feat(phased-execution): ntfy notification after each task; add new-project, upgrade-existing-app, writing-tests, security-audit skills

phased-execution/scripts/lib.sh

@@ -300,6 +300,40 @@ run_validation() {
   bash .agent/validate.sh >"$1" 2>&1
 }
 
+# --- notifications ------------------------------------------------------------
+# Send a push notification via ntfy after a unit completes. Reads
+# ~/.env/pi-ntfy.env (see the ntfy skill). No-ops (silently) when notifications
+# are disabled (PHASE_NOTIFY=0) or ntfy is not configured, so it never breaks
+# the pipeline. Gated on PHASE_NOTIFY so a misconfigured server can't stall a
+# long run; default ON when the env file is present.
+notify_task() {
+  local unit="$1" status="$2"   # status: task | phase
+  [[ "${PHASE_NOTIFY:-1}" == "1" ]] || return 0
+  local envf="${NTFY_ENV_FILE:-$HOME/.env/pi-ntfy.env}"
+  [[ -f "$envf" ]] || return 0
+  # shellcheck disable=SC1090
+  source "$envf"
+  [[ -n "${NTFY_URL:-}" && -n "${NTFY_TOKEN:-}" ]] || return 0
+
+  local title body tags
+  if [[ "$status" == phase ]]; then
+    title="Phase $(unit_phase "$unit") done"
+    tags="heavy_check_mark,phase-complete"
+    body="Phase $(unit_phase "$unit") of the pipeline completed."
+  else
+    title="Task complete"
+    tags="heavy_check_mark,task-complete"
+    body="Task delivered: $unit"
+  fi
+  curl -sS -X POST "${NTFY_URL}/${NTFY_TOPIC:-pi}" \
+    -H "Authorization: Bearer ${NTFY_TOKEN}" \
+    -H "X-Title: $title" \
+    -H "X-Priority: 4" \
+    -H "X-Tags: $tags" \
+    -H "X-Markdown: yes" \
+    -d "$body" >/dev/null 2>&1 || warn "ntfy notification failed for $unit"
+}
+
 # --- one unit (task, phase final pass, or legacy phase), with retries ---------
 # execute_unit <unit>
 # Returns 0 and moves the unit to complete/ on success; returns 1 after