@action-llama/action-llama 0.3.0 → 0.4.1

package/dist/gateway/routes/webhooks.d.ts

@@ -1,5 +1,6 @@
 import type { Router } from "../router.js";
 import type { WebhookRegistry } from "../../webhooks/registry.js";
 import type { Logger } from "../../shared/logger.js";
-export declare function registerWebhookRoutes(router: Router, registry: WebhookRegistry, webhookSecrets: Record<string, string | undefined>, logger: Logger): void;
+import type { StatusTracker } from "../../tui/status-tracker.js";
+export declare function registerWebhookRoutes(router: Router, registry: WebhookRegistry, webhookSecrets: Record<string, Record<string, string>>, logger: Logger, statusTracker?: StatusTracker): void;
 //# sourceMappingURL=webhooks.d.ts.map

package/dist/gateway/routes/webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAClD,MAAM,EAAE,MAAM,GACb,IAAI,CA+DN"}
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACtD,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,GAC5B,IAAI,CAsEN"}

package/dist/gateway/routes/webhooks.js

@@ -1,11 +1,12 @@
 import { readBody, sendJson, sendError } from "../router.js";
-export function registerWebhookRoutes(router, registry, webhookSecrets, logger) {
+export function registerWebhookRoutes(router, registry, webhookSecrets, logger, statusTracker) {
     router.post("/webhooks/:source", async (req, res, params) => {
         const source = params.source;
         logger.debug({ source }, "webhook request received");
         const provider = registry.getProvider(source);
         if (!provider) {
             logger.warn({ source }, "webhook rejected: unknown source");
+            statusTracker?.addLogLine("webhook", `Rejected: unknown source "${source}"`);
             sendError(res, 404, `unknown webhook source: ${source}`);
             return;
         }
@@ -15,6 +16,7 @@ export function registerWebhookRoutes(router, registry, webhookSecrets, logger)
         }
         catch (err) {
             logger.error({ err, source }, "webhook body read failed");
+            statusTracker?.addLogLine("webhook", `Failed to read body from ${source}: ${err.message}`);
             sendError(res, 400, "failed to read request body");
             return;
         }
@@ -31,15 +33,20 @@ export function registerWebhookRoutes(router, registry, webhookSecrets, logger)
             delivery: headers["x-github-delivery"],
             hasSignature: !!headers["x-hub-signature-256"],
         }, "webhook headers");
-        const secret = webhookSecrets[source];
-        const result = registry.dispatch(source, headers, rawBody, secret);
+        const secrets = webhookSecrets[source];
+        const result = registry.dispatch(source, headers, rawBody, secrets);
         if (!result.ok) {
             const status = result.errors?.includes("signature validation failed") ? 401 : 400;
+            const errorMsg = result.errors?.[0] || "dispatch failed";
             logger.warn({ source, status, errors: result.errors }, "webhook dispatch failed");
-            sendError(res, status, result.errors?.[0] || "dispatch failed");
+            statusTracker?.addLogLine("webhook", `${source}: ${errorMsg}`);
+            sendError(res, status, errorMsg);
             return;
         }
         logger.info({ source, matched: result.matched, skipped: result.skipped }, "webhook dispatched");
+        if (result.matched > 0) {
+            statusTracker?.addLogLine("webhook", `${source}: dispatched to ${result.matched} agent${result.matched !== 1 ? "s" : ""}`);
+        }
         sendJson(res, 200, {
             ok: true,
             matched: result.matched,

package/dist/gateway/routes/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI7D,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,QAAyB,EACzB,cAAkD,EAClD,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAC5D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,MAAM,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC1D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAE7E,gCAAgC;QAChC,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,CAAC;QAED,MAAM,CAAC,KAAK,CACV;YACE,MAAM;YACN,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;YACpC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC;YACtC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;SAC/C,EACD,iBAAiB,CAClB,CAAC;QAEF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAClF,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACzC,yBAAyB,CAC1B,CAAC;YACF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAC5D,oBAAoB,CACrB,CAAC;QACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK7D,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,QAAyB,EACzB,cAAsD,EACtD,MAAc,EACd,aAA6B;IAE7B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAC5D,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,6BAA6B,MAAM,GAAG,CAAC,CAAC;YAC7E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,MAAM,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC1D,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,4BAA4B,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAE7E,gCAAgC;QAChC,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,CAAC;QAED,MAAM,CAAC,KAAK,CACV;YACE,MAAM;YACN,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;YACpC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC;YACtC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;SAC/C,EACD,iBAAiB,CAClB,CAAC;QAEF,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACzD,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACzC,yBAAyB,CAC1B,CAAC;YACF,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;YAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAC5D,oBAAoB,CACrB,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACvB,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,mBAAmB,MAAM,CAAC,OAAO,SAAS,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gateway/types.d.ts

