@atolis-hq/wake 0.4.36 → 0.4.38

package/dist/src/bootstrap/composition-root.d.ts

@@ -71,6 +71,7 @@ export interface CompositionRoot {
     readonly delivery: DeliveryService;
     readonly intakePipeline: IntakePipeline;
     readonly runnerPipeline: RunnerPipeline;
+    readonly requestImmediatePoll: (adapter: string) => void;
     readonly resolveResourceLink: ResourceLinkResolver;
 }
 export declare function createCompositionRoot(wakeRoot: string, options?: CompositionRootOptions): Promise<CompositionRoot>;

package/dist/src/bootstrap/integration-runtime.d.ts

@@ -19,6 +19,7 @@ export interface IntegrationRuntime {
     readonly delivery: DeliveryService;
     readonly intakePipeline: IntakePipeline;
     readonly runnerPipeline: RunnerPipeline;
+    readonly requestImmediatePoll: (adapter: string) => void;
 }
 export interface IntegrationRuntimeInput {
     readonly config: ResolvedWakeModulesConfig;
@@ -46,3 +47,5 @@ export interface IntegrationRuntimeInput {
     readonly providerDefinitions: readonly ProviderDefinition[];
 }
 export declare function composeIntegrationRuntime(input: IntegrationRuntimeInput): Promise<IntegrationRuntime>;
+/** Coalesces provider webhook requests while retaining the source's durable poll semantics. */
+export declare function createImmediatePollRequester(providers: readonly ProviderInstance[], journal: EventJournal, wakeRoot: string): (adapter: string) => void;

package/dist/src/bootstrap/integration-runtime.js

@@ -23,6 +23,7 @@ export async function composeIntegrationRuntime(input) {
         registry.register(definition);
     const { instances, failures: providerFailures } = registry.compose(await hydrateFakeProviderEvidence(input.wakeRoot, input.config.integrations), {
         publicUiUrl: input.config.surfaces.web.publicUrl,
+        providerStateRoot: join(input.wakeRoot, '.wake'),
         work: input.work,
         conversations: input.conversations,
         resources: input.resources,
@@ -155,6 +156,7 @@ export async function composeIntegrationRuntime(input) {
             await delivery.deliverNext(signal);
         }),
     });
+    const requestImmediatePoll = createImmediatePollRequester(providers, input.journal, input.wakeRoot);
     return {
         projectionSubscriptions,
         processors: [
@@ -172,6 +174,26 @@ export async function composeIntegrationRuntime(input) {
         delivery,
         intakePipeline,
         runnerPipeline,
+        requestImmediatePoll,
+    };
+}
+/** Coalesces provider webhook requests while retaining the source's durable poll semantics. */
+export function createImmediatePollRequester(providers, journal, wakeRoot) {
+    const immediatePolls = new Map();
+    return (adapter) => {
+        if (immediatePolls.has(adapter))
+            return;
+        const provider = providers.find((candidate) => candidate.adapter === adapter);
+        if (provider === undefined)
+            return;
+        const run = withFileLock(join(wakeRoot, '.wake', 'locks', `poll-${provider.adapter}.lock`), async () => {
+            await new PollService(journal, provider).pollOnce(new AbortController().signal, {
+                bypassInterval: true,
+            });
+        })
+            .catch((error) => console.error(`Webhook polling ${adapter} failed`, error))
+            .finally(() => immediatePolls.delete(adapter));
+        immediatePolls.set(adapter, run);
     };
 }
 async function observeMemory(profile, phase, operation) {

