@geminixiang/mikan 1.0.0-beta.9 → 1.0.0-beta.90

package/dist/main.js

@@ -1,39 +1,57 @@
 #!/usr/bin/env node
 import "./observability/instrument.js";
-import { join, resolve } from "path";
-import { mkdirSync, statSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { fileURLToPath } from "url";
-import { dirname, join as pathJoin } from "path";
-import { DiscordMessagingBot } from "./adapters/discord/bot.js";
+import { existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { GithubMessagingBot } from "./adapters/github/bot.js";
+import { createGithubToolPack } from "./adapters/github/tool-pack.js";
+import { parseGithubPolicy } from "./adapters/github/policy.js";
 import { TelegramMessagingBot } from "./adapters/telegram/bot.js";
 import { SlackMessagingBot as SlackMessagingBotClass } from "./adapters/slack/bot.js";
-import { downloadChannel } from "./download.js";
-import { EventsWatcher } from "./events.js";
+import { createSlackToolPack } from "./adapters/slack/tool-pack.js";
+import { SLACK_BLOCKKIT_TOOL } from "./adapters/slack/tools/blockkit.js";
+import { GITHUB_CHECKS_TOOL } from "./adapters/github/tools/checks.js";
+import { GITHUB_ISSUE_TOOL } from "./adapters/github/tools/issue.js";
+import { GITHUB_PR_TOOL } from "./adapters/github/tools/pr.js";
+import { GITHUB_READ_TOOL } from "./adapters/github/tools/read.js";
+import { GITHUB_REVIEW_REPLY_TOOL } from "./adapters/github/tools/review-reply.js";
+import { downloadChannel } from "./cli/download.js";
+import { EventScheduler } from "./events/scheduler.js";
 import * as log from "./log.js";
-import { startWebServer } from "./web/server.js";
-import { InMemoryAdminTokenStore } from "./web/admin/store.js";
-import { InMemoryLinkTokenStore } from "./web/login/store.js";
-import { InMemorySessionViewTokenStore } from "./web/session-view/store.js";
-import { DockerContainerManager } from "./provisioner.js";
-import { assertStateDirOutsideWorkspace, createGlobalSettingsFile, loadGlobalSettings, MissingGlobalSettingsError, } from "./config.js";
-import { configureHttpDispatcher, defaultAuthPath, defaultModelsJsonPath, parseHttpIdleTimeoutMs, } from "./harness/index.js";
-import { existsSync, readFileSync } from "fs";
-import { readEnv, setEnvAliases } from "./utils/env.js";
-import { ensureDirExists, isRecord, readJsonFileIfExists } from "./utils/file-guards.js";
-import { SandboxError, parseSandboxArg, validateSandbox, } from "./sandbox/index.js";
+import { createProcessShutdownHandler, runShutdownSteps } from "./cli/process-lifecycle.js";
+import { closeWebServer, startWebServer } from "./adapters/web/server.js";
+import { InMemoryAdminTokenStore } from "./adapters/web/admin/portal.js";
+import { InMemoryLinkTokenStore } from "./adapters/web/login/portal.js";
+import { InMemorySessionViewTokenStore } from "./adapters/web/session-view/portal.js";
+import { DockerContainerManager } from "./sandbox/provisioner.js";
+import { loadGlobalSettings, MissingGlobalSettingsError } from "./settings/index.js";
+import { assertStateDirOutsideWorkspace } from "./file-guards.js";
+import { resolveLinkBaseUrl, resolveLinkListenHost } from "./env-manifest.js";
+import { configureHttpDispatcher, parseHttpIdleTimeoutMs } from "./harness/http.js";
+import { defaultModelsJsonPath } from "./harness/models.js";
+import { RunEventHub } from "./harness/run-events.js";
+import { readEnv, setEnvAliases } from "./env-manifest.js";
+import { ensureDirExists, readJsonFileIfExists } from "./file-guards.js";
+import { SandboxError } from "./sandbox/utils.js";
+import { validateSandbox } from "./sandbox/registry.js";
+import { helpText, resolveBoot } from "./cli/boot.js";
+import { runOnboardCommand } from "./cli/onboard.js";
+import { envReport, noPlatformsMessage, platformIsActive } from "./env-manifest.js";
 import { FileVaultManager } from "./vault/index.js";
-import { runExtCommand } from "./cli/ext.js";
+import { runMigrateCommand } from "./cli/migrate.js";
+import { runOfficeCommand } from "./cli/office.js";
+import { formatPendingMigrations, pendingMigrations } from "./migrations/index.js";
+import { createWorkspace } from "./office/index.js";
 import { createConversationRuntime } from "./runtime/conversation-runtime.js";
