@autoclawd/autoclawd 1.0.0

package/dist/index.js

@@ -0,0 +1,2786 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/config.ts
+import { z } from "zod";
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import yaml from "js-yaml";
+var AgentConfigSchema = z.object({
+  model: z.string().default("claude-sonnet-4-6"),
+  maxIterations: z.number().min(1).max(50).default(10),
+  timeout: z.number().optional()
+});
+var DockerConfigSchema = z.object({
+  image: z.string().default("node:20"),
+  memory: z.string().default("4g"),
+  cpus: z.number().optional(),
+  setup: z.array(z.string()).optional(),
+  // Shell commands to run before Claude Code
+  volumes: z.array(z.string()).optional(),
+  // Extra bind mounts, e.g. ["~/.ssh:/home/autoclawd/.ssh:ro"]
+  network: z.enum(["bridge", "host", "none"]).default("bridge")
+  // Container network mode
+});
+var LinearConfigSchema = z.object({
+  apiKey: z.string(),
+  teamId: z.string(),
+  statuses: z.array(z.string()).default(["Todo"]),
+  assignToMe: z.boolean().default(true),
+  doneStatus: z.string().default("Done"),
+  inProgressStatus: z.string().default("In Progress")
+});
+var GitHubConfigSchema = z.object({
+  token: z.string()
+});
+var WebhookConfigSchema = z.object({
+  port: z.number().default(3e3),
+  url: z.string().optional(),
+  signingSecret: z.string().optional(),
+  webhookId: z.string().optional()
+});
+var SafetyConfigSchema = z.object({
+  allowedRepos: z.array(z.string()).optional(),
+  branchPrefix: z.string().default("autoclawd/"),
+  maxFileChanges: z.number().min(1).optional()
+});
+var ConfigSchema = z.object({
+  linear: LinearConfigSchema,
+  github: GitHubConfigSchema,
+  docker: DockerConfigSchema.default({}),
+  agent: AgentConfigSchema.default({}),
+  webhook: WebhookConfigSchema.default({}),
+  safety: SafetyConfigSchema.default({}),
+  maxConcurrent: z.number().default(1),
+  validate: z.array(z.string()).optional()
+  // Global default validation commands
+});
+var RepoLocalConfigSchema = z.object({
+  prompt: z.string().optional(),
+  base: z.string().default("main"),
+  agent: AgentConfigSchema.partial().optional(),
+  docker: DockerConfigSchema.partial().optional(),
+  validate: z.array(z.string()).optional()
+  // Validation commands to run before PR
+});
+function resolveEnvVars(obj) {
+  if (typeof obj === "string") {
+    if (obj.startsWith("env:")) {
+      const envName = obj.slice(4);
+      const val = process.env[envName];
+      if (!val) throw new Error(`Environment variable ${envName} is not set`);
+      return val;
+    }
+    return obj;
+  }
+  if (Array.isArray(obj)) return obj.map(resolveEnvVars);
+  if (obj && typeof obj === "object") {
+    return Object.fromEntries(
+      Object.entries(obj).map(([k, v]) => [k, resolveEnvVars(v)])
+    );
+  }
+  return obj;
+}
+var CONFIG_DIR = join(homedir(), ".autoclawd");
+var CONFIG_FILE = join(CONFIG_DIR, "config.yaml");
+function loadConfig(path) {
+  const configPath = path ?? CONFIG_FILE;
+  if (!existsSync(configPath)) {
+    throw new Error(`Config not found: ${configPath}
+Run: autoclawd init`);
+  }
+  const content = readFileSync(configPath, "utf-8");
+  const raw = yaml.load(content);
+  if (!raw || typeof raw !== "object") {
+    throw new Error(`Config file is empty or invalid: ${configPath}`);
+  }
+  const resolved = resolveEnvVars(raw);
+  const result = ConfigSchema.safeParse(resolved);
+  if (!result.success) {
+    const issues = result.error.issues.map(
+      (i) => `  - ${i.path.join(".")}: ${i.message}`
+    ).join("\n");
+    throw new Error(`Invalid config (${configPath}):
+${issues}`);
+  }
+  return result.data;
+}
+function loadRepoLocalConfig(workspacePath) {
+  const yamlPath = join(workspacePath, ".autoclawd.yaml");
+  const ymlPath = join(workspacePath, ".autoclawd.yml");
+  const configPath = existsSync(yamlPath) ? yamlPath : existsSync(ymlPath) ? ymlPath : void 0;
+  if (!configPath) return void 0;
+  const raw = yaml.load(readFileSync(configPath, "utf-8"));
+  if (!raw || typeof raw !== "object") return void 0;
+  return RepoLocalConfigSchema.parse(raw);
+}
+function mergeConfigs(host, local) {
+  const agent = AgentConfigSchema.parse({
+    ...host.agent,
+    ...local?.agent
+  });
+  const docker2 = DockerConfigSchema.parse({
+    ...host.docker,
+    ...local?.docker
+  });
+  const validate = local?.validate ?? host.validate;
+  return { agent, docker: docker2, prompt: local?.prompt, validate };
+}
+function parseRepoFromLabels(labels) {
+  for (const label of labels) {
+    const match = label.match(/^repo:(.+)/i);
+    if (match) {
+      const value = match[1].trim();
+      if (value.startsWith("https://")) return value;
+      if (value.includes("/")) return `https://github.com/${value}`;
+    }
+  }
+  return void 0;
+}
+function parseBaseFromLabels(labels) {
+  for (const label of labels) {
+    const match = label.match(/^base:(.+)/i);
+    if (match) {
+      return match[1].trim();
+    }
+  }
+  return void 0;
+}
+function isRepoAllowed(repoUrl, allowedRepos) {
+  if (!allowedRepos) return true;
+  return allowedRepos.some((allowed) => {
+    const normalizedAllowed = allowed.includes("/") ? allowed.startsWith("https://") ? allowed : `https://github.com/${allowed}` : allowed;
+    return repoUrl.toLowerCase() === normalizedAllowed.toLowerCase();
+  });
+}
+
+// src/linear.ts
+import { LinearClient } from "@linear/sdk";
+
+// src/logger.ts
+import chalk from "chalk";
+import { appendFileSync, mkdirSync, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+var currentLevel = "info";
+var logFilePath;
+var levels = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+function setLogLevel(level) {
+  currentLevel = level;
+}
+function enableFileLogging() {
+  const logDir = join2(homedir2(), ".autoclawd", "logs");
+  if (!existsSync2(logDir)) {
+    mkdirSync(logDir, { recursive: true });
+  }
+  const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  logFilePath = join2(logDir, `autoclawd-${date}.log`);
+}
+function shouldLog(level) {
+  return levels[level] >= levels[currentLevel];
+}
+function timestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(11, 19);
+}
+function fullTimestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function writeToFile(level, msg) {
+  if (!logFilePath) return;
+  try {
+    appendFileSync(logFilePath, `${fullTimestamp()} [${level.padEnd(5)}] ${msg}
+`);
+  } catch {
+  }
+}
+var log = {
+  debug(msg, ...args) {
+    writeToFile("DEBUG", msg);
+    if (shouldLog("debug")) console.log(chalk.gray(`[${timestamp()}] ${msg}`), ...args);
+  },
+  info(msg, ...args) {
+    writeToFile("INFO", msg);
+    if (shouldLog("info")) console.log(chalk.blue(`[${timestamp()}]`), msg, ...args);
+  },
+  warn(msg, ...args) {
+    writeToFile("WARN", msg);
+    if (shouldLog("warn")) console.log(chalk.yellow(`[${timestamp()}] WARN`), msg, ...args);
+  },
+  error(msg, ...args) {
+    writeToFile("ERROR", msg);
+    if (shouldLog("error")) console.log(chalk.red(`[${timestamp()}] ERROR`), msg, ...args);
+  },
+  success(msg, ...args) {
+    writeToFile("INFO", `\u2713 ${msg}`);
+    if (shouldLog("info")) console.log(chalk.green(`[${timestamp()}] \u2713`), msg, ...args);
+  },
+  ticket(id, msg, ...args) {
+    writeToFile("INFO", `[${id}] ${msg}`);
+    if (shouldLog("info")) console.log(chalk.cyan(`[${timestamp()}] [${id}]`), msg, ...args);
+  }
+};
+
+// src/retry.ts
+async function retry(fn, opts) {
+  const attempts = opts.attempts ?? 3;
+  const baseDelay = opts.baseDelayMs ?? 1e3;
+  let lastErr;
+  for (let i = 1; i <= attempts; i++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (opts.retryIf && !opts.retryIf(err)) {
+        throw err;
+      }
+      if (i < attempts) {
+        const delay = baseDelay * Math.pow(2, i - 1);
+        const msg = err instanceof Error ? err.message.split("\n")[0] : String(err);
+        log.warn(`${opts.label} failed (attempt ${i}/${attempts}): ${msg} \u2014 retrying in ${delay}ms`);
+        await sleep(delay);
+      }
+    }
+  }
+  throw lastErr;
+}
+function retrySync(fn, opts) {
+  return retry(() => Promise.resolve(fn()), opts);
+}
+function isTransientError(err) {
+  if (!(err instanceof Error)) return false;
+  const msg = err.message.toLowerCase();
+  return msg.includes("econnreset") || msg.includes("econnrefused") || msg.includes("etimedout") || msg.includes("eai_again") || msg.includes("epipe") || msg.includes("socket hang up") || msg.includes("network") || msg.includes("timeout") || msg.includes("502") || msg.includes("503") || msg.includes("504") || msg.includes("rate limit") || msg.includes("429") || msg.includes("500") || msg.includes("internal server error");
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/linear.ts
+function createLinearClient(config) {
+  return new LinearClient({ apiKey: config.linear.apiKey });
+}
+async function pollTickets(client, config) {
+  const team = await client.team(config.linear.teamId);
+  const issues = await team.issues({
+    filter: {
+      state: { name: { in: config.linear.statuses } },
+      assignee: config.linear.assignToMe ? { isMe: { eq: true } } : void 0
+    },
+    first: 50
+  });
+  const tickets = [];
+  for (const issue of issues.nodes) {
+    const labels = await issue.labels();
+    const labelNames = labels.nodes.map((l) => l.name);
+    const repoUrl = parseRepoFromLabels(labelNames);
+    const baseBranch = parseBaseFromLabels(labelNames);
+    tickets.push({
+      id: issue.id,
+      identifier: issue.identifier,
+      title: issue.title,
+      description: issue.description ?? "",
+      labels: labelNames,
+      repoUrl,
+      baseBranch,
+      url: issue.url
+    });
+  }
+  return tickets;
+}
+async function fetchTicket(client, identifier) {
+  const match = identifier.match(/^([A-Za-z]+)-(\d+)$/);
+  if (!match) return void 0;
+  const [, teamKey, numStr] = match;
+  const normalizedKey = teamKey.toUpperCase();
+  const team = await client.team(normalizedKey);
+  const result = await team.issues({
+    filter: { number: { eq: parseInt(numStr) } },
+    first: 1
+  });
+  const issue = result.nodes[0];
+  if (!issue) return void 0;
+  const labels = await issue.labels();
+  const labelNames = labels.nodes.map((l) => l.name);
+  const repoUrl = parseRepoFromLabels(labelNames);
+  const baseBranch = parseBaseFromLabels(labelNames);
+  return {
+    id: issue.id,
+    identifier: issue.identifier,
+    title: issue.title,
+    description: issue.description ?? "",
+    labels: labelNames,
+    repoUrl,
+    baseBranch,
+    url: issue.url
+  };
+}
+async function claimTicket(client, config, ticketId) {
+  log.info(`Claiming ticket, moving to "${config.linear.inProgressStatus}"`);
+  await retry(async () => {
+    const team = await client.team(config.linear.teamId);
+    const states = await team.states();
+    const target = config.linear.inProgressStatus.toLowerCase();
+    const inProgress = states.nodes.find((s) => s.name.toLowerCase() === target);
+    if (!inProgress) {
+      log.warn(`State "${config.linear.inProgressStatus}" not found, skipping status update`);
+      return;
+    }
+    await client.updateIssue(ticketId, { stateId: inProgress.id });
+  }, { label: "Linear claim", retryIf: isTransientError });
+}
+async function completeTicket(client, config, ticketId, comment) {
+  await retry(async () => {
+    await client.createComment({ issueId: ticketId, body: comment });
+    const team = await client.team(config.linear.teamId);
+    const states = await team.states();
+    const doneTarget = config.linear.doneStatus.toLowerCase();
+    const done = states.nodes.find((s) => s.name.toLowerCase() === doneTarget);
+    if (done) {
+      await client.updateIssue(ticketId, { stateId: done.id });
+    }
+  }, { label: "Linear complete", retryIf: isTransientError });
+}
+async function addBranchLabel(client, ticketId, branchName) {
+  try {
+    const issue = await client.issue(ticketId);
