@edgehero/pi-dispatch-admin 0.1.3 → 0.1.4

package/README.md

@@ -32,7 +32,7 @@ Every trigger produces the same job, through the same path — one queue, one co
 
 - **The container is the boundary.** pi ships no permission system, so every job runs `--cap-drop=ALL`, non-root, ephemeral, with its instructions mounted read-only. That *is* the missing permission system — enforced by Docker, not hoped for.
 - **Spend is bounded before tokens.** A per-job turn budget plus daily / weekly / monthly caps, checked *before* a container starts. A runaway or a junk trigger costs you a refusal, not a surprise bill.
-- **Three triggers, one job.** A CLI command, a cron schedule, or a GitHub issue/PR — same queue, same box, same budget. Cron is the unattended one: recurring work on your own hardware, in an image you control.
+- **Three triggers, one job.** A CLI command, a cron schedule, or a GitHub issue/PR — same queue, same box, same budget. Cron is the unattended one: recurring work on your own hardware, in an image you control — one per deployment, or one per trigger.
 - **Your image, your tools.** Bake a project's toolchain into the Dockerfile; it ships **Playwright + Chromium**, so a flow can build a frontend, screenshot it, and iterate on the rendered result.
 
 ## The console — `/dispatch`
@@ -45,6 +45,8 @@ This extension puts a live TUI over the whole deployment in one command:
 
 - **Status & spend.** Queue and worker state, day/week/month **spend meters** + a daily token counter, and a run-history table with per-job token & cost.
 - **Triggers, editable live.** cron / label / comment / pull_request, with colored drill-ins showing *what fires* each one, *what it runs*, and its *trust model* — added, edited, and deleted without a restart.
+- **You can see which triggers run third-party code.** A trigger loads the pi packages you pinned into your global overlay **unless** it carries `run.packages: false`, so the ones that do get a **`[packages]`** badge in the trigger list, and their **trust model** names the staged `name@version` set plus the one-line consequence — third-party code, on adversarial input, with open network egress. Declining is deliberately *not* a panel action: it stays an edit to the reviewed `triggers.json`, which neither the console nor a model-callable tool will make for you.
+- **You can see which image each trigger runs.** A trigger may name its own container image with `run.image` (absent = the deployment default), and the trigger list shows the tag while the drill-in states it either way — because which image a job runs *is* which code it runs. Like `packages`, it is display-only: naming an image stays an edit to the reviewed `triggers.json`, which neither the console nor a model-callable tool will make for you.
 - **Quiet hours.** Scheduled pause windows per folder or repo: defer a scope's runs **between certain times** — recurring daily, weekday- and date-bounded, timezone-aware — and resume automatically. Deferred, never dropped, at zero budget cost.
 - **AI-operable, with a human gate.** Model-callable tools let an agent change limits and manage triggers and pause windows — but **every write pops an operator confirmation the model can't answer**, and is refused when no operator is present. The bundled `operate-pi-dispatch` **skill** teaches the agent to use those gates.
 - **Logs stay put.** Raw container output renders only in the overlay viewer, never into model context.
@@ -55,7 +57,7 @@ This extension puts a live TUI over the whole deployment in one command:
 pi install npm:@edgehero/pi-dispatch-admin
 ```
 
-Then run pi and open `/dispatch`. Point it at your deployment with `VALKEY_URL` / `PI_LOGS_DIR` / `PI_SETTINGS_FILE` / `PI_TRIGGERS_FILE` / `PI_PAUSE_WINDOWS_FILE` — the same values your worker uses. It reads that deployment's queue and run history; on its own it will just say "queue unreachable."
+Then run pi and open `/dispatch`. Point it at your deployment with `VALKEY_URL` / `PI_LOGS_DIR` / `PI_SETTINGS_FILE` / `PI_TRIGGERS_FILE` / `PI_PAUSE_WINDOWS_FILE` / `PI_GLOBAL_PI_DIR` — the same values your worker uses. It reads that deployment's queue and run history; on its own it will just say "queue unreachable."