-import { ChannelStore } from "./store.js";
-import * as Sentry from "@sentry/node";
+import { captureError, shutdownObservability } from "./observability/index.js";
+import { MemoryCapture } from "./memory-capture/index.js";
+import { errorMessage, isRecord } from "./unknown-values.js";
 function getVersion() {
-    // Try to find package.json in the dist directory or parent
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
     const possiblePaths = [
-        pathJoin(dirname(fileURLToPath(import.meta.url)), "package.json"),
-        pathJoin(dirname(fileURLToPath(import.meta.url)), "..", "package.json"),
-        pathJoin(process.cwd(), "package.json"),
+        join(moduleDir, "package.json"),
+        join(dirname(moduleDir), "package.json"),
+        join(process.cwd(), "package.json"),
     ];
     for (const pkgPath of possiblePaths) {
         const pkg = readJsonFileIfExists(pkgPath, (value) => isRecord(value), () => "Ignoring package.json while resolving version");
@@ -46,63 +64,17 @@ const SLACK_APP_TOKEN = readEnv("SLACK_APP_TOKEN");
 const SLACK_BOT_TOKEN = readEnv("SLACK_BOT_TOKEN");
 const TELEGRAM_BOT_TOKEN = readEnv("TELEGRAM_BOT_TOKEN");
 const DISCORD_BOT_TOKEN = readEnv("DISCORD_BOT_TOKEN");
-const GITHUB_APP_ID = readEnv("GITHUB_APP_ID");
-const GITHUB_APP_PRIVATE_KEY = readEnv("GITHUB_APP_PRIVATE_KEY");
-const GITHUB_APP_PRIVATE_KEY_PATH = readEnv("GITHUB_APP_PRIVATE_KEY_PATH");
-const GITHUB_INSTALLATION_ID = readEnv("GITHUB_INSTALLATION_ID");
-const GITHUB_REPOS = readEnv("GITHUB_REPOS");
-const GITHUB_POLL_INTERVAL = readEnv("GITHUB_POLL_INTERVAL");
-const LINK_URL = readEnv("LINK_URL");
+const GITHUB_AGENT_TOKEN = readEnv("GITHUB_AGENT_TOKEN");
+const GITHUB_WEBHOOK_SECRET = readEnv("GITHUB_WEBHOOK_SECRET");
+const LINK_BASE_URL = resolveLinkBaseUrl();
 const LINK_PORT_RAW = readEnv("LINK_PORT");
-const LINK_PORT = LINK_PORT_RAW ? parseInt(LINK_PORT_RAW, 10) : LINK_URL ? 8181 : undefined;
-function parseArgs() {
-    const args = process.argv.slice(2);
-    let sandbox = { type: "host" };
-    let workingDir;
-    let stateDirArg;
-    let downloadChannelId;
-    let showOnboard = false;
-    let showVersion = false;
-    for (let i = 0; i < args.length; i++) {
-        const arg = args[i];
-        if (arg === "--version" || arg === "-v" || arg === "-V") {
-            showVersion = true;
-        }
-        else if (arg === "--onboard") {
-            showOnboard = true;
-        }
-        else if (arg.startsWith("--sandbox=")) {
-            sandbox = parseSandboxArg(arg.slice("--sandbox=".length));
-        }
-        else if (arg === "--sandbox") {
-            sandbox = parseSandboxArg(args[++i] || "");
-        }
-        else if (arg.startsWith("--state-dir=")) {
-            stateDirArg = arg.slice("--state-dir=".length);
-        }
-        else if (arg === "--state-dir") {
-            stateDirArg = args[++i];
-        }
-        else if (arg.startsWith("--download=")) {
-            downloadChannelId = arg.slice("--download=".length);
-        }
-        else if (arg === "--download") {
-            downloadChannelId = args[++i];
-        }
-        else if (!arg.startsWith("-")) {
-            workingDir = arg;
-        }
-    }
-    return {
-        workingDir: workingDir ? resolve(workingDir) : undefined,
-        stateDir: stateDirArg ? resolve(stateDirArg) : undefined,
-        sandbox,
-        downloadChannel: downloadChannelId,
-        showOnboard,
-        showVersion,
-    };
-}
+const LINK_PORT = LINK_PORT_RAW ? parseInt(LINK_PORT_RAW, 10) : LINK_BASE_URL ? 8181 : undefined;
+const OPENCONNECTOR_ENDPOINT = readEnv("OPENCONNECTOR_ENDPOINT");
+const openConnector = OPENCONNECTOR_ENDPOINT
+    ? { url: OPENCONNECTOR_ENDPOINT }
+    : undefined;
 const WORLD_WRITABLE_MODE = 0o002;
+const SHUTDOWN_DRAIN_TIMEOUT_MS = 5 * 60_000;
 function ensureSecureStateDir(path) {
     let stat;
     try {
@@ -157,83 +129,97 @@ function handleStartupError(error) {
     console.error(String(error));
     process.exit(1);
 }
-// `mikan ext …` manages extensions and exits; handle it before the normal
-// bot-mode argument parsing (which requires a workspace dir and tokens).