package/dist/src/bootstrap/surface-cli-applications.d.ts

@@ -28,6 +28,7 @@ interface ExecutionShutdown {
     shutdown(): Promise<void>;
 }
 export declare function closeResidentRuntime(execution: ExecutionShutdown, closeResources: () => Promise<void>): Promise<void>;
+export declare function createProviderWebhookReceiver(providers: readonly CompositionRoot['providers'][number][], requestImmediatePoll: (adapter: string) => void): (body: Buffer, headers: Readonly<Record<string, string | string[] | undefined>>) => Promise<401 | 404 | 400 | 202>;
 /** The production maintenance boundary shared by the CLI update application. */
 export declare function createSelfUpdateQuiescePort(root: CompositionRoot): SelfUpdateQuiescePort;
 export {};

package/dist/src/bootstrap/surface-cli-applications.js

@@ -55,10 +55,13 @@ export function createSurfaceCliApplications(root, api, now) {
         },
         start: {
             async run(signal, budget) {
+                const listening = root.config.surfaces.web.enabled || root.config.surfaces.api.enabled;
                 if (root.config.surfaces.web.enabled)
                     await startHttp({}, true);
                 else if (root.config.surfaces.api.enabled)
                     await startHttp({}, false);
+                if (listening)
+                    await Promise.all(root.providers.flatMap((provider) => provider.webhook === undefined ? [] : [provider.webhook.provision()]));
                 return runResidentLifecycle({
                     signal,
                     budget,
@@ -289,6 +292,7 @@ function createHttpStarter(root, api, servers) {
                 disabled: root.config.surfaces.web.auth.disabled,
                 redeemGrant: (grant) => redeemPairingGrant(root.paths.wakeRoot, grant, undefined, serialiseCredentialMutation),
             },
+            webhookReceiver: createProviderWebhookReceiver(root.providers, root.requestImmediatePoll),
             ...(assets === undefined ? {} : { assets }),
         });
         servers.add(server);
@@ -304,6 +308,20 @@ function createHttpStarter(root, api, servers) {
         }
     };
 }
+export function createProviderWebhookReceiver(providers, requestImmediatePoll) {
+    return async (body, headers) => {
+        const statuses = await Promise.all(providers.flatMap((provider) => provider.webhook === undefined
+            ? []
+            : [provider.webhook.receive(body, headers, () => requestImmediatePoll(provider.adapter))]));
+        if (statuses.includes(202))
+            return 202;
+        if (statuses.includes(401))
+            return 401;
+        if (statuses.includes(400))
+            return 400;
+        return 404;
+    };
+}
 function serialiseCredentialMutation(lockPath, operation) {
     return withFileLock(lockPath, operation, { waitMs: 5_000, retryIntervalMs: 10 });
 }

package/dist/src/bootstrap/version.js

@@ -124,6 +124,6 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "v0.4.36";
+export const wakeVersion = "v0.4.38";
 /** The registry-installable version used by packaged sandbox images. */
 export const wakePackageVersion = packageVersion(defaultRepoRoot) ?? wakeVersion;

package/dist/src/integrations/application/poll-service.d.ts

@@ -9,5 +9,7 @@ export declare class PollService {
     private readonly instance;
     constructor(journal: EventJournal, instance: ProviderInstance);
     /** Persists every independently durable draft and reports partial progress. */
-    pollOnce(signal: AbortSignal): Promise<PollResult>;
+    pollOnce(signal: AbortSignal, options?: {
+        readonly bypassInterval?: boolean;
+    }): Promise<PollResult>;
 }

package/dist/src/integrations/application/poll-service.js

@@ -7,9 +7,9 @@ export class PollService {
         this.instance = instance;
     }
     /** Persists every independently durable draft and reports partial progress. */
-    async pollOnce(signal) {
+    async pollOnce(signal, options) {
         const adapter = this.instance.adapter;
-        const drafts = await this.instance.source.poll(signal);
+        const drafts = await this.instance.source.poll(signal, options);
         let appended = 0;
         let failed = 0;
         for (const draft of drafts) {

