@misterhuydo/sentinel 1.0.76 → 1.0.82

package/python/sentinel/sentinel_boss.py

@@ -1,1367 +1,1573 @@
-"""
-sentinel_boss.py — Claude-backed Sentinel Boss.
-
-Claude acts as the boss: reads project state, decides on actions,
-executes them via tool use, and responds naturally. One agentic loop
-per turn — Claude may call multiple tools before replying.
-"""
-
-import json
-import logging
-import os
-import re
-import subprocess
-import uuid
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Optional
-
-logger = logging.getLogger(__name__)
-
-# ── System prompt ────────────────────────────────────────────────────────────
-
-_SYSTEM = """\
-You are Sentinel Boss — the AI interface for Sentinel, a 24/7 autonomous DevOps agent.
-
-Sentinel watches production logs, detects errors, generates code fixes via Claude Code,
-and opens GitHub PRs for admin review (or pushes directly if AUTO_PUBLISH=true).
-
-Your job:
-- Understand what the DevOps engineer needs in natural language
-- Query Sentinel's live state (errors, fixes, open PRs) on their behalf
-- Deliver tasks/issues to the right project — you know all projects in this workspace
-- Control Sentinel (pause/resume) when asked
-- Give honest, concise answers — you know this system inside out
-- If a project name is unclear or ambiguous, ask the engineer to clarify — never guess
-
-What you can do (tools available):
-
-1. get_status        — Show recent errors detected, fixes applied/pending, open PRs.
-                       e.g. "what happened today?", "any issues?", "show open PRs"
-
-2. create_issue      — Deliver a fix/task to any project in this workspace by short name.
-                       You know all project names — use list_projects if you're unsure.
-                       If the project name is ambiguous or not found, ask to clarify.
-                       e.g. "tell 1881 to fix X", "look into Y in elprint", "investigate Z"
-
-3. pause_sentinel    — Create SENTINEL_PAUSE file to halt all auto-fix activity.
-                       e.g. "pause sentinel", "stop auto-fixing"
-
-4. resume_sentinel   — Remove SENTINEL_PAUSE file to resume normal operation.
-                       e.g. "resume sentinel", "unpause"
-
-5. list_projects     — List all configured repos and log sources in this Sentinel instance.
-                       e.g. "what projects are you watching?", "list all repos"
-
-6. search_logs       — SSH live to servers and grep logs in real time (uses fetch_log.sh with
-                       the query as GREP_FILTER). Falls back to cached files if unavailable.
-                       e.g. "search logs for illegal PIN in 1881", "find X in SSOLWA", "grep logs for Z"
-
-7. trigger_poll      — Trigger an immediate poll cycle without waiting for the schedule.
-                       e.g. "check now", "poll immediately", "don't wait, run now"
-
-8. get_repo_status   — Show the current git branch, last commit, and recent fix branches
-                       for a specific repository.
-                       e.g. "status of repo X", "what branch is cairn on?"
-
-9. list_recent_commits — List the most recent commits in a repo (including Sentinel's auto-fixes).
-                       e.g. "show me recent commits in elprint-sales", "what did sentinel commit?"
-
-10. get_fix_detail   — Get full details of a specific fix: error, patch path, PR URL, status.
-                       e.g. "show fix abc123", "details on that fix"
-
-11. list_errors      — List recent errors from the state store, optionally filtered by repo or source.
-                       e.g. "show all errors today", "what errors hit elprint this week?"
-
-12. pull_repo        — Run git pull on one or all managed application repos.
-                       e.g. "pull changes", "git pull all repos", "update the code"
-
-13. pull_config      — Run git pull on one or all Sentinel project config dirs.
-                       e.g. "pull config for 1881", "update sentinel config", "pull all configs"
-
-14. fetch_logs       — Run fetch_log.sh on demand to pull fresh logs from remote servers right now.
-                       Supports --debug mode and parameter overrides (tail count, grep filter).
-                       e.g. "fetch logs", "try fetch_log.sh for SSOLWA", "fetch logs with debug",
-                            "grab latest logs from STS", "fetch logs without filter"
-
-15. watch_bot        — Register a Slack bot for passive monitoring. Every message it posts is
-                       auto-queued as an issue in the bot's registered project.
-                       ALWAYS requires a project — infer from context or ask the user first.
-                       e.g. "listen to @alertbot", "watch @bot1 @bot2 for project 1881", "monitor @errorbot"
-
-16. unwatch_bot      — Remove a Slack bot from the passive watch list.
-                       e.g. "stop watching @alertbot", "unwatch @errorbot"
-
-17. list_watched_bots — Show all Slack bots currently being passively monitored and which projects
-                        they are delivering to.
-                        e.g. "which bots are you watching?", "list monitored bots"
-
-18. upgrade_sentinel — Pull the latest Sentinel agent code, update Python deps, and restart the
-                       process. Safe to run at any time — no restart if already up to date.
-                       e.g. "upgrade sentinel", "update sentinel", "upgrade yourself"
-
-19. ask_codebase     — Ask any natural-language question about a managed repo's codebase.
-                       Claude Code answers using its full knowledge of the code.
-                       e.g. "what does the 1881 backend do?", "find PIN validation in elprint",
-                            "any TODOs in cairn?", "are there security issues in elprint-sales?"
-
-20. restart_project  — Stop and restart a specific project instance (stop.sh + start.sh).
-                       e.g. "restart 1881", "reboot elprint", "restart the cairn project"
-
-21. tail_log         — Fetch the last N lines of a log source live, without a grep filter.
-                       e.g. "show recent SSOLWA logs", "tail STS", "last 200 lines from 1881 logs"
-
-When someone asks what you can do, what you support, what your capabilities are, or how you can help,
-reply with a short summary grouped by category:
-
-*Monitoring & status*
-• `get_status` — errors detected, fixes applied/pending/failed, open PRs — "what happened today?"
-• `get_repo_status` — per-repo breakdown of errors and fixes — "how is elprint doing?"
-• `list_recent_commits` — recent Sentinel auto-fix commits — "what did Sentinel commit?"
-
-*Log management*
-• `fetch_logs` — pull fresh logs from servers right now — "fetch logs for SSOLWA"
-• `search_logs` — live SSH grep on production servers — "search logs for illegal PIN in 1881"
-• `tail_log` — last N lines of a log source, no filter — "show recent SSOLWA logs"
-
-*Codebase questions*
-• `ask_codebase` — any question about a repo's code — "what does 1881 do?", "find PIN validation", "any TODOs?", "security issues?"
-
-*Fix management*
-• `get_fix_details` — full details of a specific fix — "show fix abc123"
-• `list_pending_prs` — all open Sentinel PRs awaiting review — "list open PRs"
-
-*Project & task delivery*
-• `list_projects` — all projects and repos Sentinel manages — "what projects do you manage?"
-• `create_issue` — deliver a task to any project by name — "tell 1881 to fix X"
-• `trigger_poll` — run a log-fetch + fix cycle right now — "check now"
-• `pause_sentinel` / `resume_sentinel` — halt or resume all auto-fix activity — "pause Sentinel"
-
-*Repo & config sync*
-• `pull_repo` — git pull on managed application repos — "pull latest code"
-• `pull_config` — git pull on Sentinel config dirs — "pull config for elprint"
-
-*Slack bot watching*
-• `watch_bot` — register a Slack bot for passive monitoring; its messages are auto-queued as issues — "listen to @alertbot"
-• `unwatch_bot` — stop monitoring a bot — "stop watching @errorbot"
-• `list_watched_bots` — show all bots currently being monitored — "which bots are you watching?"
-
-*Project control*
-• `restart_project` — stop + restart a specific project — "restart 1881"
-
-*Self-management*
-• `upgrade_sentinel` — git pull + pip install + restart — "upgrade sentinel", "update yourself"
-
-Tone: direct, professional, like a senior engineer who owns the system.
-Don't pad responses. Don't say "Great question!" or "Certainly!".
-If you don't know something, use a tool to find out before saying you don't know.
-
-When the engineer's request is fully handled, end your LAST message with the token: [DONE]
-IMPORTANT: Always write your actual reply text FIRST, then append [DONE] at the end. Example: "Hello! I'm Sentinel. [DONE]". Never output [DONE] as your only content.
-For greetings like "hello" or empty messages, introduce yourself briefly and offer help, then end with [DONE].
-If you need a follow-up from them, do NOT include [DONE] — wait for their next message.
-"""
-
-# ── Tool definitions ─────────────────────────────────────────────────────────
-
-_TOOLS = [
-    {
-        "name": "get_status",
-        "description": (
-            "Get recent errors, fixes applied, fixes pending review, and open PRs. "
-            "Use for: 'what happened today?', 'any issues?', 'how are things?', "
-            "'what are the open PRs?', 'did sentinel fix anything?'"
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "hours": {
-                    "type": "integer",
-                    "description": "Look-back window in hours (default 24)",
-                    "default": 24,
-                },
-            },
-        },
-    },
-    {
-        "name": "create_issue",
-        "description": (
-            "Deliver a fix/task request to a Sentinel project instance. "
-            "Use when the engineer says 'tell 1881 to do X', 'look into Y in project elprint', "
-            "'implement this in 1881: ...'. Can target any project by short name. "
-            "Defaults to the current project if no project is specified."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "description": {
-                    "type": "string",
-                    "description": "Full task/problem description — everything the engineer told you",
-                },
-                "project": {
-                    "type": "string",
-                    "description": "Project short name to deliver to (e.g. '1881', 'elprint'). Omit for current project.",
-                },
-                "target_repo": {
-                    "type": "string",
-                    "description": "Specific repo within the project (omit to let Sentinel auto-route)",
-                },
-            },
-            "required": ["description"],
-        },
-    },
-    {
-        "name": "get_fix_details",
-        "description": "Get full details of a specific fix by fingerprint (8+ hex chars).",
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "fingerprint": {"type": "string"},
-            },
-            "required": ["fingerprint"],
-        },
-    },
-    {
-        "name": "list_pending_prs",
-        "description": "List all open Sentinel PRs awaiting admin review.",
-        "input_schema": {"type": "object", "properties": {}},
-    },
-    {
-        "name": "pause_sentinel",
-        "description": (
-            "Pause ALL Sentinel fix activity immediately. "
-            "Use when the engineer says 'pause', 'stop', 'freeze', or 'hold off'."
-        ),
-        "input_schema": {"type": "object", "properties": {}},
-    },
-    {
-        "name": "resume_sentinel",
-        "description": "Resume Sentinel fix activity after a pause.",
-        "input_schema": {"type": "object", "properties": {}},
-    },
-    {
-        "name": "list_projects",
-        "description": (
-            "List all projects (Sentinel instances) in this workspace and the repos "
-            "each one manages. Use for: 'what projects do you manage?', 'list projects', "
-            "'what repos are configured?', 'show me all projects'."
-        ),
-        "input_schema": {"type": "object", "properties": {}},
-    },
-    {
-        "name": "search_logs",
-        "description": (
-            "Search production logs for a keyword or pattern. "
-            "When a project or source is specified (or can be inferred), performs a LIVE fetch "
-            "via fetch_log.sh with the query as the grep filter — SSHes directly to the server. "
-            "Falls back to searching locally-cached log files when no source can be determined. "
-            "Use for: 'search logs for illegal PIN in 1881', 'find X in SSOLWA logs', "
-            "'what did user Y do?', 'show entries for appid=Z', 'grep logs for X'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "query": {
-                    "type": "string",
-                    "description": "Keyword or regex to grep for",
-                },
-                "source": {
-                    "type": "string",
-                    "description": "Log source name to search (partial match against log-config filenames, e.g. 'SSOLWA', '1881'). Leave empty to search all sources.",
-                },
-                "max_matches": {
-                    "type": "integer",
-                    "description": "Max matching lines to return per source (default 30)",
-                    "default": 30,
-                },
-            },
-            "required": ["query"],
-        },
-    },
-    {
-        "name": "trigger_poll",
-        "description": (
-            "Trigger an immediate log-fetch and error-detection cycle without waiting "
-            "for the next scheduled interval. Use when: 'check now', 'run now', "
-            "'poll immediately', 'don't wait'."
