@quickchatai/quickreview 1.1.0 → 1.3.1

package/src/cli.ts

@@ -68,6 +68,7 @@ import { sanitizeText } from "./tui/paint.js";
 import { operatorCommandWriteScript } from "./tui/unwedge.js";
 import { shellQuote, transportOf } from "./tui/remote.js";
 import { MutationGate } from "@quickchatai/pi-quickreview/src/gate.js";
+import { botAccountLogin, isPersonMode } from "@quickchatai/pi-quickreview/src/identity.js";
 import type { GitHubAdapter } from "./github.js";
 import type { OutcomeCapture } from "./outcomes.js";
 import type { Learner, MineReport } from "./learner/learner.js";
@@ -198,17 +199,18 @@ export async function cmdOutcomes(rest: string[], json: boolean): Promise<number
     const outcomes = new OutcomeCapture({
       store,
       botLogin: cfg.github.bot_login,
+      personMode: isPersonMode(cfg.github),
       ...(existsSync(worktrees.basePath) ? { git: worktrees } : {}),
     });
     const since = new Date(Date.now() - days * 86_400_000).toISOString();
     if (capture) {
       let read: GitHubAdapter | undefined;
       if (readGithub) {
-        const { TokenMinter } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
+        const { githubCredential } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
         const { GitHubAdapter } = await import("./github.js");
         read = new GitHubAdapter(
           cfg,
-          new TokenMinter(cfg.github.secrets_dir),
+          githubCredential(cfg.github),
           recordOnlyGate(join(stateDir(), "dryrun")),
         );
       }
@@ -365,7 +367,8 @@ export async function cmdLessons(rest: string[], json: boolean): Promise<number>
       root,
       eodTime: cfg.eod.time,
       timeZone: cfg.eod.timezone,
-      botLogin: cfg.github.bot_login,
+      // The bot ACCOUNT ("" in person mode, where the person's words are a human's).
+      botLogin: botAccountLogin(cfg.github),
       baseBranch: cfg.github.base_branch,
       config: learnerKnobsOf(cfg.memory),
       ...(existsSync(worktrees.basePath) ? { git: worktrees } : {}),
@@ -703,13 +706,13 @@ export interface DoubtedFinding {
  * when the developer machine carries the app credential. */
 export async function enrichWhy(payload: WhyPayload, secretsDir?: string): Promise<WhyPayload> {
   try {
-    const { TokenMinter } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
+    const { githubCredential } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
     const { GitHubAdapter } = await import("./github.js");
     const cfg = loadConfig();
     const gate = recordOnlyGate(join(stateDir(), "dryrun"), "qcr why");
     const adapter = new GitHubAdapter(
       cfg,
-      new TokenMinter(secretsDir ?? cfg.github.secrets_dir),
+      githubCredential({ ...cfg.github, secrets_dir: secretsDir ?? cfg.github.secrets_dir }),
       gate,
     );
     const convo = await adapter.prConversation(payload.pr, 3);
@@ -928,14 +931,22 @@ export async function cmdBackfill(
   limit: number | undefined,
   json: boolean,
 ): Promise<void> {
-  const { TokenMinter } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
+  const { githubCredential } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
   const { GitHubAdapter } = await import("./github.js");
   const { runBackfill } = await import("./backfill.js");
   const cfg = loadConfig();
+  // The import reads "reviews by the bot's login" as the bot's history. Under
+  // the person's own credential that login is the person's, and their own
+  // reviews are not the bot's: there is nothing this importer can tell apart.
+  if (isPersonMode(cfg.github))
+    throw new Error(
+      'qcr backfill imports a GitHub App\'s review history; under [github] auth = "user" the login is ' +
+        "your own, so your reviews and the bot's cannot be told apart by it — nothing to import",
+    );
   // A gate that can only ever record: the importer performs no mutations, and
   // this keeps that structural rather than prompted.
   const gate = recordOnlyGate(join(stateDir(), "dryrun"), "qcr backfill");
-  const adapter = new GitHubAdapter(cfg, new TokenMinter(cfg.github.secrets_dir), gate);
+  const adapter = new GitHubAdapter(cfg, githubCredential(cfg.github), gate);
   const store = openStore();
   try {
     const stats = await runBackfill(store, adapter, cfg, {
@@ -976,12 +987,12 @@ export async function cmdHistory(rest: string[]): Promise<number> {
   const months = intFlag(rest, "--months", HISTORY_USAGE);
   if (sub === "digest") {
     const limit = intFlag(rest, "--limit", HISTORY_USAGE);
-    const { TokenMinter } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
+    const { githubCredential } = await import("@quickchatai/pi-quickreview/src/githubAuth.js");
     const { GitHubAdapter } = await import("./github.js");
     const { collectReviewHistory } = await import("./reviewhistory.js");
     const cfg = loadConfig();
     const gate = recordOnlyGate(join(stateDir(), "dryrun"), "qcr history");
-    const adapter = new GitHubAdapter(cfg, new TokenMinter(cfg.github.secrets_dir), gate);
+    const adapter = new GitHubAdapter(cfg, githubCredential(cfg.github), gate);
     const store = openStore();
     try {
       const digest = await collectReviewHistory(adapter, store, cfg, {
@@ -1230,12 +1241,13 @@ async function cmdDrain(rest: string[]): Promise<number> {
 // until `qcr resume-pr`, and no session lifts it. The cutover wizard's stage 9
 // pauses every tracked PR but one with it before the drain is lifted.
 