package/dist/src/integrations/contracts/intake.d.ts

@@ -1,7 +1,9 @@
 import type { EventData, EventProcessor } from '@atolis-hq/eventing';
 export type ProviderEventData = EventData<string, unknown>;
 export interface ExternalEventSource {
-    poll(signal: AbortSignal): Promise<readonly ProviderEventData[]>;
+    poll(signal: AbortSignal, options?: {
+        readonly bypassInterval?: boolean;
+    }): Promise<readonly ProviderEventData[]>;
     /** Commits provider cursor state after every draft from the poll is durable. */
     markPollPersisted?(): Promise<void>;
 }

package/dist/src/integrations/contracts/provider.d.ts

@@ -22,6 +22,8 @@ export interface WorkConclusion {
 export interface ProviderServices {
     /** Stable operator-configured UI address included in provider notifications when present. */
     readonly publicUiUrl?: string | undefined;
+    /** Durable provider-owned operational state, rooted at .wake/. */
+    readonly providerStateRoot: string;
     readonly work: WorkService;
     readonly conversations: ConversationService;
     readonly resources: ResourceService;
@@ -73,6 +75,11 @@ export interface ProviderInstance {
     readonly health?: () => readonly AdapterHealthCheck[];
     readonly commands?: () => readonly AdapterCommand[];
     readonly replyPublication?: ReplyPublicationConfig | undefined;
+    readonly webhook?: ProviderWebhook | undefined;
+}
+export interface ProviderWebhook {
+    provision(): Promise<void>;
+    receive(body: Buffer, headers: Readonly<Record<string, string | string[] | undefined>>, trigger: () => void): Promise<404 | 400 | 401 | 202>;
 }
 export type ComposedProviderInstance = Omit<ProviderInstance, 'provider'>;
 export interface ProviderDefinition<Config = unknown> {

package/dist/src/integrations/github/contracts/config.d.ts

@@ -13,6 +13,9 @@ export declare const gitHubConfigSchema: z.ZodObject<{
         lookbackMs: z.ZodDefault<z.ZodNumber>;
         intervalMs: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
+    webhooks: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
     intake: z.ZodDefault<z.ZodArray<z.ZodObject<{
         where: z.ZodObject<{
             kind: z.ZodOptional<z.ZodEnum<{

package/dist/src/integrations/github/contracts/config.js

@@ -88,6 +88,10 @@ export const gitHubConfigSchema = z
         lookbackMs: 60_000,
         intervalMs: 30_000,
     }),
+    webhooks: z
+        .object({ enabled: z.boolean().default(false) })
+        .strict()
+        .default({ enabled: false }),
     intake: z.array(intakeRuleSchema).default([]),
     publication: z
         .object({

package/dist/src/integrations/github/index.d.ts

@@ -31,4 +31,6 @@ export * from './infrastructure/issue-source.js';
 export * from './infrastructure/pr-source.js';
 export * from './infrastructure/review-source.js';
 export * from './infrastructure/source.js';
+export * from './infrastructure/webhook.js';
+export * from './infrastructure/webhook-state.js';
 export * from './provider.js';

package/dist/src/integrations/github/index.js

@@ -31,4 +31,6 @@ export * from './infrastructure/issue-source.js';
 export * from './infrastructure/pr-source.js';
 export * from './infrastructure/review-source.js';
 export * from './infrastructure/source.js';
+export * from './infrastructure/webhook.js';
+export * from './infrastructure/webhook-state.js';
 export * from './provider.js';

package/dist/src/integrations/github/infrastructure/adapter-health-registry.d.ts

@@ -1,5 +1,5 @@
 import type { AdapterHealthCheck } from '../../contracts/provider.js';
-export type GitHubHealthChannel = 'poll' | 'deliver';
+export type GitHubHealthChannel = 'poll' | 'deliver' | 'webhook';
 export interface GitHubAdapterHealthRegistry {
     recordSuccess(repository: string, channel: GitHubHealthChannel): void;
     recordFailure(repository: string, channel: GitHubHealthChannel, error: unknown): void;