 
 ## Get the whole thing
 

package/dist/index.mjs

@@ -4220,7 +4220,7 @@ __export(typebox_exports, {
 
 // src/read-model.mjs
 import * as nodeFs2 from "node:fs";
-import { join, delimiter, sep } from "node:path";
+import { join as join2, delimiter, sep } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 
 // ../worker/src/config.mjs
@@ -4371,8 +4371,12 @@ function windowState(reserved, cap, softHoldPct = null) {
 
 // ../worker/src/triggers.mjs
 var ON_TYPES = /* @__PURE__ */ new Set(["cron", "label", "comment", "pull_request"]);
-var RUN_KINDS = /* @__PURE__ */ new Set(["local", "github"]);
-var PR_ACTIONS = /* @__PURE__ */ new Set(["labeled", "opened", "synchronize", "reopened"]);
+var RUN_KINDS = /* @__PURE__ */ new Set(["local", "github", "gitlab"]);
+var FORGE_KINDS = /* @__PURE__ */ new Set(["github", "gitlab"]);
+var PR_ACTIONS = {
+  github: /* @__PURE__ */ new Set(["labeled", "opened", "synchronize", "reopened"]),
+  gitlab: /* @__PURE__ */ new Set(["open", "update", "reopen", "approved"])
+};
 var ID_CHARSET = /^[A-Za-z0-9._-]+$/;
 function isNonEmptyString2(value) {
   return typeof value === "string" && value.trim() !== "";
@@ -4388,7 +4392,7 @@ function parseTriggers(text, path) {
   if (!Array.isArray(entries)) {
     throw configError(`triggers file must have a "triggers" array: ${path}`);
   }
-  const state = { seenCronIds: /* @__PURE__ */ new Set(), commentCount: 0 };
+  const state = { seenCronIds: /* @__PURE__ */ new Set(), commentCounts: {} };
   return entries.map((entry, index) => normalizeTrigger(entry, index, path, state));
 }
 function normalizeTrigger(entry, index, path, state) {
@@ -4407,7 +4411,7 @@ function normalizeTrigger(entry, index, path, state) {
     throw configError(`${at}: on.type must be one of cron|label|comment|pull_request (got ${JSON.stringify(on.type)}): ${path}`);
   }
   if (!RUN_KINDS.has(run.kind)) {
-    throw configError(`${at}: run.kind must be one of local|github (got ${JSON.stringify(run.kind)}): ${path}`);
+    throw configError(`${at}: run.kind must be one of local|github|gitlab (got ${JSON.stringify(run.kind)}): ${path}`);
   }
   if (on.type === "cron") {
     if (run.kind !== "local") {
@@ -4415,8 +4419,8 @@ function normalizeTrigger(entry, index, path, state) {
     }
     return normalizeCron(on, run, index, path, state);
   }
-  if (run.kind !== "github") {
-    throw configError(`${at}: a ${on.type} trigger produces a github job; run.kind must be "github" (got ${JSON.stringify(run.kind)}): ${path}`);
+  if (!FORGE_KINDS.has(run.kind)) {
+    throw configError(`${at}: a ${on.type} trigger is webhook-driven and produces a forge job; run.kind must be one of github|gitlab (got ${JSON.stringify(run.kind)}): ${path}`);
   }
   if (on.type === "label") return normalizeLabel(on, run, index, path);
   if (on.type === "comment") return normalizeComment(on, run, index, path, state);
@@ -4455,11 +4459,36 @@ function normalizeCron(on, run, index, path, state) {
   if (!isNonEmptyString2(run.task)) {
     throw configError(`cron trigger "${id}": run.task must be a non-empty string: ${path}`);
   }
+  if (run.github !== void 0 && typeof run.github !== "boolean") {
+    throw configError(`cron trigger "${id}": run.github must be true or false when present: ${path}`);
+  }
+  const packages = validatePackagesFlag(run, `cron trigger "${id}"`, path);
+  const image = validateImageRef(run, `cron trigger "${id}"`, path);
   return {
     on: { type: "cron", id, pattern },
-    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns }
+    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image }
   };
 }
+function validatePackagesFlag(run, at, path) {
+  if (run.packages !== void 0 && typeof run.packages !== "boolean") {
+    throw configError(`${at}: run.packages must be true or false when present: ${path}`);
+  }
+  return run.packages;
+}
+function validateImageRef(run, at, path) {
+  const image = run.image;
+  if (image === void 0) return void 0;
+  if (typeof image !== "string" || image.trim() === "") {
+    throw configError(`${at}: run.image must be a non-empty string when present: ${path}`);
+  }
+  if (image !== image.trim()) {
+    throw configError(`${at}: run.image must not have leading or trailing whitespace (got ${JSON.stringify(image)}): ${path}`);
+  }
+  if (image.startsWith("-")) {
+    throw configError(`${at}: run.image must not start with "-" -- it is passed as the image positional in the docker argv, where a leading dash parses as a flag (got ${JSON.stringify(image)}): ${path}`);
+  }
+  return image;
+}
 function validatePredicate(on, index, path, requirePositive) {
   const at = `trigger at index ${index}`;
   for (const key of ["any", "all", "none"]) {
@@ -4480,7 +4509,9 @@ function normalizeLabel(on, run, index, path) {
   if (!isNonEmptyString2(run.flow)) {
     throw configError(`${at}: label trigger run.flow must be a non-empty string: ${path}`);
   }
-  return { on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none }, run: { kind: "github", flow: run.flow } };
+  const packages = validatePackagesFlag(run, at, path);
+  const image = validateImageRef(run, at, path);
+  return { on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none }, run: { kind: run.kind, flow: run.flow, packages, image } };
 }
 function normalizeComment(on, run, index, path, state) {
   const at = `trigger at index ${index}`;
@@ -4490,11 +4521,13 @@ function normalizeComment(on, run, index, path, state) {
   if (!isNonEmptyString2(run.flow)) {
