@dotdotdash/afterhours 0.1.0

package/dist/index.js

@@ -0,0 +1,2920 @@
+#!/usr/bin/env node
+import {
+  writeReports
+} from "./chunk-UC2WX3XO.js";
+
+// src/cli/main.ts
+import { Command } from "commander";
+
+// src/config/load.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { parse } from "yaml";
+
+// src/config/schema.ts
+import { z } from "zod";
+var projectSchema = z.object({
+  type: z.enum(["auto", "website", "server", "library"]).default("auto"),
+  packageManager: z.enum(["auto", "npm", "pnpm", "yarn", "bun"]).default("auto"),
+  build: z.union([z.enum(["auto", "none"]), z.string()]).default("auto"),
+  test: z.union([z.enum(["auto", "none"]), z.string()]).default("auto"),
+  run: z.union([z.enum(["auto"]), z.string()]).default("auto"),
+  runHealthcheck: z.object({
+    type: z.enum(["http", "log", "exit"]).default("http"),
+    url: z.string().optional(),
+    timeoutSec: z.number().int().positive().optional()
+  }).strict().optional()
+}).strict();
+var sandboxSchema = z.object({
+  mode: z.enum(["docker", "host"]).default("docker"),
+  image: z.string().default("node:20-bookworm"),
+  network: z.enum(["bridge", "none"]).default("bridge")
+}).strict();
+var scheduleSchema = z.object({ cron: z.string().default("0 3 * * 1") }).strict();
+var platformSchema = z.object({
+  provider: z.enum(["github", "gitlab", "azure", "codecommit", "gcsr", "generic"]).default("github"),
+  remote: z.string().default("origin"),
+  baseBranch: z.string().default("main"),
+  branchPrefix: z.string().default("afterhours/"),
+  autoMerge: z.boolean().default(false),
+  mergeStrategy: z.enum(["squash", "merge", "rebase"]).default("squash")
+}).strict();
+var llmSchema = z.object({
+  provider: z.enum(["anthropic", "openai", "ollama", "github-models", "gemini", "copilot"]).default("anthropic"),
+  model: z.string().default("claude-sonnet-4-5"),
+  apiKeyEnv: z.string().default("ANTHROPIC_API_KEY"),
+  baseUrlEnv: z.string().optional(),
+  maxTokens: z.number().int().positive().default(8e3)
+}).strict();
+var agentExternalSchema = z.object({
+  cli: z.enum(["aider", "claude", "codex"]).default("aider"),
+  extraArgs: z.array(z.string()).default([])
+}).strict();
+var agentSchema = z.object({
+  mode: z.enum(["builtin", "external"]).default("builtin"),
+  external: agentExternalSchema.optional()
+}).strict();
+var dependencyAuditSchema = z.object({
+  enabled: z.boolean().default(true),
+  securityOnly: z.boolean().default(false),
+  allowMajor: z.boolean().default(false),
+  notifyOnFailure: z.boolean().default(true)
+}).strict();
+var codeOptimizationSchema = z.object({
+  enabled: z.boolean().default(true),
+  priorityThreshold: z.enum(["low", "medium", "high", "severe"]).default("high"),
+  notifyOnComplete: z.boolean().default(false)
+}).strict();
+var deploymentSchema = z.object({
+  enabled: z.boolean().default(false),
+  targets: z.array(z.unknown()).default([])
+}).strict();
+var issueTriageSchema = z.object({
+  enabled: z.boolean().default(false),
+  allowedAuthors: z.array(z.string()).default(["*"]),
+  notifyOnFailure: z.boolean().default(true)
+}).strict();
+var tasksSchema = z.object({
+  dependencyAudit: dependencyAuditSchema.default({}),
+  codeOptimization: codeOptimizationSchema.default({}),
+  deployment: deploymentSchema.default({}),
+  issueTriage: issueTriageSchema.default({})
+}).strict();
+var notificationSchema = z.object({
+  type: z.enum(["github", "email", "webhook"]).default("github"),
+  toEnv: z.string().optional(),
+  fromEnv: z.string().optional(),
+  smtp: z.object({
+    hostEnv: z.string().optional(),
+    portEnv: z.string().optional(),
+    userEnv: z.string().optional(),
+    passEnv: z.string().optional()
+  }).strict().optional(),
+  urlEnv: z.string().optional()
+}).strict();
+var contactSchema = z.object({
+  name: z.string(),
+  emailEnv: z.string().optional()
+}).strict();
+var ConfigSchema = z.object({
+  version: z.number().int().positive(),
+  project: projectSchema,
+  sandbox: sandboxSchema,
+  schedule: scheduleSchema,
+  platform: platformSchema,
+  llm: llmSchema,
+  agent: agentSchema,
+  tasks: tasksSchema,
+  notifications: z.array(notificationSchema).default([]),
+  contacts: z.array(contactSchema).default([])
+}).strict();
+
+// src/secrets/index.ts
+import { config as loadDotEnv } from "dotenv";
+
+// src/util/errors.ts
+var AfterhoursError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AfterhoursError";
+  }
+};
+var ConfigError = class extends AfterhoursError {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "ConfigError";
+  }
+};
+var SecretError = class extends AfterhoursError {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "SecretError";
+  }
+};
+var UnsupportedCapabilityError = class extends AfterhoursError {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "UnsupportedCapabilityError";
+  }
+};
+
+// src/secrets/index.ts
+loadDotEnv();
+function readEnv(name) {
+  return process.env[name];
+}
+function resolveEnvRefs(value) {
+  if (typeof value === "string") {
+    const ref = value.match(/^\$\{env:([A-Z0-9_]+)\}$/i);
+    if (ref) {
+      const envName = ref[1];
+      const resolved = readEnv(envName);
+      if (resolved === void 0) {
+        throw new SecretError(`Missing required environment variable ${envName}`);
+      }
+      return resolved;
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => resolveEnvRefs(item));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entryValue]) => [key, resolveEnvRefs(entryValue)])
+    );
+  }
+  return value;
+}
+function redact(text) {
+  const secretValues = Object.values(process.env).filter((value) => Boolean(value));
+  return secretValues.reduce((acc, secret) => acc.replaceAll(secret, "[REDACTED]"), text);
+}
+
+// src/config/load.ts
+function loadConfig(startDir = process.cwd()) {
+  let currentDir = startDir;
+  while (true) {
+    const configPath = join(currentDir, ".afterhours", "config.yml");
+    if (existsSync(configPath)) {
+      try {
+        const content = readFileSync(configPath, "utf8");
+        const parsed = parse(content);
+        const resolved = resolveEnvRefs(parsed);
+        return ConfigSchema.parse(resolved);
+      } catch (error) {
+        if (error instanceof ConfigError) {
+          throw error;
+        }
+        throw new ConfigError(`Invalid config at ${configPath}: ${error}`);
+      }
+    }
+    const parent = dirname(currentDir);
+    if (parent === currentDir) {
+      throw new ConfigError("No .afterhours/config.yml found");
+    }
+    currentDir = parent;
+  }
+}
+
+// src/detect/index.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+function detectPackageManager(dir) {
+  const files = [
+    join2(dir, "pnpm-lock.yaml"),
+    join2(dir, "yarn.lock"),
+    join2(dir, "bun.lockb")
+  ];
+  if (existsSync2(files[0])) return "pnpm";
+  if (existsSync2(files[1])) return "yarn";
+  if (existsSync2(files[2])) return "bun";
+  return "npm";
+}
+function detectProjectType(dir) {
+  const pkgPath = join2(dir, "package.json");
+  if (!existsSync2(pkgPath)) return "library";
+  const data = JSON.parse(readFileSync2(pkgPath, "utf8"));
+  const deps = { ...data.dependencies, ...data.devDependencies };
+  const names = Object.keys(deps ?? {});
+  const hasServerFramework = names.some((dep) => ["express", "fastify", "koa", "nest", "http"].includes(dep));
+  const hasWebsiteFramework = names.some((dep) => ["next", "vite", "react", "svelte", "astro"].includes(dep));
+  if (data.bin || data.main || data.exports) {
+    if (!hasServerFramework && !hasWebsiteFramework) {
+      return "library";
+    }
+  }
+  if (hasServerFramework || data.scripts?.start?.includes("3000") || data.scripts?.dev?.includes("3000")) {
+    return "server";
+  }
+  if (hasWebsiteFramework || data.scripts?.build?.includes("vite") || data.scripts?.build?.includes("next")) {
+    return "website";
+  }
+  return "library";
+}
+function detectCommands(dir, pm) {
+  const pkgPath = join2(dir, "package.json");
+  if (!existsSync2(pkgPath)) {
+    return { build: "npm run build", test: "npm test", run: "npm run start" };
+  }
+  const data = JSON.parse(readFileSync2(pkgPath, "utf8"));
+  const scripts = data.scripts ?? {};
+  const runner = pm === "pnpm" ? "pnpm" : pm === "yarn" ? "yarn" : pm === "bun" ? "bun" : "npm";
+  return {
+    build: scripts.build ? `${runner} run build` : `${runner} run build`,
+    test: scripts.test ? `${runner} test` : `${runner} test`,
+    run: scripts.start ? `${runner} run start` : scripts.dev ? `${runner} run dev` : `${runner} run start`
+  };
+}
+
+// src/cli/doctor.ts
+function registerDoctor(program) {
+  program.command("doctor").description("Check configuration, secrets, and project detection").option("--platform", "Include platform provider details").action(async (opts) => {
+    let ok = true;
+    let config;
+    try {
+      config = loadConfig();
+      console.log("\u2705  Config: valid");
+    } catch (err) {
+      if (err instanceof ConfigError) {
+        console.error(`\u274C  Config: ${err.message}`);
+      } else {
+        console.error(`\u274C  Config: ${err}`);
+      }
+      ok = false;
+    }
+    if (config) {
+      const cwd = process.cwd();
+      const pm = detectPackageManager(cwd);
+      const type = detectProjectType(cwd);
+      const cmds = detectCommands(cwd, pm);
+      console.log(`
+Project detection:`);
+      console.log(`  type:           ${type}`);
+      console.log(`  packageManager: ${pm}`);
+      console.log(`  build:          ${cmds.build}`);
+      console.log(`  test:           ${cmds.test}`);
+      console.log(`  run:            ${cmds.run}`);
+      const secretEnvNames = [];
+      if (config.llm.apiKeyEnv) secretEnvNames.push(config.llm.apiKeyEnv);
+      for (const n of config.notifications) {
+        if (n.toEnv) secretEnvNames.push(n.toEnv);
+        if (n.fromEnv) secretEnvNames.push(n.fromEnv);
+        if (n.urlEnv) secretEnvNames.push(n.urlEnv);
+        if (n.smtp) {
+          if (n.smtp.hostEnv) secretEnvNames.push(n.smtp.hostEnv);
+          if (n.smtp.portEnv) secretEnvNames.push(n.smtp.portEnv);
+          if (n.smtp.userEnv) secretEnvNames.push(n.smtp.userEnv);
+          if (n.smtp.passEnv) secretEnvNames.push(n.smtp.passEnv);
+        }
+      }
+      for (const c of config.contacts) {
+        if (c.emailEnv) secretEnvNames.push(c.emailEnv);
+      }
+      if (secretEnvNames.length > 0) {
+        console.log(`
+Secrets presence:`);
+        for (const name of [...new Set(secretEnvNames)]) {
+          const val = readEnv(name);
+          if (val !== void 0) {
+            console.log(`  \u2705  ${name} = (set)`);
+          } else {
+            console.log(`  \u26A0\uFE0F   ${name} = (not set)`);
+          }
+        }
+      }
+      if (opts.platform) {
+        console.log(`
+Platform provider: ${config.platform.provider}`);
+        const requiredPlatformEnvs = [];
+        switch (config.platform.provider) {
+          case "github":
+            requiredPlatformEnvs.push("GITHUB_TOKEN");
+            break;
+          case "gitlab":
+            requiredPlatformEnvs.push("GITLAB_TOKEN");
+            break;
+          case "azure":
+            requiredPlatformEnvs.push("AZURE_DEVOPS_TOKEN");
+            break;
+          case "codecommit":
+            requiredPlatformEnvs.push("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY");
+            break;
+          default:
+            break;
+        }
+        for (const name of requiredPlatformEnvs) {
+          const val = readEnv(name);
+          if (val !== void 0) {
+            console.log(`  \u2705  ${name} = (set)`);
+          } else {
+            console.log(`  \u274C  ${name} = (not set)`);
+            ok = false;
+          }
+        }
+      }
+    }
+    process.exit(ok ? 0 : 1);
+  });
+}
+
+// src/platform/generic.ts
+var GenericGitProvider = class {
+  name = "generic";
+  capabilities = {
+    pullRequests: false,
+    merge: false,
+    releases: false,
+    comments: false,
+    issues: false
+  };
+  openPullRequest() {
+    return Promise.reject(new UnsupportedCapabilityError("generic provider does not support pull requests; push the branch and open a PR manually"));
+  }
+  mergePullRequest() {
+    return Promise.reject(new UnsupportedCapabilityError("generic provider does not support merging pull requests"));
+  }
+  comment() {
+    return Promise.reject(new UnsupportedCapabilityError("generic provider does not support PR comments"));
+  }
+  createRelease() {
+    return Promise.reject(new UnsupportedCapabilityError("generic provider does not support releases"));
+  }
+  listIssues() {
+    return Promise.reject(new UnsupportedCapabilityError("generic provider does not support issues"));
+  }
+  commentOnIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("generic provider does not support issues"));
+  }
+  closeIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("generic provider does not support issues"));
+  }
+};
+
+// src/platform/github.ts
+function parseGitHubRemote(remoteUrl) {
+  const https = remoteUrl.match(/https?:\/\/github\.com\/([^/]+)\/([^/.]+)(?:\.git)?/);
+  if (https) return { owner: https[1], repo: https[2] };
+  const ssh = remoteUrl.match(/git@github\.com:([^/]+)\/([^/.]+)(?:\.git)?/);
+  if (ssh) return { owner: ssh[1], repo: ssh[2] };
+  throw new Error(`Cannot parse GitHub remote URL: ${remoteUrl}`);
+}
+var GitHubProvider = class {
+  constructor(token, owner, repo) {
+    this.token = token;
+    this.owner = owner;
+    this.repo = repo;
+  }
+  token;
+  owner;
+  repo;
+  name = "github";
+  capabilities = {
+    pullRequests: true,
+    merge: true,
+    releases: true,
+    comments: true,
+    issues: true
+  };
+  get headers() {
+    return {
+      Authorization: `Bearer ${this.token}`,
+      Accept: "application/vnd.github+json",
+      "Content-Type": "application/json",
+      "X-GitHub-Api-Version": "2022-11-28"
+    };
+  }
+  async openPullRequest(opts) {
+    const res = await fetch(`https://api.github.com/repos/${this.owner}/${this.repo}/pulls`, {
+      method: "POST",
+      headers: this.headers,
+      body: JSON.stringify(opts)