-        ),
-        "input_schema": {"type": "object", "properties": {}},
-    },
-    {
-        "name": "get_repo_status",
-        "description": (
-            "Per-repository breakdown of errors detected and fixes applied. "
-            "Use for: 'how is repo X doing?', 'which repo has the most issues?', "
-            "'break down by repo'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "hours": {
-                    "type": "integer",
-                    "description": "Look-back window in hours (default 24)",
-                    "default": 24,
-                },
-            },
-        },
-    },
-    {
-        "name": "list_recent_commits",
-        "description": (
-            "List recent commits made by Sentinel across all managed repos. "
-            "Use for: 'what did Sentinel commit?', 'show recent auto-fixes', 'what was changed?'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "limit": {
-                    "type": "integer",
-                    "description": "Max commits per repo (default 5)",
-                    "default": 5,
-                },
-            },
-        },
-    },
-    {
-        "name": "pull_repo",
-        "description": (
-            "Run git pull on one or all managed repos to fetch latest changes from GitHub. "
-            "Use for: 'pull changes', 'git pull', 'update repo X', 'fetch latest code'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "repo": {
-                    "type": "string",
-                    "description": "Repo name to pull (omit to pull all configured repos)",
-                },
-            },
-        },
-    },
-    {
-        "name": "pull_config",
-        "description": (
-            "Run git pull on one or all Sentinel project config directories. "
-            "Projects are matched by short name ('1881', 'elprint') or full dir name ('sentinel-1881'). "
-            "Use for: 'pull config for 1881', 'update sentinel config', 'pull all configs'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "project": {
-                    "type": "string",
-                    "description": "Project short name or dir name to pull (omit for all projects)",
-                },
-            },
-        },
-    },
-    {
-        "name": "fetch_logs",
-        "description": (
-            "Run fetch_log.sh for one or all configured log sources to pull the latest logs "
-            "from remote servers right now. Use for: 'fetch logs', 'run fetch_log.sh', "
-            "'grab latest logs from SSOLWA', 'try fetch_log.sh for STS', "
-            "'pull logs from server', 'get fresh logs'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "source": {
-                    "type": "string",
-                    "description": "Log source name to fetch (partial match, e.g. 'SSOLWA'). Omit to fetch all.",
-                },
-                "debug": {
-                    "type": "boolean",
-                    "description": "Run fetch_log.sh with --debug flag to show SSH/grep details",
-                    "default": False,
-                },
-                "tail": {
-                    "type": "integer",
-                    "description": "Override TAIL lines (how many log lines to fetch)",
-                },
-                "grep_filter": {
-                    "type": "string",
-                    "description": "Override GREP_FILTER (regex). Pass 'none' to disable filtering.",
-                },
-            },
-        },
-    },
-    {
-        "name": "watch_bot",
-        "description": (
-            "Tell Sentinel to passively monitor a Slack bot — queuing its messages as issues. "
-            "Extract all <@UXXXXXX> user IDs from the message and pass them here. "
-            "Sentinel verifies each is actually a bot (not a human) before adding to the watch list. "
-            "IMPORTANT: a bot watcher is only useful if its issues can be delivered to a project. "
-            "Try to infer the project from context (bot name, prior messages, available projects). "
-            "If it cannot be determined, do NOT call this tool — instead ask the user which project "
-            "the bot's alerts belong to, then call this tool with the project filled in. "
-            "Use for: 'listen to @alertbot', 'watch @bot1 @bot2', 'monitor @errorbot'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "user_ids": {
-                    "type": "array",
-                    "items": {"type": "string"},
-                    "description": "Slack user IDs to watch — extract from <@UXXXXXX> patterns in the message",
-                },
-                "project": {
-                    "type": "string",
-                    "description": "Project short name this bot's issues should be routed to (e.g. '1881', 'elprint'). Infer from context or ask user before calling.",
-                },
-            },
-            "required": ["user_ids"],
-        },
-    },
-    {
-        "name": "unwatch_bot",
-        "description": (
-            "Stop Sentinel from monitoring a Slack bot. "
-            "Use for: 'stop watching @alertbot', 'unwatch @bot', 'remove @errorbot from watchers'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "user_ids": {
-                    "type": "array",
-                    "items": {"type": "string"},
-                    "description": "Slack user IDs to remove from the watch list",
-                },
-            },
-            "required": ["user_ids"],
-        },
-    },
-    {
-        "name": "list_watched_bots",
-        "description": (
-            "List all Slack bots Sentinel is currently monitoring passively. "
-            "Use for: 'who are you watching?', 'which bots are you monitoring?', 'list watched bots'."
-        ),
-        "input_schema": {"type": "object", "properties": {}},
-    },
-    {
-        "name": "upgrade_sentinel",
-        "description": (
-            "Upgrade the Sentinel agent itself: git pull the latest code, update Python deps, "
-            "then restart the process. Safe to call at any time — if already up to date, "
-            "no restart is triggered. "
-            "Use for: 'upgrade sentinel', 'update sentinel', 'upgrade yourself', "
-            "'pull latest sentinel code', 'restart sentinel after upgrade'."
-        ),
-        "input_schema": {"type": "object", "properties": {}},
-    },
-    {
-        "name": "ask_codebase",
-        "description": (
-            "Ask any natural-language question about a managed codebase. "
-            "Accepts a repo name (e.g. 'STS', 'elprint-sales') OR a project name (e.g. '1881', 'elprint') "
-            "— if a project name is given and it has multiple repos, all are queried. "
-            "Claude Code answers using its full codebase knowledge — no need to specify how. "
-            "Use for: 'what does 1881 do?', 'TODOs in 1881', 'find PIN validation in STS', "
-            "'security issues in elprint-sales?', 'summarize the cairn repo'."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "repo": {
-                    "type": "string",
-                    "description": "Repo name (e.g. 'STS', 'elprint-sales') OR project name (e.g. '1881', 'elprint') — project name queries all its repos",
-                },
-                "question": {
-                    "type": "string",
-                    "description": "Natural language question about the codebase",
-                },
-            },
-            "required": ["repo", "question"],
-        },
-    },
-    {
-        "name": "restart_project",
-        "description": (
-            "Stop and restart a specific Sentinel project instance (runs stop.sh then start.sh). "
-            "Use when: 'restart 1881', 'restart elprint', 'reboot the cairn project'. "
-            "Safer than restarting all projects at once."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "project": {
-                    "type": "string",
-                    "description": "Project short name or dir name (e.g. '1881', 'elprint')",
-                },
-            },
-            "required": ["project"],
-        },
-    },
-    {
-        "name": "tail_log",
-        "description": (
-            "Fetch the last N lines of a log source's live production logs without any grep filter. "
-            "Use when: 'show me recent SSOLWA logs', 'tail STS', 'what's happening in 1881 logs right now', "
-            "'show last 100 lines from SSOLWA'. Different from search_logs — no pattern required."
-        ),
-        "input_schema": {
-            "type": "object",
-            "properties": {
-                "source": {
-                    "type": "string",
-                    "description": "Log source name (partial match against log-config filenames, e.g. 'SSOLWA', 'STS')",
-                },
-                "lines": {
-                    "type": "integer",
-                    "description": "Number of recent lines to fetch (default 100)",
-                    "default": 100,
-                },
-            },
-            "required": ["source"],
-        },
-    },
-]
-
-
-# ── Workspace helpers ─────────────────────────────────────────────────────────
-
-def _workspace_dir() -> Path:
-    return Path(".").resolve().parent
-
-def _short_name(dir_name: str) -> str:
-    """'sentinel-1881' → '1881', 'sentinel-elprint' → 'elprint', others unchanged."""
-    if dir_name.startswith("sentinel-"):
-        return dir_name[len("sentinel-"):]
-    return dir_name
-
-def _read_project_name(project_dir: Path) -> str:
-    """Return PROJECT_NAME from sentinel.properties if set, else fall back to _short_name(dir)."""
-    props = project_dir / "config" / "sentinel.properties"
-    if props.exists():
-        try:
-            for line in props.read_text(encoding="utf-8", errors="ignore").splitlines():
-                line = line.strip()
-                if line.startswith("PROJECT_NAME"):
-                    _, _, val = line.partition("=")
-                    val = val.partition("#")[0].strip()
-                    if val:
-                        return val
-        except Exception:
-            pass
-    return _short_name(project_dir.name)
-
-def _find_project_dirs(target: str = "") -> list[Path]:
-    """Return project dirs matching target (PROJECT_NAME, short name, or full dir name), or all if target empty."""
-    workspace = _workspace_dir()
-    results = []
-    try:
-        for d in sorted(workspace.iterdir()):
-            if not d.is_dir() or d.name in ("code", ".git"):
-                continue
-            if not (d / "config").exists():
-                continue
-            if target:
-                t = target.lower()
-                if (t not in d.name.lower()
-                        and t not in _short_name(d.name).lower()
-                        and t not in _read_project_name(d).lower()):
-                    continue
-            results.append(d)
-    except Exception:
-        pass
-    return results
-
-def _git_pull(path: Path) -> dict:
-    try:
-        r = subprocess.run(
-            ["git", "pull", "--rebase", "origin"],
-            cwd=str(path), capture_output=True, text=True, timeout=60,
-        )
-        last = r.stdout.strip().splitlines()[-1] if r.stdout.strip() else "already up to date"
-        return {"status": "ok" if r.returncode == 0 else "error",
-                "detail": last if r.returncode == 0 else r.stderr.strip()}
-    except Exception as e:
-        return {"status": "error", "detail": str(e)}
-
-
-# ── Tool execution ────────────────────────────────────────────────────────────
-
-async def _run_tool(name: str, inputs: dict, cfg_loader, store, slack_client=None) -> str:
-    if name == "get_status":
-        hours = int(inputs.get("hours", 24))
-        errors = store.get_recent_errors(hours)
-        fixes  = store.get_recent_fixes(hours)
-        prs    = store.get_open_prs()
-        top_errors = [
-            {
-                "message": e["message"][:120],
-                "count":   e["count"],
-                "source":  e["source"],
-                "last_seen": e["last_seen"],
-            }
-            for e in errors[:8]
-        ]
-        return json.dumps({
-            "window_hours":    hours,
-            "errors_detected": len(errors),
-            "top_errors":      top_errors,
-            "fixes_applied":   sum(1 for f in fixes if f["status"] == "applied"),
-            "fixes_pending":   sum(1 for f in fixes if f["status"] == "pending"),
-            "fixes_failed":    sum(1 for f in fixes if f["status"] == "failed"),
-            "open_prs":        [
-                {
-                    "repo":   p["repo_name"],
-                    "branch": p["branch"],
-                    "pr_url": p["pr_url"],
-                    "age":    p.get("timestamp", ""),
-                }
-                for p in prs
-            ],
-            "sentinel_paused": Path("SENTINEL_PAUSE").exists(),
-        })
-
-    if name == "create_issue":
-        description = inputs["description"]
-        target_repo = inputs.get("target_repo", "")
-        project_arg = inputs.get("project", "")
-
-        if project_arg:
-            project_dirs = _find_project_dirs(project_arg)
-            if not project_dirs:
-                all_names = [_read_project_name(d) for d in _find_project_dirs()]
-                return json.dumps({
-                    "error": f"No project found matching '{project_arg}'",
-                    "available_projects": all_names,
-                    "action_needed": "Ask the user which project they meant.",
-                })
-            if len(project_dirs) > 1:
-                matches = [_read_project_name(d) for d in project_dirs]
-                return json.dumps({
-                    "error": f"Ambiguous project name '{project_arg}' — matches: {matches}",
-                    "action_needed": "Ask the user to clarify which project they mean.",
-                })
-            project_dir = project_dirs[0]
-        else:
-            project_dir = Path(".")
-
-        issues_dir = project_dir / "issues"
-        issues_dir.mkdir(exist_ok=True)
-        fname   = f"slack-{uuid.uuid4().hex[:8]}.txt"
-        content = (f"TARGET_REPO: {target_repo}\n\n" if target_repo else "") + description
-        (issues_dir / fname).write_text(content, encoding="utf-8")
-
-        # Touch SENTINEL_POLL_NOW so the target instance picks it up immediately
-        (project_dir / "SENTINEL_POLL_NOW").touch()
-
-        project_label = _read_project_name(project_dir.resolve()) if project_arg else "this project"
-        logger.info("Boss created issue for %s: %s", project_label, fname)
-        return json.dumps({
-            "status":  "queued",
-            "project": project_label,
-            "file":    fname,
-            "note":    f"Delivered to '{project_label}'. Sentinel will process it on the next poll cycle.",
-        })
-
-    if name == "get_fix_details":
-        fp  = inputs["fingerprint"]
-        fix = store.get_confirmed_fix(fp) or store.get_marker_seen_fix(fp)
-        if not fix:
-            # Fallback: search recent fixes by prefix
-            recent = store.get_recent_fixes(hours=72)
-            fix    = next((f for f in recent if f.get("fingerprint", "").startswith(fp)), None)
-        return json.dumps(fix or {"error": "not found"})
-
-    if name == "list_pending_prs":
-        prs = store.get_open_prs()
-        return json.dumps({
-            "count":    len(prs),
-            "open_prs": [
-                {
-                    "repo":      p["repo_name"],
-                    "branch":    p["branch"],
-                    "pr_url":    p["pr_url"],
-                    "timestamp": p.get("timestamp", ""),
-                }
-                for p in prs
-            ],
-        })
-
-    if name == "pause_sentinel":
-        Path("SENTINEL_PAUSE").touch()
-        logger.info("Boss: SENTINEL_PAUSE created")
-        return json.dumps({"status": "paused"})
-
-    if name == "resume_sentinel":
-        p = Path("SENTINEL_PAUSE")
-        if p.exists():
-            p.unlink()
-        logger.info("Boss: SENTINEL_PAUSE removed")
-        return json.dumps({"status": "resumed"})
-
-    if name == "list_projects":
-        projects = []
-        for d in _find_project_dirs():
-            repo_cfg_dir = d / "config" / "repo-configs"
-            repos_in_project = []
-            if repo_cfg_dir.exists():
-                for p in sorted(repo_cfg_dir.glob("*.properties")):
-                    if p.name.startswith("_"):
-                        continue
-                    repo_url = ""
-                    for line in p.read_text(encoding="utf-8", errors="ignore").splitlines():
-                        if line.startswith("REPO_URL"):