@@ -0,0 +1,6 @@
+export interface ContainerRegistration {
+    containerName: string;
+    credentials?: Record<string, Record<string, Record<string, string>>>;
+    onLogLine?: (line: string) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/gateway/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/gateway/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC"}

package/dist/gateway/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/gateway/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/gateway/types.ts"],"names":[],"mappings":""}

package/dist/scheduler/index.d.ts

@@ -1,13 +1,14 @@
 import { Cron } from "croner";
 import type { GlobalConfig } from "../shared/config.js";
+import { type RunOutcome } from "../agents/runner.js";
 import type { StatusTracker } from "../tui/status-tracker.js";
 import { WebhookRegistry } from "../webhooks/registry.js";
 import type { GatewayServer } from "../gateway/index.js";
 interface RunnerLike {
     isRunning: boolean;
-    run(prompt: string): Promise<void>;
+    run(prompt: string): Promise<RunOutcome>;
 }
-export declare function startScheduler(projectPath: string, globalConfigOverride?: GlobalConfig, statusTracker?: StatusTracker): Promise<{
+export declare function startScheduler(projectPath: string, globalConfigOverride?: GlobalConfig, statusTracker?: StatusTracker, cloudMode?: boolean): Promise<{
     cronJobs: Cron<undefined>[];
     runners: Record<string, RunnerLike>;
     gateway: GatewayServer | undefined;

package/dist/scheduler/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scheduler/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAG9B,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAKrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,UAAU,UAAU;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,aAAa;;;;;;;GAyQ3H"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scheduler/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAG9B,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAIrE,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD,UAAU,UAAU;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1C;AAmHD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,OAAO;;;;;;;GAqZhJ"}