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitHub openPullRequest failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    return { id: String(data.id), url: data.html_url, number: data.number };
+  }
+  async mergePullRequest(pr, strategy) {
+    const mergeMethod = strategy === "squash" ? "squash" : strategy === "rebase" ? "rebase" : "merge";
+    const res = await fetch(
+      `https://api.github.com/repos/${this.owner}/${this.repo}/pulls/${pr.number}/merge`,
+      { method: "PUT", headers: this.headers, body: JSON.stringify({ merge_method: mergeMethod }) }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitHub mergePullRequest failed: ${res.status} ${err}`);
+    }
+  }
+  async comment(pr, body) {
+    const res = await fetch(
+      `https://api.github.com/repos/${this.owner}/${this.repo}/issues/${pr.number}/comments`,
+      { method: "POST", headers: this.headers, body: JSON.stringify({ body }) }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitHub comment failed: ${res.status} ${err}`);
+    }
+  }
+  async createRelease(opts) {
+    const res = await fetch(`https://api.github.com/repos/${this.owner}/${this.repo}/releases`, {
+      method: "POST",
+      headers: this.headers,
+      body: JSON.stringify({
+        tag_name: opts.tag,
+        name: opts.name,
+        body: opts.body,
+        draft: false,
+        prerelease: false
+      })
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitHub createRelease failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    return { id: String(data.id), url: data.html_url };
+  }
+  async listIssues() {
+    const res = await fetch(
+      `https://api.github.com/repos/${this.owner}/${this.repo}/issues?state=open&per_page=100`,
+      { headers: this.headers }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitHub listIssues failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    return data.filter((item) => !item.pull_request).map((item) => ({
+      id: String(item.id),
+      number: item.number,
+      title: item.title,
+      body: item.body ?? "",
+      url: item.html_url,
+      author: item.user?.login ?? "unknown"
+    }));
+  }
+  async commentOnIssue(issue, body) {
+    const res = await fetch(
+      `https://api.github.com/repos/${this.owner}/${this.repo}/issues/${issue.number}/comments`,
+      { method: "POST", headers: this.headers, body: JSON.stringify({ body }) }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitHub commentOnIssue failed: ${res.status} ${err}`);
+    }
+  }
+  async closeIssue(issue, body) {
+    await this.commentOnIssue(issue, body);
+    const res = await fetch(
+      `https://api.github.com/repos/${this.owner}/${this.repo}/issues/${issue.number}`,
+      { method: "PATCH", headers: this.headers, body: JSON.stringify({ state: "closed" }) }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitHub closeIssue failed: ${res.status} ${err}`);
+    }
+  }
+};
+
+// src/platform/gitlab.ts
+function parseGitLabRemote(remoteUrl) {
+  const https = remoteUrl.match(/https?:\/\/([^/]+)\/(.*?)(?:\.git)?$/);
+  if (https) return { baseUrl: `https://${https[1]}`, projectPath: https[2] };
+  const ssh = remoteUrl.match(/git@([^:]+):(.+?)(?:\.git)?$/);
+  if (ssh) return { baseUrl: `https://${ssh[1]}`, projectPath: ssh[2] };
+  throw new Error(`Cannot parse GitLab remote URL: ${remoteUrl}`);
+}
+var GitLabProvider = class {
+  constructor(token, baseUrl, projectPath) {
+    this.token = token;
+    this.baseUrl = baseUrl;
+    this.projectPath = projectPath;
+    this.encodedProject = encodeURIComponent(projectPath);
+  }
+  token;
+  baseUrl;
+  projectPath;
+  name = "gitlab";
+  capabilities = {
+    pullRequests: true,
+    merge: true,
+    releases: true,
+    comments: true,
+    issues: false
+  };
+  encodedProject;
+  get headers() {
+    return {
+      "PRIVATE-TOKEN": this.token,
+      "Content-Type": "application/json"
+    };
+  }
+  async openPullRequest(opts) {
+    const res = await fetch(`${this.baseUrl}/api/v4/projects/${this.encodedProject}/merge_requests`, {
+      method: "POST",
+      headers: this.headers,
+      body: JSON.stringify({
+        source_branch: opts.head,
+        target_branch: opts.base,
+        title: opts.title,
+        description: opts.body
+      })
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitLab openMR failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    return { id: String(data.id), url: data.web_url, number: data.iid };
+  }
+  async mergePullRequest(pr, strategy) {
+    const squash = strategy === "squash";
+    const res = await fetch(
+      `${this.baseUrl}/api/v4/projects/${this.encodedProject}/merge_requests/${pr.number}/merge`,
+      { method: "PUT", headers: this.headers, body: JSON.stringify({ squash }) }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitLab merge failed: ${res.status} ${err}`);
+    }
+  }
+  async comment(pr, body) {
+    const res = await fetch(
+      `${this.baseUrl}/api/v4/projects/${this.encodedProject}/merge_requests/${pr.number}/notes`,
+      { method: "POST", headers: this.headers, body: JSON.stringify({ body }) }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitLab comment failed: ${res.status} ${err}`);
+    }
+  }
+  async createRelease(opts) {
+    const res = await fetch(
+      `${this.baseUrl}/api/v4/projects/${this.encodedProject}/releases`,
+      {
+        method: "POST",
+        headers: this.headers,
+        body: JSON.stringify({ name: opts.name, tag_name: opts.tag, description: opts.body })
+      }
+    );
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`GitLab createRelease failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    return {
+      id: data.tag_name,
+      url: data._links?.self ?? `${this.baseUrl}/${this.projectPath}/-/releases/${data.tag_name}`
+    };
+  }
+  listIssues() {
+    return Promise.reject(new UnsupportedCapabilityError("GitLab issue triage is not yet implemented"));
+  }
+  commentOnIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("GitLab issue triage is not yet implemented"));
+  }
+  closeIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("GitLab issue triage is not yet implemented"));
+  }
+};
+
+// src/platform/azure.ts
+function parseAzureRemote(remoteUrl) {
+  const devAzure = remoteUrl.match(/https?:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/.]+)/);
+  if (devAzure) return { org: devAzure[1], project: devAzure[2], repo: devAzure[3] };
+  const vsTs = remoteUrl.match(/https?:\/\/([^.]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/.]+)/);
+  if (vsTs) return { org: vsTs[1], project: vsTs[2], repo: vsTs[3] };
+  throw new Error(`Cannot parse Azure Repos remote URL: ${remoteUrl}`);
+}
+var AzureReposProvider = class {
+  constructor(token, org, project, repo) {
+    this.token = token;
+    this.org = org;
+    this.project = project;
+    this.repo = repo;
+  }
+  token;
+  org;
+  project;
+  repo;
+  name = "azure";
+  capabilities = {
+    pullRequests: true,
+    merge: true,
+    releases: false,
+    comments: true,
+    issues: false
+  };
+  get headers() {
+    const encoded = Buffer.from(`:${this.token}`).toString("base64");
+    return {
+      Authorization: `Basic ${encoded}`,
+      "Content-Type": "application/json"
+    };
+  }
+  get base() {
+    return `https://dev.azure.com/${this.org}/${encodeURIComponent(this.project)}/_apis/git/repositories/${encodeURIComponent(this.repo)}`;
+  }
+  async openPullRequest(opts) {
+    const res = await fetch(`${this.base}/pullrequests?api-version=7.1`, {
+      method: "POST",
+      headers: this.headers,
+      body: JSON.stringify({
+        title: opts.title,
+        description: opts.body,
+        sourceRefName: `refs/heads/${opts.head}`,
+        targetRefName: `refs/heads/${opts.base}`
+      })
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`Azure openPR failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    return { id: String(data.pullRequestId), url: data.url, number: data.pullRequestId };
+  }
+  async mergePullRequest(pr, strategy) {
+    const mergeStrategy = strategy === "squash" ? 1 : strategy === "rebase" ? 3 : 2;
+    const res = await fetch(`${this.base}/pullrequests/${pr.number}?api-version=7.1`, {
+      method: "PATCH",
+      headers: this.headers,
+      body: JSON.stringify({ status: "completed", completionOptions: { mergeStrategy } })
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`Azure mergePR failed: ${res.status} ${err}`);
+    }
+  }
+  async comment(pr, body) {
+    const res = await fetch(`${this.base}/pullrequests/${pr.number}/threads?api-version=7.1`, {
+      method: "POST",
+      headers: this.headers,
+      body: JSON.stringify({ comments: [{ parentCommentId: 0, content: body, commentType: 1 }], status: 1 })
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`Azure comment failed: ${res.status} ${err}`);
+    }
+  }
+  createRelease(opts) {
+    throw new UnsupportedCapabilityError(
+      `Azure Repos does not support GitHub-style releases. Use the git tag "${opts.tag}" and create a release in your CI/CD pipeline.`
+    );
+  }
+  listIssues() {
+    return Promise.reject(new UnsupportedCapabilityError("Azure Repos does not support issue triage via this provider"));
+  }
+  commentOnIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("Azure Repos does not support issue triage via this provider"));
+  }
+  closeIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("Azure Repos does not support issue triage via this provider"));
+  }
+};
+
+// src/platform/aws-gcsr.ts
+var AwsCodeCommitProvider = class {
+  constructor(region, repoName, accessKeyId, secretAccessKey) {
+    this.region = region;
+    this.repoName = repoName;
+    this.accessKeyId = accessKeyId;
+    this.secretAccessKey = secretAccessKey;
+  }
+  region;
+  repoName;
+  accessKeyId;
+  secretAccessKey;
+  name = "codecommit";
+  capabilities = {
+    pullRequests: true,
+    merge: false,
+    releases: false,
+    comments: false,
+    issues: false
+  };
+  async openPullRequest(opts) {
+    const endpoint = `https://codecommit.${this.region}.amazonaws.com`;
+    const body = JSON.stringify({
+      title: opts.title,
+      description: opts.body,
+      sourceReference: opts.head,
+      destinationReference: opts.base,
+      repositoryName: this.repoName
+    });
+    const headers = await this.signRequest("POST", "/pullRequests", body);
+    const res = await fetch(`${endpoint}/pullRequests`, {
+      method: "POST",
+      headers,
+      body
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new Error(`CodeCommit openPR failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    const prId = data.pullRequest.pullRequestId;
+    return {
+      id: prId,
+      url: `https://${this.region}.console.aws.amazon.com/codesuite/codecommit/repositories/${this.repoName}/pull-requests/${prId}`,
+      number: Number(prId)
+    };
+  }
+  mergePullRequest() {
+    throw new UnsupportedCapabilityError("CodeCommit provider merge not yet implemented; use the AWS console");
+  }
+  comment() {
+    throw new UnsupportedCapabilityError("CodeCommit provider comments not yet implemented");
+  }
+  createRelease(opts) {
+    throw new UnsupportedCapabilityError(
+      `CodeCommit does not support GitHub-style releases. Push tag "${opts.tag}" and create a release in your CI pipeline.`
+    );
+  }
+  listIssues() {
+    return Promise.reject(new UnsupportedCapabilityError("CodeCommit provider does not support issue triage"));
+  }
+  commentOnIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("CodeCommit provider does not support issue triage"));
+  }
+  closeIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("CodeCommit provider does not support issue triage"));
+  }
+  async signRequest(method, path, body) {
+    const now = /* @__PURE__ */ new Date();
+    const date = now.toISOString().replace(/[-:]/g, "").split(".")[0] + "Z";
+    const dateShort = date.slice(0, 8);
+    const service = "codecommit";
+    const region = this.region;
+    const encoder = new TextEncoder();
+    const hash = async (data) => {
+      const buffer = await crypto.subtle.digest("SHA-256", encoder.encode(data));
+      return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+    };
+    const hmac = async (key, data) => {
+      const keyData = typeof key === "string" ? encoder.encode(key) : key;
+      const cryptoKey = await crypto.subtle.importKey("raw", keyData, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+      return crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(data));
+    };
+    const payloadHash = await hash(body);
+    const canonicalHeaders = `content-type:application/json
+host:codecommit.${region}.amazonaws.com
+x-amz-date:${date}
+`;
+    const signedHeaders = "content-type;host;x-amz-date";
+    const canonicalRequest = [method, path, "", canonicalHeaders, signedHeaders, payloadHash].join("\n");
+    const credentialScope = `${dateShort}/${region}/${service}/aws4_request`;
+    const stringToSign = ["AWS4-HMAC-SHA256", date, credentialScope, await hash(canonicalRequest)].join("\n");
+    const kDate = await hmac(`AWS4${this.secretAccessKey}`, dateShort);
+    const kRegion = await hmac(kDate, region);
+    const kService = await hmac(kRegion, service);
+    const kSigning = await hmac(kService, "aws4_request");
+    const sigBuffer = await hmac(kSigning, stringToSign);
+    const signature = Array.from(new Uint8Array(sigBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+    return {
+      "Content-Type": "application/json",
+      "X-Amz-Date": date,
+      Authorization: `AWS4-HMAC-SHA256 Credential=${this.accessKeyId}/${credentialScope},SignedHeaders=${signedHeaders},Signature=${signature}`
+    };
+  }
+};
+var GoogleCloudSourceProvider = class {
+  constructor(projectId) {
+    this.projectId = projectId;
+  }
+  projectId;
+  name = "gcsr";
+  capabilities = {
+    pullRequests: false,
+    merge: false,
+    releases: false,
+    comments: false,
+    issues: false
+  };
+  openPullRequest() {
+    throw new UnsupportedCapabilityError(
+      "Google Cloud Source Repositories has limited PR API support. Push the branch and create a review manually in the Cloud Console."