+    const team = await issue.team;
+    if (!team) return;
+    const teamLabels = await team.labels();
+    const labelName = `base:${branchName}`;
+    let labelId = teamLabels.nodes.find((l) => l.name === labelName)?.id;
+    if (!labelId) {
+      const result = await client.createIssueLabel({
+        name: labelName,
+        teamId: team.id
+      });
+      const label = await result.issueLabel;
+      labelId = label?.id;
+    }
+    if (labelId) {
+      const currentLabels = await issue.labels();
+      const labelIds = currentLabels.nodes.map((l) => l.id);
+      if (!labelIds.includes(labelId)) {
+        await client.updateIssue(ticketId, {
+          labelIds: [...labelIds, labelId]
+        });
+        log.info(`Added "base:${branchName}" label to ticket for stacked diffs`);
+      }
+    }
+  } catch (err) {
+    log.debug(`Could not add branch label: ${err instanceof Error ? err.message : err}`);
+  }
+}
+async function failTicket(client, ticketId, reason) {
+  await client.createComment({
+    issueId: ticketId,
+    body: `**autoclawd failed:**
+
+${reason}`
+  });
+}
+
+// src/github.ts
+import { Octokit } from "@octokit/rest";
+function createOctokit(config) {
+  return new Octokit({ auth: config.github.token });
+}
+function parseRepoUrl(url) {
+  const match = url.match(/github\.com[/:]([^/]+)\/([^/.]+)/);
+  if (!match) throw new Error(`Cannot parse GitHub URL: ${url}`);
+  return { owner: match[1], repo: match[2] };
+}
+async function openPR(octokit, opts) {
+  return retry(async () => {
+    const { owner, repo } = parseRepoUrl(opts.repoUrl);
+    const existing = await octokit.rest.pulls.list({
+      owner,
+      repo,
+      head: `${owner}:${opts.branch}`,
+      state: "open"
+    });
+    if (existing.data.length > 0) {
+      const pr2 = existing.data[0];
+      log.info(`Updating existing PR #${pr2.number}: ${pr2.html_url}`);
+      await octokit.rest.pulls.update({
+        owner,
+        repo,
+        pull_number: pr2.number,
+        body: opts.body
+      });
+      return { url: pr2.html_url, number: pr2.number };
+    }
+    const pr = await octokit.rest.pulls.create({
+      owner,
+      repo,
+      title: opts.title,
+      body: opts.body,
+      head: opts.branch,
+      base: opts.baseBranch,
+      draft: opts.draft ?? false
+    });
+    log.success(`Created ${opts.draft ? "draft " : ""}PR #${pr.data.number}: ${pr.data.html_url}`);
+    return { url: pr.data.html_url, number: pr.data.number };
+  }, { label: "GitHub PR", retryIf: isTransientError });
+}
+async function markPRReady(octokit, opts) {
+  return retry(async () => {
+    const { owner, repo } = parseRepoUrl(opts.repoUrl);
+    await octokit.rest.pulls.update({
+      owner,
+      repo,
+      pull_number: opts.prNumber,
+      draft: false
+    });
+    log.info(`Marked PR #${opts.prNumber} as ready for review`);
+  }, { label: "GitHub PR ready", retryIf: isTransientError });
+}
+async function updatePRBody(octokit, opts) {
+  return retry(async () => {
+    const { owner, repo } = parseRepoUrl(opts.repoUrl);
+    await octokit.rest.pulls.update({
+      owner,
+      repo,
+      pull_number: opts.prNumber,
+      body: opts.body
+    });
+  }, { label: "GitHub PR update", retryIf: isTransientError });
+}
+async function fetchPR(octokit, opts) {
+  const { owner, repo } = parseRepoUrl(opts.repoUrl);
+  const { data } = await octokit.rest.pulls.get({ owner, repo, pull_number: opts.prNumber });
+  return {
+    head: data.head.ref,
+    base: data.base.ref,
+    title: data.title,
+    state: data.state
+  };
+}
+async function fetchFailedChecks(octokit, opts) {
+  const { owner, repo } = parseRepoUrl(opts.repoUrl);
+  const { data: pr } = await octokit.rest.pulls.get({ owner, repo, pull_number: opts.prNumber });
+  const headSha = pr.head.sha;
+  const { data: checks } = await octokit.rest.checks.listForRef({
+    owner,
+    repo,
+    ref: headSha
+  });
+  const failed = checks.check_runs.filter(
+    (c) => c.conclusion === "failure" || c.conclusion === "timed_out"
+  );
+  if (failed.length === 0) return [];
+  const results = [];
+  for (const check of failed) {
+    let logText = "";
+    if (check.app?.slug === "github-actions") {
+      try {
+        const { data: runs } = await octokit.rest.actions.listWorkflowRunsForRepo({
+          owner,
+          repo,
+          head_sha: headSha,
+          per_page: 10
+        });
+        for (const run of runs.workflow_runs) {
+          if (run.conclusion !== "failure") continue;
+          const { data: jobs } = await octokit.rest.actions.listJobsForWorkflowRun({
+            owner,
+            repo,
+            run_id: run.id
+          });
+          for (const job of jobs.jobs) {
+            if (job.conclusion !== "failure") continue;
+            try {
+              const { data: log2 } = await octokit.rest.actions.downloadJobLogsForWorkflowRun({
+                owner,
+                repo,
+                job_id: job.id
+              });
+              const logStr = typeof log2 === "string" ? log2 : String(log2);
+              logText += `
+--- Job: ${job.name} ---
+` + logStr.slice(-3e3);
+            } catch {
+            }
+          }
+        }
+      } catch {
+      }
+    }
+    if (!logText && check.output?.text) {
+      logText = check.output.text.slice(-3e3);
+    }
+    if (!logText && check.output?.summary) {
+      logText = check.output.summary.slice(-3e3);
+    }
+    results.push({
+      name: check.name,
+      conclusion: check.conclusion ?? "failure",
+      log: logText || "(no log available)"
+    });
+  }
+  return results;
+}
+
+// src/webhook.ts
+import { createServer } from "http";
+import { createHmac, timingSafeEqual } from "crypto";
+
+// src/docker.ts
+import Docker from "dockerode";
+import { PassThrough } from "stream";
+import { homedir as homedir3, tmpdir } from "os";
+import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync, mkdtempSync, rmSync } from "fs";
+import { execSync } from "child_process";
+var docker = new Docker();
+async function checkDockerAvailable() {
+  try {
+    await docker.ping();
+  } catch (err) {
+    throw new Error(
+      "Cannot connect to Docker daemon. Is Docker running?\nInstall: https://docs.docker.com/get-docker/"
+    );
+  }
+}
+var AUTOCODE_BASE_DOCKERFILE = `FROM node:20-bookworm
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \\
+    build-essential git curl wget ca-certificates openssh-client jq unzip \\
+    python3 python3-pip python3-venv python3-dev \\
+    ruby ruby-dev \\
+    && rm -rf /var/lib/apt/lists/*
+ARG GO_VERSION=1.22.2
+RUN curl -fsSL "https://go.dev/dl/go\${GO_VERSION}.linux-$(dpkg --print-architecture).tar.gz" \\
+    | tar -xz -C /usr/local
+ENV PATH="/usr/local/go/bin:\${PATH}"
+RUN npm install -g @anthropic-ai/claude-code@latest
+WORKDIR /workspace
+`;
+async function ensureImage(image) {
+  try {
+    await docker.getImage(image).inspect();
+    log.debug(`Image ${image} found locally`);
+    return;
+  } catch {
+  }
+  if (image === "autoclawd-base") {
+    log.info("Building autoclawd-base image (first time only, takes a few minutes)...");
+    const buildDir = mkdtempSync(join3(tmpdir(), "autoclawd-build-"));
+    try {
+      writeFileSync(join3(buildDir, "Dockerfile"), AUTOCODE_BASE_DOCKERFILE);
+      execSync(`docker build -t autoclawd-base ${buildDir}`, {
+        stdio: "inherit",
+        timeout: 6e5
+      });
+      log.success("autoclawd-base image built");
+      return;
+    } catch (err) {
+      throw new Error(
+        `Failed to build autoclawd-base image.
+You can build manually: docker build -t autoclawd-base .
+Or use a different image in your config (e.g. node:20).
+Error: ${err instanceof Error ? err.message : err}`
+      );
+    } finally {
+      rmSync(buildDir, { recursive: true, force: true });
+    }
+  }
+  log.info(`Pulling image ${image} (this may take a moment)...`);
+  await retry(() => new Promise((resolve, reject) => {
+    docker.pull(image, (err, stream) => {
+      if (err) {
+        if (err.message?.includes("not found") || err.message?.includes("404")) {
+          return reject(new Error(`Docker image "${image}" not found. Check the image name in your config.`));
+        }
+        return reject(err);
+      }
+      docker.modem.followProgress(stream, (err2) => {
+        if (err2) reject(err2);
+        else {
+          log.success(`Image ${image} pulled`);
+          resolve();
+        }
+      });
+    });
+  }), { label: "docker pull", retryIf: isTransientError });
+}
+async function createContainer(opts) {
+  const { dockerConfig, name } = opts;
+  await ensureImage(dockerConfig.image);
+  const binds = [`${opts.workspacePath}:/workspace`];
+  if (dockerConfig.volumes?.length) {
+    for (const vol of dockerConfig.volumes) {
+      binds.push(vol.replace(/^~(?=\/|:)/, homedir3()));
+    }
+  }
+  const container = await docker.createContainer({
+    Image: dockerConfig.image,
+    name: `autoclawd-${name}`,
+    Cmd: ["sleep", "infinity"],
+    WorkingDir: "/workspace",
+    User: "root",
+    HostConfig: {
+      Binds: binds,
+      Memory: parseMemory(dockerConfig.memory),
+      NanoCpus: dockerConfig.cpus ? dockerConfig.cpus * 1e9 : void 0,
+      NetworkMode: dockerConfig.network ?? "bridge"
+    },
+    Env: ["HOME=/root"]
+  });
+  await container.start();
+  log.info(`Container ${name} started (${container.id.slice(0, 12)})`);
+  const wrapped = { id: container.id, instance: container };
+  const shellCheck = await exec(wrapped, ["sh", "-c", "echo ok"]);
+  if (shellCheck.exitCode !== 0 || !shellCheck.stdout.includes("ok")) {
+    await destroyContainer(wrapped);
+    throw new Error(
+      `Docker image "${dockerConfig.image}" has no working shell (sh).
+autoclawd requires a shell to set up the container. Use a standard base image
+(e.g. node:20, python:3.12, ubuntu:24.04) or ensure /bin/sh is available.`
+    );
+  }
+  const curlCheck = await exec(wrapped, ["which", "curl"]);
+  if (curlCheck.exitCode !== 0) {
+    log.debug("curl not found, installing...");
+    await exec(wrapped, [
+      "sh",
+      "-c",
+      "(apt-get update -qq && apt-get install -y -qq curl 2>/dev/null) || (apk add --no-cache curl 2>/dev/null) || (yum install -y curl 2>/dev/null) || true"
+    ]);
+  }
+  const gitCheck = await exec(wrapped, ["git", "--version"]);
+  if (gitCheck.exitCode !== 0) {
+    log.info("Git not found in image, installing...");
+    const installGit = await exec(wrapped, [
+      "sh",
+      "-c",
+      '(apt-get update -qq && apt-get install -y -qq git 2>/dev/null) || (apk add --no-cache git 2>/dev/null) || (yum install -y git 2>/dev/null) || (echo "Cannot install git" && exit 1)'
+    ]);
+    if (installGit.exitCode !== 0) {
+      throw new Error(`Docker image "${dockerConfig.image}" has no git and autoclawd could not install it. Use an image with git pre-installed.`);
+    }
+  }
+  const claudeCheck = await exec(wrapped, ["which", "claude"]);
+  if (claudeCheck.exitCode !== 0) {
+    log.info("Installing Claude Code in container...");
+    const npmCheck = await exec(wrapped, ["which", "npm"]);
+    let installed = false;
+    if (npmCheck.exitCode === 0) {
+      const npmResult = await exec(wrapped, [
+        "npm",
+        "install",
+        "-g",
+        "@anthropic-ai/claude-code@latest"
+      ]);
+      installed = npmResult.exitCode === 0;
+    }
+    if (!installed) {
+      log.info("npm not available, installing Claude Code standalone binary...");
+      const standaloneResult = await exec(wrapped, [
+        "bash",
+        "-c",
+        "curl -fsSL https://claude.ai/install.sh | bash && cp -L /root/.local/bin/claude /usr/local/bin/claude && chmod 755 /usr/local/bin/claude"
+      ], { timeout: 12e4 });
+      if (standaloneResult.exitCode !== 0) {
+        throw new Error(
+          `Failed to install Claude Code. Tried npm and standalone installer.
