@misterhuydo/sentinel 1.5.4 → 1.5.6

package/.cairn/views/23edf4_sentinel_boss.py

@@ -0,0 +1,3664 @@
+from __future__ import annotations
+import json
+import logging
+import os
+_GITHUB_TOKEN_403_GUIDE = (
+    "GitHub returned 403 — your `GITHUB_TOKEN` is blocked by this org's policy.\n\n"
+    "*How to fix — create a fine-grained PAT:*\n"
+    "1. Go to https://github.com/settings/tokens → *Fine-grained tokens* → *Generate new token*\n"
+    "2. Set *Resource owner* to the org (e.g. `exoreaction` or `Opplysningen1881`)\n"
+    "3. Set *Repository access* → the specific repo (or all repos in the org)\n"
+    "4. Under *Permissions* → enable: `Pull requests` (Read & Write), `Contents` (Read & Write)\n"
+    "5. Generate, copy the token, and set it in `config/sentinel.properties`:\n"
+    "   `GITHUB_TOKEN=github_pat_...`\n"
+    "6. Restart Sentinel or send `SIGHUP` to reload config.\n\n"
+    "_Note: fine-grained PATs expire after max 1 year — set a reminder to renew._"
+)
+import re
+import subprocess
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Optional
+from .notify import alert_if_rate_limited, slack_alert, is_rate_limited
+logger = logging.getLogger(__name__)
+_SYSTEM =
+_BOSS_MODE_HINTS = {
+    "standard": (
+        "For requests that are clearly not DevOps tasks (jokes, stories, SVGs, general questions, "
+        "creative tasks) — just answer helpfully and naturally. No need to redirect back to "
+        "Sentinel's purpose."
+    ),
+    "strict": (
+        "You are a DevOps-only assistant. If the user asks for something unrelated to software "
+        "engineering, infrastructure, or this project's operations (e.g. jokes, stories, creative "
+        "writing), politely decline and steer back to DevOps topics. Keep it brief and friendly."
+    ),
+    "fun": (
+        "For requests that are clearly not DevOps tasks (jokes, stories, SVGs, creative writing, "
+        "trivia, anything fun) — engage fully and enthusiastically. You're a senior engineer who "
+        "also happens to be great company. Have fun with it, keep your personality, and don't "
+        "over-explain. Then offer to help with DevOps if relevant."
+    ),
+}
+def _resolve_system(boss_mode: str = "standard",
+                    project_name: str = "",
+                    project_description: str = "",
+                    other_project_names: list | None = None) -> str:
+    hint = _BOSS_MODE_HINTS.get(boss_mode, _BOSS_MODE_HINTS["standard"])
+    base = _SYSTEM.replace("{BOSS_MODE_HINT}", hint)
+    if not project_name:
+        return base
+    desc_line = f"\nProject description: {project_description}" if project_description else ""
+    others = [n for n in (other_project_names or []) if n.lower() != project_name.lower()]
+    if others:
+        scope_line = (
+            f"\n\nSCOPE ISOLATION (important): You serve ONLY the {project_name} project. "
+            f"This Sentinel host also runs instances for: {', '.join(others)}. "
+            f"If a user asks about {', '.join(others)} or any other project not in your repos, "
+            f"decline and explain you are scoped to {project_name} only. "
+            f"Never expose config, logs, errors, or code from other projects."
+        )
+    else:
+        scope_line = (
+            f"\n\nSCOPE: You serve ONLY the {project_name} project. "
+            f"Decline requests about projects or repos you do not manage."
+        )
+    identity = (
+        f"PROJECT IDENTITY\n"
+        f"You are Sentinel Boss for: {project_name}{desc_line}"
+        f"{scope_line}\n"
+        f"{'=' * 60}\n\n"
+    )
+    return identity + base
+_TOOLS = [
+    {
+        "name": "get_status",
+        "description": (
+            "Get recent errors, fixes applied, fixes pending review, and open PRs. "
+            "Use for: 'what happened today?', 'any issues?', 'how are things?', "
+            "'what are the open PRs?', 'did sentinel fix anything?'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "hours": {
+                    "type": "integer",
+                    "description": "Look-back window in hours (default 24)",
+                    "default": 24,
+                },
+            },
+        },
+    },
+    {
+        "name": "create_issue",
+        "description": (
+            "Deliver an issue/task to a Sentinel project instance. "
+            "Call this as soon as you have identified: (1) a real issue or task (not a status question "
+            "or casual chat), (2) the target project, (3) enough context to describe the problem. "
+            "Act immediately — do not ask the user for confirmation first. "
+            "Only pause if the target project is genuinely unknown and cannot be inferred."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "description": {
+                    "type": "string",
+                    "description": "Full problem/task description — include all context the user gave you",
+                },
+                "project": {
+                    "type": "string",
+                    "description": "Project short name (e.g. '1881', 'elprint'). Ask if unclear.",
+                },
+                "target_repo": {
+                    "type": "string",
+                    "description": "Specific repo within the project (omit to let Sentinel auto-route)",
+                },
+                "support_url": {
+                    "type": "string",
+                    "description": "Any URL the user shared (ticket, doc, screenshot link, etc.)",
+                },
+                "attachments_summary": {
+                    "type": "string",
+                    "description": "Summary of any files/screenshots the user attached",
+                },
+                "findings": {
+                    "type": "string",
+                    "description": (
+                        "A concise, curated summary of evidence directly relevant to this issue — "
+                        "NOT raw tool output. Include only what the fix engine needs: "
+                        "key error patterns, affected services, approximate frequency/timestamps, "
+                        "and 1-3 representative log lines. Omit unrelated results. "
+                        "Keep under 500 words. Leave empty if no tool results are relevant."
+                    ),
+                },
+            },
+            "required": ["description"],
+        },
+    },
+    {
+        "name": "get_fix_details",
+        "description": "Get full details of a specific fix by fingerprint (8+ hex chars).",
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "fingerprint": {"type": "string"},
+            },
+            "required": ["fingerprint"],
+        },
+    },
+    {
+        "name": "retry_issue",
+        "description": (
+            "Re-queue a previously failed or blocked issue from the archive without requiring the "
+            "user to re-type the context. Scans issues/.done/ for the most recent matching file "
+            "and re-submits it to Sentinel. "
+            "Use when the user says things like: 'retry the last issue', 're-raise the umlaut fix', "
+            "'try that again', 'retry Whydah-TypeLib', 'run the last failed fix again'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "project": {
+                    "type": "string",
+                    "description": "Project short name (e.g. '1881'). Required.",
+                },
+                "keyword": {
+                    "type": "string",
+                    "description": "Optional keyword to match against archived issue content (e.g. 'umlaut', 'Whydah-TypeLib')",
+                },
+            },
+            "required": ["project"],
+        },
+    },
+    {
+        "name": "cancel_issue",
+        "description": (
+            "Cancel a pending issue that is still waiting in the queue (not yet picked up). "
+            "Moves the file to issues/.cancelled/ so Sentinel never processes it. "
+            "If the issue is already running it cannot be cancelled — it will block naturally. "
+            "Use when the user says: 'stop', 'cancel that', 'don't process X', 'cancel the TypeLib retry'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "project": {
+                    "type": "string",
+                    "description": "Project short name (e.g. '1881'). Required.",
+                },
+                "keyword": {
+                    "type": "string",
+                    "description": "Keyword to match the pending issue (repo name, error keyword, etc.)",
+                },
+            },
+            "required": ["project", "keyword"],
+        },
+    },
+    {
+        "name": "dev_task",
+        "description": (
+            "Submit a Sentinel self-improvement task to Patch, the autonomous dev agent. "
+            "Patch will explore the Sentinel source code, implement the change, "
+            "run syntax checks, and commit. Changes are live immediately. "
+            "Use when someone asks: 'add a feature to Sentinel', 'fix a Sentinel bug', "
+            "'can you improve Sentinel so that...', 'update Sentinel to support...', "
+            "'hey Sentinel, you should be able to...'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "task_type": {
+                    "type": "string",
+                    "enum": ["feature", "fix", "refactor", "chore", "ask"],
+                    "description": "Type of task. Default: feature.",
+                },
+                "description": {
+                    "type": "string",
+                    "description": "Full description of what Patch should implement or fix.",
+                },
+                "notify_user_ids": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": (
+                        "Slack user IDs to ping when the task completes, in addition to the submitter. "
+                        "Extract from <@USER_ID> mentions in the message. "
+                        "e.g. if user says 'notify me and @totto', include both user IDs here."
+                    ),
+                },
+            },
+            "required": ["description"],
+        },
+    },
+    {
+        "name": "repo_task",
+        "description": (
+            "ADMIN ONLY. Submit a feature, fix, or refactor task for a managed repo. "
+            "Claude Code will run against the repo's local clone, implement the change, "
+            "commit, and push (or open a PR if AUTO_PUBLISH=false). "
+            "ALWAYS gather a complete spec first — ask follow-up questions until unambiguous. "
+            "Use for: 'add X to elprint-connector-service', 'fix Y in cairn', "
+            "'refactor OrderService', any human-requested change to a managed repo."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo_name": {
+                    "type": "string",
+                    "description": "Name of the target repo (must match or fuzzy-match a repo in config/repos/).",
+                },
+                "task_type": {
+                    "type": "string",
+                    "enum": ["feature", "fix", "refactor", "chore"],
+                    "description": "Type of task. Default: feature.",
+                },
+                "description": {
+                    "type": "string",
+                    "description": "Full, unambiguous description of what to implement or fix. "
+                                   "Include all details gathered from the human.",
+                },
+                "notify_user_ids": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Extra Slack user IDs to ping on completion (besides the submitter).",
+                },
+            },
+            "required": ["repo_name", "description"],
+        },
+    },
+    {
+        "name": "list_pending_prs",
+        "description": "List all open Sentinel PRs awaiting admin review.",
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "check_auth_status",
+        "description": (
+            "Check Claude authentication health, current rate-limit / usage-limit circuit state, "
+            "and fix engine stats for the last 24 h. "
+            "Use when someone asks: 'is Claude working?', 'any rate limits?', 'why aren't fixes running?', "
+            "'is the API key OK?', 'auth issues?', 'fix engine status'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "pause_sentinel",
+        "description": (
+            "Pause ALL Sentinel fix activity immediately. "
+            "Use when the engineer says 'pause', 'stop', 'freeze', or 'hold off'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "resume_sentinel",
+        "description": "Resume Sentinel fix activity after a pause.",
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "list_projects",
+        "description": (
+            "List all projects (Sentinel instances) in this workspace and the repos "
+            "each one manages. Use for: 'what projects do you manage?', 'list projects', "
+            "'what repos are configured?', 'show me all projects'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "search_logs",
+        "description": (
+            "Search production logs for a keyword or pattern. "
+            "When a project or source is specified (or can be inferred), performs a LIVE fetch "
+            "via fetch_log.sh with the query as the grep filter — SSHes directly to the server. "
+            "Falls back to searching locally-cached log files when no source can be determined. "
+            "Use for: 'search logs for illegal PIN in 1881', 'find X in SSOLWA logs', "
+            "'what did user Y do?', 'show entries for appid=Z', 'grep logs for X'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "query": {
+                    "type": "string",
+                    "description": "Keyword or regex to grep for",
+                },
+                "source": {
+                    "type": "string",
+                    "description": "Log source name to search (partial match against log-config filenames, e.g. 'SSOLWA', '1881'). Leave empty to search all sources.",
+                },
+                "max_matches": {
+                    "type": "integer",
+                    "description": "Max matching lines to return per source (default 30)",
+                    "default": 30,
+                },
+                "tail": {
+                    "type": "integer",
+                    "description": (
+                        "Number of log lines to fetch from the server before grepping (default: config value, typically 500). "
+                        "Increase when the user asks for a longer time window — e.g. 'yesterday up to now' → use 5000-10000. "
+                        "Higher values take longer but cover more history."
+                    ),
+                },
+            },
+            "required": ["query"],
+        },
+    },
+    {
+        "name": "filter_logs",
+        "description": (
+            "Search locally-synced log files by keyword or regex — instant, no SSH required. "
+            "Use this for fast queries once logs are synced (check with list_projects if unsure). "
+            "Supports time-range filtering and case options. "
+            "Use for: 'find TryDig in synced logs', 'show errors from last 24h', "
+            "'filter logs for appid=X', 'search local logs for Y'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "query": {
+                    "type": "string",
+                    "description": "Keyword or regex to search for",
+                },
+                "source": {
+                    "type": "string",
+                    "description": "Log source name (partial match, e.g. 'STS', 'SSOLWA'). Leave empty to search all synced sources.",
+                },
+                "since_hours": {
+                    "type": "integer",
+                    "description": "Only return lines from the last N hours (uses log line timestamps). Omit for all available history.",
+                },
+                "max_matches": {
+                    "type": "integer",
+                    "description": "Max matching lines to return per source file (default 50)",
+                    "default": 50,
+                },
+                "case_sensitive": {
+                    "type": "boolean",
+                    "description": "Case-sensitive match (default false)",
+                    "default": False,
+                },
+            },
+            "required": ["query"],
+        },
+    },
+    {
+        "name": "trigger_poll",
+        "description": (
+            "Trigger an immediate log-fetch and error-detection cycle without waiting "
+            "for the next scheduled interval. Use when: 'check now', 'run now', "
+            "'poll immediately', 'don't wait'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "get_repo_status",
+        "description": (
+            "Per-repository breakdown of errors detected and fixes applied. "
+            "Use for: 'how is repo X doing?', 'which repo has the most issues?', "
+            "'break down by repo'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "hours": {
+                    "type": "integer",
+                    "description": "Look-back window in hours (default 24)",
+                    "default": 24,
+                },
+            },
+        },
+    },
+    {
+        "name": "list_recent_commits",
+        "description": (
+            "List recent commits made by Sentinel across all managed repos. "
+            "Use for: 'what did Sentinel commit?', 'show recent auto-fixes', 'what was changed?'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "limit": {
+                    "type": "integer",
+                    "description": "Max commits per repo (default 5)",
+                    "default": 5,
+                },
+            },
+        },
+    },
+    {
+        "name": "pull_repo",
+        "description": (
+            "Run git pull on one or all managed repos to fetch latest changes from GitHub. "
+            "Use for: 'pull changes', 'git pull', 'update repo X', 'fetch latest code'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo": {
+                    "type": "string",
+                    "description": "Repo name to pull (omit to pull all configured repos)",
+                },
+            },
+        },
+    },
+    {
+        "name": "pull_config",
+        "description": (
+            "Run git pull on one or all Sentinel project config directories. "
+            "Projects are matched by short name ('1881', 'elprint') or full dir name ('sentinel-1881'). "
+            "Use for: 'pull config for 1881', 'update sentinel config', 'pull all configs'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "project": {
+                    "type": "string",
+                    "description": "Project short name or dir name to pull (omit for all projects)",
+                },
+            },
+        },
+    },
+    {
+        "name": "fetch_logs",
+        "description": (
+            "Run fetch_log.sh for one or all configured log sources to pull the latest logs "
+            "from remote servers right now. Use for: 'fetch logs', 'run fetch_log.sh', "
+            "'grab latest logs from SSOLWA', 'try fetch_log.sh for STS', "
+            "'pull logs from server', 'get fresh logs'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "description": "Log source name to fetch (partial match, e.g. 'SSOLWA'). Omit to fetch all.",
+                },
+                "debug": {
+                    "type": "boolean",
+                    "description": "Run fetch_log.sh with --debug flag to show SSH/grep details",
+                    "default": False,
+                },
+                "tail": {
+                    "type": "integer",
+                    "description": "Override TAIL lines (how many log lines to fetch)",
+                },
+                "grep_filter": {
+                    "type": "string",
+                    "description": "Override GREP_FILTER (regex). Pass 'none' to disable filtering.",
+                },
+            },
+        },
+    },
+    {
+        "name": "watch_bot",
+        "description": (
+            "Tell Sentinel to passively monitor a Slack bot — queuing its messages as issues. "
+            "Extract all <@UXXXXXX> user IDs from the message and pass them here. "
+            "Sentinel verifies each is actually a bot (not a human) before adding to the watch list. "
+            "IMPORTANT: a bot watcher is only useful if its issues can be delivered to a project. "
+            "Try to infer the project from context (bot name, prior messages, available projects). "
+            "If it cannot be determined, do NOT call this tool — instead ask the user which project "
+            "the bot's alerts belong to, then call this tool with the project filled in. "
+            "Use for: 'listen to @alertbot', 'watch @bot1 @bot2', 'monitor @errorbot'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "user_ids": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Slack user IDs to watch — extract from <@UXXXXXX> patterns in the message",
+                },
+                "project": {
+                    "type": "string",
+                    "description": "Project short name this bot's issues should be routed to (e.g. '1881', 'elprint'). Infer from context or ask user before calling.",
+                },
+            },
+            "required": ["user_ids"],
+        },
+    },
+    {
+        "name": "unwatch_bot",
+        "description": (
+            "Stop Sentinel from monitoring a Slack bot. "
+            "Use for: 'stop watching @alertbot', 'unwatch @bot', 'remove @errorbot from watchers'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "user_ids": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Slack user IDs to remove from the watch list",
+                },
+            },
+            "required": ["user_ids"],
+        },
+    },
+    {
+        "name": "list_watched_bots",
+        "description": (
+            "List all Slack bots Sentinel is currently monitoring passively. "
+            "Use for: 'who are you watching?', 'which bots are you monitoring?', 'list watched bots'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "upgrade_sentinel",
+        "description": (
+            "Upgrade the Sentinel agent itself: git pull the latest code, update Python deps, "
+            "then restart the process. Safe to call at any time — if already up to date, "
+            "no restart is triggered. "
+            "Use for: 'upgrade sentinel', 'update sentinel', 'upgrade yourself', "
+            "'pull latest sentinel code', 'restart sentinel after upgrade'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "ask_codebase",
+        "description": (
+            "Ask any natural-language question about a managed codebase — or discuss architecture, "
+            "extensions, and new features. Claude Code explores the repo(s) with full file access. "
+            "Accepts a repo name (e.g. 'STS', 'TypeLib') OR project name (e.g. '1881', 'Whydah') — "
+            "project name queries all its repos. "
+            "Use for: 'what does 1881 do?', 'describe the project structure', "
+            "'what should we implement next in STS?', 'find security issues in elprint-sales', "
+            "'what features could we add to TypeLib?', 'summarise the cairn architecture'. "
+            "Use mode=issues to make Claude output structured GitHub issue suggestions "
+            "(e.g. 'raise issues for improvements in STS', 'what bugs should we track in 1881?')."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo": {
+                    "type": "string",
+                    "description": "Repo name (e.g. 'STS', 'TypeLib') OR project name (e.g. '1881', 'Whydah')",
+                },
+                "question": {
+                    "type": "string",
+                    "description": "Natural language question, task, or discussion prompt about the codebase",
+                },
+                "mode": {
+                    "type": "string",
+                    "enum": ["explore", "issues"],
+                    "description": (
+                        "explore (default): answer freely, describe structure, discuss architecture. "
+                        "issues: Claude outputs structured GitHub issue suggestions "
+                        "(title + description + labels) that can be raised on GitHub."