+    );
+  }
+  mergePullRequest() {
+    throw new UnsupportedCapabilityError("GCSR does not support PR merging via API");
+  }
+  comment() {
+    throw new UnsupportedCapabilityError("GCSR does not support PR comments via API");
+  }
+  createRelease() {
+    throw new UnsupportedCapabilityError("GCSR does not support releases; use Cloud Build or another CI step");
+  }
+  listIssues() {
+    return Promise.reject(new UnsupportedCapabilityError("GCSR does not support issue triage"));
+  }
+  commentOnIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("GCSR does not support issue triage"));
+  }
+  closeIssue() {
+    return Promise.reject(new UnsupportedCapabilityError("GCSR does not support issue triage"));
+  }
+};
+
+// src/platform/index.ts
+function createProvider(config) {
+  const { provider } = config.platform;
+  const remoteUrl = config._remoteUrl ?? "";
+  switch (provider) {
+    case "github": {
+      const token = process.env.GITHUB_TOKEN ?? "";
+      if (remoteUrl) {
+        const { owner, repo } = parseGitHubRemote(remoteUrl);
+        return new GitHubProvider(token, owner, repo);
+      }
+      return new GitHubProvider(token, "", "");
+    }
+    case "gitlab": {
+      const token = process.env.GITLAB_TOKEN ?? "";
+      if (remoteUrl) {
+        const { baseUrl, projectPath } = parseGitLabRemote(remoteUrl);
+        return new GitLabProvider(token, baseUrl, projectPath);
+      }
+      return new GitLabProvider(token, "https://gitlab.com", "");
+    }
+    case "azure": {
+      const token = process.env.AZURE_DEVOPS_TOKEN ?? "";
+      if (remoteUrl) {
+        const { org, project, repo } = parseAzureRemote(remoteUrl);
+        return new AzureReposProvider(token, org, project, repo);
+      }
+      return new AzureReposProvider(token, "", "", "");
+    }
+    case "codecommit": {
+      const region = process.env.AWS_REGION ?? "us-east-1";
+      const accessKeyId = process.env.AWS_ACCESS_KEY_ID ?? "";
+      const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY ?? "";
+      const repoName = remoteUrl.split("/").pop()?.replace(/\.git$/, "") ?? "";
+      return new AwsCodeCommitProvider(region, repoName, accessKeyId, secretAccessKey);
+    }
+    case "gcsr": {
+      const projectId = process.env.GCP_PROJECT_ID ?? "";
+      return new GoogleCloudSourceProvider(projectId);
+    }
+    case "generic":
+      return new GenericGitProvider();
+    default:
+      throw new ConfigError(`Unknown platform provider: "${provider}". Must be one of: github, gitlab, azure, codecommit, gcsr, generic`);
+  }
+}
+
+// src/sandbox/host.ts
+import { spawn } from "child_process";
+var HostSandbox = class {
+  mountDir;
+  constructor(mountDir) {
+    this.mountDir = mountDir;
+  }
+  run(cmd, opts = {}) {
+    return new Promise((resolve2, reject) => {
+      const timeoutMs = (opts.timeoutSec ?? 300) * 1e3;
+      const env = { ...process.env, ...opts.env ?? {} };
+      const child = spawn(cmd, {
+        shell: true,
+        cwd: opts.cwd ?? this.mountDir,
+        env,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      child.stdout?.on("data", (chunk) => {
+        stdout += chunk.toString();
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        reject(new Error(`Command timed out after ${opts.timeoutSec ?? 300}s: ${cmd}`));
+      }, timeoutMs);
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        resolve2({
+          code: code ?? 1,
+          stdout: redact(stdout),
+          stderr: redact(stderr)
+        });
+      });
+      child.on("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+    });
+  }
+  async start(cmd, opts = {}) {
+    const env = { ...process.env, ...opts.env ?? {} };
+    const child = spawn(cmd, {
+      shell: true,
+      cwd: opts.cwd ?? this.mountDir,
+      env,
+      stdio: "ignore"
+    });
+    const handle = {
+      stop: () => new Promise((resolve2) => {
+        if (child.killed) {
+          resolve2();
+          return;
+        }
+        child.on("close", () => resolve2());
+        child.kill("SIGTERM");
+        setTimeout(() => {
+          if (!child.killed) child.kill("SIGKILL");
+        }, 5e3);
+      })
+    };
+    return handle;
+  }
+};
+
+// src/sandbox/docker.ts
+import { execFileSync, spawn as spawn2 } from "child_process";
+function isDockerAvailable() {
+  try {
+    execFileSync("docker", ["info"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var DockerSandbox = class {
+  constructor(mountDir, image, network = "bridge") {
+    this.image = image;
+    this.network = network;
+    this.mountDir = mountDir;
+    if (!isDockerAvailable()) {
+      throw new AfterhoursError(
+        "Docker is not available. Set sandbox.mode: host in your config to run without Docker."
+      );
+    }
+  }
+  image;
+  network;
+  mountDir;
+  run(cmd, opts = {}) {
+    const args = this.buildDockerRunArgs(cmd, opts, false);
+    return new Promise((resolve2, reject) => {
+      const timeoutMs = (opts.timeoutSec ?? 300) * 1e3;
+      const child = spawn2("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+      let stdout = "";
+      let stderr = "";
+      child.stdout?.on("data", (chunk) => {
+        stdout += chunk.toString();
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        reject(new Error(`Docker command timed out after ${opts.timeoutSec ?? 300}s`));
+      }, timeoutMs);
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        resolve2({ code: code ?? 1, stdout: redact(stdout), stderr: redact(stderr) });
+      });
+      child.on("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+    });
+  }
+  async start(cmd, opts = {}) {
+    const containerName = `afterhours-${Date.now()}`;
+    const args = this.buildDockerRunArgs(cmd, opts, true, containerName);
+    const child = spawn2("docker", args, { stdio: "ignore" });
+    child.unref();
+    const handle = {
+      stop: () => new Promise((resolve2) => {
+        const rm = spawn2("docker", ["rm", "-f", containerName], { stdio: "ignore" });
+        rm.on("close", () => resolve2());
+        rm.on("error", () => resolve2());
+      })
+    };
+    return handle;
+  }
+  buildDockerRunArgs(cmd, opts, detach, name) {
+    const args = ["run", "--rm"];
+    if (detach) args.push("-d");
+    if (name) args.push("--name", name);
+    args.push("--network", this.network);
+    args.push("-v", `${this.mountDir}:/workspace`);
+    args.push("-w", "/workspace");
+    const env = { ...process.env, ...opts.env ?? {} };
+    for (const [key, value] of Object.entries(env)) {
+      if (value !== void 0) args.push("-e", `${key}=${value}`);
+    }
+    args.push(this.image, "sh", "-c", cmd);
+    return args;
+  }
+};
+
+// src/sandbox/index.ts
+function createSandbox(config) {
+  if (config.sandbox.mode === "docker") {
+    return new DockerSandbox(config.mountDir, config.sandbox.image, config.sandbox.network);
+  }
+  return new HostSandbox(config.mountDir);
+}
+
+// src/llm/anthropic.ts
+import { z as z2 } from "zod";
+function toolToAnthropicDef(tool) {
+  const shape = tool.parameters.shape ?? {};
+  const properties = {};
+  const required = [];
+  for (const [key, val] of Object.entries(shape)) {
+    const zodVal = val;
+    properties[key] = { type: "string" };
+    if (zodVal.description) properties[key].description = zodVal.description;
+    if (!(zodVal instanceof z2.ZodOptional)) required.push(key);
+  }
+  return {
+    name: tool.name,
+    description: tool.description,
+    input_schema: { type: "object", properties, required }
+  };
+}
+var AnthropicProvider = class {
+  constructor(apiKey, model, baseUrl = "https://api.anthropic.com") {
+    this.apiKey = apiKey;
+    this.model = model;
+    this.baseUrl = baseUrl;
+  }
+  apiKey;
+  model;
+  baseUrl;
+  async chat(opts) {
+    const messages = opts.messages.filter((m) => m.role !== "system").map((m) => ({
+      role: m.role,
+      content: m.content
+    }));
+    const system = opts.messages.find((m) => m.role === "system")?.content;
+    const body = {
+      model: this.model,
+      max_tokens: opts.maxTokens ?? 8e3,
+      messages
+    };
+    if (system) body.system = system;
+    if (opts.tools?.length) body.tools = opts.tools.map(toolToAnthropicDef);
+    const res = await fetch(`${this.baseUrl}/v1/messages`, {
+      method: "POST",
+      headers: {
+        "x-api-key": this.apiKey,
+        "anthropic-version": "2023-06-01",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new AfterhoursError(`Anthropic API error ${res.status}: ${err}`);
+    }
+    const data = await res.json();
+    let text = "";
+    const toolCalls = [];
+    for (const block of data.content) {
+      if (block.type === "text") text += block.text ?? "";
+      if (block.type === "tool_use") {
+        toolCalls.push({ id: block.id ?? "", name: block.name ?? "", arguments: block.input ?? {} });
+      }
+    }
+    const stopReason = data.stop_reason === "tool_use" ? "tool_use" : data.stop_reason === "max_tokens" ? "max_tokens" : data.stop_reason === "stop_sequence" ? "stop_sequence" : "end_turn";
+    return { text, toolCalls, stopReason };
+  }
+};
+
+// src/llm/openai.ts
+import { z as z3 } from "zod";
+function toolToOpenAIDef(tool) {
+  const shape = tool.parameters.shape ?? {};
+  const properties = {};
+  const required = [];
+  for (const [key, val] of Object.entries(shape)) {
+    const zodVal = val;
+    properties[key] = { type: "string" };
+    if (zodVal.description) properties[key].description = zodVal.description;
+    if (!(zodVal instanceof z3.ZodOptional)) required.push(key);
+  }
+  return {
+    type: "function",
+    function: {
+      name: tool.name,
+      description: tool.description,
+      parameters: { type: "object", properties, required }
+    }
+  };
+}
+var OpenAIProvider = class {
+  constructor(apiKey, model, baseUrl = "https://api.openai.com/v1") {
+    this.apiKey = apiKey;
+    this.model = model;
+    this.baseUrl = baseUrl;
+  }
+  apiKey;
+  model;
+  baseUrl;
+  async chat(opts) {
+    const body = {
+      model: this.model,
+      max_tokens: opts.maxTokens ?? 8e3,
+      messages: opts.messages.map((m) => ({ role: m.role, content: m.content }))
+    };
+    if (opts.tools?.length) body.tools = opts.tools.map(toolToOpenAIDef);
+    const res = await fetch(`${this.baseUrl}/chat/completions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new AfterhoursError(`OpenAI API error ${res.status}: ${err}`);
+    }
+    const data = await res.json();
+    const choice = data.choices[0];
+    const text = choice?.message.content ?? "";
+    const toolCalls = (choice?.message.tool_calls ?? []).map((tc) => ({
+      id: tc.id,
+      name: tc.function.name,
+      arguments: JSON.parse(tc.function.arguments)
+    }));
+    const finishReason = choice?.finish_reason;
+    const stopReason = finishReason === "tool_calls" ? "tool_use" : finishReason === "length" ? "max_tokens" : "end_turn";
+    return { text, toolCalls, stopReason };
+  }
+};
+
+// src/llm/ollama.ts
+var OllamaProvider = class {
+  constructor(model, baseUrl = "http://localhost:11434") {
+    this.model = model;
+    this.baseUrl = baseUrl;
+    this.openai = new OpenAIProvider("ollama", model, `${baseUrl}/v1`);
+  }
+  model;
+  baseUrl;
+  openai;
+  async chat(opts) {
+    try {
+      return await this.openai.chat(opts);
+    } catch {
+      return this.chatJsonFallback(opts);
+    }
+  }
+  async chatJsonFallback(opts) {
+    const toolsDescription = (opts.tools ?? []).map((t) => `${t.name}: ${t.description}`).join("\n");
+    const systemInstructions = opts.tools?.length ? `You are a helpful assistant. When you need to use a tool, respond ONLY with a JSON object in this exact format: {"tool":"<tool_name>","args":{...}}. Available tools:
+${toolsDescription}` : void 0;
+    const messages = [...opts.messages];
+    if (systemInstructions) {
+      messages.unshift({ role: "system", content: systemInstructions });
+    }
+    const body = {
+      model: this.model,
+      messages: messages.map((m) => ({ role: m.role, content: m.content })),
+      stream: false,
+      format: opts.tools?.length ? "json" : void 0
+    };
+    const res = await fetch(`${this.baseUrl}/api/chat`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new AfterhoursError(`Ollama API error ${res.status}: ${err}`);
+    }
+    const data = await res.json();
+    const rawContent = data.message.content;
+    if (opts.tools?.length) {
+      try {
+        const parsed = JSON.parse(rawContent);
+        if (parsed.tool) {
+          return {
+            text: "",
+            toolCalls: [{ id: `call_${Date.now()}`, name: parsed.tool, arguments: parsed.args ?? {} }],
+            stopReason: "tool_use"
+          };
+        }
+      } catch {
+      }
+    }
+    return { text: rawContent, toolCalls: [], stopReason: "end_turn" };
+  }
+};
+
+// src/llm/github-models.ts
+var GitHubModelsProvider = class {
+  constructor(apiKey, model) {
+    this.model = model;
+    this.openai = new OpenAIProvider(apiKey, model, "https://models.inference.ai.azure.com");
+  }
+  model;
+  openai;
+  chat(opts) {
+    return this.openai.chat(opts);
+  }
+};
+
+// src/llm/gemini.ts
+import { z as z4 } from "zod";
+function toolToGeminiDecl(tool) {
+  const shape = tool.parameters.shape ?? {};
+  const properties = {};
+  const required = [];
+  for (const [key, val] of Object.entries(shape)) {
+    const zodVal = val;