package/dist/scheduler/index.js

@@ -1,15 +1,106 @@
 import { Cron } from "croner";
 import { mkdirSync } from "fs";
 import { loadGlobalConfig, loadAgentConfig, discoverAgents, validateAgentConfig } from "../shared/config.js";
-import { requireCredentialRef, parseCredentialRef, loadCredentialField } from "../shared/credentials.js";
+import { backendRequireCredentialRef, backendLoadField, backendListInstances } from "../shared/credentials.js";
 import { createLogger, createFileOnlyLogger } from "../shared/logger.js";
 import { agentDir } from "../shared/paths.js";
 import { AgentRunner } from "../agents/runner.js";
-import { buildScheduledPrompt, buildWebhookPrompt } from "../agents/prompt.js";
+import { buildScheduledPrompt, buildWebhookPrompt, buildTriggeredPrompt } from "../agents/prompt.js";
 import { WebhookRegistry } from "../webhooks/registry.js";
 import { GitHubWebhookProvider } from "../webhooks/providers/github.js";
 import { SentryWebhookProvider } from "../webhooks/providers/sentry.js";
-export async function startScheduler(projectPath, globalConfigOverride, statusTracker) {
+import { AWS_CONSTANTS } from "../shared/aws-constants.js";
+// Provider type → credential type for loading secrets
+const PROVIDER_TO_CREDENTIAL = {
+    github: "github_webhook_secret",
+    sentry: "sentry_client_secret",
+};
+function buildFilterFromTrigger(trigger) {
+    const providerType = trigger.type;
+    if (providerType === "github") {
+        const f = {};
+        if (trigger.events)
+            f.events = trigger.events;
+        if (trigger.actions)
+            f.actions = trigger.actions;
+        if (trigger.repos)
+            f.repos = trigger.repos;
+        if (trigger.labels)
+            f.labels = trigger.labels;
+        if (trigger.assignee)
+            f.assignee = trigger.assignee;
+        if (trigger.author)
+            f.author = trigger.author;
+        if (trigger.branches)
+            f.branches = trigger.branches;
+        return Object.keys(f).length > 0 ? f : undefined;
+    }
+    if (providerType === "sentry") {
+        const f = {};
+        if (trigger.resources)
+            f.resources = trigger.resources;
+        return Object.keys(f).length > 0 ? f : undefined;
+    }
+    return undefined;
+}
+const DEFAULT_MAX_RERUNS = 10;
+const DEFAULT_MAX_TRIGGER_DEPTH = 3;
+function dispatchTriggers(triggers, sourceAgent, depth, ctx) {
+    for (const { agent, context } of triggers) {
+        if (agent === sourceAgent) {
+            ctx.logger.warn({ source: sourceAgent }, "agent cannot trigger itself, skipping");
+            continue;
+        }
+        if (depth >= ctx.maxTriggerDepth) {
+            ctx.logger.warn({ source: sourceAgent, target: agent, depth, maxTriggerDepth: ctx.maxTriggerDepth }, "trigger depth limit reached, skipping");
+            continue;
+        }
+        const targetConfig = ctx.agentConfigs.find((a) => a.name === agent);
+        if (!targetConfig) {
+            ctx.logger.warn({ source: sourceAgent, target: agent }, "trigger target agent not found, skipping");
+            continue;
+        }
+        const runner = ctx.runners[agent];
+        if (runner.isRunning) {
+            ctx.logger.warn({ source: sourceAgent, target: agent }, "trigger target agent is busy, skipping");
+            continue;
+        }
+        ctx.logger.info({ source: sourceAgent, target: agent, depth }, "agent trigger firing");
+        const prompt = buildTriggeredPrompt(targetConfig, sourceAgent, context);
+        runTriggered(runner, targetConfig, prompt, sourceAgent, depth + 1, ctx).catch((err) => {
+            ctx.logger.error({ err, target: agent }, "triggered run failed");
+        });
+    }
+}
+async function runTriggered(runner, agentConfig, prompt, sourceAgent, depth, ctx) {
+    const { result, triggers } = await runner.run(prompt);
+    if (triggers.length > 0) {
+        dispatchTriggers(triggers, agentConfig.name, depth, ctx);
+    }
+    // No reruns for triggered runs — they respond to a specific event
+    if (result === "completed") {
+        ctx.logger.info(`${agentConfig.name} triggered run completed`);
+    }
+}
+async function runWithReruns(runner, agentConfig, depth, ctx) {
+    let { result, triggers } = await runner.run(buildScheduledPrompt(agentConfig));
+    if (triggers.length > 0) {
+        dispatchTriggers(triggers, agentConfig.name, depth, ctx);
+    }
+    let reruns = 0;
+    while (result === "completed" && reruns < ctx.maxReruns) {
+        reruns++;
+        ctx.logger.info({ rerun: reruns, maxReruns: ctx.maxReruns }, `${agentConfig.name} did work, re-running immediately`);
+        ({ result, triggers } = await runner.run(buildScheduledPrompt(agentConfig)));
+        if (triggers.length > 0) {
+            dispatchTriggers(triggers, agentConfig.name, depth, ctx);
+        }