package/dist/src/integrations/github/infrastructure/client.d.ts

@@ -3,6 +3,22 @@ import type { GitHubIssueQueryFilters } from '../contracts/issue-query.js';
 import { GitHubOutboundAction } from '../contracts/vocabulary.js';
 export declare function redactGitHubRequestMessage(message: unknown): string;
 export declare function createGitHubClient(token: string): {
+    getHook: (owner: string, repo: string, hookId: number) => Promise<void>;
+    createHook: (input: {
+        owner: string;
+        repo: string;
+        url: string;
+        secret: string;
+        events: readonly string[];
+    }) => Promise<number>;
+    updateHook: (input: {
+        owner: string;
+        repo: string;
+        hookId: number;
+        url: string;
+        secret: string;
+        events: readonly string[];
+    }) => Promise<void>;
     authenticatedLogin: () => Promise<string>;
     collaboratorPermission: (owner: string, repo: string, login: string) => Promise<ProviderPermission>;
     getIssueLabelsFresh: (owner: string, repo: string, issueNumber: number) => Promise<string[]>;

package/dist/src/integrations/github/infrastructure/client.js

@@ -62,6 +62,35 @@ export function createGitHubClient(token) {
             });
         },
         deliver: (command) => deliver(octokit, command),
+        ...createGitHubWebhookClient(octokit),
+    };
+}
+function createGitHubWebhookClient(octokit) {
+    return {
+        getHook: async (owner, repo, hookId) => {
+            await octokit.rest.repos.getWebhook({ owner, repo, hook_id: hookId });
+        },
+        createHook: async (input) => {
+            const response = await octokit.rest.repos.createWebhook({
+                owner: input.owner,
+                repo: input.repo,
+                name: 'web',
+                active: true,
+                events: [...input.events],
+                config: { url: input.url, content_type: 'json', secret: input.secret },
+            });
+            return response.data.id;
+        },
+        updateHook: async (input) => {
+            await octokit.rest.repos.updateWebhook({
+                owner: input.owner,
+                repo: input.repo,
+                hook_id: input.hookId,
+                active: true,
+                events: [...input.events],
+                config: { url: input.url, content_type: 'json', secret: input.secret },
+            });
+        },
     };
 }
 function createGitHubReadClient(octokit, cache) {

package/dist/src/integrations/github/infrastructure/source.js

@@ -20,9 +20,11 @@ export function createGitHubSource(config, client, adapter, requests = createGit
     // the same tradeoff already made for lastEventIds above.
     let lastPolledAt;
     return {
-        async poll(signal) {
+        async poll(signal, options) {
             const currentTime = now();
-            if (lastPolledAt !== undefined && currentTime - lastPolledAt < config.polling.intervalMs) {
+            if (options?.bypassInterval !== true &&
+                lastPolledAt !== undefined &&
+                currentTime - lastPolledAt < config.polling.intervalMs) {
                 return [];
             }
             lastPolledAt = currentTime;

package/dist/src/integrations/github/infrastructure/webhook-state.d.ts

@@ -0,0 +1,16 @@
+import type { AdapterId } from '../../contracts/identifiers.js';
+export interface GitHubWebhookState {
+    readonly secret: string;
+    readonly hookId?: number;
+}
+/** Provider operational state: intentionally outside configuration and projections. */
+export declare class GitHubWebhookStateStore {
+    private readonly root;
+    private readonly adapter;
+    constructor(root: string, adapter: AdapterId);
+    load(owner: string, repo: string): Promise<GitHubWebhookState>;
+    save(owner: string, repo: string, state: GitHubWebhookState): Promise<void>;
+    serialise<Value>(owner: string, repo: string, operation: () => Promise<Value>): Promise<Value>;
+    private path;
+    private lockPath;
+}