+    properties[key] = { type: "STRING" };
+    if (zodVal.description) properties[key].description = zodVal.description;
+    if (!(zodVal instanceof z4.ZodOptional)) required.push(key);
+  }
+  return {
+    name: tool.name,
+    description: tool.description,
+    parameters: { type: "OBJECT", properties, required }
+  };
+}
+var GeminiProvider = class {
+  constructor(apiKey, model, baseUrl = "https://generativelanguage.googleapis.com/v1beta") {
+    this.apiKey = apiKey;
+    this.model = model;
+    this.baseUrl = baseUrl;
+  }
+  apiKey;
+  model;
+  baseUrl;
+  async chat(opts) {
+    const systemText = opts.messages.filter((m) => m.role === "system").map((m) => m.content).join("\n");
+    const contents = opts.messages.filter((m) => m.role !== "system").map((m) => ({
+      role: m.role === "assistant" ? "model" : "user",
+      parts: [{ text: m.content }]
+    }));
+    const body = {
+      contents,
+      generationConfig: { maxOutputTokens: opts.maxTokens ?? 8e3 }
+    };
+    if (systemText) body.systemInstruction = { parts: [{ text: systemText }] };
+    if (opts.tools?.length) body.tools = [{ functionDeclarations: opts.tools.map(toolToGeminiDecl) }];
+    const res = await fetch(`${this.baseUrl}/models/${this.model}:generateContent`, {
+      method: "POST",
+      headers: {
+        "x-goog-api-key": this.apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new AfterhoursError(`Gemini API error ${res.status}: ${err}`);
+    }
+    const data = await res.json();
+    const candidate = data.candidates?.[0];
+    const parts = candidate?.content?.parts ?? [];
+    let text = "";
+    const toolCalls = [];
+    for (const part of parts) {
+      if (part.text) text += part.text;
+      if (part.functionCall) {
+        toolCalls.push({
+          id: `call_${toolCalls.length}_${part.functionCall.name}`,
+          name: part.functionCall.name,
+          arguments: part.functionCall.args ?? {}
+        });
+      }
+    }
+    const finishReason = candidate?.finishReason;
+    const stopReason = toolCalls.length > 0 ? "tool_use" : finishReason === "MAX_TOKENS" ? "max_tokens" : "end_turn";
+    return { text, toolCalls, stopReason };
+  }
+};
+
+// src/llm/copilot.ts
+var CopilotProvider = class {
+  constructor(githubToken, model, apiBaseUrl = "https://api.githubcopilot.com", tokenUrl = "https://api.github.com/copilot_internal/v2/token") {
+    this.githubToken = githubToken;
+    this.model = model;
+    this.apiBaseUrl = apiBaseUrl;
+    this.tokenUrl = tokenUrl;
+  }
+  githubToken;
+  model;
+  apiBaseUrl;
+  tokenUrl;
+  cachedToken;
+  cachedTokenExpiresAt = 0;
+  async getCopilotToken() {
+    const nowSec = Date.now() / 1e3;
+    if (this.cachedToken && this.cachedTokenExpiresAt - 60 > nowSec) {
+      return this.cachedToken;
+    }
+    const res = await fetch(this.tokenUrl, {
+      headers: {
+        Authorization: `token ${this.githubToken}`,
+        "User-Agent": "afterhours"
+      }
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new AfterhoursError(`GitHub Copilot token exchange failed: ${res.status} ${err}`);
+    }
+    const data = await res.json();
+    this.cachedToken = data.token;
+    this.cachedTokenExpiresAt = data.expires_at;
+    return this.cachedToken;
+  }
+  async chat(opts) {
+    const token = await this.getCopilotToken();
+    const body = {
+      model: this.model,
+      max_tokens: opts.maxTokens ?? 8e3,
+      messages: opts.messages.map((m) => ({ role: m.role, content: m.content }))
+    };
+    if (opts.tools?.length) body.tools = opts.tools.map(toolToOpenAIDef);
+    const res = await fetch(`${this.apiBaseUrl}/chat/completions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        "Copilot-Integration-Id": "vscode-chat",
+        "Editor-Version": "afterhours/0.2.0"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      throw new AfterhoursError(`GitHub Copilot API error ${res.status}: ${err}`);
+    }
+    const data = await res.json();
+    const choice = data.choices[0];
+    const text = choice?.message.content ?? "";
+    const toolCalls = (choice?.message.tool_calls ?? []).map((tc) => ({
+      id: tc.id,
+      name: tc.function.name,
+      arguments: JSON.parse(tc.function.arguments)
+    }));
+    const finishReason = choice?.finish_reason;
+    const stopReason = finishReason === "tool_calls" ? "tool_use" : finishReason === "length" ? "max_tokens" : "end_turn";
+    return { text, toolCalls, stopReason };
+  }
+};
+
+// src/llm/index.ts
+function createLlm(config) {
+  const { provider, model, apiKeyEnv, baseUrlEnv } = config.llm;
+  const baseUrl = baseUrlEnv ? readEnv(baseUrlEnv) : void 0;
+  switch (provider) {
+    case "anthropic": {
+      const key = readEnv(apiKeyEnv);
+      if (!key) throw new SecretError(`Missing required env var ${apiKeyEnv} for Anthropic LLM provider`);
+      return new AnthropicProvider(key, model, baseUrl ?? "https://api.anthropic.com");
+    }
+    case "openai": {
+      const key = readEnv(apiKeyEnv);
+      if (!key) throw new SecretError(`Missing required env var ${apiKeyEnv} for OpenAI LLM provider`);
+      return new OpenAIProvider(key, model, baseUrl ?? "https://api.openai.com/v1");
+    }
+    case "ollama":
+      return new OllamaProvider(model, baseUrl ?? "http://localhost:11434");
+    case "github-models": {
+      const key = readEnv(apiKeyEnv);
+      if (!key) throw new SecretError(`Missing required env var ${apiKeyEnv} for GitHub Models LLM provider`);
+      return new GitHubModelsProvider(key, model);
+    }
+    case "gemini": {
+      const key = readEnv(apiKeyEnv);
+      if (!key) throw new SecretError(`Missing required env var ${apiKeyEnv} for Gemini LLM provider`);
+      return new GeminiProvider(key, model, baseUrl ?? "https://generativelanguage.googleapis.com/v1beta");
+    }
+    case "copilot": {
+      const key = readEnv(apiKeyEnv);
+      if (!key) throw new SecretError(`Missing required env var ${apiKeyEnv} for GitHub Copilot LLM provider (a GitHub token for a Copilot-licensed account)`);
+      return new CopilotProvider(key, model, baseUrl ?? "https://api.githubcopilot.com");
+    }
+    default:
+      throw new ConfigError(`Unknown LLM provider: "${provider}". Must be one of: anthropic, openai, ollama, github-models, gemini, copilot`);
+  }
+}
+
+// src/agent/loop.ts
+async function runAgentLoop(opts) {
+  const maxIterations = opts.maxIterations ?? 30;
+  const transcript = [];
+  const filesChanged = [];
+  let summary = "";
+  const messages = [
+    { role: "user", content: opts.goal }
+  ];
+  transcript.push({ role: "system", content: opts.systemPrompt });
+  transcript.push({ role: "user", content: opts.goal });
+  for (let iter = 0; iter < maxIterations; iter++) {
+    const response = await opts.llm.chat({
+      messages: [
+        { role: "system", content: opts.systemPrompt },
+        ...messages
+      ],
+      tools: opts.tools,
+      maxTokens: opts.maxTokens
+    });
+    if (response.text) {
+      transcript.push({ role: "assistant", content: response.text });
+      summary = response.text;
+    }
+    if (response.stopReason === "end_turn" || response.toolCalls.length === 0) {
+      return { summary, filesChanged, transcript, stopReason: "done" };
+    }
+    if (response.stopReason === "max_tokens") {
+      return { summary, filesChanged, transcript, stopReason: "max_tokens" };
+    }
+    const assistantMsg = {
+      role: "assistant",
+      content: response.text || `[tool calls: ${response.toolCalls.map((tc) => tc.name).join(", ")}]`
+    };
+    messages.push(assistantMsg);
+    for (const toolCall of response.toolCalls) {
+      const toolResult = await executeToolCall(toolCall, opts.registry, filesChanged);
+      const toolResultMsg = {
+        role: "user",
+        content: `[Tool result for ${toolCall.name} (id=${toolCall.id})]: ${toolResult}`
+      };
+      messages.push(toolResultMsg);
+      transcript.push({ role: "tool", content: `${toolCall.name}: ${toolResult}` });
+    }
+  }
+  return { summary, filesChanged, transcript, stopReason: "max_iterations" };
+}
+async function executeToolCall(toolCall, registry, filesChanged) {
+  const fn = registry[toolCall.name];
+  if (!fn) {
+    return `[Error: unknown tool "${toolCall.name}"]`;
+  }
+  try {
+    const result = await fn(toolCall.arguments);
+    if (toolCall.name === "write_file" && toolCall.arguments.path) {
+      filesChanged.push(String(toolCall.arguments.path));
+    }
+    return result;
+  } catch (err) {
+    return `[Error: ${err}]`;
+  }
+}
+
+// src/agent/tools/fs.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync, readdirSync, statSync } from "fs";
+import { join as join3, resolve, relative } from "path";
+import { z as z5 } from "zod";
+var MAX_FILE_SIZE = 1e5;
+var MAX_SEARCH_RESULTS = 50;
+function assertSafePath(repoRoot, filePath) {
+  const abs = resolve(repoRoot, filePath);
+  const rel = relative(repoRoot, abs);
+  if (rel.startsWith("..") || abs !== join3(repoRoot, rel)) {
+    throw new Error(`Path traversal rejected: ${filePath}`);
+  }
+  return abs;
+}
+var readFileTool = {
+  name: "read_file",
+  description: "Read the contents of a file in the repository.",
+  parameters: z5.object({
+    path: z5.string().describe("Repo-relative path to the file")
+  })
+};
+function readFile(repoRoot, path) {
+  const abs = assertSafePath(repoRoot, path);
+  if (!existsSync3(abs)) throw new Error(`File not found: ${path}`);
+  const stat = statSync(abs);
+  if (stat.size > MAX_FILE_SIZE) return `[File too large to read: ${stat.size} bytes]`;
+  return readFileSync3(abs, "utf8");
+}
+var writeFileTool = {
+  name: "write_file",
+  description: "Write content to a file in the repository, creating it if needed.",
+  parameters: z5.object({
+    path: z5.string().describe("Repo-relative path to write to"),
+    content: z5.string().describe("Full content to write")
+  })
+};
+function writeFile(repoRoot, path, content) {
+  const abs = assertSafePath(repoRoot, path);
+  writeFileSync(abs, content, "utf8");
+}
+var listDirTool = {
+  name: "list_dir",
+  description: "List files and directories under a path in the repository.",
+  parameters: z5.object({
+    path: z5.string().describe("Repo-relative path to list (defaults to root if empty)")
+  })
+};
+function listDir(repoRoot, dirPath) {
+  const abs = assertSafePath(repoRoot, dirPath || ".");
+  if (!existsSync3(abs)) return `Directory not found: ${dirPath}`;
+  const entries = readdirSync(abs, { withFileTypes: true });
+  return entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).join("\n");
+}
+var searchTextTool = {
+  name: "search_text",
+  description: "Search for a text pattern (literal or regex) across repository files.",
+  parameters: z5.object({
+    pattern: z5.string().describe("Text or regex to search for"),
+    fileGlob: z5.string().optional().describe("Optional glob to restrict search scope"),
+    isRegex: z5.string().optional().describe('Set to "true" to treat pattern as regex')
+  })
+};
+function searchText(repoRoot, pattern, fileGlob, isRegex) {
+  const results = [];
+  const regex = isRegex === "true" ? new RegExp(pattern) : null;
+  function walk(dir) {
+    if (results.length >= MAX_SEARCH_RESULTS) return;
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "dist") continue;
+      const abs = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(abs);
+      } else if (!fileGlob || entry.name.endsWith(fileGlob.replace("*", ""))) {
+        try {
+          const content = readFileSync3(abs, "utf8");
+          const lines = content.split("\n");
+          for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const match = regex ? regex.test(line) : line.includes(pattern);
+            if (match) {
+              const rel = relative(repoRoot, abs);
+              results.push(`${rel}:${i + 1}: ${line.trim()}`);
+              if (results.length >= MAX_SEARCH_RESULTS) return;
+            }
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  walk(repoRoot);
+  return results.length > 0 ? results.join("\n") : "No matches found.";
+}
+var applyPatchTool = {
+  name: "apply_patch",
+  description: "Apply a unified diff patch to repository files.",
+  parameters: z5.object({
+    patch: z5.string().describe("Unified diff patch content")
+  })
+};
+function applyPatch(_repoRoot, patch) {
+  const lines = patch.split("\n");
+  if (lines.length === 0) return "Empty patch";
+  return `Patch received (${lines.length} lines). Use write_file for precise edits or shell git-apply.`;
+}
+
+// src/agent/tools/run.ts
+import { z as z6 } from "zod";
+var DENYLISTED_COMMANDS = [
+  /^rm\s+-rf\s+\/\s*/,
+  /^dd\s+if=/,
+  /^mkfs/,
+  /^format\s+c:/i,
+  />\s*\/dev\/sda/
+];
+var MAX_OUTPUT_LENGTH = 2e4;
+var runCommandTool = {
+  name: "run_command",
+  description: "Run a shell command in the repository sandbox.",
+  parameters: z6.object({
+    command: z6.string().describe("Shell command to execute"),
+    timeoutSec: z6.number().optional().describe("Timeout in seconds (default 60)")
+  })
+};
+async function runCommand(sandbox, command, timeoutSec = 60) {
+  for (const pattern of DENYLISTED_COMMANDS) {
+    if (pattern.test(command.trim())) {
+      return `[BLOCKED] Command rejected by denylist: ${command}`;
+    }
+  }
+  const result = await sandbox.run(command, { timeoutSec });
+  const combined = `${result.stdout}
+${result.stderr}`.trim();