-                            repo_url = line.split("=", 1)[-1].strip()
-                            break
-                    repos_in_project.append({"repo": p.stem, "url": repo_url})
-            projects.append({
-                "project": _read_project_name(d),
-                "dir":     d.name,
-                "running": (d / "sentinel.pid").exists(),
-                "this":    d.resolve() == Path(".").resolve(),
-                "repos":   repos_in_project,
-            })
-        return json.dumps({"projects": projects})
-
-    if name == "search_logs":
-        query       = inputs.get("query", "")
-        source      = inputs.get("source", "").lower()
-        max_matches = int(inputs.get("max_matches", 30))
-
-        # ── Live fetch path: SSH to servers and grep in real time ──────────────
-        script = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
-        log_cfg_dir = Path("config") / "log-configs"
-        if script.exists() and log_cfg_dir.exists():
-            props_files = sorted(log_cfg_dir.glob("*.properties"))
-            if source:
-                props_files = [p for p in props_files if source in p.stem.lower()]
-            if props_files:
-                live_results = []
-                for props in props_files:
-                    env = os.environ.copy()
-                    env["GREP_FILTER"] = query
-                    try:
-                        r = subprocess.run(
-                            ["bash", str(script), str(props)],
-                            capture_output=True, text=True, timeout=60, env=env,
-                        )
-                        lines = (r.stdout or "").strip().splitlines()
-                        matches = [ln[:300] for ln in lines if ln.strip()][:max_matches]
-                        if matches:
-                            live_results.append({"source": props.stem, "matches": matches})
-                        logger.info("Boss search_logs live %s rc=%d found=%d", props.stem, r.returncode, len(matches))
-                    except subprocess.TimeoutExpired:
-                        live_results.append({"source": props.stem, "error": "timed out"})
-                    except Exception as e:
-                        live_results.append({"source": props.stem, "error": str(e)})
-                total = sum(len(r.get("matches", [])) for r in live_results)
-                return json.dumps({
-                    "query": query,
-                    "mode": "live",
-                    "total_matches": total,
-                    "results": live_results,
-                })
-
-        # ── Fallback: search locally-cached log files ──────────────────────────
-        fetched_dir = Path("workspace/fetched")
-        if not fetched_dir.exists():
-            return json.dumps({"error": "No fetched logs found and fetch_log.sh unavailable"})
-        try:
-            pattern = re.compile(query, re.IGNORECASE)
-        except re.error as e:
-            return json.dumps({"error": f"Invalid regex: {e}"})
-        results = []
-        for log_file in sorted(fetched_dir.glob("*.log")):
-            if source and source not in log_file.name.lower():
-                continue
-            try:
-                lines   = log_file.read_text(encoding="utf-8", errors="ignore").splitlines()
-                matches = [
-                    {"line": i + 1, "text": line[:300]}
-                    for i, line in enumerate(lines)
-                    if pattern.search(line)
-                ][:max_matches]
-                if matches:
-                    results.append({"file": log_file.name, "matches": matches})
-            except Exception:
-                pass
-        total = sum(len(r["matches"]) for r in results)
-        return json.dumps({
-            "query": query,
-            "mode": "cached",
-            "total_matches": total,
-            "files_searched": len(list(fetched_dir.glob("*.log"))),
-            "results": results,
-        })
-
-    if name == "trigger_poll":
-        Path("SENTINEL_POLL_NOW").touch()
-        logger.info("Boss: immediate poll requested")
-        return json.dumps({"status": "triggered", "note": "Sentinel will run a poll cycle within seconds"})
-
-    if name == "get_repo_status":
-        hours  = int(inputs.get("hours", 24))
-        fixes  = store.get_recent_fixes(hours)
-        errors = store.get_recent_errors(hours)
-        by_repo: dict = {}
-        for fix in fixes:
-            repo = fix.get("repo_name", "unknown")
-            s    = by_repo.setdefault(repo, {"applied": 0, "pending": 0, "failed": 0, "skipped": 0})
-            key  = fix.get("status", "failed")
-            s[key] = s.get(key, 0) + 1
-        return json.dumps({"window_hours": hours, "total_errors": len(errors), "by_repo": by_repo})
-
-    if name == "list_recent_commits":
-        limit   = int(inputs.get("limit", 5))
-        results = []
-        for repo_name, repo in cfg_loader.repos.items():
-            local = Path(repo.local_path)
-            if not local.exists():
-                continue
-            try:
-                r = subprocess.run(
-                    ["git", "log", "--oneline", "--grep=sentinel", "-n", str(limit)],
-                    cwd=str(local), capture_output=True, text=True, timeout=10,
-                )
-                commits = r.stdout.strip().splitlines()
-                if commits:
-                    results.append({"repo": repo_name, "commits": commits})
-            except Exception:
-                pass
-        return json.dumps({"sentinel_commits": results})
-
-    if name == "pull_repo":
-        target = inputs.get("repo", "").lower()
-        results = []
-        for repo_name, repo in cfg_loader.repos.items():
-            if target and target not in repo_name.lower():
-                continue
-            local = Path(repo.local_path)
-            if not local.exists():
-                results.append({"repo": repo_name, "status": "error", "detail": "local path not found"})
-                continue
-            try:
-                r = subprocess.run(
-                    ["git", "pull", "--rebase", "origin", repo.branch],
-                    cwd=str(local), capture_output=True, text=True, timeout=60,
-                )
-                last_line = r.stdout.strip().splitlines()[-1] if r.stdout.strip() else "already up to date"
-                if r.returncode == 0:
-                    results.append({"repo": repo_name, "status": "ok", "detail": last_line})
-                else:
-                    results.append({"repo": repo_name, "status": "error", "detail": r.stderr.strip()})
-            except Exception as e:
-                results.append({"repo": repo_name, "status": "error", "detail": str(e)})
-        return json.dumps({"results": results})
-
-    if name == "pull_config":
-        target = inputs.get("project", "")
-        dirs = _find_project_dirs(target)
-        if not dirs:
-            return json.dumps({"error": f"No project found matching '{target}'"})
-        results = []
-        for d in dirs:
-            res = _git_pull(d)
-            results.append({"project": _read_project_name(d), "dir": d.name, **res})
-            logger.info("Boss: pull_config %s → %s", d.name, res["status"])
-        return json.dumps({"results": results})
-
-    if name == "fetch_logs":
-        source_filter = inputs.get("source", "").lower()
-        debug         = bool(inputs.get("debug", False))
-        tail_override = inputs.get("tail")
-        grep_override = inputs.get("grep_filter", "")
-
-        # Find fetch_log.sh relative to this file
-        script = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
-        if not script.exists():
-            return json.dumps({"error": f"fetch_log.sh not found at {script}"})
-
-        log_cfg_dir = Path("config") / "log-configs"
-        if not log_cfg_dir.exists():
-            return json.dumps({"error": "config/log-configs/ not found"})
-
-        props_files = sorted(log_cfg_dir.glob("*.properties"))
-        if source_filter:
-            props_files = [p for p in props_files if source_filter in p.stem.lower()]
-        if not props_files:
-            return json.dumps({"error": f"No log-config found matching '{source_filter}'"})
-
-        results = []
-        for props in props_files:
-            env = os.environ.copy()
-            if tail_override:
-                env["TAIL"] = str(tail_override)
-            if grep_override:
-                env["GREP_FILTER"] = grep_override
-
-            cmd = ["bash", str(script)]
-            if debug:
-                cmd.append("--debug")
-            cmd.append(str(props))
-
-            try:
-                r = subprocess.run(
-                    cmd, capture_output=True, text=True, timeout=120, env=env,
-                )
-                output = (r.stdout or "").strip()
-                stderr = (r.stderr or "").strip()
-                results.append({
-                    "source":     props.stem,
-                    "returncode": r.returncode,
-                    "output":     output[-2000:] if output else "",
-                    "stderr":     stderr[-1000:] if stderr else "",
-                })
-                logger.info("Boss fetch_logs %s rc=%d", props.stem, r.returncode)
-            except subprocess.TimeoutExpired:
-                results.append({"source": props.stem, "error": "timed out after 120s"})
-            except Exception as e:
-                results.append({"source": props.stem, "error": str(e)})
-
-        return json.dumps({"fetched": len(results), "results": results})
-
-    if name == "watch_bot":
-        user_ids    = inputs.get("user_ids", [])
-        project_arg = inputs.get("project", "").strip()
-        if not user_ids:
-            return json.dumps({"error": "No user_ids provided"})
-
-        # Resolve + validate project — required for bot issue routing
-        resolved_project = ""
-        if project_arg:
-            project_dirs = _find_project_dirs(project_arg)
-            if not project_dirs:
-                all_names = [_read_project_name(d) for d in _find_project_dirs()]
-                return json.dumps({
-                    "error": f"No project found matching '{project_arg}'",
-                    "available_projects": all_names,
-                    "action_needed": "Ask the user which project these bot alerts belong to.",
-                })
-            if len(project_dirs) > 1:
-                matches = [_read_project_name(d) for d in project_dirs]
-                return json.dumps({
-                    "error": f"Ambiguous project name '{project_arg}' — matches: {matches}",
-                    "action_needed": "Ask the user to clarify which project.",
-                })
-            resolved_project = _read_project_name(project_dirs[0])
-        else:
-            all_projects = _find_project_dirs()
-            if len(all_projects) == 1:
-                # Single project in workspace — auto-assign
-                resolved_project = _read_project_name(all_projects[0])
-            elif all_projects:
-                all_names = [_read_project_name(d) for d in all_projects]
-                return json.dumps({
-                    "error": "Cannot determine which project these bot alerts belong to.",
-                    "available_projects": all_names,
-                    "action_needed": "Ask the user to specify the project, then retry with project filled in.",
-                })
-
-        results = []
-        for uid in user_ids:
-            if not slack_client:
-                results.append({"user_id": uid, "status": "error", "reason": "no Slack client available"})
-                continue
-            try:
-                info = await slack_client.users_info(user=uid)
-                user = info.get("user", {})
-                if not user.get("is_bot", False):
-                    results.append({"user_id": uid, "status": "skipped", "reason": "not a bot — only bots can be watched passively"})
-                    continue
-                bot_name = user.get("real_name") or user.get("name") or uid
-                store.add_watched_bot(uid, bot_name, added_by="boss", project_name=resolved_project)
-                logger.info("Boss: now watching bot %s (%s) → project '%s'", bot_name, uid, resolved_project or "unset")
-                results.append({"user_id": uid, "bot_name": bot_name, "project": resolved_project, "status": "watching"})
-            except Exception as e:
-                results.append({"user_id": uid, "status": "error", "reason": str(e)})
-        return json.dumps({"results": results})
-
-    if name == "unwatch_bot":
-        user_ids = inputs.get("user_ids", [])
-        if not user_ids:
-            return json.dumps({"error": "No user_ids provided"})
-        results = []
-        for uid in user_ids:
-            removed = store.remove_watched_bot(uid)
-            logger.info("Boss: unwatch bot %s → %s", uid, "removed" if removed else "not found")
-            results.append({"user_id": uid, "status": "removed" if removed else "not found"})
-        return json.dumps({"results": results})
-
-    if name == "list_watched_bots":
-        bots = store.get_watched_bots()
-        return json.dumps({
-            "count": len(bots),
-            "bots": [
-                {
-                    "bot_id":   b["bot_id"],
-                    "bot_name": b["bot_name"],
-                    "project":  b.get("project_name") or "",
-                    "added_by": b["added_by"],
-                    "added_at": b["added_at"],
-                }
-                for b in bots
-            ],
-        })
-
-    if name == "upgrade_sentinel":
-        import threading
-
-        # Sentinel is installed via npm — use `sentinel upgrade` which handles
-        # npm install + Python bundle copy + restart via stopAll/startAll.
-        # Run it in the background after a short delay so the Slack reply is
-        # sent before the process is replaced.
-        try:
-            r = subprocess.run(
-                ["sentinel", "--version"],
-                capture_output=True, text=True, timeout=10,
-            )
-            sentinel_bin_ok = r.returncode == 0
-        except Exception:
-            sentinel_bin_ok = False
-
-        if not sentinel_bin_ok:
-            return json.dumps({
-                "status": "error",
-                "note":   "`sentinel` CLI not found. Run: npm install -g @misterhuydo/sentinel",
-            })
-
-        def _do_upgrade():
-            import time
-            time.sleep(10)   # give Slack time to post the reply
-            subprocess.Popen(["sentinel", "upgrade"], close_fds=True)
-
-        threading.Thread(target=_do_upgrade, daemon=True).start()
-        logger.info("Boss: upgrade_sentinel scheduled via `sentinel upgrade`")
-        return json.dumps({
-            "status": "ok",
-            "note":   "Upgrade started — pulling latest version via npm and restarting. Give me ~30 seconds then I'll be back.",
-        })
-
-    if name == "ask_codebase":
-        target   = inputs.get("repo", "").lower()
-        question = inputs.get("question", "")
-
-        # 1. Find repos whose name contains the target (e.g. "STS", "elprint-sales")
-        matched = [(rn, r) for rn, r in cfg_loader.repos.items() if target in rn.lower()]
-
-        # 2. No repo match — check if target is a project name → use ALL repos in cfg_loader
-        #    (each Sentinel instance is scoped to one project, so all repos belong to it)
-        if not matched:
-            current_project = _read_project_name(Path("."))
-            if target in current_project.lower() or current_project.lower() in target:
-                matched = list(cfg_loader.repos.items())
-
-        if not matched:
-            return json.dumps({
-                "error": f"No repo or project found matching '{target}'",
-                "available_repos": list(cfg_loader.repos.keys()),
-            })
-
-        cfg = cfg_loader.sentinel
-        env = os.environ.copy()
-        if cfg.anthropic_api_key:
-            env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
-
-        def _ask_one(repo_name, repo_cfg) -> dict:
-            local_path = Path(repo_cfg.local_path)
-            if not local_path.exists():
-                return {"repo": repo_name, "error": f"not cloned yet at {local_path}"}
-            prompt = (
-                f"You are a code analyst. Answer the following question about the codebase at: {local_path}\n\n"
-                f"Question: {question}\n\n"
-                f"Use whatever tools you need to answer accurately. Be concise and direct. Plain text only."