+                    ),
+                },
+            },
+            "required": ["repo", "question"],
+        },
+    },
+    {
+        "name": "restart_project",
+        "description": (
+            "Stop and restart a specific Sentinel monitoring instance (runs stop.sh then start.sh). "
+            "This restarts the Sentinel agent process for that project — it does NOT restart the application itself. "
+            "Use when: 'restart sentinel for 1881', 'reload the 1881 monitor', 'restart elprint sentinel'. "
+            "Safer than restarting all projects at once."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "project": {
+                    "type": "string",
+                    "description": "Project short name or dir name (e.g. '1881', 'elprint')",
+                },
+            },
+            "required": ["project"],
+        },
+    },
+    {
+        "name": "my_stats",
+        "description": (
+            "Show the current user's personal Sentinel dashboard: "
+            "conversation history length, issues they submitted, and "
+            "a summary of Sentinel fix activity (errors caught, fixes applied, "
+            "fixes pending PR review, fixes confirmed live, fixes failed). "
+            "Use for: 'what have you done for me?', 'show my stats', "
+            "'how many issues have been fixed?', 'my history', 'summary', "
+            "'what did sentinel fix this week?', 'pending fixes', 'open PRs'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "hours": {
+                    "type": "integer",
+                    "description": "Look-back window in hours (default 168 = 7 days)",
+                    "default": 168,
+                },
+            },
+        },
+    },
+    {
+        "name": "clear_my_history",
+        "description": (
+            "Clear the current user's conversation history with Sentinel. "
+            "After clearing, future sessions start with no memory of past conversations. "
+            "Use for: 'clear my history', 'forget our conversation', "
+            "'start fresh', 'reset my context', 'wipe my history'."
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "tail_log",
+        "description": (
+            "Fetch the last N lines of a log source's live production logs without any grep filter. "
+            "Use when: 'show me recent SSOLWA logs', 'tail STS', 'what's happening in 1881 logs right now', "
+            "'show last 100 lines from SSOLWA'. Different from search_logs — no pattern required."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "description": "Log source name (partial match against log-config filenames, e.g. 'SSOLWA', 'STS')",
+                },
+                "lines": {
+                    "type": "integer",
+                    "description": "Number of recent lines to fetch (default 100)",
+                    "default": 100,
+                },
+            },
+            "required": ["source"],
+        },
+    },
+    {
+        "name": "ask_logs",
+        "description": (
+            "Ask Claude Code to search and summarize log files for a source. "
+            "Claude Code reads the full log history (rsync'd synced logs + rolling window) "
+            "and answers the question using its file tools — not just a regex match. "
+            "Use for analysis questions that require reading and reasoning over log content. "
+            "e.g. 'what errors happened yesterday in SSOLWA?', "
+            "'summarize last week of STS logs', "
+            "'what's been causing 400s in 1881 logs?', "
+            "'any unusual patterns in elprint logs recently?'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "description": "Log source name (partial match, e.g. 'SSOLWA', 'STS'). Leave blank to query all sources.",
+                },
+                "question": {
+                    "type": "string",
+                    "description": "Natural language question about the logs",
+                },
+            },
+            "required": ["question"],
+        },
+    },
+    {
+        "name": "post_file",
+        "description": (
+            "Upload a text file directly to the Slack conversation so the user can read or download it. "
+            "Use when: output is too large for a chat message, the user asks to 'download', 'export', or "
+            "'send as a file', or when formatted content (diffs, logs, CSVs, reports) is clearer as a file. "
+            "e.g. 'give me that as a file', 'export the log', 'send me the diff for PR
+            "'download the health report', 'export recent errors as CSV'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "content": {
+                    "type": "string",
+                    "description": "The full text content of the file to upload",
+                },
+                "filename": {
+                    "type": "string",
+                    "description": "Filename with extension, e.g. 'fix-ab12.diff', 'sentinel-report.txt', 'errors.csv', 'ssolwa.log'",
+                },
+                "title": {
+                    "type": "string",
+                    "description": "Optional display title shown above the file in Slack (defaults to filename)",
+                },
+            },
+            "required": ["content", "filename"],
+        },
+    },
+    {
+        "name": "list_all_users",
+        "description": (
+            "ADMIN ONLY. List all Slack users who have ever talked to Sentinel, "
+            "with their issue count and conversation message count. "
+            "e.g. 'list all users', 'who has talked to you?', 'show user activity'"
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "clear_user_history",
+        "description": (
+            "ADMIN ONLY. Clear the conversation history for a specific Slack user. "
+            "e.g. 'clear history for huy', 'reset bob's conversation'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "user_id": {
+                    "type": "string",
+                    "description": "Slack user ID to clear (e.g. U01AB2CD3EF)",
+                },
+            },
+            "required": ["user_id"],
+        },
+    },
+    {
+        "name": "reset_fingerprint",
+        "description": (
+            "ADMIN ONLY. Remove the 24h fix lock for an error fingerprint so Sentinel will retry it "
+            "on the next poll cycle. Use when a fix attempt failed and you want to force a retry. "
+            "e.g. 'retry fix abc123', 'reset fingerprint abc123de', 'let Sentinel try that error again'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "fingerprint": {
+                    "type": "string",
+                    "description": "Error fingerprint hash (8+ hex chars, from get_fix_details or list_all_errors)",
+                },
+            },
+            "required": ["fingerprint"],
+        },
+    },
+    {
+        "name": "list_all_errors",
+        "description": (
+            "ADMIN ONLY. Return the full unfiltered error database — all fingerprints, counts, "
+            "sources, and last-seen times. "
+            "e.g. 'show all errors', 'full error list', 'dump the error DB'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "hours": {
+                    "type": "integer",
+                    "description": "Limit to errors seen in the last N hours (0 = all time)",
+                    "default": 0,
+                },
+            },
+        },
+    },
+    {
+        "name": "export_db",
+        "description": (
+            "ADMIN ONLY. Export the full Sentinel state (errors, fixes, PRs, users) as a "
+            "downloadable text file posted to Slack. "
+            "e.g. 'export the DB', 'download state', 'give me a full report file'"
+        ),
+        "input_schema": {"type": "object", "properties": {}},
+    },
+    {
+        "name": "refresh_knowledge",
+        "description": (
+            "Clear the knowledge cache so the next ask_codebase question fetches a fresh answer "
+            "instead of using the cached one. Use when the codebase has changed and you want "
+            "up-to-date answers. "
+            "e.g. 'refresh knowledge for TypeLib', 'clear codebase cache', "
+            "'force fresh answer for Java-SDK', 'list what is cached'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo": {
+                    "type": "string",
+                    "description": "Repo or project name to clear cache for. Omit to clear all cached knowledge.",
+                },
+                "list_only": {
+                    "type": "boolean",
+                    "description": "If true, just list what is cached without deleting anything.",
+                },
+            },
+        },
+    },
+    {
+        "name": "list_prs",
+        "description": (
+            "ADMIN ONLY. List all tracked pull requests across managed repos. "
+            "Shows open PRs waiting for decision, plus recent merges and drops. "
+            "Use for: 'show open PRs', 'what PRs are waiting?', 'list renovate PRs', "
+            "'what did I merge last week?', 'show all PRs for TypeLib'."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo": {
+                    "type": "string",
+                    "description": "Filter by repo name (partial match). Omit for all repos.",
+                },
+                "status": {
+                    "type": "string",
+                    "enum": ["open", "merged", "closed", "pending"],
+                    "description": (
+                        "open = all open PRs, pending = open with no admin decision yet, "
+                        "merged = merged PRs, closed = dropped/closed without merge. "
+                        "Omit for all."
+                    ),
+                },
+            },
+        },
+    },
+    {
+        "name": "drop_pr",
+        "description": (
+            "ADMIN ONLY. Mark a PR as dropped/rejected — do NOT merge it. "
+            "Records who dropped it and when. "
+            "Use for: 'drop PR
+            "'close without merging PR
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo_name": {
+                    "type": "string",
+                    "description": "Repository name (must match a repo in config/repos/)",
+                },
+                "pr_number": {
+                    "type": "integer",
+                    "description": "PR number to drop",
+                },
+            },
+            "required": ["repo_name", "pr_number"],
+        },
+    },
+    {
+        "name": "merge_pr",
+        "description": (
+            "ADMIN ONLY. Merge a branch or PR into the main branch. "
+            "ALWAYS call with confirmed=false first to show details for admin review — "
+            "never merge without showing the plan first. "
+            "Use for Sentinel fix PRs (AUTO_PUBLISH=false), Renovate/external PRs by number, "
+            "or any arbitrary branch by name (branch_name). "
+            "confirmed=false fetches and shows details; confirmed=true executes the merge. "
+            "e.g. 'merge the fix for Whydah-TypeLib', 'merge TypeLib PR
+            "'merge branch fix/pin-header-geometry-sync into elprint-connector-service'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo_name": {
+                    "type": "string",
+                    "description": "Repository name (must match a repo in config/repos/)",
+                },
+                "fingerprint": {
+                    "type": "string",
+                    "description": "Optional 8-char fingerprint to target a specific Sentinel fix PR.",
+                },
+                "pr_number": {
+                    "type": "integer",
+                    "description": "Merge a specific PR by number (e.g. a Renovate PR). "
+                                   "When set, repo_name is still required but fingerprint is ignored.",
+                },
+                "branch_name": {
+                    "type": "string",
+                    "description": "Merge an arbitrary branch into the repo's main branch via "
+                                   "GitHub Merge API. Use when the user gives a branch URL or name "
+                                   "without an associated PR. e.g. 'fix/pin-header-geometry-sync'",
+                },
+                "confirmed": {
+                    "type": "boolean",
+                    "description": (
+                        "false (default) = fetch details and show plan for review, do NOT merge yet. "
+                        "true = execute the merge after admin has seen and approved the plan."
+                    ),
+                },
+            },
+            "required": ["repo_name"],
+        },
+    },
+    {
+        "name": "install_tool",
+        "description": (
+            "ADMIN ONLY. Install a missing build tool (e.g. maven, gradle, node) on this server "
+            "using Claude Code with shell execution rights. "
+            "Use after Sentinel reports a missing tool error. "
+            "e.g. 'install maven', 'install gradle', '@Sentinel install mvn'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "tool_name": {
+                    "type": "string",
+                    "description": "The tool to install, e.g. 'maven', 'gradle', 'node'",
+                },
+            },
+            "required": ["tool_name"],
+        },
+    },
+    {
+        "name": "list_renovate_prs",
+        "description": (
+            "List all open Renovate bot pull requests across all managed repos. "
+            "Shows package name, version change, Renovate confidence, CI status, age, and merge-readiness. "
+            "Use before deciding which Renovate PRs to merge. "
+            "e.g. 'show renovate PRs', 'what dependency upgrades are pending?', "
+            "'list open renovate pull requests', 'any renovate PRs ready to merge?'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo_name": {
+                    "type": "string",
+                    "description": "Filter to a specific repo. Omit to scan all managed repos.",
+                },
+                "ready_only": {
+                    "type": "boolean",
+                    "description": "If true, only show PRs where CI passes and there are no conflicts.",
+                    "default": False,
+                },
+            },
+        },
+    },
+    {
+        "name": "manage_release",
+        "description": (
+            "Plan and execute repository operations: build, Maven release, dependency updates, "
+            "or a full release-and-cascade (release one repo then bump its version in all dependents). "
+            "Always presents a confirmation plan before acting. "
+            "Examples: 'build Whydah-TypeLib', 'release Whydah-TypeLib', "
+            "'update Whydah-Java-SDK to use the latest Whydah-TypeLib', "
+            "'trigger a release for Whydah-TypeLib and update all dependents', "
+            "'update all repos to use the latest whydah-typelib release'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "operation": {
+                    "type": "string",
+                    "enum": ["build", "release", "update_deps", "release_and_cascade"],
+                    "description": (
+                        "build: trigger Jenkins build only. "
+                        "release: trigger Maven Release; auto-cascades if AUTO_PUBLISH=true. "
+                        "update_deps: update dependency version in target repos (source already released). "
+                        "release_and_cascade: release source_repo then cascade to all dependents."
+                    ),
+                },
+                "source_repo": {
+                    "type": "string",
+                    "description": "Repo to build/release, or the repo whose artifact is being updated.",
+                },
+                "target_repos": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Repos to update. Empty = auto-detect all dependents.",
+                },
+                "confirmed": {
+                    "type": "boolean",
+                    "description": "false = show plan and ask for confirmation. true = execute.",
+                    "default": False,
+                },
+            },
+            "required": ["operation", "source_repo"],
+        },
+    },
+    {
+        "name": "set_maintenance",
+        "description": (
+            "Confirm that a repo/app is deliberately stopped for maintenance. "
+            "Sentinel will silently monitor the health URL and notify when it comes back online. "
+            "Use when Sentinel asked if a 502/503 is deliberate. "
+            "e.g. 'yes it's maintenance', 'maintenance ssolwa', 'confirm ssolwa is down for maintenance'"
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "repo_name": {
+                    "type": "string",
+                    "description": "Repo name as configured (from repo-configs/*.properties)",
+                },
+                "note": {
+                    "type": "string",
+                    "description": "Optional reason e.g. 'scheduled maintenance', 'dependency update'",
+                },
+            },
+            "required": ["repo_name"],
+        },
+    },
+    {
+        "name": "chain_release",
+        "description": (
+            "Execute a sequential release chain: release repo A, update repo B's dependency on A and release B, "
+            "update repo C's dependency on B and release C, and so on. "
+            "Use when the admin describes a multi-step release pipeline like "
+            "'release TypeLib, then update Java-SDK with new TypeLib and release it, then update Admin-SDK...'. "
+            "Also handles shorter requests like 'release TypeLib and cascade' by inferring the full chain. "
+            "confirmed=false shows the full plan with version numbers; confirmed=true executes all steps in order."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "chain": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": (
+                        "Ordered list of repo names from first-to-release to last. "
+                        "E.g. ['Whydah-TypeLib', 'Whydah-Java-SDK', 'Whydah-Admin-SDK', '1881-SSOLoginWebApp']"
+                    ),
+                },
+                "confirmed": {
+                    "type": "boolean",
+                    "description": "false = show plan only (default); true = execute all steps in sequence",
+                },
+            },
+            "required": ["chain", "confirmed"],
+        },
+    },
+]
+def _workspace_dir() -> Path:
+    return Path(".").resolve()
+def _short_name(dir_name: str) -> str:
+    if dir_name.startswith("sentinel-"):
+        return dir_name[len("sentinel-"):]
+    return dir_name
+def _read_project_name(project_dir: Path) -> str:
+    props = project_dir / "config" / "sentinel.properties"
+    if props.exists():
+        try:
+            for line in props.read_text(encoding="utf-8", errors="ignore").splitlines():
+                line = line.strip()
+                if line.startswith("PROJECT_NAME"):
+                    _, _, val = line.partition("=")
+                    val = val.partition("
+                    if val:
+                        return val
+        except Exception:
+            pass
+    return _short_name(project_dir.name)
+def _find_project_dirs(target: str = "") -> list[Path]:
+    current = Path(".").resolve()
+    if not (current / "config").exists():
+        return []
+    if target:
+        t = target.lower()
+        name = _read_project_name(current)
+        if (t not in current.name.lower()
+                and t not in _short_name(current.name).lower()
+                and t not in name.lower()):
+            return []
+    return [current]
+def _git_pull(path: Path) -> dict:
+    try:
+        r = subprocess.run(
+            ["git", "pull", "--rebase", "origin"],
+            cwd=str(path), capture_output=True, text=True, timeout=60,
+        )
+        last = r.stdout.strip().splitlines()[-1] if r.stdout.strip() else "already up to date"
+        return {"status": "ok" if r.returncode == 0 else "error",
+                "detail": last if r.returncode == 0 else r.stderr.strip()}
+    except Exception as e:
+        return {"status": "error", "detail": str(e)}
+def _filter_log_sources(props_files: list, source_hint: str) -> list:
+    if not source_hint:
+        return props_files
+    hint = source_hint.lower()
+    def _props_contains(path: Path, key: str, hint: str) -> bool:
+        try:
+            for line in path.read_text(encoding="utf-8", errors="replace").splitlines():
+                stripped = line.strip()
+                if stripped.startswith("
+                    continue
+                if stripped.upper().startswith(key + "="):
+                    val = stripped.split("=", 1)[1].partition("
+                    if hint in val:
+                        return True
+        except OSError:
+            pass
+        return False
+    matched = []
+    for p in props_files:
+        if hint in p.stem.lower():
+            matched.append(p)
+        elif _props_contains(p, "REMOTE_SERVICE_USER", hint):
+            matched.append(p)
+        elif _props_contains(p, "HOSTS", hint):
+            matched.append(p)
+    return matched
+async def _run_tool(name: str, inputs: dict, cfg_loader, store, slack_client=None, user_id: str = "", channel: str = "", is_admin: bool = False) -> str:
+    if name == "get_status":
+        hours = int(inputs.get("hours", 24))
+        errors = store.get_recent_errors(hours)
+        fixes  = store.get_recent_fixes(hours)
+        prs    = store.get_open_prs()
+        top_errors = [
+            {
+                "message": e["message"][:120],
+                "count":   e["count"],
+                "source":  e["source"],
+                "last_seen": e["last_seen"],
+            }
+            for e in errors[:8]
+        ]
+        return json.dumps({
+            "window_hours":    hours,
+            "errors_detected": len(errors),
+            "top_errors":      top_errors,
+            "fixes_applied":   sum(1 for f in fixes if f["status"] == "applied"),
+            "fixes_pending":   sum(1 for f in fixes if f["status"] == "pending"),
+            "fixes_failed":    sum(1 for f in fixes if f["status"] == "failed"),
+            "open_prs":        [
+                {
+                    "repo":   p["repo_name"],
+                    "branch": p["branch"],
+                    "pr_url": p["pr_url"],
+                    "age":    p.get("timestamp", ""),
+                }
+                for p in prs
+            ],
+            "sentinel_paused": Path("SENTINEL_PAUSE").exists(),
+        })
+    if name == "check_auth_status":
+        import subprocess as _sp
+        from .notify import get_circuit_status
+        cfg = cfg_loader.sentinel
+        has_key      = bool(cfg.anthropic_api_key)
+        pro_for_tasks = cfg.claude_pro_for_tasks
+        if pro_for_tasks and has_key:
+            primary, fallback = "claude_pro_oauth", "api_key"
+        elif pro_for_tasks:
+            primary, fallback = "claude_pro_oauth", None
+        else:
+            primary, fallback = "api_key", "claude_pro_oauth" if not has_key else "claude_pro_oauth"
+        cli_ok, cli_version = False, ""
+        try:
+            r = _sp.run(
+                [cfg.claude_code_bin, "--version"],
+                capture_output=True, text=True, timeout=10,
+            )
+            if r.returncode == 0:
+                cli_ok     = True
+                cli_version = r.stdout.strip() or r.stderr.strip()
+        except Exception:
+            pass
+        circuits = get_circuit_status()
+        recent = store.get_recent_fixes(hours=24)
+        counts = {"applied": 0, "failed": 0, "skipped": 0, "pending": 0}
+        last_success = None
+        for f in recent:
+            s = f.get("status", "")
+            if s in counts:
+                counts[s] += 1
+            if s == "applied" and not last_success:
+                last_success = f.get("timestamp", "")
+        overall = "healthy"
+        if circuits:
+            overall = "degraded — rate/auth limit active on: " + ", ".join(circuits)
+        elif not cli_ok:
+            overall = "warning — claude CLI not reachable"
+        return json.dumps({
+            "overall": overall,
+            "auth": {
+                "api_key_configured": has_key,
+                "claude_pro_for_tasks": pro_for_tasks,
+                "primary_method": primary,
+                "fallback_method": fallback,
+            },
+            "claude_cli": {"available": cli_ok, "version": cli_version},
+            "rate_limit_circuits": circuits,
+            "fix_engine_24h": {**counts, "last_successful_fix": last_success},
+        })
+    if name == "create_issue":
+        description = inputs["description"]
+        target_repo = inputs.get("target_repo", "")
+        project_arg = inputs.get("project", "")
+        if project_arg:
+            project_dirs = _find_project_dirs(project_arg)
+            if not project_dirs:
+                all_names = [_read_project_name(d) for d in _find_project_dirs()]
+                return json.dumps({
+                    "error": f"No project found matching '{project_arg}'",
+                    "available_projects": all_names,
+                    "action_needed": "Ask the user which project they meant.",
+                })
+            if len(project_dirs) > 1:
+                matches = [_read_project_name(d) for d in project_dirs]
+                return json.dumps({
+                    "error": f"Ambiguous project name '{project_arg}' — matches: {matches}",
+                    "action_needed": "Ask the user to clarify which project they mean.",
+                })
+            project_dir = project_dirs[0]
+        else:
+            project_dir = Path(".")