package/dist/src/integrations/github/infrastructure/webhook-state.js

@@ -0,0 +1,70 @@
+import { randomBytes } from 'node:crypto';
+import { mkdir, open, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/** Provider operational state: intentionally outside configuration and projections. */
+export class GitHubWebhookStateStore {
+    root;
+    adapter;
+    constructor(root, adapter) {
+        this.root = root;
+        this.adapter = adapter;
+    }
+    async load(owner, repo) {
+        const path = this.path(owner, repo);
+        try {
+            const parsed = JSON.parse(await readFile(path, 'utf8'));
+            if (typeof parsed === 'object' &&
+                parsed !== null &&
+                'secret' in parsed &&
+                typeof parsed.secret === 'string' &&
+                ('hookId' in parsed ? typeof parsed.hookId === 'number' : true))
+                return parsed;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const state = { secret: randomBytes(32).toString('hex') };
+        await this.save(owner, repo, state);
+        return state;
+    }
+    async save(owner, repo, state) {
+        const path = this.path(owner, repo);
+        await mkdir(join(this.root, 'github-webhooks', this.adapter), { recursive: true });
+        const temporary = `${path}.${process.pid}.tmp`;
+        await writeFile(temporary, JSON.stringify(state), { encoding: 'utf8', mode: 0o600 });
+        await rename(temporary, path);
+    }
+    async serialise(owner, repo, operation) {
+        await mkdir(join(this.root, 'locks'), { recursive: true });
+        const lock = this.lockPath(owner, repo);
+        await acquireLock(lock);
+        try {
+            return await operation();
+        }
+        finally {
+            await unlink(lock);
+        }
+    }
+    path(owner, repo) {
+        return join(this.root, 'github-webhooks', this.adapter, `${encodeURIComponent(owner)}--${encodeURIComponent(repo)}.json`);
+    }
+    lockPath(owner, repo) {
+        return join(this.root, 'locks', `github-webhook-${this.adapter}-${encodeURIComponent(owner)}--${encodeURIComponent(repo)}.lock`);
+    }
+}
+async function acquireLock(path) {
+    const deadline = Date.now() + 5_000;
+    while (true) {
+        try {
+            const handle = await open(path, 'wx', 0o600);
+            await handle.close();
+            return;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST' || Date.now() >= deadline)
+                throw error;
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        }
+    }
+}

package/dist/src/integrations/github/infrastructure/webhook.d.ts

@@ -0,0 +1,24 @@
+import type { AdapterId } from '../../contracts/identifiers.js';
+import type { ProviderWebhook } from '../../contracts/provider.js';
+import type { GitHubConfig } from '../contracts/config.js';
+import type { GitHubAdapterHealthRegistry } from './adapter-health-registry.js';
+interface HookClient {
+    getHook(owner: string, repo: string, hookId: number): Promise<void>;
+    createHook(input: {
+        owner: string;
+        repo: string;
+        url: string;
+        secret: string;
+        events: readonly string[];
+    }): Promise<number>;
+    updateHook(input: {
+        owner: string;
+        repo: string;
+        hookId: number;
+        url: string;
+        secret: string;
+        events: readonly string[];
+    }): Promise<void>;
+}
+export declare function createGitHubWebhook(adapter: AdapterId, config: GitHubConfig, publicUrl: string | undefined, root: string, client: HookClient, health: GitHubAdapterHealthRegistry): ProviderWebhook;
+export {};