+    }
+    if (result === "completed" && reruns >= ctx.maxReruns) {
+        ctx.logger.warn({ maxReruns: ctx.maxReruns }, `${agentConfig.name} hit max reruns limit`);
+    }
+}
+export async function startScheduler(projectPath, globalConfigOverride, statusTracker, cloudMode) {
     const mkLogger = statusTracker ? createFileOnlyLogger : createLogger;
     const logger = mkLogger(projectPath, "scheduler");
     logger.info("Starting scheduler...");
@@ -27,17 +118,19 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
     // Validate credentials exist for each agent
     const allCredentials = new Set(agentConfigs.flatMap((a) => a.credentials));
     for (const credRef of allCredentials) {
-        requireCredentialRef(credRef);
+        await backendRequireCredentialRef(credRef);
     }
+    const maxReruns = globalConfig.maxReruns ?? DEFAULT_MAX_RERUNS;
+    const maxTriggerDepth = globalConfig.maxTriggerDepth ?? DEFAULT_MAX_TRIGGER_DEPTH;
     const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
-    const dockerEnabled = globalConfig.docker?.enabled === true;
-    const anyWebhooks = agentConfigs.some((a) => a.webhooks?.filters?.length);
+    const dockerEnabled = globalConfig.local?.enabled === true;
+    const anyWebhooks = agentConfigs.some((a) => a.webhooks?.length);
     // Validate pi_auth is not used with Docker (containers can't access host auth storage)
     if (dockerEnabled) {
         for (const config of agentConfigs) {
             if (config.model.authType === "pi_auth") {
                 throw new Error(`Agent "${config.name}" uses pi_auth which is not supported in Docker mode. ` +
-                    `Either switch to api_key/oauth_token (run 'al setup') or use --dangerous-no-docker.`);
+                    `Either switch to api_key/oauth_token (run 'al doctor') or use --no-docker.`);
             }
         }
     }
@@ -49,64 +142,176 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
         // Register providers
         webhookRegistry.registerProvider(new GitHubWebhookProvider());
         webhookRegistry.registerProvider(new SentryWebhookProvider());
-        // Load GitHub webhook secret from credentials (if configured)
-        const githubSecretRef = globalConfig.webhooks?.secretCredentials?.github
-            || "github_webhook_secret:default";
-        const { type: ghType, instance: ghInst } = parseCredentialRef(githubSecretRef);
-        const githubSecret = loadCredentialField(ghType, ghInst, "secret");
-        if (githubSecret) {
-            webhookSecrets.github = githubSecret;
-        }
-        // Load Sentry webhook secret from credentials (if configured)
-        const sentrySecretRef = globalConfig.webhooks?.secretCredentials?.sentry
-            || "sentry_client_secret:default";
-        const { type: sType, instance: sInst } = parseCredentialRef(sentrySecretRef);
-        const sentrySecret = loadCredentialField(sType, sInst, "secret");
-        if (sentrySecret) {
-            webhookSecrets.sentry = sentrySecret;
+        // Load all GitHub webhook secrets (instanceName → secret value)
+        const ghInstances = await backendListInstances("github_webhook_secret");
+        const ghSecrets = {};
+        for (const inst of ghInstances) {
+            const secret = await backendLoadField("github_webhook_secret", inst, "secret");
+            if (secret)
+                ghSecrets[inst] = secret;
+        }
+        if (Object.keys(ghSecrets).length > 0) {
+            webhookSecrets.github = ghSecrets;
+            logger.info({ count: Object.keys(ghSecrets).length }, "loaded GitHub webhook secrets");
+        }
+        // Load all Sentry webhook secrets (instanceName → secret value)
+        const sentryInstances = await backendListInstances("sentry_client_secret");
+        const sentrySecrets = {};
+        for (const inst of sentryInstances) {
+            const secret = await backendLoadField("sentry_client_secret", inst, "secret");
+            if (secret)
+                sentrySecrets[inst] = secret;
+        }
+        if (Object.keys(sentrySecrets).length > 0) {
+            webhookSecrets.sentry = sentrySecrets;
+            logger.info({ count: Object.keys(sentrySecrets).length }, "loaded Sentry webhook secrets");
         }
     }
     let gateway;
-    let baseImage = "al-agent:latest";
+    let runtime;
+    let baseImage = AWS_CONSTANTS.DEFAULT_IMAGE;
     const agentImages = {};
+    // Determine runtime type from cloud mode or local
+    const useCloudRuntime = cloudMode && globalConfig.cloud;
+    const runtimeType = useCloudRuntime ? globalConfig.cloud.provider : "local";
+    // Register agents early so the TUI shows them during image builds
+    for (const agentConfig of agentConfigs) {
+        statusTracker?.registerAgent(agentConfig.name);
+    }
     if (dockerEnabled) {