+        support_url          = inputs.get("support_url", "").strip()
+        attachments_summary  = inputs.get("attachments_summary", "").strip()
+        findings             = inputs.get("findings", "").strip()
+        issues_dir = project_dir / "issues"
+        issues_dir.mkdir(exist_ok=True)
+        fname = f"slack-{uuid.uuid4().hex[:8]}.txt"
+        submitter_name = store.get_user_name(user_id) if user_id else ""
+        submitter_line = f"SUBMITTED_BY: {submitter_name} ({user_id})" if user_id else ""
+        lines = []
+        if target_repo:
+            lines.append(f"TARGET_REPO: {target_repo}")
+        if submitter_line:
+            lines.append(submitter_line)
+        if support_url:
+            lines.append(f"SUPPORT_URL: {support_url}")
+        lines.append(f"SUBMITTED_AT: {datetime.now(timezone.utc).isoformat()}")
+        lines.append("")
+        lines.append(description)
+        if findings:
+            lines.append(f"\nEVIDENCE (gathered by Sentinel Boss):\n{findings}")
+        if attachments_summary:
+            lines.append(f"\nATTACHMENTS:\n{attachments_summary}")
+        content = "\n".join(lines)
+        (issues_dir / fname).write_text(content, encoding="utf-8")
+        (project_dir / "SENTINEL_POLL_NOW").touch()
+        project_label = _read_project_name(project_dir.resolve()) if project_arg else "this project"
+        logger.info("Boss created issue for %s: %s", project_label, fname)
+        if user_id:
+            try:
+                store.record_submitted_issue(
+                    user_id=user_id,
+                    user_name=submitter_name,
+                    project=project_label,
+                    fname=fname,
+                    description=description,
+                )
+            except Exception as _rec_err:
+                logger.debug("Boss: could not record submitted issue: %s", _rec_err)
+        return json.dumps({
+            "status":  "queued",
+            "project": project_label,
+            "file":    fname,
+            "note":    f"Delivered to '{project_label}'. Sentinel will process it on the next poll cycle.",
+        })
+    if name == "retry_issue":
+        project_arg = inputs.get("project", "").strip()
+        keyword     = inputs.get("keyword", "").strip().lower()
+        project_dirs = _find_project_dirs(project_arg) if project_arg else _find_project_dirs()
+        if not project_dirs:
+            return json.dumps({"error": f"No project found matching '{project_arg}'"})
+        if len(project_dirs) > 1 and project_arg:
+            return json.dumps({"error": f"Ambiguous project '{project_arg}' — matches: {[_read_project_name(d) for d in project_dirs]}"})
+        project_dir    = project_dirs[0]
+        issues_base    = project_dir / "issues"
+        archive_dirs   = [issues_base / d for d in (".done", ".cancelled") if (issues_base / d).exists()]
+        if not archive_dirs:
+            return json.dumps({"error": "No archived issues found — issues/.done/ does not exist"})
+        candidates = sorted(
+            [f for d in archive_dirs for f in d.iterdir() if f.is_file() and not f.name.startswith(".")],
+            key=lambda f: f.stat().st_mtime,
+            reverse=True,
+        )
+        if not candidates:
+            return json.dumps({"error": "No archived issues found in issues/.done/ or issues/.cancelled/"})
+        if keyword:
+            repo_matched = []
+            content_matched = []
+            for f in candidates:
+                try:
+                    content = f.read_text(encoding="utf-8", errors="replace")
+                    content_lower = content.lower()
+                    for line in content.splitlines():
+                        if line.strip().upper().startswith("TARGET_REPO"):
+                            repo_val = line.split(":", 1)[-1].split("=", 1)[-1].strip().lower()
+                            if keyword.lower() in repo_val:
+                                repo_matched.append(f)
+                                break
+                    else:
+                        if keyword.lower() in content_lower:
+                            content_matched.append(f)
+                except OSError:
+                    pass
+            matched = repo_matched if repo_matched else content_matched
+            if not matched:
+                return json.dumps({"error": f"No archived issues match keyword '{keyword}'"})
+            candidates = matched
+        source_file = candidates[0]
+        content     = source_file.read_text(encoding="utf-8", errors="replace")
+        import hashlib as _hashlib
+        _target_repo = ""
+        _message     = ""
+        _body_lines  = []
+        _in_body     = False
+        _META_UPPER  = ("TARGET_REPO:", "SUBMITTED_BY:", "SUBMITTED_AT:", "SUPPORT_URL:")
+        for _line in content.splitlines():
+            _s = _line.strip()
+            if not _in_body:
+                if _s.upper().startswith("TARGET_REPO"):
+                    _target_repo = _s.split(":", 1)[-1].split("=", 1)[-1].strip()
+                elif any(_s.upper().startswith(_p) for _p in _META_UPPER) or not _s:
+                    pass
+                else:
+                    _in_body = True
+                    _body_lines.append(_line)
+            else:
+                _body_lines.append(_line)
+        _message = next((l.strip() for l in _body_lines if l.strip()), source_file.name)
+        _fp_raw  = f"issue:{_target_repo}:{_message[:200]}"
+        _fp      = _hashlib.sha1(_fp_raw.encode()).hexdigest()[:16]
+        if store:
+            try:
+                with store._conn() as _c:
+                    _row = _c.execute(
+                        "SELECT status, pr_url, commit_hash FROM fixes "
+                        "WHERE fingerprint=? ORDER BY timestamp DESC LIMIT 1",
+                        (_fp,),
+                    ).fetchone()
+                if _row:
+                    _status = _row["status"]
+                    if _status in ("merged", "applied"):
+                        _commit = _row["commit_hash"] or ""
+                        return json.dumps({
+                            "error": (
+                                f"Already fixed — this issue was resolved "
+                                + (f"in commit `{_commit[:8]}`" if _commit else "successfully")
+                                + f". Status: `{_status}`. "
+                                f"If the problem recurred, describe it as a new issue."
+                            )
+                        })
+                    if _status == "pending":
+                        _pr = _row["pr_url"] or ""
+                        return json.dumps({
+                            "error": (
+                                f"There is already an open PR for this issue"
+                                + (f": {_pr}" if _pr else "")
+                                + ". Merge or close it before retrying."
+                            )
+                        })
+            except Exception as _e:
+                logger.debug("retry_issue: state_store guard failed (non-fatal): %s", _e)
+        issues_dir = project_dir / "issues"
+        issues_dir.mkdir(exist_ok=True)
+        fname = f"retry-{source_file.stem[-8:]}-{uuid.uuid4().hex[:6]}.txt"
+        (issues_dir / fname).write_text(content, encoding="utf-8")
+        (project_dir / "SENTINEL_POLL_NOW").touch()
+        project_label = _read_project_name(project_dir.resolve())
+        logger.info("Boss retry_issue: re-queued '%s' as '%s' for %s", source_file.name, fname, project_label)
+        return json.dumps({
+            "status":       "re-queued",
+            "project":      project_label,
+            "original_file": source_file.name,
+            "new_file":     fname,
+            "note":         f"Re-submitted '{source_file.name}' to '{project_label}'. Poll triggered.",
+        })
+    if name == "cancel_issue":
+        import re as _re
+        project_arg = inputs.get("project", "").strip()
+        keyword     = inputs.get("keyword", "").strip()
+        project_dirs = _find_project_dirs(project_arg) if project_arg else _find_project_dirs()
+        if not project_dirs:
+            return json.dumps({"error": f"No project found matching '{project_arg}'"})
+        if len(project_dirs) > 1 and project_arg:
+            return json.dumps({"error": f"Ambiguous project '{project_arg}' — matches: {[_read_project_name(d) for d in project_dirs]}"})
+        project_dir = project_dirs[0]
+        issues_dir  = project_dir / "issues"
+        if not issues_dir.exists():
+            return json.dumps({"error": "No issues/ directory found for this project"})
+        from .issue_watcher import cancel_issue as _cancel_issue
+        result = _cancel_issue(issues_dir, keyword)
+        if "error" in result:
+            return json.dumps(result)
+        cancelled_file = (issues_dir / ".cancelled" / result["cancelled"])
+        submitter_uid = ""
+        if cancelled_file.exists():
+            for line in cancelled_file.read_text(encoding="utf-8", errors="replace").splitlines():
+                if line.strip().upper().startswith("SUBMITTED_BY:"):
+                    m = _re.search(r"\((\w+)\)", line)
+                    if m:
+                        submitter_uid = m.group(1)
+                    break
+        if submitter_uid:
+            if user_id != submitter_uid and not is_admin:
+                import shutil as _shutil
+                _shutil.move(str(cancelled_file), str(issues_dir / result["cancelled"]))
+                return json.dumps({
+                    "error": (
+                        f"Permission denied — this issue was submitted by <@{submitter_uid}>. "
+                        f"Only they or an admin can cancel it."
+                    )
+                })
+        else:
+            if not is_admin:
+                import shutil as _shutil
+                _shutil.move(str(cancelled_file), str(issues_dir / result["cancelled"]))
+                return json.dumps({"error": "This issue was not submitted via Slack — only admins can cancel it."})
+        project_label = _read_project_name(project_dir.resolve())
+        logger.info("Boss cancel_issue: cancelled '%s' for %s by user %s", result["cancelled"], project_label, user_id)
+        return json.dumps({
+            "status":    "cancelled",
+            "project":   project_label,
+            "file":      result["cancelled"],
+            "note":      "Moved to issues/.cancelled/ — Sentinel will not process it.",
+        })
+    if name == "dev_task":
+        if not is_admin:
+            return json.dumps({"error": "Only admins can submit dev tasks to Patch."})
+        description = inputs.get("description", "").strip()
+        if not description:
+            return json.dumps({"error": "description is required"})
+        task_type = inputs.get("task_type", "feature").strip()
+        if task_type not in ("feature", "fix", "refactor", "chore", "ask"):
+            task_type = "feature"
+        _project_dirs = _find_project_dirs()
+        if not _project_dirs:
+            return json.dumps({"error": "No project directory found — cannot drop dev task."})
+        _dev_project_dir = _project_dirs[0]
+        from .sentinel_dev import drop_escalation as _drop_task
+        from datetime import datetime as _dt, timezone as _tz
+        import uuid as _uuid
+        dev_tasks_dir = _dev_project_dir / "dev-tasks"
+        dev_tasks_dir.mkdir(exist_ok=True)
+        ts = int(__import__("time").time())
+        fname = f"slack-{_uuid.uuid4().hex[:8]}-{ts}.txt"
+        fpath = dev_tasks_dir / fname
+        notify_ids = inputs.get("notify_user_ids") or []
+        if isinstance(notify_ids, list):
+            notify_ids = [u for u in notify_ids if u and u != user_id]
+        lines = [
+            f"TYPE: {task_type}",
+            f"SUBMITTED_BY: <@{user_id}> ({user_id})",
+            f"SOURCE: boss",
+            f"SUBMITTED_AT: {_dt.now(_tz.utc).isoformat()}",
+        ]
+        if notify_ids:
+            lines.append(f"NOTIFY: {','.join(notify_ids)}")
+        lines += ["", description]
+        fpath.write_text("\n".join(lines), encoding="utf-8")
+        logger.info("Boss dev_task: dropped %s for user %s (type=%s)", fname, user_id, task_type)
+        project_label = _read_project_name(_dev_project_dir.resolve())
+        return json.dumps({
+            "status": "queued",
+            "project": project_label,
+            "file": fname,
+            "task_type": task_type,
+            "note": (
+                "Dev task queued — Patch will pick it up on the next poll cycle "
+                "and post progress to this channel."
+            ),
+        })
+    if name == "repo_task":
+        if not is_admin:
+            return json.dumps({"error": "Only admins can submit repo tasks."})
+        repo_name   = inputs.get("repo_name", "").strip()
+        description = inputs.get("description", "").strip()
+        if not repo_name:
+            return json.dumps({"error": "repo_name is required"})
+        if not description:
+            return json.dumps({"error": "description is required"})
+        task_type = inputs.get("task_type", "feature").strip()
+        if task_type not in ("feature", "fix", "refactor", "chore"):
+            task_type = "feature"
+        if repo_name not in cfg_loader.repos:
+            for rname in cfg_loader.repos:
+                if repo_name.lower() in rname.lower() or rname.lower() in repo_name.lower():
+                    repo_name = rname
+                    break
+        if repo_name not in cfg_loader.repos:
+            return json.dumps({
+                "error": f"No repo matching '{repo_name}' found.",
+                "available_repos": list(cfg_loader.repos.keys()),
+            })
+        notify_ids = inputs.get("notify_user_ids") or []
+        if isinstance(notify_ids, list):
+            notify_ids = [u for u in notify_ids if u and u != user_id]
+        _project_dirs = _find_project_dirs()
+        if not _project_dirs:
+            return json.dumps({"error": "No project directory found."})
+        from .repo_task_engine import drop_repo_task as _drop_repo_task
+        task_file = _drop_repo_task(
+            _project_dirs[0],
+            repo_name=repo_name,
+            task_type=task_type,
+            description=description,
+            submitter_user_id=user_id,
+            notify_user_ids=notify_ids,
+        )
+        logger.info("Boss repo_task: dropped %s for user %s (repo=%s)", task_file.name, user_id, repo_name)
+        return json.dumps({
+            "status": "queued",
+            "repo": repo_name,
+            "task_type": task_type,
+            "file": task_file.name,
+            "note": f"Task queued for `{repo_name}` — Claude will implement and post progress here.",
+        })
+    if name == "get_fix_details":
+        fp  = inputs["fingerprint"]
+        fix = store.get_confirmed_fix(fp) or store.get_marker_seen_fix(fp)
+        if not fix:
+            recent = store.get_recent_fixes(hours=72)
+            fix    = next((f for f in recent if f.get("fingerprint", "").startswith(fp)), None)
+        return json.dumps(fix or {"error": "not found"})
+    if name == "list_pending_prs":
+        prs = store.get_open_prs()
+        return json.dumps({
+            "count":    len(prs),
+            "open_prs": [
+                {
+                    "repo":      p["repo_name"],
+                    "branch":    p["branch"],
+                    "pr_url":    p["pr_url"],
+                    "timestamp": p.get("timestamp", ""),
+                }
+                for p in prs
+            ],
+        })
+    if name == "pause_sentinel":
+        Path("SENTINEL_PAUSE").touch()
+        logger.info("Boss: SENTINEL_PAUSE created")
+        return json.dumps({"status": "paused"})
+    if name == "resume_sentinel":
+        p = Path("SENTINEL_PAUSE")
+        if p.exists():
+            p.unlink()
+        logger.info("Boss: SENTINEL_PAUSE removed")
+        return json.dumps({"status": "resumed"})
+    if name == "list_projects":
+        projects = []
+        for d in _find_project_dirs():
+            repo_cfg_dir = d / "config" / "repo-configs"
+            repos_in_project = []
+            if repo_cfg_dir.exists():
+                for p in sorted(repo_cfg_dir.glob("*.properties")):
+                    if p.name.startswith("_"):
+                        continue
+                    repo_url = ""
+                    for line in p.read_text(encoding="utf-8", errors="ignore").splitlines():
+                        if line.startswith("REPO_URL"):
+                            repo_url = line.split("=", 1)[-1].strip()
+                            break
+                    repos_in_project.append({"repo": p.stem, "url": repo_url})
+            projects.append({
+                "project": _read_project_name(d),
+                "dir":     d.name,
+                "running": (d / "sentinel.pid").exists(),
+                "this":    d.resolve() == Path(".").resolve(),
+                "repos":   repos_in_project,
+            })
+        return json.dumps({"projects": projects})
+    if name == "search_logs":
+        query       = inputs.get("query", "")
+        source      = inputs.get("source", "").lower()
+        max_matches = int(inputs.get("max_matches", 30))
+        tail_override = inputs.get("tail")
+        synced_base = Path("workspace/synced")
+        if synced_base.exists():
+            log_cfg_dir_s = Path("config") / "log-configs"
+            candidate_sources = (
+                [p.stem for p in _filter_log_sources(sorted(log_cfg_dir_s.glob("*.properties")), source)]
+                if log_cfg_dir_s.exists() else
+                [d.name for d in sorted(synced_base.iterdir()) if d.is_dir()]
+            )
+            synced_results = []
+            try:
+                qpat_s = re.compile(query, re.IGNORECASE)
+            except re.error:
+                qpat_s = re.compile(re.escape(query), re.IGNORECASE)
+            for src_name in candidate_sources:
+                src_dir = synced_base / src_name
+                if not src_dir.is_dir():
+                    continue
+                for log_file in sorted(src_dir.glob("*")):
+                    try:
+                        lines = log_file.read_text(encoding="utf-8", errors="replace").splitlines()
+                        matches = [ln[:300] for ln in lines if qpat_s.search(ln)][:max_matches]
+                        if matches:
+                            synced_results.append({"source": src_name, "file": log_file.name, "matches": matches})
+                    except Exception:
+                        pass
+            if synced_results:
+                total = sum(len(r["matches"]) for r in synced_results)
+                return json.dumps({
+                    "query": query,
+                    "mode": "synced",
+                    "total_matches": total,
+                    "results": synced_results,
+                    "note": "Results from locally-synced files. No SSH needed.",
+                })
+        script = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
+        log_cfg_dir = Path("config") / "log-configs"
+        if script.exists() and log_cfg_dir.exists():
+            props_files = _filter_log_sources(sorted(log_cfg_dir.glob("*.properties")), source)
+            if props_files:
+                live_results = []
+                for props in props_files:
+                    env = os.environ.copy()
+                    env["GREP_FILTER"] = query
+                    if tail_override:
+                        env["TAIL"] = str(tail_override)
+                    try:
+                        r = subprocess.run(
+                            ["bash", str(script), str(props)],
+                            capture_output=True, text=True, timeout=60, env=env,
+                        )
+                        try:
+                            _qpat = re.compile(query, re.IGNORECASE)
+                        except re.error:
+                            _qpat = re.compile(re.escape(query), re.IGNORECASE)
+                        lines = (r.stdout or "").strip().splitlines()
+                        matches = [ln[:300] for ln in lines if _qpat.search(ln)][:max_matches]
+                        if matches:
+                            live_results.append({"source": props.stem, "matches": matches})
+                        logger.info("Boss search_logs live %s rc=%d found=%d", props.stem, r.returncode, len(matches))
+                    except subprocess.TimeoutExpired:
+                        live_results.append({"source": props.stem, "error": "timed out"})
+                    except Exception as e:
+                        live_results.append({"source": props.stem, "error": str(e)})
+                total = sum(len(r.get("matches", [])) for r in live_results)
+                return json.dumps({
+                    "query": query,
+                    "mode": "live",
+                    "total_matches": total,
+                    "results": live_results,
+                    "note": (
+                        "Results already include a per-source breakdown. "
+                        "Do NOT call search_logs again with a source filter to 'refine' — "
+                        "use these results directly."