+Error: ${standaloneResult.stderr}
+Use an image with Claude Code pre-installed, or ensure bash and curl are available.`
+        );
+      }
+    }
+    log.info("Claude Code installed");
+  } else {
+    log.debug("Claude Code already installed in image");
+  }
+  await exec(wrapped, [
+    "sh",
+    "-c",
+    '( getent passwd autoclawd >/dev/null 2>&1 ) || ( adduser --disabled-password --gecos "" --uid 1001 --home /home/autoclawd autoclawd 2>/dev/null ) || ( adduser -D -u 1001 -h /home/autoclawd autoclawd 2>/dev/null ) || ( useradd -m -u 1001 -d /home/autoclawd autoclawd 2>/dev/null ) || ( echo "autoclawd:x:1001:1001::/home/autoclawd:/bin/sh" >> /etc/passwd && mkdir -p /home/autoclawd ); mkdir -p /home/autoclawd && chown -R autoclawd /home/autoclawd /workspace'
+  ]);
+  await autoInstallRuntimes(wrapped);
+  if (dockerConfig.setup?.length) {
+    log.info(`Running ${dockerConfig.setup.length} setup command(s)...`);
+    for (const cmd of dockerConfig.setup) {
+      const result = await exec(wrapped, ["sh", "-c", cmd]);
+      if (result.exitCode !== 0) {
+        throw new Error(`Setup command failed: ${cmd}
+${result.stderr}`);
+      }
+    }
+  }
+  await copyClaudeCredentials(wrapped);
+  return wrapped;
+}
+async function autoInstallRuntimes(container) {
+  const detect = await exec(container, [
+    "sh",
+    "-c",
+    "ls /workspace/package.json /workspace/pyproject.toml /workspace/setup.py /workspace/requirements.txt /workspace/Pipfile /workspace/go.mod /workspace/Cargo.toml /workspace/Gemfile /workspace/pom.xml /workspace/build.gradle /workspace/build.gradle.kts /workspace/composer.json /workspace/mix.exs 2>/dev/null || true"
+  ]);
+  const files = detect.stdout.trim().split("\n").filter(Boolean);
+  if (files.length === 0) return;
+  const needs = [];
+  const checks = await exec(container, [
+    "sh",
+    "-c",
+    'echo "node:$(which node 2>/dev/null || echo missing)";echo "python:$(which python3 2>/dev/null || which python 2>/dev/null || echo missing)";echo "go:$(which go 2>/dev/null || echo missing)";echo "ruby:$(which ruby 2>/dev/null || echo missing)";'
+  ]);
+  const installed = /* @__PURE__ */ new Map();
+  for (const line of checks.stdout.trim().split("\n")) {
+    const [lang, path] = line.split(":");
+    installed.set(lang, path !== "missing");
+  }
+  const hasPython = files.some(
+    (f) => f.includes("pyproject.toml") || f.includes("setup.py") || f.includes("requirements.txt") || f.includes("Pipfile")
+  );
+  const hasGo = files.some((f) => f.includes("go.mod"));
+  const hasRuby = files.some((f) => f.includes("Gemfile"));
+  if (hasPython && !installed.get("python")) {
+    needs.push("python3 python3-pip python3-venv");
+  }
+  if (hasGo && !installed.get("go")) {
+    needs.push("golang");
+  }
+  if (hasRuby && !installed.get("ruby")) {
+    needs.push("ruby ruby-dev");
+  }
+  if (needs.length === 0) return;
+  const packages = needs.join(" ");
+  log.info(`Detected stack requires: ${packages}`);
+  const installResult = await exec(container, [
+    "sh",
+    "-c",
+    `(apt-get update -qq && apt-get install -y -qq ${packages} 2>/dev/null) || (apk add --no-cache ${packages.replace("python3-pip", "py3-pip").replace("python3-venv", "").replace("ruby-dev", "ruby-dev build-base")} 2>/dev/null) || echo "Warning: could not auto-install ${packages}"`
+  ]);
+  if (installResult.exitCode === 0) {
+    log.success("Runtime dependencies installed");
+  } else {
+    log.warn(`Could not auto-install ${packages} \u2014 Claude may not be able to run tests for this stack`);
+  }
+}
+async function copyClaudeCredentials(container) {
+  const home = homedir3();
+  await exec(container, [
+    "sh",
+    "-c",
+    "mkdir -p /home/autoclawd/.claude && chown autoclawd /home/autoclawd/.claude"
+  ]);
+  const credFile = join3(home, ".claude", ".credentials.json");
+  if (existsSync3(credFile)) {
+    const content = readFileSync2(credFile, "utf-8");
+    const b64 = Buffer.from(content).toString("base64");
+    await exec(container, [
+      "sh",
+      "-c",
+      `echo '${b64}' | base64 -d > /home/autoclawd/.claude/.credentials.json && chown autoclawd /home/autoclawd/.claude/.credentials.json`
+    ]);
+    log.debug("Copied .credentials.json");
+  }
+  const settingsFile = join3(home, ".claude", "settings.json");
+  if (existsSync3(settingsFile)) {
+    const content = readFileSync2(settingsFile, "utf-8");
+    const b64 = Buffer.from(content).toString("base64");
+    await exec(container, [
+      "sh",
+      "-c",
+      `echo '${b64}' | base64 -d > /home/autoclawd/.claude/settings.json && chown autoclawd /home/autoclawd/.claude/settings.json`
+    ]);
+  }
+  log.info("Claude credentials copied into container");
+}
+async function exec(container, cmd, opts) {
+  const execution = await container.instance.exec({
+    Cmd: cmd,
+    AttachStdout: true,
+    AttachStderr: true,
+    WorkingDir: opts?.workdir ?? "/workspace",
+    Env: opts?.env,
+    User: opts?.user
+  });
+  const stream = await execution.start({ hijack: true, stdin: false });
+  let stdout = "";
+  let stderr = "";
+  return new Promise((resolve, reject) => {
+    const stdoutStream = new PassThrough();
+    const stderrStream = new PassThrough();
+    docker.modem.demuxStream(stream, stdoutStream, stderrStream);
+    stdoutStream.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    stderrStream.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    let timer;
+    if (opts?.timeout) {
+      timer = setTimeout(() => {
+        stream.destroy();
+        resolve({ exitCode: 124, stdout, stderr: stderr + "\n[autoclawd] exec timed out" });
+      }, opts.timeout);
+    }
+    stream.on("end", async () => {
+      if (timer) clearTimeout(timer);
+      try {
+        const info = await execution.inspect();
+        resolve({ exitCode: info.ExitCode ?? 1, stdout, stderr });
+      } catch (e) {
+        reject(e);
+      }
+    });
+    stream.on("error", (e) => {
+      if (timer) clearTimeout(timer);
+      reject(e);
+    });
+  });
+}
+async function cleanupOrphanedContainers() {
+  const containers = await docker.listContainers({ all: true });
+  const orphans = containers.filter(
+    (c) => c.Names.some((n) => n.startsWith("/autoclawd-"))
+  );
+  let cleaned = 0;
+  for (const c of orphans) {
+    try {
+      const container = docker.getContainer(c.Id);
+      if (c.State === "running") {
+        await container.stop({ t: 5 });
+      }
+      await container.remove({ force: true });
+      log.info(`Cleaned up orphaned container ${c.Names[0]} (${c.Id.slice(0, 12)})`);
+      cleaned++;
+    } catch {
+    }
+  }
+  return cleaned;
+}
+async function destroyContainer(container) {
+  try {
+    await container.instance.stop({ t: 5 });
+  } catch {
+  }
+  try {
+    await container.instance.remove({ force: true });
+  } catch {
+  }
+  log.info(`Container ${container.id.slice(0, 12)} destroyed`);
+}
+function parseMemory(mem) {
+  const match = mem.match(/^(\d+(?:\.\d+)?)(k|m|g|t)$/i);
+  if (!match) throw new Error(`Invalid memory format: "${mem}". Use a number followed by k, m, g, or t (e.g. "4g", "512m")`);
+  const [, num, unit] = match;
+  const value = parseFloat(num);
+  if (value <= 0) throw new Error(`Memory must be greater than 0: "${mem}"`);
+  const multipliers = {
+    k: 1024,
+    m: 1024 * 1024,
+    g: 1024 * 1024 * 1024,
+    t: 1024 * 1024 * 1024 * 1024
+  };
+  return Math.round(value * multipliers[unit.toLowerCase()]);
+}
+
+// src/agent.ts
+var DEFAULT_ITERATION_TIMEOUT_MS = 30 * 60 * 1e3;
+var RATE_LIMIT_PATTERNS = [
+  /rate.?limit/i,
+  /too many requests/i,
+  /\b429\b.*(?:error|too many|rate|limit|retry)/i,
+  /(?:error|status|code|http)[:\s]*429\b/i,
+  /(?:api|server|model)\s+(?:is\s+)?overloaded/i,
+  /over\s*capacity/i
+];
+var COMPLETION_PATTERNS = [
+  /\[autoclawd:done\]/i,
+  /all tasks? completed/i
+];
+function isRateLimited(output) {
+  return RATE_LIMIT_PATTERNS.some((p) => p.test(output));
+}
+function isCompleted(output) {
+  return COMPLETION_PATTERNS.some((p) => p.test(output));
+}
+function estimateResetMs(output) {
+  const match = output.match(/retry.?after[:\s]*(\d+)/i);
+  if (match) return parseInt(match[1]) * 1e3;
+  return 6e4;
+}
+var MAX_RATE_LIMIT_RETRIES = 10;
+async function runAgentLoop(opts) {
+  const { container, agentConfig, prompt, ticketId, onIteration } = opts;
+  let lastOutput = "";
+  let rateLimitRetries = 0;
+  const promptB64 = Buffer.from(prompt).toString("base64");
+  await exec(container, [
+    "sh",
+    "-c",
+    `mkdir -p /tmp/autoclawd && echo '${promptB64}' | base64 -d > /tmp/autoclawd/prompt.md && chmod 644 /tmp/autoclawd/prompt.md`
+  ]);
+  for (let i = 1; i <= agentConfig.maxIterations; i++) {
+    log.ticket(ticketId, `Iteration ${i}/${agentConfig.maxIterations}`);
+    const cmd = [
+      "sh",
+      "-c",
+      [
+        "claude",
+        "-p",
+        '"$(cat /tmp/autoclawd/prompt.md)"',
+        "--model",
+        agentConfig.model,
+        "--output-format",
+        "text",
+        "--max-turns",
+        "50",
+        "--dangerously-skip-permissions",
+        "--verbose"
+      ].join(" ")
+    ];
+    const timeoutMs = agentConfig.timeout ? agentConfig.timeout * 1e3 : DEFAULT_ITERATION_TIMEOUT_MS;
+    const result = await exec(container, cmd, {
+      user: "autoclawd",
+      env: ["HOME=/home/autoclawd", "CLAUDE_CODE_DISABLE_NONINTERACTIVE_TUTORIAL=1"],
+      timeout: timeoutMs
+    });
+    const combined = result.stdout + result.stderr;
+    lastOutput = combined;
+    const snippet = combined.slice(-500).trim();
+    if (snippet) {
+      log.debug(`Agent output (last 500 chars): ${snippet}`);
+    }
+    const rateLimited = isRateLimited(combined);
+    const completed = isCompleted(combined) || result.exitCode === 0 && i > 1;
+    const agentResult = {
+      iteration: i,
+      exitCode: result.exitCode,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      rateLimited,
+      completed
+    };
+    onIteration?.(agentResult);
+    if (completed) {
+      log.ticket(ticketId, `Completed after ${i} iterations`);
+      return { iterations: i, success: true, lastOutput };
+    }
+    if (rateLimited) {
+      rateLimitRetries++;
+      if (rateLimitRetries > MAX_RATE_LIMIT_RETRIES) {
+        log.ticket(ticketId, `Rate limited ${rateLimitRetries} times, giving up`);
+        return { iterations: i, success: false, lastOutput };
+      }
+      const waitMs = estimateResetMs(combined);
+      log.ticket(ticketId, `Rate limited (${rateLimitRetries}/${MAX_RATE_LIMIT_RETRIES}) \u2014 pausing ${Math.round(waitMs / 1e3)}s`);
+      await sleep2(waitMs);
+      i--;
+      continue;
+    }
+    if (result.exitCode !== 0) {
+      log.ticket(ticketId, `Non-zero exit (${result.exitCode}), continuing...`);
+    }
+  }
+  log.ticket(ticketId, `Max iterations (${agentConfig.maxIterations}) reached`);
+  return { iterations: agentConfig.maxIterations, success: false, lastOutput };
+}
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/git.ts
+async function setupRepo(container, opts) {
+  const u = { user: "autoclawd" };
+  await exec(container, ["git", "config", "user.name", "autoclawd"], u);
+  await exec(container, ["git", "config", "user.email", "autoclawd@autoclawd.dev"], u);
+  await exec(container, ["git", "config", "--global", "safe.directory", "/workspace"], u);
+  log.info(`Git configured, on branch ${opts.branchName}`);
+}
+async function commitAndPush(container, opts) {
+  const { branchName, ticketId, title, githubToken, branchPrefix, maxFileChanges } = opts;
+  const u = { user: "autoclawd" };
+  if (branchPrefix && !branchName.startsWith(branchPrefix)) {
+    log.error(`Safety: branch "${branchName}" does not start with required prefix "${branchPrefix}"`);
+    throw new Error(`Branch "${branchName}" does not start with required prefix "${branchPrefix}"`);
+  }
+  log.info(`Safety: branch prefix check passed for "${branchName}"`);
+  const status = await exec(container, ["git", "status", "--porcelain"], u);
+  if (status.stdout.trim()) {
+    await exec(container, ["git", "add", "-A"], u);
+    const message = `${ticketId}: ${title}`;
+    await exec(container, ["git", "commit", "-m", message], u);
+  }
+  const countResult = await exec(container, [
+    "git",
+    "rev-list",
+    "--count",
+    `HEAD`,
+    "--not",
+    "--remotes"
+  ], u);
+  const commitCount = parseInt(countResult.stdout.trim()) || 0;
+  if (commitCount === 0) {
+    log.warn("No commits to push");
+    return { pushed: false, commitCount: 0 };