-if (process.argv[2] === "ext") {
-    const code = await runExtCommand(process.argv.slice(3));
-    process.exit(code);
-}
-let parsedArgs;
+let plan;
 try {
-    parsedArgs = parseArgs();
+    plan = resolveBoot();
 }
 catch (error) {
     handleStartupError(error);
 }
-// Global fetch: proxy support (HTTP_PROXY/HTTPS_PROXY/NO_PROXY) and idle
-// timeouts so a stalled LLM stream errors out instead of hanging a session.
+if (plan.mode === "office") {
+    process.exit(runOfficeCommand(plan.officeArgs ?? []));
+}
+if (plan.mode === "migrate") {
+    process.exit(await runMigrateCommand(plan.migrateArgs ?? []));
+}
 const httpIdleTimeoutMs = parseHttpIdleTimeoutMs(readEnv("HTTP_IDLE_TIMEOUT"));
 configureHttpDispatcher(httpIdleTimeoutMs);
-// Handle --version
-if (parsedArgs.showVersion) {
+if (plan.mode === "help") {
+    console.log(helpText());
+    process.exit(0);
+}
+if (plan.mode === "env") {
+    console.log(envReport());
+    process.exit(0);
+}
+if (plan.mode === "version") {
     console.log(getVersion());
     process.exit(0);
 }
-// Handle --onboard mode
-if (parsedArgs.showOnboard) {
-    const stateDir = parsedArgs.stateDir ?? join(homedir(), ".mikan");
+if (plan.mode === "onboard") {
+    const stateDir = plan.stateDir;
     setEnvAliases("STATE_DIR", stateDir);
     ensureSecureStateDir(stateDir);
     try {
-        const settingsPath = createGlobalSettingsFile(stateDir);
-        console.log(`Created global settings at ${settingsPath}`);
-        console.log("Review the file, then start mikan with your working directory.");
-        process.exit(0);
+        process.exit(await runOnboardCommand(stateDir));
     }
     catch (err) {
-        console.error(err instanceof Error ? err.message : String(err));
+        console.error(errorMessage(err));
         process.exit(1);
     }
 }
-// Handle --download mode (Slack only)
-if (parsedArgs.downloadChannel) {
+if (plan.mode === "download" && plan.downloadChannel) {
     if (!SLACK_BOT_TOKEN) {
         console.error("Missing env: SLACK_BOT_TOKEN");
         process.exit(1);
     }
-    await downloadChannel(parsedArgs.downloadChannel, SLACK_BOT_TOKEN);
+    await downloadChannel(plan.downloadChannel, SLACK_BOT_TOKEN);
     process.exit(0);
 }
-// Normal bot mode - require working dir
-if (!parsedArgs.workingDir) {
-    console.error("Usage: mikan [--state-dir=<dir>] [--sandbox=host|container:<name>|image:<image>|firecracker:<vm-id>:<host-path>|cloudflare:<sandbox-id>] <working-directory>");
-    console.error("       mikan --onboard [--state-dir=<dir>]");
-    console.error("       mikan --download <channel-id>");
-    process.exit(1);
-}
-const { workingDir, sandbox } = { workingDir: parsedArgs.workingDir, sandbox: parsedArgs.sandbox };
-const stateDir = parsedArgs.stateDir ?? join(homedir(), ".mikan");
+const sandbox = plan.sandbox;
+const stateDir = plan.stateDir;
+const workingDir = plan.workingDir;
 setEnvAliases("STATE_DIR", stateDir);
 ensureSecureStateDir(stateDir);
+if (!plan.workingDirExplicit) {
+    ensureDirExists(workingDir);
+}
 try {
     assertStateDirOutsideWorkspace(stateDir, workingDir, sandbox.type);
 }
 catch (error) {
     handleStartupError(error);
 }
-// Validate platform tokens
-const hasSlack = !!(SLACK_APP_TOKEN && SLACK_BOT_TOKEN);
-const hasTelegram = !!TELEGRAM_BOT_TOKEN;
-const hasDiscord = !!DISCORD_BOT_TOKEN;
-const hasGithub = !!(GITHUB_APP_ID &&
-    GITHUB_INSTALLATION_ID &&
-    (GITHUB_APP_PRIVATE_KEY || GITHUB_APP_PRIVATE_KEY_PATH));
+const hasSlack = platformIsActive("slack");
+const hasTelegram = platformIsActive("telegram");
+const hasDiscord = platformIsActive("discord");
+const hasGithub = platformIsActive("github");
