@integrity-labs/agt-cli 0.28.1164 → 0.28.1165

package/dist/{chunk-J3LCXQGY.js → chunk-ZDHCIJL6.js}

@@ -1,6 +1,6 @@
 import {
   encodeClaudeProjectPath
-} from "./chunk-DR7PAO2Y.js";
+} from "./chunk-TNPLCJIG.js";
 
 // src/lib/daily-session.ts
 import { randomUUID } from "crypto";
@@ -235,4 +235,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-J3LCXQGY.js.map
+//# sourceMappingURL=chunk-ZDHCIJL6.js.map

package/dist/{claude-code-updater-L7C3DZJ3.js → claude-code-updater-EM3AY2PR.js}

@@ -12,9 +12,9 @@ import {
   probeClaudeInstalls,
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
-} from "./chunk-WPNCOXIB.js";
+} from "./chunk-T7NKHOJF.js";
 import "./chunk-XWVM4KPK.js";
-import "./chunk-DR7PAO2Y.js";
+import "./chunk-TNPLCJIG.js";
 import "./chunk-EL5MWGGH.js";
 import "./chunk-DGUM43GV.js";
 export {
@@ -32,4 +32,4 @@ export {
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
 };
-//# sourceMappingURL=claude-code-updater-L7C3DZJ3.js.map
+//# sourceMappingURL=claude-code-updater-EM3AY2PR.js.map

package/dist/{claude-pair-runtime-EQVMQMTF.js → claude-pair-runtime-P45H3GNC.js}

@@ -8,7 +8,7 @@ import {
 import {
   redactPaneFrame,
   sanitizeTerminalFrame
-} from "./chunk-DR7PAO2Y.js";
+} from "./chunk-TNPLCJIG.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -321,7 +321,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-BP3EXMFT.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-KSV7RIQQ.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -836,4 +836,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-EQVMQMTF.js.map
+//# sourceMappingURL=claude-pair-runtime-P45H3GNC.js.map

package/dist/lib/manager-worker.js

@@ -77,7 +77,7 @@ import {
   setConfigHash,
   shellGuard,
   tripClass
-} from "../chunk-6SIOI32E.js";
+} from "../chunk-MBNPMML4.js";
 import {
   CLAUDE_CODE_SECURITY_FLOOR,
   SELF_UPDATE_TIMEOUTS,
@@ -90,7 +90,7 @@ import {
   runSafeCleanup,
   tightestDiskStat,
   withPackageCacheLock
-} from "../chunk-WPNCOXIB.js";
+} from "../chunk-T7NKHOJF.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -177,7 +177,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-CHTG2VLG.js";
+} from "../chunk-FGPPJKJ5.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -186,7 +186,7 @@ import {
   sessionTranscriptDir,
   subagentActivityAgeSeconds,
   transcriptActivityAgeSeconds
-} from "../chunk-J3LCXQGY.js";
+} from "../chunk-ZDHCIJL6.js";
 import {
   classifyUnanswerablePane,
   focusedConfirmDialogBlock,
@@ -304,7 +304,7 @@ import {
   serializeAccountEnforcementMarker,
   stabiliseResetInstant,
   sumTranscriptUsageInWindow
-} from "../chunk-DR7PAO2Y.js";
+} from "../chunk-TNPLCJIG.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -15082,7 +15082,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-ASP2NY2K.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-XVYYSQQN.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -15874,7 +15874,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1164" : "dev";
+var agtCliVersion = true ? "0.28.1165" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -17674,7 +17674,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-BP3EXMFT.js");
+      const { collectDiagnostics } = await import("../persistent-session-KSV7RIQQ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -17817,7 +17817,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-BP3EXMFT.js");
+      const { collectDiagnostics } = await import("../persistent-session-KSV7RIQQ.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -18017,7 +18017,7 @@ async function pollCycleInner() {
       setConfigHash(hbResp?.config_hash ?? null);
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
-        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-L7C3DZJ3.js");
+        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-EM3AY2PR.js");
         claudeUpdaterInFlight = true;
         if (desiredClaudeCodeVersion && (claudePairLoop.busy || claudePairingInProgress())) {
           log(
@@ -18049,7 +18049,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-ASP2NY2K.js");
+      } = await import("../responsiveness-probe-XVYYSQQN.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -18166,7 +18166,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-ASP2NY2K.js");
+        } = await import("../responsiveness-probe-XVYYSQQN.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -18452,7 +18452,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-ASP2NY2K.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-XVYYSQQN.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -18483,7 +18483,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-BP3EXMFT.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-KSV7RIQQ.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -18648,7 +18648,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-KR2CABKC.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-KMMDVC5E.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -23316,7 +23316,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-ASP2NY2K.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-XVYYSQQN.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -23359,7 +23359,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-BP3EXMFT.js");
+        const { collectDiagnostics } = await import("../persistent-session-KSV7RIQQ.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -23410,7 +23410,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-BP3EXMFT.js");
+      const { collectDiagnostics } = await import("../persistent-session-KSV7RIQQ.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -24104,7 +24104,7 @@ async function processClaudePairSessions(agents) {
     snapshotPairConfig,
     // ENG-11659: result -> report body + the manager.log line that records it.
     planPairStartReport
-  } = await import("../claude-pair-runtime-EQVMQMTF.js");
+  } = await import("../claude-pair-runtime-P45H3GNC.js");
   const { resetClaudeSignin, describeSigninResetForLog, describeSigninResetFailure } = await import("../claude-signin-reset-EF3UO5IK.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);

