feat(cli): queue update notifications after channel changes

[riderx]

Summary (AI generated)

• Add --send-update-notification to bundle upload and channel set so changed channel bundle targets can queue native update-check pushes.
• Reuse the notifications /update-check endpoint from CLI and prompt in the channel UI after linking a new stable or rollout bundle.
• Update CLI docs/skill docs and include a WebP screenshot of the channel prompt.

Test Plan (AI generated)

• cd cli && bun run lint
• cd cli && bun run build
• cd cli && bun run test:mcp
• cd cli && bun run test:bundle
• bun lint (passes with existing admin dashboard warnings)
• bun typecheck
• git diff --check

Visual Changes (AI generated)

---

Note

Medium Risk
Opt-in pushes can reach all devices on a channel; CLI swallows notification errors so operators may think pushes queued when they did not.

Overview
Release workflows can now nudge devices to check for updates right after a channel’s linked bundle changes, instead of waiting for the next poll.

CLI: New --send-update-notification on bundle upload and channel set calls POST /notifications/update-check (via sendUpdateNotificationsForChannels) for channels whose bundle link actually changed. Upload results now include appId and updatedChannels so the upload handler knows where to notify; notification failures are caught so the upload/channel command still succeeds.

Dashboard: After linking, unlinking, reverting, or rollout promote/rollback on the channel page, users get an optional dialog to queue the same update-check notification (Bearer auth vs CLI’s capgkey).

Docs, skill notes, and i18n strings document the flag and prompt.

^{Reviewed by Cursor Bugbot for commit 4fb3168. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 28 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9749e9cf-648f-4109-9f52-503b18f03e14

📥 Commits

Reviewing files that changed from the base of the PR and between ea2b976 and 4fb3168.

📒 Files selected for processing (13)

• .github/pr-screenshots/channel-update-notification.webp
• cli/skills/release-management/SKILL.md
• cli/src/bundle/upload-command.ts
• cli/src/bundle/upload.ts
• cli/src/channel/set.ts
• cli/src/index.ts
• cli/src/notifications/send-update.ts
• cli/src/schemas/bundle.ts
• cli/src/schemas/channel.ts
• cli/webdocs/bundle.mdx
• cli/webdocs/channel.mdx
• messages/en.json
• src/pages/app/[app].channel.[channel].vue

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed-hq]

Merging this PR will improve performance by 90.83%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 42 untouched benchmarks
⏩ 2 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	/updates manifest response with metadata	164.2 µs	86 µs	+90.83%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing codex/cli-channel-update-notifications (4fb3168) with main (5003de2)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[riderx]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_adf03593-a336-467b-b24c-91ae6fde05af)

[RobinWitch]

One rollback path is missed by the new notification trigger.

bundleLinkChanged is only flipped when a stable version is assigned, a rollout target is assigned, or a rollout is promoted. But --rollout-rollback clears rollout_version, disables rollout, and resets rollout_percentage_bps without setting bundleLinkChanged. The later sendUpdateNotification block then passes an empty channel list and sendUpdateNotificationsForChannels() logs "No channel bundle changed, skipping update notification".

That means a release operator can run channel set <channel> <appId> --rollout-rollback --send-update-notification expecting devices on the rollout channel to wake up and return to stable, but no update-check notification is queued. This is the path where a fast silent push is most useful, especially for reverting a bad rollout. Please mark rollback as notification-worthy when there was an active rollout target (and consider the same for rollout disable / percentage-to-zero if those are meant to stop exposure immediately).

[RobinWitch]

One more UI path seems to miss the same notification flow.

In src/pages/app/[app].channel.[channel].vue, linking a stable bundle or rollout target calls askUpdateNotificationAfterBundleChange() after saveChannelChange() / saveChannelChanges() succeeds. But both handleUnlink() and handleRevert() clear version with saveChannelChange('version', null) and return without asking for the update notification.

Clearing the linked bundle is still a channel bundle change: devices pinned to that channel need an update check to discover they should fall back to the builtin/stable behavior. As written, an operator can unlink or revert a bad bundle from the dashboard and get no prompt to wake clients, even though the positive link paths do prompt. Please call the same notification helper after the unlink/revert save succeeds.

[cursor]

Stale comment

Risk: medium. Not approving: Cursor Bugbot reported 1 unresolved medium-severity finding (rollout promote/rollback paths skip update notifications), and the Bugbot check completed as skipped. Human reviewers have been assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Stale comment

Risk: medium. Not approving: Cursor Bugbot skipped (usage limit reached) so automated review is incomplete, and this PR changes CLI/console update-notification behavior across multiple code paths. Requested human reviewers.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}

[cursor]

Stale comment

Risk: medium. Not approving: Cursor Bugbot completed as skipped and reported 2 unresolved findings on the latest commit, including a medium-severity issue where notification failures fail an otherwise successful upload. Human reviewers Dalanir and WcaleNieWolny are already assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Stale comment

Risk: medium. Not approving: Cursor Bugbot completed as skipped with 2 unresolved findings on the latest commit, and this PR exceeds the low-risk approval threshold for device-facing update notifications. Dalanir and WcaleNieWolny are already assigned as reviewers.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 05789cb. Configure here.}

[cursor]

Stale comment

Risk: medium. Not approving: Cursor Bugbot completed as skipped on the latest commit, and this PR exceeds the low-risk approval threshold for device-facing update-notification behavior. Dalanir and WcaleNieWolny are already assigned as reviewers.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}

[cursor]

Stale comment

Risk: medium. Not approving: Cursor Bugbot completed as skipped with 1 unresolved high-severity finding on the latest commit (notification failure can fail channel set after the save succeeds). Dalanir and WcaleNieWolny are already assigned as reviewers.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Risk: medium. Approved: Cursor Bugbot passed on the latest commit with all prior findings resolved, and human reviewers are already assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Risk: medium. Not approving: this PR exceeds the low-risk approval threshold for device-facing update-notification behavior across CLI and console paths. Cursor Bugbot passed on the latest commit with all prior findings resolved; Dalanir and WcaleNieWolny are already assigned as reviewers.

  

_{Sent by Cursor Approval Agent: Pull Request Approver External}