+  }
+  if (maxFileChanges !== void 0) {
+    const diffResult = await exec(container, [
+      "git",
+      "diff",
+      "--name-only",
+      "HEAD",
+      "--not",
+      "--remotes"
+    ], u);
+    const changedFiles = diffResult.stdout.trim().split("\n").filter(Boolean).length;
+    if (changedFiles > maxFileChanges) {
+      log.error(`Safety: ${changedFiles} files changed, exceeds maxFileChanges limit of ${maxFileChanges}`);
+      throw new Error(`Too many file changes: ${changedFiles} files changed (limit: ${maxFileChanges}). Review changes manually.`);
+    }
+    log.info(`Safety: file change count (${changedFiles}) within limit (${maxFileChanges})`);
+  }
+  await exec(container, [
+    "sh",
+    "-c",
+    `git config credential.helper '!f() { echo "password=${githubToken}"; echo "username=x-access-token"; }; f'`
+  ], u);
+  const pushResult = await exec(container, ["git", "push", "-u", "origin", branchName], u);
+  if (pushResult.exitCode !== 0) {
+    const safeStderr = pushResult.stderr.replace(/x-access-token:[^\s@]+/g, "x-access-token:***");
+    log.error(`Push failed: ${safeStderr}`);
+    return { pushed: false, commitCount };
+  }
+  log.success(`Pushed ${commitCount} commit(s) to ${branchName}`);
+  return { pushed: true, commitCount };
+}
+
+// src/worker.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join5 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { execSync as execSync2 } from "child_process";
+
+// src/db.ts
+import Database from "better-sqlite3";
+import { join as join4 } from "path";
+import { mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
+var DB_PATH = join4(CONFIG_DIR, "autoclawd.db");
+var _db;
+function getDb() {
+  if (_db) return _db;
+  if (!existsSync4(CONFIG_DIR)) {
+    mkdirSync2(CONFIG_DIR, { recursive: true });
+  }
+  _db = new Database(DB_PATH);
+  _db.pragma("journal_mode = WAL");
+  _db.exec(`
+    CREATE TABLE IF NOT EXISTS runs (
+      id TEXT PRIMARY KEY,
+      ticket_id TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'queued',
+      branch TEXT,
+      pr_url TEXT,
+      started_at TEXT NOT NULL DEFAULT (datetime('now')),
+      finished_at TEXT,
+      error TEXT,
+      iterations INTEGER NOT NULL DEFAULT 0,
+      model TEXT,
+      image TEXT,
+      duration_secs INTEGER
+    );
+    CREATE TABLE IF NOT EXISTS queue (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      ticket_id TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `);
+  const cols = _db.prepare("PRAGMA table_info(runs)").all();
+  const colNames = new Set(cols.map((c) => c.name));
+  if (!colNames.has("model")) _db.exec("ALTER TABLE runs ADD COLUMN model TEXT");
+  if (!colNames.has("image")) _db.exec("ALTER TABLE runs ADD COLUMN image TEXT");
+  if (!colNames.has("duration_secs")) _db.exec("ALTER TABLE runs ADD COLUMN duration_secs INTEGER");
+  return _db;
+}
+function closeDb() {
+  _db?.close();
+  _db = void 0;
+}
+function insertRun(ticketId, status = "running") {
+  const db = getDb();
+  db.prepare(
+    "INSERT OR REPLACE INTO runs (id, ticket_id, status, started_at) VALUES (?, ?, ?, datetime('now'))"
+  ).run(ticketId, ticketId, status);
+}
+function updateRun(ticketId, update) {
+  const db = getDb();
+  const sets = [];
+  const values = [];
+  for (const [key, val] of Object.entries(update)) {
+    sets.push(`${key} = ?`);
+    values.push(val);
+  }
+  if (sets.length === 0) return;
+  values.push(ticketId);
+  db.prepare(`UPDATE runs SET ${sets.join(", ")} WHERE id = ?`).run(...values);
+}
+function finishRun(ticketId, status, error) {
+  updateRun(ticketId, { status, finished_at: (/* @__PURE__ */ new Date()).toISOString(), error: error ?? null });
+}
+function getRunByTicketId(ticketId) {
+  const db = getDb();
+  return db.prepare("SELECT * FROM runs WHERE ticket_id = ?").get(ticketId);
+}
+function getActiveRuns() {
+  const db = getDb();
+  return db.prepare("SELECT * FROM runs WHERE status = 'running'").all();
+}
+function isTicketProcessed(ticketId) {
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT 1 FROM runs WHERE ticket_id = ? AND status IN ('success', 'failed')"
+  ).get(ticketId);
+  return !!row;
+}
+function isTicketActive(ticketId) {
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT 1 FROM runs WHERE ticket_id = ? AND status = 'running'"
+  ).get(ticketId);
+  return !!row;
+}
+function enqueue(ticket) {
+  const db = getDb();
+  db.prepare("INSERT INTO queue (ticket_id, payload) VALUES (?, ?)").run(
+    ticket.id,
+    JSON.stringify(ticket)
+  );
+}
+function dequeue() {
+  const db = getDb();
+  const row = db.prepare("SELECT * FROM queue ORDER BY id ASC LIMIT 1").get();
+  if (!row) return void 0;
+  db.prepare("DELETE FROM queue WHERE id = ?").run(row.id);
+  return JSON.parse(row.payload);
+}
+function removeFromQueue(ticketId) {
+  const db = getDb();
+  db.prepare("DELETE FROM queue WHERE ticket_id = ?").run(ticketId);
+}
+function getQueueLength() {
+  const db = getDb();
+  const row = db.prepare("SELECT COUNT(*) as count FROM queue").get();
+  return row.count;
+}
+function getQueuedTickets() {
+  const db = getDb();
+  const rows = db.prepare("SELECT * FROM queue ORDER BY id ASC").all();
+  return rows.map((r) => JSON.parse(r.payload));
+}
+function queryRuns(opts) {
+  const db = getDb();
+  const limit = opts?.limit ?? 20;
+  const failedOnly = opts?.failedOnly ?? false;
+  const where = failedOnly ? "WHERE status = 'failed'" : "";
+  return db.prepare(
+    `SELECT * FROM runs ${where} ORDER BY started_at DESC LIMIT ?`
+  ).all(limit);
+}
+function countRuns() {
+  const db = getDb();
+  const row = db.prepare("SELECT COUNT(*) as count FROM runs").get();
+  return row.count;
+}
+
+// src/worker.ts
+function buildPrompt(ticket, repoPrompt) {
+  const parts = [];
+  if (repoPrompt) {
+    parts.push(repoPrompt);
+    parts.push("");
+  }
+  parts.push(`## Task: ${ticket.identifier} \u2014 ${ticket.title}`);
+  parts.push("");
+  if (ticket.description) {
+    parts.push(ticket.description);
+  }
+  parts.push("");
+  parts.push("## Instructions");
+  parts.push("- Start by reading CLAUDE.md if it exists \u2014 it has project-specific guidance");
+  parts.push("- Read the codebase to understand the context before making changes");
+  parts.push("- Work through the task step by step");
+  parts.push('- After making changes, run: git add -A && git commit -m "description of changes"');
+  parts.push("- Commit after each logical step (do not batch all changes into one commit)");
+  parts.push("- If the task has a checklist, work through items in order and commit after each one");
+  parts.push("- Tests MUST import from the actual source modules \u2014 never re-implement or duplicate source code in tests");
+  parts.push("- If the project uses TypeScript but tests are plain JS, install tsx or ts-node so tests can import .ts files");
+  parts.push("- Run any existing tests before finishing to verify your changes");
+  parts.push("- IMPORTANT: You MUST commit your changes with git before finishing");
+  parts.push("- When all work is complete and committed, include [autoclawd:done] in your final output");
+  return parts.join("\n");
+}
+function slugify(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 50);
+}
+function assertSafeRef(name, label) {
+  if (!name || /[\s~^:?*\[\\]|\.\./.test(name) || name.startsWith("-")) {
+    throw new Error(`Invalid ${label}: "${name}"`);
+  }
+}
+function createAskpass(githubToken) {
+  const dir = mkdtempSync2(join5(tmpdir2(), "autoclawd-cred-"));
+  const path = join5(dir, "askpass.sh");
+  writeFileSync2(path, `#!/bin/sh
+echo "${githubToken}"
+`, { mode: 448 });
+  return { dir, path };
+}
+function gitEnv(askpassPath) {
+  return { ...process.env, GIT_ASKPASS: askpassPath, GIT_TERMINAL_PROMPT: "0" };
+}
+function detectDefaultBranch(repoUrl, githubToken) {
+  const askpass = createAskpass(githubToken);
+  const authedUrl = repoUrl.replace("https://", "https://x-access-token@");
+  try {
+    const output = execSync2(
+      `git ls-remote --symref -- ${authedUrl} HEAD`,
+      { stdio: "pipe", timeout: 3e4, env: gitEnv(askpass.path), encoding: "utf-8" }
+    );
+    const match = output.match(/ref:\s+refs\/heads\/(\S+)\s+HEAD/);
+    if (match) return match[1];
+  } catch {
+  } finally {
+    rmSync2(askpass.dir, { recursive: true, force: true });
+  }
+  return "main";
+}
+async function cloneToTemp(repoUrl, baseBranch, githubToken) {
+  assertSafeRef(baseBranch, "base branch");
+  return retrySync(() => {
+    const workDir = mkdtempSync2(join5(tmpdir2(), "autoclawd-"));
+    const askpass = createAskpass(githubToken);
+    const authedUrl = repoUrl.replace("https://", "https://x-access-token@");
+    try {
+      execSync2(`git clone --depth=50 -b ${baseBranch} -- ${authedUrl} ${workDir}`, {
+        stdio: "pipe",
+        timeout: 12e4,
+        env: gitEnv(askpass.path)
+      });
+    } catch (err) {
+      rmSync2(workDir, { recursive: true, force: true });
+      throw err;
+    } finally {
+      rmSync2(askpass.dir, { recursive: true, force: true });
+    }
+    return workDir;
+  }, { label: "git clone", retryIf: isTransientError });
+}
+async function runValidation(container, commands, ticketId) {
+  const failures = [];
+  for (const cmd of commands) {
+    log.ticket(ticketId, `Validating: ${cmd}`);
+    const result = await exec(container, ["sh", "-c", cmd], {
+      user: "autoclawd",
+      env: ["HOME=/home/autoclawd"],
+      timeout: 5 * 60 * 1e3
+      // 5 min per validation command
+    });
+    if (result.exitCode === 0) {
+      log.ticket(ticketId, `  PASS: ${cmd}`);
+    } else {
+      log.ticket(ticketId, `  FAIL: ${cmd} (exit ${result.exitCode})`);
+      const output = (result.stdout + result.stderr).trim();
+      failures.push({
+        command: cmd,
+        exitCode: result.exitCode,
+        output: output.slice(-3e3)
+        // Cap output to avoid huge prompts
+      });
+    }
+  }
+  return failures;
+}
+function buildValidationFixPrompt(failures) {
+  const parts = [];
+  parts.push("## Validation Failed");
+  parts.push("");
+  parts.push("The following validation commands failed after your changes. Please fix the issues and commit your fixes.");
+  parts.push("");
+  for (const f of failures) {
+    parts.push(`### Failed: \`${f.command}\` (exit code ${f.exitCode})`);
+    parts.push("```");
+    parts.push(f.output);
+    parts.push("```");
+    parts.push("");
+  }
+  parts.push("## Instructions");
+  parts.push("- Read the error output carefully and fix the root cause");
+  parts.push("- Run the failing command(s) to verify your fix");
+  parts.push('- Commit your fixes with: git add -A && git commit -m "fix: address validation failures"');
+  parts.push("- When done, include [autoclawd:done] in your output");
+  return parts.join("\n");
+}
+async function executeTicket(opts) {
+  const { ticket, config, linearClient, octokit, force } = opts;
+  const startedAt = /* @__PURE__ */ new Date();
+  function recordRun(result, branch) {
+    const finishedAt = /* @__PURE__ */ new Date();
+    const durationSecs = Math.round((finishedAt.getTime() - startedAt.getTime()) / 1e3);
+    try {
+      insertRun(result.ticketId, result.success ? "success" : "failed");
+      updateRun(result.ticketId, {
+        status: result.success ? "success" : "failed",
+        branch: branch ?? null,
+        pr_url: result.prUrl ?? null,
+        error: result.error ?? null,
+        iterations: result.iterations,
+        model: config.agent.model,
+        image: config.docker.image,
+        finished_at: finishedAt.toISOString(),
+        duration_secs: durationSecs
+      });
+    } catch {
+    }
+  }
+  if (!force) {
+    const existingRun = getRunByTicketId(ticket.identifier);
+    if (existingRun?.status === "success") {
+      log.info(`${ticket.identifier}: already completed, use --force to re-run`);
+      return {
+        ticketId: ticket.identifier,
+        success: true,
+        prUrl: existingRun.pr_url ?? void 0,
+        iterations: existingRun.iterations
+      };
+    }
+  }
+  insertRun(ticket.identifier, "running");
+  if (!ticket.repoUrl) {
+    const result = {
+      ticketId: ticket.identifier,
+      success: false,
+      error: "No repo:owner/name label on ticket",
+      iterations: 0
+    };
+    recordRun(result);
+    return result;
+  }
+  if (!ticket.repoUrl.startsWith("https://")) {
+    const result = {
+      ticketId: ticket.identifier,
+      success: false,
+      error: `Invalid repo URL: "${ticket.repoUrl}". Only HTTPS URLs are supported.`,