package/dist/mcp/direct-chat-channel.js

@@ -19117,7 +19117,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str, str.replace(/^\s*|\s*$/g, ""));
     }
     _exports.trim = trim;
-    function truncate(input, length, killwords, end) {
+    function truncate2(input, length, killwords, end) {
       var orig = input;
       input = normalize(input, "");
       length = length || 255;
@@ -19136,7 +19136,7 @@ var require_filters = __commonJS({
       input += end !== void 0 && end !== null ? end : "...";
       return r.copySafeness(orig, input);
     }
-    _exports.truncate = truncate;
+    _exports.truncate = truncate2;
     function upper(str) {
       str = normalize(str, "");
       return str.toUpperCase();
@@ -43719,6 +43719,183 @@ var videoRenderTriggerAdapter = {
 };
 registerTriggerSource(videoRenderTriggerAdapter);
 
+// ../core/dist/triggers/adapters/webhook.js
+var WEBHOOK_TRIGGER_PROVIDER = "webhook";
+var WEBHOOK_MAX_BODY_BYTES = 1280 * 1024;
+var WEBHOOK_PROMPT_MAX_CHARS = 8e3;
+var WEBHOOK_RAW_MAX_CHARS = 64 * 1024;
+var WEBHOOK_INSTRUCTION_MAX_CHARS = 2e3;
+var WEBHOOK_NAME_MAX_CHARS = 80;
+var WEBHOOK_DEFAULT_RATE_CAP = 60;
+var WEBHOOK_MAX_RATE_CAP = 1e3;
+var WEBHOOK_PRESETS = {
+  // https://docs.aws.amazon.com/eventbridge/latest/ref/overiew-event-structure.html
+  eventbridge: {
+    dedupPath: "id",
+    eventTypePaths: ["source", "detail-type"],
+    payloadPath: "detail",
+    timePath: "time"
+  },
+  // Raw-body hash dedup, whole body as payload. Set dedup_path when the
+  // sender has a stable id, or two identical bodies collapse into one.
+  generic: {}
+};
+var PATH_RE = /^[A-Za-z0-9_$-]+(\.[A-Za-z0-9_$-]+){0,9}$/;
+function readPath(value, path) {
+  let cur = value;
+  for (const key of path.split(".")) {
+    if (cur === null || typeof cur !== "object" || Array.isArray(cur))
+      return void 0;
+    if (!Object.prototype.hasOwnProperty.call(cur, key))
+      return void 0;
+    cur = cur[key];
+  }
+  return cur;
+}
+function scalarString(v) {
+  if (typeof v === "string")
+    return v.length > 0 ? v : null;
+  if (typeof v === "number" && Number.isFinite(v))
+    return String(v);
+  return null;
+}
+function truncate(text, max) {
+  if (text.length <= max)
+    return text;
+  return `${text.slice(0, max)}
+... [truncated ${text.length - max} more characters]`;
+}
+function resolvePreset(config2) {
+  const name = config2["preset"];
+  const base = typeof name === "string" && name in WEBHOOK_PRESETS ? WEBHOOK_PRESETS[name] : WEBHOOK_PRESETS.generic;
+  const dedup = config2["dedup_path"];
+  const type = config2["event_type_path"];
+  const payload = config2["payload_path"];
+  return {
+    ...base,
+    ...typeof dedup === "string" && dedup ? { dedupPath: dedup } : {},
+    ...typeof type === "string" && type ? { eventTypePaths: [type] } : {},
+    ...typeof payload === "string" && payload ? { payloadPath: payload } : {}
+  };
+}
+function validateWebhookConfig(input) {
+  const out = {};
+  const name = input["name"];
+  if (name !== void 0) {
+    if (typeof name !== "string")
+      return { ok: false, error: "name must be a string" };
+    const trimmed = name.trim();
+    if (trimmed.length > WEBHOOK_NAME_MAX_CHARS) {
+      return { ok: false, error: `name must be at most ${WEBHOOK_NAME_MAX_CHARS} characters` };
+    }
+    if (trimmed)
+      out["name"] = trimmed;
+  }
+  const instruction = input["instruction"];
+  if (typeof instruction !== "string" || !instruction.trim()) {
+    return {
+      ok: false,
+      error: "instruction is required: tell the agent what to do when an event arrives"
+    };
+  }
+  if (instruction.trim().length > WEBHOOK_INSTRUCTION_MAX_CHARS) {
+    return {
+      ok: false,
+      error: `instruction must be at most ${WEBHOOK_INSTRUCTION_MAX_CHARS} characters`
+    };
+  }