     throw configError(`${at}: comment trigger run.flow (the default flow) must be a non-empty string: ${path}`);
   }
-  state.commentCount += 1;
-  if (state.commentCount > 1) {
-    throw configError(`${at}: at most one comment trigger is allowed: ${path}`);
+  state.commentCounts[run.kind] = (state.commentCounts[run.kind] ?? 0) + 1;
+  if (state.commentCounts[run.kind] > 1) {
+    throw configError(`${at}: at most one ${run.kind} comment trigger is allowed: ${path}`);
   }
-  return { on: { type: "comment", phrase: on.phrase }, run: { kind: "github", flow: run.flow } };
+  const packages = validatePackagesFlag(run, at, path);
+  const image = validateImageRef(run, at, path);
+  return { on: { type: "comment", phrase: on.phrase }, run: { kind: run.kind, flow: run.flow, packages, image } };
 }
 function normalizePullRequest(on, run, index, path) {
   const at = `trigger at index ${index}`;
@@ -4502,19 +4535,23 @@ function normalizePullRequest(on, run, index, path) {
   if (!Array.isArray(actions) || actions.length === 0) {
     throw configError(`${at}: pull_request on.action must be a non-empty array: ${path}`);
   }
+  const allowed = PR_ACTIONS[run.kind];
+  const expected = [...allowed].join("|");
   for (const a of actions) {
-    if (!PR_ACTIONS.has(a)) {
-      throw configError(`${at}: pull_request on.action has an unsupported action ${JSON.stringify(a)} (expected labeled|opened|synchronize|reopened): ${path}`);
+    if (!allowed.has(a)) {
+      throw configError(`${at}: pull_request on.action has an unsupported ${run.kind} action ${JSON.stringify(a)} (expected ${expected}): ${path}`);
     }
   }
-  const requirePositive = actions.includes("labeled");
+  const requirePositive = run.kind === "github" && actions.includes("labeled");
   const predicate = validatePredicate(on, index, path, requirePositive);
   if (!isNonEmptyString2(run.flow)) {
     throw configError(`${at}: pull_request trigger run.flow must be a non-empty string: ${path}`);
   }
+  const packages = validatePackagesFlag(run, at, path);
+  const image = validateImageRef(run, at, path);
   return {
     on: { type: "pull_request", action: [...actions], any: predicate.any, all: predicate.all, none: predicate.none },
-    run: { kind: "github", flow: run.flow }
+    run: { kind: run.kind, flow: run.flow, packages, image }
   };
 }
 
@@ -4690,7 +4727,7 @@ var QUEUE = "pi-jobs";
 function makeQueue(connection) {
   return new Queue(QUEUE, { connection });
 }
-async function enqueueLocalJob(queue, { folder, flow, task, provider, model, maxTurns, chainDepth, parentJobId, jobId, now = /* @__PURE__ */ new Date() }) {
+async function enqueueLocalJob(queue, { folder, flow, task, provider, model, maxTurns, image, chainDepth, parentJobId, jobId, now = /* @__PURE__ */ new Date() }) {
   const minute = now.toISOString().slice(0, 16);
   const id = jobId ?? localJobId({ folder, flow, task, minute });
   const data = {
@@ -4701,6 +4738,7 @@ async function enqueueLocalJob(queue, { folder, flow, task, provider, model, max
     provider,
     model,
     maxTurns,
+    ...image !== void 0 && { image },
     ...chainDepth !== void 0 && { chainDepth },
     ...parentJobId !== void 0 && { parentJobId }
   };
@@ -4764,6 +4802,48 @@ function gitDirty(folder, { exec: exec2 = execFileSync } = {}) {
   }
 }
 
+// ../worker/src/packages.mjs
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// ../worker/src/import-pi.mjs
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var ENTRY_NAME_RE = /^[a-z0-9](?:[a-z0-9_.-]{0,62}[a-z0-9])?$/i;
+var execFileAsync = promisify2(execFile2);
+
+// ../worker/src/docker-run.mjs
+var CONTAINER_GLOBAL_PI_DIR = "/opt/pi-global";
+
+// ../worker/src/packages.mjs
+var PACKAGES_SUBDIR = "packages";
+var STAGE_MANIFEST = "packages.json";
+var CONTAINER_PACKAGES_ROOT = `${CONTAINER_GLOBAL_PI_DIR}/${PACKAGES_SUBDIR}`;
+var MAX_DIR_LENGTH = 64;
+function isNonEmptyString4(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function readStageManifest({ globalPiDir, readFile = readFileSync, fileExists = existsSync } = {}) {
+  if (!globalPiDir) return null;
+  const path = join(globalPiDir, PACKAGES_SUBDIR, STAGE_MANIFEST);
+  try {
+    if (!fileExists(path)) return null;
+    const parsed = JSON.parse(readFile(path, "utf8"));
+    if (parsed === null || typeof parsed !== "object" || !Array.isArray(parsed.packages)) return null;
+    const packages = [];
+    for (const entry of parsed.packages) {
+      if (entry === null || typeof entry !== "object") return null;
+      const { name, version, dir } = entry;
+      if (!isNonEmptyString4(name) || !isNonEmptyString4(version) || !isNonEmptyString4(dir)) return null;
+      if (!ENTRY_NAME_RE.test(dir) || dir.length > MAX_DIR_LENGTH) return null;
+      packages.push({ name, version, dir });
+    }
+    return { stagedAt: typeof parsed.stagedAt === "string" ? parsed.stagedAt : null, packages };
+  } catch {
+    return null;
+  }
+}
+
 // src/read-model.mjs
 function resolvePaths(env = process.env) {
   return {
@@ -4772,6 +4852,10 @@ function resolvePaths(env = process.env) {
     settingsFile: settingsFilePath(env),
     triggersPath: env.PI_TRIGGERS_FILE ?? "deploy/triggers.json",
     pauseWindowsPath: env.PI_PAUSE_WINDOWS_FILE ?? "deploy/pause-windows.json",
+    // The operator's global pi overlay dir (REQ-GLOBAL-PI-OVERLAY), where the staged third-party pi
+    // packages live under `packages/`. `|| null` so unset AND empty both read as "no overlay" -- the
+    // normal deployment, in which no trigger can arm any package.