 if (!hasSlack && !hasTelegram && !hasDiscord && !hasGithub) {
-    console.error("No platform tokens found. Set one of:\n" +
-        "  Slack:    SLACK_APP_TOKEN + SLACK_BOT_TOKEN\n" +
-        "  Telegram: TELEGRAM_BOT_TOKEN\n" +
-        "  Discord:  DISCORD_BOT_TOKEN\n" +
-        "  GitHub:   GITHUB_APP_ID + GITHUB_INSTALLATION_ID + GITHUB_APP_PRIVATE_KEY(_PATH)");
+    console.error(noPlatformsMessage());
+    process.exit(1);
+}
+let githubPolicy;
+try {
+    githubPolicy = hasGithub
+        ? parseGithubPolicy({
+            repos: readEnv("GITHUB_REPOS"),
+            publicRepos: readEnv("GITHUB_PUBLIC_REPOS"),
+            users: readEnv("GITHUB_USERS"),
+            minPermission: readEnv("GITHUB_MIN_PERMISSION"),
+            triggers: readEnv("GITHUB_TRIGGERS"),
+            capabilities: readEnv("GITHUB_CAPABILITIES"),
+        })
+        : undefined;
+    if (hasGithub && !LINK_PORT) {
+        throw new Error("GitHub receives webhooks on the link server: set LINK_PORT and LINK_URL");
+    }
+}
+catch (error) {
+    handleStartupError(error);
+}
+const pending = pendingMigrations(stateDir);
+if (pending.length > 0) {
+    console.error(formatPendingMigrations({ pending, stateDir, workspaceRoot: workingDir, sandbox }));
     process.exit(1);
 }
 try {
@@ -242,11 +228,12 @@ try {
 catch (error) {
     handleStartupError(error);
 }
+const workspace = createWorkspace({ root: workingDir, stateDir });
 const vaultManager = new FileVaultManager(stateDir);
 if (vaultManager.isEnabled()) {
     console.log(sandbox.type === "container"
         ? "  Vault system enabled. Container vault active."
-        : sandbox.type === "image" || sandbox.type === "firecracker" || sandbox.type === "cloudflare"
+        : sandbox.type === "image" || sandbox.type === "cloudflare"
             ? "  Vault system enabled. Conversation-scoped credential routing active."
             : "  Vault system enabled. Host mode will not inject vault env.");
 }
@@ -258,11 +245,12 @@ const startupConfig = (() => {
         handleStartupError(error);
     }
 })();
-const sandboxLimits = startupConfig.sandboxCpus || startupConfig.sandboxMemory
-    ? { cpus: startupConfig.sandboxCpus, memory: startupConfig.sandboxMemory }
+const sandboxSettings = startupConfig.sandbox;
+const sandboxLimits = sandboxSettings?.cpus || sandboxSettings?.memory
+    ? { cpus: sandboxSettings?.cpus, memory: sandboxSettings?.memory }
     : undefined;
-const sandboxBoostLimits = startupConfig.sandboxBoostCpus || startupConfig.sandboxBoostMemory
-    ? { cpus: startupConfig.sandboxBoostCpus, memory: startupConfig.sandboxBoostMemory }
+const sandboxBoostLimits = sandboxSettings?.boost?.cpus || sandboxSettings?.boost?.memory
+    ? { cpus: sandboxSettings?.boost?.cpus, memory: sandboxSettings?.boost?.memory }
     : undefined;
 const provisioner = sandbox.type === "image"
     ? new DockerContainerManager(sandbox.image, {
@@ -270,11 +258,12 @@ const provisioner = sandbox.type === "image"
         boostLimits: sandboxBoostLimits,
     })
     : undefined;
+const resourceController = sandbox.type === "image" ? provisioner : undefined;
 if (sandbox.type === "image") {
-    ensureDirExists(join(workingDir, "skills"));
-    ensureDirExists(join(workingDir, "events"));
+    ensureDirExists(workspace.skillsDir);
+    ensureDirExists(workspace.agentsDir);
     try {
-        writeFileSync(join(workingDir, "MEMORY.md"), "", { flag: "wx" });
+        writeFileSync(workspace.memoryPath, "", { flag: "wx" });
     }
     catch (err) {
         if (err.code !== "EEXIST")
@@ -283,78 +272,90 @@ if (sandbox.type === "image") {
 }
 const linkTokenStore = new InMemoryLinkTokenStore();