+  out["instruction"] = instruction.trim();
+  const preset = input["preset"] ?? "generic";
+  if (typeof preset !== "string" || !(preset in WEBHOOK_PRESETS)) {
+    return {
+      ok: false,
+      error: `preset must be one of: ${Object.keys(WEBHOOK_PRESETS).join(", ")}`
+    };
+  }
+  out["preset"] = preset;
+  for (const key of ["dedup_path", "event_type_path", "payload_path"]) {
+    const v = input[key];
+    if (v === void 0 || v === null || v === "")
+      continue;
+    if (typeof v !== "string" || !PATH_RE.test(v)) {
+      return { ok: false, error: `${key} must be a dot path like "detail.id"` };
+    }
+    out[key] = v;
+  }
+  const cap = input["max_events_per_hour"];
+  if (cap !== void 0 && cap !== null) {
+    if (typeof cap !== "number" || !Number.isInteger(cap) || cap < 1 || cap > WEBHOOK_MAX_RATE_CAP) {
+      return {
+        ok: false,
+        error: `max_events_per_hour must be an integer from 1 to ${WEBHOOK_MAX_RATE_CAP}`
+      };
+    }
+    out["max_events_per_hour"] = cap;
+  } else {
+    out["max_events_per_hour"] = WEBHOOK_DEFAULT_RATE_CAP;
+  }
+  return { ok: true, config: out };
+}
+function webhookRateCap(trigger) {
+  const cap = trigger.config["max_events_per_hour"];
+  if (typeof cap === "number" && Number.isInteger(cap) && cap >= 1) {
+    return Math.min(cap, WEBHOOK_MAX_RATE_CAP);
+  }
+  return WEBHOOK_DEFAULT_RATE_CAP;
+}
+function buildWebhookEvent(req, config2, now = /* @__PURE__ */ new Date()) {
+  const preset = resolvePreset(config2);
+  const body = req.body;
+  const raw = req.rawBody ?? JSON.stringify(body ?? null);
+  const idValue = preset.dedupPath ? scalarString(readPath(body, preset.dedupPath)) : null;
+  const dedupKey = idValue ? `wh:id:${stableHash(idValue)}` : `wh:raw:${stableHash(raw)}`;
+  const typeParts = (preset.eventTypePaths ?? []).map((p2) => scalarString(readPath(body, p2))).filter((v) => v !== null).map((v) => v.slice(0, 200));
+  const eventType = typeParts.length > 0 ? typeParts.join(" / ") : "webhook event";
+  const timeValue = preset.timePath ? scalarString(readPath(body, preset.timePath)) : null;
+  const timeMs = timeValue ? Date.parse(timeValue) : NaN;
+  const occurredAt = Number.isFinite(timeMs) ? new Date(timeMs).toISOString() : now.toISOString();
+  let payload = body;
+  if (preset.payloadPath) {
+    const sub = readPath(body, preset.payloadPath);
+    if (sub !== void 0)
+      payload = sub;
+  }
+  const rendered = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) ?? "null";
+  const lines = [`Event: ${eventType}`];
+  if (idValue)
+    lines.push(`Event id: ${idValue.slice(0, 200)}`);
+  lines.push("", truncate(rendered, WEBHOOK_PROMPT_MAX_CHARS));
+  return {
+    provider: WEBHOOK_TRIGGER_PROVIDER,
+    occurredAt,
+    dedupKey,
+    sourceTrust: "untrusted",
+    title: eventType,
+    body: lines.join("\n"),
+    // Keep the ledger row bounded: the full body when small, else a marker
+    // with the head of it. Never headers (the bearer token rides there).
+    raw: raw.length <= WEBHOOK_RAW_MAX_CHARS ? body : { truncated: true, bytes: raw.length, head: raw.slice(0, WEBHOOK_RAW_MAX_CHARS) },
+    meaningful: true
+  };
+}
+var webhookTriggerAdapter = {
+  provider: WEBHOOK_TRIGGER_PROVIDER,
+  kind: "webhook",
+  webhookAuth: "bearer",
+  webhookEvents: [],
+  multiInstance: true,
+  maxBodyBytes: WEBHOOK_MAX_BODY_BYTES,
+  validateConfig: validateWebhookConfig,
+  rateCapPerHour: (trigger) => webhookRateCap(trigger),
+  // Webhook-kind triggers are minted only on POST /agents/:id/triggers
+  // (agent.edit); /host/triggers refuses non-poll providers.
+  operatorInstruction: true,
+  ingest(req, trigger) {
+    return [buildWebhookEvent(req, trigger.config)];
+  }
+};
+registerTriggerSource(webhookTriggerAdapter);
+
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
   {