+    globalPiDir: env.PI_GLOBAL_PI_DIR || null,
     captureJobLogs: env.PI_CAPTURE_JOB_LOGS === "1",
     // The two dispatch_run bounds the extension enforces producer-side, read DIRECTLY from env (never
     // loadConfig, which throws on unrelated GitHub-auth problems). `delimitedList`/`nonNegativeInt` are
@@ -5058,19 +5142,19 @@ function listRuns({ logsDir, limit = 10, fs = nodeFs2 }) {
   const records = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const record = readJsonFile(join(logsDir, name), fs);
+    const record = readJsonFile(join2(logsDir, name), fs);
     if (record && typeof record === "object") records.push(record);
   }
   records.sort(byEndedAtDesc);
   return records.slice(0, cap);
 }
 function readRun({ logsDir, jobId, fs = nodeFs2 }) {
-  return readJsonFile(join(logsDir, `${sanitizeJobId(jobId)}.json`), fs);
+  return readJsonFile(join2(logsDir, `${sanitizeJobId(jobId)}.json`), fs);
 }
 function readLogTail({ logsDir, jobId, lines = 200, fs = nodeFs2 }) {
   let text;
   try {
-    text = fs.readFileSync(join(logsDir, `${sanitizeJobId(jobId)}.log`), "utf8");
+    text = fs.readFileSync(join2(logsDir, `${sanitizeJobId(jobId)}.log`), "utf8");
   } catch {
     return { missing: true };
   }
@@ -5114,6 +5198,9 @@ function normalizeTriggerForDisplay(entry) {
   if (on === null || typeof on !== "object") return null;
   const run = entry.run !== null && typeof entry.run === "object" ? entry.run : {};
   const flow = typeof run.flow === "string" ? run.flow : null;
+  const packages = run.packages !== false;
+  const image = typeof run.image === "string" && run.image.trim() !== "" ? run.image : null;
+  const forge = typeof run.kind === "string" && run.kind.trim() !== "" ? run.kind : null;
   switch (on.type) {
     case "cron":
       return {
@@ -5124,12 +5211,14 @@ function normalizeTriggerForDisplay(entry) {
         flow,
         // Optional per-cron model override (passthrough into job.data); null when the entry resolves the
         // deployment default. Surfaced so the drill-in shows which schedules pin their own model.
-        model: typeof run.model === "string" ? run.model : null
+        model: typeof run.model === "string" ? run.model : null,
+        packages,
+        image
       };
     case "label":
-      return { type: "label", any: normalizeSelector(on.any), all: normalizeSelector(on.all), none: normalizeSelector(on.none), flow };
+      return { type: "label", any: normalizeSelector(on.any), all: normalizeSelector(on.all), none: normalizeSelector(on.none), flow, packages, image, forge };
     case "comment":
-      return { type: "comment", phrase: typeof on.phrase === "string" ? on.phrase : null, flow };
+      return { type: "comment", phrase: typeof on.phrase === "string" ? on.phrase : null, flow, packages, image, forge };
     case "pull_request":
       return {
         type: "pull_request",
@@ -5137,7 +5226,10 @@ function normalizeTriggerForDisplay(entry) {
         any: normalizeSelector(on.any),
         all: normalizeSelector(on.all),
         none: normalizeSelector(on.none),
-        flow
+        flow,
+        packages,
+        image,
+        forge
       };
     default:
       return null;
@@ -5147,6 +5239,28 @@ function normalizeSelector(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((member) => typeof member === "string");
 }
+function readStagedPackages({ globalPiDir, fs = nodeFs2, readManifest = readStageManifest } = {}) {
+  const empty = { stagedAt: null, packages: [] };
+  if (typeof globalPiDir !== "string" || globalPiDir === "") return empty;
+  let manifest;
+  try {
+    manifest = readManifest({
+      globalPiDir,
+      readFile: (path) => fs.readFileSync(path, "utf8"),
+      fileExists: (path) => fs.existsSync(path)
+    });
+  } catch {
+    return empty;
+  }
+  const entries = Array.isArray(manifest?.packages) ? manifest.packages : [];
+  return {
+    stagedAt: typeof manifest?.stagedAt === "string" ? manifest.stagedAt : null,
+    packages: entries.filter((p) => p && typeof p.name === "string").map(nameAtVersion)
+  };
+}
+function nameAtVersion(pkg) {
+  return typeof pkg.version === "string" && pkg.version !== "" ? `${pkg.name}@${pkg.version}` : pkg.name;
+}
 function listRunIds({ logsDir, fs = nodeFs2 }) {
   let names;
   try {
@@ -5279,17 +5393,20 @@ function renderTriggers({ schedulers, triggers } = {}) {
 }
 function triggerLine(t) {
   const flow = t?.flow ?? "-";
+  const forge = t?.forge && t.forge !== "github" ? `  [${t.forge}]` : "";
+  const pkgs = t?.packages === true ? "  [packages]" : "";
+  const img = t?.image ? `  [image ${t.image}]` : "";
   switch (t?.type) {
     case "cron":