package/dist/src/integrations/github/infrastructure/webhook.js

@@ -0,0 +1,148 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { GitHubWebhookStateStore } from './webhook-state.js';
+const events = new Set([
+    'issues',
+    'issue_comment',
+    'pull_request',
+    'pull_request_review',
+    'pull_request_review_comment',
+    'check_run',
+    'status',
+]);
+export function createGitHubWebhook(adapter, config, publicUrl, root, client, health) {
+    const state = new GitHubWebhookStateStore(root, adapter);
+    const endpoint = publicUrl === undefined ? undefined : webhookEndpoint(publicUrl);
+    return {
+        async provision() {
+            for (const repository of config.repositories) {
+                if (!config.webhooks.enabled)
+                    continue;
+                if (endpoint === undefined) {
+                    health.recordFailure(`${repository.owner}/${repository.repo}`, 'webhook', new Error('surfaces.web.publicUrl is not configured'));
+                    continue;
+                }
+                try {
+                    await state.serialise(repository.owner, repository.repo, () => provisionRepository(repository, endpoint, state, client, health));
+                }
+                catch (error) {
+                    health.recordFailure(`${repository.owner}/${repository.repo}`, 'webhook', error);
+                }
+            }
+        },
+        async receive(body, headers, trigger) {
+            if (!config.webhooks.enabled)
+                return 404;
+            const signature = header(headers, 'x-hub-signature-256');
+            if (signature === undefined)
+                return 401;
+            const event = header(headers, 'x-github-event');
+            if (event === undefined)
+                return 400;
+            const fullName = parseRepository(body);
+            if (fullName === null)
+                return 400;
+            if (fullName === undefined)
+                return 404;
+            const [owner, repo] = fullName.split('/');
+            if (owner === undefined ||
+                repo === undefined ||
+                !config.repositories.some((value) => value.owner === owner && value.repo === repo))
+                return 404;
+            return state.serialise(owner, repo, async () => {
+                const saved = await state.load(owner, repo);
+                const expected = `sha256=${createHmac('sha256', saved.secret).update(body).digest('hex')}`;
+                if (!safeEqual(signature, expected))
+                    return 401;
+                if (!events.has(event))
+                    return 404;
+                trigger();
+                return 202;
+            });
+        },
+    };
+}
+async function provisionRepository(repository, endpoint, state, client, health) {
+    const scope = `${repository.owner}/${repository.repo}`;
+    try {
+        const saved = await state.load(repository.owner, repository.repo);
+        if (saved.hookId !== undefined &&
+            (await updateManagedHook(repository, endpoint, saved, client))) {
+            health.recordSuccess(scope, 'webhook');
+            return;
+        }
+        const hookId = await client.createHook({
+            ...repository,
+            url: endpoint,
+            secret: saved.secret,
+            events: [...events],
+        });
+        await state.save(repository.owner, repository.repo, { ...saved, hookId });
+        health.recordSuccess(scope, 'webhook');
+    }
+    catch (error) {
+        health.recordFailure(scope, 'webhook', error);
+    }
+}
+async function updateManagedHook(repository, endpoint, saved, client) {
+    if (saved.hookId === undefined)
+        return false;
+    try {
+        await client.getHook(repository.owner, repository.repo, saved.hookId);
+        await client.updateHook({
+            ...repository,
+            hookId: saved.hookId,
+            url: endpoint,
+            secret: saved.secret,
+            events: [...events],
+        });
+        return true;
+    }
+    catch (error) {
+        if (statusOf(error) === 404)
+            return false;
+        throw error;
+    }
+}
+function header(headers, name) {
+    const value = headers[name] ?? headers[name.toLowerCase()];
+    return Array.isArray(value) ? value[0] : value;
+}
+function repositoryName(value) {
+    if (typeof value !== 'object' ||
+        value === null ||
+        !('full_name' in value) ||
+        typeof value.full_name !== 'string')
+        return undefined;
+    return value.full_name;
+}
+function parseRepository(body) {
+    try {
+        const payload = JSON.parse(body.toString('utf8'));
+        if (typeof payload !== 'object' || payload === null || !('repository' in payload))
+            return null;
+        return repositoryName(payload.repository);
+    }
+    catch {
+        return null;
+    }
+}
+function safeEqual(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function statusOf(error) {
+    return typeof error === 'object' &&
+        error !== null &&
+        'status' in error &&
+        typeof error.status === 'number'
+        ? error.status
+        : undefined;
+}
+function webhookEndpoint(publicUrl) {
+    const base = new URL(publicUrl);
+    base.pathname = `${base.pathname.replace(/\/$/, '')}/webhooks/github`;
+    base.search = '';
+    base.hash = '';
+    return base.href;
+}