 const sessionViewTokenStore = new InMemorySessionViewTokenStore();
+const runEvents = new RunEventHub();
 const adminTokenStore = new InMemoryAdminTokenStore();
 setInterval(() => linkTokenStore.purge(), 5 * 60 * 1000).unref();
 setInterval(() => sessionViewTokenStore.purge(), 5 * 60 * 1000).unref();
 setInterval(() => adminTokenStore.purge(), 5 * 60 * 1000).unref();
 function portalBaseUrl() {
-    if (LINK_URL)
-        return LINK_URL.replace(/\/+$/, "");
+    if (LINK_BASE_URL)
+        return LINK_BASE_URL;
     if (LINK_PORT)
         return `http://localhost:${LINK_PORT}`;
     return undefined;
 }
-/** Idle timeout for managed image containers (10 minutes) */
-const IMAGE_IDLE_TIMEOUT_MS = 10 * 60 * 1000;
+const MANAGED_SANDBOX_IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 if (provisioner) {
-    await provisioner.reconcile();
-    await provisioner.stopIdle(IMAGE_IDLE_TIMEOUT_MS);
-    setInterval(() => provisioner.stopIdle(IMAGE_IDLE_TIMEOUT_MS), IMAGE_IDLE_TIMEOUT_MS).unref();
+    await provisioner.reconcile(workspace.root);
+    await provisioner.stopIdle(MANAGED_SANDBOX_IDLE_TIMEOUT_MS);
+    setInterval(() => provisioner.stopIdle(MANAGED_SANDBOX_IDLE_TIMEOUT_MS), MANAGED_SANDBOX_IDLE_TIMEOUT_MS).unref();
 }
-// Declared before the runtime so the notifier closure can capture them;
-// bots register below once their platforms initialize.
-const bots = [];
 const botsByPlatform = {};
-/**
- * Resolve which platform bot to use: an explicit platform, or the sole
- * running one. Mirrors event-file platform resolution.
- */
-function resolvePlatformBot(op, platform) {
-    const available = Object.keys(botsByPlatform);
-    const key = platform?.trim().toLowerCase() || (available.length === 1 ? available[0] : undefined);
-    const bot = key ? botsByPlatform[key] : undefined;
+function requireGithubBot(op) {
+    const bot = botsByPlatform.github;
     if (!bot) {
-        throw new Error(platform
-            ? `${op}: unknown platform '${platform}' (available: ${available.join(", ") || "none"})`
-            : `${op}: multiple platforms active (${available.join(", ")}); specify platform`);
+        throw new Error(`${op}: the GitHub platform is not running`);
     }
-    return [key, bot];
-}
-/** Extension `api.notify` backend: post into a conversation without a run. */
-const platformNotifier = async (conversationId, text, platform) => {
-    const [key, bot] = resolvePlatformBot("notify", platform);
-    await bot.postMessage(conversationId, text);
-    log.logInfo(`[notify] posted to ${key}/${conversationId} (${text.length} chars)`);
-};
-/** Extension `api.react` backend: add a reaction to a message. */
-const platformReactor = async (conversationId, messageTs, emoji, platform) => {
-    const [key, bot] = resolvePlatformBot("react", platform);
-    if (!bot.addReaction) {
-        throw new Error(`react: platform '${key}' does not support reactions`);
-    }
-    await bot.addReaction(conversationId, messageTs, emoji);
-    log.logInfo(`[react] :${emoji}: on ${key}/${conversationId}`);
-};
-/** `github_pr` tool backend: push a prepared branch and open a PR. */
-const platformPrCreator = async (conversationId, request) => {
-    const bot = botsByPlatform.github;
+    return bot;
+}
+function requireSlackBot(op) {
+    const bot = botsByPlatform.slack;
     if (!bot) {
-        throw new Error("github_pr: the GitHub platform is not running");
+        throw new Error(`${op}: the Slack platform is not running`);
     }
-    return bot.pushAndCreatePr(conversationId, request);
-};
+    return bot;
+}
+function buildPlatformToolPackFactories() {
+    const factories = [];
+    if (hasSlack) {