-      return `cron  ${t.id ?? "-"}  ${t.pattern ?? "-"} \u2192 ${t.folder ?? "-"}/${flow}`;
+      return `cron  ${t.id ?? "-"}  ${t.pattern ?? "-"} \u2192 ${t.folder ?? "-"}/${flow}${forge}${pkgs}${img}`;
     case "label":
-      return `label  ${ruleClauses(t) || "(no selector)"} \u2192 ${flow}`;
+      return `label  ${ruleClauses(t) || "(no selector)"} \u2192 ${flow}${forge}${pkgs}${img}`;
     case "comment":
-      return `comment  "${t.phrase ?? "-"}" \u2192 ${flow}`;
+      return `comment  "${t.phrase ?? "-"}" \u2192 ${flow}${forge}${pkgs}${img}`;
     case "pull_request": {
       const clauses = ruleClauses(t);
       const action = `action[${(t.action ?? []).join(",")}]`;
-      return `pull_request  ${action}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}`;
+      return `pull_request  ${action}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}${forge}${pkgs}${img}`;
     }
     default:
       return "(unknown trigger)";
@@ -5571,6 +5688,11 @@ function createDashboardDeps(paths) {
         settings: readSettingsView({ settingsFile: paths.settingsFile }),
         triggers: readTriggers({ triggersPath: paths.triggersPath }),
         pauseWindows: readPauseWindows({ pauseWindowsPath: paths.pauseWindowsPath }),
+        // The operator's staged third-party pi packages (REQ-GLOBAL-PI-OVERLAY), for the armed triggers'
+        // trust model. Like the four reads above it is a plain file read whose fs access lives entirely in
+        // read-model.mjs -- this module never touches the filesystem -- and it degrades to a safe empty
+        // shape rather than throwing, so a broken overlay cannot take the whole snapshot down.
+        stagedPackages: readStagedPackages({ globalPiDir: paths.globalPiDir }),
         // ONLY the id off the active Job -- a Job's `.data` holds issue title/body/username (PII), so it
         // never enters the snapshot (no-pii-in-logs, INT-RUN-HISTORY-FILE-CONTRACT).
         activeJobId: activeList?.[0]?.id ?? null
@@ -5812,7 +5934,7 @@ function renderPanel(snapshot, width, state, styler) {
     const detailTitle = `trigger \xB7 ${t?.type ?? "?"}`;
     const dw = framed ? Math.min(Math.trunc(width), DRILL_WIDTH) : Math.trunc(width);
     const sched = cronSchedInfo(t, snapshot);
-    const lines = renderTriggerDetail(t, framed ? dw - 4 : 24, styler, sched);
+    const lines = renderTriggerDetail(t, framed ? dw - 4 : 24, styler, sched, snapshot?.stagedPackages);
     if (!framed) return [detailTitle, "", ...lines.map((l) => styler.stripAnsi(l)), "", "e edit \xB7 x delete \xB7 esc back"];
     const boxed = frame(styler, { title: detailTitle, width: dw, lines, footer: triggerDetailHints(dw - 4, styler) });
     return centerBlock(boxed, Math.trunc(width), dw);
@@ -5984,7 +6106,10 @@ function triggerRow(t, sel, inner, styler) {
   const cursor = sel ? styler.fg("accent", "\u203A") : " ";
   const kind = t?.type ?? "?";
   const badge = styler.cell(kind, KIND_WIDTH, { color: KIND_COLOR[kind] ?? "muted" });
-  return fitLine(`${cursor} ${badge} ${matchColored(t, styler)} ${targetColored(t, styler)}`, inner, styler);
+  const forge = t?.forge && t.forge !== "github" ? " " + styler.fg("accent", `[${t.forge}]`) : "";
+  const pkgs = t?.packages === true ? " " + styler.fg("warning", "[packages]") : "";
+  const img = t?.image ? " " + styler.fg("accent", `[${t.image}]`) : "";
+  return fitLine(`${cursor} ${badge} ${matchColored(t, styler)} ${targetColored(t, styler)}${forge}${pkgs}${img}`, inner, styler);
 }
 function matchColored(t, styler) {
   switch (t?.type) {
@@ -6084,7 +6209,7 @@ function settingsLines(settings2, inner, styler) {
   const l2 = [kv("dailyCap", o.dailyCap), tk("dailyTokenCap", o.dailyTokenCap), kv("concurrency", o.concurrency), styler.fg("muted", "softHold") + " " + styler.fg("text", pctVal)].join(gap);
   return [fitLine(l1, inner, styler), fitLine(l2, inner, styler)];
 }
-function renderTriggerDetail(t, inner, styler, sched = null) {
+function renderTriggerDetail(t, inner, styler, sched = null, staged = null) {
   if (!t) return [styler.cell("(no trigger)", inner, { color: "dim" })];
   const out = [];
   const kv = (k, v, color = "text") => fitLine(styler.cell(k, 12, { color: "muted" }) + " " + styler.fg(color, v), inner, styler);
@@ -6122,15 +6247,25 @@ function renderTriggerDetail(t, inner, styler, sched = null) {
     out.push(kv("folder", `${t.folder ?? "-"}`, "success"));
     out.push(kv("model", t.model ?? "deployment default", t.model ? "accent" : "dim"));
   } else {
-    out.push(kv("job", "github", "accent"));
-    out.push(kv("target", "the triggering repo#issue / PR", "accent"));
+    out.push(kv("job", t.forge ?? "-", "accent"));