+                    ) if total > 0 else None,
+                })
+        fetched_dir = Path("workspace/fetched")
+        if not fetched_dir.exists():
+            return json.dumps({
+                "error": "No fetched logs found and fetch_log.sh unavailable",
+                "note": "This is a config/setup problem, not a 'no results' answer.",
+            })
+        try:
+            pattern = re.compile(query, re.IGNORECASE)
+        except re.error as e:
+            return json.dumps({"error": f"Invalid regex: {e}"})
+        results = []
+        for log_file in sorted(fetched_dir.glob("*.log")):
+            if source and source not in log_file.name.lower():
+                continue
+            try:
+                lines   = log_file.read_text(encoding="utf-8", errors="ignore").splitlines()
+                matches = [
+                    {"line": i + 1, "text": line[:300]}
+                    for i, line in enumerate(lines)
+                    if pattern.search(line)
+                ][:max_matches]
+                if matches:
+                    results.append({"file": log_file.name, "matches": matches})
+            except Exception:
+                pass
+        total = sum(len(r["matches"]) for r in results)
+        files_searched = len(list(fetched_dir.glob("*.log")))
+        result = {
+            "query": query,
+            "mode": "cached",
+            "total_matches": total,
+            "files_searched": files_searched,
+            "results": results,
+        }
+        if files_searched == 0:
+            result["warning"] = (
+                "Source name not recognised in cached files — this is a lookup failure, not 'no results'. "
+                "If you already have results from a broader search_logs call, use those. Stop retrying."
+            )
+        return json.dumps(result)
+    if name == "filter_logs":
+        import re as _re
+        from collections import Counter as _Counter
+        from datetime import datetime as _datetime, timedelta, timezone as _tz
+        _EXC_PAT  = _re.compile(r'([A-Z][a-zA-Z]+(?:Exception|Error|Failure|Fault|Warning))')
+        _LVL_PAT  = _re.compile(r'\b(ERROR|WARN(?:ING)?|CRITICAL|FATAL|SEVERE)\b', _re.IGNORECASE)
+        def _signature(line):
+            exc = _EXC_PAT.search(line)
+            if exc:
+                return exc.group(1)
+            m = _LVL_PAT.search(line)
+            if m:
+                after = line[m.end():].strip()
+                token = after.split()[0].rstrip(':.,') if after.split() else ''
+                if token and len(token) > 2:
+                    return m.group(1).upper() + ' ' + token[:40]
+            return line.strip()[:40]
+        query_f      = inputs.get("query", "")
+        source_f     = inputs.get("source", "").lower()
+        since_hours  = inputs.get("since_hours")
+        max_matches  = int(inputs.get("max_matches", 300))
+        case_flag    = 0 if inputs.get("case_sensitive") else _re.IGNORECASE
+        try:
+            pat = _re.compile(query_f, case_flag)
+        except _re.error as e:
+            return json.dumps({"error": f"Invalid regex: {e}"})
+        synced_base = Path("workspace/synced")
+        if not synced_base.exists():
+            return json.dumps({
+                "error": "No synced logs found.",
+                "hint": "Log sync runs every SYNC_INTERVAL_SECONDS (default 300s). "
+                        "If just started, wait a minute then try again.",
+            })
+        cutoff = None
+        if since_hours:
+            cutoff = _datetime.now(_tz.utc) - timedelta(hours=int(since_hours))
+        if source_f:
+            src_dirs = [d for d in sorted(synced_base.iterdir())
+                        if d.is_dir() and source_f in d.name.lower()]
+        else:
+            src_dirs = [d for d in sorted(synced_base.iterdir()) if d.is_dir()]
+        if not src_dirs:
+            available = [d.name for d in synced_base.iterdir() if d.is_dir()]
+            return json.dumps({
+                "error": f"No synced source matching '{source_f}'",
+                "available_sources": available,
+            })
+        results = []
+        total_matches = 0
+        for src_dir in src_dirs:
+            for log_file in sorted(src_dir.glob("*")):
+                try:
+                    lines = log_file.read_text(encoding="utf-8", errors="replace").splitlines()
+                    matches = []
+                    for line in lines:
+                        if not pat.search(line):
+                            continue
+                        if cutoff:
+                            from .log_fetcher import _parse_line_ts
+                            ts = _parse_line_ts(line)
+                            if ts and ts < cutoff:
+                                continue
+                        matches.append(line[:300])
+                        if len(matches) >= max_matches:
+                            break
+                    if matches:
+                        results.append({
+                            "source": src_dir.name,
+                            "file": log_file.name,
+                            "matches": matches,
+                        })
+                        total_matches += len(matches)
+                except Exception:
+                    pass
+        if not results:
+            return json.dumps({
+                "query": query_f,
+                "total_matches": 0,
+                "sources_searched": [d.name for d in src_dirs],
+                "note": "No matches found in synced logs.",
+            })
+        try:
+            pat = _re.compile(query_f, case_flag)
+        except _re.error as e:
+            return json.dumps({"error": f"Invalid regex: {e}"})
+        synced_base = Path("workspace/synced")
+        if not synced_base.exists():
+            return json.dumps({
+                "error": "No synced logs found.",
+                "hint": "Log sync runs every SYNC_INTERVAL_SECONDS (default 300s). "
+                        "If just started, wait a minute then try again.",
+            })
+        cutoff = None
+        if since_hours:
+            cutoff = _datetime.now(_tz.utc) - timedelta(hours=int(since_hours))
+        if source_f:
+            src_dirs = [d for d in sorted(synced_base.iterdir())
+                        if d.is_dir() and source_f in d.name.lower()]
+        else:
+            src_dirs = [d for d in sorted(synced_base.iterdir()) if d.is_dir()]
+        if not src_dirs:
+            available = [d.name for d in synced_base.iterdir() if d.is_dir()]
+            return json.dumps({
+                "error": f"No synced source matching '{source_f}'",
+                "available_sources": available,
+            })
+        all_matches = []
+        sources_hit = set()
+        for src_dir in src_dirs:
+            for log_file in sorted(src_dir.glob("*")):
+                try:
+                    lines = log_file.read_text(encoding="utf-8", errors="replace").splitlines()
+                    for line in lines:
+                        if not pat.search(line):
+                            continue
+                        if cutoff:
+                            from .log_fetcher import _parse_line_ts
+                            ts = _parse_line_ts(line)
+                            if ts and ts < cutoff:
+                                continue
+                        all_matches.append((src_dir.name, line[:300]))
+                        sources_hit.add(src_dir.name)
+                        if len(all_matches) >= max_matches:
+                            break
+                except Exception:
+                    pass
+            if len(all_matches) >= max_matches:
+                break
+        total = len(all_matches)
+        if total == 0:
+            return json.dumps({
+                "query": query_f,
+                "total_matches": 0,
+                "sources_searched": [d.name for d in src_dirs],
+                "note": "No matches found in synced logs.",
+            })
+        sig_counter = _Counter()
+        sig_examples = {}
+        for src, line in all_matches:
+            sig = _signature(line)
+            sig_counter[sig] += 1
+            if sig not in sig_examples:
+                sig_examples[sig] = f"[{src}] {line}"
+        top_patterns = [
+            {"pattern": sig, "count": cnt, "example": sig_examples[sig][:250]}
+            for sig, cnt in sig_counter.most_common(10)
+        ]
+        sample_lines = []
+        seen_sigs = set()
+        for src, line in all_matches:
+            sig = _signature(line)
+            if sig not in seen_sigs:
+                sample_lines.append(f"[{src}] {line}")
+                seen_sigs.add(sig)
+            if len(sample_lines) >= 10:
+                break
+        time_span = {}
+        try:
+            from .log_fetcher import _parse_line_ts
+            timestamps = [_parse_line_ts(ln) for _, ln in all_matches]
+            timestamps = [t for t in timestamps if t]
+            if timestamps:
+                time_span = {
+                    "earliest": min(timestamps).strftime("%Y-%m-%d %H:%M:%S UTC"),
+                    "latest":   max(timestamps).strftime("%Y-%m-%d %H:%M:%S UTC"),
+                }
+        except Exception:
+            pass
+        return json.dumps({
+            "query":            query_f,
+            "total_matches":    total,
+            "sources_hit":      sorted(sources_hit),
+            "sources_searched": [d.name for d in src_dirs],
+            "top_patterns":     top_patterns,
+            "sample_lines":     sample_lines,
+            "time_span":        time_span,
+            "capped":           total >= max_matches,
+        })
+    if name == "trigger_poll":
+        Path("SENTINEL_POLL_NOW").touch()
+        logger.info("Boss: immediate poll requested")
+        return json.dumps({"status": "triggered", "note": "Sentinel will run a poll cycle within seconds"})
+    if name == "get_repo_status":
+        hours  = int(inputs.get("hours", 24))
+        fixes  = store.get_recent_fixes(hours)
+        errors = store.get_recent_errors(hours)
+        by_repo: dict = {}
+        for fix in fixes:
+            repo = fix.get("repo_name", "unknown")
+            s    = by_repo.setdefault(repo, {"applied": 0, "pending": 0, "failed": 0, "skipped": 0})
+            key  = fix.get("status", "failed")
+            s[key] = s.get(key, 0) + 1
+        return json.dumps({"window_hours": hours, "total_errors": len(errors), "by_repo": by_repo})
+    if name == "list_recent_commits":
+        limit   = int(inputs.get("limit", 5))
+        results = []
+        for repo_name, repo in cfg_loader.repos.items():
+            local = Path(repo.local_path)
+            if not local.exists():
+                continue
+            try:
+                r = subprocess.run(
+                    ["git", "log", "--oneline", "--grep=sentinel", "-n", str(limit)],
+                    cwd=str(local), capture_output=True, text=True, timeout=10,
+                )
+                commits = r.stdout.strip().splitlines()
+                if commits:
+                    results.append({"repo": repo_name, "commits": commits})
+            except Exception:
+                pass
+        return json.dumps({"sentinel_commits": results})
+    if name == "pull_repo":
+        target = inputs.get("repo", "").lower()
+        results = []
+        for repo_name, repo in cfg_loader.repos.items():
+            if target and target not in repo_name.lower():
+                continue
+            local = Path(repo.local_path)
+            if not local.exists():
+                results.append({"repo": repo_name, "status": "error", "detail": "local path not found"})
+                continue
+            try:
+                r = subprocess.run(
+                    ["git", "pull", "--rebase", "origin", repo.branch],
+                    cwd=str(local), capture_output=True, text=True, timeout=60,
+                )
+                last_line = r.stdout.strip().splitlines()[-1] if r.stdout.strip() else "already up to date"
+                if r.returncode == 0:
+                    results.append({"repo": repo_name, "status": "ok", "detail": last_line})
+                else:
+                    results.append({"repo": repo_name, "status": "error", "detail": r.stderr.strip()})
+            except Exception as e:
+                results.append({"repo": repo_name, "status": "error", "detail": str(e)})
+        return json.dumps({"results": results})
+    if name == "pull_config":
+        target = inputs.get("project", "")
+        dirs = _find_project_dirs(target)
+        if not dirs:
+            return json.dumps({"error": f"No project found matching '{target}'"})
+        results = []
+        for d in dirs:
+            res = _git_pull(d)
+            results.append({"project": _read_project_name(d), "dir": d.name, **res})
+            logger.info("Boss: pull_config %s → %s", d.name, res["status"])
+        return json.dumps({"results": results})
+    if name == "fetch_logs":
+        source_filter = inputs.get("source", "").lower()
+        debug         = bool(inputs.get("debug", False))
+        tail_override = inputs.get("tail")
+        grep_override = inputs.get("grep_filter", "")
+        script = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
+        if not script.exists():
+            return json.dumps({"error": f"fetch_log.sh not found at {script}"})
+        log_cfg_dir = Path("config") / "log-configs"
+        if not log_cfg_dir.exists():
+            return json.dumps({"error": "config/log-configs/ not found"})
+        props_files = _filter_log_sources(sorted(log_cfg_dir.glob("*.properties")), source_filter)
+        if not props_files:
+            return json.dumps({"error": f"No log-config found matching '{source_filter}'"})
+        results = []
+        for props in props_files:
+            env = os.environ.copy()
+            if tail_override:
+                env["TAIL"] = str(tail_override)
+            if grep_override:
+                env["GREP_FILTER"] = grep_override
+            cmd = ["bash", str(script)]
+            if debug:
+                cmd.append("--debug")
+            cmd.append(str(props))
+            try:
+                r = subprocess.run(
+                    cmd, capture_output=True, text=True, timeout=120, env=env,
+                )
+                output = (r.stdout or "").strip()
+                stderr = (r.stderr or "").strip()
+                results.append({
+                    "source":     props.stem,
+                    "returncode": r.returncode,
+                    "output":     output[-2000:] if output else "",
+                    "stderr":     stderr[-1000:] if stderr else "",
+                })
+                logger.info("Boss fetch_logs %s rc=%d", props.stem, r.returncode)
+            except subprocess.TimeoutExpired:
+                results.append({"source": props.stem, "error": "timed out after 120s"})
+            except Exception as e:
+                results.append({"source": props.stem, "error": str(e)})
+        return json.dumps({"fetched": len(results), "results": results})
+    if name == "watch_bot":
+        if not is_admin:
+            return json.dumps({"error": "watch_bot is admin-only. Ask a Sentinel admin to register this bot."})
+        user_ids    = inputs.get("user_ids", [])
+        project_arg = inputs.get("project", "").strip()
+        if not user_ids:
+            return json.dumps({"error": "No user_ids provided"})
+        resolved_project = ""
+        if project_arg:
+            project_dirs = _find_project_dirs(project_arg)
+            if not project_dirs:
+                all_names = [_read_project_name(d) for d in _find_project_dirs()]
+                return json.dumps({
+                    "error": f"No project found matching '{project_arg}'",
+                    "available_projects": all_names,
+                    "action_needed": "Ask the user which project these bot alerts belong to.",
+                })
+            if len(project_dirs) > 1:
+                matches = [_read_project_name(d) for d in project_dirs]
+                return json.dumps({
+                    "error": f"Ambiguous project name '{project_arg}' — matches: {matches}",
+                    "action_needed": "Ask the user to clarify which project.",
+                })
+            resolved_project = _read_project_name(project_dirs[0])
+        else:
+            all_projects = _find_project_dirs()
+            if len(all_projects) == 1:
+                resolved_project = _read_project_name(all_projects[0])
+            elif all_projects:
+                all_names = [_read_project_name(d) for d in all_projects]
+                return json.dumps({
+                    "error": "Cannot determine which project these bot alerts belong to.",
+                    "available_projects": all_names,
+                    "action_needed": "Ask the user to specify the project, then retry with project filled in.",
+                })
+        results = []
+        for uid in user_ids:
+            if not slack_client:
+                results.append({"user_id": uid, "status": "error", "reason": "no Slack client available"})
+                continue
+            try:
+                info = await slack_client.users_info(user=uid)
+                user = info.get("user", {})
+                if not user.get("is_bot", False):
+                    results.append({"user_id": uid, "status": "skipped", "reason": "not a bot — only bots can be watched passively"})
+                    continue
+                bot_name = user.get("real_name") or user.get("name") or uid
+                store.add_watched_bot(uid, bot_name, added_by="boss", project_name=resolved_project)
+                logger.info("Boss: now watching bot %s (%s) → project '%s'", bot_name, uid, resolved_project or "unset")
+                results.append({"user_id": uid, "bot_name": bot_name, "project": resolved_project, "status": "watching"})
+            except Exception as e:
+                results.append({"user_id": uid, "status": "error", "reason": str(e)})
+        return json.dumps({"results": results})
+    if name == "unwatch_bot":
+        if not is_admin:
+            return json.dumps({"error": "unwatch_bot is admin-only. Ask a Sentinel admin to remove this bot."})
+        user_ids = inputs.get("user_ids", [])
+        if not user_ids:
+            return json.dumps({"error": "No user_ids provided"})
+        results = []
+        for uid in user_ids:
+            removed = store.remove_watched_bot(uid)
+            logger.info("Boss: unwatch bot %s → %s", uid, "removed" if removed else "not found")
+            results.append({"user_id": uid, "status": "removed" if removed else "not found"})
+        return json.dumps({"results": results})
+    if name == "list_watched_bots":
+        bots = store.get_watched_bots()
+        return json.dumps({
+            "count": len(bots),
+            "bots": [
+                {
+                    "bot_id":   b["bot_id"],
+                    "bot_name": b["bot_name"],
+                    "project":  b.get("project_name") or "",
+                    "added_by": b["added_by"],
+                    "added_at": b["added_at"],
+                }
+                for b in bots
+            ],
+        })
+    if name == "upgrade_sentinel":
+        if not is_admin:
+            return json.dumps({"error": "upgrade is admin-only. Ask a Sentinel admin to perform the upgrade."})
+        import threading
+        try:
+            r = subprocess.run(
+                ["sentinel", "--version"],
+                capture_output=True, text=True, timeout=10,
+            )
+            sentinel_bin_ok = r.returncode == 0
+        except Exception:
+            sentinel_bin_ok = False
+        if not sentinel_bin_ok:
+            return json.dumps({
+                "status": "error",
+                "note":   "`sentinel` CLI not found. Run: npm install -g @misterhuydo/sentinel",
+            })
+        def _do_upgrade():
+            import time
+            time.sleep(10)
+            subprocess.Popen(["sentinel", "upgrade"], close_fds=True)
+        threading.Thread(target=_do_upgrade, daemon=True).start()
+        logger.info("Boss: upgrade_sentinel scheduled via `sentinel upgrade`")
+        return json.dumps({
+            "status": "ok",
+            "note":   "Upgrade started — pulling latest version via npm and restarting. Give me ~30 seconds then I'll be back.",
+        })
+    if name == "ask_codebase":
+        target   = inputs.get("repo", "").lower()
+        question = inputs.get("question", "")
+        matched = [(rn, r) for rn, r in cfg_loader.repos.items() if target in rn.lower()]
+        if not matched:
+            current_project = _read_project_name(Path("."))