-            )
-            try:
-                r = subprocess.run(
-                    [cfg.claude_code_bin, "--permission-mode", "bypassPermissions", "--print", prompt],
-                    capture_output=True, text=True, timeout=180, env=env,
-                    cwd=str(local_path),
-                )
-                output = (r.stdout or "").strip()
-                logger.info("Boss ask_codebase %s rc=%d len=%d", repo_name, r.returncode, len(output))
-                if r.returncode != 0 and not output:
-                    return {"repo": repo_name, "error": f"claude --print failed (rc={r.returncode}): {(r.stderr or '')[:200]}"}
-                return {"repo": repo_name, "answer": output[:3000]}
-            except subprocess.TimeoutExpired:
-                return {"repo": repo_name, "error": "timed out after 180s"}
-            except Exception as e:
-                return {"repo": repo_name, "error": str(e)}
-
-        if len(matched) == 1:
-            result = _ask_one(*matched[0])
-            # Unwrap single-repo result for cleaner response
-            return json.dumps(result)
-
-        # Multiple repos — query each and combine
-        results = [_ask_one(rn, r) for rn, r in matched]
-        return json.dumps({"project": target, "repos_queried": len(results), "results": results})
-
-    if name == "restart_project":
-        project_arg = inputs.get("project", "").lower()
-        dirs = _find_project_dirs(project_arg)
-        if not dirs:
-            return json.dumps({"error": f"No project found matching '{project_arg}'"})
-        results = []
-        for d in dirs:
-            stop_sh  = d / "stop.sh"
-            start_sh = d / "start.sh"
-            if not stop_sh.exists() or not start_sh.exists():
-                results.append({"project": d.name, "status": "error", "detail": "stop.sh or start.sh not found"})
-                continue
-            try:
-                subprocess.run(["bash", str(stop_sh)],  cwd=str(d), timeout=30)
-                subprocess.run(["bash", str(start_sh)], cwd=str(d), timeout=30)
-                results.append({"project": d.name, "status": "restarted"})
-                logger.info("Boss: restarted project %s", d.name)
-            except Exception as e:
-                results.append({"project": d.name, "status": "error", "detail": str(e)})
-        return json.dumps({"results": results})
-
-    if name == "tail_log":
-        source      = inputs.get("source", "").lower()
-        lines       = int(inputs.get("lines", 100))
-        script      = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
-        log_cfg_dir = Path("config") / "log-configs"
-
-        if not script.exists():
-            return json.dumps({"error": "fetch_log.sh not found"})
-        if not log_cfg_dir.exists():
-            return json.dumps({"error": "config/log-configs/ not found"})
-
-        props_files = sorted(log_cfg_dir.glob("*.properties"))
-        if source:
-            props_files = [p for p in props_files if source in p.stem.lower()]
-        if not props_files:
-            return json.dumps({"error": f"No log-config found matching '{source}'"})
-
-        results = []
-        for props in props_files:
-            env = os.environ.copy()
-            env["TAIL"]        = str(lines)
-            env["GREP_FILTER"] = ""   # no filter — show everything
-            try:
-                r = subprocess.run(
-                    ["bash", str(script), str(props)],
-                    capture_output=True, text=True, timeout=60, env=env,
-                )
-                tail_lines = (r.stdout or "").strip().splitlines()[-lines:]
-                results.append({
-                    "source":  props.stem,
-                    "lines":   len(tail_lines),
-                    "content": "\n".join(tail_lines),
-                })
-                logger.info("Boss tail_log %s rc=%d lines=%d", props.stem, r.returncode, len(tail_lines))
-            except subprocess.TimeoutExpired:
-                results.append({"source": props.stem, "error": "timed out"})
-            except Exception as e:
-                results.append({"source": props.stem, "error": str(e)})
-        return json.dumps({"results": results})
-
-    return json.dumps({"error": f"unknown tool: {name}"})
-
-
-# ── CLI fallback (OAuth / no API key) ────────────────────────────────────────
-
-_ACTION_RE = re.compile(r"^ACTION:\s*(\{.*\})", re.MULTILINE)
-
-
-async def _handle_with_cli(
-    message: str,
-    history: list,
-    cfg_loader,
-    store,
-    slack_client=None,
-    user_name: str = "",
-) -> tuple[str, bool]:
-    """Fallback: use `claude --print` for users without an Anthropic API key."""
-    status_json = await _run_tool("get_status", {"hours": 24}, cfg_loader, store)
-    prs_json    = await _run_tool("list_pending_prs", {}, cfg_loader, store)
-
-    # Pre-fetch log search if the message is a search request.
-    # Use quoted strings as the query, or fall back to the full message.
-    # Never hardcode field names — the query is whatever the user said.
-    search_json = ""
-    _search_kws = ("search", "find", "look for", "show me log", "grep", "entries for")
-    if any(kw in message.lower() for kw in _search_kws):
-        quoted = re.findall(r'"([^"]+)"', message)
-        query  = quoted[0] if quoted else message
-        search_json = await _run_tool("search_logs", {"query": query}, cfg_loader, store)
-
-    paused      = Path("SENTINEL_PAUSE").exists()
-    repos       = list(cfg_loader.repos.keys())
-    log_sources = list(cfg_loader.log_sources.keys())
-    ts          = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
-
-    history_text = ""
-    for msg in history[-8:]:
-        role    = msg["role"].upper()
-        content = msg["content"]
-        if isinstance(content, list):
-            content = " ".join(
-                (b.get("text", "") if isinstance(b, dict) else getattr(b, "text", ""))
-                for b in content
-                if (isinstance(b, dict) and b.get("type") == "text")
-                or (hasattr(b, "type") and b.type == "text")
-            )
-        history_text += f"\n{role}: {content}"
-
-    prompt = (
-        _SYSTEM
-        + (f"\nYou are speaking with: {user_name}" if user_name else "")
-        + f"\n\nCurrent time: {ts}"
-        + f"\nSentinel status: {'⏸ PAUSED' if paused else '▶ RUNNING'}"
-        + f"\nManaged repos: {', '.join(repos) if repos else '(none configured)'}"
-        + (f"\nLog sources: {', '.join(log_sources)}" if log_sources else "")
-        + f"\n\nCurrent status (last 24 h):\n{status_json}"
-        + f"\n\nOpen PRs:\n{prs_json}"
-        + (f"\n\nLog search results:\n{search_json}" if search_json else "")
-        + (f"\n\nConversation so far:{history_text}" if history_text else "")
-        + f"\n\nUSER: {message}"
-        + "\n\nIf you need to take an action, include a line like:\n"
-        + "  ACTION: {\"action\": \"pause_sentinel\"}\n"
-        + "  ACTION: {\"action\": \"resume_sentinel\"}\n"
-        + "  ACTION: {\"action\": \"trigger_poll\"}\n"
-        + "  ACTION: {\"action\": \"create_issue\", \"description\": \"...\", \"target_repo\": \"\"}\n"
-        + "  ACTION: {\"action\": \"search_logs\", \"query\": \"<whatever the user asked to find>\"}\n"
-        + "End with [DONE] if the request is fully handled."
-    )
-
-    cfg = cfg_loader.sentinel
-    env = os.environ.copy()
-    if cfg.anthropic_api_key:
-        env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
-
-    try:
-        result = subprocess.run(
-            [cfg.claude_code_bin, "--permission-mode", "bypassPermissions", "--print", prompt],
-            capture_output=True, text=True, timeout=180, env=env,
-        )
-        output = (result.stdout or "").strip()
-        if result.returncode != 0 or not output:
-            stderr = (result.stderr or "").strip()
-            logger.error(
-                "Boss CLI call failed (rc=%d): stdout=%r stderr=%r",
-                result.returncode, output[:200], stderr[:200],
-            )
-        if result.returncode != 0 and not output:
-            return f":warning: `claude --print` failed (exit {result.returncode}): {(result.stderr or '').strip()[:300]}", True
-    except Exception as e:
-        logger.error("Boss CLI call failed: %s", e)
-        return f":warning: Boss unavailable: {e}", True
-
-    for m in _ACTION_RE.finditer(output):
-        try:
-            action = json.loads(m.group(1))
-            name   = action.pop("action", "")
-            if name:
-                result_str = await _run_tool(name, action, cfg_loader, store)
-                logger.info("Boss CLI action: %s → %s", name, result_str[:80])
-        except Exception as e:
-            logger.warning("Boss action parse error: %s", e)
-
-    reply   = _ACTION_RE.sub("", output).strip()
-    is_done = "[DONE]" in reply
-    reply   = reply.replace("[DONE]", "").strip()
-    if not reply:
-        greeting = f"Hi {user_name}! " if user_name else "Hi! "
-        reply = f"{greeting}I'm Sentinel, your autonomous DevOps agent. How can I help you?"
-
-    history.append({"role": "user",      "content": message})
-    history.append({"role": "assistant", "content": reply})
-    return reply, is_done
-
-
-# ── Main entry point ──────────────────────────────────────────────────────────
-
-async def handle_message(
-    message: str,
-    history: list,
-    cfg_loader,
-    store,
-    slack_client=None,
-    user_name: str = "",
-) -> tuple[str, bool]:
-    """
-    Process one user message through the Sentinel Boss (Claude with tool use).
-
-    Args:
-        message:     The user's Slack message text.
-        history:     Conversation history list — mutated in place (role/content dicts).
-        cfg_loader:  ConfigLoader for repo/sentinel config.
-        store:       StateStore for DB queries.
-
-    Returns:
-        (reply_text, is_done)
-        is_done=True  → session complete, release the Slack queue slot.
-        is_done=False → waiting for user follow-up, keep the slot.
-    """
-    try:
-        import anthropic
-    except ImportError:
-        return (
-            ":warning: `anthropic` package not installed. Run: `pip install anthropic`",
-            True,
-        )
-
-    api_key = cfg_loader.sentinel.anthropic_api_key or os.environ.get("ANTHROPIC_API_KEY", "")
-    if not api_key:
-        return await _handle_with_cli(message, history, cfg_loader, store, slack_client=slack_client, user_name=user_name)
-
-    client = anthropic.Anthropic(api_key=api_key)
-
-    # Build system context snapshot
-    paused       = Path("SENTINEL_PAUSE").exists()
-    repos        = list(cfg_loader.repos.keys())
-    ts           = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
-    known_projects = [_read_project_name(d) for d in _find_project_dirs()]
-    log_sources = list(cfg_loader.log_sources.keys())
-    system    = (
-        _SYSTEM
-        + (f"\nYou are speaking with: {user_name}" if user_name else "")
-        + f"\n\nCurrent time: {ts}"
-        + f"\nSentinel status: {'⏸ PAUSED' if paused else '▶ RUNNING'}"
-        + f"\nManaged repos: {', '.join(repos) if repos else '(none configured)'}"
-        + (f"\nLog sources: {', '.join(log_sources)}" if log_sources else "")
-        + (f"\nKnown projects in workspace: {', '.join(known_projects)}" if known_projects else "")
-    )
-
-    history.append({"role": "user", "content": message})
-    messages = list(history)
-
-    # Agentic loop — Claude may call multiple tools before giving a final reply
-    while True:
-        response = client.messages.create(
-            model="claude-opus-4-6",
-            max_tokens=1024,
-            system=system,
-            tools=_TOOLS,
-            messages=messages,
-        )
-
-        text_parts  = []
-        tool_blocks = []
-        for block in response.content:
-            if block.type == "text":
-                text_parts.append(block.text)
-            elif block.type == "tool_use":
-                tool_blocks.append(block)
-
-        if not tool_blocks:
-            # Final response — no more tool calls
-            reply   = " ".join(text_parts).strip()
-            is_done = "[DONE]" in reply
-            reply   = reply.replace("[DONE]", "").strip()
-            if not reply:
-                greeting = f"Hi {user_name}! " if user_name else "Hi! "
-                reply = f"{greeting}I'm Sentinel, your autonomous DevOps agent. How can I help you?"
-            history.append({"role": "assistant", "content": response.content})
-            return reply, is_done
-
-        # Execute tools and continue
-        messages.append({"role": "assistant", "content": response.content})
-        tool_results = []
-        for tc in tool_blocks:
-            result = await _run_tool(tc.name, tc.input, cfg_loader, store, slack_client=slack_client)
-            logger.info("Boss tool: %s(%s) → %s", tc.name, tc.input, result[:120])
-            tool_results.append({
-                "type":        "tool_result",
-                "tool_use_id": tc.id,
-                "content":     result,
-            })
-        messages.append({"role": "user", "content": tool_results})
+"""
+sentinel_boss.py — Claude-backed Sentinel Boss.
+
+Claude acts as the boss: reads project state, decides on actions,
+executes them via tool use, and responds naturally. One agentic loop
+per turn — Claude may call multiple tools before replying.
+"""
+
+import json
+import logging
+import os
+import re
+import subprocess
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+# ── System prompt ────────────────────────────────────────────────────────────
+
+_SYSTEM = """\
+You are Sentinel Boss — the AI interface for Sentinel, a 24/7 autonomous DevOps agent.
+
+Sentinel watches production logs, detects errors, generates code fixes via Claude Code,
+and opens GitHub PRs for admin review (or pushes directly if AUTO_PUBLISH=true).
+
+Your job:
+- Understand what the DevOps engineer needs in natural language
+- Query Sentinel's live state (errors, fixes, open PRs) on their behalf
+- Deliver tasks/issues to the right project — you know all projects in this workspace
+- Control Sentinel (pause/resume) when asked
+- Give honest, concise answers — you know this system inside out
+- If a project name is unclear or ambiguous, ask the engineer to clarify — never guess
+
+What you can do (tools available):
+
+1. get_status        — Show recent errors detected, fixes applied/pending, open PRs.
+                       e.g. "what happened today?", "any issues?", "show open PRs"
+
+2. create_issue      — Deliver a fix/task to any project in this workspace by short name.
+                       You know all project names — use list_projects if you're unsure.
+                       If the project name is ambiguous or not found, ask to clarify.
+                       e.g. "tell 1881 to fix X", "look into Y in elprint", "investigate Z"
+
+3. pause_sentinel    — Create SENTINEL_PAUSE file to halt all auto-fix activity.
+                       e.g. "pause sentinel", "stop auto-fixing"
+
+4. resume_sentinel   — Remove SENTINEL_PAUSE file to resume normal operation.
+                       e.g. "resume sentinel", "unpause"
+
+5. list_projects     — List all configured repos and log sources in this Sentinel instance.
+                       e.g. "what projects are you watching?", "list all repos"
+
+6. search_logs       — SSH live to servers and grep logs in real time (uses fetch_log.sh with
+                       the query as GREP_FILTER). Falls back to cached files if unavailable.
+                       e.g. "search logs for illegal PIN in 1881", "find X in SSOLWA", "grep logs for Z"
+
+7. trigger_poll      — Trigger an immediate poll cycle without waiting for the schedule.
+                       e.g. "check now", "poll immediately", "don't wait, run now"
+
+8. get_repo_status   — Show the current git branch, last commit, and recent fix branches
+                       for a specific repository.
+                       e.g. "status of repo X", "what branch is cairn on?"
+
+9. list_recent_commits — List the most recent commits in a repo (including Sentinel's auto-fixes).
+                       e.g. "show me recent commits in elprint-sales", "what did sentinel commit?"
+
+10. get_fix_detail   — Get full details of a specific fix: error, patch path, PR URL, status.
+                       e.g. "show fix abc123", "details on that fix"
+
+11. list_errors      — List recent errors from the state store, optionally filtered by repo or source.
+                       e.g. "show all errors today", "what errors hit elprint this week?"