-export const PR_LEVER_USAGE = "usage: qcr pause-pr <pr> [--reason <text>] | qcr resume-pr <pr>";
+export const PR_LEVER_USAGE =
+  "usage: qcr pause-pr <pr> [--reason <text>] | qcr resume-pr <pr> | qcr review-now <pr>";
 
 /** `qcr pause-pr|resume-pr`'s arguments: one PR number, and for a pause an
  * optional `--reason <text>` (the reason the board and `qcr status` show). */
 export function parsePrLeverArgs(
-  verb: "pause-pr" | "resume-pr",
+  verb: "pause-pr" | "resume-pr" | "review-now",
   rest: readonly string[],
 ): import("./tui/prpause.js").PrLeverCommand {
   let pr: number | undefined;
@@ -1251,10 +1263,14 @@ export function parsePrLeverArgs(
   }
   if (pr === undefined) throw new Error(PR_LEVER_USAGE);
   if (verb === "resume-pr") return { command: "resume-pr", pr };
+  if (verb === "review-now") return { command: "review-now", pr };
   return { command: "pause-pr", pr, reason: reason ?? "paused by the operator (qcr pause-pr)" };
 }
 
-async function cmdPrLever(verb: "pause-pr" | "resume-pr", rest: string[]): Promise<number> {
+async function cmdPrLever(
+  verb: "pause-pr" | "resume-pr" | "review-now",
+  rest: string[],
+): Promise<number> {
   const cmd = parsePrLeverArgs(verb, rest);
   const cfg = loadConfig();
   const { runnerFor } = await import("./tui/remote.js");
@@ -1540,6 +1556,7 @@ export async function cmdCompanion(sub: string | undefined): Promise<void> {
       dir: companionGithubDir(),
       repo: full.github.repo,
       secretsDir: full.github.secrets_dir,
+      auth: full.github.auth ?? "app",
     }).refresh();
     console.log(`companion ${cfg.container_name}: ${tokenOutcomeLine(gh)}`);
     const mirror = lc.syncConfigMirror();
@@ -1840,55 +1857,6 @@ export async function cmdSetup(rest: string[]): Promise<number> {
   return 0;
 }
 