+      iterations: 0
+    };
+    recordRun(result);
+    return result;
+  }
+  if (!isRepoAllowed(ticket.repoUrl, config.safety.allowedRepos)) {
+    log.warn(`Safety: repo ${ticket.repoUrl} not in allowedRepos list`);
+    return {
+      ticketId: ticket.identifier,
+      success: false,
+      error: `Repo not allowed: "${ticket.repoUrl}". Check safety.allowedRepos in config.`,
+      iterations: 0
+    };
+  }
+  log.info(`Safety: repo ${ticket.repoUrl} allowed`);
+  const branchName = `autoclawd/${ticket.identifier}-${slugify(ticket.title)}`;
+  const containerName = `${ticket.identifier}-${Date.now()}`.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
+  let workDir;
+  let container;
+  try {
+    await claimTicket(linearClient, config, ticket.id);
+    log.ticket(ticket.identifier, `Claimed \u2014 ${ticket.repoUrl}`);
+    const detectedBase = detectDefaultBranch(ticket.repoUrl, config.github.token);
+    log.ticket(ticket.identifier, `Default branch: ${detectedBase}`);
+    workDir = await cloneToTemp(ticket.repoUrl, detectedBase, config.github.token);
+    log.ticket(ticket.identifier, "Cloned repo");
+    const repoLocal = loadRepoLocalConfig(workDir);
+    const actualBase = ticket.baseBranch ?? repoLocal?.base ?? detectedBase;
+    const { agent, docker: docker2, prompt, validate } = mergeConfigs(config, repoLocal);
+    if (repoLocal) {
+      log.ticket(ticket.identifier, "Loaded .autoclawd.yaml from repo");
+    }
+    if (ticket.baseBranch) {
+      log.ticket(ticket.identifier, `Stacked on branch: ${ticket.baseBranch}`);
+    }
+    if (actualBase !== detectedBase) {
+      rmSync2(workDir, { recursive: true, force: true });
+      workDir = await cloneToTemp(ticket.repoUrl, actualBase, config.github.token);
+    }
+    execSync2(`git checkout -B ${branchName} --`, { cwd: workDir, stdio: "pipe" });
+    container = await createContainer({
+      dockerConfig: docker2,
+      workspacePath: workDir,
+      name: containerName
+    });
+    await setupRepo(container, { branchName });
+    const agentPrompt = buildPrompt(ticket, prompt);
+    let agentResult = await runAgentLoop({
+      container,
+      agentConfig: agent,
+      prompt: agentPrompt,
+      ticketId: ticket.identifier
+    });
+    const gitResult = await commitAndPush(container, {
+      branchName,
+      ticketId: ticket.identifier,
+      title: ticket.title,
+      repoUrl: ticket.repoUrl,
+      githubToken: config.github.token,
+      branchPrefix: config.safety.branchPrefix,
+      maxFileChanges: config.safety.maxFileChanges
+    });
+    if (!gitResult.pushed) {
+      await failTicket(linearClient, ticket.id, "No changes produced");
+      finishRun(ticket.identifier, "failed", "No changes produced");
+      const result2 = {
+        ticketId: ticket.identifier,
+        success: false,
+        error: "No changes produced",
+        iterations: agentResult.iterations
+      };
+      recordRun(result2, branchName);
+      return result2;
+    }
+    const buildPRBody = (opts2) => {
+      const prBody = [
+        `Resolves [${ticket.identifier}](${ticket.url})`,
+        ""
+      ];
+      if (ticket.description) {
+        const desc = ticket.description.length > 2e3 ? ticket.description.slice(0, 2e3) + "\n\n*[description truncated]*" : ticket.description;
+        prBody.push("## Description", "", desc, "");
+      }
+      if (opts2?.validationWarnings && opts2.validationWarnings.length > 0) {
+        prBody.push("## :warning: Validation Failures", "");
+        prBody.push("The following validation commands were still failing after all iterations:", "");
+        for (const f of opts2.validationWarnings) {
+          prBody.push(`### \`${f.command}\` (exit code ${f.exitCode})`, "");
+          prBody.push("<details><summary>Output</summary>", "", "```", f.output, "```", "", "</details>", "");
+        }
+      }
+      prBody.push(
+        "## Details",
+        "",
+        `| Metric | Value |`,
+        `| --- | --- |`,
+        `| Iterations | ${agentResult.iterations} |`,
+        `| Commits | ${opts2?.commitCount ?? gitResult.commitCount} |`,
+        `| Model | ${agent.model} |`,
+        "",
+        "---",
+        "*Generated by [autoclawd](https://github.com/rahul-fnu/autoclawd)*"
+      );
+      return prBody.join("\n");
+    };
+    const hasValidation = validate && validate.length > 0;
+    const pr = await openPR(octokit, {
+      repoUrl: ticket.repoUrl,
+      branch: branchName,
+      baseBranch: actualBase,
+      title: `${ticket.identifier}: ${ticket.title}`,
+      body: buildPRBody({ commitCount: gitResult.commitCount }),
+      draft: hasValidation ? true : false
+    });
+    if (hasValidation) {
+      let iterationsUsed = agentResult.iterations;
+      let lastFailures = [];
+      let totalCommitCount = gitResult.commitCount;
+      while (iterationsUsed < agent.maxIterations) {
+        const failures = await runValidation(container, validate, ticket.identifier);
+        if (failures.length === 0) {
+          log.ticket(ticket.identifier, "All validations passed");
+          lastFailures = [];
+          break;
+        }
+        lastFailures = failures;
+        log.ticket(ticket.identifier, `${failures.length} validation(s) failed, feeding back to Claude`);
+        const fixPrompt = buildValidationFixPrompt(failures);
+        const fixResult = await runAgentLoop({
+          container,
+          agentConfig: { ...agent, maxIterations: 1 },
+          prompt: fixPrompt,
+          ticketId: ticket.identifier
+        });
+        iterationsUsed += fixResult.iterations;
+        agentResult = {
+          iterations: iterationsUsed,
+          success: fixResult.success,
+          lastOutput: fixResult.lastOutput
+        };
+        const fixGitResult = await commitAndPush(container, {
+          branchName,
+          ticketId: ticket.identifier,
+          title: ticket.title,
+          repoUrl: ticket.repoUrl,
+          githubToken: config.github.token,
+          branchPrefix: config.safety.branchPrefix,
+          maxFileChanges: config.safety.maxFileChanges
+        });
+        totalCommitCount += fixGitResult.commitCount;
+      }
+      if (lastFailures.length > 0) {
+        log.ticket(ticket.identifier, "Validation still failing after max iterations \u2014 leaving PR as draft with warnings");
+        await updatePRBody(octokit, {
+          repoUrl: ticket.repoUrl,
+          prNumber: pr.number,
+          body: buildPRBody({ validationWarnings: lastFailures, commitCount: totalCommitCount })
+        });
+      } else {
+        await updatePRBody(octokit, {
+          repoUrl: ticket.repoUrl,
+          prNumber: pr.number,
+          body: buildPRBody({ commitCount: totalCommitCount })
+        });
+        await markPRReady(octokit, {
+          repoUrl: ticket.repoUrl,
+          prNumber: pr.number
+        });
+        log.ticket(ticket.identifier, "PR marked as ready for review");
+      }
+    }
+    await completeTicket(linearClient, config, ticket.id, `PR opened: ${pr.url}`);
+    await addBranchLabel(linearClient, ticket.id, branchName);
+    log.success(`${ticket.identifier} done \u2014 ${pr.url}`);
+    const result = {
+      ticketId: ticket.identifier,
+      success: true,
+      prUrl: pr.url,
+      iterations: agentResult.iterations
+    };
+    finishRun(ticket.identifier, "success");
+    updateRun(ticket.identifier, { pr_url: pr.url, branch: branchName, iterations: agentResult.iterations });
+    recordRun(result, branchName);
+    return result;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.error(`${ticket.identifier} failed: ${msg}`);
+    try {
+      await failTicket(linearClient, ticket.id, msg);
+    } catch {
+    }
+    finishRun(ticket.identifier, "failed", msg);
+    const result = {
+      ticketId: ticket.identifier,
+      success: false,
+      error: msg,
+      iterations: 0
+    };
+    recordRun(result, branchName);
+    return result;
+  } finally {
+    if (container) {
+      await destroyContainer(container);
+    }
+    if (workDir) {
+      try {
+        rmSync2(workDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+function buildFixPrompt(pr, failures) {
+  const parts = [];
+  parts.push(`## Task: Fix CI failures on PR "${pr.title}"`);
+  parts.push("");
+  parts.push(`Branch: ${pr.head}`);
+  parts.push("");
+  parts.push("The following CI checks are failing. Read the logs carefully, identify the root cause, fix the code, and make sure the fix is correct.");
+  parts.push("");
+  for (const f of failures) {
+    parts.push(`### Failed check: ${f.name}`);
+    parts.push("```");
+    parts.push(f.log);
+    parts.push("```");
+    parts.push("");
+  }
+  parts.push("## Instructions");
+  parts.push("- Start by reading CLAUDE.md if it exists");
+  parts.push("- Read the failing test/lint/build output carefully before making changes");
+  parts.push("- Fix the root cause, not just the symptoms");
+  parts.push("- Run the failing command locally to verify your fix");
+  parts.push("- Tests MUST import from actual source modules \u2014 never duplicate source code in tests");
+  parts.push('- After fixing, run: git add -A && git commit -m "fix: address CI failures"');
+  parts.push("- IMPORTANT: You MUST commit your changes with git before finishing");
+  parts.push("- When all fixes are committed, include [autoclawd:done] in your final output");
+  return parts.join("\n");
+}
+async function fixPR(opts) {
+  const { repoUrl, prNumber, config, octokit } = opts;
+  const prUrl = `${repoUrl}/pull/${prNumber}`;
+  let workDir;
+  let container;
+  try {
+    const pr = await fetchPR(octokit, { repoUrl, prNumber });
+    log.info(`PR #${prNumber}: "${pr.title}" (${pr.head} \u2192 ${pr.base})`);
+    if (pr.state !== "open") {
+      return { success: false, prUrl, error: "PR is not open", iterations: 0, failedChecks: 0 };
+    }
+    const failures = await fetchFailedChecks(octokit, { repoUrl, prNumber });
+    if (failures.length === 0) {
+      log.success("No failed CI checks \u2014 nothing to fix");
+      return { success: true, prUrl, iterations: 0, failedChecks: 0 };
+    }
+    log.info(`Found ${failures.length} failed check(s): ${failures.map((f) => f.name).join(", ")}`);
+    workDir = await cloneToTemp(repoUrl, pr.head, config.github.token);
+    log.info("Cloned PR branch");
+    const repoLocal = loadRepoLocalConfig(workDir);
+    const { agent, docker: docker2 } = mergeConfigs(config, repoLocal);
+    const containerName = `fix-pr-${prNumber}-${Date.now()}`.replace(/[^a-z0-9_.-]/g, "-");
+    container = await createContainer({
+      dockerConfig: docker2,
+      workspacePath: workDir,
+      name: containerName
+    });
+    await setupRepo(container, { branchName: pr.head });
+    const prompt = buildFixPrompt(pr, failures);
+    const agentResult = await runAgentLoop({
+      container,
+      agentConfig: agent,
+      prompt,
+      ticketId: `PR-${prNumber}`
+    });
+    const gitResult = await commitAndPush(container, {
+      branchName: pr.head,
+      ticketId: `PR-${prNumber}`,
+      title: "Fix CI failures",
+      repoUrl,
+      githubToken: config.github.token,
+      branchPrefix: config.safety.branchPrefix,
+      maxFileChanges: config.safety.maxFileChanges
+    });
+    if (!gitResult.pushed) {
+      return { success: false, prUrl, error: "No fix produced", iterations: agentResult.iterations, failedChecks: failures.length };
+    }
+    log.success(`Pushed ${gitResult.commitCount} fix commit(s) to ${pr.head}`);
+    return { success: true, prUrl, iterations: agentResult.iterations, failedChecks: failures.length };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.error(`Fix failed: ${msg}`);
+    return { success: false, prUrl, error: msg, iterations: 0, failedChecks: 0 };
+  } finally {
+    if (container) await destroyContainer(container);
+    if (workDir) {
+      try {
+        rmSync2(workDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+
+// src/webhook.ts
+function verifySignature(body, signature, secret) {
+  const expected = createHmac("sha256", secret).update(body).digest("hex");
+  try {
+    return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+  } catch {
+    return false;
+  }
+}
+var WebhookServer = class {
+  constructor(config, linearClient, octokit) {
+    this.config = config;
+    this.linearClient = linearClient;
+    this.octokit = octokit;
+  }
+  config;
+  linearClient;
+  octokit;
+  server;