+  const redacted = redact(combined);
+  const truncated = redacted.length > MAX_OUTPUT_LENGTH ? redacted.slice(0, MAX_OUTPUT_LENGTH) + `
+[Output truncated at ${MAX_OUTPUT_LENGTH} characters]` : redacted;
+  return `exit=${result.code}
+${truncated}`;
+}
+
+// src/agent/index.ts
+function createAgent(llm) {
+  return {
+    async runBuiltin(goal, systemPrompt, ctx) {
+      const tools = [readFileTool, writeFileTool, listDirTool, searchTextTool, applyPatchTool, runCommandTool];
+      const registry = {
+        read_file: (args) => readFile(ctx.repoRoot, String(args.path ?? "")),
+        write_file: (args) => {
+          writeFile(ctx.repoRoot, String(args.path ?? ""), String(args.content ?? ""));
+          return "File written.";
+        },
+        list_dir: (args) => listDir(ctx.repoRoot, String(args.path ?? "")),
+        search_text: (args) => searchText(ctx.repoRoot, String(args.pattern ?? ""), args.fileGlob ? String(args.fileGlob) : void 0, args.isRegex ? String(args.isRegex) : void 0),
+        apply_patch: (args) => applyPatch(ctx.repoRoot, String(args.patch ?? "")),
+        run_command: (args) => runCommand(ctx.sandbox, String(args.command ?? ""), args.timeoutSec ? Number(args.timeoutSec) : 60)
+      };
+      return runAgentLoop({ llm, tools, registry, systemPrompt, goal });
+    }
+  };
+}
+
+// src/util/log.ts
+function createLogger() {
+  return {
+    info(message, meta) {
+      console.info(JSON.stringify({ level: "info", message, meta }));
+    },
+    warn(message, meta) {
+      console.warn(JSON.stringify({ level: "warn", message, meta }));
+    },
+    error(message, meta) {
+      console.error(JSON.stringify({ level: "error", message, meta }));
+    }
+  };
+}
+
+// src/report/model.ts
+function createRunReport(partial) {
+  return {
+    projectType: "library",
+    projectPackageManager: "npm",
+    branch: "",
+    baseBranch: "main",
+    tasks: [],
+    deployments: [],
+    outstandingWork: [],
+    ...partial
+  };
+}
+
+// src/notify/platform.ts
+var PlatformNotifier = class {
+  constructor(provider, activePr) {
+    this.provider = provider;
+    this.activePr = activePr;
+  }
+  provider;
+  activePr;
+  async send(event) {
+    if (!this.provider.capabilities.comments && !this.provider.capabilities.pullRequests) {
+      console.log(`[notify/platform] ${event.type}: ${event.title}`);
+      return;
+    }
+    const body = `**${event.title}**
+
+${event.body}`;
+    if (this.activePr && this.provider.capabilities.comments) {
+      await this.provider.comment(this.activePr, body);
+    }
+  }
+};
+
+// src/notify/email.ts
+function getEnvOrThrow(name, label) {
+  if (!name) throw new SecretError(`Email notifier missing config field: ${label}`);
+  const val = process.env[name];
+  if (!val) throw new SecretError(`Email notifier: env var ${name} (${label}) is not set`);
+  return val;
+}
+var EmailNotifier = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  async send(event) {
+    const to = getEnvOrThrow(this.config.toEnv, "toEnv");
+    const from = getEnvOrThrow(this.config.fromEnv, "fromEnv");
+    const smtpHost = getEnvOrThrow(this.config.smtp?.hostEnv, "smtp.hostEnv");
+    const smtpPort = Number(getEnvOrThrow(this.config.smtp?.portEnv, "smtp.portEnv") || "587");
+    const smtpUser = getEnvOrThrow(this.config.smtp?.userEnv, "smtp.userEnv");
+    const smtpPass = getEnvOrThrow(this.config.smtp?.passEnv, "smtp.passEnv");
+    const nodemailer = await import("nodemailer").catch(() => null);
+    if (!nodemailer) {
+      console.log(`[notify/email] nodemailer not installed \u2014 skipping email to ${redact(to)}`);
+      return;
+    }
+    const transport = nodemailer.default.createTransport({
+      host: smtpHost,
+      port: smtpPort,
+      secure: smtpPort === 465,
+      auth: { user: smtpUser, pass: smtpPass }
+    });
+    await transport.sendMail({
+      from,
+      to,
+      subject: `[afterhours] ${event.title}`,
+      text: event.body,
+      html: `<pre>${event.body}</pre>`
+    });
+  }
+};
+
+// src/notify/webhook.ts
+import { createHmac } from "crypto";
+var MAX_RETRIES = 3;
+var RETRY_DELAY_MS = 1e3;
+var WebhookNotifier = class {
+  urlEnv;
+  secretEnv;
+  constructor(config) {
+    this.urlEnv = config.urlEnv;
+    this.secretEnv = config.secretEnv;
+  }
+  async send(event) {
+    const url = process.env[this.urlEnv];
+    if (!url) throw new SecretError(`Webhook notifier: env var ${this.urlEnv} is not set`);
+    const payload = JSON.stringify({ type: event.type, title: event.title, body: redact(event.body), data: event.data });
+    const secret = this.secretEnv ? process.env[this.secretEnv] : void 0;
+    const headers = { "Content-Type": "application/json" };
+    if (secret) {
+      const sig = createHmac("sha256", secret).update(payload).digest("hex");
+      headers["X-Afterhours-Signature"] = `sha256=${sig}`;
+    }
+    let lastError = null;
+    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+      if (attempt > 0) await new Promise((r) => setTimeout(r, RETRY_DELAY_MS * attempt));
+      try {
+        const res = await fetch(url, { method: "POST", headers, body: payload });
+        if (res.ok || res.status < 500) return;
+        lastError = new Error(`Webhook returned ${res.status}`);
+      } catch (err) {
+        lastError = err instanceof Error ? err : new Error(String(err));
+      }
+    }
+    throw lastError ?? new Error("Webhook failed after retries");
+  }
+};
+
+// src/notify/index.ts
+var logger = createLogger();
+function createNotifiers(config) {
+  const notifiers = [];
+  for (const n of config.notifications) {
+    switch (n.type) {
+      case "github":
+        if (config.provider) {
+          notifiers.push(new PlatformNotifier(config.provider, config.activePr));
+        }
+        break;
+      case "email":
+        notifiers.push(new EmailNotifier({ toEnv: n.toEnv, fromEnv: n.fromEnv, smtp: n.smtp }));
+        break;
+      case "webhook":
+        if (n.urlEnv) notifiers.push(new WebhookNotifier({ urlEnv: n.urlEnv }));
+        break;
+    }
+  }
+  return notifiers;
+}
+async function dispatch(notifiers, event) {
+  const redactedBody = redact(event.body);
+  const redactedEvent = { ...event, body: redactedBody };
+  await Promise.allSettled(
+    notifiers.map(async (n) => {
+      try {
+        await n.send(redactedEvent);
+      } catch (err) {
+        logger.warn(`Notifier send failed (type: ${redactedEvent.type}): ${err}`);
+      }
+    })
+  );
+}
+
+// src/git/index.ts
+import { simpleGit } from "simple-git";
+function createGit(cwd) {
+  return simpleGit(cwd ? { baseDir: cwd } : {});
+}
+async function createBranch(name, from, cwd) {
+  const g = createGit(cwd);
+  if (from) {
+    await g.checkoutBranch(name, from);
+  } else {
+    await g.checkoutLocalBranch(name);
+  }
+}
+async function checkout(name, cwd) {
+  await createGit(cwd).checkout(name);
+}
+async function stageAll(cwd) {
+  await createGit(cwd).add(".");
+}
+async function commit(msg, cwd) {
+  await createGit(cwd).commit(msg);
+}
+async function resetHard(ref, cwd) {
+  await createGit(cwd).reset(["--hard", ref]);
+}
+async function push(remote, branch, setUpstream, cwd) {
+  const args = setUpstream ? ["-u", remote, branch] : [remote, branch];
+  await createGit(cwd).push(args);
+}
+async function headSha(cwd) {
+  return (await createGit(cwd).revparse(["HEAD"])).trim();
+}
+
+// src/orchestrator/run.ts
+import { join as join4 } from "path";
+
+// src/orchestrator/verify-gate.ts
+async function runVerifyGate(ctx) {
+  const steps = [];
+  if (ctx.buildCmd !== "none") {
+    const result = await ctx.sandbox.run(ctx.buildCmd);
+    const step = {
+      name: "build",
+      ok: result.code === 0,
+      code: result.code,
+      stdout: result.stdout,
+      stderr: result.stderr
+    };
+    steps.push(step);
+    if (!step.ok) {
+      return { ok: false, steps };
+    }
+  }
+  if (ctx.projectType !== "library" && ctx.runCmd) {
+    const healthcheck = ctx.runHealthcheck;
+    let smokeOk = false;
+    if (healthcheck?.type === "http" && healthcheck.url) {
+      const handle = await ctx.sandbox.start(ctx.runCmd);
+      const timeoutSec = healthcheck.timeoutSec ?? 30;
+      smokeOk = await waitForHttpHealthcheck(healthcheck.url, timeoutSec);
+      await handle.stop();
+    } else if (healthcheck?.type === "exit") {
+      const result = await ctx.sandbox.run(ctx.runCmd, { timeoutSec: healthcheck.timeoutSec });
+      smokeOk = result.code === 0;
+    } else {
+      const handle = await ctx.sandbox.start(ctx.runCmd);
+      await new Promise((r) => setTimeout(r, 1e3));
+      await handle.stop();
+      smokeOk = true;
+    }
+    steps.push({ name: "smoke", ok: smokeOk });
+    if (!smokeOk) {
+      return { ok: false, steps };
+    }
+  } else {
+    steps.push({ name: "smoke", ok: true, skipped: true });
+  }
+  if (ctx.testCmd && ctx.testCmd !== "none") {
+    const result = await ctx.sandbox.run(ctx.testCmd);
+    const step = {
+      name: "test",
+      ok: result.code === 0,
+      code: result.code,
+      stdout: result.stdout,
+      stderr: result.stderr
+    };
+    steps.push(step);
+    if (!step.ok) {
+      return { ok: false, steps };
+    }
+  } else {
+    steps.push({ name: "test", ok: true, skipped: true });
+  }
+  return { ok: true, steps };
+}
+async function waitForHttpHealthcheck(url, timeoutSec) {
+  const deadline = Date.now() + timeoutSec * 1e3;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(url);
+      if (res.ok) return true;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  return false;
+}
+
+// src/agent/prompts.ts
+var CODE_OPTIMIZATION_PROMPT = `You are afterhours, an autonomous maintenance agent.
+Your task is to implement code improvements from a pre-analyzed findings list.
+Each finding has already been graded; you are applying the fixes.
+
+Guidelines:
+- Make MINIMAL changes required to address each finding. Do not gold-plate.
+- Preserve existing behavior. Do not change APIs or interfaces unless the finding explicitly asks.
+- Do not leak secrets. Never print API keys or tokens.
+- After applying a fix, verify it by running the tests if possible.
+- When you finish a finding, respond with a summary. Then stop if all findings are addressed.
+`;
+var ISSUE_RESOLUTION_PROMPT = `You are afterhours, an autonomous maintenance agent.
+Your task is to resolve a single issue reported in this repository's issue tracker.
+You have access to the repository files and a sandbox to run commands.
+
+Guidelines:
+- Make MINIMAL, reversible changes that directly address the issue. Do not refactor unrelated code.
+- After each change, run the build/tests if possible to verify correctness.
+- Do not leak secrets. Never print API keys or tokens.
+- When you are done, stop by responding with a plain text summary of what was changed.
+- If you cannot resolve the issue, stop and explain what is blocking you; do not guess or fabricate a fix.
+`;
+
+// src/tasks/issue-triage/match.ts
+function isAuthorAllowed(author, allowedAuthors) {
+  if (allowedAuthors.some((a) => a.trim() === "*")) return true;
+  return allowedAuthors.some((a) => a.toLowerCase() === author.toLowerCase());
+}
+
+// src/tasks/issue-triage/index.ts
+async function runIssueTriage(ctx, opts = {}) {
+  const { config, provider, sandbox, agent, projectInfo, logger: logger2, report, repoRoot, mainBranch } = ctx;
+  const triageConfig = config.tasks.issueTriage;
+  if (!triageConfig.enabled) return;
+  if (!provider.capabilities.issues) {
+    logger2.info(`Platform provider "${provider.name}" does not support issues; skipping issue triage.`);
+    return;
+  }
+  let issues;
+  try {
+    issues = await provider.listIssues();
+  } catch (err) {
+    logger2.warn(`Issue triage: failed to list issues: ${err}`);
+    return;
+  }
+  const matched = issues.filter((issue) => isAuthorAllowed(issue.author, triageConfig.allowedAuthors));
+  if (matched.length === 0) {
+    logger2.info("Issue triage: no open issues match the configured authors.");
+    return;
+  }
+  logger2.info(`Issue triage: ${matched.length} issue(s) matched configured authors.`);
+  const notifiers = createNotifiers({ notifications: config.notifications, provider });
+  for (const issue of matched) {
+    await triageOneIssue(issue, {
+      config,
+      provider,
+      sandbox,
+      agent,
+      projectInfo,
+      logger: logger2,
+      report,
+      repoRoot,
+      mainBranch,
+      notifiers,
+      dryRun: opts.dryRun ?? false
+    });
+  }
+}
+async function triageOneIssue(issue, ctx) {
+  const { config, provider, sandbox, agent, projectInfo, logger: logger2, report, repoRoot, mainBranch, notifiers, dryRun } = ctx;
+  const triageConfig = config.tasks.issueTriage;
+  const taskId = `issue-${issue.number}`;
+  const title = `Issue #${issue.number}: ${issue.title}`;
+  if (dryRun) {
+    logger2.info(`[dry-run] Would attempt to resolve issue #${issue.number}: ${issue.title}`);
+    report.tasks.push({ taskId, title, status: "skipped", gateSteps: [], summary: "Dry-run: issue triage skipped." });
+    return;
+  }
+  const branchName = `${config.platform.branchPrefix}issue-${issue.number}`;
+  logger2.info(`Issue triage: attempting to resolve issue #${issue.number} on branch ${branchName}`);
+  try {
+    await createBranch(branchName, config.platform.baseBranch, repoRoot);
+    const goal = `Resolve the following issue in this repository.