-/** `qcr onboard` — the guided setup wizard: pi at the pinned
- * version via npx (works from a bare clone; pi stays a non-dependency), the
- * onboarding prompt + extension + a restricted tool set, then the TUI handoff
- * when the checklist verifies complete. Resumable: run it again after a crash
- * and completed steps are re-verified, not repeated. */
-export async function cmdOnboard(): Promise<number> {
-  const { piPinFromPackageJson, onboardingSessionDir, runOnboard } =
-    await import("./onboard/launch.js");
-  const { checklistComplete } = await import("./onboard/engine.js");
-  const { spawn } = await import("node:child_process");
-  const root = sandboxRoot();
-  // Pin source: config.toml [pi] when it loads; package.json's "qcrPi" block on a
-  // bare clone (config.toml is written later, BY onboarding). Same pinned
-  // version by the rule-7 mirror discipline.
-  let pin: { package: string; version: string } | null = null;
-  try {
-    const { package: pkg, version } = loadConfig().pi;
-    pin = { package: pkg, version };
-  } catch {
-    pin = piPinFromPackageJson(root);
-  }
-  if (!pin)
-    throw new Error(
-      'onboard: pi pin not found (need config.toml [pi] or the package.json "qcrPi" block)',
-    );
-  mkdirSync(onboardingSessionDir(root), { recursive: true });
-  const run = (cmd: string, args: string[]): Promise<number> =>
-    new Promise((resolvePromise) => {
-      const child = spawn(cmd, args, {
-        stdio: "inherit",
-        cwd: root,
-        env: { ...process.env, QCR_ROOT: root },
-      });
-      child.on("error", (err) => {
-        console.error(`onboard: ${cmd} failed to start: ${err.message}`);
-        resolvePromise(1);
-      });
-      child.on("close", (code) => resolvePromise(code ?? 1));
-    });
-  return runOnboard({
-    pin,
-    root,
-    spawn: run,
-    isComplete: () => checklistComplete(join(root, "state")),
-    log: (line) => console.log(line),
-    cliPath: join(root, "dist", "src", "cli.js"),
-  });
-}
-
 export const ARCHIVE_USAGE =
   "usage: qcr archive status [--plan] [--json] | qcr archive run | qcr archive restore <pr> | " +
   "qcr archive extract <pr> --to <dir>";
@@ -2137,6 +2105,16 @@ export async function main(rawArgv: string[]): Promise<void> {
       const { runTui } = await import("./tui/index.js");
       return runTui(rest);
     }
+    case "home": {
+      // the home (src/home/launch.ts): the bin routes a bare `qcr` here too
+      // (src/qcrbin.ts); the image's home mode reaches it through this verb
+      if (rest.length > 0) throw new Error("usage: qcr home");
+      const { homeRunDeps, runHome } = await import("./home/launch.js");
+      // the token taken at startup, when the wrapper handed one over
+      const githubToken = takeHandoffToken();
+      process.exitCode = runHome({ ...homeRunDeps(sandboxRoot()), githubToken: () => githubToken });
+      return;
+    }
     case "companion":
       if (rest.length !== 1) throw new Error("usage: qcr companion <up|down|status|rebuild|plan>");
       return cmdCompanion(rest[0]);
@@ -2144,10 +2122,6 @@ export async function main(rawArgv: string[]): Promise<void> {
       process.exitCode = await cmdMemory(rest);
