloudflared } from "./cloudflared";
-import { superviseTunnel, type Spawn, type TunnelState } from "./supervise";
+import {
+  reapTunnel,
+  superviseTunnel,
+  type ReapDeps,
+  type Spawn,
+  type TunnelState,
+} from "./supervise";
 
 export interface Handlers {
   onRequest: (req: IncomingMessage, res: ServerResponse) => void;
@@ -101,12 +112,51 @@ export interface ConnectDeps {
   delays?: Parameters<typeof superviseTunnel>[0]["delays"];
   heartbeat?: typeof sendHeartbeat;
   heartbeatMs?: number;
+  reap?: ReapDeps;
+}
+
+/**
+ * Whether connections to 127.0.0.1:<port> reach `server`: one is made and
+ * must show up on it. Never rejects.
+ */
+export function listenerIsOurs(
+  server: http.Server,
+  port: number,
+  timeoutMs = 3000
+): Promise<boolean> {
+  return new Promise((resolve) => {
+    const arrived = new Set<number>();
+    let probePort: number | undefined;
+    let done = false;
+    const finish = (ok: boolean) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      server.removeListener("connection", onConnection);
+      client.destroy();
+      resolve(ok);
+    };
+    const onConnection = (s: Socket) => {
+      if (s.remotePort === undefined) return;
+      arrived.add(s.remotePort);
+      if (s.remotePort === probePort) finish(true);
+    };
+    server.prependListener("connection", onConnection);
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    timer.unref?.();
+    const client = net.connect(port, "127.0.0.1", () => {
+      probePort = client.localPort;
+      // The server may have seen it before this callback ran.
+      if (probePort !== undefined && arrived.has(probePort)) finish(true);
+    });
+    client.on("error", () => finish(false));
+  });
 }
 
 interface Running {
   server: http.Server;
   sockets: Set<Socket>;
-  supervisor: ReturnType<typeof superviseTunnel>;
+  supervisor: ReturnType<typeof superviseTunnel> | null;
   heartbeat: ReturnType<typeof startHeartbeat>;
   release: () => void;
 }
@@ -131,12 +181,12 @@ export function startConnect(
   let bindError: string | undefined;
   g.__agentosConnect = () => {
     if (!running) return base;
-    const s: TunnelState = running.supervisor.state();
+    const s: TunnelState = running.supervisor?.state() ?? "connecting";
     return {
       ...base,
       hostname: hostname || base.hostname,
       state: bindError ? "error" : s === "stopped" ? "off" : s,
-      reason: bindError ?? running.supervisor.reason(),
+      reason: bindError ?? running.supervisor?.reason(),
     };
   };
 