+
+Title: ${issue.title}
+
+Description:
+${issue.body || "(no description provided)"}
+
+Make the minimal code changes necessary to fix or implement this issue.`;
+    const result = await agent.runBuiltin(goal, ISSUE_RESOLUTION_PROMPT, { repoRoot, sandbox });
+    if (result.filesChanged.length === 0) {
+      await checkout(mainBranch, repoRoot);
+      const reason = "Agent made no changes while attempting to resolve this issue.";
+      await provider.commentOnIssue(issue, `Automated resolution attempt did not produce any changes.
+
+${result.summary}`);
+      report.tasks.push({ taskId, title, status: "failed", gateSteps: [], summary: reason });
+      report.outstandingWork.push(`${title}: ${reason}`);
+      if (triageConfig.notifyOnFailure) {
+        await dispatch(notifiers, { type: "task-failed", title: `${title}: no changes made`, body: reason });
+      }
+      return;
+    }
+    const gate = await runVerifyGate({
+      sandbox,
+      buildCmd: projectInfo.build,
+      testCmd: projectInfo.test,
+      projectType: projectInfo.type
+    });
+    if (!gate.ok) {
+      await checkout(mainBranch, repoRoot);
+      const failedStep = gate.steps.find((s) => !s.ok && !s.skipped);
+      const reason = `Verify gate failed at step: ${failedStep?.name ?? "unknown"}`;
+      await provider.commentOnIssue(issue, `Automated resolution attempt failed verification (${reason}).
+
+${result.summary}`);
+      report.tasks.push({ taskId, title, status: "outstanding", gateSteps: gate.steps, summary: result.summary, outstandingReason: reason });
+      report.outstandingWork.push(`${title}: ${reason}`);
+      if (triageConfig.notifyOnFailure) {
+        await dispatch(notifiers, { type: "task-failed", title: `${title}: verify gate failed`, body: reason });
+      }
+      return;
+    }
+    await stageAll(repoRoot);
+    await commit(`afterhours(issue-${issue.number}): ${issue.title}`, repoRoot);
+    const commitSha = await headSha(repoRoot);
+    await push(config.platform.remote, branchName, true, repoRoot);
+    let prUrl;
+    if (provider.capabilities.pullRequests) {
+      const pr = await provider.openPullRequest({
+        title: `Fix #${issue.number}: ${issue.title}`,
+        body: `Closes #${issue.number}
+
+${result.summary}`,
+        head: branchName,
+        base: config.platform.baseBranch
+      });
+      prUrl = pr.url;
+      if (config.platform.autoMerge) {
+        await provider.mergePullRequest(pr, config.platform.mergeStrategy);
+      }
+    }
+    await provider.closeIssue(issue, `Resolved automatically by afterhours.${prUrl ? ` See ${prUrl}.` : ""}
+
+${result.summary}`);
+    await checkout(mainBranch, repoRoot);
+    report.tasks.push({ taskId, title, status: "changed", commit: commitSha, gateSteps: gate.steps, summary: result.summary });
+    await dispatch(notifiers, { type: "task-succeeded", title: `${title}: resolved`, body: result.summary });
+  } catch (err) {
+    logger2.warn(`Issue triage: unexpected error resolving issue #${issue.number}: ${err}`);
+    try {
+      await provider.commentOnIssue(issue, `Automated resolution attempt encountered an error: ${err}`);
+    } catch (commentErr) {
+      logger2.warn(`Issue triage: failed to comment on issue #${issue.number}: ${commentErr}`);
+    }
+    try {
+      await checkout(mainBranch, repoRoot);
+    } catch {
+    }
+    report.tasks.push({ taskId, title, status: "failed", gateSteps: [], summary: `Error: ${err}` });
+    report.outstandingWork.push(`${title}: unexpected error: ${err}`);
+  }
+}
+
+// src/orchestrator/run.ts
+async function runOrchestrator(tasks, opts = {}) {
+  const repoRoot = opts.repoRoot ?? process.cwd();
+  const config = loadConfig(repoRoot);
+  const logger2 = createLogger();
+  const runId = `run-${Date.now()}`;
+  logger2.info(`Starting afterhours run ${runId}`, { dryRun: opts.dryRun });
+  const pm = config.project.packageManager !== "auto" ? config.project.packageManager : detectPackageManager(repoRoot);
+  const type = config.project.type !== "auto" ? config.project.type : detectProjectType(repoRoot);
+  const cmds = detectCommands(repoRoot, pm);
+  const projectInfo = {
+    type,
+    packageManager: pm,
+    build: typeof config.project.build !== "string" || config.project.build === "auto" ? cmds.build : config.project.build,
+    test: typeof config.project.test !== "string" || config.project.test === "auto" ? cmds.test : config.project.test,
+    run: typeof config.project.run !== "string" || config.project.run === "auto" ? cmds.run : config.project.run
+  };
+  const branchName = `${config.platform.branchPrefix}${runId}`;
+  const report = createRunReport({
+    id: runId,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    projectType: type,
+    projectPackageManager: pm,
+    branch: branchName,
+    baseBranch: config.platform.baseBranch
+  });
+  if (opts.dryRun) {
+    logger2.info("Dry-run mode: skipping branch creation and commits");
+  } else {
+    await createBranch(branchName, config.platform.baseBranch, repoRoot);
+  }
+  const provider = createProvider({ platform: config.platform });
+  const sandbox = createSandbox({ sandbox: config.sandbox, mountDir: repoRoot });
+  const llm = createLlm({ llm: config.llm });
+  const agent = createAgent(llm);
+  const notifiers = createNotifiers({ notifications: config.notifications, provider });
+  await dispatch(notifiers, { type: "run-started", title: `afterhours run ${runId} started`, body: `Branch: ${branchName}` });
+  const ctx = { config, sandbox, provider, agent, projectInfo, logger: logger2, report, repoRoot };
+  let hasSharedBranchCommits = false;
+  const enabledTasks = tasks.filter((t) => {
+    if (opts.taskFilter && t.id !== opts.taskFilter) return false;
+    if (opts.noDeploy && t.id === "deployment") return false;
+    return t.isEnabled(config);
+  });
+  for (const task of enabledTasks) {
+    logger2.info(`Running task: ${task.title}`);
+    const snapshotSha = opts.dryRun ? "" : await headSha(repoRoot);
+    let outcome;
+    try {
+      outcome = await task.execute(ctx);
+    } catch (err) {
+      outcome = { status: "failed", summary: `Task threw: ${err}`, details: String(err) };
+    }
+    if (outcome.status === "changed" && !opts.dryRun) {
+      const gate = await runVerifyGate({
+        sandbox,
+        buildCmd: projectInfo.build,
+        testCmd: projectInfo.test,
+        projectType: type
+      });
+      if (gate.ok) {
+        await stageAll(repoRoot);
+        const commitSha = await (async () => {
+          await commit(`afterhours(${task.id}): ${task.title}`, repoRoot);
+          return headSha(repoRoot);
+        })();
+        report.tasks.push({
+          taskId: task.id,
+          title: task.title,
+          status: "changed",
+          commit: commitSha,
+          gateSteps: gate.steps,
+          summary: outcome.summary,
+          details: outcome.details
+        });
+        await dispatch(notifiers, { type: "task-succeeded", title: `${task.title}: succeeded`, body: outcome.summary });
+        hasSharedBranchCommits = true;
+      } else {
+        if (snapshotSha) await resetHard(snapshotSha, repoRoot);
+        const failedStep = gate.steps.find((s) => !s.ok && !s.skipped);
+        const reason = `Verify gate failed at step: ${failedStep?.name ?? "unknown"}`;
+        report.tasks.push({
+          taskId: task.id,
+          title: task.title,
+          status: "outstanding",
+          gateSteps: gate.steps,
+          summary: outcome.summary,
+          outstandingReason: reason
+        });
+        report.outstandingWork.push(`${task.title}: ${reason}`);
+        await dispatch(notifiers, { type: "task-failed", title: `${task.title}: verify gate failed`, body: reason });
+      }
+    } else {
+      report.tasks.push({
+        taskId: task.id,
+        title: task.title,
+        status: outcome.status,
+        gateSteps: [],
+        summary: outcome.summary
+      });
+      if (outcome.status === "failed") {
+        await dispatch(notifiers, { type: "task-failed", title: `${task.title}: failed`, body: outcome.summary });
+      }
+    }
+  }
+  if (!opts.taskFilter || opts.taskFilter === "issue-triage") {
+    await runIssueTriage(
+      { config, provider, sandbox, agent, projectInfo, logger: logger2, report, repoRoot, mainBranch: branchName },
+      { dryRun: opts.dryRun }
+    );
+  }
+  report.completedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const hasCommits = hasSharedBranchCommits;
+  if (hasCommits && !opts.dryRun) {
+    await push(config.platform.remote, branchName, true, repoRoot);
+    if (provider.capabilities.pullRequests) {
+      const { renderMarkdown } = await import("./report-2P72ZPRH.js");
+      const pr = await provider.openPullRequest({
+        title: `afterhours: automated maintenance (${runId})`,
+        body: renderMarkdown(report),
+        head: branchName,
+        base: config.platform.baseBranch
+      });
+      report.pr = { id: pr.id, url: pr.url, number: pr.number };
+      if (config.platform.autoMerge && report.tasks.every((t) => t.status !== "failed" && t.status !== "outstanding")) {
+        await provider.mergePullRequest(pr, config.platform.mergeStrategy);
+        report.pr.merged = true;
+      }
+    }
+  }
+  const reportsDir = join4(repoRoot, ".afterhours", "reports");
+  writeReports(report, reportsDir);
+  await dispatch(notifiers, {
+    type: "run-summary",
+    title: `afterhours run ${runId} complete`,
+    body: `Tasks: ${report.tasks.length}, outstanding: ${report.outstandingWork.length}`,
+    data: { reportId: runId }
+  });
+  return report;
+}
+
+// src/tasks/dependency-audit/audit.ts
+async function collectAuditData(sandbox, pm) {
+  const [auditOut, outdatedOut] = await Promise.all([
+    sandbox.run(`${pm === "npm" ? "npm" : pm} audit --json`),
+    sandbox.run(`${pm === "npm" ? "npm" : pm} outdated --json`)
+  ]);
+  const vulnerabilities = parseNpmAudit(auditOut.stdout);
+  const outdated = parseNpmOutdated(outdatedOut.stdout);
+  return { vulnerabilities, outdated };
+}
+function parseNpmAudit(json) {
+  try {
+    const data = JSON.parse(json);
+    if (!data.vulnerabilities) return [];
+    return Object.entries(data.vulnerabilities).map(([name, vuln]) => ({
+      name,
+      severity: vuln.severity ?? "low",
+      vulnerableVersions: vuln.range ?? "",
+      recommendation: Array.isArray(vuln.via) ? vuln.via[0]?.recommendation ?? "" : "",
+      reason: Array.isArray(vuln.via) ? vuln.via[0]?.title ?? "vulnerability" : "vulnerability"
+    }));
+  } catch {
+    return [];
+  }
+}
+function parseNpmOutdated(json) {
+  try {
+    const data = JSON.parse(json);
+    return Object.entries(data).map(([name, info]) => ({
+      name,
+      current: info.current ?? "0.0.0",
+      wanted: info.wanted ?? info.current ?? "0.0.0",
+      latest: info.latest ?? info.wanted ?? "0.0.0",
+      deprecated: info.deprecated
+    }));
+  } catch {
+    return [];
+  }
+}
+
+// src/tasks/dependency-audit/planner.ts
+function semverMajor(version) {
+  return parseInt(version.split(".")[0] ?? "0", 10);
+}
+function planUpgrades(data, config) {
+  const safe = [];
+  const risky = [];
+  const vulnNames = new Set(data.vulnerabilities.map((v) => v.name));
+  for (const dep of data.outdated) {
+    if (dep.current === dep.latest) continue;
+    const isVulnerable = vulnNames.has(dep.name) || dep.deprecated !== void 0;
+    if (config.securityOnly && !isVulnerable) continue;
+    const isMajor = semverMajor(dep.current) < semverMajor(dep.latest);
+    if (isMajor && !config.allowMajor) {
+      risky.push({ name: dep.name, fromVersion: dep.current, toVersion: dep.latest, isMajor: true, reason: "major version bump blocked by allowMajor:false", severity: isVulnerable ? "high" : void 0 });
+      continue;
+    }
+    const item = {
+      name: dep.name,
+      fromVersion: dep.current,
+      toVersion: isMajor ? dep.latest : dep.wanted,
+      isMajor,
+      reason: dep.deprecated ? "deprecated" : isVulnerable ? "vulnerability" : "outdated",
+      severity: data.vulnerabilities.find((v) => v.name === dep.name)?.severity
+    };
+    if (isMajor) {
+      if (config.allowMajor) {
+        safe.push(item);
+      } else {
+        risky.push(item);
+      }
+    } else {
+      safe.push(item);
+    }
+  }
+  for (const vuln of data.vulnerabilities) {
+    if (!data.outdated.find((o) => o.name === vuln.name)) {
+      safe.push({ name: vuln.name, fromVersion: "unknown", toVersion: vuln.recommendation || "latest", isMajor: false, reason: "vulnerability", severity: vuln.severity });
+    }
+  }
+  const severityOrder = ["critical", "high", "moderate", "low"];
+  const sortBySeverity = (a, b) => severityOrder.indexOf(a.severity ?? "low") - severityOrder.indexOf(b.severity ?? "low");
+  safe.sort(sortBySeverity);
+  return { safe, risky };
+}
+
+// src/tasks/dependency-audit/index.ts
+var DependencyAuditTask = class {
+  id = "dependency-audit";