+            if target in current_project.lower() or current_project.lower() in target:
+                matched = list(cfg_loader.repos.items())
+        if not matched:
+            return json.dumps({
+                "error": f"No repo or project found matching '{target}'",
+                "available_repos": list(cfg_loader.repos.keys()),
+            })
+        mode = inputs.get("mode", "explore")
+        cfg = cfg_loader.sentinel
+        env = os.environ.copy()
+        if cfg.anthropic_api_key and not cfg.claude_pro_for_tasks:
+            env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
+        api_env = {**env, "ANTHROPIC_API_KEY": cfg.anthropic_api_key} if cfg.anthropic_api_key else None
+        _project_name = _read_project_name(Path("."))
+        _all_repos_lines = []
+        for _rn, _rc in cfg_loader.repos.items():
+            _url = getattr(_rc, "repo_url", "") or ""
+            _path = getattr(_rc, "local_path", "") or ""
+            _prefixes = getattr(_rc, "package_prefixes", "") or ""
+            _all_repos_lines.append(
+                f"  - {_rn}: path={_path}"
+                + (f", url={_url}" if _url else "")
+                + (f", packages={_prefixes}" if _prefixes else "")
+            )
+        _project_ctx = (
+            f"Project: {_project_name}\n"
+            f"Repos managed by this Sentinel instance:\n"
+            + "\n".join(_all_repos_lines)
+        )
+        def _ask_one(repo_name, repo_cfg) -> dict:
+            local_path = Path(repo_cfg.local_path)
+            if not local_path.exists():
+                return {"repo": repo_name, "error": f"not cloned yet at {local_path}"}
+            if mode == "issues":
+                _mode_instruction = (
+                    "Output a structured list of GitHub issues to raise for this codebase.\n"
+                    "For each issue include:\n"
+                    "  TITLE: <concise issue title>\n"
+                    "  LABELS: <bug|enhancement|tech-debt|security|performance>\n"
+                    "  DESCRIPTION: <2-4 sentences: what, why, suggested approach>\n"
+                    "---\n"
+                    "Focus on: bugs, missing error handling, performance bottlenecks, "
+                    "security gaps, missing tests, tech-debt, and useful new features.\n"
+                    "Output plain text only — no markdown headers."
+                )
+            else:
+                _mode_instruction = (
+                    "Explore the codebase freely — read files, search for patterns, examine structure.\n"
+                    "Answer thoroughly. You may discuss architecture, suggest extensions, "
+                    "describe design patterns, or analyse any aspect of the code.\n"
+                    "Plain text only. Be concise but complete."
+                )
+            prompt = (
+                f"{_project_ctx}\n\n"
+                f"You are now analysing: {repo_name} at {local_path}\n\n"
+                f"{_mode_instruction}\n\n"
+                f"Question / Task: {question}"
+            )
+            from .fix_engine import _is_auth_error
+            skip_perms = os.getuid() != 0
+            oauth_cmd = (
+                [cfg.claude_code_bin, "--dangerously-skip-permissions", "--print", prompt]
+                if skip_perms else
+                [cfg.claude_code_bin, "--print", prompt]
+            )
+            api_cmd = (
+                [cfg.claude_code_bin, "--dangerously-skip-permissions", "--bare", "--print", prompt]
+                if skip_perms else
+                [cfg.claude_code_bin, "--bare", "--print", prompt]
+            )
+            run_kwargs = dict(capture_output=True, text=True, timeout=300,
+                              cwd=str(local_path), stdin=subprocess.DEVNULL)
+            try:
+                r = subprocess.run(oauth_cmd, env=env, **run_kwargs)
+                output = (r.stdout or "").strip()
+                auth_failed = _is_auth_error(output) or _is_auth_error(r.stderr or "")
+                if auth_failed and api_env:
+                    logger.warning("ask_codebase/%s: OAuth session issue — retrying with API key", repo_name)
+                    r = subprocess.run(api_cmd, env=api_env, **run_kwargs)
+                    output = (r.stdout or "").strip()
+                logger.info("Boss ask_codebase %s mode=%s rc=%d len=%d", repo_name, mode, r.returncode, len(output))
+                if r.returncode != 0 and not output:
+                    raw_err = (r.stderr or "")
+                    alert_if_rate_limited(
+                        cfg.slack_bot_token, cfg.slack_channel,
+                        f"ask_codebase/{repo_name}", raw_err,
+                    )
+                    return {"repo": repo_name, "error": f"claude --print failed (rc={r.returncode}): {raw_err[:200]}"}
+                return {"repo": repo_name, "answer": output[:4000]}
+            except subprocess.TimeoutExpired:
+                return {"repo": repo_name, "error": "timed out after 300s"}
+            except Exception as e:
+                return {"repo": repo_name, "error": str(e)}
+        def _ask_cached(repo_name, repo_cfg) -> dict:
+            if mode != "issues":
+                cached = store.get_knowledge(repo_name, question)
+                if cached:
+                    logger.info("Boss ask_codebase %s: cache hit", repo_name)
+                    return {"repo": repo_name, "answer": cached, "cached": True}
+            result = _ask_one(repo_name, repo_cfg)
+            if result.get("answer") and len(result["answer"]) > 50 and mode != "issues":
+                store.save_knowledge(repo_name, question, result["answer"], ttl_hours=24)
+            return result
+        if len(matched) == 1:
+            result = _ask_cached(*matched[0])
+            return json.dumps(result)
+        results = [_ask_cached(rn, r) for rn, r in matched]
+        return json.dumps({"project": target, "repos_queried": len(results), "results": results})
+    if name == "ask_logs":
+        question   = inputs.get("question", "")
+        source_arg = inputs.get("source", "").lower()
+        cfg = cfg_loader.sentinel
+        workspace  = Path(cfg.workspace_dir)
+        synced_base = workspace / "synced"
+        fetched_base = workspace / "fetched"
+        log_files = []
+        if source_arg:
+            if synced_base.exists():
+                for d in sorted(synced_base.iterdir()):
+                    if d.is_dir() and source_arg in d.name.lower():
+                        log_files.extend(sorted(d.glob("*")))
+            for f in sorted(fetched_base.glob("*.log")):
+                if source_arg in f.stem.lower() and f not in log_files:
+                    log_files.append(f)
+        else:
+            if synced_base.exists():
+                for d in sorted(synced_base.iterdir()):
+                    if d.is_dir():
+                        log_files.extend(sorted(d.glob("*")))
+            for f in sorted(fetched_base.glob("*.log")):
+                if f not in log_files:
+                    log_files.append(f)
+        if not log_files:
+            hint = (
+                f"No log files found for source '{source_arg}'."
+                if source_arg else "No log files found."
+            )
+            available = (
+                [d.name for d in synced_base.iterdir() if d.is_dir()]
+                if synced_base.exists() else []
+            )
+            return json.dumps({
+                "error": hint,
+                "available_sources": available,
+                "hint": "Run fetch_logs first, or wait for the next poll cycle.",
+            })
+        file_list = "\n".join(f"  {p}" for p in log_files)
+        prompt = (
+            f"You are analyzing production logs.\n\n"
+            f"QUESTION: {question}\n\n"
+            f"LOG FILES (use your Read and Grep tools to search these):\n{file_list}\n\n"
+            f"Search the log files and answer the question. "
+            f"Be concise and direct. Plain text only — no markdown."
+        )
+        env = os.environ.copy()
+        if cfg.anthropic_api_key and not cfg.claude_pro_for_tasks:
+            env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
+        try:
+            skip_flag = []
+            try:
+                if os.getuid() != 0:
+                    skip_flag = ["--dangerously-skip-permissions"]
+            except AttributeError:
+                skip_flag = ["--dangerously-skip-permissions"]
+            r = subprocess.run(
+                [cfg.claude_code_bin] + skip_flag + ["--print", prompt],
+                capture_output=True, text=True, timeout=240, env=env,
+                cwd=str(workspace),
+            )
+            output = (r.stdout or "").strip()
+            logger.info("Boss ask_logs source=%s rc=%d len=%d", source_arg or "all", r.returncode, len(output))
+            if r.returncode != 0 and not output:
+                raw_err = (r.stderr or "")
+                alert_if_rate_limited(cfg.slack_bot_token, cfg.slack_channel,
+                                      f"ask_logs/{source_arg or 'all'}", raw_err)
+                return json.dumps({"error": f"claude --print failed (rc={r.returncode}): {raw_err[:300]}"})
+            return json.dumps({
+                "source": source_arg or "all",
+                "files_searched": len(log_files),
+                "answer": output[:4000],
+            })
+        except subprocess.TimeoutExpired:
+            return json.dumps({"error": "timed out after 240s"})
+        except Exception as e:
+            return json.dumps({"error": str(e)})
+    if name == "restart_project":
+        if not is_admin:
+            return json.dumps({"error": "restart_project is admin-only. Ask a Sentinel admin to restart the project."})
+        project_arg = inputs.get("project", "").lower()
+        dirs = _find_project_dirs(project_arg)
+        if not dirs:
+            return json.dumps({"error": f"No project found matching '{project_arg}'"})
+        results = []
+        for d in dirs:
+            stop_sh  = d / "stop.sh"
+            start_sh = d / "start.sh"
+            if not stop_sh.exists() or not start_sh.exists():
+                results.append({"project": d.name, "status": "error", "detail": "stop.sh or start.sh not found"})
+                continue
+            try:
+                subprocess.run(["bash", str(stop_sh)],  cwd=str(d), timeout=30)
+                subprocess.run(["bash", str(start_sh)], cwd=str(d), timeout=30)
+                results.append({"project": d.name, "status": "restarted"})
+                logger.info("Boss: restarted project %s", d.name)
+            except Exception as e:
+                results.append({"project": d.name, "status": "error", "detail": str(e)})
+        return json.dumps({"results": results})
+    if name == "tail_log":
+        source      = inputs.get("source", "").lower()
+        lines       = int(inputs.get("lines", 100))
+        script      = Path(__file__).resolve().parent.parent / "scripts" / "fetch_log.sh"
+        log_cfg_dir = Path("config") / "log-configs"
+        if not script.exists():
+            return json.dumps({"error": "fetch_log.sh not found"})
+        if not log_cfg_dir.exists():
+            return json.dumps({"error": "config/log-configs/ not found"})
+        props_files = sorted(log_cfg_dir.glob("*.properties"))
+        if source:
+            props_files = [p for p in props_files if source in p.stem.lower()]
+        if not props_files:
+            return json.dumps({"error": f"No log-config found matching '{source}'"})
+        results = []
+        for props in props_files:
+            env = os.environ.copy()
+            env["TAIL"]        = str(lines)
+            env["GREP_FILTER"] = ""
+            try:
+                r = subprocess.run(
+                    ["bash", str(script), str(props)],
+                    capture_output=True, text=True, timeout=60, env=env,
+                )
+                tail_lines = (r.stdout or "").strip().splitlines()[-lines:]
+                results.append({
+                    "source":  props.stem,
+                    "lines":   len(tail_lines),
+                    "content": "\n".join(tail_lines),
+                })
+                logger.info("Boss tail_log %s rc=%d lines=%d", props.stem, r.returncode, len(tail_lines))
+            except subprocess.TimeoutExpired:
+                results.append({"source": props.stem, "error": "timed out"})
+            except Exception as e:
+                results.append({"source": props.stem, "error": str(e)})
+        return json.dumps({"results": results})
+    if name == "post_file":
+        if not slack_client or not channel:
+            return json.dumps({"error": "No Slack channel context — cannot upload file"})
+        content  = inputs.get("content", "")
+        filename = inputs.get("filename", "sentinel-output.txt")
+        title    = inputs.get("title", filename)
+        if not content:
+            return json.dumps({"error": "No content provided"})
+        try:
+            await slack_client.files_upload_v2(
+                channel=channel,
+                content=content,
+                filename=filename,
+                title=title,
+            )
+            logger.info("Boss post_file: uploaded %s (%d bytes) to %s", filename, len(content), channel)
+            return json.dumps({"ok": True, "filename": filename, "bytes": len(content)})
+        except Exception as e:
+            logger.warning("Boss post_file failed: %s", e)
+            return json.dumps({"error": str(e)})
+    if name == "my_stats":
+        hours  = int(inputs.get("hours", 168))
+        errors = store.get_recent_errors(hours)
+        fixes  = store.get_recent_fixes(hours)
+        prs    = store.get_open_prs()
+        pending_conf = store.get_fixes_pending_confirmation()
+        history      = store.load_conversation(user_id) if user_id else []
+        hist_len     = len(history)
+        conv_updated = ""
+        try:
+            import sqlite3 as _sqlite3
+            with _sqlite3.connect(store.db_path) as _db:
+                row = _db.execute(
+                    "SELECT updated_at FROM conversations WHERE user_id=?", (user_id,)
+                ).fetchone()
+                if row:
+                    conv_updated = row[0]
+        except Exception:
+            pass
+        by_status: dict = {}
+        for fix in fixes:
+            s = fix.get("status", "unknown")
+            by_status[s] = by_status.get(s, 0) + 1
+        confirmed = [f for f in fixes if f.get("fix_outcome") == "confirmed"]
+        regressed = [f for f in fixes if f.get("fix_outcome") == "regressed"]
+        submitted = store.get_submitted_issues(user_id, hours=hours) if user_id else []
+        submitted_recent = store.get_submitted_issues(user_id, hours=hours) if user_id else []
+        return json.dumps({
+            "conversation": {
+                "messages_in_history": hist_len,
+                "turns":               hist_len // 2,
+                "last_active":         conv_updated or "no history",
+            },
+            "issues_you_submitted": {
+                "total_in_window": len(submitted_recent),
+                "all_time":        len(store.get_submitted_issues(user_id) if user_id else []),
+                "recent": [
+                    {"project": i["project"], "description": i["description"][:80],
+                     "submitted_at": i["submitted_at"]}
+                    for i in submitted_recent[:5]
+                ],
+            },
+            "window_hours": hours,
+            "errors_detected": len(errors),
+            "fixes": {
+                "applied":    by_status.get("applied", 0),
+                "pending_pr": len(prs),
+                "failed":     by_status.get("failed", 0),
+                "skipped":    by_status.get("skipped", 0),
+                "error":      by_status.get("error", 0),
+            },
+            "confirmed_in_prod":     len(confirmed),
+            "regressed_after_fix":   len(regressed),
+            "awaiting_confirmation": len(pending_conf),
+            "open_prs": [
+                {"repo": p["repo_name"], "pr_url": p["pr_url"], "timestamp": p["timestamp"]}
+                for p in prs
+            ],
+            "top_errors": [
+                {"message": e["message"][:100], "count": e["count"], "source": e["source"]}
+                for e in errors[:5]
+            ],
+        })
+    if name == "clear_my_history":
+        if user_id:
+            store.save_conversation(user_id, [])
+            logger.info("Boss: cleared conversation history for user %s", user_id)
+            return json.dumps({
+                "status":  "cleared",
+                "note":    "Your conversation history has been wiped. Next session starts fresh. [DONE]",
+            })
+        return json.dumps({"error": "cannot determine user — not clearing"})
+    _ADMIN_TOOLS = {"list_all_users", "clear_user_history", "reset_fingerprint", "list_all_errors", "export_db", "merge_pr", "install_tool", "manage_release", "chain_release"}
+    if name in _ADMIN_TOOLS:
+        if not is_admin:
+            return json.dumps({"error": "This operation is admin-only (SLACK_ADMIN_USERS). Contact a Sentinel admin if you need access."})
+        if name == "list_all_users":
+            stats = store.get_all_user_stats()
+            return json.dumps({"users": stats, "total": len(stats)})
+        if name == "clear_user_history":
+            target = (inputs.get("user_id") or inputs.get("target_user_id", "")).strip()
+            if not target:
+                return json.dumps({"error": "user_id is required"})
+            store.save_conversation(target, [])
+            display = store.get_user_name(target)
+            logger.info("Boss admin: cleared history for user %s (%s) by admin %s", target, display, user_id)
+            return json.dumps({"status": "cleared", "target_user_id": target, "display_name": display})
+        if name == "set_maintenance":
+            repo_name = inputs.get("repo_name", "").strip()
+            note      = inputs.get("note", "").strip()
+            if not repo_name:
+                return json.dumps({"error": "repo_name is required"})
+            store.set_health_state(repo_name, "confirmed", note=note)
+            logger.info("Boss: maintenance confirmed for %s by %s (note: %s)", repo_name, user_id, note or "none")
+            return json.dumps({
+                "status": "confirmed",
+                "repo": repo_name,
+                "note": note or "none",
+                "message": (
+                    f"Got it. I'll silently monitor {repo_name}'s health URL and "
+                    f"notify you as soon as it comes back online."