@@ -153,7 +203,7 @@ export function startConnect(
     if (!running) return;
     bindError = undefined;
     running.heartbeat.stop();
-    running.supervisor.stop();
+    running.supervisor?.stop();
     running.sockets.forEach((s) => s.destroy());
     running.server.close();
     running.release();
@@ -200,19 +250,50 @@ export function startConnect(
       log(`connect: ${base.reason}`);
       return;
     }
+    // The lock is ours, so a cloudflared in the pid file belongs to an
+    // AgentOS that died: it goes before anything else happens.
+    const reaped = reapTunnel(dir, undefined, deps.reap).catch(() => false);
     const server = tunnelListener(() => hostname, handlers);
     const sockets = new Set<Socket>();
     server.on("connection", (s: Socket) => {
       sockets.add(s);
       s.once("close", () => sockets.delete(s));
     });
+    const ensure =
+      deps.ensureBinary ?? ((d: string) => ensureCloudflared({ dir: d }));
+    const ask = deps.requestTunnel ?? requestTunnel;
+    const startTunnel = () =>
+      superviseTunnel({
+        dir,
+        log,
+        spawn: deps.spawn,
+        delays: deps.delays,
+        prepare: async () => {
+          const bin = await ensure(dir);
+          // Fresh every start; the token lives only in this call and the child's env.
+          const tunnel = await ask(config, machineKey, tunnelPort);
+          if (tunnel.hostname !== hostname) {
+            hostname = tunnel.hostname;
+            saveConnect({ ...config, hostname }, dir);
+            log(`connect: reachable at https://${hostname}`);
+          }
+          return { bin, token: tunnel.token };
+        },
+      });
+    const stopTunnel = () => {
+      if (running?.server !== server || !running.supervisor) return;
+      running.supervisor.stop();
+      running.supervisor = null;
+    };
     // Something else may hold the port for a while (an AgentOS shutting
-    // down, say): keep trying with backoff rather than giving up.
+    // down, say): keep trying with backoff rather than giving up, with
+    // cloudflared stopped meanwhile.
     const bindDelays = deps.delays ?? { min: 1000, max: 60_000 };
     let bindDelay = bindDelays.min;
-    server.on("error", (err) => {
+    const rebind = (why: string) => {
       if (running?.server !== server) return;
-      bindError = `can't listen on 127.0.0.1:${tunnelPort}: ${err.message}`;
+      stopTunnel();
+      bindError = `can't listen on 127.0.0.1:${tunnelPort}: ${why}`;
       log(`connect: ${bindError}; trying again`);
       const t = setTimeout(() => {
         if (running?.server !== server) return;
@@ -221,30 +302,19 @@ export function startConnect(
       }, bindDelay);
       t.unref?.();
       bindDelay = Math.min(bindDelay * 2, bindDelays.max);
-    });
-    server.on("listening", () => {
+    };
+    server.on("error", (err) => rebind(err.message));
+    server.on("close", () => stopTunnel());
+    server.on("listening", async () => {
+      const [ours] = await Promise.all([
+        listenerIsOurs(server, tunnelPort),
+        reaped,
+      ]);
+      if (running?.server !== server || !server.listening) return;
+      if (!ours) return rebind("connections there don't reach AgentOS");
       bindError = undefined;
       bindDelay = bindDelays.min;
-    });
-    const ensure =
-      deps.ensureBinary ?? ((d: string) => ensureCloudflared({ dir: d }));
-    const ask = deps.requestTunnel ?? requestTunnel;
-    const supervisor = superviseTunnel({
-      dir,
-      log,
-      spawn: deps.spawn,
-      delays: deps.delays,
-      prepare: async () => {
-        const bin = await ensure(dir);
-        // Fresh every start; the token lives only in this call and the child's env.
-        const tunnel = await ask(config, machineKey, tunnelPort);
-        if (tunnel.hostname !== hostname) {
-          hostname = tunnel.hostname;
-          saveConnect({ ...config, hostname }, dir);
-          log(`connect: reachable at https://${hostname}`);
-        }
-        return { bin, token: tunnel.token };
-      },
+      if (!running.supervisor) running.supervisor = startTunnel();
     });
     const beat = deps.heartbeat ?? sendHeartbeat;
     const version = appVersion();
@@ -261,7 +331,13 @@ export function startConnect(
         down("machine no longer linked");
       },
     });
-    running = { server, sockets, supervisor, heartbeat, release: lock.release };
+    running = {
+      server,
+      sockets,
+      supervisor: null,
+      heartbeat,
+      release: lock.release,
+    };
     server.listen(tunnelPort, "127.0.0.1");
   };
 

package/lib/connect/supervise.ts

@@ -3,13 +3,24 @@
  * the Connect service for a fresh connector token, which goes to the child
  * in TUNNEL_TOKEN only: never argv, never a file, never a log line. The
  * child exits → it's started again with backoff; stop() ends it.
+ *
+ * cloudflared must never outlive AgentOS: it would go on publishing
+ * whatever next holds the tunnel port. So it runs in a process group of its
+ * own under a small shell that kills it the moment AgentOS goes, however it
+ * goes (SIGKILL and out-of-memory included), and a copy a crash left behind
+ * anyway is killed before the next one starts.
  */
 
-import { execFile, spawn as nodeSpawn } from "child_process";
+import {
+  execFile,
+  spawn as nodeSpawn,
+  type ChildProcess,
+  type SpawnOptions,
+} from "child_process";
 import fs from "fs";
 import path from "path";
 import readline from "readline";
-import type { Readable } from "stream";
+import type { Readable, Writable } from "stream";
 import { ApiError, clean } from "./control-api";
 
 export type TunnelState = "connecting" | "up" | "denied" | "error" | "stopped";
@@ -21,6 +32,7 @@ export interface Prepared {
 
 interface Child {
   pid?: number;
+  stdin?: Writable | null;
   stdout: Readable | null;
   stderr: Readable | null;
   kill(signal?: NodeJS.Signals): boolean;
@@ -53,7 +65,48 @@ const DELAYS = {
 // cloudflared can be chatty while the network flaps.
 const LOG_LINES_PER_MINUTE = 20;
 