       return;
     }
-    case "onboard": {
-      process.exitCode = await cmdOnboard();
-      return;
-    }
     case "setup": {
       process.exitCode = await cmdSetup(rest);
       return;
@@ -2157,10 +2131,28 @@ export async function main(rawArgv: string[]): Promise<void> {
       return;
     }
     case "pause-pr":
-    case "resume-pr": {
+    case "resume-pr":
+    case "review-now": {
+      // review-now: the operator's "review this PR now" — queued as a
+      // human-asked round through the sealed operator channel, no label.
       process.exitCode = await cmdPrLever(cmd, rest);
       return;
     }
+    case "github-token": {
+      // The own-account route's token refresher (src/githubtoken.ts): gh's
+      // token → <secrets>/github_token, 0600. The crontab entry runs this.
+      const { cmdGithubToken } = await import("./githubtoken.js");
+      process.exitCode = await cmdGithubToken(rest, {
+        secretsDir: () => {
+          try {
+            return loadConfig().github.secrets_dir;
+          } catch {
+            return locateSecrets({}).path;
+          }
+        },
+      });
+      return;
+    }
     case "message": {
       process.exitCode = await cmdMessage(rest);
       return;
@@ -2238,7 +2230,7 @@ export async function main(rawArgv: string[]): Promise<void> {
     }
     default:
       console.log(
-        "usage: qcr <version|config check [--config-home <dir>]|onboard|setup [validate [<profile>]|commit]|status|spend|today|why <n>|metrics [--pr <n>]|events|takeover <n>|debug-round <n>|release <n>|tui [pr|overseer]|drain <on [--hold]|off>|pause-pr <pr> [--reason <text>]|resume-pr <pr>|message <pr> [--may-post] <text...>|archive <status [--plan]|run|restore <pr>|extract <pr> --to <dir>>|install <where|migrate>|" +
+        "usage: qcr <version|config check [--config-home <dir>]|home|setup [validate [<profile>]|commit]|status|spend|today|why <n>|metrics [--pr <n>]|events|takeover <n>|debug-round <n>|release <n>|tui [pr|overseer]|drain <on [--hold]|off>|pause-pr <pr> [--reason <text>]|resume-pr <pr>|review-now <pr>|github-token sync [--gh <path>] [--secrets-dir <dir>]|message <pr> [--may-post] <text...>|archive <status [--plan]|run|restore <pr>|extract <pr> --to <dir>>|install <where|migrate>|" +
           "companion <up|down|status|rebuild>|review [start|status|stop|branch|--uncommitted|--diff FILE|-|<PR number|URL>] [--repo OWNER/NAME] [--base REF] [--preview] [--key K] [--limit USD] [--json]|live [RUN_ID|DIR] [--lens ID] [--round N] [--follow] [--json]|open [RUN_ID|DIR|FILE.jsonl|scan[:RUN]|pr N [--round R]] [--lens ID] [--write] [--print]|scan <preview|start|status|stop|findings|matches|match|suggestions|stage2 propose|stage2 start|dismiss|units show|units propose|units adjust|units save|login|doctor|rebuild>|memory reembed [--user <name>]|memory relayout [--plan|--apply]|backfill [--dry-run] [--limit <n>]|history <digest|pull>|outcomes [--days <n>] [--capture [--read-github]]|lessons [mine|shadow-report [--days <n>]|off|on|suppress <id>|unsuppress <id>]|checklist|compare <pr...>|" +
           "regression [--set <path>] [--clone <path>] [--change <name>] [--limit <n>] [--out <path>]>",
       );