package/dist/src/integrations/github/provider.js

@@ -14,6 +14,7 @@ import { createGitHubDelivery } from './infrastructure/delivery.js';
 import { resolveGitHubCliToken } from './infrastructure/gh-auth.js';
 import { createGitHubRequestCoordinator } from './infrastructure/request-coordinator.js';
 import { createGitHubSource } from './infrastructure/source.js';
+import { createGitHubWebhook } from './infrastructure/webhook.js';
 export const gitHubProviderDefinition = {
     provider: 'github',
     eventTypes: Object.values(GitHubEventType),
@@ -59,6 +60,7 @@ export const gitHubProviderDefinition = {
                 requests,
             }),
             health: () => health.snapshotAll(),
+            webhook: createGitHubWebhook(adapter, config, services.publicUiUrl, services.providerStateRoot, client, health),
             commands: () => [
                 ...Object.values(GitHubBuiltInCommand).map((syntax) => ({ syntax })),
                 ...config.commands.map((syntax) => ({ syntax })),

package/dist/src/orchestration/application/orchestration-service.js

@@ -154,7 +154,7 @@ export class OrchestrationService {
             throw new GroupBudgetExtensionIneligibleError('Workflow has no durable gate definition to extend');
         const group = childOrchestrationGroupStream(parent.orchestrationGroupId, exhausted.watchId);
         await this.claims.grantBudget(group, exhausted.requestId, context, authority);
-        await this.waitForSignal(parent.workflowInstanceId, parent.waitingFor, context);
+        await this.waitForSignal(parent.workflowInstanceId, { ...parent.waitingFor, suppressWatchDispatch: true }, context);
         return this.requestChild({
             ...exhausted,
             workflowName,

package/dist/src/orchestration/application/watch-reactor.js

@@ -11,6 +11,8 @@ const reconciliationCheckpoint = 'reconciler:orchestration.watch';
 const noWatchEventTypes = () => [];
 export function createWatchReactor(orchestration, watchEventTypes = noWatchEventTypes, runs) {
     const react = async (event, context) => {
+        if (suppressesWatchDispatch(event))
+            return;
         await dispatch(orchestration, runs, event, context, await orchestration.listWatchMatches(event, context));
     };
     return {
@@ -45,6 +47,10 @@ export function createWatchReconciler(orchestration, journal, checkpoints, runs)
             ]));
             let reconciled = 0;
             for (const event of events) {
+                if (suppressesWatchDispatch(event)) {
+                    await checkpoints.save(reconciliationCheckpoint, event.globalPosition);
+                    continue;
+                }
                 const context = reactorCommandContext(event, ApprovalAuthorityKind.Watch, 'watch-reactor');
                 const matches = (await Promise.all((await orchestration.listWatchMatches(event, context)).map(async (match) => {
                     const watches = waiting.get(match.parent.workflowInstanceId);
@@ -63,6 +69,11 @@ export function createWatchReconciler(orchestration, journal, checkpoints, runs)
         },
     };
 }
+function suppressesWatchDispatch(event) {
+    const owned = selectOrchestrationEvent(event);
+    return (owned?.event.eventType === OrchestrationEventType.SignalWaitStarted &&
+        owned.event.payload.suppressWatchDispatch === true);
+}
 async function dispatch(orchestration, runs, event, context, matches) {
     const causalCycle = orchestrationCausalCycleId(selectOrchestrationEvent(event));
     const sourceWorkflowInstanceId = await resolveTriggerWorkflowInstanceId(event, runs);

package/dist/src/orchestration/contracts/event-decoder.d.ts

@@ -71,6 +71,7 @@ export declare const activityRequestedSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const expectationSchema: z.ZodObject<{
     signalKind: z.ZodPipe<z.ZodString, z.ZodTransform<import("./identifiers.js").SignalName, string>>;
+    suppressWatchDispatch: z.ZodOptional<z.ZodLiteral<true>>;
     resourceId: z.ZodOptional<z.ZodString>;
     revision: z.ZodOptional<z.ZodString>;
     from: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{