-/** A cloudflared left running by an AgentOS that died without stopping it. */
+// $1 is cloudflared, the rest its arguments. Its stdin is a pipe only
+// AgentOS holds the other end of: when AgentOS ends, the read sees EOF and
+// cloudflared is killed outright (a SIGTERM would let it drain, still
+// forwarding, for half a minute). The shell exits with cloudflared's code.
+const WATCHDOG = `exec 3<&0 </dev/null
+"$@" 3<&- &
+child=$!
+trap 'kill -TERM "$child" 2>/dev/null' TERM INT HUP
+{ read -r _ <&3; kill -KILL "$child" 2>/dev/null; } &
+watch=$!
+exec 3<&-
+while :; do
+  wait "$child"; code=$?
+  kill -0 "$child" 2>/dev/null || break
+done
+kill "$watch" 2>/dev/null
+exit "$code"`;
+
+/** cloudflared under the watchdog, its group killed as one. */
+export const spawnTunnel: Spawn = (bin, args, opts) => {
+  if (process.platform === "win32")
+    return (nodeSpawn as unknown as Spawn)(bin, args, opts);
+  const proc: ChildProcess = nodeSpawn(
+    "/bin/sh",
+    ["-c", WATCHDOG, "agentos-cloudflared", bin, ...args],
+    {
+      env: opts.env,
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: true,
+    } as SpawnOptions
+  );
+  proc.stdin?.on("error", () => {});
+  return Object.assign(proc, {
+    kill: (signal: NodeJS.Signals = "SIGTERM") => {
+      try {
+        if (proc.pid) return process.kill(-proc.pid, signal);
+      } catch {}
+      return proc.kill(signal);
+    },
+  }) as unknown as Child;
+};
+
 const commandOf = (pid: number) =>
   new Promise<string>((resolve) =>
     execFile(
@@ -64,25 +117,60 @@ const commandOf = (pid: number) =>
     )
   );
 
-async function stopStale(pidFile: string, binDir: string) {
+const signal = (pid: number, sig: NodeJS.Signals | 0) => {
+  try {
+    process.kill(pid, sig);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+export interface ReapDeps {
+  commandOf?: (pid: number) => Promise<string>;
+  /** process.kill: false when there was nothing to signal. */
+  kill?: (pid: number, sig: NodeJS.Signals | 0) => boolean;
+  waitMs?: number;
+}
+
+/**
+ * Kills a cloudflared an AgentOS that died left running, named by the pid
+ * file, and only if that pid is still one of ours (pids get reused). Call
+ * it only while holding connect.lock: then no live AgentOS owns it.
+ */
+export async function reapTunnel(
+  dir: string,
+  binDir = path.join(dir, "bin"),
+  deps: ReapDeps = {}
+) {
+  const pidFile = path.join(dir, "cloudflared.pid");
+  const kill = deps.kill ?? signal;
   let pid = 0;
   try {
     pid = Number(fs.readFileSync(pidFile, "utf8")) || 0;
   } catch {
-    return;
+    return false;
   }
+  let reaped = false;
   if (pid > 1) {
-    const command = await commandOf(pid);
-    try {
-      if (command.startsWith(binDir + path.sep)) process.kill(pid, "SIGTERM");
-    } catch {}
+    const command = await (deps.commandOf ?? commandOf)(pid);
+    if (command.includes(binDir + path.sep)) {
+      // Its group (the watchdog and cloudflared), or a bare cloudflared an
+      // older AgentOS started outside one.
+      reaped = kill(-pid, "SIGKILL");
+      reaped = kill(pid, "SIGKILL") || reaped;
+      const end = Date.now() + (deps.waitMs ?? 2000);
+      while (kill(pid, 0) && Date.now() < end)
+        await new Promise((r) => setTimeout(r, 25));
+    }
   }
   fs.rmSync(pidFile, { force: true });
+  return reaped;
 }
 
 export function superviseTunnel(opts: SuperviseOptions) {
   const log = opts.log ?? (() => {});
-  const spawn = opts.spawn ?? (nodeSpawn as unknown as Spawn);
+  const spawn = opts.spawn ?? spawnTunnel;
   const delays = opts.delays ?? DELAYS;
   const pidFile = path.join(opts.dir, "cloudflared.pid");
   const home = path.join(opts.dir, "cloudflared-home");
@@ -145,7 +233,7 @@ export function superviseTunnel(opts: SuperviseOptions) {
 
   const run = async ({ bin, token }: Prepared) => {
     const redact = (line: string) => clean(line.split(token).join("[token]"));
-    await stopStale(pidFile, path.dirname(bin));
+    await reapTunnel(opts.dir, path.dirname(bin));
     if (stopped) return;
     fs.mkdirSync(home, { recursive: true, mode: 0o700 });
     // Its own config and home, so no config.yml elsewhere on the machine
@@ -256,8 +344,18 @@ export function superviseTunnel(opts: SuperviseOptions) {
     proc.on("exit", (code) => end(`cloudflared exited (${code ?? "signal"})`));
   };
 