+    out.push(kv("target", t.forge === "gitlab" ? "the triggering project#issue / !MR" : "the triggering repo#issue / PR", "accent"));
     out.push(kv("model", "deployment default", "dim"));
   }
+  out.push(kv("image", t.image ?? "deployment default", t.image ? "accent" : "dim"));
   blank();
   section("trust model");
   for (const line of trustModel(t)) out.push(fitLine(styler.fg("border", "\xB7 ") + styler.fg("text", line), inner, styler));
+  if (t.packages === true) {
+    const loads = (text) => out.push(fitLine(styler.fg("border", "\xB7 ") + styler.fg("warning", text), inner, styler));
+    loads(`packages loaded \xB7 ${stagedNames(staged)}`);
+    loads("third-party code on adversarial input, open network egress");
+  }
   return out;
 }
+function stagedNames(staged) {
+  const list = Array.isArray(staged?.packages) ? staged.packages : [];
+  return list.length > 0 ? list.join(" \xB7 ") : "(none staged in the overlay)";
+}
 function trustModel(t) {
   switch (t?.type) {
     case "cron":
@@ -6248,6 +6383,10 @@ function renderRunDetail(record, inner, styler, allRuns = []) {
   out.push(kv("turns", turnBits.join(" \xB7 ")));
   const cost = typeof r.tokens?.cost === "number" ? ` \xB7 $${r.tokens.cost.toFixed(4)}` : "";
   out.push(kv("tokens", `${show(r.tokens?.total)}${cost}`));
+  const otherTotal = r.tokens?.otherTotal;
+  if (typeof otherTotal === "number" && Number.isFinite(otherTotal) && otherTotal > 0) {
+    out.push(kv("of which", `subagents: ${otherTotal}`, "dim"));
+  }
   const children = (Array.isArray(allRuns) ? allRuns : []).filter((x) => x?.parentJobId && r.jobId && x.parentJobId === r.jobId);
   const chainBits = [r.parentJobId ? `child of ${r.parentJobId}` : "root"];
   if (r.chainDepth !== null && r.chainDepth !== void 0) chainBits.push(`depth ${r.chainDepth}`);
@@ -6465,11 +6604,12 @@ function registerTools(pi) {
   pi.registerTool({
     name: "dispatch_trigger_add",
     label: "pi-dispatch add trigger",
-    description: "Adds a trigger to triggers.json and applies it live. The operator MUST approve a confirm dialog showing the entry; with no interactive operator it is refused. `flow` is the .pi/skills/<name> skill the job runs (its SKILL.md is the agent's instructions). `kind` = cron|label|comment|pull_request. cron (local) needs id, pattern, `folder` (absolute host path the job runs in), `flow`, and `task` (the prompt text handed to the agent), and may set optional model/provider/maxTurns for that schedule (omit = deployment default). label needs labels[]+flow; comment needs phrase+flow; pull_request needs action[] (+ optional labels[]) + flow. For github triggers the repo and the task come from the triggering issue/PR event \u2014 set only the match + flow \u2014 and they run under the deployment default model.",
+    description: "Adds a trigger to triggers.json and applies it live. The operator MUST approve a confirm dialog showing the entry; with no interactive operator it is refused. `flow` is the .pi/skills/<name> skill the job runs (its SKILL.md is the agent's instructions). `kind` = cron|label|comment|pull_request. cron (local) needs id, pattern, `folder` (absolute host path the job runs in), `flow`, and `task` (the prompt text handed to the agent), and may set optional model/provider/maxTurns for that schedule (omit = deployment default). label needs labels[]+flow; comment needs phrase+flow; pull_request needs action[] (+ optional labels[]) + flow. Webhook triggers take an optional `forge` = github (default) | gitlab, which also decides which action words pull_request accepts: github is labeled|opened|synchronize|reopened, gitlab is open|update|reopen|approved. For webhook triggers the repo and the task come from the triggering issue/PR event \u2014 set only the match + flow \u2014 and they run under the deployment default model.",
     executionMode: "sequential",
     parameters: typebox_exports.Object({
       kind: typebox_exports.String(),
       flow: typebox_exports.String(),
+      forge: typebox_exports.Optional(typebox_exports.String()),
       id: typebox_exports.Optional(typebox_exports.String()),
       pattern: typebox_exports.Optional(typebox_exports.String()),
       folder: typebox_exports.Optional(typebox_exports.String()),
@@ -6685,13 +6825,14 @@ function buildTriggerEntry(kind, f) {
     if (maxTurns !== void 0) run.maxTurns = maxTurns;
     return { on: { type: "cron", id: f.id, pattern: f.pattern }, run };
   }
-  if (kind === "label") return { on: { type: "label", any: asWords(f.labels ?? f.any) }, run: { kind: "github", flow: f.flow } };
-  if (kind === "comment") return { on: { type: "comment", phrase: f.phrase }, run: { kind: "github", flow: f.flow } };