package/dist/src/orchestration/contracts/event-decoder.js

@@ -121,6 +121,7 @@ const resourceTransitionSchema = z
 export const expectationSchema = z
     .object({
     signalKind: brandedStringSchema(signalName),
+    suppressWatchDispatch: z.literal(true).optional(),
     resourceId: z.string().optional(),
     revision: z.string().optional(),
     from: z.array(approvalAuthoritySchema).min(1).optional(),

package/dist/src/orchestration/contracts/events.d.ts

@@ -187,6 +187,8 @@ export interface ActivityRequestedPayload {
 }
 export interface SignalExpectation {
     readonly signalKind: SignalName;
+    /** Re-arm a blocked gate without treating its wait event as a new watch trigger. */
+    readonly suppressWatchDispatch?: true | undefined;
     readonly resourceId?: string | undefined;
     readonly revision?: string | undefined;
     readonly from?: readonly ApprovalAuthority[] | undefined;

package/dist/src/orchestration/contracts/views.d.ts

@@ -17,6 +17,7 @@ export interface ActivityActivationView {
 }
 export interface SignalExpectationView {
     readonly signalKind: SignalName;
+    readonly suppressWatchDispatch?: true;
     readonly intentEventId?: string;
     readonly resourceId?: string;
     readonly revision?: string;

package/dist/src/orchestration/domain/workflow-instance-events.js

@@ -177,6 +177,7 @@ function applySignalWaitStarted(state, event) {
     state.status = orchestrationStatusTransitions[OrchestrationEventType.SignalWaitStarted];
     state.waitingFor = {
         signalKind: event.payload.signalKind,
+        ...(event.payload.suppressWatchDispatch === true ? { suppressWatchDispatch: true } : {}),
         ...(event.payload.resourceId === undefined ? {} : { resourceId: event.payload.resourceId }),
         ...(event.payload.revision === undefined ? {} : { revision: event.payload.revision }),
         ...(event.payload.from === undefined ? {} : { from: event.payload.from }),

package/dist/src/surfaces/api/http-server.d.ts

@@ -24,6 +24,7 @@ export interface SurfaceHttpServerOptions {
         readonly disabled: boolean;
         readonly redeemGrant: (grant: string) => Promise<boolean>;
     };
+    readonly webhookReceiver?: (body: Buffer, headers: Readonly<Record<string, string | string[] | undefined>>) => Promise<number>;
 }
 /**
  * The production HTTP surface. Public login routes are declared separately;

package/dist/src/surfaces/api/http-server.js

@@ -41,6 +41,17 @@ export function createSurfaceHttpServer(options) {
             return sendFastifyJson(reply, errorResult(new MalformedJsonError()), false);
         return sendFastifyJson(reply, errorResult(error), false);
     });
+    if (options.webhookReceiver !== undefined) {
+        app.register((webhooks, _pluginOptions, done) => {
+            webhooks.removeAllContentTypeParsers();
+            webhooks.addContentTypeParser('*', { parseAs: 'buffer' }, (_request, body, callback) => callback(null, body));
+            webhooks.post('/github', { bodyLimit: 64 * 1024 }, async (request, reply) => {
+                const status = await options.webhookReceiver(request.body, request.headers);
+                return reply.code(status).send();
+            });
+            done();
+        }, { prefix: '/webhooks' });
+    }
     app.get('/api/v1/auth/session', async (request, reply) => {
         if (authDisabled)
             return { authenticated: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atolis-hq/wake",
-  "version": "0.4.36",
+  "version": "0.4.38",
   "description": "Local autonomous agent control plane for software development",
   "license": "Apache-2.0",
   "repository": {