package/src/cliops.ts

@@ -1,6 +1,7 @@
 // qcr checklist / qcr compare — production wiring of the cutover harnesses. Local
 // runs exercise the offline halves; the live halves (tunnel, real searches,
 // live rounds) light up on the VM where the daemon and pi are running.
+import { botAccountLogin } from "@quickchatai/pi-quickreview/src/identity.js";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { runChecklist, type ChecklistDeps } from "./checklist.js";
@@ -253,7 +254,7 @@ export async function cmdChecklist(parts?: ProductionParts): Promise<number> {
           await p.adapter.searchLabelTriggered(),
           "label",
           cfg.dry_run,
-          cfg.github.bot_login,
+          botAccountLogin(cfg.github),
           store,
         ),
       teamTriggered: async () =>
@@ -261,7 +262,7 @@ export async function cmdChecklist(parts?: ProductionParts): Promise<number> {
           await p.adapter.searchTeamTriggered(),
           "team_request",
           cfg.dry_run,
-          cfg.github.bot_login,
+          botAccountLogin(cfg.github),
           store,
         ),
       derivedQueue: () => derivedQueueOf(store.allPrs(), cfg.dry_run),

package/src/commands.ts

@@ -99,7 +99,10 @@ export const CONTROL_TEXT_MAX = 8000;
  * session's command file cannot spell them: in the session directories, and
  * in an UNSEALED operator directory (served as a session's), they are refused
  * at validation, and `executeCommand` refuses
- * them again for any issuer but the operator. The kill switch's state lives
+ * them again for any issuer but the operator. `review-now` is the operator's
+ * "review this PR now": one PR queued as a human-asked round, exactly as a
+ * fresh trigger label would queue it, with no GitHub write to ask for it (the
+ * onboarding wizard's proof round sends it). The kill switch's state lives
  * in state.db (src/lessonledger.ts), never as a memory tag anyone holding a
  * key could write.
  */
@@ -110,6 +113,7 @@ export const OPERATOR_COMMANDS = [
   "unsuppress-lesson",
   "archive-run",
   "archive-restore",
+  "review-now",
   ...CONTROL_COMMANDS,
 ] as const;
 
@@ -180,6 +184,9 @@ export type Command =
    * valid in a session's file. */
   | { command: "archive-run" }
   | { command: "archive-restore"; pr: number }
+  /** The operator's "review this PR now" (`OPERATOR_COMMANDS`): never valid
+   * in a session's file. */
+  | { command: "review-now"; pr: number }
   /** The operator's round controls (`CONTROL_COMMANDS`): never valid in a
    * session's file. */
   | { command: "steer"; pr: number; text: string }
@@ -263,6 +270,9 @@ export interface CommandDeps {
    * only for an operator-issued command; optional like `drain`. */
   archiveRun?(file: string): Promise<FileOutcome | void> | FileOutcome | void;
   archiveRestore?(pr: number, file: string): Promise<FileOutcome | void> | FileOutcome | void;
+  /** The operator's "review this PR now": queue one PR for a human-asked
+   * round. Reached only for an operator-issued command; optional like `drain`. */
+  reviewNow?(pr: number, file: string): Promise<FileOutcome | void> | FileOutcome | void;
   /** The operator's round controls (`CONTROL_COMMANDS`), forwarded to the PR's
    * host. Reached only for an operator-issued command; optional like `drain`,
    * so a daemon with no worker host refuses them with a reason. */
@@ -338,7 +348,7 @@ export function validateCommand(raw: unknown, opts: ValidateOptions = {}): Valid
         ok: false,
         reason:
           `command '${name}' is the OPERATOR's alone: it is accepted only from the root-sealed commands/operator/ ` +
-          "channel (`qcr lessons off|on|suppress|unsuppress`, `qcr archive run|restore`), never from a session's command file",
+          "channel (`qcr lessons off|on|suppress|unsuppress`, `qcr archive run|restore`, `qcr review-now`), never from a session's command file",
       };
     return validateOperatorCommand(name, obj);
   }
@@ -609,6 +619,12 @@ function validateOperatorCommand(
       if (!isPrNumber(obj["pr"])) return { ok: false, reason: "'pr' must be a positive integer" };
       return { ok: true, command: { command: "archive-restore", pr: obj["pr"] } };
     }
+    case "review-now": {
+      const err = fieldError(obj, ["pr"]);
+      if (err) return { ok: false, reason: err };
+      if (!isPrNumber(obj["pr"])) return { ok: false, reason: "'pr' must be a positive integer" };
+      return { ok: true, command: { command: "review-now", pr: obj["pr"] } };
+    }
     case "steer":
     case "follow-up":
     case "message": {
@@ -971,6 +987,16 @@ export async function executeCommand(
         return { ok: false, reason: "archive-restore is not wired on this daemon" };
       return normalize(await deps.archiveRestore(command.pr, ctx.delivery_key ?? ctx.file));
     }
+    case "review-now": {
+      // The belt behind validation's brace, as for the kill switch.
+      if (ctx.issuer !== "operator")
+        return {
+          ok: false,
+          reason: `'${command.command}' is the operator's alone — refused for issuer '${ctx.issuer}'`,
+        };
+      if (!deps.reviewNow) return { ok: false, reason: "review-now is not wired on this daemon" };
+      return normalize(await deps.reviewNow(command.pr, ctx.delivery_key ?? ctx.file));
+    }
     case "steer":
     case "follow-up":
     case "abort-round":