+        const platformSlackOps = {
+            postBlocks: async (conversationId, { text, blocks, threadTs }) => {
+                const bot = requireSlackBot(SLACK_BLOCKKIT_TOOL);
+                const ts = threadTs
+                    ? await bot.postInThreadBlocks(conversationId, threadTs, text, blocks)
+                    : await bot.postMessageBlocks(conversationId, text, blocks);
+                bot.logBotResponse(conversationId, text, ts, threadTs, { slackBlocks: blocks });
+                return { ts };
+            },
+            updateBlocks: async (conversationId, { ts, text, blocks, threadTs }) => {
+                const bot = requireSlackBot(SLACK_BLOCKKIT_TOOL);
+                await bot.updateMessageBlocks(conversationId, ts, text, blocks);
+                bot.logBotResponse(conversationId, text, ts, threadTs, { slackBlocks: blocks });
+            },
+            ownsBlockKitMessage: (conversationId, ts, threadTs) => requireSlackBot(SLACK_BLOCKKIT_TOOL).ownsBlockKitMessage(conversationId, ts, threadTs),
+        };
+        factories.push(() => createSlackToolPack(platformSlackOps));
+    }
+    if (!githubPolicy)
+        return factories;
+    const githubCapabilities = githubPolicy.capabilities;
+    const platformGithubOps = {
+        createPullRequest: (conversationId, request) => requireGithubBot(GITHUB_PR_TOOL).ops.createPullRequest(conversationId, request),
+        getChecks: (conversationId, branch) => requireGithubBot(GITHUB_CHECKS_TOOL).ops.getChecks(conversationId, branch),
+        getJobLog: (conversationId, jobId) => requireGithubBot(GITHUB_CHECKS_TOOL).ops.getJobLog(conversationId, jobId),
+        replyToReviewThread: (conversationId, commentId, body) => requireGithubBot(GITHUB_REVIEW_REPLY_TOOL).ops.replyToReviewThread(conversationId, commentId, body),
+        readGithub: (conversationId, request) => requireGithubBot(GITHUB_READ_TOOL).ops.readGithub(conversationId, request),
+        manageIssue: (conversationId, request) => requireGithubBot(GITHUB_ISSUE_TOOL).ops.manageIssue(conversationId, request),
+    };
+    factories.push(() => createGithubToolPack(platformGithubOps, githubCapabilities));
+    return factories;
+}
+let eventScheduler;
 const handler = createConversationRuntime({
-    workingDir,
+    workspace,
+    eventScheduler: () => eventScheduler,
     sandbox,
     vaultManager,
     provisioner,
+    resourceController,
     linkTokenStore,
     sessionViewTokenStore,
     adminTokenStore,
+    openConnector,
+    runEvents,
     portalBaseUrl: portalBaseUrl(),
-    platformNotifier,
-    platformReactor,
-    platformPrCreator,
+    platformToolPackFactories: buildPlatformToolPackFactories(),
+    memoryCapture: (models) => new MemoryCapture(models),
 });
 const sandboxDesc = sandbox.type === "host"
     ? "host"
@@ -362,35 +363,15 @@ const sandboxDesc = sandbox.type === "host"
         ? `container:${sandbox.container}`
         : sandbox.type === "image"
             ? `image:${sandbox.image}`
-            : sandbox.type === "firecracker"
-                ? `firecracker:${sandbox.vmId}`
-                : `cloudflare:${sandbox.sandboxId}`;
+            : `cloudflare:${sandbox.sandboxId}`;
 log.logStartup(workingDir, sandboxDesc);
 logHarnessStartupSummary();
-/**
- * One-look confirmation of the harness runtime surface, aimed at upgrade
- * verification: config moved from ~/.pi to ~/.mikan with no fallback, so a
- * missing auth.json here is the first thing to check when runs fail.
- */
 function logHarnessStartupSummary() {
     const proxy = process.env.HTTPS_PROXY ??
         process.env.https_proxy ??
         process.env.HTTP_PROXY ??