package/dist/mcp/index.js

@@ -19117,7 +19117,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str, str.replace(/^\s*|\s*$/g, ""));
     }
     _exports.trim = trim;
-    function truncate2(input, length, killwords, end) {
+    function truncate3(input, length, killwords, end) {
       var orig = input;
       input = normalize(input, "");
       length = length || 255;
@@ -19136,7 +19136,7 @@ var require_filters = __commonJS({
       input += end !== void 0 && end !== null ? end : "...";
       return r.copySafeness(orig, input);
     }
-    _exports.truncate = truncate2;
+    _exports.truncate = truncate3;
     function upper(str) {
       str = normalize(str, "");
       return str.toUpperCase();
@@ -29316,6 +29316,183 @@ var videoRenderTriggerAdapter = {
 };
 registerTriggerSource(videoRenderTriggerAdapter);
 
+// ../core/dist/triggers/adapters/webhook.js
+var WEBHOOK_TRIGGER_PROVIDER = "webhook";
+var WEBHOOK_MAX_BODY_BYTES = 1280 * 1024;
+var WEBHOOK_PROMPT_MAX_CHARS = 8e3;
+var WEBHOOK_RAW_MAX_CHARS = 64 * 1024;
+var WEBHOOK_INSTRUCTION_MAX_CHARS = 2e3;
+var WEBHOOK_NAME_MAX_CHARS = 80;
+var WEBHOOK_DEFAULT_RATE_CAP = 60;
+var WEBHOOK_MAX_RATE_CAP = 1e3;
+var WEBHOOK_PRESETS = {
+  // https://docs.aws.amazon.com/eventbridge/latest/ref/overiew-event-structure.html
+  eventbridge: {
+    dedupPath: "id",
+    eventTypePaths: ["source", "detail-type"],
+    payloadPath: "detail",
+    timePath: "time"
+  },
+  // Raw-body hash dedup, whole body as payload. Set dedup_path when the
+  // sender has a stable id, or two identical bodies collapse into one.
+  generic: {}
+};
+var PATH_RE = /^[A-Za-z0-9_$-]+(\.[A-Za-z0-9_$-]+){0,9}$/;
+function readPath(value, path) {
+  let cur = value;
+  for (const key of path.split(".")) {
+    if (cur === null || typeof cur !== "object" || Array.isArray(cur))
+      return void 0;
+    if (!Object.prototype.hasOwnProperty.call(cur, key))
+      return void 0;
+    cur = cur[key];
+  }
+  return cur;
+}
+function scalarString(v) {
+  if (typeof v === "string")
+    return v.length > 0 ? v : null;
+  if (typeof v === "number" && Number.isFinite(v))
+    return String(v);
+  return null;
+}
+function truncate(text, max) {
+  if (text.length <= max)
+    return text;
+  return `${text.slice(0, max)}
+... [truncated ${text.length - max} more characters]`;
+}
+function resolvePreset(config2) {
+  const name = config2["preset"];
+  const base = typeof name === "string" && name in WEBHOOK_PRESETS ? WEBHOOK_PRESETS[name] : WEBHOOK_PRESETS.generic;
+  const dedup = config2["dedup_path"];
+  const type = config2["event_type_path"];
+  const payload = config2["payload_path"];
+  return {
+    ...base,
+    ...typeof dedup === "string" && dedup ? { dedupPath: dedup } : {},
+    ...typeof type === "string" && type ? { eventTypePaths: [type] } : {},
+    ...typeof payload === "string" && payload ? { payloadPath: payload } : {}