package/src/config.ts

@@ -974,8 +974,11 @@ function checkSectionTimeZone<T extends { timezone: string }>(section: T, where:
  * what an absent section means) starts nothing at all.
  */
 export interface IngressConfig {
-  /** "none" ⇒ no watcher is ever constructed; "tunnel-file" ⇒ self-heal on. */
-  shape: "none" | "tunnel-file";
+  /** "none" ⇒ no watcher is ever constructed; "tunnel-file" ⇒ self-heal on;
+   * "polling" ⇒ no webhooks at all: the daemon's `/webhook` route refuses
+   * every delivery, no webhook secret is read, and the reconcile poll is the
+   * only trigger. `[github] auth = "user"` requires "polling". */
+  shape: "none" | "tunnel-file" | "polling";
   /** File the tunnel sidecar writes the bare public hostname into. Empty ⇒
    * `<root>/state/ingress/hostname` (see ingressHostnameFile). */
   hostname_file: string;
@@ -994,6 +997,13 @@ export const INGRESS_DEFAULTS: IngressConfig = {
   sweep_interval_s: 300,
 };
 
+/** Does this install take webhooks at all? Not under the polling shape
+ * (and so never under `[github] auth = "user"`, which requires it): there the
+ * `/webhook` route refuses every delivery and no webhook secret is read. */
+export function webhooksEnabled(cfg: Pick<Config, "ingress">): boolean {
+  return cfg.ingress.shape !== "polling";
+}
+
 /** The hostname file's resolved path — the one place the default is spelled. */
 export function ingressHostnameFile(cfg: Config, root: string): string {
   const configured = cfg.ingress.hostname_file.trim();
@@ -1148,6 +1158,43 @@ export interface Config extends CoreConfig {
   /** The bot login's single refresher (`src/loginrefresh/`). Optional
    * in the file; off unless the cutover's config turns it on. */
   login_refresh: LoginRefreshConfig;
+  /** The home, the app's own pi a bare `qcr` opens (src/home/launch.ts).
+   * Optional in the file and here, so hand-rolled configs keep compiling;
+   * the parser fills every key. */
+  home?: HomeConfig;
+}
+
+/** Which tools the home's model may call: `reviewer` is the plugin's tools,
+ * the home's own `home_*` tools and pi's read tools; `full` is all of pi's. */
+export type HomeToolSet = "reviewer" | "full";
+
+/** `[home]`: the home a bare `qcr` opens (src/home/launch.ts reads it). */
+export interface HomeConfig {
+  /** The chat's model, `provider/id`. The panel's login line counts only
+   * this model's provider as signed in. */
+  model: string;
+  tools: HomeToolSet;
+}
+
+export const HOME_DEFAULTS: Readonly<HomeConfig> = {
+  model: "openai-codex/gpt-6.1-sol",
+  tools: "reviewer",
+};
+
+/** `[home]`, every key defaulted; a value of the wrong kind is refused. */
+export function parseHomeSection(raw: unknown): HomeConfig {
+  const t = (raw ?? {}) as Record<string, unknown>;
+  const model = t["model"] ?? HOME_DEFAULTS.model;
+  if (typeof model !== "string" || !/^[^/\s]+\/\S+$/.test(model))
+    throw new Error(
+      `config.toml [home]: model must be "provider/id" (got ${JSON.stringify(model)})`,
+    );
+  const tools = t["tools"] ?? HOME_DEFAULTS.tools;
+  if (tools !== "reviewer" && tools !== "full")
+    throw new Error(
+      `config.toml [home]: tools must be "reviewer" or "full" (got ${JSON.stringify(tools)})`,
+    );
+  return { model, tools };
 }
 