+  // Track in-memory active set for concurrency counting (fast path)
+  activeInMemory = /* @__PURE__ */ new Set();
+  start() {
+    getDb();
+    this.resumeQueue();
+    const port = this.config.webhook?.port ?? 3e3;
+    const MAX_BODY_BYTES = 1024 * 1024;
+    this.server = createServer((req, res) => {
+      if (req.method === "GET" && (req.url === "/health" || req.url === "/healthz")) {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+          status: "ok",
+          active: this.activeInMemory.size,
+          queued: getQueueLength(),
+          capacity: this.config.maxConcurrent
+        }));
+        return;
+      }
+      if (req.method !== "POST" || req.url !== "/webhook" && req.url !== "/api/v1/linear/webhook") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      let body = "";
+      let bodyBytes = 0;
+      req.on("data", (chunk) => {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_BODY_BYTES) {
+          res.writeHead(413);
+          res.end("Payload too large");
+          req.destroy();
+          return;
+        }
+        body += chunk;
+      });
+      req.on("end", () => {
+        if (this.config.webhook?.signingSecret) {
+          const sig = req.headers["linear-signature"];
+          if (!sig || !verifySignature(body, sig, this.config.webhook.signingSecret)) {
+            log.warn("Invalid webhook signature, rejecting");
+            res.writeHead(401);
+            res.end("Invalid signature");
+            return;
+          }
+        }
+        res.writeHead(200);
+        res.end("ok");
+        void this.handleWebhook(body);
+      });
+    });
+    return new Promise((resolve) => {
+      this.server.listen(port, () => {
+        log.info(`Webhook server listening on port ${port}`);
+        resolve();
+      });
+    });
+  }
+  stop() {
+    this.server?.close();
+    closeDb();
+    log.info("Webhook server stopped");
+  }
+  resumeQueue() {
+    const staleRuns = getActiveRuns();
+    for (const run of staleRuns) {
+      log.warn(`${run.ticket_id}: was running at shutdown, marking as failed`);
+      finishRun(run.ticket_id, "failed", "Unclean shutdown \u2014 process restarted");
+    }
+    const queued = getQueuedTickets();
+    if (queued.length > 0) {
+      log.info(`Resuming ${queued.length} queued ticket(s) from database`);
+      for (const ticket of queued) {
+        removeFromQueue(ticket.id);
+        if (this.activeInMemory.size >= this.config.maxConcurrent) {
+          enqueue(ticket);
+          break;
+        }
+        this.dispatch(ticket);
+      }
+    }
+  }
+  async handleWebhook(body) {
+    let payload;
+    try {
+      payload = JSON.parse(body);
+    } catch {
+      log.warn("Invalid webhook JSON");
+      return;
+    }
+    if (payload.type !== "Issue") return;
+    const { action, data } = payload;
+    const triggerStatuses = this.config.linear.statuses.map((s) => s.toLowerCase());
+    const currentStatus = data.state.name.toLowerCase();
+    if (action === "create" || action === "update") {
+      if (!triggerStatuses.includes(currentStatus)) {
+        log.debug(`${data.identifier}: status "${data.state.name}" not in trigger list, ignoring`);
+        return;
+      }
+      if (action === "update" && !payload.updatedFrom?.stateId) {
+        log.debug(`${data.identifier}: update but status didn't change, ignoring`);
+        return;
+      }
+    } else {
+      return;
+    }
+    if (this.activeInMemory.has(data.id) || isTicketActive(data.id)) {
+      log.debug(`${data.identifier}: already active, ignoring`);
+      return;
+    }
+    if (isTicketProcessed(data.id)) {
+      log.debug(`${data.identifier}: already processed, ignoring`);
+      return;
+    }
+    if (this.activeInMemory.size >= this.config.maxConcurrent) {
+      log.info(`${data.identifier}: at capacity (${this.activeInMemory.size}/${this.config.maxConcurrent}), queued`);
+      const queueLabels = data.labels.map((l) => l.name);
+      const ticket2 = {
+        id: data.id,
+        identifier: data.identifier,
+        title: data.title,
+        description: data.description ?? "",
+        labels: queueLabels,
+        repoUrl: parseRepoFromLabels(queueLabels),
+        baseBranch: parseBaseFromLabels(queueLabels),
+        url: data.url
+      };
+      enqueue(ticket2);
+      return;
+    }
+    const labelNames = data.labels.map((l) => l.name);
+    const repoUrl = parseRepoFromLabels(labelNames);
+    if (!repoUrl) {
+      log.warn(`${data.identifier}: no repo: label, ignoring`);
+      return;
+    }
+    const ticket = {
+      id: data.id,
+      identifier: data.identifier,
+      title: data.title,
+      description: data.description ?? "",
+      labels: labelNames,
+      repoUrl,
+      baseBranch: parseBaseFromLabels(labelNames),
+      url: data.url
+    };
+    this.dispatch(ticket);
+  }
+  dispatch(ticket) {
+    this.activeInMemory.add(ticket.id);
+    insertRun(ticket.id, "running");
+    log.ticket(ticket.identifier, `Dispatching \u2192 ${ticket.repoUrl}`);
+    void executeTicket({
+      ticket,
+      config: this.config,
+      linearClient: this.linearClient,
+      octokit: this.octokit
+    }).then(
+      () => {
+        finishRun(ticket.id, "success");
+      },
+      (err) => {
+        finishRun(ticket.id, "failed", err.message);
+      }
+    ).finally(() => {
+      this.activeInMemory.delete(ticket.id);
+      this.drainQueue();
+    });
+  }
+  drainQueue() {
+    while (this.activeInMemory.size < this.config.maxConcurrent) {
+      const next = dequeue();
+      if (!next) break;
+      if (this.activeInMemory.has(next.id)) continue;
+      log.ticket(next.identifier, `Dequeued (${getQueueLength()} remaining)`);
+      this.dispatch(next);
+    }
+  }
+};
+
+// src/tunnel.ts
+import { spawn } from "child_process";
+async function startQuickTunnel(port) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn("cloudflared", ["tunnel", "--url", `http://127.0.0.1:${port}`], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let resolved = false;
+    const timeout = setTimeout(() => {
+      if (!resolved) {
+        reject(new Error("Tunnel startup timed out after 30s"));
+      }
+    }, 3e4);
+    const handleOutput = (data) => {
+      const line = data.toString();
+      const match = line.match(/(https:\/\/[a-z0-9-]+\.trycloudflare\.com)/);
+      if (match && !resolved) {
+        resolved = true;
+        clearTimeout(timeout);
+        resolve({ url: match[1], process: proc });
+      }
+    };
+    proc.stdout.on("data", handleOutput);
+    proc.stderr.on("data", handleOutput);
+    proc.on("error", (err) => {
+      if (!resolved) {
+        clearTimeout(timeout);
+        if (err.code === "ENOENT") {
+          reject(new Error("cloudflared not found. Install it: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"));
+        } else {
+          reject(err);
+        }
+      }
+    });
+    proc.on("exit", (code) => {
+      if (!resolved) {
+        clearTimeout(timeout);
+        reject(new Error(`cloudflared exited with code ${code}`));
+      }
+    });
+  });
+}
+function stopTunnel(tunnel) {
+  tunnel.process.kill("SIGTERM");
+  log.info("Tunnel stopped");
+}
+
+// src/watch.ts
+var Watcher = class {
+  constructor(config, linearClient, octokit) {
+    this.config = config;
+    this.linearClient = linearClient;
+    this.octokit = octokit;
+  }
+  config;
+  linearClient;
+  octokit;
+  activeInMemory = /* @__PURE__ */ new Set();
+  timer;
+  stopped = false;
+  async start(intervalSeconds, once) {
+    getDb();
+    this.resumeQueue();
+    await this.poll();
+    if (once) {
+      await this.waitForActive();
+      closeDb();
+      return;
+    }
+    this.timer = setInterval(() => {
+      if (!this.stopped) {
+        void this.poll();
+      }
+    }, intervalSeconds * 1e3);
+    log.info(`Polling every ${intervalSeconds}s (Ctrl+C to stop)`);
+  }
+  stop() {
+    this.stopped = true;
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = void 0;
+    }
+    closeDb();
+    log.info("Watcher stopped");
+  }
+  resumeQueue() {
+    const staleRuns = getActiveRuns();
+    for (const run of staleRuns) {
+      log.warn(`${run.ticket_id}: was running at shutdown, marking as failed`);
+      finishRun(run.ticket_id, "failed", "Unclean shutdown \u2014 process restarted");
+    }
+    const queued = getQueuedTickets();
+    if (queued.length > 0) {
+      log.info(`Resuming ${queued.length} queued ticket(s) from database`);
+      for (const ticket of queued) {
+        removeFromQueue(ticket.id);
+        if (this.activeInMemory.size >= this.config.maxConcurrent) {
+          enqueue(ticket);
+          break;
+        }
+        this.dispatch(ticket);
+      }
+    }
+  }
+  async poll() {
+    try {
+      const tickets = await pollTickets(this.linearClient, this.config);
+      const newTickets = tickets.filter((t) => this.isNewTicket(t));
+      log.info(`Poll: ${tickets.length} ticket(s) found, ${newTickets.length} new`);
+      for (const ticket of newTickets) {
+        if (!ticket.repoUrl) {
+          log.warn(`${ticket.identifier}: no repo: label, skipping`);
+          continue;
+        }
+        if (this.activeInMemory.size >= this.config.maxConcurrent) {
+          log.info(`${ticket.identifier}: at capacity (${this.activeInMemory.size}/${this.config.maxConcurrent}), queued`);
+          enqueue(ticket);
+          continue;
+        }
+        this.dispatch(ticket);
+      }
+    } catch (err) {
+      log.error(`Poll failed: ${err instanceof Error ? err.message : err}`);
+    }
+  }
+  isNewTicket(ticket) {
+    if (this.activeInMemory.has(ticket.id)) return false;
+    if (isTicketActive(ticket.id)) return false;
+    if (isTicketProcessed(ticket.id)) return false;
+    return true;
+  }
+  dispatch(ticket) {
+    this.activeInMemory.add(ticket.id);
+    insertRun(ticket.id, "running");
+    log.ticket(ticket.identifier, `Dispatching \u2192 ${ticket.repoUrl}`);
+    void executeTicket({
+      ticket,
+      config: this.config,
+      linearClient: this.linearClient,
+      octokit: this.octokit
+    }).then(
+      () => {
+        finishRun(ticket.id, "success");
+      },
+      (err) => {
+        finishRun(ticket.id, "failed", err.message);
+      }
+    ).finally(() => {
+      this.activeInMemory.delete(ticket.id);
+      this.drainQueue();
+    });
+  }
+  drainQueue() {
+    while (this.activeInMemory.size < this.config.maxConcurrent) {
+      const next = dequeue();
+      if (!next) break;
+      if (this.activeInMemory.has(next.id)) continue;
+      log.ticket(next.identifier, `Dequeued (${getQueueLength()} remaining)`);
+      this.dispatch(next);
+    }
+  }
+  waitForActive() {
+    if (this.activeInMemory.size === 0) return Promise.resolve();
+    return new Promise((resolve) => {
+      const check = setInterval(() => {
+        if (this.activeInMemory.size === 0) {
+          clearInterval(check);
+          resolve();
+        }
+      }, 1e3);
+    });
+  }
+};
+
+// src/history.ts
+import { readFileSync as readFileSync3, existsSync as existsSync5 } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir4 } from "os";
+import chalk2 from "chalk";
+var HISTORY_DIR = join6(homedir4(), ".autoclawd");
+var HISTORY_FILE = join6(HISTORY_DIR, "history.jsonl");
+function runToRecord(run) {
+  return {
+    ticketId: run.ticket_id,
+    status: run.status === "failed" ? "failure" : "success",
+    branch: run.branch ?? "",
+    prUrl: run.pr_url ?? void 0,
+    error: run.error ?? void 0,
+    iterations: run.iterations,
+    model: run.model ?? "",
+    image: run.image ?? "",
+    startedAt: run.started_at,
+    finishedAt: run.finished_at ?? "",
+    durationSecs: run.duration_secs ?? 0
+  };
+}
+function readHistory(opts) {
+  const runs = queryRuns(opts);
+  return runs.map(runToRecord);
+}
+function migrateJsonlToSqlite() {
+  if (!existsSync5(HISTORY_FILE)) return 0;
+  if (countRuns() > 0) return 0;
+  const lines = readFileSync3(HISTORY_FILE, "utf-8").split("\n").filter(Boolean);
+  if (lines.length === 0) return 0;
+  const db = getDb();
+  const insert = db.prepare(
+    `INSERT OR IGNORE INTO runs (id, ticket_id, status, branch, pr_url, started_at, finished_at, error, iterations, model, image, duration_secs)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  );
+  const tx = db.transaction(() => {
+    let count = 0;
+    for (const line of lines) {
+      try {
+        const r = JSON.parse(line);
+        const status = r.status === "failure" ? "failed" : r.status;
+        insert.run(