+
+12. pull_repo        — Run git pull on one or all managed application repos.
+                       e.g. "pull changes", "git pull all repos", "update the code"
+
+13. pull_config      — Run git pull on one or all Sentinel project config dirs.
+                       e.g. "pull config for 1881", "update sentinel config", "pull all configs"
+
+14. fetch_logs       — Run fetch_log.sh on demand to pull fresh logs from remote servers right now.
+                       Supports --debug mode and parameter overrides (tail count, grep filter).
+                       e.g. "fetch logs", "try fetch_log.sh for SSOLWA", "fetch logs with debug",
+                            "grab latest logs from STS", "fetch logs without filter"
+
+15. watch_bot        — Register a Slack bot for passive monitoring. Every message it posts is
+                       auto-queued as an issue in the bot's registered project.
+                       ALWAYS requires a project — infer from context or ask the user first.
+                       e.g. "listen to @alertbot", "watch @bot1 @bot2 for project 1881", "monitor @errorbot"
+
+16. unwatch_bot      — Remove a Slack bot from the passive watch list.
+                       e.g. "stop watching @alertbot", "unwatch @errorbot"
+
+17. list_watched_bots — Show all Slack bots currently being passively monitored and which projects
+                        they are delivering to.
+                        e.g. "which bots are you watching?", "list monitored bots"
+
+18. upgrade_sentinel — Pull the latest Sentinel agent code, update Python deps, and restart the
+                       process. Safe to run at any time — no restart if already up to date.
+                       e.g. "upgrade sentinel", "update sentinel", "upgrade yourself"
+
+19. ask_codebase     — Ask any natural-language question about a managed repo's codebase.
+                       Claude Code answers using its full knowledge of the code.
+                       e.g. "what does the 1881 backend do?", "find PIN validation in elprint",
+                            "any TODOs in cairn?", "are there security issues in elprint-sales?"
+
+20. restart_project  — Stop and restart a specific project instance (stop.sh + start.sh).
+                       e.g. "restart 1881", "reboot elprint", "restart the cairn project"
+
+21. tail_log         — Fetch the last N lines of a log source live, without a grep filter.
+                       e.g. "show recent SSOLWA logs", "tail STS", "last 200 lines from 1881 logs"
+
+When someone asks what you can do, what you support, what your capabilities are, or how you can help,
+reply with a short summary grouped by category:
+
+*Monitoring & status*
+• `get_status` — errors detected, fixes applied/pending/failed, open PRs — "what happened today?"
+• `get_repo_status` — per-repo breakdown of errors and fixes — "how is elprint doing?"
+• `list_recent_commits` — recent Sentinel auto-fix commits — "what did Sentinel commit?"
+
+*Log management*
+• `fetch_logs` — pull fresh logs from servers right now — "fetch logs for SSOLWA"
+• `search_logs` — live SSH grep on production servers — "search logs for illegal PIN in 1881"
+• `tail_log` — last N lines of a log source, no filter — "show recent SSOLWA logs"
+
+*Codebase questions*
+• `ask_codebase` — any question about a repo's code — "what does 1881 do?", "find PIN validation", "any TODOs?", "security issues?"
+
+*Fix management*
+• `get_fix_details` — full details of a specific fix — "show fix abc123"
+• `list_pending_prs` — all open Sentinel PRs awaiting review — "list open PRs"
+
+*Project & task delivery*
+• `list_projects` — all projects and repos Sentinel manages — "what projects do you manage?"
+• `create_issue` — deliver a task to any project by name — "tell 1881 to fix X"
+• `trigger_poll` — run a log-fetch + fix cycle right now — "check now"
+• `pause_sentinel` / `resume_sentinel` — halt or resume all auto-fix activity — "pause Sentinel"
+
+*Repo & config sync*
+• `pull_repo` — git pull on managed application repos — "pull latest code"
+• `pull_config` — git pull on Sentinel config dirs — "pull config for elprint"
+
+*Slack bot watching*
+• `watch_bot` — register a Slack bot for passive monitoring; its messages are auto-queued as issues — "listen to @alertbot"
+• `unwatch_bot` — stop monitoring a bot — "stop watching @errorbot"
+• `list_watched_bots` — show all bots currently being monitored — "which bots are you watching?"
+
+*Project control*
+• `restart_project` — stop + restart a specific project — "restart 1881"
+
+*Self-management*
+• `upgrade_sentinel` — git pull + pip install + restart — "upgrade sentinel", "update yourself"
+
+Tone: direct, professional, like a senior engineer who owns the system.
+Don't pad responses. Don't say "Great question!" or "Certainly!".
+If you don't know something, use a tool to find out before saying you don't know.
+
+When the engineer's request is fully handled, end your LAST message with the token: [DONE]
+IMPORTANT: Always write your actual reply text FIRST, then append [DONE] at the end. Example: "Hello! I'm Sentinel. [DONE]". Never output [DONE] as your only content.
+For greetings like "hello" or empty messages, introduce yourself briefly and offer help, then end with [DONE].
+If you need a follow-up from them, do NOT include [DONE] — wait for their next message.
+"""
+
+# ── Tool definitions ─────────────────────────────────────────────────────────
+
+_TOOLS = [
+    {
+        "name": "get_status",
+        "description": (
+            "Get recent errors, fixes applied, fixes pending review, and open PRs. "
+            "Use for: 'what happened today?', 'any issues?', 'how are things?', "
+            "'what are the open PRs?', 'did sentinel fix anything?'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "hours": {
+                    "type": "integer",
+                    "description": "Look-back window in hours (default 24)",
+                    "default": 24,
+                },
+            },
+        },
+    },
+    {
+        "name": "create_issue",
+        "description": (
+            "Deliver a fix/task request to a Sentinel project instance. "
+            "Use when the engineer says 'tell 1881 to do X', 'look into Y in project elprint', "
+            "'implement this in 1881: ...'. Can target any project by short name. "
+            "Defaults to the current project if no project is specified."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "description": {
+                    "type": "string",
+                    "description": "Full task/problem description — everything the engineer told you",
+                },
+                "project": {
+                    "type": "string",
+                    "description": "Project short name to deliver to (e.g. '1881', 'elprint'). Omit for current project.",
+                },
+                "target_repo": {
+                    "type": "string",
+                    "description": "Specific repo within the project (omit to let Sentinel auto-route)",
+                },
+            },
+            "required": ["description"],
+        },
+    },
+    {
+        "name": "get_fix_details",
+        "description": "Get full details of a specific fix by fingerprint (8+ hex chars).",
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "fingerprint": {"type": "string"},
+            },
+            "required": ["fingerprint"],
+        },
+    },
+    {
+        "name": "list_pending_prs",
+        "description": "List all open Sentinel PRs awaiting admin review.",
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "pause_sentinel",
+        "description": (
+            "Pause ALL Sentinel fix activity immediately. "
+            "Use when the engineer says 'pause', 'stop', 'freeze', or 'hold off'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "resume_sentinel",
+        "description": "Resume Sentinel fix activity after a pause.",
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "list_projects",
+        "description": (
+            "List all projects (Sentinel instances) in this workspace and the repos "
+            "each one manages. Use for: 'what projects do you manage?', 'list projects', "
+            "'what repos are configured?', 'show me all projects'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "search_logs",
+        "description": (
+            "Search production logs for a keyword or pattern. "
+            "When a project or source is specified (or can be inferred), performs a LIVE fetch "
+            "via fetch_log.sh with the query as the grep filter — SSHes directly to the server. "
+            "Falls back to searching locally-cached log files when no source can be determined. "
+            "Use for: 'search logs for illegal PIN in 1881', 'find X in SSOLWA logs', "
+            "'what did user Y do?', 'show entries for appid=Z', 'grep logs for X'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "query": {
+                    "type": "string",
+                    "description": "Keyword or regex to grep for",
+                },
+                "source": {
+                    "type": "string",
+                    "description": "Log source name to search (partial match against log-config filenames, e.g. 'SSOLWA', '1881'). Leave empty to search all sources.",
+                },
+                "max_matches": {
+                    "type": "integer",
+                    "description": "Max matching lines to return per source (default 30)",
+                    "default": 30,
+                },
+            },
+            "required": ["query"],
+        },
+    },
+    {
+        "name": "trigger_poll",
+        "description": (
+            "Trigger an immediate log-fetch and error-detection cycle without waiting "
+            "for the next scheduled interval. Use when: 'check now', 'run now', "
+            "'poll immediately', 'don't wait'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "get_repo_status",
+        "description": (
+            "Per-repository breakdown of errors detected and fixes applied. "
+            "Use for: 'how is repo X doing?', 'which repo has the most issues?', "
+            "'break down by repo'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "hours": {
+                    "type": "integer",
+                    "description": "Look-back window in hours (default 24)",
+                    "default": 24,
+                },
+            },
+        },
+    },
+    {
+        "name": "list_recent_commits",
+        "description": (
+            "List recent commits made by Sentinel across all managed repos. "
+            "Use for: 'what did Sentinel commit?', 'show recent auto-fixes', 'what was changed?'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "limit": {
+                    "type": "integer",
+                    "description": "Max commits per repo (default 5)",
+                    "default": 5,
+                },
+            },
+        },
+    },
+    {
+        "name": "pull_repo",
+        "description": (
+            "Run git pull on one or all managed repos to fetch latest changes from GitHub. "
+            "Use for: 'pull changes', 'git pull', 'update repo X', 'fetch latest code'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo": {
+                    "type": "string",
+                    "description": "Repo name to pull (omit to pull all configured repos)",
+                },
+            },
+        },
+    },
+    {
+        "name": "pull_config",
+        "description": (
+            "Run git pull on one or all Sentinel project config directories. "
+            "Projects are matched by short name ('1881', 'elprint') or full dir name ('sentinel-1881'). "
+            "Use for: 'pull config for 1881', 'update sentinel config', 'pull all configs'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "project": {
+                    "type": "string",
+                    "description": "Project short name or dir name to pull (omit for all projects)",
+                },
+            },
+        },
+    },
+    {
+        "name": "fetch_logs",
+        "description": (
+            "Run fetch_log.sh for one or all configured log sources to pull the latest logs "
+            "from remote servers right now. Use for: 'fetch logs', 'run fetch_log.sh', "
+            "'grab latest logs from SSOLWA', 'try fetch_log.sh for STS', "
+            "'pull logs from server', 'get fresh logs'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "description": "Log source name to fetch (partial match, e.g. 'SSOLWA'). Omit to fetch all.",
+                },
+                "debug": {
+                    "type": "boolean",
+                    "description": "Run fetch_log.sh with --debug flag to show SSH/grep details",
+                    "default": False,
+                },
+                "tail": {
+                    "type": "integer",
+                    "description": "Override TAIL lines (how many log lines to fetch)",
+                },
+                "grep_filter": {
+                    "type": "string",
+                    "description": "Override GREP_FILTER (regex). Pass 'none' to disable filtering.",
+                },
+            },
+        },
+    },
+    {
+        "name": "watch_bot",
+        "description": (
+            "Tell Sentinel to passively monitor a Slack bot — queuing its messages as issues. "
+            "Extract all <@UXXXXXX> user IDs from the message and pass them here. "
+            "Sentinel verifies each is actually a bot (not a human) before adding to the watch list. "
+            "IMPORTANT: a bot watcher is only useful if its issues can be delivered to a project. "
+            "Try to infer the project from context (bot name, prior messages, available projects). "
+            "If it cannot be determined, do NOT call this tool — instead ask the user which project "
+            "the bot's alerts belong to, then call this tool with the project filled in. "
+            "Use for: 'listen to @alertbot', 'watch @bot1 @bot2', 'monitor @errorbot'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "user_ids": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Slack user IDs to watch — extract from <@UXXXXXX> patterns in the message",
+                },
+                "project": {
+                    "type": "string",
+                    "description": "Project short name this bot's issues should be routed to (e.g. '1881', 'elprint'). Infer from context or ask user before calling.",
+                },
+            },
+            "required": ["user_ids"],
+        },
+    },
+    {
+        "name": "unwatch_bot",
+        "description": (
+            "Stop Sentinel from monitoring a Slack bot. "
+            "Use for: 'stop watching @alertbot', 'unwatch @bot', 'remove @errorbot from watchers'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "user_ids": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Slack user IDs to remove from the watch list",
+                },
+            },
+            "required": ["user_ids"],
+        },
+    },
+    {
+        "name": "list_watched_bots",
+        "description": (
+            "List all Slack bots Sentinel is currently monitoring passively. "
+            "Use for: 'who are you watching?', 'which bots are you monitoring?', 'list watched bots'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "upgrade_sentinel",
+        "description": (
+            "Upgrade the Sentinel agent itself: git pull the latest code, update Python deps, "
+            "then restart the process. Safe to call at any time — if already up to date, "
+            "no restart is triggered. "
+            "Use for: 'upgrade sentinel', 'update sentinel', 'upgrade yourself', "
+            "'pull latest sentinel code', 'restart sentinel after upgrade'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "ask_codebase",
+        "description": (
+            "Ask any natural-language question about a managed codebase. "
+            "Accepts a repo name (e.g. 'STS', 'elprint-sales') OR a project name (e.g. '1881', 'elprint') "
+            "— if a project name is given and it has multiple repos, all are queried. "
+            "Claude Code answers using its full codebase knowledge — no need to specify how. "
+            "Use for: 'what does 1881 do?', 'TODOs in 1881', 'find PIN validation in STS', "
+            "'security issues in elprint-sales?', 'summarize the cairn repo'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo": {
+                    "type": "string",
+                    "description": "Repo name (e.g. 'STS', 'elprint-sales') OR project name (e.g. '1881', 'elprint') — project name queries all its repos",
+                },
+                "question": {
+                    "type": "string",
+                    "description": "Natural language question about the codebase",
+                },
+            },
+            "required": ["repo", "question"],
+        },
+    },
+    {
+        "name": "restart_project",
+        "description": (
+            "Stop and restart a specific Sentinel project instance (runs stop.sh then start.sh). "
+            "Use when: 'restart 1881', 'restart elprint', 'reboot the cairn project'. "
+            "Safer than restarting all projects at once."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "project": {
+                    "type": "string",
+                    "description": "Project short name or dir name (e.g. '1881', 'elprint')",
+                },
+            },
+            "required": ["project"],
+        },
+    },
+    {
+        "name": "my_stats",
+        "description": (
+            "Show the current user's personal Sentinel dashboard: "
+            "conversation history length, issues they submitted, and "
+            "a summary of Sentinel fix activity (errors caught, fixes applied, "
+            "fixes pending PR review, fixes confirmed live, fixes failed). "
+            "Use for: 'what have you done for me?', 'show my stats', "
+            "'how many issues have been fixed?', 'my history', 'summary', "
+            "'what did sentinel fix this week?', 'pending fixes', 'open PRs'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "hours": {
+                    "type": "integer",
+                    "description": "Look-back window in hours (default 168 = 7 days)",
+                    "default": 168,
+                },
+            },
+        },
+    },
+    {
+        "name": "clear_my_history",
+        "description": (
+            "Clear the current user's conversation history with Sentinel. "
+            "After clearing, future sessions start with no memory of past conversations. "
+            "Use for: 'clear my history', 'forget our conversation', "
+            "'start fresh', 'reset my context', 'wipe my history'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "tail_log",
+        "description": (
+            "Fetch the last N lines of a log source's live production logs without any grep filter. "
+            "Use when: 'show me recent SSOLWA logs', 'tail STS', 'what's happening in 1881 logs right now', "
+            "'show last 100 lines from SSOLWA'. Different from search_logs — no pattern required."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "description": "Log source name (partial match against log-config filenames, e.g. 'SSOLWA', 'STS')",
+                },
+                "lines": {
+                    "type": "integer",
+                    "description": "Number of recent lines to fetch (default 100)",
+                    "default": 100,
+                },
+            },
+            "required": ["source"],
+        },
+    },
+]
+
+
+# ── Workspace helpers ─────────────────────────────────────────────────────────
+
+def _workspace_dir() -> Path:
+    return Path(".").resolve().parent
+
+def _short_name(dir_name: str) -> str:
+    """'sentinel-1881' → '1881', 'sentinel-elprint' → 'elprint', others unchanged."""