+  title = "Dependency Audit & Upgrade";
+  isEnabled(config) {
+    return config.tasks.dependencyAudit.enabled;
+  }
+  async execute(ctx) {
+    const { config, sandbox, projectInfo, logger: logger2, report, agent } = ctx;
+    const auditConfig = config.tasks.dependencyAudit;
+    logger2.info("Collecting audit data...");
+    const auditData = await collectAuditData(sandbox, projectInfo.packageManager);
+    if (auditData.vulnerabilities.length === 0 && auditData.outdated.length === 0) {
+      return { status: "noop", summary: "No vulnerabilities or outdated dependencies found." };
+    }
+    const plan = planUpgrades(auditData, { securityOnly: auditConfig.securityOnly, allowMajor: auditConfig.allowMajor });
+    logger2.info(`Upgrade plan: ${plan.safe.length} safe, ${plan.risky.length} risky`);
+    const upgraded = [];
+    const failed = [];
+    if (plan.safe.length > 0) {
+      const installCmd = buildInstallCmd(plan.safe, projectInfo.packageManager);
+      const installResult = await sandbox.run(installCmd, { timeoutSec: 300 });
+      if (installResult.code !== 0) {
+        logger2.warn("Safe batch install failed; trying to fix with agent...");
+        const agentResult = await agent.runBuiltin(
+          `The following packages failed to install: ${plan.safe.map((u) => `${u.name}@${u.toVersion}`).join(", ")}. Error: ${installResult.stderr}. Fix the package.json/code breaking changes.`,
+          "You are afterhours. Fix the dependency install failure. Make minimal changes.",
+          { repoRoot: ctx.repoRoot, sandbox }
+        );
+        if (agentResult.stopReason !== "done") {
+          for (const item of plan.safe) {
+            failed.push({ item, reason: `Install failed: ${installResult.stderr.slice(0, 200)}` });
+          }
+        } else {
+          upgraded.push(...plan.safe);
+        }
+      } else {
+        upgraded.push(...plan.safe);
+      }
+    }
+    if (failed.length > 0 && auditConfig.notifyOnFailure) {
+      const notifiers = createNotifiers({ notifications: config.notifications, provider: ctx.provider });
+      for (const { item, reason } of failed) {
+        if (item.reason === "vulnerability" || item.reason === "deprecated") {
+          await dispatch(notifiers, {
+            type: "migration-failed",
+            title: `Migration failed: ${item.name}`,
+            body: `Package: ${item.name}
+Target: ${item.toVersion}
+Reason needed: ${item.reason} (${item.severity ?? "unknown severity"})
+Error: ${reason}`,
+            data: { package: item.name, targetVersion: item.toVersion, reason: item.reason }
+          });
+        }
+      }
+      for (const item of failed) {
+        report.outstandingWork.push(`${item.item.name}@${item.item.toVersion}: ${item.reason}`);
+      }
+    }
+    if (upgraded.length === 0) {
+      return { status: "noop", summary: "Audit complete; no safe upgrades could be applied." };
+    }
+    return {
+      status: "changed",
+      summary: `Upgraded ${upgraded.length} package(s): ${upgraded.map((u) => `${u.name}@${u.toVersion}`).join(", ")}`,
+      details: failed.length > 0 ? `Failed: ${failed.map((f) => f.item.name).join(", ")}` : void 0
+    };
+  }
+};
+function buildInstallCmd(items, pm) {
+  const packages = items.map((u) => `${u.name}@${u.toVersion}`).join(" ");
+  switch (pm) {
+    case "pnpm":
+      return `pnpm add ${packages}`;
+    case "yarn":
+      return `yarn add ${packages}`;
+    case "bun":
+      return `bun add ${packages}`;
+    default:
+      return `npm install ${packages}`;
+  }
+}
+
+// src/tasks/code-optimization/findings.ts
+import { z as z7 } from "zod";
+var FindingSchema = z7.object({
+  title: z7.string(),
+  area: z7.string(),
+  kind: z7.enum(["optimization", "weakness", "vulnerability"]),
+  severity: z7.enum(["low", "medium", "high", "severe"]),
+  rationale: z7.string(),
+  suggestedFix: z7.string(),
+  files: z7.array(z7.string())
+});
+var FindingsSchema = z7.array(FindingSchema);
+var SEVERITY_ORDER = ["severe", "high", "medium", "low"];
+function rankSeverity(s) {
+  return SEVERITY_ORDER.indexOf(s);
+}
+function selectFindings(findings, threshold) {
+  const thresholdRank = rankSeverity(threshold);
+  return findings.filter((f) => rankSeverity(f.severity) <= thresholdRank).sort((a, b) => rankSeverity(a.severity) - rankSeverity(b.severity));
+}
+
+// src/tasks/code-optimization/index.ts
+var ANALYZE_SYSTEM_PROMPT = `You are afterhours. Analyze the codebase and produce a structured JSON array of findings.
+Each finding must have: title, area, kind (optimization|weakness|vulnerability), severity (low|medium|high|severe), rationale, suggestedFix, files.
+Respond ONLY with a valid JSON array, no markdown fences.`;
+var CodeOptimizationTask = class {
+  id = "code-optimization";
+  title = "Code Optimization";
+  isEnabled(config) {
+    return config.tasks.codeOptimization.enabled;
+  }
+  async execute(ctx) {
+    const { config, sandbox, agent, projectInfo, logger: logger2, report } = ctx;
+    const optConfig = config.tasks.codeOptimization;
+    logger2.info("Collecting code intake for analysis...");
+    const intakeResult = await agent.runBuiltin(
+      "List the repository structure and read key source files (src/ directory, README, package.json). Summarize the project.",
+      ANALYZE_SYSTEM_PROMPT,
+      { repoRoot: ctx.repoRoot, sandbox }
+    );
+    logger2.info("Analyzing codebase for findings...");
+    const analysisResult = await agent.runBuiltin(
+      `Based on the project overview:
+
+${intakeResult.summary}
+
+Produce a JSON array of findings (max 20). Focus on: security vulnerabilities, performance, error handling, code quality. Return ONLY JSON.`,
+      ANALYZE_SYSTEM_PROMPT,
+      { repoRoot: ctx.repoRoot, sandbox }
+    );
+    let findings = [];
+    try {
+      const parsed = JSON.parse(analysisResult.summary);
+      const validated = FindingsSchema.parse(Array.isArray(parsed) ? parsed : []);
+      findings = validated;
+    } catch {
+      logger2.warn("Could not parse findings from analysis; no changes will be made.");
+      return { status: "noop", summary: "Analysis did not return valid findings." };
+    }
+    if (findings.length === 0) {
+      return { status: "noop", summary: "No findings from code analysis." };
+    }
+    const selected = selectFindings(findings, optConfig.priorityThreshold);
+    logger2.info(`Selected ${selected.length} finding(s) at or above threshold "${optConfig.priorityThreshold}"`);
+    if (selected.length === 0) {
+      return { status: "noop", summary: `Analysis found ${findings.length} finding(s) but none at/above threshold "${optConfig.priorityThreshold}".` };
+    }
+    const fixed = [];
+    const outstanding = [];
+    for (const finding of selected) {
+      logger2.info(`Fixing: [${finding.severity}] ${finding.title}`);
+      const fixResult = await agent.runBuiltin(
+        `Fix this finding:
+
+Title: ${finding.title}
+Area: ${finding.area}
+Severity: ${finding.severity}
+Rationale: ${finding.rationale}
+Suggested fix: ${finding.suggestedFix}
+Files: ${finding.files.join(", ")}
+
+Make the minimal change required.`,
+        CODE_OPTIMIZATION_PROMPT,
+        { repoRoot: ctx.repoRoot, sandbox }
+      );
+      if (fixResult.filesChanged.length > 0) {
+        const gate = await runVerifyGate({
+          sandbox,
+          buildCmd: projectInfo.build,
+          testCmd: projectInfo.test,
+          projectType: projectInfo.type
+        });
+        if (gate.ok) {
+          fixed.push(finding);
+        } else {
+          outstanding.push(finding);
+          report.outstandingWork.push(`[${finding.severity}] ${finding.title}: fix broke build/tests`);
+        }
+      } else {
+        outstanding.push(finding);
+        report.outstandingWork.push(`[${finding.severity}] ${finding.title}: agent made no changes`);
+      }
+    }
+    if (optConfig.notifyOnComplete) {
+      const notifiers = createNotifiers({ notifications: config.notifications, provider: ctx.provider });
+      await dispatch(notifiers, {
+        type: "run-summary",
+        title: "Code optimization complete",
+        body: `Fixed: ${fixed.length}, Outstanding: ${outstanding.length}
+
+Fixed:
+${fixed.map((f) => `- [${f.severity}] ${f.title}`).join("\n")}
+
+Outstanding:
+${outstanding.map((f) => `- [${f.severity}] ${f.title}`).join("\n")}`
+      });
+    }
+    if (fixed.length === 0) {
+      return { status: "noop", summary: `Analyzed ${findings.length} findings; none could be safely applied.` };
+    }
+    return {
+      status: "changed",
+      summary: `Fixed ${fixed.length} finding(s): ${fixed.map((f) => f.title).join(", ")}`,
+      details: outstanding.length > 0 ? `Outstanding: ${outstanding.map((f) => f.title).join(", ")}` : void 0
+    };
+  }
+};
+
+// src/tasks/deployment/targets.ts
+var DockerTarget = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  type = "docker";
+  validate() {
+    if (!process.env[this.config.registryUserEnv]) throw new Error(`Missing env var ${this.config.registryUserEnv}`);
+    if (!process.env[this.config.registryPassEnv]) throw new Error(`Missing env var ${this.config.registryPassEnv}`);
+  }
+  async deploy(ctx) {
+    const user = process.env[this.config.registryUserEnv] ?? "";
+    const pass = process.env[this.config.registryPassEnv] ?? "";
+    const tag = this.config.tag.includes("${env:") ? process.env[this.config.tag.match(/\$\{env:([^}]+)\}/)?.[1] ?? ""] ?? "latest" : this.config.tag;
+    const fullImage = `${this.config.image}:${tag}`;
+    const context = this.config.context ?? ".";
+    const dockerfile = this.config.dockerfile ? `-f ${this.config.dockerfile}` : "";
+    const build = await ctx.sandbox.run(`docker build ${dockerfile} -t ${fullImage} ${context}`, { cwd: ctx.repoRoot, timeoutSec: 600 });
+    if (build.code !== 0) return { targetType: "docker", status: "failed", error: build.stderr };
+    const login = await ctx.sandbox.run(`echo "${pass}" | docker login --username "${user}" --password-stdin`, { cwd: ctx.repoRoot });
+    if (login.code !== 0) return { targetType: "docker", status: "failed", error: "Docker login failed" };
+    const push2 = await ctx.sandbox.run(`docker push ${fullImage}`, { cwd: ctx.repoRoot, timeoutSec: 300 });
+    if (push2.code !== 0) return { targetType: "docker", status: "failed", error: push2.stderr };
+    return { targetType: "docker", status: "succeeded", url: fullImage };
+  }
+  describe() {
+    return `docker push ${this.config.image}:${this.config.tag}`;
+  }
+};
+var NpmTarget = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  type = "npm";
+  validate() {
+    if (!process.env[this.config.tokenEnv]) throw new Error(`Missing env var ${this.config.tokenEnv}`);
+  }
+  async deploy(ctx) {
+    const token = process.env[this.config.tokenEnv] ?? "";
+    const registry = this.config.registry ?? "https://registry.npmjs.org";
+    const access = this.config.access ?? "public";
+    const pkgJson = JSON.parse((await ctx.sandbox.run("cat package.json", { cwd: ctx.repoRoot })).stdout);
+    const check = await ctx.sandbox.run(`npm view ${pkgJson.name}@${pkgJson.version} version --registry ${registry}`, { cwd: ctx.repoRoot });
+    if (check.code === 0 && check.stdout.trim() === pkgJson.version) {
+      return { targetType: "npm", status: "skipped", url: `${registry}/${pkgJson.name}` };
+    }
+    const npmrc = `//${new URL(registry).host}/:_authToken=${token}
+`;
+    await ctx.sandbox.run(`echo '${npmrc}' >> .npmrc`, { cwd: ctx.repoRoot });
+    const pub = await ctx.sandbox.run(`npm publish --access ${access} --registry ${registry}`, { cwd: ctx.repoRoot });
+    await ctx.sandbox.run("rm -f .npmrc", { cwd: ctx.repoRoot });
+    if (pub.code !== 0) return { targetType: "npm", status: "failed", error: pub.stderr };
+    return { targetType: "npm", status: "succeeded", url: `${registry}/${pkgJson.name}` };
+  }
+  describe() {
+    return `npm publish --access ${this.config.access ?? "public"}`;
+  }
+};
+var GitHubReleaseTarget = class {
+  constructor(config, provider) {
+    this.config = config;
+    this.provider = provider;
+  }
+  config;
+  provider;
+  type = "github-release";
+  validate() {
+    if (!this.provider.capabilities.releases) throw new Error("Provider does not support releases");
+  }
+  async deploy(ctx) {
+    const pkgJson = JSON.parse((await ctx.sandbox.run("cat package.json", { cwd: ctx.repoRoot })).stdout);
+    const tag = `v${pkgJson.version}`;
+    const tagCheck = await ctx.sandbox.run(`git tag -l ${tag}`, { cwd: ctx.repoRoot });
+    if (!tagCheck.stdout.includes(tag)) {
+      await ctx.sandbox.run(`git tag -a ${tag} -m "Release ${tag}"`, { cwd: ctx.repoRoot });
+      await ctx.sandbox.run(`git push origin ${tag}`, { cwd: ctx.repoRoot });
+    }
+    const rel = await this.provider.createRelease({ tag, name: `Release ${tag}`, body: "Automated release by afterhours" });
+    return { targetType: "github-release", status: "succeeded", url: rel.url };