+  // A stop that never ran (the process exiting, or a signal nobody else
+  // handles) still takes cloudflared's whole group down first.
   const killNow = () => child?.kill("SIGTERM");
+  const SIGNALS = ["SIGTERM", "SIGINT", "SIGHUP"] as const;
+  const onSignal = (sig: NodeJS.Signals) => {
+    killNow();
+    for (const s of SIGNALS) process.removeListener(s, onSignal);
+    // Nobody else handles it: end the way the signal would have.
+    if (process.listenerCount(sig) === 0) process.kill(process.pid, sig);
+  };
   process.once("exit", killNow);
+  for (const s of SIGNALS) process.on(s, onSignal);
   tick();
 
   return {
@@ -268,6 +366,7 @@ export function superviseTunnel(opts: SuperviseOptions) {
       stopped = true;
       state = "stopped";
       process.removeListener("exit", killNow);
+      for (const s of SIGNALS) process.removeListener(s, onSignal);
       if (timer) clearTimeout(timer);
       const proc = child;
       if (!proc) return;

package/lib/db/migrations.ts

@@ -1630,6 +1630,65 @@ const migrations: Migration[] = [
       );
     },
   },
+  {
+    id: 71,
+    name: "devices_push",
+    up: (db) => {
+      // Push belongs to a paired device, so revoking the device clears it.
+      // push_categories is a JSON array; NULL means the defaults.
+      // Each column checked, so a run cut off part way can be run again.
+      const have = new Set(
+        (
+          db.prepare(`PRAGMA table_info(devices)`).all() as { name: string }[]
+        ).map((c) => c.name)
+      );
+      for (const col of [
+        "push_token",
+        "push_platform",
+        "push_environment",
+        "push_categories",
+        "push_updated_at",
+        "push_last_error",
+      ])
+        if (!have.has(col))
+          db.exec(`ALTER TABLE devices ADD COLUMN ${col} TEXT`);
+      db.exec(
+        `CREATE INDEX IF NOT EXISTS idx_devices_push_token ON devices(push_token)
+         WHERE push_token IS NOT NULL`
+      );
+    },
+  },
+  {
+    id: 72,
+    name: "push_outbox",
+    up: (db) => {
+      // One row per (event, device). device_id is '' for a row folded into
+      // the Away digest. state: pending, sending, sent, failed, gone,
+      // capped, superseded, folded, digested.
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS push_outbox (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          event_key TEXT NOT NULL,
+          device_id TEXT NOT NULL,
+          category TEXT NOT NULL,
+          level TEXT NOT NULL,
+          payload TEXT NOT NULL,
+          collapse_id TEXT,
+          state TEXT NOT NULL,
+          attempts INTEGER NOT NULL DEFAULT 0,
+          next_attempt_at INTEGER NOT NULL,
+          created_at INTEGER NOT NULL,
+          sent_at INTEGER,
+          error TEXT,
+          fallback_source TEXT,
+          fallback_text TEXT,
+          UNIQUE(event_key, device_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_push_outbox_due ON push_outbox(state, next_attempt_at);
+        CREATE INDEX IF NOT EXISTS idx_push_outbox_device ON push_outbox(device_id, sent_at);
+      `);
+    },
+  },
 ];
 
 // `upTo`: stop after this id (tests that start from an older database).

package/lib/done/index.ts

@@ -26,6 +26,7 @@ import { releasePorts } from "../ports";
 import { dropSessionDatabase } from "../project-config/database";
 import { doneOnPeer, peerSessionLink } from "../hosts/peer-actions";
 import { captureMergedTask } from "../session-logs";
+import { pushMerged } from "../notify/push/events";
 
 export interface DoneOptions {
   // Who asked: the orchestrator's gate failures count toward Saad, as its
@@ -103,7 +104,10 @@ function mark(s: Session, status: "merged" | "done", pr: TaskPR | null) {
       : `UPDATE sessions SET task_status = 'done' WHERE id = ?`
   ).run(s.id);
   syncTaskCardInBackground(s, status, pr);
-  if (status === "merged") void captureMergedTask(s.id, { head: pr?.head });
+  if (status === "merged") {
+    pushMerged(s.id);
+    void captureMergedTask(s.id, { head: pr?.head });
+  }
 }
 
 export async function doneSession(

package/lib/load/alert.ts

@@ -30,7 +30,11 @@ const BACK_OFF =
   "Ask your running tasks to use targeted tests and hold off on full suites, type checks and builds until it clears. Nothing has been stopped.";
 
 export function raiseAlert(text: string): void {
-  notifyPhone("load", text);
+  notifyPhone("load", text, {
+    category: "system",
+    key: `system:load:${Date.now()}`,
+    collapse: "system:load",
+  });
   for (const orch of listOrchestrators()) {
     if (orch.archived_at) continue;
     sendMessage({