+                ),
+            })
+        if name == "reset_fingerprint":
+            fp = inputs.get("fingerprint", "").strip()
+            if not fp:
+                return json.dumps({"error": "fingerprint is required"})
+            found = store.reset_fingerprint(fp)
+            logger.info("Boss admin: reset fingerprint %s by admin %s (found=%s)", fp, user_id, found)
+            return json.dumps({"status": "reset" if found else "not_found", "fingerprint": fp,
+                               "note": "Sentinel will retry this error on the next poll." if found else "No fix record found for this fingerprint."})
+        if name == "list_all_errors":
+            hours = int(inputs.get("hours", 0))
+            errors = store.get_all_errors(hours)
+            return json.dumps({"errors": errors[:100], "total": len(errors),
+                               "window_hours": hours or "all time"})
+        if name == "export_db":
+            if not slack_client or not channel:
+                return json.dumps({"error": "No Slack channel context — cannot upload file"})
+            try:
+                import sqlite3 as _sq
+                import io as _io
+                lines = []
+                with _sq.connect(store.db_path) as _db:
+                    for tbl in ["errors", "fixes", "reports", "slack_users", "conversations", "submitted_issues"]:
+                        try:
+                            rows = _db.execute(f"SELECT * FROM {tbl}").fetchall()
+                            cols = [d[0] for d in _db.execute(f"SELECT * FROM {tbl} LIMIT 0").description]
+                            lines.append(f"=== {tbl} ({len(rows)} rows) ===")
+                            lines.append("\t".join(cols))
+                            for row in rows:
+                                lines.append("\t".join(str(v) if v is not None else "" for v in row))
+                            lines.append("")
+                        except Exception:
+                            lines.append(f"=== {tbl} (unavailable) ===\n")
+                content = "\n".join(lines)
+                await slack_client.files_upload_v2(
+                    channel=channel,
+                    content=content,
+                    filename="sentinel-db-export.tsv",
+                    title="Sentinel DB Export",
+                )
+                logger.info("Boss admin: exported DB (%d bytes) by admin %s", len(content), user_id)
+                return json.dumps({"ok": True, "bytes": len(content)})
+            except Exception as e:
+                return json.dumps({"error": str(e)})
+        if name == "refresh_knowledge":
+            repo_filter = inputs.get("repo", "").strip()
+            list_only   = bool(inputs.get("list_only", False))
+            if list_only:
+                entries = store.list_knowledge(repo_name=repo_filter)
+                if not entries:
+                    return json.dumps({"message": "Knowledge cache is empty.", "entries": []})
+                return json.dumps({
+                    "total": len(entries),
+                    "entries": [
+                        {
+                            "repo":       e["repo_name"],
+                            "question":   e["question"][:80],
+                            "cached_at":  e["cached_at"][:16],
+                            "expires_at": e["expires_at"][:16],
+                            "hits":       e["hit_count"],
+                            "tool":       e["source_tool"],
+                        }
+                        for e in entries
+                    ],
+                })
+            deleted = store.invalidate_knowledge(repo_name=repo_filter)
+            scope   = f"repo '{repo_filter}'" if repo_filter else "all repos"
+            logger.info("Boss refresh_knowledge: cleared %d entries for %s by %s", deleted, scope, user_id)
+            return json.dumps({
+                "status":  "cleared",
+                "deleted": deleted,
+                "scope":   scope,
+                "note":    "Next ask_codebase call will fetch a fresh answer from Claude.",
+            })
+        if name == "list_prs":
+            if not is_admin:
+                return json.dumps({"error": "list_prs is admin-only. Ask a Sentinel admin (SLACK_ADMIN_USERS) to run this for you."})
+            repo_filter   = inputs.get("repo", "").strip()
+            status_filter = inputs.get("status", "").strip()
+            if status_filter == "pending":
+                prs = store.get_prs(repo_name=repo_filter, state="open", decision="pending")
+            elif status_filter:
+                prs = store.get_prs(repo_name=repo_filter, state=status_filter)
+            else:
+                prs = store.get_prs(repo_name=repo_filter)
+            if not prs:
+                return json.dumps({"message": "No PRs found matching the filter.", "prs": []})
+            formatted = []
+            for p in prs:
+                entry = {
+                    "repo":       p["repo_name"],
+                    "pr_number":  p["pr_number"],
+                    "title":      p["title"],
+                    "author":     p["author"],
+                    "source":     p["source"],
+                    "state":      p["pr_state"],
+                    "url":        p["pr_url"],
+                    "first_seen": p["first_seen"][:10] if p["first_seen"] else "",
+                }
+                if p.get("admin_decision"):
+                    entry["decision"]    = p["admin_decision"]
+                    entry["decided_by"]  = p.get("admin_user_id", "")
+                    entry["decided_at"]  = (p.get("admin_decided_at") or "")[:10]
+                else:
+                    entry["decision"] = "pending"
+                formatted.append(entry)
+            return json.dumps({"total": len(formatted), "prs": formatted})
+        if name == "drop_pr":
+            if not is_admin:
+                return json.dumps({"error": "drop_pr is admin-only. Ask a Sentinel admin to drop this PR for you."})
+            repo_name  = inputs.get("repo_name", "").strip()
+            pr_number  = inputs.get("pr_number")
+            if not repo_name or not pr_number:
+                return json.dumps({"error": "repo_name and pr_number are required"})
+            pr_number = int(pr_number)
+            if repo_name not in cfg_loader.repos:
+                for rname in cfg_loader.repos:
+                    if repo_name.lower() in rname.lower():
+                        repo_name = rname
+                        break
+            store.record_pr_decision(repo_name, pr_number, "rejected", user_id)
+            logger.info("Boss drop_pr: PR
+            return json.dumps({
+                "status": "dropped",
+                "repo":      repo_name,
+                "pr_number": pr_number,
+                "dropped_by": user_id,
+                "note": f"PR
+            })
+        if name == "merge_pr":
+            import re as _re
+            import requests as _req
+            repo_name    = inputs.get("repo_name", "").strip()
+            fingerprint  = inputs.get("fingerprint", "").strip()
+            pr_number_in = inputs.get("pr_number")
+            confirmed    = bool(inputs.get("confirmed", False))
+            github_token = cfg_loader.sentinel.github_token
+            if not github_token:
+                return json.dumps({"error": "GITHUB_TOKEN not configured"})
+            headers = {
+                "Authorization": f"Bearer {github_token}",
+                "Accept": "application/vnd.github+json",
+            }
+            if repo_name not in cfg_loader.repos:
+                for rname in cfg_loader.repos:
+                    if repo_name.lower() in rname.lower():
+                        repo_name = rname
+                        break
+            branch_name  = inputs.get("branch_name", "").strip()
+            if branch_name and not pr_number_in:
+                repo_cfg = cfg_loader.repos.get(repo_name)
+                owner_repo = ""
+                if repo_cfg and repo_cfg.repo_url:
+                    url = repo_cfg.repo_url
+                    owner_repo = url.split(":")[-1].removesuffix(".git") if url.startswith("git@") \
+                        else "/".join(url.rstrip("/").split("/")[-2:]).removesuffix(".git")
+                if not owner_repo:
+                    return json.dumps({"error": f"Cannot determine GitHub owner/repo for '{repo_name}'"})
+                base_branch = (repo_cfg.branch if repo_cfg else None) or "main"
+                branch_resp = _req.get(
+                    f"https://api.github.com/repos/{owner_repo}/branches/{branch_name}",
+                    headers=headers, timeout=15,
+                )
+                if branch_resp.status_code == 404:
+                    return json.dumps({"error": f"Branch '{branch_name}' not found in {owner_repo}"})
+                if branch_resp.status_code != 200:
+                    return json.dumps({"error": f"GitHub API error ({branch_resp.status_code}): {branch_resp.text[:200]}"})
+                branch_data = branch_resp.json()
+                head_sha    = branch_data.get("commit", {}).get("sha", "")[:8]
+                head_msg    = branch_data.get("commit", {}).get("commit", {}).get("message", "").splitlines()[0]
+                compare_resp = _req.get(
+                    f"https://api.github.com/repos/{owner_repo}/compare/{base_branch}...{branch_name}",
+                    headers=headers, timeout=15,
+                )
+                compare_data = compare_resp.json() if compare_resp.status_code == 200 else {}
+                ahead_by    = compare_data.get("ahead_by", "?")
+                behind_by   = compare_data.get("behind_by", "?")
+                files_list  = [f.get("filename", "") for f in compare_data.get("files", [])]
+                if not confirmed:
+                    return json.dumps({
+                        "plan":         f"Merge branch '{branch_name}' into {repo_name}/{base_branch}",
+                        "branch":       branch_name,
+                        "base":         base_branch,
+                        "head_sha":     head_sha,
+                        "head_commit":  head_msg,
+                        "ahead_by":     ahead_by,
+                        "behind_by":    behind_by,
+                        "files":        files_list,
+                        "confirm_prompt": (
+                            f"This will merge branch '{branch_name}' (ahead by {ahead_by} commit(s)) "
+                            f"into {repo_name}/{base_branch} via GitHub Merge API. "
+                            f"Reply with confirmed=true to proceed."
+                        ),
+                    })
+                merge_resp = _req.post(
+                    f"https://api.github.com/repos/{owner_repo}/merges",
+                    json={"base": base_branch, "head": branch_name,
+                          "commit_message": f"chore: merge branch '{branch_name}' into {base_branch}"},
+                    headers=headers, timeout=30,
+                )
+                if merge_resp.status_code == 201:
+                    sha = merge_resp.json().get("sha", "")[:8]
+                    logger.info("Boss merge_pr (branch): merged '%s' into %s/%s by %s sha=%s",
+                                branch_name, repo_name, base_branch, user_id, sha)
+                    return json.dumps({
+                        "status":  "merged",
+                        "branch":  branch_name,
+                        "base":    base_branch,
+                        "sha":     sha,
+                        "repo":    repo_name,
+                        "note":    f"Branch '{branch_name}' merged into {base_branch}. SHA: {sha}",
+                    })
+                if merge_resp.status_code == 204:
+                    return json.dumps({
+                        "status": "already_merged",
+                        "note":   f"Branch '{branch_name}' is already fully merged into {base_branch}.",
+                    })
+                if merge_resp.status_code == 409:
+                    return json.dumps({
+                        "status": "conflict",
+                        "error":  f"Merge conflict between '{branch_name}' and '{base_branch}'. Resolve manually on GitHub.",
+                    })
+                return json.dumps({"status": "error",
+                                   "error": f"GitHub API returned {merge_resp.status_code}: {merge_resp.text[:300]}"})
+            if pr_number_in:
+                pr_number_in = int(pr_number_in)
+                repo_cfg = cfg_loader.repos.get(repo_name)
+                owner_repo = ""
+                if repo_cfg and repo_cfg.repo_url:
+                    url = repo_cfg.repo_url
+                    if url.startswith("git@"):
+                        owner_repo = url.split(":")[-1].removesuffix(".git")
+                    else:
+                        owner_repo = "/".join(url.rstrip("/").split("/")[-2:]).removesuffix(".git")
+                if not owner_repo:
+                    for p in store.get_open_prs():
+                        if p.get("repo_name") == repo_name and p.get("pr_url"):
+                            m2 = _re.search(r"github\.com/([^/]+/[^/]+)/pull/", p["pr_url"])
+                            if m2:
+                                owner_repo = m2.group(1)
+                                break
+                if not owner_repo:
+                    return json.dumps({"error": f"Cannot determine GitHub owner/repo for '{repo_name}'"})
+                pr_resp = _req.get(
+                    f"https://api.github.com/repos/{owner_repo}/pulls/{pr_number_in}",
+                    headers=headers, timeout=15,
+                )
+                if pr_resp.status_code == 404:
+                    return json.dumps({"error": f"PR
+                if pr_resp.status_code in (401, 403):
+                    return json.dumps({"error": _GITHUB_TOKEN_403_GUIDE})
+                if pr_resp.status_code != 200:
+                    return json.dumps({"error": f"GitHub API error ({pr_resp.status_code}): {pr_resp.text[:200]}"})
+                pr_data = pr_resp.json()
+                if pr_data.get("state") != "open":
+                    return json.dumps({"error": f"PR
+                pr_url   = pr_data.get("html_url", "")
+                branch   = pr_data.get("head", {}).get("ref", "")
+                pr_title = pr_data.get("title", "")
+                pr_author = pr_data.get("user", {}).get("login", "unknown")
+                pr_body   = (pr_data.get("body") or "")[:300]
+                files_changed = pr_data.get("changed_files", "?")
+                additions     = pr_data.get("additions", "?")
+                deletions     = pr_data.get("deletions", "?")
+                mergeable     = pr_data.get("mergeable")
+                if not confirmed:
+                    return json.dumps({
+                        "plan": f"Merge PR
+                        "pr_number":     pr_number_in,
+                        "pr_url":        pr_url,
+                        "title":         pr_title,
+                        "author":        pr_author,
+                        "branch":        branch,
+                        "files_changed": files_changed,
+                        "additions":     additions,
+                        "deletions":     deletions,
+                        "mergeable":     mergeable,
+                        "description":   pr_body or "(no description)",
+                        "confirm_prompt": (
+                            f"This will squash-merge PR
+                            f"from {pr_author} into {repo_name}. Reply with confirmed=true to proceed."
+                        ),
+                    })
+                merge_resp = _req.put(
+                    f"https://api.github.com/repos/{owner_repo}/pulls/{pr_number_in}/merge",
+                    json={"merge_method": "squash", "commit_title": f"chore: merge PR
+                    headers=headers, timeout=30,
+                )
+                if merge_resp.status_code == 200:
+                    sha = merge_resp.json().get("sha", "")[:8]
+                    store.record_pr_decision(repo_name, pr_number_in, "merged", user_id)
+                    logger.info("Boss merge_pr: merged PR
+                    return json.dumps({
+                        "status": "merged",
+                        "pr": pr_url,
+                        "pr_number": pr_number_in,
+                        "title": pr_title,
+                        "sha": sha,
+                        "repo": repo_name,
+                        "note": f"PR
+                    })
+                if merge_resp.status_code in (405, 409):
+                    return json.dumps({
+                        "status": "conflict",
+                        "pr": pr_url,
+                        "error": f"PR
+                    })
+                return json.dumps({"status": "error", "pr": pr_url,
+                                   "error": f"GitHub API returned {merge_resp.status_code}: {merge_resp.text[:300]}"})
+            open_prs = store.get_open_prs()
+            candidates = [p for p in open_prs if p.get("repo_name") == repo_name]
+            if fingerprint:
+                candidates = [p for p in candidates if p.get("fingerprint", "").startswith(fingerprint)]
+            if not candidates:
+                return json.dumps({"error": f"No open Sentinel PR found for repo '{repo_name}'"
+                                            + (f" with fingerprint '{fingerprint}'" if fingerprint else "")})
+            fix = candidates[0]
+            pr_url = fix.get("pr_url", "")
+            branch = fix.get("branch", "")
+            fp     = fix.get("fingerprint", "")
+            m = _re.search(r"github\.com/([^/]+/[^/]+)/pull/(\d+)", pr_url)
+            if not m:
+                return json.dumps({"error": f"Cannot parse PR URL: {pr_url}"})
+            owner_repo = m.group(1)
+            pr_number  = m.group(2)
+            pr_resp2 = _req.get(
+                f"https://api.github.com/repos/{owner_repo}/pulls/{pr_number}",
+                headers=headers, timeout=15,
+            )
+            pr_detail = pr_resp2.json() if pr_resp2.status_code == 200 else {}
+            pr_title2    = pr_detail.get("title", fix.get("fingerprint", ""))
+            pr_state2    = pr_detail.get("state", "unknown")
+            files_changed2 = pr_detail.get("changed_files", "?")
+            additions2     = pr_detail.get("additions", "?")
+            deletions2     = pr_detail.get("deletions", "?")
+            pr_body2       = (pr_detail.get("body") or "")[:300]
+            if pr_state2 != "open" and pr_state2 != "unknown":
+                return json.dumps({"error": f"PR
+            if not confirmed:
+                return json.dumps({
+                    "plan":          f"Merge Sentinel fix PR
+                    "pr_number":     pr_number,
+                    "pr_url":        pr_url,
+                    "title":         pr_title2,
+                    "fingerprint":   fp[:8],
+                    "branch":        branch,
+                    "files_changed": files_changed2,
+                    "additions":     additions2,
+                    "deletions":     deletions2,
+                    "description":   pr_body2 or "(no description)",
+                    "confirm_prompt": (
+                        f"This will squash-merge Sentinel fix PR
+                        f"into {repo_name}/{fix.get('branch', 'main')}. "
+                        f"Reply with confirmed=true to proceed."
+                    ),
+                })
+            merge_resp = _req.put(
+                f"https://api.github.com/repos/{owner_repo}/pulls/{pr_number}/merge",
+                json={"merge_method": "squash", "commit_title": f"fix(sentinel): merge PR
+                headers=headers, timeout=30,
+            )
+            if merge_resp.status_code == 200:
+                sha = merge_resp.json().get("sha", "")[:8]
+                store.record_fix(fp, "applied", branch=branch, pr_url=pr_url,
+                                 repo_name=repo_name, commit_hash=sha)
+                try:
+                    store.record_pr_decision(repo_name, int(pr_number), "merged", user_id)
+                except Exception:
+                    pass
+                try:
+                    store.invalidate_knowledge(repo_name)
+                except Exception:
+                    pass
+                logger.info("Boss merge_pr: merged PR
+                            pr_number, repo_name, fp[:8], user_id)
+                return json.dumps({
+                    "status": "merged",
+                    "pr": pr_url,
+                    "sha": sha,
+                    "repo": repo_name,
+                    "note": f"PR
+                })
+            if merge_resp.status_code in (405, 409):
+                repo_cfg = cfg_loader.repos.get(repo_name)
+                if not repo_cfg or not repo_cfg.local_path:
+                    return json.dumps({"error": f"Merge conflict and no local clone found for '{repo_name}'. Resolve manually: {pr_url}"})
+                import subprocess as _sp
+                from .git_manager import _git_env
+                env = _git_env(repo_cfg)
+                cwd = repo_cfg.local_path
+                base = repo_cfg.branch
+                _sp.run(["git", "fetch", "origin"], cwd=cwd, env=env, capture_output=True, timeout=60)
+                _sp.run(["git", "checkout", branch], cwd=cwd, env=env, capture_output=True, timeout=30)
+                rb = _sp.run(["git", "rebase", f"origin/{base}"], cwd=cwd, env=env, capture_output=True, timeout=60)
+                if rb.returncode != 0:
+                    _sp.run(["git", "rebase", "--abort"], cwd=cwd, env=env, capture_output=True, timeout=30)
+                    _sp.run(["git", "checkout", base], cwd=cwd, env=env, capture_output=True, timeout=30)
+                    return json.dumps({
+                        "status": "conflict",
+                        "error": "Rebase failed — conflicts must be resolved manually",
+                        "pr": pr_url,
+                        "details": rb.stderr.strip()[:500],
+                    })
+                _sp.run(["git", "push", "--force-with-lease", "origin", branch],
+                        cwd=cwd, env=env, capture_output=True, timeout=60)
+                _sp.run(["git", "checkout", base], cwd=cwd, env=env, capture_output=True, timeout=30)
+                retry_resp = _req.put(
+                    f"https://api.github.com/repos/{owner_repo}/pulls/{pr_number}/merge",
+                    json={"merge_method": "squash", "commit_title": f"fix(sentinel): merge PR
+                    headers=headers, timeout=30,
+                )
+                if retry_resp.status_code == 200:
+                    sha = retry_resp.json().get("sha", "")[:8]
+                    store.record_fix(fp, "applied", branch=branch, pr_url=pr_url,
+                                     repo_name=repo_name, commit_hash=sha)
+                    logger.info("Boss merge_pr: merged (after rebase) PR
+                                pr_number, repo_name, user_id)
+                    return json.dumps({
+                        "status": "merged",
+                        "pr": pr_url,
+                        "sha": sha,
+                        "repo": repo_name,
+                        "note": f"PR
+                    })
+                return json.dumps({"status": "error", "pr": pr_url,
+                                   "error": f"Retry merge failed ({retry_resp.status_code}): {retry_resp.text[:300]}"})
+            return json.dumps({"status": "error", "pr": pr_url,
+                               "error": f"GitHub API returned {merge_resp.status_code}: {merge_resp.text[:300]}"})
+    if name == "install_tool":
+        import subprocess as _sp
+        import os as _os
+        tool_name = inputs.get("tool_name", "").strip()
+        if not tool_name:
+            return json.dumps({"error": "tool_name is required"})
+        bin_path = cfg_loader.sentinel.claude_code_bin
+        api_key  = cfg_loader.sentinel.anthropic_api_key
+        env      = {**_os.environ}
+        if api_key:
+            env["ANTHROPIC_API_KEY"] = api_key
+        prompt = (
+            f"Install '{tool_name}' on this server so it can be used as a build/test tool. "
+            f"Detect the OS and package manager (yum/dnf/apt), then run the appropriate install command. "
+            f"After installing, verify the installation by running '{tool_name} --version' or the equivalent. "
+            f"Report the installed version. Do not explain — just install and report."