+  }
+  describe() {
+    return `github-release from package.json version`;
+  }
+};
+var VercelTarget = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  type = "vercel";
+  validate() {
+    if (!process.env[this.config.tokenEnv]) throw new Error(`Missing env var ${this.config.tokenEnv}`);
+    if (!process.env[this.config.projectEnv]) throw new Error(`Missing env var ${this.config.projectEnv}`);
+    if (!process.env[this.config.orgEnv]) throw new Error(`Missing env var ${this.config.orgEnv}`);
+  }
+  async deploy(ctx) {
+    const token = process.env[this.config.tokenEnv] ?? "";
+    const projectId = process.env[this.config.projectEnv] ?? "";
+    const orgId = process.env[this.config.orgEnv] ?? "";
+    const prod = this.config.prod ? "--prod" : "";
+    const result = await ctx.sandbox.run(
+      `VERCEL_TOKEN="${token}" VERCEL_PROJECT_ID="${projectId}" VERCEL_ORG_ID="${orgId}" npx vercel deploy ${prod} --yes --token "${token}"`,
+      { cwd: ctx.repoRoot, timeoutSec: 300 }
+    );
+    if (result.code !== 0) return { targetType: "vercel", status: "failed", error: result.stderr };
+    const url = result.stdout.trim().split("\n").find((l) => l.startsWith("https://")) ?? "";
+    return { targetType: "vercel", status: "succeeded", url };
+  }
+  describe() {
+    return `vercel deploy${this.config.prod ? " --prod" : ""}`;
+  }
+};
+var RenderTarget = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  type = "render";
+  validate() {
+    if (!process.env[this.config.apiKeyEnv]) throw new Error(`Missing env var ${this.config.apiKeyEnv}`);
+    if (!process.env[this.config.serviceIdEnv]) throw new Error(`Missing env var ${this.config.serviceIdEnv}`);
+  }
+  async deploy(_ctx) {
+    const apiKey = process.env[this.config.apiKeyEnv] ?? "";
+    const serviceId = process.env[this.config.serviceIdEnv] ?? "";
+    const triggerRes = await fetch(`https://api.render.com/v1/services/${serviceId}/deploys`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ clearCache: "do_not_clear" })
+    });
+    if (!triggerRes.ok) {
+      return { targetType: "render", status: "failed", error: `Render deploy trigger failed: ${triggerRes.status}` };
+    }
+    const deployData = await triggerRes.json();
+    const deployId = deployData.id;
+    for (let i = 0; i < 30; i++) {
+      await new Promise((r) => setTimeout(r, 1e4));
+      const statusRes = await fetch(`https://api.render.com/v1/services/${serviceId}/deploys/${deployId}`, {
+        headers: { Authorization: `Bearer ${apiKey}` }
+      });
+      if (!statusRes.ok) continue;
+      const status = await statusRes.json();
+      if (status.status === "live") {
+        return { targetType: "render", status: "succeeded", url: status.serviceDetails?.url };
+      }
+      if (status.status === "failed" || status.status === "canceled") {
+        return { targetType: "render", status: "failed", error: `Render deploy status: ${status.status}` };
+      }
+    }
+    return { targetType: "render", status: "failed", error: "Render deploy timed out waiting for live status" };
+  }
+  describe() {
+    return `render deploy service ${this.config.serviceIdEnv}`;
+  }
+};
+var CloudStubTarget = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  get type() {
+    return this.config.type;
+  }
+  validate() {
+    const requiredEnvs = [];
+    if (this.config.type === "aws") requiredEnvs.push("AWS_REGION", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY");
+    if (this.config.type === "azure") requiredEnvs.push("AZURE_SUBSCRIPTION_ID", "AZURE_TENANT_ID");
+    if (this.config.type === "gcp") requiredEnvs.push("GCP_PROJECT_ID", "GCP_SERVICE_ACCOUNT_KEY");
+    for (const name of requiredEnvs) {
+      if (!process.env[name]) throw new Error(`Missing env var ${name} for ${this.config.type} target`);
+    }
+  }
+  async deploy(_ctx) {
+    return {
+      targetType: this.config.type,
+      status: "not-implemented",
+      error: `Cloud target "${this.config.type}" is not yet fully implemented. Config was validated. Please deploy manually or contribute an implementation.`
+    };
+  }
+  describe() {
+    return `${this.config.type} cloud deployment (stub \u2014 not implemented)`;
+  }
+};
+
+// src/tasks/deployment/index.ts
+function createDeployTarget(config, ctx) {
+  switch (config.type) {
+    case "docker":
+      return new DockerTarget(config);
+    case "npm":
+      return new NpmTarget(config);
+    case "github-release":
+      return new GitHubReleaseTarget(config, ctx.provider);
+    case "vercel":
+      return new VercelTarget(config);
+    case "render":
+      return new RenderTarget(config);
+    case "aws":
+    case "azure":
+    case "gcp":
+      return new CloudStubTarget(config);
+    default:
+      throw new ConfigError(`Unknown deployment target type: "${config.type}"`);
+  }
+}
+var DeploymentTask = class {
+  id = "deployment";
+  title = "Deployment";
+  isEnabled(config) {
+    return config.tasks.deployment.enabled;
+  }
+  async execute(ctx) {
+    const { config, logger: logger2, report } = ctx;
+    const deployConfig = config.tasks.deployment;
+    if (!deployConfig.enabled) {
+      return { status: "skipped", summary: "Deployment is disabled in config." };
+    }
+    const targets = deployConfig.targets ?? [];
+    if (targets.length === 0) {
+      return { status: "noop", summary: "No deployment targets configured." };
+    }
+    const results = [];
+    let anyFailed = false;
+    for (const targetConfig of targets) {
+      const target = createDeployTarget(targetConfig, ctx);
+      logger2.info(`Deploying: ${target.describe()}`);
+      try {
+        target.validate();
+      } catch (err) {
+        const result2 = { targetType: target.type, status: "failed", error: String(err) };
+        results.push(result2);
+        report.deployments.push(result2);
+        anyFailed = true;
+        continue;
+      }
+      const result = await target.deploy({ sandbox: ctx.sandbox, repoRoot: ctx.repoRoot });
+      results.push(result);
+      report.deployments.push(result);
+      if (result.status === "failed") anyFailed = true;
+    }
+    const succeeded = results.filter((r) => r.status === "succeeded").length;
+    const failed = results.filter((r) => r.status === "failed").length;
+    if (anyFailed) {
+      return { status: "failed", summary: `Deployment: ${succeeded} succeeded, ${failed} failed.`, details: results.map((r) => `${r.targetType}: ${r.status}${r.error ? " - " + r.error : ""}`).join("\n") };
+    }
+    return { status: succeeded > 0 ? "changed" : "noop", summary: `Deployment: ${succeeded} target(s) deployed.` };
+  }
+};
+
+// src/cli/run.ts
+function registerRun(program) {
+  program.command("run").description("Run the afterhours maintenance orchestrator").option("--dry-run", "Preview what would happen without making changes").option("--task <id>", "Run only the specified task").option("--no-deploy", "Skip the deployment task").action(async (opts) => {
+    try {
+      const report = await runOrchestrator(
+        [new DependencyAuditTask(), new CodeOptimizationTask(), new DeploymentTask()],
+        {
+          dryRun: opts.dryRun,
+          taskFilter: opts.task,
+          noDeploy: opts.deploy === false
+        }
+      );
+      console.log(`Run complete: ${report.tasks.length} task(s), ${report.outstandingWork.length} outstanding.`);
+      process.exit(0);
+    } catch (err) {
+      console.error(`Run failed: ${err}`);
+      process.exit(1);
+    }
+  });
+}
+
+// src/cli/report.ts
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+function registerReport(program) {
+  program.command("report").description("Print the latest run report or a specific run by ID").argument("[runId]", "Optional run ID").action((runId) => {
+    const reportsDir = join5(process.cwd(), ".afterhours", "reports");
+    if (!existsSync4(reportsDir)) {
+      console.log("No reports found. Run afterhours run first.");
+      return;
+    }
+    let target = runId;
+    if (!target) {
+      const files = readdirSync2(reportsDir).filter((f) => f.endsWith(".md")).sort();
+      if (files.length === 0) {
+        console.log("No reports found.");
+        return;
+      }
+      target = files[files.length - 1].replace(".md", "");
+    }
+    const mdPath = join5(reportsDir, `${target}.md`);
+    if (!existsSync4(mdPath)) {
+      console.error(`Report not found: ${target}`);
+      process.exit(1);
+    }
+    console.log(readFileSync4(mdPath, "utf8"));
+  });
+}
+
+// src/cli/init.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync, appendFileSync } from "fs";
+import { join as join6 } from "path";
+function registerInit(program) {
+  program.command("init").description("Scaffold afterhours config and an optional scheduler adapter in this repo").option("--force", "Overwrite existing .afterhours/config.yml").option("--scheduler <type>", "Scheduler adapter to install: github | docker-cron | none", "none").action(async (opts) => {
+    const cwd = process.cwd();
+    const configDir = join6(cwd, ".afterhours");
+    const configPath = join6(configDir, "config.yml");
+    const templateDir = getTemplateDir();
+    mkdirSync(configDir, { recursive: true });
+    mkdirSync(join6(configDir, "reports"), { recursive: true });
+    if (!existsSync5(configPath) || opts.force) {
+      let template = readFileSync5(join6(templateDir, "config.yml"), "utf8");
+      const pm = detectPackageManager(cwd);
+      const type = detectProjectType(cwd);
+      if (pm !== "npm") template = template.replace("packageManager: auto", `packageManager: ${pm}`);
+      if (type !== "library") template = template.replace("type: auto", `type: ${type}`);
+      writeFileSync2(configPath, template, "utf8");
+      console.log(`\u2705  Created .afterhours/config.yml`);
+    } else {
+      console.log(`\u23ED  .afterhours/config.yml already exists (use --force to overwrite)`);
+    }
+    const gitignorePath = join6(cwd, ".gitignore");
+    const additions = [".env", ".afterhours/reports/"];
+    if (existsSync5(gitignorePath)) {
+      const existing = readFileSync5(gitignorePath, "utf8");
+      for (const line of additions) {
+        if (!existing.includes(line)) {
+          appendFileSync(gitignorePath, `
+${line}`);
+        }
+      }
+    } else {
+      writeFileSync2(gitignorePath, additions.join("\n") + "\n");
+    }
+    const envExampleSrc = join6(templateDir, "..", ".env.example");
+    const envExampleDst = join6(cwd, ".env.example");
+    if (!existsSync5(envExampleDst) && existsSync5(envExampleSrc)) {
+      writeFileSync2(envExampleDst, readFileSync5(envExampleSrc, "utf8"), "utf8");
+      console.log(`\u2705  Created .env.example`);
+    }
+    if (opts.scheduler === "github") {
+      const ghDir = join6(cwd, ".github", "workflows");
+      mkdirSync(ghDir, { recursive: true });
+      const dst = join6(ghDir, "afterhours.yml");
+      if (!existsSync5(dst)) {
+        writeFileSync2(dst, readFileSync5(join6(templateDir, "github-actions.yml"), "utf8"), "utf8");
+        console.log(`\u2705  Created .github/workflows/afterhours.yml`);
+      } else {
+        console.log(`\u23ED  .github/workflows/afterhours.yml already exists`);
+      }
+    } else if (opts.scheduler === "docker-cron") {
+      const dstDir = join6(cwd, ".afterhours", "docker-cron");
+      mkdirSync(dstDir, { recursive: true });
+      const srcDir = join6(templateDir, "docker-cron");
+      for (const file of ["Dockerfile", "crontab", "README.md"]) {
+        const dst = join6(dstDir, file);
+        if (!existsSync5(dst)) {
+          writeFileSync2(dst, readFileSync5(join6(srcDir, file), "utf8"), "utf8");
+        }
+      }
+      console.log(`\u2705  Created .afterhours/docker-cron/ adapter`);
+    }
+    console.log("\nafterhours is ready! Next steps:");
+    console.log("  1. Review .afterhours/config.yml");
+    console.log("  2. Copy .env.example \u2192 .env and fill in your secrets");
+    console.log("  3. Run: afterhours doctor");
+  });
+}
+function getTemplateDir() {
+  const candidates = [
+    join6(new URL(import.meta.url).pathname, "..", "..", "..", "templates"),
+    join6(process.cwd(), "templates")
+  ];
+  for (const c of candidates) {
+    if (existsSync5(c)) return c;
+  }
+  throw new Error("Templates directory not found. Is afterhours installed?");
+}
+
+// src/cli/main.ts
+function main() {
+  const program = new Command();
+  program.name("afterhours").description("afterhours CLI").version("0.1.0");
+  registerInit(program);
+  registerRun(program);
+  program.command("audit").action(() => console.log("<audit>: not implemented yet"));
+  program.command("optimize").action(() => console.log("<optimize>: not implemented yet"));
+  program.command("deploy").action(() => console.log("<deploy>: not implemented yet"));
+  registerReport(program);
+  registerDoctor(program);
+  void program.parseAsync(process.argv);
+}
+
+// src/index.ts
+main();