-        logger.info("Docker mode enabled — initializing docker infrastructure");
-        // 1. Verify Docker is available and running
-        const { execFileSync } = await import("child_process");
-        try {
-            execFileSync("docker", ["info"], { stdio: "pipe", timeout: 10000 });
-        }
-        catch {
-            throw new Error("Docker is not running. Start Docker Desktop (or the Docker daemon) and try again, " +
-                "or use --dangerous-no-docker to run without container isolation.");
-        }
-        // 2. Ensure Docker network exists
-        logger.info("Ensuring Docker network...");
-        const { ensureNetwork } = await import("../docker/network.js");
-        ensureNetwork();
-        // 3. Ensure base Docker image is built (may take a while on first run)
-        baseImage = globalConfig.docker?.image || "al-agent:latest";
-        logger.info({ image: baseImage }, "Ensuring base Docker image (this may take a few minutes on first run)...");
-        const { ensureImage, ensureAgentImage } = await import("../docker/image.js");
-        ensureImage(baseImage);
-        // 4. Build per-agent images for agents with a custom Dockerfile
+        logger.info({ runtime: runtimeType }, "Docker mode enabled — initializing infrastructure");
+        // 1. Create the container runtime
+        if (useCloudRuntime && globalConfig.cloud.provider === "cloud-run") {
+            const { CloudRunJobRuntime } = await import("../docker/cloud-run-runtime.js");
+            const { gcpProject, region, artifactRegistry, serviceAccount, secretPrefix } = globalConfig.cloud;
+            if (!gcpProject || !region || !artifactRegistry || !serviceAccount) {
+                throw new Error("Cloud Run runtime requires cloud.gcpProject, cloud.region, " +
+                    "cloud.artifactRegistry, and cloud.serviceAccount in config.toml");
+            }
+            runtime = new CloudRunJobRuntime({ gcpProject, region, artifactRegistry, serviceAccount, secretPrefix });
+            logger.info({ gcpProject, region }, "Using Cloud Run Jobs runtime");
+        }
+        else if (useCloudRuntime && globalConfig.cloud.provider === "ecs") {
+            const { ECSFargateRuntime } = await import("../docker/ecs-runtime.js");
+            const cc = globalConfig.cloud;
+            if (!cc.awsRegion || !cc.ecsCluster || !cc.ecrRepository || !cc.executionRoleArn || !cc.taskRoleArn || !cc.subnets?.length) {
+                throw new Error("ECS runtime requires cloud.awsRegion, cloud.ecsCluster, cloud.ecrRepository, " +
+                    "cloud.executionRoleArn, cloud.taskRoleArn, and cloud.subnets in config.toml");
+            }
+            runtime = new ECSFargateRuntime({
+                awsRegion: cc.awsRegion,
+                ecsCluster: cc.ecsCluster,
+                ecrRepository: cc.ecrRepository,
+                executionRoleArn: cc.executionRoleArn,
+                taskRoleArn: cc.taskRoleArn,
+                subnets: cc.subnets,
+                securityGroups: cc.securityGroups,
+                secretPrefix: cc.awsSecretPrefix,
+            });
+            logger.info({ region: cc.awsRegion, cluster: cc.ecsCluster }, "Using ECS Fargate runtime");
+        }
+        else {
+            // Local runtime needs Docker running
+            const { execFileSync } = await import("child_process");
+            try {
+                execFileSync("docker", ["info"], { stdio: "pipe", timeout: 10000 });
+            }
+            catch {
+                throw new Error("Docker is not running. Start Docker Desktop (or the Docker daemon) and try again, " +
+                    "or use --no-docker to run without container isolation.");
+            }
+            const { LocalDockerRuntime } = await import("../docker/local-runtime.js");
+            runtime = new LocalDockerRuntime();
+            // Local-only: ensure Docker network
+            logger.info("Ensuring Docker network...");
+            const { ensureNetwork } = await import("../docker/network.js");
+            ensureNetwork();
+        }
+        // 2. Build base image via the runtime
+        const { resolve: resolvePath, dirname } = await import("path");
+        const { fileURLToPath } = await import("url");
+        const packageRoot = resolvePath(dirname(fileURLToPath(import.meta.url)), "..", "..");
+        baseImage = globalConfig.local?.image || AWS_CONSTANTS.DEFAULT_IMAGE;
+        logger.info({ image: baseImage }, "Building base image (this may take a few minutes on first run)...");
+        // Show all agents as "building" during the base image build
+        const setBuildProgress = (message) => {
+            for (const ac of agentConfigs) {
+                statusTracker?.setAgentStatusText(ac.name, message);
+            }
+        };