+  };
+}
+function validateWebhookConfig(input) {
+  const out = {};
+  const name = input["name"];
+  if (name !== void 0) {
+    if (typeof name !== "string")
+      return { ok: false, error: "name must be a string" };
+    const trimmed = name.trim();
+    if (trimmed.length > WEBHOOK_NAME_MAX_CHARS) {
+      return { ok: false, error: `name must be at most ${WEBHOOK_NAME_MAX_CHARS} characters` };
+    }
+    if (trimmed)
+      out["name"] = trimmed;
+  }
+  const instruction = input["instruction"];
+  if (typeof instruction !== "string" || !instruction.trim()) {
+    return {
+      ok: false,
+      error: "instruction is required: tell the agent what to do when an event arrives"
+    };
+  }
+  if (instruction.trim().length > WEBHOOK_INSTRUCTION_MAX_CHARS) {
+    return {
+      ok: false,
+      error: `instruction must be at most ${WEBHOOK_INSTRUCTION_MAX_CHARS} characters`
+    };
+  }
+  out["instruction"] = instruction.trim();
+  const preset = input["preset"] ?? "generic";
+  if (typeof preset !== "string" || !(preset in WEBHOOK_PRESETS)) {
+    return {
+      ok: false,
+      error: `preset must be one of: ${Object.keys(WEBHOOK_PRESETS).join(", ")}`
+    };
+  }
+  out["preset"] = preset;
+  for (const key of ["dedup_path", "event_type_path", "payload_path"]) {
+    const v = input[key];
+    if (v === void 0 || v === null || v === "")
+      continue;
+    if (typeof v !== "string" || !PATH_RE.test(v)) {
+      return { ok: false, error: `${key} must be a dot path like "detail.id"` };
+    }
+    out[key] = v;
+  }
+  const cap = input["max_events_per_hour"];
+  if (cap !== void 0 && cap !== null) {
+    if (typeof cap !== "number" || !Number.isInteger(cap) || cap < 1 || cap > WEBHOOK_MAX_RATE_CAP) {
+      return {
+        ok: false,
+        error: `max_events_per_hour must be an integer from 1 to ${WEBHOOK_MAX_RATE_CAP}`
+      };
+    }
+    out["max_events_per_hour"] = cap;
+  } else {
+    out["max_events_per_hour"] = WEBHOOK_DEFAULT_RATE_CAP;
+  }
+  return { ok: true, config: out };
+}
+function webhookRateCap(trigger) {
+  const cap = trigger.config["max_events_per_hour"];
+  if (typeof cap === "number" && Number.isInteger(cap) && cap >= 1) {
+    return Math.min(cap, WEBHOOK_MAX_RATE_CAP);
+  }
+  return WEBHOOK_DEFAULT_RATE_CAP;
+}
+function buildWebhookEvent(req, config2, now = /* @__PURE__ */ new Date()) {
+  const preset = resolvePreset(config2);
+  const body = req.body;
+  const raw = req.rawBody ?? JSON.stringify(body ?? null);
+  const idValue = preset.dedupPath ? scalarString(readPath(body, preset.dedupPath)) : null;
+  const dedupKey = idValue ? `wh:id:${stableHash(idValue)}` : `wh:raw:${stableHash(raw)}`;
+  const typeParts = (preset.eventTypePaths ?? []).map((p2) => scalarString(readPath(body, p2))).filter((v) => v !== null).map((v) => v.slice(0, 200));