+        )
+        logger.info("Boss install_tool: installing '%s' via Claude Code", tool_name)
+        try:
+            result = _sp.run(
+                [bin_path, "--dangerously-skip-permissions", "--bare", "--print", prompt],
+                capture_output=True, text=True, timeout=300, env=env,
+            )
+            output = ((result.stdout or "") + (result.stderr or "")).strip()
+            success = result.returncode == 0
+            logger.info("Boss install_tool: '%s' install %s:\n%s", tool_name, "OK" if success else "FAILED", output[-500:])
+            return json.dumps({
+                "status": "installed" if success else "failed",
+                "tool": tool_name,
+                "output": output[-1000:],
+            })
+        except FileNotFoundError:
+            return json.dumps({"error": f"Claude Code binary not found at '{bin_path}'"})
+        except _sp.TimeoutExpired:
+            return json.dumps({"error": f"Install timed out for '{tool_name}'"})
+    if name == "list_renovate_prs":
+        import requests as _req
+        from datetime import datetime as _dt_rpr, timezone as _tz_rpr
+        github_token = cfg_loader.sentinel.github_token
+        if not github_token:
+            return json.dumps({"error": "GITHUB_TOKEN not configured — cannot query GitHub API"})
+        filter_repo = inputs.get("repo_name", "").strip()
+        ready_only  = bool(inputs.get("ready_only", False))
+        headers = {
+            "Authorization": f"Bearer {github_token}",
+            "Accept": "application/vnd.github+json",
+        }
+        def _owner_repo_from_url(url):
+            if url.startswith("git@"):
+                return url.split(":")[-1].removesuffix(".git")
+            return "/".join(url.rstrip("/").split("/")[-2:]).removesuffix(".git")
+        def _ci_status(owner_repo, sha):
+            r = _req.get(
+                f"https://api.github.com/repos/{owner_repo}/commits/{sha}/check-runs",
+                headers=headers, params={"per_page": 20}, timeout=10,
+            )
+            if r.status_code != 200:
+                return "unknown"
+            runs = r.json().get("check_runs", [])
+            if not runs:
+                return "no checks"
+            statuses = {run["conclusion"] for run in runs if run["status"] == "completed"}
+            if "failure" in statuses or "cancelled" in statuses:
+                return "failing"
+            if all(s == "success" for s in statuses) and len(statuses) > 0:
+                return "passing"
+            return "pending"
+        def _parse_renovate_body(body):
+            if not body:
+                return [], "unknown"
+            conf = "unknown"
+            conf_m = __import__("re").search(r"\| *(low|moderate|high|neutral|very high) *\|", body, __import__("re").IGNORECASE)
+            if conf_m:
+                conf = conf_m.group(1).lower()
+            changes = __import__("re").findall(r"\[([^\]]+)\].*?(\d+[\.\d]*)\s*[→\-]+\s*(\d+[\.\d]*)", body)
+            pkgs = [{"package": p, "from": f, "to": t} for p, f, t in changes[:5]]
+            return pkgs, conf
+        all_prs = []
+        repos_to_scan = {
+            name: repo for name, repo in cfg_loader.repos.items()
+            if (not filter_repo) or (filter_repo.lower() in name.lower())
+        }
+        for repo_name_k, repo in repos_to_scan.items():
+            if not repo.repo_url:
+                continue
+            owner_repo = _owner_repo_from_url(repo.repo_url)
+            try:
+                r = _req.get(
+                    f"https://api.github.com/repos/{owner_repo}/pulls",
+                    headers=headers,
+                    params={"state": "open", "per_page": 50},
+                    timeout=15,
+                )
+                if r.status_code != 200:
+                    continue
+                for pr in r.json():
+                    labels = [l["name"] for l in pr.get("labels", [])]
+                    if "renovate" not in labels:
+                        continue
+                    sha = pr["head"]["sha"]
+                    ci = _ci_status(owner_repo, sha)
+                    mergeable = pr.get("mergeable")
+                    conflict = (mergeable is False)
+                    pkgs, conf = _parse_renovate_body(pr.get("body", ""))
+                    created = pr.get("created_at", "")
+                    age_days = 0
+                    if created:
+                        try:
+                            dt = _dt_rpr.fromisoformat(created.replace("Z", "+00:00"))
+                            age_days = (_dt_rpr.now(_tz_rpr.utc) - dt).days
+                        except Exception:
+                            pass
+                    ready = (ci == "passing" and not conflict)
+                    if ready_only and not ready:
+                        continue
+                    all_prs.append({
+                        "repo": repo_name_k,
+                        "pr_number": pr["number"],
+                        "title": pr["title"],
+                        "url": pr["html_url"],
+                        "packages": pkgs,
+                        "confidence": conf,
+                        "ci": ci,
+                        "conflict": conflict,
+                        "age_days": age_days,
+                        "ready_to_merge": ready,
+                    })
+            except Exception as exc:
+                logger.warning("list_renovate_prs: error scanning %s: %s", repo_name_k, exc)
+        all_prs.sort(key=lambda p: (0 if p["ready_to_merge"] else 1, p["repo"]))
+        return json.dumps({
+            "total": len(all_prs),
+            "ready_count": sum(1 for p in all_prs if p["ready_to_merge"]),
+            "prs": all_prs,
+            "note": "Use merge_pr with repo_name + pr_number to merge a specific PR." if all_prs else "No open Renovate PRs found.",
+        })
+    if name == "manage_release":
+        from .dependency_manager import plan_cascade, execute_cascade, get_artifact_id, get_release_version
+        from .cicd_trigger import trigger as cicd_trigger, _trigger_jenkins, _trigger_jenkins_release
+        from .notify import notify_cascade_started, notify_cascade_result
+        operation   = inputs.get("operation", "").strip()
+        source_repo = inputs.get("source_repo", "").strip()
+        target_repos = inputs.get("target_repos") or []
+        confirmed   = bool(inputs.get("confirmed", False))
+        repo = cfg_loader.repos.get(source_repo)
+        if not repo:
+            for rname in cfg_loader.repos:
+                if source_repo.lower() in rname.lower():
+                    repo = cfg_loader.repos[rname]
+                    source_repo = rname
+                    break
+        if not repo:
+            return json.dumps({"error": f"Repo not found: {source_repo}. Known repos: {list(cfg_loader.repos.keys())}"})
+        if not confirmed:
+            if operation == "build":
+                return json.dumps({
+                    "plan": f"Trigger Jenkins build for {source_repo}",
+                    "job_url": repo.cicd_job_url,
+                    "note": "This triggers a regular build, not a release.",
+                    "confirm_prompt": "Reply with confirmed=true to proceed.",
+                })
+            if operation in ("release", "release_and_cascade"):
+                cascade_plan = plan_cascade(source_repo, cfg_loader.repos, target_repos or None)
+                if "error" in cascade_plan:
+                    return json.dumps(cascade_plan)
+                cascade_note = (
+                    f"After release, will update {len(cascade_plan['dependents'])} dependent repo(s)."
+                    if cascade_plan["dependents"] else "No dependent repos found in config."
+                )
+                return json.dumps({
+                    "plan": f"Trigger Maven Release for {source_repo}",
+                    "release_version": cascade_plan["new_version"],
+                    "dev_version_after": cascade_plan.get("new_version", ""),
+                    "job_url": repo.cicd_job_url,
+                    "cascade": cascade_plan["dependents"],
+                    "cascade_note": cascade_note,
+                    "auto_publish_source": repo.auto_publish,
+                    "confirm_prompt": "Reply with confirmed=true to proceed.",
+                })
+            if operation == "update_deps":
+                cascade_plan = plan_cascade(source_repo, cfg_loader.repos, target_repos or None)
+                if "error" in cascade_plan:
+                    return json.dumps(cascade_plan)
+                if not cascade_plan["dependents"]:
+                    return json.dumps({"note": f"No repos depend on {cascade_plan['artifact_id']} — nothing to update."})
+                return json.dumps({
+                    "plan": f"Update {cascade_plan['artifact_id']} to {cascade_plan['new_version']} in dependent repos",
+                    "artifact_id": cascade_plan["artifact_id"],
+                    "new_version": cascade_plan["new_version"],
+                    "targets": cascade_plan["dependents"],
+                    "confirm_prompt": "Reply with confirmed=true to proceed.",
+                })
+        if operation == "build":
+            success = _trigger_jenkins(repo)
+            logger.info("Boss manage_release: build triggered for %s by %s", source_repo, user_id)
+            return json.dumps({"status": "triggered" if success else "failed", "repo": source_repo, "job_url": repo.cicd_job_url})
+        if operation in ("release", "release_and_cascade"):
+            success = _trigger_jenkins_release(repo)
+            logger.info("Boss manage_release: release triggered for %s by %s (success=%s)", source_repo, user_id, success)
+            if not success:
+                return json.dumps({"status": "failed", "repo": source_repo, "error": "Jenkins release trigger failed — check logs"})
+            do_cascade = (operation == "release_and_cascade") or repo.auto_publish
+            if do_cascade:
+                artifact_id = get_artifact_id(repo.local_path)
+                new_version = get_release_version(repo.local_path)
+                if artifact_id and new_version:
+                    target_names = target_repos or None
+                    cascade_plan = plan_cascade(source_repo, cfg_loader.repos, target_names)
+                    target_repo_names = [d["repo"] for d in cascade_plan.get("dependents", [])]
+                    if target_repo_names:
+                        notify_cascade_started(cfg_loader.sentinel, artifact_id, new_version, target_repo_names, user_id)
+                        results = execute_cascade(source_repo, new_version, artifact_id, cfg_loader.repos, cfg_loader.sentinel, target_names)
+                        notify_cascade_result(cfg_loader.sentinel, artifact_id, new_version, results, user_id)
+                        return json.dumps({
+                            "status": "released_and_cascaded",
+                            "repo": source_repo,
+                            "version": new_version,
+                            "cascade": [{"repo": r.repo_name, "success": r.success, "pr_url": r.pr_url, "error": r.error} for r in results],
+                        })
+            return json.dumps({"status": "released", "repo": source_repo, "note": "Cascade will run automatically on next poll if AUTO_PUBLISH=true."})
+        if operation == "update_deps":
+            artifact_id = get_artifact_id(repo.local_path)
+            new_version = get_release_version(repo.local_path)
+            if not artifact_id or not new_version:
+                return json.dumps({"error": f"Could not read artifact/version from {source_repo}/pom.xml"})
+            target_names = target_repos or None
+            cascade_plan = plan_cascade(source_repo, cfg_loader.repos, target_names)
+            target_repo_names = [d["repo"] for d in cascade_plan.get("dependents", [])]
+            if not target_repo_names:
+                return json.dumps({"note": f"No repos depend on {artifact_id} — nothing to update."})
+            notify_cascade_started(cfg_loader.sentinel, artifact_id, new_version, target_repo_names, user_id)
+            results = execute_cascade(source_repo, new_version, artifact_id, cfg_loader.repos, cfg_loader.sentinel, target_names)
+            notify_cascade_result(cfg_loader.sentinel, artifact_id, new_version, results, user_id)
+            return json.dumps({
+                "status": "updated",
+                "artifact_id": artifact_id,
+                "version": new_version,
+                "results": [{"repo": r.repo_name, "success": r.success, "pr_url": r.pr_url, "error": r.error} for r in results],
+            })
+        return json.dumps({"error": f"Unknown operation: {operation}"})
+    if name == "chain_release":
+        from .dependency_manager import get_artifact_id, get_release_version, update_dependency
+        from .git_manager import commit_file_change, push_dep_update, _git, _git_env, maven_compile_check, MissingToolError
+        from .cicd_trigger import _trigger_jenkins_release
+        from .notify import slack_alert
+        chain_repos = inputs.get("chain", [])
+        confirmed   = bool(inputs.get("confirmed", False))
+        if not chain_repos or len(chain_repos) < 2:
+            return json.dumps({"error": "chain must contain at least 2 repos"})
+        resolved = []
+        for rname in chain_repos:
+            repo = cfg_loader.repos.get(rname)
+            if not repo:
+                for k, v in cfg_loader.repos.items():
+                    if rname.lower() in k.lower():
+                        repo = v
+                        rname = k
+                        break
+            if not repo:
+                return json.dumps({"error": f"Repo not found: {rname}. Known: {list(cfg_loader.repos.keys())}"})
+            resolved.append(repo)
+        steps = []
+        for repo in resolved:
+            artifact_id  = get_artifact_id(repo.local_path)  if repo.local_path else ""
+            release_ver  = get_release_version(repo.local_path) if repo.local_path else ""
+            steps.append({
+                "repo":            repo.repo_name,
+                "artifact_id":     artifact_id,
+                "release_version": release_ver,
+                "cicd_url":        repo.cicd_job_url,
+                "auto_publish":    repo.auto_publish,
+            })
+        if not confirmed:
+            plan_steps = []
+            for i, step in enumerate(steps):
+                if i == 0:
+                    desc = f"Release {step['repo']} v{step['release_version']}"
+                else:
+                    prev = steps[i - 1]
+                    desc = (
+                        f"Update {step['repo']} dep on {prev['artifact_id']} "
+                        f"→ {prev['release_version']}, then release v{step['release_version']}"
+                    )
+                plan_steps.append({
+                    "step":            i + 1,
+                    "action":          desc,
+                    "repo":            step["repo"],
+                    "release_version": step["release_version"],
+                    "jenkins_url":     step["cicd_url"],
+                    "mode":            "push to main" if step["auto_publish"] else "open PR",
+                })
+            return json.dumps({
+                "plan":           f"Sequential release chain: {' → '.join(s['repo'] for s in steps)}",
+                "steps":          plan_steps,
+                "confirm_prompt": "Reply with confirmed=true to execute all steps in sequence.",
+            })
+        cfg = cfg_loader.sentinel
+        slack_alert(
+            cfg.slack_bot_token, cfg.slack_channel,
+            f":chains: *Chain release started* ({len(steps)} steps)\n"
+            + " \u2192 ".join(s["repo"] for s in steps),
+        )
+        results = []
+        for i, (step, repo) in enumerate(zip(steps, resolved)):
+            step_label = f"Step {i + 1}/{len(steps)}"
+            if i > 0:
+                prev = steps[i - 1]
+                if not prev["artifact_id"] or not prev["release_version"]:
+                    msg = f"{step_label}: skipped — could not read artifact/version from {prev['repo']}"
+                    results.append({"step": i + 1, "repo": step["repo"], "status": "skipped", "error": msg})
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel, f":warning: {msg}")
+                    break
+                _git(["checkout", "pom.xml"], cwd=repo.local_path, env=_git_env(repo))
+                pull_r = _git(["pull", "--rebase", "origin", repo.branch], cwd=repo.local_path, env=_git_env(repo))
+                if pull_r.returncode != 0:
+                    msg = f"{step_label}: git pull failed for {repo.repo_name}"
+                    results.append({"step": i + 1, "repo": step["repo"], "status": "failed", "error": msg})
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel, ":x: Chain release failed — " + msg)
+                    break
+                changed = update_dependency(repo.local_path, prev["artifact_id"], prev["release_version"])
+                if changed:
+                    commit_msg = (
+                        f"chore(deps): update {prev['artifact_id']} to {prev['release_version']} [sentinel-chain]\n\n"
+                        f"Part of release chain: {' -> '.join(s['repo'] for s in steps)}"
+                    )
+                    try:
+                        compile_ok, compile_out = maven_compile_check(repo.local_path)
+                    except MissingToolError:
+                        compile_ok, compile_out = False, "mvn not installed"
+                    if not compile_ok:
+                        _git(["checkout", "pom.xml"], cwd=repo.local_path, env=_git_env(repo))
+                        msg = f"{step_label}: Maven compile failed for {repo.repo_name} — pom.xml reverted"
+                        results.append({"step": i + 1, "repo": step["repo"], "status": "failed", "error": msg})
+                        slack_alert(cfg.slack_bot_token, cfg.slack_channel, ":x: Chain release failed — " + msg)
+                        break
+                    status, commit_hash = commit_file_change(repo, ["pom.xml"], commit_msg, skip_pull=True)
+                    if status != "committed":
+                        msg = f"{step_label}: git commit failed for {repo.repo_name}"
+                        results.append({"step": i + 1, "repo": step["repo"], "status": "failed", "error": msg})
+                        slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                    f":x: *Chain release failed at {step_label}*\n{msg}")
+                        break
+                    push_r = _git(["push", "origin", repo.branch], cwd=repo.local_path, env=_git_env(repo))
+                    push_ok = push_r.returncode == 0
+                    branch  = repo.branch
+                    pr_url  = ""
+                    if not push_ok:
+                        msg = (f"{step_label}: git push to {repo.branch} failed for {repo.repo_name}: "
+                               + push_r.stderr.strip()[:200])
+                        results.append({"step": i + 1, "repo": step["repo"], "status": "failed", "error": msg})
+                        slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                    ":x: Chain release failed: " + msg)
+                        break
+                    action = f"pushed to `{branch}`"
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":arrow_right: {step_label}: Updated `{repo.repo_name}` "
+                                f"`{prev['artifact_id']}` \u2192 `{prev['release_version']}` ({action})")
+                else:
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":information_source: {step_label}: `{repo.repo_name}` dep already at "
+                                f"`{prev['release_version']}` — skipping pom.xml update")
+            if repo.cicd_job_url and repo.cicd_type:
+                from .cicd_trigger import _maven_release_versions
+                actual_ver, _ = _maven_release_versions(repo.local_path)
+                actual_ver = actual_ver or step["release_version"]
+                success = _trigger_jenkins_release(repo, wait=True)
+                if success:
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":rocket: {step_label}: Jenkins release completed — "
+                                f"`{repo.repo_name}` v{actual_ver}")
+                    results.append({"step": i + 1, "repo": step["repo"], "status": "released",
+                                    "version": actual_ver})
+                else:
+                    msg = f"Jenkins release trigger failed for {repo.repo_name}"
+                    results.append({"step": i + 1, "repo": step["repo"], "status": "failed", "error": msg})
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":x: *Chain release failed at {step_label}*\n{msg}")
+                    break
+            else:
+                slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                            f":information_source: {step_label}: `{repo.repo_name}` has no CI/CD — "
+                            f"pom.xml updated but Jenkins not triggered")
+                results.append({"step": i + 1, "repo": step["repo"], "status": "no_cicd",
+                                "note": "pom.xml updated, no Jenkins trigger configured"})
+        all_ok = all(r.get("status") in ("released", "no_cicd") for r in results)
+        final  = "completed" if all_ok else "partial" if results else "failed"
+        _icon  = ":white_check_mark:" if all_ok else ":warning:"
+        _steps = ", ".join(
+            "`" + r["repo"] + "` " + ("✓" if r.get("status") in ("released", "no_cicd") else "✗")
+            for r in results
+        )
+        slack_alert(
+            cfg.slack_bot_token, cfg.slack_channel,
+            f"{_icon}: *Chain release {final}* — {_steps}",
+        )
+        logger.info("Boss chain_release: %s by %s — %s", final, user_id, results)
+        return json.dumps({"status": final, "steps": results})
+    return json.dumps({"error": f"unknown tool: {name}"})
+def _attachments_to_text(attachments: list[dict]) -> str:
+    if not attachments:
+        return ""
+    parts = []
+    for att in attachments:
+        if att["type"] == "text":
+            parts.append(
+                f"[Attached file: {att['name']}]\n{att['content']}"
+            )
+        elif att["type"] == "image":
+            parts.append(
+                f"[Attached image: {att['name']}] (saved at {att['path']})"
+            )
+        else:
+            parts.append(
+                f"[Attached file: {att['name']}] (saved at {att['path']} — read it if relevant)"
+            )
+    return "\n\nATTACHMENTS:\n" + "\n---\n".join(parts)
+def _attachments_to_api_blocks(attachments: list[dict]) -> list[dict]:
+    blocks: list[dict] = []
+    for att in attachments:
+        if att["type"] == "image":
+            blocks.append({
+                "type": "image",
+                "source": {
+                    "type":       "base64",
+                    "media_type": att.get("mime", "image/png"),
+                    "data":       att["content"],
+                },
+            })
+        elif att["type"] == "text":
+            blocks.append({
+                "type": "text",
+                "text": f"[Attached file: {att['name']}]\n{att['content']}",
+            })
+        else:
+            blocks.append({
+                "type": "text",
+                "text": f"[Attached file: {att['name']}] saved at {att['path']}",
+            })
+    return blocks
+_ACTION_RE = re.compile(r"^ACTION:\s*(\{.*\})", re.MULTILINE)
+async def _handle_with_cli(
+    message: str,
+    history: list,
+    cfg_loader,
+    store,
+    slack_client=None,
+    user_name: str = "",
+    user_id: str = "",
+    attachments: list | None = None,
+    is_admin: bool = False,
+) -> tuple[str, bool]:
+    status_json = await _run_tool("get_status", {"hours": 24}, cfg_loader, store)
+    prs_json    = await _run_tool("list_pending_prs", {}, cfg_loader, store)
+    search_json = ""
+    _search_kws = ("search", "find", "look for", "show me log", "grep", "entries for")
+    if any(kw in message.lower() for kw in _search_kws):
+        quoted = re.findall(r'"([^"]+)"', message)
+        query  = quoted[0] if quoted else message
+        search_json = await _run_tool("search_logs", {"query": query}, cfg_loader, store)
+    paused      = Path("SENTINEL_PAUSE").exists()
+    repos       = list(cfg_loader.repos.keys())
+    log_sources = list(cfg_loader.log_sources.keys())
+    ts          = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+    user_tz = store.get_user_tz(user_id) if user_id else ""
+    if user_tz:
+        try:
+            import zoneinfo as _zi
+            _local = datetime.now(_zi.ZoneInfo(user_tz)).strftime("%Y-%m-%d %H:%M")
+            user_time_hint = f"User's local time ({user_tz}): {_local}"
+        except Exception:
+            user_time_hint = ""
+    else:
+        user_time_hint = ""
+    history_text = ""
+    for msg in history[-8:]:
+        role    = msg["role"].upper()
+        content = msg["content"]
+        if isinstance(content, list):
+            content = " ".join(
+                (b.get("text", "") if isinstance(b, dict) else getattr(b, "text", ""))
+                for b in content
+                if (isinstance(b, dict) and b.get("type") == "text")
+                or (hasattr(b, "type") and b.type == "text")
+            )
+        history_text += f"\n{role}: {content}"
+    slack_mention = f"<@{user_id}>" if user_id else (user_name or "")
+    known_users   = store.get_all_users()
+    users_hint    = ", ".join(f"<@{uid}> = {name}" for uid, name in known_users.items())
+    prompt = (
+        _resolve_system(
+            boss_mode=getattr(cfg_loader.sentinel, "boss_mode", "standard"),
+            project_name=cfg_loader.sentinel.project_name or _read_project_name(Path(".")),
+            project_description=getattr(cfg_loader.sentinel, "project_description", ""),
+            other_project_names=[_read_project_name(d) for d in _find_project_dirs()],
+        )
+        + (f"\nYou are speaking with: {user_name} (Slack mention: {slack_mention})" if user_name else "")
+        + "\nAlways start your reply by addressing the user directly using their Slack mention, e.g. \"<@U123> here is what I found...\"."