+          r.ticketId,
+          r.ticketId,
+          status,
+          r.branch || null,
+          r.prUrl || null,
+          r.startedAt,
+          r.finishedAt || null,
+          r.error || null,
+          r.iterations,
+          r.model || null,
+          r.image || null,
+          r.durationSecs ?? null
+        );
+        count++;
+      } catch {
+      }
+    }
+    return count;
+  });
+  return tx();
+}
+function formatDuration(secs) {
+  if (secs < 60) return `${secs}s`;
+  const m = Math.floor(secs / 60);
+  const s = secs % 60;
+  if (m < 60) return `${m}m ${s}s`;
+  const h = Math.floor(m / 60);
+  return `${h}h ${m % 60}m`;
+}
+function formatTime(iso) {
+  return iso.replace("T", " ").slice(0, 19);
+}
+function pad(s, len) {
+  return s.length >= len ? s.slice(0, len) : s + " ".repeat(len - s.length);
+}
+function printHistoryTable(records) {
+  if (records.length === 0) {
+    console.log("No history records found.");
+    return;
+  }
+  const header = `${pad("Ticket", 14)} ${pad("Status", 10)} ${pad("PR", 50)} ${pad("Duration", 10)} ${pad("Time", 20)}`;
+  console.log(chalk2.bold(header));
+  console.log("-".repeat(header.length));
+  for (const r of records) {
+    const status = r.status === "success" ? chalk2.green(pad("success", 10)) : chalk2.red(pad("failure", 10));
+    const pr = pad(r.prUrl ?? (r.error ? r.error.slice(0, 48) : "-"), 50);
+    const dur = pad(formatDuration(r.durationSecs), 10);
+    const time = pad(formatTime(r.startedAt), 20);
+    console.log(`${pad(r.ticketId, 14)} ${status} ${pr} ${dur} ${time}`);
+  }
+}
+
+// src/deps.ts
+import { execSync as execSync3 } from "child_process";
+import { existsSync as existsSync6 } from "fs";
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+function detectPackageManager() {
+  const checks = [
+    ["apt", "apt-get"],
+    ["dnf", "dnf"],
+    ["yum", "yum"],
+    ["pacman", "pacman"],
+    ["apk", "apk"],
+    ["brew", "brew"]
+  ];
+  for (const [name, cmd] of checks) {
+    try {
+      execSync3(`which ${cmd}`, { stdio: "pipe" });
+      return name;
+    } catch {
+    }
+  }
+  return "unknown";
+}
+var DOCKER_INSTALL = {
+  apt: [
+    "apt-get update -qq",
+    "apt-get install -y docker.io",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  dnf: [
+    "dnf install -y docker",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  yum: [
+    "yum install -y docker",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  pacman: [
+    "pacman -Sy --noconfirm docker",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  apk: [
+    "apk add docker",
+    "rc-update add docker boot",
+    "service docker start"
+  ],
+  brew: [
+    "brew install --cask docker"
+  ],
+  unknown: []
+};
+var CLOUDFLARED_INSTALL = {
+  apt: [
+    "apt-get update -qq",
+    'apt-get install -y cloudflared || (curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null && echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/cloudflared.list && apt-get update -qq && apt-get install -y cloudflared)'
+  ],
+  dnf: ["dnf install -y cloudflared || npm install -g cloudflared"],
+  yum: ["yum install -y cloudflared || npm install -g cloudflared"],
+  pacman: ["pacman -Sy --noconfirm cloudflared"],
+  apk: ["apk add cloudflared"],
+  brew: ["brew install cloudflared"],
+  unknown: []
+};
+function checkDeps() {
+  const pm = detectPackageManager();
+  const needsSudo = pm !== "brew" && pm !== "unknown" && process.getuid?.() !== 0;
+  const sudo = needsSudo ? "sudo " : "";
+  return [
+    {
+      name: "Docker",
+      installed: commandExists("docker"),
+      running: isDockerRunning(),
+      installable: pm !== "unknown",
+      installCommands: DOCKER_INSTALL[pm].map((c) => `${sudo}${c}`),
+      manualInstructions: "https://docs.docker.com/get-docker/"
+    },
+    {
+      name: "Claude Code",
+      installed: commandExists("claude"),
+      installable: commandExists("npm"),
+      installCommands: ["npm install -g @anthropic-ai/claude-code@latest"],
+      manualInstructions: "npm install -g @anthropic-ai/claude-code"
+    },
+    {
+      name: "Claude credentials",
+      installed: existsSync6(join7(homedir5(), ".claude", ".credentials.json")),
+      installable: false,
+      installCommands: [],
+      manualInstructions: 'Run "claude" and complete the login flow'
+    },
+    {
+      name: "cloudflared",
+      installed: commandExists("cloudflared"),
+      installable: pm !== "unknown",
+      installCommands: CLOUDFLARED_INSTALL[pm].map((c) => `${sudo}${c}`),
+      manualInstructions: "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"
+    }
+  ];
+}
+function installDep(dep) {
+  if (dep.installCommands.length === 0) return false;
+  for (const cmd of dep.installCommands) {
+    try {
+      execSync3(cmd, { stdio: "inherit", timeout: 3e5 });
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+function addUserToDockerGroup() {
+  if (process.platform !== "linux") return;
+  try {
+    const user = execSync3("whoami", { encoding: "utf-8" }).trim();
+    execSync3(`sudo usermod -aG docker ${user}`, { stdio: "pipe" });
+    log.info(`Added ${user} to docker group \u2014 log out and back in to apply`);
+  } catch {
+  }
+}
+function commandExists(cmd) {
+  try {
+    execSync3(`which ${cmd}`, { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isDockerRunning() {
+  try {
+    execSync3("docker info", { stdio: "pipe", timeout: 1e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/index.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { execSync as execSync4 } from "child_process";
+import { createInterface } from "readline";
+import { join as join8 } from "path";
+import { homedir as homedir6 } from "os";
+import { LinearClient as LinearClient2 } from "@linear/sdk";
+import { Octokit as Octokit2 } from "@octokit/rest";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var program = new Command();
+program.name("autoclawd").description("Linear webhooks \u2192 Claude Code in Docker \u2192 PRs").version(pkg.version);
+function ask(question, defaultVal) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const hint = defaultVal ? ` (${defaultVal})` : "";
+  return new Promise((resolve) => {
+    rl.question(`${question}${hint}: `, (answer) => {
+      rl.close();
+      resolve(answer.trim() || defaultVal || "");
+    });
+  });
+}
+program.command("serve").description("Start webhook server with auto-tunnel").option("-c, --config <path>", "Config file path").option("-p, --port <number>", "Override webhook port").option("--no-tunnel", "Skip auto-tunnel (use if you have your own reverse proxy)").option("-v, --verbose", "Verbose logging").action(async (opts) => {
+  if (opts.verbose) setLogLevel("debug");
+  enableFileLogging();
+  log.info(`autoclawd v${pkg.version}`);
+  await checkDockerAvailable();
+  if (!checkClaudeCredentials()) {
+    throw new Error(
+      "Claude Code credentials not found (~/.claude/.credentials.json)\nRun: claude (and complete login) to create credentials"
+    );
+  }
+  const orphans = await cleanupOrphanedContainers();
+  if (orphans > 0) {
+    log.info(`Cleaned up ${orphans} orphaned container(s) from previous session`);
+  }
+  const config = loadConfig(opts.config);
+  if (opts.port) config.webhook.port = parseInt(opts.port);
+  log.info(`Team: ${config.linear.teamId} | Statuses: ${config.linear.statuses.join(", ")} | Model: ${config.agent.model} | Max concurrent: ${config.maxConcurrent}`);
+  const linearClient = createLinearClient(config);
+  const octokit = createOctokit(config);
+  const server = new WebhookServer(config, linearClient, octokit);
+  let tunnel;
+  if (opts.tunnel !== false) {
+    log.info("Starting tunnel...");
+    try {
+      tunnel = await startQuickTunnel(config.webhook.port);
+      const webhookUrl = `${tunnel.url}/api/v1/linear/webhook`;
+      log.success(`Tunnel: ${tunnel.url}`);
+      log.info(`Webhook URL: ${webhookUrl}`);
+      if (config.webhook.webhookId) {
+        try {
+          await linearClient.deleteWebhook(config.webhook.webhookId);
+        } catch {
+        }
+      }
+      const team = await linearClient.team(config.linear.teamId);
+      const result = await linearClient.createWebhook({
+        url: webhookUrl,
+        resourceTypes: ["Issue"],
+        label: "autoclawd",
+        teamId: team.id
+      });
+      const webhook = await result.webhook;
+      if (webhook) {
+        log.success(`Linear webhook created \u2192 ${webhookUrl}`);
+        config.webhook.webhookId = webhook.id;
+        config.webhook.signingSecret = void 0;
+      }
+    } catch (err) {
+      log.warn(`Tunnel failed: ${err instanceof Error ? err.message : err}`);
+      log.info("Falling back to local-only mode. Set up your own reverse proxy.");
+    }
+  }
+  await server.start();
+  const shutdown = () => {
+    log.info("Shutting down...");
+    server.stop();
+    if (tunnel) stopTunnel(tunnel);
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+});
+program.command("watch").description("Poll Linear for tickets (no webhook/tunnel needed)").option("-c, --config <path>", "Config file path").option("-i, --interval <seconds>", "Poll interval in seconds", "30").option("--once", "Poll once and exit (useful for cron)").option("-v, --verbose", "Verbose logging").action(async (opts) => {
+  if (opts.verbose) setLogLevel("debug");
+  enableFileLogging();
+  log.info(`autoclawd v${pkg.version}`);
+  await checkDockerAvailable();
+  if (!checkClaudeCredentials()) {
+    throw new Error(
+      "Claude Code credentials not found (~/.claude/.credentials.json)\nRun: claude (and complete login) to create credentials"
+    );
+  }
+  const orphans = await cleanupOrphanedContainers();
+  if (orphans > 0) {
+    log.info(`Cleaned up ${orphans} orphaned container(s) from previous session`);
+  }
+  const config = loadConfig(opts.config);
+  const intervalSeconds = parseInt(opts.interval);
+  log.info(`Team: ${config.linear.teamId} | Statuses: ${config.linear.statuses.join(", ")} | Model: ${config.agent.model} | Max concurrent: ${config.maxConcurrent}`);
+  const linearClient = createLinearClient(config);
+  const octokit = createOctokit(config);
+  const watcher = new Watcher(config, linearClient, octokit);
+  const shutdown = () => {
+    log.info("Shutting down...");
+    watcher.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  await watcher.start(intervalSeconds, opts.once ?? false);
+});
+program.command("run <ticket>").description("Run a single ticket (e.g. autoclawd run RAH-123)").option("-c, --config <path>", "Config file path").option("-v, --verbose", "Verbose logging").option("--dry-run", "Show what would happen without executing").option("--force", "Bypass completed-ticket check and re-run").action(async (ticketId, opts) => {
+  if (opts.verbose) setLogLevel("debug");
+  enableFileLogging();
+  const config = loadConfig(opts.config);
+  const linearClient = createLinearClient(config);
+  const ticket = await fetchTicket(linearClient, ticketId);
+  if (!ticket) throw new Error(`Ticket ${ticketId} not found`);
+  if (!ticket.repoUrl) {
+    throw new Error(`${ticketId} has no repo: label. Add "repo:owner/name" label to the ticket.`);
+  }
+  if (opts.dryRun) {
+    log.info("Dry run \u2014 no changes will be made\n");
+    log.info(`  Ticket:   ${ticket.identifier} \u2014 ${ticket.title}`);
+    log.info(`  Repo:     ${ticket.repoUrl}`);
+    log.info(`  Base:     ${ticket.baseBranch ?? "(from .autoclawd.yaml or main)"}`);
+    log.info(`  Branch:   autoclawd/${ticket.identifier}-...`);
+    log.info(`  Image:    ${config.docker.image}`);
+    log.info(`  Model:    ${config.agent.model}`);
+    log.info(`  Max iter: ${config.agent.maxIterations}`);
+    if (ticket.description) {
+      log.info(`
+  Description:
+    ${ticket.description.split("\n").join("\n    ")}`);
+    }
+    return;
+  }
+  await checkDockerAvailable();
+  if (!checkClaudeCredentials()) {
+    throw new Error(
+      "Claude Code credentials not found (~/.claude/.credentials.json)\nRun: claude (and complete login) to create credentials"
+    );
+  }
+  const octokit = createOctokit(config);
+  const abort = new AbortController();
+  const onSignal = () => {
+    log.info("Received signal, cleaning up...");
+    abort.abort();
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  try {
+    const result = await executeTicket({ ticket, config, linearClient, octokit, force: opts.force });
+    if (!result.success) throw new Error(result.error ?? "Unknown failure");