+    if dir_name.startswith("sentinel-"):
+        return dir_name[len("sentinel-"):]
+    return dir_name
+
+def _read_project_name(project_dir: Path) -> str:
+    """Return PROJECT_NAME from sentinel.properties if set, else fall back to _short_name(dir)."""
+    props = project_dir / "config" / "sentinel.properties"
+    if props.exists():
+        try:
+            for line in props.read_text(encoding="utf-8", errors="ignore").splitlines():
+                line = line.strip()
+                if line.startswith("PROJECT_NAME"):
+                    _, _, val = line.partition("=")
+                    val = val.partition("#")[0].strip()
+                    if val:
+                        return val
+        except Exception:
+            pass
+    return _short_name(project_dir.name)
+
+def _find_project_dirs(target: str = "") -> list[Path]:
+    """Return project dirs matching target (PROJECT_NAME, short name, or full dir name), or all if target empty."""
+    workspace = _workspace_dir()
+    results = []
+    try:
+        for d in sorted(workspace.iterdir()):
+            if not d.is_dir() or d.name in ("code", ".git"):
+                continue
+            if not (d / "config").exists():
+                continue
+            if target:
+                t = target.lower()
+                if (t not in d.name.lower()
+                        and t not in _short_name(d.name).lower()
+                        and t not in _read_project_name(d).lower()):
+                    continue
+            results.append(d)
+    except Exception:
+        pass
+    return results
+
+def _git_pull(path: Path) -> dict:
+    try:
+        r = subprocess.run(
+            ["git", "pull", "--rebase", "origin"],
+            cwd=str(path), capture_output=True, text=True, timeout=60,
+        )
+        last = r.stdout.strip().splitlines()[-1] if r.stdout.strip() else "already up to date"
+        return {"status": "ok" if r.returncode == 0 else "error",
+                "detail": last if r.returncode == 0 else r.stderr.strip()}
+    except Exception as e:
+        return {"status": "error", "detail": str(e)}
+
+
+# ── Tool execution ────────────────────────────────────────────────────────────
+
+async def _run_tool(name: str, inputs: dict, cfg_loader, store, slack_client=None, user_id: str = "") -> str:
+    if name == "get_status":
+        hours = int(inputs.get("hours", 24))
+        errors = store.get_recent_errors(hours)
+        fixes  = store.get_recent_fixes(hours)
+        prs    = store.get_open_prs()
+        top_errors = [
+            {
+                "message": e["message"][:120],
+                "count":   e["count"],
+                "source":  e["source"],
+                "last_seen": e["last_seen"],
+            }
+            for e in errors[:8]
+        ]
+        return json.dumps({
+            "window_hours":    hours,
+            "errors_detected": len(errors),
+            "top_errors":      top_errors,
+            "fixes_applied":   sum(1 for f in fixes if f["status"] == "applied"),
+            "fixes_pending":   sum(1 for f in fixes if f["status"] == "pending"),
+            "fixes_failed":    sum(1 for f in fixes if f["status"] == "failed"),
+            "open_prs":        [
+                {
+                    "repo":   p["repo_name"],
+                    "branch": p["branch"],
+                    "pr_url": p["pr_url"],
+                    "age":    p.get("timestamp", ""),
+                }
+                for p in prs
+            ],
+            "sentinel_paused": Path("SENTINEL_PAUSE").exists(),
+        })
+
+    if name == "create_issue":
+        description = inputs["description"]
+        target_repo = inputs.get("target_repo", "")
+        project_arg = inputs.get("project", "")
+
+        if project_arg:
+            project_dirs = _find_project_dirs(project_arg)
+            if not project_dirs:
+                all_names = [_read_project_name(d) for d in _find_project_dirs()]
+                return json.dumps({
+                    "error": f"No project found matching '{project_arg}'",
+                    "available_projects": all_names,
+                    "action_needed": "Ask the user which project they meant.",
+                })
+            if len(project_dirs) > 1:
+                matches = [_read_project_name(d) for d in project_dirs]
+                return json.dumps({
+                    "error": f"Ambiguous project name '{project_arg}' — matches: {matches}",
+                    "action_needed": "Ask the user to clarify which project they mean.",
+                })
+            project_dir = project_dirs[0]
+        else:
+            project_dir = Path(".")
+
+        issues_dir = project_dir / "issues"
+        issues_dir.mkdir(exist_ok=True)
+        fname   = f"slack-{uuid.uuid4().hex[:8]}.txt"
+        content = (f"TARGET_REPO: {target_repo}\n\n" if target_repo else "") + description
+        (issues_dir / fname).write_text(content, encoding="utf-8")
+
+        # Touch SENTINEL_POLL_NOW so the target instance picks it up immediately
+        (project_dir / "SENTINEL_POLL_NOW").touch()
+
+        project_label = _read_project_name(project_dir.resolve()) if project_arg else "this project"
+        logger.info("Boss created issue for %s: %s", project_label, fname)
+        if user_id:
+            try:
+                store.record_submitted_issue(
+                    user_id=user_id,
+                    user_name="",        # resolved by caller if needed
+                    project=project_label,
+                    fname=fname,
+                    description=description,
+                )
+            except Exception as _rec_err:
+                logger.debug("Boss: could not record submitted issue: %s", _rec_err)
+        return json.dumps({
+            "status":  "queued",
+            "project": project_label,
+            "file":    fname,
+            "note":    f"Delivered to '{project_label}'. Sentinel will process it on the next poll cycle.",
+        })
+
+    if name == "get_fix_details":
+        fp  = inputs["fingerprint"]
+        fix = store.get_confirmed_fix(fp) or store.get_marker_seen_fix(fp)
+        if not fix:
+            # Fallback: search recent fixes by prefix
+            recent = store.get_recent_fixes(hours=72)
+            fix    = next((f for f in recent if f.get("fingerprint", "").startswith(fp)), None)
+        return json.dumps(fix or {"error": "not found"})
+
+    if name == "list_pending_prs":
+        prs = store.get_open_prs()
+        return json.dumps({
+            "count":    len(prs),
+            "open_prs": [
+                {
+                    "repo":      p["repo_name"],
+                    "branch":    p["branch"],
+                    "pr_url":    p["pr_url"],
+                    "timestamp": p.get("timestamp", ""),
+                }
+                for p in prs
+            ],
+        })
+
+    if name == "pause_sentinel":
+        Path("SENTINEL_PAUSE").touch()
+        logger.info("Boss: SENTINEL_PAUSE created")
+        return json.dumps({"status": "paused"})
+
+    if name == "resume_sentinel":
+        p = Path("SENTINEL_PAUSE")
+        if p.exists():
+            p.unlink()
+        logger.info("Boss: SENTINEL_PAUSE removed")
+        return json.dumps({"status": "resumed"})
+
+    if name == "list_projects":
+        projects = []
+        for d in _find_project_dirs():
+            repo_cfg_dir = d / "config" / "repo-configs"
+            repos_in_project = []
+            if repo_cfg_dir.exists():
+                for p in sorted(repo_cfg_dir.glob("*.properties")):
+                    if p.name.startswith("_"):
+                        continue
+                    repo_url = ""
+                    for line in p.read_text(encoding="utf-8", errors="ignore").splitlines():
+                        if line.startswith("REPO_URL"):
+                            repo_url = line.split("=", 1)[-1].strip()
+                            break
+                    repos_in_project.append({"repo": p.stem, "url": repo_url})
+            projects.append({
+                "project": _read_project_name(d),
+                "dir":     d.name,
+                "running": (d / "sentinel.pid").exists(),
+                "this":    d.resolve() == Path(".").resolve(),
+                "repos":   repos_in_project,
+            })
+        return json.dumps({"projects": projects})
+
+    if name == "search_logs":
+        query       = inputs.get("query", "")
+        source      = inputs.get("source", "").lower()
+        max_matches = int(inputs.get("max_matches", 30))
+
+        # ── Live fetch path: SSH to servers and grep in real time ──────────────
+        script = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
+        log_cfg_dir = Path("config") / "log-configs"
+        if script.exists() and log_cfg_dir.exists():
+            props_files = sorted(log_cfg_dir.glob("*.properties"))
+            if source:
+                props_files = [p for p in props_files if source in p.stem.lower()]
+            if props_files:
+                live_results = []
+                for props in props_files:
+                    env = os.environ.copy()
+                    env["GREP_FILTER"] = query
+                    try:
+                        r = subprocess.run(
+                            ["bash", str(script), str(props)],
+                            capture_output=True, text=True, timeout=60, env=env,
+                        )
+                        lines = (r.stdout or "").strip().splitlines()
+                        matches = [ln[:300] for ln in lines if ln.strip()][:max_matches]
+                        if matches:
+                            live_results.append({"source": props.stem, "matches": matches})
+                        logger.info("Boss search_logs live %s rc=%d found=%d", props.stem, r.returncode, len(matches))
+                    except subprocess.TimeoutExpired:
+                        live_results.append({"source": props.stem, "error": "timed out"})
+                    except Exception as e:
+                        live_results.append({"source": props.stem, "error": str(e)})
+                total = sum(len(r.get("matches", [])) for r in live_results)
+                return json.dumps({
+                    "query": query,
+                    "mode": "live",
+                    "total_matches": total,
+                    "results": live_results,
+                })
+
+        # ── Fallback: search locally-cached log files ──────────────────────────
+        fetched_dir = Path("workspace/fetched")
+        if not fetched_dir.exists():
+            return json.dumps({"error": "No fetched logs found and fetch_log.sh unavailable"})
+        try:
+            pattern = re.compile(query, re.IGNORECASE)
+        except re.error as e:
+            return json.dumps({"error": f"Invalid regex: {e}"})
+        results = []
+        for log_file in sorted(fetched_dir.glob("*.log")):
+            if source and source not in log_file.name.lower():
+                continue
+            try:
+                lines   = log_file.read_text(encoding="utf-8", errors="ignore").splitlines()
+                matches = [
+                    {"line": i + 1, "text": line[:300]}
+                    for i, line in enumerate(lines)
+                    if pattern.search(line)
+                ][:max_matches]
+                if matches:
+                    results.append({"file": log_file.name, "matches": matches})
+            except Exception:
+                pass
+        total = sum(len(r["matches"]) for r in results)
+        return json.dumps({
+            "query": query,
+            "mode": "cached",
+            "total_matches": total,
+            "files_searched": len(list(fetched_dir.glob("*.log"))),
+            "results": results,
+        })
+
+    if name == "trigger_poll":
+        Path("SENTINEL_POLL_NOW").touch()
+        logger.info("Boss: immediate poll requested")
+        return json.dumps({"status": "triggered", "note": "Sentinel will run a poll cycle within seconds"})
+
+    if name == "get_repo_status":
+        hours  = int(inputs.get("hours", 24))
+        fixes  = store.get_recent_fixes(hours)
+        errors = store.get_recent_errors(hours)
+        by_repo: dict = {}
+        for fix in fixes:
+            repo = fix.get("repo_name", "unknown")
+            s    = by_repo.setdefault(repo, {"applied": 0, "pending": 0, "failed": 0, "skipped": 0})
+            key  = fix.get("status", "failed")
+            s[key] = s.get(key, 0) + 1
+        return json.dumps({"window_hours": hours, "total_errors": len(errors), "by_repo": by_repo})
+
+    if name == "list_recent_commits":
+        limit   = int(inputs.get("limit", 5))
+        results = []
+        for repo_name, repo in cfg_loader.repos.items():
+            local = Path(repo.local_path)
+            if not local.exists():
+                continue
+            try:
+                r = subprocess.run(
+                    ["git", "log", "--oneline", "--grep=sentinel", "-n", str(limit)],
+                    cwd=str(local), capture_output=True, text=True, timeout=10,
+                )
+                commits = r.stdout.strip().splitlines()
+                if commits:
+                    results.append({"repo": repo_name, "commits": commits})
+            except Exception:
+                pass
+        return json.dumps({"sentinel_commits": results})
+
+    if name == "pull_repo":
+        target = inputs.get("repo", "").lower()
+        results = []
+        for repo_name, repo in cfg_loader.repos.items():
+            if target and target not in repo_name.lower():
+                continue
+            local = Path(repo.local_path)
+            if not local.exists():
+                results.append({"repo": repo_name, "status": "error", "detail": "local path not found"})
+                continue
+            try:
+                r = subprocess.run(
+                    ["git", "pull", "--rebase", "origin", repo.branch],
+                    cwd=str(local), capture_output=True, text=True, timeout=60,
+                )
+                last_line = r.stdout.strip().splitlines()[-1] if r.stdout.strip() else "already up to date"
+                if r.returncode == 0:
+                    results.append({"repo": repo_name, "status": "ok", "detail": last_line})
+                else:
+                    results.append({"repo": repo_name, "status": "error", "detail": r.stderr.strip()})
+            except Exception as e:
+                results.append({"repo": repo_name, "status": "error", "detail": str(e)})
+        return json.dumps({"results": results})
+
+    if name == "pull_config":
+        target = inputs.get("project", "")
+        dirs = _find_project_dirs(target)
+        if not dirs:
+            return json.dumps({"error": f"No project found matching '{target}'"})
+        results = []
+        for d in dirs:
+            res = _git_pull(d)
+            results.append({"project": _read_project_name(d), "dir": d.name, **res})
+            logger.info("Boss: pull_config %s → %s", d.name, res["status"])
+        return json.dumps({"results": results})
+
+    if name == "fetch_logs":
+        source_filter = inputs.get("source", "").lower()
+        debug         = bool(inputs.get("debug", False))
+        tail_override = inputs.get("tail")
+        grep_override = inputs.get("grep_filter", "")
+
+        # Find fetch_log.sh relative to this file
+        script = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
+        if not script.exists():
+            return json.dumps({"error": f"fetch_log.sh not found at {script}"})
+
+        log_cfg_dir = Path("config") / "log-configs"
+        if not log_cfg_dir.exists():
+            return json.dumps({"error": "config/log-configs/ not found"})
+
+        props_files = sorted(log_cfg_dir.glob("*.properties"))
+        if source_filter:
+            props_files = [p for p in props_files if source_filter in p.stem.lower()]
+        if not props_files:
+            return json.dumps({"error": f"No log-config found matching '{source_filter}'"})
+
+        results = []
+        for props in props_files:
+            env = os.environ.copy()
+            if tail_override:
+                env["TAIL"] = str(tail_override)
+            if grep_override:
+                env["GREP_FILTER"] = grep_override
+
+            cmd = ["bash", str(script)]
+            if debug:
+                cmd.append("--debug")
+            cmd.append(str(props))
+
+            try:
+                r = subprocess.run(
+                    cmd, capture_output=True, text=True, timeout=120, env=env,
+                )
+                output = (r.stdout or "").strip()
+                stderr = (r.stderr or "").strip()
+                results.append({
+                    "source":     props.stem,
+                    "returncode": r.returncode,
+                    "output":     output[-2000:] if output else "",
+                    "stderr":     stderr[-1000:] if stderr else "",
+                })
+                logger.info("Boss fetch_logs %s rc=%d", props.stem, r.returncode)
+            except subprocess.TimeoutExpired:
+                results.append({"source": props.stem, "error": "timed out after 120s"})
+            except Exception as e:
+                results.append({"source": props.stem, "error": str(e)})
+
+        return json.dumps({"fetched": len(results), "results": results})
+
+    if name == "watch_bot":
+        user_ids    = inputs.get("user_ids", [])
+        project_arg = inputs.get("project", "").strip()
+        if not user_ids:
+            return json.dumps({"error": "No user_ids provided"})
+
+        # Resolve + validate project — required for bot issue routing
+        resolved_project = ""
+        if project_arg:
+            project_dirs = _find_project_dirs(project_arg)
+            if not project_dirs:
+                all_names = [_read_project_name(d) for d in _find_project_dirs()]
+                return json.dumps({
+                    "error": f"No project found matching '{project_arg}'",
+                    "available_projects": all_names,
+                    "action_needed": "Ask the user which project these bot alerts belong to.",
+                })
+            if len(project_dirs) > 1:
+                matches = [_read_project_name(d) for d in project_dirs]
+                return json.dumps({
+                    "error": f"Ambiguous project name '{project_arg}' — matches: {matches}",
+                    "action_needed": "Ask the user to clarify which project.",
+                })
+            resolved_project = _read_project_name(project_dirs[0])
+        else:
+            all_projects = _find_project_dirs()
+            if len(all_projects) == 1:
+                # Single project in workspace — auto-assign
+                resolved_project = _read_project_name(all_projects[0])
+            elif all_projects:
+                all_names = [_read_project_name(d) for d in all_projects]
+                return json.dumps({
+                    "error": "Cannot determine which project these bot alerts belong to.",
+                    "available_projects": all_names,
+                    "action_needed": "Ask the user to specify the project, then retry with project filled in.",
+                })
+
+        results = []
+        for uid in user_ids:
+            if not slack_client:
+                results.append({"user_id": uid, "status": "error", "reason": "no Slack client available"})
+                continue
+            try:
+                info = await slack_client.users_info(user=uid)
+                user = info.get("user", {})
+                if not user.get("is_bot", False):
+                    results.append({"user_id": uid, "status": "skipped", "reason": "not a bot — only bots can be watched passively"})
+                    continue
+                bot_name = user.get("real_name") or user.get("name") or uid
+                store.add_watched_bot(uid, bot_name, added_by="boss", project_name=resolved_project)
+                logger.info("Boss: now watching bot %s (%s) → project '%s'", bot_name, uid, resolved_project or "unset")
+                results.append({"user_id": uid, "bot_name": bot_name, "project": resolved_project, "status": "watching"})
+            except Exception as e:
+                results.append({"user_id": uid, "status": "error", "reason": str(e)})
+        return json.dumps({"results": results})
+
+    if name == "unwatch_bot":
+        user_ids = inputs.get("user_ids", [])
+        if not user_ids:
+            return json.dumps({"error": "No user_ids provided"})
+        results = []
+        for uid in user_ids:
+            removed = store.remove_watched_bot(uid)
+            logger.info("Boss: unwatch bot %s → %s", uid, "removed" if removed else "not found")
+            results.append({"user_id": uid, "status": "removed" if removed else "not found"})
+        return json.dumps({"results": results})
+
+    if name == "list_watched_bots":
+        bots = store.get_watched_bots()
+        return json.dumps({
+            "count": len(bots),
+            "bots": [
+                {
+                    "bot_id":   b["bot_id"],
+                    "bot_name": b["bot_name"],
+                    "project":  b.get("project_name") or "",
+                    "added_by": b["added_by"],
+                    "added_at": b["added_at"],
+                }
+                for b in bots
+            ],
+        })
+
+    if name == "upgrade_sentinel":
+        import threading
+
+        # Sentinel is installed via npm — use `sentinel upgrade` which handles
+        # npm install + Python bundle copy + restart via stopAll/startAll.
+        # Run it in the background after a short delay so the Slack reply is
+        # sent before the process is replaced.
+        try:
+            r = subprocess.run(
+                ["sentinel", "--version"],
+                capture_output=True, text=True, timeout=10,
+            )
+            sentinel_bin_ok = r.returncode == 0
+        except Exception:
+            sentinel_bin_ok = False
+
+        if not sentinel_bin_ok:
+            return json.dumps({
+                "status": "error",
+                "note":   "`sentinel` CLI not found. Run: npm install -g @misterhuydo/sentinel",
+            })
+
+        def _do_upgrade():
+            import time
+            time.sleep(10)   # give Slack time to post the reply
+            subprocess.Popen(["sentinel", "upgrade"], close_fds=True)
+
+        threading.Thread(target=_do_upgrade, daemon=True).start()
+        logger.info("Boss: upgrade_sentinel scheduled via `sentinel upgrade`")
+        return json.dumps({
+            "status": "ok",
+            "note":   "Upgrade started — pulling latest version via npm and restarting. Give me ~30 seconds then I'll be back.",
+        })
+
+    if name == "ask_codebase":
+        target   = inputs.get("repo", "").lower()
+        question = inputs.get("question", "")
+
+        # 1. Find repos whose name contains the target (e.g. "STS", "elprint-sales")
+        matched = [(rn, r) for rn, r in cfg_loader.repos.items() if target in rn.lower()]
+
+        # 2. No repo match — check if target is a project name → use ALL repos in cfg_loader
+        #    (each Sentinel instance is scoped to one project, so all repos belong to it)
+        if not matched:
+            current_project = _read_project_name(Path("."))
+            if target in current_project.lower() or current_project.lower() in target:
+                matched = list(cfg_loader.repos.items())
+
+        if not matched:
+            return json.dumps({
+                "error": f"No repo or project found matching '{target}'",
+                "available_repos": list(cfg_loader.repos.keys()),
+            })
+
+        cfg = cfg_loader.sentinel
+        env = os.environ.copy()
+        if cfg.anthropic_api_key:
+            env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
+
+        def _ask_one(repo_name, repo_cfg) -> dict:
+            local_path = Path(repo_cfg.local_path)
+            if not local_path.exists():
+                return {"repo": repo_name, "error": f"not cloned yet at {local_path}"}
+            prompt = (
+                f"You are a code analyst. Answer the following question about the codebase at: {local_path}\n\n"
+                f"Question: {question}\n\n"
+                f"Use whatever tools you need to answer accurately. Be concise and direct. Plain text only."
+            )
+            try:
+                r = subprocess.run(
+                    ([cfg.claude_code_bin, "--dangerously-skip-permissions", "--print", prompt]
+                    if os.getuid() != 0 else
+                    [cfg.claude_code_bin, "--print", prompt]),
+                    capture_output=True, text=True, timeout=180, env=env,
+                    cwd=str(local_path),
+                )
+                output = (r.stdout or "").strip()
+                logger.info("Boss ask_codebase %s rc=%d len=%d", repo_name, r.returncode, len(output))
+                if r.returncode != 0 and not output:
+                    return {"repo": repo_name, "error": f"claude --print failed (rc={r.returncode}): {(r.stderr or '')[:200]}"}
+                return {"repo": repo_name, "answer": output[:3000]}
+            except subprocess.TimeoutExpired:
+                return {"repo": repo_name, "error": "timed out after 180s"}
+            except Exception as e:
+                return {"repo": repo_name, "error": str(e)}
+
+        if len(matched) == 1:
+            result = _ask_one(*matched[0])
+            # Unwrap single-repo result for cleaner response
+            return json.dumps(result)
+
+        # Multiple repos — query each and combine
+        results = [_ask_one(rn, r) for rn, r in matched]
+        return json.dumps({"project": target, "repos_queried": len(results), "results": results})
+
+    if name == "restart_project":
+        project_arg = inputs.get("project", "").lower()
+        dirs = _find_project_dirs(project_arg)
+        if not dirs:
+            return json.dumps({"error": f"No project found matching '{project_arg}'"})
+        results = []
+        for d in dirs:
+            stop_sh  = d / "stop.sh"
+            start_sh = d / "start.sh"
+            if not stop_sh.exists() or not start_sh.exists():
+                results.append({"project": d.name, "status": "error", "detail": "stop.sh or start.sh not found"})
+                continue
+            try:
+                subprocess.run(["bash", str(stop_sh)],  cwd=str(d), timeout=30)
+                subprocess.run(["bash", str(start_sh)], cwd=str(d), timeout=30)
+                results.append({"project": d.name, "status": "restarted"})
+                logger.info("Boss: restarted project %s", d.name)
+            except Exception as e:
+                results.append({"project": d.name, "status": "error", "detail": str(e)})
+        return json.dumps({"results": results})
+
+    if name == "tail_log":
+        source      = inputs.get("source", "").lower()
+        lines       = int(inputs.get("lines", 100))
+        script      = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
+        log_cfg_dir = Path("config") / "log-configs"
+
+        if not script.exists():
+            return json.dumps({"error": "fetch_log.sh not found"})
+        if not log_cfg_dir.exists():
+            return json.dumps({"error": "config/log-configs/ not found"})
+
+        props_files = sorted(log_cfg_dir.glob("*.properties"))
+        if source:
+            props_files = [p for p in props_files if source in p.stem.lower()]
+        if not props_files:
+            return json.dumps({"error": f"No log-config found matching '{source}'"})
+
+        results = []
+        for props in props_files:
+            env = os.environ.copy()
+            env["TAIL"]        = str(lines)
+            env["GREP_FILTER"] = ""   # no filter — show everything
+            try:
+                r = subprocess.run(
+                    ["bash", str(script), str(props)],
+                    capture_output=True, text=True, timeout=60, env=env,
+                )
+                tail_lines = (r.stdout or "").strip().splitlines()[-lines:]
+                results.append({
+                    "source":  props.stem,
+                    "lines":   len(tail_lines),
+                    "content": "\n".join(tail_lines),
+                })
+                logger.info("Boss tail_log %s rc=%d lines=%d", props.stem, r.returncode, len(tail_lines))
+            except subprocess.TimeoutExpired:
+                results.append({"source": props.stem, "error": "timed out"})
+            except Exception as e:
+                results.append({"source": props.stem, "error": str(e)})
+        return json.dumps({"results": results})
+
+    if name == "my_stats":
+        hours  = int(inputs.get("hours", 168))
+        errors = store.get_recent_errors(hours)
+        fixes  = store.get_recent_fixes(hours)
+        prs    = store.get_open_prs()
+        pending_conf = store.get_fixes_pending_confirmation()
+        # Conversation stats
+        history      = store.load_conversation(user_id) if user_id else []
+        hist_len     = len(history)
+        # Load conversation updated_at from DB
+        conv_updated = ""
+        try:
+            import sqlite3 as _sqlite3
+            with _sqlite3.connect(store.db_path) as _db:
+                row = _db.execute(
+                    "SELECT updated_at FROM conversations WHERE user_id=?", (user_id,)
+                ).fetchone()
+                if row:
+                    conv_updated = row[0]
+        except Exception:
+            pass
+        # Tally fix statuses
+        by_status: dict = {}
+        for fix in fixes:
+            s = fix.get("status", "unknown")
+            by_status[s] = by_status.get(s, 0) + 1
+        # Fixes confirmed via sentinel marker in prod
+        confirmed = [f for f in fixes if f.get("fix_outcome") == "confirmed"]
+        regressed = [f for f in fixes if f.get("fix_outcome") == "regressed"]
+        submitted = store.get_submitted_issues(user_id, hours=hours) if user_id else []
+        submitted_recent = store.get_submitted_issues(user_id, hours=hours) if user_id else []
+        return json.dumps({
+            "conversation": {
+                "messages_in_history": hist_len,
+                "turns":               hist_len // 2,
+                "last_active":         conv_updated or "no history",
+            },
+            "issues_you_submitted": {
+                "total_in_window": len(submitted_recent),
+                "all_time":        len(store.get_submitted_issues(user_id) if user_id else []),
+                "recent": [
+                    {"project": i["project"], "description": i["description"][:80],
+                     "submitted_at": i["submitted_at"]}
+                    for i in submitted_recent[:5]
+                ],
+            },
+            "window_hours": hours,
+            "errors_detected": len(errors),
+            "fixes": {
+                "applied":    by_status.get("applied", 0),
+                "pending_pr": len(prs),
+                "failed":     by_status.get("failed", 0),
+                "skipped":    by_status.get("skipped", 0),
+                "error":      by_status.get("error", 0),
+            },
+            "confirmed_in_prod":     len(confirmed),
+            "regressed_after_fix":   len(regressed),
+            "awaiting_confirmation": len(pending_conf),
+            "open_prs": [
+                {"repo": p["repo_name"], "pr_url": p["pr_url"], "timestamp": p["timestamp"]}
+                for p in prs
+            ],
+            "top_errors": [
+                {"message": e["message"][:100], "count": e["count"], "source": e["source"]}
+                for e in errors[:5]
+            ],
+        })
+    if name == "clear_my_history":
+        if user_id:
+            store.save_conversation(user_id, [])
+            logger.info("Boss: cleared conversation history for user %s", user_id)
+            return json.dumps({
+                "status":  "cleared",
+                "note":    "Your conversation history has been wiped. Next session starts fresh. [DONE]",
+            })
+        return json.dumps({"error": "cannot determine user — not clearing"})
+    return json.dumps({"error": f"unknown tool: {name}"})
+
+
+# ── CLI fallback (OAuth / no API key) ────────────────────────────────────────
+
+def _attachments_to_text(attachments: list[dict]) -> str:
+    """Produce a plain-text summary of attachments to append to CLI prompts."""