+  const forge = optStr(f.forge) ?? "github";
+  if (kind === "label") return { on: { type: "label", any: asWords(f.labels ?? f.any) }, run: { kind: forge, flow: f.flow } };
+  if (kind === "comment") return { on: { type: "comment", phrase: f.phrase }, run: { kind: forge, flow: f.flow } };
   if (kind === "pull_request") {
     const on = { type: "pull_request", action: asWords(f.action) };
     const any = asWords(f.labels ?? f.any);
     if (any.length > 0) on.any = any;
-    return { on, run: { kind: "github", flow: f.flow } };
+    return { on, run: { kind: forge, flow: f.flow } };
   }
   return null;
 }
@@ -6965,25 +7106,32 @@ async function addTriggerViaDialogs(paths, ui, notify) {
     if (maxTurns === void 0) return;
     entry = buildTriggerEntry("cron", { id, pattern, folder, flow, task, model, provider, maxTurns });
   } else if (kind === "label") {
-    const labels = await ui.input("labels \u2014 space-separated, any-of (a collaborator applies one to fire)", "pi:fix");
+    const forge = await ui.input("forge \u2014 github or gitlab", "github");
+    if (forge === void 0) return;
+    const labels = await ui.input("labels \u2014 space-separated, any-of (a project member applies one to fire)", "pi:fix");
     if (labels === void 0) return;
     const flow = await ui.input("flow \u2014 the .pi/skills/<name> skill to run (the issue text is the task)", "fix");
     if (flow === void 0) return;
-    entry = buildTriggerEntry("label", { labels, flow });
+    entry = buildTriggerEntry("label", { labels, flow, forge });
   } else if (kind === "comment") {
+    const forge = await ui.input("forge \u2014 github or gitlab", "github");
+    if (forge === void 0) return;
     const phrase = await ui.input("trigger phrase \u2014 a comment containing this fires the flow (e.g. @pi)", "@pi");
     if (phrase === void 0) return;
     const flow = await ui.input("flow \u2014 the .pi/skills/<name> skill to run (the comment/issue text is the task)", "fix");
     if (flow === void 0) return;
-    entry = buildTriggerEntry("comment", { phrase, flow });
+    entry = buildTriggerEntry("comment", { phrase, flow, forge });
   } else {
-    const action = await ui.input("PR actions \u2014 space-separated: labeled opened synchronize reopened", "labeled");
+    const forge = await ui.input("forge \u2014 github or gitlab", "github");
+    if (forge === void 0) return;
+    const actionHint = forge === "gitlab" ? "open update reopen approved" : "labeled opened synchronize reopened";
+    const action = await ui.input(`MR/PR actions \u2014 space-separated: ${actionHint}`, forge === "gitlab" ? "update" : "labeled");
     if (action === void 0) return;
     const labels = await ui.input("labels for 'labeled' \u2014 space-separated (blank for the auto actions)", "pi:review");
     if (labels === void 0) return;
     const flow = await ui.input("flow \u2014 the .pi/skills/<name> skill to run (the PR text is the task)", "review");
     if (flow === void 0) return;
-    entry = buildTriggerEntry("pull_request", { action, labels, flow });
+    entry = buildTriggerEntry("pull_request", { action, labels, flow, forge });
   }
   const res = writeTriggers({ triggersPath: paths.triggersPath, mutate: (list) => [...list, entry] });
   notify?.(res.ok ? `trigger added (live) \u2014 ${kind} \u2192 ${entry.run.flow}` : `add rejected: ${res.invalid}`, res.ok ? "info" : "error");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@edgehero/pi-dispatch-admin",
-  "version": "0.1.3",
-  "description": "Operator console (a pi extension) + skill for pi-dispatch: run the pi coding agent as a self-hosted service. A /dispatch TUI for the queue, spend caps, run history, editable triggers (cron/label/comment/PR), and scheduled pause windows — plus AI-operable, human-confirmed controls. Runs against a live pi-dispatch deployment.",
+  "version": "0.1.4",
+  "description": "Operator console (a pi extension) + skill for pi-dispatch: run the pi coding agent as a self-hosted service. A /dispatch TUI for the queue, spend caps, run history, editable GitHub and GitLab triggers (cron/label/comment/PR/MR), and scheduled pause windows — plus AI-operable, human-confirmed controls. Runs against a live pi-dispatch deployment.",
   "keywords": [
     "pi-package",
     "pi-extension",
@@ -11,6 +11,8 @@
     "ai-agent",
     "autonomous-agents",
     "self-hosted",
+    "github",
+    "gitlab",
     "job-queue",
     "cron",
     "tui",

package/skills/operate-pi-dispatch/SKILL.md

@@ -49,3 +49,79 @@ Use them like this:
    the change can't be made without an operator at the terminal — it is not a bug to work around.