+        for (const ac of agentConfigs) {
+            statusTracker?.setAgentState(ac.name, "building");
+        }
+        if (runtimeType === "local") {
+            // Local: only build if image doesn't exist yet
+            const { imageExists } = await import("../docker/image.js");
+            if (!imageExists(baseImage)) {
+                setBuildProgress("Building base image");
+                await runtime.buildImage({
+                    tag: baseImage, dockerfile: "docker/Dockerfile", contextDir: packageRoot,
+                    onProgress: setBuildProgress,
+                });
+            }
+        }
+        else {
+            // Cloud: always build (Cloud Build handles caching)
+            baseImage = await runtime.buildImage({
+                tag: baseImage, dockerfile: "docker/Dockerfile", contextDir: packageRoot,
+                onProgress: setBuildProgress,
+            });
+        }
+        // 3. Build per-agent images for agents with a custom Dockerfile
+        const { existsSync } = await import("fs");
         for (const agentConfig of agentConfigs) {
-            const image = ensureAgentImage(agentConfig.name, projectPath, baseImage);
+            const agentDockerfile = resolvePath(projectPath, agentConfig.name, "Dockerfile");
+            if (!existsSync(agentDockerfile)) {
+                agentImages[agentConfig.name] = baseImage;
+                continue;
+            }
+            statusTracker?.setAgentState(agentConfig.name, "building");
+            statusTracker?.setAgentStatusText(agentConfig.name, "Building custom image");
+            const agentImageTag = AWS_CONSTANTS.agentImage(agentConfig.name);
+            const image = await runtime.buildImage({
+                tag: agentImageTag,
+                dockerfile: agentDockerfile,
+                contextDir: packageRoot,
+                baseImage,
+                onProgress: (msg) => statusTracker?.setAgentStatusText(agentConfig.name, msg),
+            });
             agentImages[agentConfig.name] = image;
-            if (image !== baseImage) {
-                logger.info({ agent: agentConfig.name, image }, "Built custom agent image");
+            logger.info({ agent: agentConfig.name, image }, "Built custom agent image");
+        }
+        // 4. Push images to remote registry if needed (no-op for local, tags+pushes for cloud)
+        if (runtimeType !== "local") {
+            for (const agentConfig of agentConfigs) {
+                const currentImage = agentImages[agentConfig.name] || baseImage;
+                if (!currentImage.includes("/")) {
+                    // Looks like a local tag — needs pushing
+                    statusTracker?.setAgentStatusText(agentConfig.name, "Pushing image to registry");
+                    const remoteImage = await runtime.pushImage(currentImage);
+                    agentImages[agentConfig.name] = remoteImage;
+                    logger.info({ agent: agentConfig.name, image: remoteImage }, "Pushed image to registry");
+                }
             }
         }
+        // Reset all agents back to idle after builds complete
+        for (const ac of agentConfigs) {
+            statusTracker?.setAgentState(ac.name, "idle");
+        }
         logger.info("Docker infrastructure ready");
-        // 4. Start gateway (with webhook registry if configured)
-        const { startGateway } = await import("../gateway/index.js");
-        const gatewayPort = globalConfig.gateway?.port || 8080;
-        gateway = await startGateway({
-            port: gatewayPort,
-            logger: mkLogger(projectPath, "gateway"),
-            webhookRegistry,
-            webhookSecrets,
-        });
+        // 6. Start gateway if the runtime needs it or webhooks are configured
+        if (runtime.needsGateway || anyWebhooks) {
+            const { startGateway } = await import("../gateway/index.js");
+            const gatewayPort = globalConfig.gateway?.port || 8080;
+            gateway = await startGateway({
+                port: gatewayPort,
+                logger: mkLogger(projectPath, "gateway"),
+                killContainer: (name) => runtime.kill(name),
+                webhookRegistry,
+                webhookSecrets,
+                statusTracker,
+            });
+        }
     }
     else if (anyWebhooks) {
         // Start gateway even without docker when webhooks are configured
@@ -118,35 +323,45 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
             logger: mkLogger(projectPath, "gateway"),
             webhookRegistry,
             webhookSecrets,
+            statusTracker,
         });
     }
     // Create runners for each agent
     const runners = {};
-    if (dockerEnabled && gateway) {
+    if (dockerEnabled && runtime) {
         const { ContainerAgentRunner } = await import("../agents/container-runner.js");