         process.env.http_proxy;
     log.logInfo(`HTTP dispatcher: idle timeout ${httpIdleTimeoutMs}ms${proxy ? `, proxy ${proxy}` : ", no proxy"}`);
-    const authPath = defaultAuthPath();
-    if (existsSync(authPath)) {
-        try {
-            const providers = Object.keys(JSON.parse(readFileSync(authPath, "utf-8")));
-            log.logInfo(`Harness auth: ${authPath} (providers: ${providers.join(", ") || "none"})`);
-        }
-        catch {
-            log.logWarning(`Harness auth: ${authPath} exists but is not valid JSON`);
-        }
-    }
-    else {
-        log.logInfo(`Harness auth: ${authPath} missing — provider keys come from env vars only`);
-    }
     const modelsPath = defaultModelsJsonPath();
     log.logInfo(existsSync(modelsPath)
         ? `Harness models.json: ${modelsPath}`
@@ -402,14 +383,11 @@ if (hasSlack) {
     if (!slackMessagingBotToken || !slackAppToken) {
         throw new Error("Slack startup requires both SLACK_APP_TOKEN and SLACK_BOT_TOKEN");
     }
-    const sharedStore = new ChannelStore({ workingDir, botToken: slackMessagingBotToken });
     const slackMessagingBot = new SlackMessagingBotClass(handler, {
         appToken: slackAppToken,
         botToken: slackMessagingBotToken,
-        workingDir,
-        store: sharedStore,
+        workspace,
     });
-    bots.push(slackMessagingBot);
     botsByPlatform.slack = slackMessagingBot;
     log.logInfo("Platform: Slack");
 }
@@ -420,9 +398,8 @@ if (hasTelegram) {
     }
     const telegramMessagingBot = new TelegramMessagingBot(handler, {
         token: telegramToken,
-        workingDir,
+        workspace,
     });
-    bots.push(telegramMessagingBot);
     botsByPlatform.telegram = telegramMessagingBot;
     log.logInfo("Platform: Telegram");
 }
@@ -431,47 +408,27 @@ if (hasDiscord) {
     if (!discordToken) {
         throw new Error("Discord startup requires DISCORD_BOT_TOKEN");
     }
+    const { DiscordMessagingBot } = await import("./adapters/discord/bot.js");
     const discordMessagingBot = new DiscordMessagingBot(handler, {
         token: discordToken,
-        workingDir,
+        workspace,
     });
-    bots.push(discordMessagingBot);
     botsByPlatform.discord = discordMessagingBot;
     log.logInfo("Platform: Discord");
 }
-if (hasGithub) {
-    if (!GITHUB_APP_ID || !GITHUB_INSTALLATION_ID) {
-        throw new Error("GitHub startup requires GITHUB_APP_ID and GITHUB_INSTALLATION_ID");
-    }
-    // Env vars flatten PEM newlines to literal `\n`; a key file avoids that.
-    const githubPrivateKey = GITHUB_APP_PRIVATE_KEY_PATH
-        ? readFileSync(GITHUB_APP_PRIVATE_KEY_PATH, "utf-8")
-        : GITHUB_APP_PRIVATE_KEY?.replace(/\\n/g, "\n");
-    if (!githubPrivateKey) {
-        throw new Error("GitHub startup requires GITHUB_APP_PRIVATE_KEY or GITHUB_APP_PRIVATE_KEY_PATH");
-    }
-    const pollIntervalSeconds = GITHUB_POLL_INTERVAL ? parseInt(GITHUB_POLL_INTERVAL, 10) : NaN;
-    const githubMessagingBot = new GithubMessagingBot(handler, {
-        appId: GITHUB_APP_ID,
-        privateKey: githubPrivateKey,
-        installationId: GITHUB_INSTALLATION_ID,
-        repos: GITHUB_REPOS
-            ? GITHUB_REPOS.split(",")
-                .map((repo) => repo.trim())
-                .filter(Boolean)
-            : [],
-        pollIntervalMs: (Number.isFinite(pollIntervalSeconds) && pollIntervalSeconds > 0 ? pollIntervalSeconds : 60) *
-            1000,
-        workingDir,
-        syncStatePath: join(stateDir, "github-sync.json"),
+if (githubPolicy && GITHUB_AGENT_TOKEN) {
+    botsByPlatform.github = new GithubMessagingBot(handler, {
+        token: GITHUB_AGENT_TOKEN,
+        policy: githubPolicy,
+        workspace,
     });
-    bots.push(githubMessagingBot);
-    botsByPlatform.github = githubMessagingBot;
     log.logInfo("Platform: GitHub");
 }
-if (LINK_PORT) {
-    startWebServer({
+const githubBot = botsByPlatform.github;
+const webServer = LINK_PORT
+    ? startWebServer({
         port: LINK_PORT,
+        host: resolveLinkListenHost(),
         linkTokenStore,
         vaultManager,
         notify: async (platform, conversationId, message) => {
@@ -480,29 +437,96 @@ if (LINK_PORT) {
                 await bot.postMessage(conversationId, message);
         },
         sessionViewTokenStore,