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  }
+});
+program.command("fix <pr-url>").description("Fix failed CI checks on a PR (e.g. autoclawd fix https://github.com/owner/repo/pull/123)").option("-c, --config <path>", "Config file path").option("-v, --verbose", "Verbose logging").action(async (prUrl, opts) => {
+  if (opts.verbose) setLogLevel("debug");
+  enableFileLogging();
+  const match = prUrl.match(/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+  if (!match) {
+    throw new Error(`Invalid PR URL: "${prUrl}"
+Expected: https://github.com/owner/repo/pull/123`);
+  }
+  const [, owner, repo, prNumStr] = match;
+  const repoUrl = `https://github.com/${owner}/${repo}`;
+  const prNumber = parseInt(prNumStr);
+  const config = loadConfig(opts.config);
+  await checkDockerAvailable();
+  if (!checkClaudeCredentials()) {
+    throw new Error(
+      "Claude Code credentials not found (~/.claude/.credentials.json)\nRun: claude (and complete login) to create credentials"
+    );
+  }
+  const octokit = createOctokit(config);
+  const result = await fixPR({ repoUrl, prNumber, config, octokit });
+  if (!result.success) {
+    throw new Error(result.error ?? "Fix failed");
+  }
+});
+program.command("retry [ticket]").description("Retry a failed ticket (e.g. autoclawd retry RAH-123)").option("-c, --config <path>", "Config file path").option("-v, --verbose", "Verbose logging").option("--last-failed", "Retry the most recent failed run").option("--all-failed", "Retry all failed runs (sequentially)").action(async (ticketArg, opts) => {
+  if (opts.verbose) setLogLevel("debug");
+  enableFileLogging();
+  if (!ticketArg && !opts.lastFailed && !opts.allFailed) {
+    throw new Error(
+      "Provide a ticket ID, --last-failed, or --all-failed.\nUsage: autoclawd retry RAH-123 | --last-failed | --all-failed"
+    );
+  }
+  const config = loadConfig(opts.config);
+  await checkDockerAvailable();
+  if (!checkClaudeCredentials()) {
+    throw new Error(
+      "Claude Code credentials not found (~/.claude/.credentials.json)\nRun: claude (and complete login) to create credentials"
+    );
+  }
+  const linearClient = createLinearClient(config);
+  const octokit = createOctokit(config);
+  let ticketIds = [];
+  if (ticketArg) {
+    const history = readHistory({ failedOnly: true, limit: 1e3 });
+    const prev = history.find(
+      (r) => r.ticketId.toLowerCase() === ticketArg.toLowerCase()
+    );
+    if (prev) {
+      log.info(`Retrying ${prev.ticketId} \u2014 last failure: ${prev.error ?? "unknown error"}`);
+      log.info(`  Failed at: ${prev.startedAt}`);
+    } else {
+      log.info(`No previous failure found for ${ticketArg}, running fresh`);
+    }
+    ticketIds = [ticketArg];
+  } else if (opts.lastFailed) {
+    const history = readHistory({ failedOnly: true, limit: 1 });
+    if (history.length === 0) {
+      throw new Error("No failed runs found in history");
+    }
+    const last = history[0];
+    log.info(`Retrying last failed: ${last.ticketId} \u2014 ${last.error ?? "unknown error"}`);
+    log.info(`  Failed at: ${last.startedAt}`);
+    ticketIds = [last.ticketId];
+  } else if (opts.allFailed) {
+    const allRecords = readHistory({ limit: 1e4 });
+    const succeeded = new Set(
+      allRecords.filter((r) => r.status === "success").map((r) => r.ticketId)
+    );
+    const failedUnique = /* @__PURE__ */ new Map();
+    for (const r of allRecords) {
+      if (r.status === "failure" && !succeeded.has(r.ticketId) && !failedUnique.has(r.ticketId)) {
+        failedUnique.set(r.ticketId, r);
+      }
+    }
+    if (failedUnique.size === 0) {
+      throw new Error("No unresolved failed runs found in history");
+    }
+    log.info(`Found ${failedUnique.size} failed ticket(s) to retry:`);
+    for (const [id, rec] of failedUnique) {
+      log.info(`  ${id} \u2014 ${rec.error ?? "unknown error"}`);
+    }
+    ticketIds = [...failedUnique.keys()];
+  }
+  const abort = new AbortController();
+  const onSignal = () => {
+    log.info("Received signal, cleaning up...");
+    abort.abort();
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  try {
+    for (const id of ticketIds) {
+      log.info(`
+Retrying ticket ${id}...`);
+      const ticket = await fetchTicket(linearClient, id);
+      if (!ticket) {
+        log.error(`Ticket ${id} not found in Linear, skipping`);
+        continue;
+      }
+      if (!ticket.repoUrl) {
+        log.error(`${id} has no repo: label, skipping`);
+        continue;
+      }
+      const result = await executeTicket({ ticket, config, linearClient, octokit });
+      if (result.success) {
+        log.success(`${id} completed${result.prUrl ? ` \u2192 ${result.prUrl}` : ""}`);
+      } else {
+        log.error(`${id} failed again: ${result.error ?? "unknown"}`);
+        if (ticketIds.length === 1) {
+          throw new Error(result.error ?? "Retry failed");
+        }
+      }
+    }
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  }
+});
+program.command("validate").description("Validate config without running anything").option("-c, --config <path>", "Config file path").action(async (opts) => {
+  try {
+    const config = loadConfig(opts.config);
+    log.success("Config is valid");
+    log.info(`  Linear team: ${config.linear.teamId}`);
+    log.info(`  Trigger statuses: ${config.linear.statuses.join(", ")}`);
+    log.info(`  Docker image: ${config.docker.image}`);
+    log.info(`  Agent model: ${config.agent.model}`);
+    log.info(`  Max iterations: ${config.agent.maxIterations}`);
+    log.info(`  Max concurrent: ${config.maxConcurrent}`);
+    log.info(`  Webhook port: ${config.webhook.port}`);
+  } catch (err) {
+    log.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+});
+program.command("cleanup").description("Remove orphaned autoclawd Docker containers").action(async () => {
+  await checkDockerAvailable();
+  const count = await cleanupOrphanedContainers();
+  if (count === 0) {
+    log.info("No orphaned containers found");
+  } else {
+    log.success(`Cleaned up ${count} orphaned container(s)`);
+  }
+});
+program.command("history").description("Show run history").option("-n, --limit <number>", "Number of records to show", "20").option("--json", "Output as JSON").option("--failed", "Show only failures").action((opts) => {
+  migrateJsonlToSqlite();
+  const records = readHistory({
+    limit: parseInt(opts.limit),
+    failedOnly: opts.failed ?? false
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(records, null, 2));
+  } else {
+    printHistoryTable(records);
+  }
+});
+function checkClaudeCredentials() {
+  return existsSync7(join8(homedir6(), ".claude", ".credentials.json"));
+}
+async function validateGitHubToken(token) {
+  try {
+    const octokit = new Octokit2({ auth: token });
+    const { data } = await octokit.rest.users.getAuthenticated();
+    return data.login;
+  } catch {
+    return void 0;
+  }
+}
+program.command("init").description("Set up autoclawd interactively").action(async () => {
+  console.log("\n  autoclawd setup\n");
+  console.log("  Checking dependencies...\n");
+  const deps = checkDeps();
+  const stillMissing = [];
+  for (const dep of deps) {
+    if (dep.installed && dep.running !== false) {
+      log.success(`${dep.name}`);
+      continue;
+    }
+    if (dep.installed && dep.running === false) {
+      log.warn(`${dep.name} \u2014 installed but not running`);
+      stillMissing.push(`${dep.name} (needs restart)`);
+      continue;
+    }
+    if (dep.installable && dep.installCommands.length > 0) {
+      const answer = await ask(`  ${dep.name} not found. Install? (Y/n)`, "Y");
+      if (answer.toLowerCase() !== "n") {
+        console.log(`
+  Installing ${dep.name} via system package manager...
+`);
+        const ok = installDep(dep);
+        if (ok) {
+          log.success(`${dep.name} installed`);
+          if (dep.name === "Docker") addUserToDockerGroup();
+          if (dep.name === "Claude Code") {
+            console.log('\n  Run "claude" in your terminal to log in, then re-run: autoclawd init\n');
+            stillMissing.push("Claude Code login");
+          }
+        } else {
+          log.error(`${dep.name} install failed`);
+          console.log(`    Install manually: ${dep.manualInstructions}`);
+          stillMissing.push(dep.name);
+        }
+      } else {
+        console.log(`    Install manually: ${dep.manualInstructions}`);
+        stillMissing.push(dep.name);
+      }
+    } else if (dep.name === "Claude credentials") {
+      log.warn(`${dep.name} \u2014 run "claude" to log in`);
+      stillMissing.push(dep.name);
+    } else {
+      log.warn(`${dep.name} \u2014 ${dep.manualInstructions}`);
+      stillMissing.push(dep.name);
+    }
+  }
+  if (stillMissing.length > 0) {
+    console.log(`
+  Continuing setup \u2014 install ${stillMissing.join(", ")} before running.
+`);
+  } else {
+    console.log("");
+  }
+  if (!existsSync7(CONFIG_DIR)) {
+    mkdirSync3(CONFIG_DIR, { recursive: true });
+  }
+  if (existsSync7(CONFIG_FILE)) {
+    const overwrite = await ask("Config already exists. Overwrite? (y/N)", "N");
+    if (overwrite.toLowerCase() !== "y") {
+      log.info("Keeping existing config.");
+      return;
+    }
+  }
+  const linearKey = await ask("Linear API key", process.env.LINEAR_API_KEY);
+  if (!linearKey) {
+    log.error("Linear API key is required");
+    process.exit(1);
+  }
+  let teamId = "";
+  try {
+    const client = new LinearClient2({ apiKey: linearKey });
+    const teams = await client.teams();
+    if (teams.nodes.length === 0) {
+      log.error("No teams found in your Linear workspace");
+      process.exit(1);
+    }
+    if (teams.nodes.length === 1) {
+      teamId = teams.nodes[0].key;
+      log.success(`Linear team: ${teams.nodes[0].name} (${teamId})`);
+    } else {
+      console.log("\n  Available teams:");
+      for (const t of teams.nodes) {
+        console.log(`    ${t.key} \u2014 ${t.name}`);
+      }
+      teamId = await ask("\n  Team key");
+    }
+  } catch (err) {
+    log.error(`Invalid Linear API key: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+  let ghToken = "";
+  try {
+    ghToken = execSync4("gh auth token", { encoding: "utf-8" }).trim();
+    log.success(`GitHub token detected from gh CLI`);
+  } catch {
+    ghToken = await ask("GitHub personal access token");
+  }
+  if (!ghToken) {
+    log.error("GitHub token is required");
+    process.exit(1);
+  }
+  const ghUser = await validateGitHubToken(ghToken);
+  if (ghUser) {
+    log.success(`GitHub authenticated as ${ghUser}`);
+  } else {
+    log.error("GitHub token is invalid or expired");
+    process.exit(1);
+  }
+  console.log("\n  Docker image options:");
+  console.log("    autoclawd-base    \u2014 All runtimes: Node, Python, Go, Rust, Ruby (~1.5GB)");
+  console.log("                       Works with any repo, no per-repo config needed");
+  console.log("    node:20          \u2014 Node.js only (fast, ~300MB)");
+  const dockerImage = await ask("Docker image", "autoclawd-base");
+  if (dockerImage === "autoclawd-base") {
+    try {
+      execSync4("docker image inspect autoclawd-base", { stdio: "pipe" });
+      log.success("autoclawd-base image found");
+    } catch {
+      log.info("autoclawd-base will be built automatically on first run (~3 min)");
+    }
+  }
+  const model = await ask("Claude model", "claude-sonnet-4-6");
+  const maxIter = await ask("Max iterations per ticket", "10");
+  const config = `# autoclawd config \u2014 generated by autoclawd init
+# Tip: use "env:VAR_NAME" to read secrets from environment variables
+# e.g. apiKey: env:LINEAR_API_KEY
+
+linear:
+  apiKey: "${linearKey}"
+  teamId: ${teamId}
+  statuses: [Todo]
+  assignToMe: false
+  inProgressStatus: In Progress
+  doneStatus: Done
+
+github:
+  token: "${ghToken}"
+
+webhook:
+  port: 3000
+
+docker:
+  image: ${dockerImage}
+  memory: 4g
+
+agent:
+  model: ${model}
+  maxIterations: ${parseInt(maxIter) || 10}
+
+maxConcurrent: 1
+`;
+  writeFileSync3(CONFIG_FILE, config, { mode: 384 });
+  log.success(`Config saved to ${CONFIG_FILE}`);
+  console.log(`
+  Setup complete! Next steps:
+
+  1. Add repo: labels to your Linear team
+     (e.g. "repo:your-org/your-repo")
+
+  2. Tag tickets with a repo: label
+
+  3. Start autoclawd:
+     $ autoclawd serve
+
+  autoclawd serve will auto-create a tunnel and
+  register the webhook with Linear. Just run it.
+`);
+});
+program.parseAsync().catch((err) => {
+  log.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map