 
 The confirm is the approval step. Treat a decline as a final, legitimate answer.
+
+## Staged packages — `run.packages`, and why you cannot set it
+
+When a trigger fires, the job loads the third-party **pi packages the operator staged** into their global
+overlay dir (`PI_GLOBAL_PI_DIR`, under `packages/`, pinned by version). `run.packages` is an **opt-out**:
+absent and `true` both load them, and only an explicit `run.packages: false` withholds them from that one
+trigger. So the question to answer for a user is never "is this trigger armed" — it is "did this trigger
+decline".
+
+It matters because a loading trigger runs pinned third-party code against adversarial input (issue/PR/comment
+text) with open network egress. So the panel makes it visible: a loading trigger is badged `[packages]` in
+the trigger list, and its trust-model drill-in names the staged `name@version` set.
+
+**Which packages are staged, and whether a trigger declines them, are both operator edits to reviewed files
+— never a panel action and never a tool call.** This is deliberate, not a gap:
+
+- `dispatch_triggers` shows you *whether* a trigger loads them. The `/dispatch` panel displays it too, and
+  has no key that sets it.
+- `dispatch_trigger_add` and `dispatch_trigger_edit` **have no `packages` parameter**. You can change it in
+  neither direction — you cannot make a trigger load packages and you cannot make one decline them — the
+  same reason `dispatch_run` withholds the provider and model from you.
+
+So if a user asks you to change a trigger's packages flag, or to stage a package: **say plainly that you
+cannot, and that it is an edit they make to `triggers.json` (and to their overlay dir) themselves.** Do not
+attempt it through `dispatch_trigger_edit`, do not write the triggers file by another route, and do not treat
+the missing parameter as a bug to work around. Reporting which triggers load the staged set and explaining
+the change they would make is the whole of your part.
+
+## The job image — `run.image`, and why you cannot set it
+
+A trigger may carry `run.image`: the container image that trigger's jobs run in. Absent means the
+deployment default (`PI_JOB_IMAGE`). It exists so one flow can have a Python toolchain and another Node +
+Playwright, without one image carrying the union of both.
+
+Report it when asked, and be precise about what it does and does not decide. **Which image a job runs is
+which code it runs** — the pi version, the runner, the guardrail floor and the loader's discovery posture
+all come from the image. What it does *not* decide is what the container may do: `--cap-drop=ALL`, the
+non-root user, the read-only `/job` and the closed env allowlist are built by the worker for every image
+alike. The panel shows the tag in the trigger list and states it in the drill-in either way.
+
+**You cannot change it, in either direction.** `dispatch_trigger_add` and `dispatch_trigger_edit` have **no
+`image` parameter**, `dispatch_run` has none, and there is no allowlist for you to consult — because there
+is nothing model-callable to bound. Naming an image is an operator edit to the reviewed `triggers.json`,
+exactly like `run.packages`.
+
+So if a user asks you to point a trigger at a different image, or to build one: **say plainly that you
+cannot, and that it is an edit they make to `triggers.json` themselves.** Do not route around it via
+`dispatch_trigger_edit`, which changes the flow only. Two useful things you *can* say: the image must be
+built or pulled on the worker's own host, because jobs run with `--pull=never` and nothing is fetched at
+job time; and `pi-dispatch doctor` lists every image their triggers name and flags one that is missing.
+
+## The forge a trigger listens to — `run.kind`
+
+A webhook trigger names its forge: `"kind": "github"` or `"kind": "gitlab"`. Everything else about the
+trigger is the same — the `on.type`, the `{any, all, none}` label predicate, `flow`, `packages`, `image`.
+
+Two things are NOT the same, and both refuse at load rather than misbehaving quietly:
+
+- **`pull_request` actions are the forge's own words.** GitHub takes
+  `labeled | opened | synchronize | reopened`; GitLab takes `open | update | reopen | approved`. A word
+  from the wrong forge is refused when the file is written. It would not break anything otherwise — it
+  would simply never match an event, and the trigger would look configured while doing nothing.
+- **One `comment` trigger per forge.** Two GitHub comment triggers are refused; one GitHub and one GitLab
+  are fine.
+
+`dispatch_trigger_add` takes an optional `forge` parameter, defaulting to `github`. Unlike `image`, this
+one IS offered to the model — a model that can already add a GitHub trigger can already arm a paid run,
+and naming GitLab instead does not widen that. Both paths stay behind the same operator confirm.
+
+If you are asked why a GitLab trigger did not fire, the usual answers in order:
+
+1. **The actor was not a Developer.** Every GitLab trigger is gated on the actor's project access level,
+   including label triggers — a GitLab label is not an approval the way a GitHub one is.
+2. **No label was added by that event.** GitLab has no `labeled` action; the trigger fires on the labels
+   an event *added*, so editing an already-labelled issue does nothing. This is deliberate.
+3. **The action word belongs to the other forge.** See above.