+    if not attachments:
+        return ""
+    parts = []
+    for att in attachments:
+        if att["type"] == "text":
+            parts.append(
+                f"[Attached file: {att['name']}]\n{att['content']}"
+            )
+        elif att["type"] == "image":
+            parts.append(
+                f"[Attached image: {att['name']}] (saved at {att['path']})"
+            )
+        else:
+            parts.append(
+                f"[Attached file: {att['name']}] (saved at {att['path']} — read it if relevant)"
+            )
+    return "\n\nATTACHMENTS:\n" + "\n---\n".join(parts)
+
+
+def _attachments_to_api_blocks(attachments: list[dict]) -> list[dict]:
+    """Convert attachments into Anthropic API message content blocks."""
+    blocks: list[dict] = []
+    for att in attachments:
+        if att["type"] == "image":
+            blocks.append({
+                "type": "image",
+                "source": {
+                    "type":       "base64",
+                    "media_type": att.get("mime", "image/png"),
+                    "data":       att["content"],
+                },
+            })
+        elif att["type"] == "text":
+            blocks.append({
+                "type": "text",
+                "text": f"[Attached file: {att['name']}]\n{att['content']}",
+            })
+        else:
+            blocks.append({
+                "type": "text",
+                "text": f"[Attached file: {att['name']}] saved at {att['path']}",
+            })
+    return blocks
+
+
+_ACTION_RE = re.compile(r"^ACTION:\s*(\{.*\})", re.MULTILINE)
+
+
+async def _handle_with_cli(
+    message: str,
+    history: list,
+    cfg_loader,
+    store,
+    slack_client=None,
+    user_name: str = "",
+    user_id: str = "",
+    attachments: list | None = None,
+) -> tuple[str, bool]:
+    """Fallback: use `claude --print` for users without an Anthropic API key."""
+    status_json = await _run_tool("get_status", {"hours": 24}, cfg_loader, store)
+    prs_json    = await _run_tool("list_pending_prs", {}, cfg_loader, store)
+
+    # Pre-fetch log search if the message is a search request.
+    # Use quoted strings as the query, or fall back to the full message.
+    # Never hardcode field names — the query is whatever the user said.
+    search_json = ""
+    _search_kws = ("search", "find", "look for", "show me log", "grep", "entries for")
+    if any(kw in message.lower() for kw in _search_kws):
+        quoted = re.findall(r'"([^"]+)"', message)
+        query  = quoted[0] if quoted else message
+        search_json = await _run_tool("search_logs", {"query": query}, cfg_loader, store)
+
+    paused      = Path("SENTINEL_PAUSE").exists()
+    repos       = list(cfg_loader.repos.keys())
+    log_sources = list(cfg_loader.log_sources.keys())
+    ts          = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+
+    history_text = ""
+    for msg in history[-8:]:
+        role    = msg["role"].upper()
+        content = msg["content"]
+        if isinstance(content, list):
+            content = " ".join(
+                (b.get("text", "") if isinstance(b, dict) else getattr(b, "text", ""))
+                for b in content
+                if (isinstance(b, dict) and b.get("type") == "text")
+                or (hasattr(b, "type") and b.type == "text")
+            )
+        history_text += f"\n{role}: {content}"
+
+    prompt = (
+        _SYSTEM
+        + (f"\nYou are speaking with: {user_name}" if user_name else "")
+        + f"\n\nCurrent time: {ts}"
+        + f"\nSentinel status: {'⏸ PAUSED' if paused else '▶ RUNNING'}"
+        + f"\nManaged repos: {', '.join(repos) if repos else '(none configured)'}"
+        + (f"\nLog sources: {', '.join(log_sources)}" if log_sources else "")
+        + f"\n\nCurrent status (last 24 h):\n{status_json}"
+        + f"\n\nOpen PRs:\n{prs_json}"
+        + (f"\n\nLog search results:\n{search_json}" if search_json else "")
+        + (f"\n\nConversation so far:{history_text}" if history_text else "")
+        + _attachments_to_text(attachments or [])
+        + f"\n\nUSER: {message}"
+        + "\n\nIf you need to take an action, include a line like:\n"
+        + "  ACTION: {\"action\": \"pause_sentinel\"}\n"
+        + "  ACTION: {\"action\": \"resume_sentinel\"}\n"
+        + "  ACTION: {\"action\": \"trigger_poll\"}\n"
+        + "  ACTION: {\"action\": \"create_issue\", \"description\": \"...\", \"target_repo\": \"\"}\n"
+        + "  ACTION: {\"action\": \"search_logs\", \"query\": \"<whatever the user asked to find>\"}\n"
+        + "End with [DONE] if the request is fully handled."
+    )
+
+    cfg = cfg_loader.sentinel
+    env = os.environ.copy()
+    if cfg.anthropic_api_key:
+        env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
+
+    try:
+        result = subprocess.run(
+            ([cfg.claude_code_bin, "--dangerously-skip-permissions", "--print", prompt]
+                    if os.getuid() != 0 else
+                    [cfg.claude_code_bin, "--print", prompt]),
+            capture_output=True, text=True, timeout=180, env=env,
+        )
+        output = (result.stdout or "").strip()
+        if result.returncode != 0 or not output:
+            stderr = (result.stderr or "").strip()
+            logger.error(
+                "Boss CLI call failed (rc=%d): stdout=%r stderr=%r",
+                result.returncode, output[:200], stderr[:200],
+            )
+        if result.returncode != 0 and not output:
+            return f":warning: `claude --print` failed (exit {result.returncode}): {(result.stderr or '').strip()[:300]}", True
+    except Exception as e:
+        logger.error("Boss CLI call failed: %s", e)
+        return f":warning: Boss unavailable: {e}", True
+
+    for m in _ACTION_RE.finditer(output):
+        try:
+            action = json.loads(m.group(1))
+            name   = action.pop("action", "")
+            if name:
+                result_str = await _run_tool(name, action, cfg_loader, store, user_id=user_id)
+                logger.info("Boss CLI action: %s → %s", name, result_str[:80])
+        except Exception as e:
+            logger.warning("Boss action parse error: %s", e)
+
+    reply   = _ACTION_RE.sub("", output).strip()
+    is_done = "[DONE]" in reply
+    reply   = reply.replace("[DONE]", "").strip()
+    if not reply:
+        greeting = f"Hi {user_name}! " if user_name else "Hi! "
+        reply = f"{greeting}I'm Sentinel, your autonomous DevOps agent. How can I help you?"
+
+    history.append({"role": "user",      "content": message})
+    history.append({"role": "assistant", "content": reply})
+    return reply, is_done
+
+
+# ── API-key path (structured tools, full agentic loop) ────────────────────────
+
+async def _handle_with_api(
+    message: str,
+    history: list,
+    cfg_loader,
+    store,
+    slack_client=None,
+    user_name: str = "",
+    user_id: str = "",
+    attachments: list | None = None,
+) -> tuple[str, bool]:
+    import anthropic
+
+    api_key = cfg_loader.sentinel.anthropic_api_key or os.environ.get("ANTHROPIC_API_KEY", "")
+    client  = anthropic.Anthropic(api_key=api_key)
+
+    paused         = Path("SENTINEL_PAUSE").exists()
+    repos          = list(cfg_loader.repos.keys())
+    ts             = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+    known_projects = [_read_project_name(d) for d in _find_project_dirs()]
+    log_sources    = list(cfg_loader.log_sources.keys())
+    system = (
+        _SYSTEM
+        + (f"\nYou are speaking with: {user_name}" if user_name else "")
+        + f"\n\nCurrent time: {ts}"
+        + f"\nSentinel status: {'⏸ PAUSED' if paused else '▶ RUNNING'}"
+        + f"\nManaged repos: {', '.join(repos) if repos else '(none configured)'}"
+        + (f"\nLog sources: {', '.join(log_sources)}" if log_sources else "")
+        + (f"\nKnown projects in workspace: {', '.join(known_projects)}" if known_projects else "")
+    )
+
+    # Build user content — include attachment blocks if any
+    attach_blocks = _attachments_to_api_blocks(attachments or [])
+    if attach_blocks:
+        user_content = attach_blocks + [{"type": "text", "text": message}]
+    else:
+        user_content = message
+    history.append({"role": "user", "content": user_content})
+    messages = list(history)
+
+    while True:
+        response = client.messages.create(
+            model="claude-opus-4-6",
+            max_tokens=1024,
+            system=system,
+            tools=_TOOLS,
+            messages=messages,
+        )
+
+        text_parts  = []
+        tool_blocks = []
+        for block in response.content:
+            if block.type == "text":
+                text_parts.append(block.text)
+            elif block.type == "tool_use":
+                tool_blocks.append(block)
+
+        if not tool_blocks:
+            reply   = " ".join(text_parts).strip()
+            is_done = "[DONE]" in reply
+            reply   = reply.replace("[DONE]", "").strip()
+            if not reply:
+                greeting = f"Hi {user_name}! " if user_name else "Hi! "
+                reply = f"{greeting}I'm Sentinel, your autonomous DevOps agent. How can I help you?"
+            history.append({"role": "assistant", "content": response.content})
+            return reply, is_done
+
+        messages.append({"role": "assistant", "content": response.content})
+        tool_results = []
+        for tc in tool_blocks:
+            result = await _run_tool(tc.name, tc.input, cfg_loader, store, slack_client=slack_client, user_id=user_id)
+            logger.info("Boss tool: %s(%s) → %s", tc.name, tc.input, result[:120])
+            tool_results.append({
+                "type":        "tool_result",
+                "tool_use_id": tc.id,
+                "content":     result,
+            })
+        messages.append({"role": "user", "content": tool_results})
+
+
+# ── Main entry point ──────────────────────────────────────────────────────────
+
+async def handle_message(
+    message: str,
+    history: list,
+    cfg_loader,
+    store,
+    slack_client=None,
+    user_name: str = "",
+    user_id: str = "",
+    attachments: list | None = None,
+) -> tuple[str, bool]:
+    """
+    Process one user message through the Sentinel Boss (Claude with tool use).
+
+    Priority:
+      1. Claude Pro / OAuth via `claude --print` (CLI path — no API key needed)
+      2. ANTHROPIC_API_KEY fallback (structured tools, full agentic loop)
+
+    Returns:
+        (reply_text, is_done)
+        is_done=True  → session complete, release the Slack queue slot.
+        is_done=False → waiting for user follow-up, keep the slot.
+    """
+    # 1st priority: Claude Pro / OAuth via CLI
+    cli_reply, cli_done = await _handle_with_cli(
+        message, history, cfg_loader, store, slack_client=slack_client, user_name=user_name,
+        user_id=user_id, attachments=attachments,
+    )
+    if not cli_reply.startswith(":warning:"):
+        return cli_reply, cli_done
+
+    # CLI failed — try ANTHROPIC_API_KEY fallback
+    try:
+        import anthropic  # noqa: F401
+    except ImportError:
+        return (
+            ":warning: `anthropic` package not installed. Run: `pip install anthropic`",
+            True,
+        )
+
+    api_key = cfg_loader.sentinel.anthropic_api_key or os.environ.get("ANTHROPIC_API_KEY", "")
+    if not api_key:
+        return cli_reply, cli_done  # No fallback available
+
+    logger.info("Boss: CLI path failed (%s…), falling back to ANTHROPIC_API_KEY", cli_reply[:60])
+    return await _handle_with_api(
+        message, history, cfg_loader, store, slack_client=slack_client, user_name=user_name,
+        user_id=user_id, attachments=attachments,
+    )