+  const eventType = typeParts.length > 0 ? typeParts.join(" / ") : "webhook event";
+  const timeValue = preset.timePath ? scalarString(readPath(body, preset.timePath)) : null;
+  const timeMs = timeValue ? Date.parse(timeValue) : NaN;
+  const occurredAt = Number.isFinite(timeMs) ? new Date(timeMs).toISOString() : now.toISOString();
+  let payload = body;
+  if (preset.payloadPath) {
+    const sub = readPath(body, preset.payloadPath);
+    if (sub !== void 0)
+      payload = sub;
+  }
+  const rendered = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) ?? "null";
+  const lines = [`Event: ${eventType}`];
+  if (idValue)
+    lines.push(`Event id: ${idValue.slice(0, 200)}`);
+  lines.push("", truncate(rendered, WEBHOOK_PROMPT_MAX_CHARS));
+  return {
+    provider: WEBHOOK_TRIGGER_PROVIDER,
+    occurredAt,
+    dedupKey,
+    sourceTrust: "untrusted",
+    title: eventType,
+    body: lines.join("\n"),
+    // Keep the ledger row bounded: the full body when small, else a marker
+    // with the head of it. Never headers (the bearer token rides there).
+    raw: raw.length <= WEBHOOK_RAW_MAX_CHARS ? body : { truncated: true, bytes: raw.length, head: raw.slice(0, WEBHOOK_RAW_MAX_CHARS) },
+    meaningful: true
+  };
+}
+var webhookTriggerAdapter = {
+  provider: WEBHOOK_TRIGGER_PROVIDER,
+  kind: "webhook",
+  webhookAuth: "bearer",
+  webhookEvents: [],
+  multiInstance: true,
+  maxBodyBytes: WEBHOOK_MAX_BODY_BYTES,
+  validateConfig: validateWebhookConfig,
+  rateCapPerHour: (trigger) => webhookRateCap(trigger),
+  // Webhook-kind triggers are minted only on POST /agents/:id/triggers
+  // (agent.edit); /host/triggers refuses non-poll providers.
+  operatorInstruction: true,
+  ingest(req, trigger) {
+    return [buildWebhookEvent(req, trigger.config)];
+  }
+};
+registerTriggerSource(webhookTriggerAdapter);
+
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
   {
@@ -47113,7 +47290,7 @@ function mayMutate(toolName) {
 function describeToolCallFailure(params) {
   const { path, toolName, readOnly, state, status, body, aborted: aborted2, timeoutMs } = params;
   const what = aborted2 ? `API ${path} did not respond within ${timeoutMs}ms` : `API ${path} returned ${status}`;
-  const detail = body ? `: ${truncate(body, 400)}` : "";
+  const detail = body ? `: ${truncate2(body, 400)}` : "";
   if (state === "not_committed") {
     return `${what}${detail} \u2014 the request was rejected before it took effect, so nothing changed. Safe to retry once the cause is fixed.`;
   }
@@ -47126,7 +47303,7 @@ function describeToolCallFailure(params) {
   }
   return `${what}${detail} \u2014 INDETERMINATE: the server may have completed this operation before the failure. ${tool} is read-only, so retrying is safe.`;
 }
-function truncate(text, max) {
+function truncate2(text, max) {
   return text.length > max ? `${text.slice(0, max)}\u2026` : text;
 }