-        sessionViewInteractive: { handler, botsByPlatform },
-        adminOptions: { adminTokenStore, workingDir, runtime: handler, sandbox, botsByPlatform },
-    });
+        sessionViewInteractive: { handler, botsByPlatform, runEvents },
+        adminOptions: {
+            adminTokenStore,
+            workspace,
+            runtime: handler,
+            sandbox,
+            botsByPlatform,
+            eventScheduler: () => eventScheduler,
+        },
+        githubWebhook: GITHUB_WEBHOOK_SECRET && githubBot
+            ? {
+                secret: GITHUB_WEBHOOK_SECRET,
+                onDelivery: (delivery) => void githubBot.receive(delivery),
+            }
+            : undefined,
+    })
+    : undefined;
+const WEB_SERVER_CLOSE_GRACE_MS = 5000;
+function stopWebServer() {
+    if (!webServer)
+        return Promise.resolve();
+    return closeWebServer(webServer, WEB_SERVER_CLOSE_GRACE_MS);
 }
-// Start events watcher with explicit platform routing
-const eventsWatcher = new EventsWatcher(join(workingDir, "events"), botsByPlatform);
+async function stopConversationIntake() {
+    const results = await Promise.allSettled([
+        ...Object.values(botsByPlatform).map((bot) => bot.stop()),
+        stopWebServer(),
+    ]);
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    if (failures.length > 0)
+        throw new AggregateError(failures, "Failed to stop conversation intake");
+}
+async function waitForGracefulDrain(drain) {
+    let timeout;
+    const settled = await Promise.race([
+        drain.then(() => true),
+        new Promise((resolve) => {
+            timeout = setTimeout(() => resolve(false), SHUTDOWN_DRAIN_TIMEOUT_MS);
+        }),
+    ]);
+    if (timeout)
+        clearTimeout(timeout);
+    return settled;
+}
+async function drainConversationWork(intakeStop) {
+    const gracefulDrain = Promise.allSettled([intakeStop]);
+    if (!(await waitForGracefulDrain(gracefulDrain))) {
+        const runtimeResult = await Promise.allSettled([handler.shutdown(0)]);
+        const failures = [
+            new Error(`Conversation work did not drain within ${SHUTDOWN_DRAIN_TIMEOUT_MS}ms`),
+            ...runtimeResult.flatMap((result) => (result.status === "rejected" ? [result.reason] : [])),
+        ];
+        throw new AggregateError(failures, "Failed to drain conversation work");
+    }
+    const results = [
+        ...(await gracefulDrain),
+        ...(await Promise.allSettled([handler.shutdown(SHUTDOWN_DRAIN_TIMEOUT_MS)])),
+    ];
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    if (failures.length > 0)
+        throw new AggregateError(failures, "Failed to drain conversation work");
+}
+eventScheduler = new EventScheduler(workspace, botsByPlatform);
 const slackMessagingBot = botsByPlatform.slack;
 if (slackMessagingBot) {
-    slackMessagingBot.setEventsWatcher(eventsWatcher);
-}
-eventsWatcher.start();
-// Handle shutdown
-async function shutdown() {
-    await handler.shutdown();
-    eventsWatcher.stop();
-    await Sentry.close(5000);
-    process.exit(0);
+    slackMessagingBot.setEventScheduler(eventScheduler);
 }
-process.on("SIGINT", shutdown);
-process.on("SIGTERM", shutdown);
-// Start all bots
-await Promise.all(bots.map((bot) => bot.start().catch((err) => {
-    log.logWarning("Failed to start bot", err instanceof Error ? err.message : String(err));
+eventScheduler.start();
+const shutdown = createProcessShutdownHandler({
+    stop: () => {
+        const intakeStop = stopConversationIntake();
+        return runShutdownSteps([
+            {
+                name: "event scheduler",
+                run: async () => {
+                    eventScheduler?.stop();
+                },
+            },
+            { name: "conversation work", run: () => drainConversationWork(intakeStop) },
+        ]);
+    },
+    shutdownObservability: () => shutdownObservability(5000),
+    captureError,
+    warn: log.logWarning,
+    exit: (code) => process.exit(code),
+});
+process.on("SIGINT", () => void shutdown("SIGINT"));
+process.on("SIGTERM", () => void shutdown("SIGTERM"));
+await Promise.all(Object.values(botsByPlatform).map((bot) => bot.start().catch((err) => {
+    log.logWarning("Failed to start bot", errorMessage(err));
     process.exit(1);
 })));
 //# sourceMappingURL=main.js.map