+        + " Never use their plain name — always use the <@USER_ID> format so Slack highlights it."
+        + (f"\nKnown Slack users: {users_hint}" if users_hint else "")
+        + f"\n\nCurrent time (UTC): {ts}"
+        + (f"\n{user_time_hint}" if user_time_hint else "")
+        + f"\nSentinel status: {'⏸ PAUSED' if paused else '▶ RUNNING'}"
+        + f"\nManaged repos: {', '.join(repos) if repos else '(none configured)'}"
+        + (f"\nLog sources: {', '.join(log_sources)}" if log_sources else "")
+        + f"\nAdmin access for this user: {'YES — admin tools are available' if is_admin else 'NO — admin tools will be refused'}"
+        + "\nNOTE: Running in CLI fallback mode — admin tools and some features are unavailable. Ask user to configure ANTHROPIC_API_KEY for full features."
+        + f"\n\nCurrent status (last 24 h):\n{status_json}"
+        + f"\n\nOpen PRs:\n{prs_json}"
+        + (f"\n\nLog search results:\n{search_json}" if search_json else "")
+        + (f"\n\nConversation so far:{history_text}" if history_text else "")
+        + _attachments_to_text(attachments or [])
+        + f"\n\nUSER: {message}"
+        + "\n\nIf you need to take an action, include a line like:\n"
+        + "  ACTION: {\"action\": \"pause_sentinel\"}\n"
+        + "  ACTION: {\"action\": \"resume_sentinel\"}\n"
+        + "  ACTION: {\"action\": \"trigger_poll\"}\n"
+        + "  ACTION: {\"action\": \"create_issue\", \"description\": \"...\", \"target_repo\": \"\"}\n"
+        + "  ACTION: {\"action\": \"search_logs\", \"query\": \"<whatever the user asked to find>\"}\n"
+        + "End with [DONE] if the request is fully handled."
+    )
+    cfg = cfg_loader.sentinel
+    env = os.environ.copy()
+    if cfg.anthropic_api_key:
+        env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
+    try:
+        result = subprocess.run(
+            ([cfg.claude_code_bin, "--dangerously-skip-permissions", "--bare", "--print", prompt]
+                    if os.getuid() != 0 else
+                    [cfg.claude_code_bin, "--bare", "--print", prompt]),
+            capture_output=True, text=True, timeout=180, env=env, stdin=subprocess.DEVNULL,
+        )
+        output = (result.stdout or "").strip()
+        if result.returncode != 0 or not output:
+            stderr = (result.stderr or "").strip()
+            logger.error(
+                "Boss CLI call failed (rc=%d): stdout=%r stderr=%r",
+                result.returncode, output[:200], stderr[:200],
+            )
+        raw_err = (result.stderr or "").strip()
+        if result.returncode != 0 and not output:
+            full_err = f"exit {result.returncode}: {raw_err[:300]}"
+            cfg = cfg_loader.sentinel
+            alert_if_rate_limited(cfg.slack_bot_token, cfg.slack_channel,
+                                  "sentinel_boss/cli", raw_err or full_err)
+            return f":warning: `claude --print` failed ({full_err})", True
+    except Exception as e:
+        logger.error("Boss CLI call failed: %s", e)
+        return f":warning: Boss unavailable: {e}", True
+    tools_ran = []
+    for m in _ACTION_RE.finditer(output):
+        try:
+            action = json.loads(m.group(1))
+            name   = action.pop("action", "")
+            if name:
+                result_str = await _run_tool(name, action, cfg_loader, store, user_id=user_id)
+                tools_ran.append(name)
+                logger.info("Boss CLI action: %s → %s", name, result_str[:80])
+        except Exception as e:
+            logger.warning("Boss action parse error: %s", e)
+    reply   = _ACTION_RE.sub("", output).strip()
+    is_done = "[DONE]" in reply
+    reply   = reply.replace("[DONE]", "").strip()
+    if not reply:
+        if tools_ran:
+            reply = f":white_check_mark: Done ({', '.join(tools_ran)})."
+        elif len(message.strip()) <= 12 and not any(c.isalpha() and c not in 'helo wrdHELOWRD' for c in message):
+            greeting = f"Hi {user_name}! " if user_name else "Hi! "
+            reply = f"{greeting}I'm Sentinel, your autonomous DevOps agent. How can I help you?"
+        else:
+            reply = ":thinking_face: I didn't produce a response — please try rephrasing."
+    history.append({"role": "user",      "content": message})
+    history.append({"role": "assistant", "content": reply})
+    return reply, is_done
+def _serialize_content(content) -> list:
+    if not isinstance(content, list):
+        return content
+    result = []
+    for block in content:
+        if isinstance(block, dict):
+            result.append(block)
+        elif hasattr(block, "model_dump"):
+            result.append(block.model_dump())
+        elif hasattr(block, "dict"):
+            result.append(block.dict())
+        elif hasattr(block, "type"):
+            if block.type == "text":
+                result.append({"type": "text", "text": getattr(block, "text", "")})
+            elif block.type == "tool_use":
+                result.append({
+                    "type":  "tool_use",
+                    "id":    getattr(block, "id", ""),
+                    "name":  getattr(block, "name", ""),
+                    "input": getattr(block, "input", {}),
+                })
+        else:
+            result.append({"type": "text", "text": str(block)})
+    return result
+def _clean_history(history: list) -> list:
+    cleaned = []
+    i = 0
+    while i < len(history):
+        turn = history[i]
+        role    = turn.get("role", "")
+        content = turn.get("content", [])
+        if role == "assistant" and isinstance(content, list):
+            has_tool_use = any(
+                (isinstance(b, dict) and b.get("type") == "tool_use")
+                for b in content
+            )
+            if has_tool_use:
+                next_turn = history[i + 1] if i + 1 < len(history) else None
+                next_content = (next_turn or {}).get("content", [])
+                has_result = isinstance(next_content, list) and any(
+                    (isinstance(b, dict) and b.get("type") == "tool_result")
+                    for b in next_content
+                )
+                if not has_result:
+                    i += 1
+                    continue
+        if cleaned and cleaned[-1].get("role") == role:
+            cleaned[-1] = turn
+        else:
+            cleaned.append(turn)
+        i += 1
+    return cleaned
+async def _handle_with_api(
+    message: str,
+    history: list,
+    cfg_loader,
+    store,
+    slack_client=None,
+    user_name: str = "",
+    user_id: str = "",
+    attachments: list | None = None,
+    channel: str = "",
+    is_admin: bool = False,
+) -> tuple[str, bool]:
+    import anthropic
+    api_key = cfg_loader.sentinel.anthropic_api_key or os.environ.get("ANTHROPIC_API_KEY", "")
+    client  = anthropic.Anthropic(api_key=api_key)
+    paused         = Path("SENTINEL_PAUSE").exists()
+    repos          = list(cfg_loader.repos.keys())
+    ts             = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+    known_projects = [_read_project_name(d) for d in _find_project_dirs()]
+    log_sources    = list(cfg_loader.log_sources.keys())
+    slack_mention = f"<@{user_id}>" if user_id else (user_name or "")
+    known_users   = store.get_all_users()
+    users_hint    = ", ".join(f"<@{uid}> = {name}" for uid, name in known_users.items())
+    user_tz       = store.get_user_tz(user_id) if user_id else ""
+    if user_tz:
+        try:
+            import zoneinfo as _zi
+            _local = datetime.now(_zi.ZoneInfo(user_tz)).strftime("%Y-%m-%d %H:%M")
+            user_time_hint = f"User's local time ({user_tz}): {_local}"
+        except Exception:
+            user_time_hint = ""
+    else:
+        user_time_hint = ""
+    _known_projects = [_read_project_name(d) for d in _find_project_dirs()]
+    system = (
+        _resolve_system(
+            boss_mode=getattr(cfg_loader.sentinel, "boss_mode", "standard"),
+            project_name=cfg_loader.sentinel.project_name or _read_project_name(Path(".")),
+            project_description=getattr(cfg_loader.sentinel, "project_description", ""),
+            other_project_names=_known_projects,
+        )
+        + (f"\nYou are speaking with: {user_name} (Slack mention: {slack_mention})" if user_name else "")
+        + "\nAlways start your reply by addressing the user directly using their Slack mention, e.g. \"<@U123> here is what I found...\"."
+        + " Never use their plain name — always use the <@USER_ID> format so Slack highlights it."
+        + (f"\nKnown Slack users: {users_hint}" if users_hint else "")
+        + f"\n\nCurrent time (UTC): {ts}"
+        + (f"\n{user_time_hint}" if user_time_hint else "")
+        + f"\nSentinel status: {'⏸ PAUSED' if paused else '▶ RUNNING'}"
+        + f"\nManaged repos: {', '.join(repos) if repos else '(none configured)'}"
+        + (f"\nLog sources: {', '.join(log_sources)}" if log_sources else "")
+        + (f"\nKnown projects in workspace: {', '.join(known_projects)}" if known_projects else "")
+        + f"\nAdmin access for this user: {'YES — admin tools are available' if is_admin else 'NO — admin tools will be refused'}"
+    )
+    attach_blocks = _attachments_to_api_blocks(attachments or [])
+    if attach_blocks:
+        user_content = attach_blocks + [{"type": "text", "text": message}]
+    else:
+        user_content = message
+    messages = list(history) + [{"role": "user", "content": user_content}]
+    while True:
+        response = client.messages.create(
+            model="claude-opus-4-6",
+            max_tokens=2048,
+            system=system,
+            tools=_TOOLS,
+            messages=messages,
+        )
+        text_parts  = []
+        tool_blocks = []
+        for block in response.content:
+            if block.type == "text":
+                text_parts.append(block.text)
+            elif block.type == "tool_use":
+                tool_blocks.append(block)
+        if not tool_blocks:
+            reply   = " ".join(text_parts).strip()
+            is_done = "[DONE]" in reply
+            reply   = reply.replace("[DONE]", "").strip()
+            if not reply:
+                tools_ran_this_session = any(
+                    m.get("role") == "user" and isinstance(m.get("content"), list)
+                    and any(r.get("type") == "tool_result" for r in m["content"])
+                    for m in messages
+                )
+                if tools_ran_this_session:
+                    reply = ":white_check_mark: Done."
+                elif len(message.strip()) <= 12:
+                    greeting = f"Hi {user_name}! " if user_name else "Hi! "
+                    reply = f"{greeting}I'm Sentinel, your autonomous DevOps agent. How can I help you?"
+                else:
+                    reply = ":thinking_face: I didn't produce a response — please try rephrasing."
+            if is_done and re.search(r'\?\s*$', reply):
+                is_done = False
+            history.append({"role": "user", "content": user_content})
+            history.append({"role": "assistant", "content": _serialize_content(response.content)})
+            return reply, is_done
+        messages.append({"role": "assistant", "content": _serialize_content(response.content)})
+        tool_results = []
+        for tc in tool_blocks:
+            result = await _run_tool(tc.name, tc.input, cfg_loader, store, slack_client=slack_client, user_id=user_id, channel=channel, is_admin=is_admin)
+            logger.info("Boss tool: %s(%s) → %s", tc.name, tc.input, result[:120])
+            tool_results.append({
+                "type":        "tool_result",
+                "tool_use_id": tc.id,
+                "content":     result,
+            })
+        messages.append({"role": "user", "content": tool_results})
+async def handle_message(
+    message: str,
+    history: list,
+    cfg_loader,
+    store,
+    slack_client=None,
+    user_name: str = "",
+    user_id: str = "",
+    attachments: list | None = None,
+    channel: str = "",
+    is_admin: bool = False,
+) -> tuple[str, bool]:
+    api_key = cfg_loader.sentinel.anthropic_api_key or os.environ.get("ANTHROPIC_API_KEY", "")
+    if api_key:
+        try:
+            import anthropic
+            return await _handle_with_api(
+                message, history, cfg_loader, store, slack_client=slack_client,
+                user_name=user_name, user_id=user_id, attachments=attachments, channel=channel,
+                is_admin=is_admin,
+            )
+        except Exception as api_err:
+            err_str = str(api_err)
+            cfg = cfg_loader.sentinel
+            if is_rate_limited(err_str):
+                from .notify import rate_limit_message
+                alert_if_rate_limited(cfg.slack_bot_token, cfg.slack_channel,
+                                      "sentinel_boss/api", err_str)
+            logger.warning("Boss: API key path failed (%s), trying CLI fallback", err_str)
+    cli_reply, cli_done = await _handle_with_cli(
+        message, history, cfg_loader, store, slack_client=slack_client, user_name=user_name,
+        user_id=user_id, attachments=attachments, is_admin=is_admin,
+    )
+    if not cli_reply.startswith(":warning:"):
+        return cli_reply, cli_done
+    cfg = cfg_loader.sentinel
+    err_output = cli_reply
+    alert_if_rate_limited(cfg.slack_bot_token, cfg.slack_channel,
+                          "sentinel_boss/cli", err_output)
+    if not api_key:
+        no_auth_msg = (
+            ":warning: *Sentinel Boss — no Claude auth configured*\n"
+            "Configure at least one of:\n"
+            "• `ANTHROPIC_API_KEY` in `sentinel.properties` — full features\n"
+            "• Claude Pro OAuth: run `claude login` on the server — required for fix_engine\n"
+            "See: https://github.com/misterhuydo/Sentinel
+        )
+        slack_alert(cfg.slack_bot_token, cfg.slack_channel, no_auth_msg)
+        return ":warning: No Claude authentication configured. See Slack for details.", True
+    return cli_reply, cli_done