         const gatewayPort = globalConfig.gateway?.port || 8080;
         const gatewayUrl = `http://host.docker.internal:${gatewayPort}`;
+        // Gateway callbacks — no-ops if gateway isn't running (remote runtimes)
+        const registerContainer = gateway
+            ? gateway.registerContainer
+            : (_secret, _reg) => { };
+        const unregisterContainer = gateway
+            ? gateway.unregisterContainer
+            : (_secret) => { };
         for (const agentConfig of agentConfigs) {
-            statusTracker?.registerAgent(agentConfig.name);
-            runners[agentConfig.name] = new ContainerAgentRunner(globalConfig, agentConfig, mkLogger(projectPath, agentConfig.name), gateway.registerContainer, gatewayUrl, projectPath, agentImages[agentConfig.name] || baseImage, statusTracker);
+            runners[agentConfig.name] = new ContainerAgentRunner(runtime, globalConfig, agentConfig, mkLogger(projectPath, agentConfig.name), registerContainer, unregisterContainer, gatewayUrl, projectPath, agentImages[agentConfig.name] || baseImage, statusTracker);
         }
     }
     else {
         for (const agentConfig of agentConfigs) {
             mkdirSync(agentDir(projectPath, agentConfig.name), { recursive: true });
-            statusTracker?.registerAgent(agentConfig.name);
             runners[agentConfig.name] = new AgentRunner(agentConfig, mkLogger(projectPath, agentConfig.name), projectPath, statusTracker);
         }
     }
+    const schedulerCtx = { runners, agentConfigs, maxReruns, maxTriggerDepth, logger };
     // Set up webhook bindings
     if (webhookRegistry) {
         for (const agentConfig of agentConfigs) {
-            if (!agentConfig.webhooks?.filters?.length)
+            if (!agentConfig.webhooks?.length)
                 continue;
             const runner = runners[agentConfig.name];
-            for (const filter of agentConfig.webhooks.filters) {
+            for (const trigger of agentConfig.webhooks) {
+                const filter = buildFilterFromTrigger(trigger);
                 webhookRegistry.addBinding({
                     agentName: agentConfig.name,
+                    source: trigger.source,
+                    type: trigger.type,
                     filter,
                     trigger: (context) => {
                         if (runner.isRunning) {
@@ -155,7 +370,11 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
                         }
                         logger.info({ agent: agentConfig.name, event: context.event, action: context.action }, "webhook triggering agent");
                         const prompt = buildWebhookPrompt(agentConfig, context);
-                        runner.run(prompt).catch((err) => {
+                        runner.run(prompt).then(({ triggers }) => {
+                            if (triggers.length > 0) {
+                                dispatchTriggers(triggers, agentConfig.name, 0, schedulerCtx);
+                            }
+                        }).catch((err) => {
                             logger.error({ err }, `${agentConfig.name} webhook run failed`);
                         });
                     },
@@ -175,7 +394,7 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
                 return;
             }
             logger.info(`Triggering ${agentConfig.name} (scheduled)`);
-            await runner.run(buildScheduledPrompt(agentConfig));
+            await runWithReruns(runner, agentConfig, 0, schedulerCtx);
         });
         cronJobs.push(job);
         const nextRun = job.nextRun();
@@ -187,9 +406,9 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
     const webhookUrls = [];
     if (anyWebhooks && gateway) {
         const gatewayPort = globalConfig.gateway?.port || 8080;
-        const sources = new Set(agentConfigs.flatMap((a) => a.webhooks?.filters?.map((f) => f.source) || []));
-        for (const source of sources) {
-            webhookUrls.push(`http://localhost:${gatewayPort}/webhooks/${source}`);
+        const providerTypes = new Set(agentConfigs.flatMap((a) => a.webhooks?.map((t) => t.type) || []));
+        for (const pt of providerTypes) {
+            webhookUrls.push(`http://localhost:${gatewayPort}/webhooks/${pt}`);
         }
     }
     logger.info(`Scheduler running with ${cronJobs.length} scheduled jobs`);
@@ -199,7 +418,7 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
             continue;
         const runner = runners[agentConfig.name];
         logger.info(`Initial run for ${agentConfig.name}`);
-        runner.run(buildScheduledPrompt(agentConfig)).catch((err) => {
+        runWithReruns(runner, agentConfig, 0, schedulerCtx).catch((err) => {
             logger.error({ err }, `Initial ${agentConfig.name} run failed`);
         });
     }