 /**
@@ -1729,9 +1776,19 @@ export function parseConfig(toml: string): Config {
     ...INGRESS_DEFAULTS,
     ...((raw.ingress ?? {}) as Partial<IngressConfig>),
   };
-  if (!["none", "tunnel-file"].includes(ingress.shape)) {
+  if (!["none", "tunnel-file", "polling"].includes(ingress.shape)) {
+    throw new Error(
+      `config.toml [ingress]: shape must be "none", "tunnel-file" or "polling" (got ${JSON.stringify(ingress.shape)})`,
+    );
+  }
+  // The person's own credential has no webhook: GitHub delivers webhooks to
+  // an App, and the person has none. So that mode is polling-only, and any
+  // other shape is refused here rather than left to run half-wired.
+  if (github.auth === "user" && ingress.shape !== "polling") {
     throw new Error(
-      `config.toml [ingress]: shape must be "none" or "tunnel-file" (got ${JSON.stringify(ingress.shape)})`,
+      `config.toml: [github] auth = "user" runs polling-only — set [ingress] shape = "polling" ` +
+        `(got ${JSON.stringify(ingress.shape)}${raw.ingress === undefined ? ", the default for an absent [ingress]" : ""}). ` +
+        `Webhooks and the webhook self-heal need a GitHub App: use auth = "app" for them.`,
     );
   }
   const cfg: Config = {
@@ -1802,6 +1859,7 @@ export function parseConfig(toml: string): Config {
       (raw.login_refresh ?? {}) as Record<string, unknown>,
       Number((req(raw, "daemon") as { round_deadline_min?: number }).round_deadline_min ?? 75),
     ),
+    home: parseHomeSection(raw.home),
   };
   validateReviewSection(cfg);
   foldLegacyOwnerSlackId(raw, cfg.owner);

package/src/daemon.ts

@@ -18,6 +18,7 @@ import {
   DEFAULT_POSTING_RETRY_WINDOW_MIN,
   loadConfig,
   sandboxRoot,
+  webhooksEnabled,
   type Config,
 } from "./config.js";
 import { dispatchOnce, type DispatchAdapter, type PreparedTree } from "./dispatch.js";
@@ -30,7 +31,13 @@ import {
 } from "./eventloop.js";
 import { MutationGate, type MutationIntent } from "@quickchatai/pi-quickreview/src/gate.js";
 import { GitHubAdapter } from "./github.js";
-import { appActorAlias, TokenMinter } from "@quickchatai/pi-quickreview/src/githubAuth.js";
+import { githubCredential } from "@quickchatai/pi-quickreview/src/githubAuth.js";
+import {
+  botAccountLogin,
+  isPersonMode,
+  ownActorAlias,
+  ownLogins,
+} from "@quickchatai/pi-quickreview/src/identity.js";
 import { REVIEW_SET_ASIDE_STALE_WINDOW_MS, type FeedbackEvent } from "./feedback.js";
 import { enforceLedgerFreshness } from "./ledgercheck.js";
 import { readLedgerCarry } from "@quickchatai/pi-quickreview/src/ledgercarry.js";
@@ -57,7 +64,13 @@ import {
 } from "./recheck.js";
 import type { DispatchAnnouncer, VerdictAnnouncer } from "./slack/announce.js";
 import { applyEvent } from "./statemachine.js";
-import { buildPipelineStatus, buildStatusSnapshot, StateStore, writeStatusJson } from "./state.js";
+import {
+  buildPipelineStatus,
+  buildStatusSnapshot,
+  StateStore,
+  writeStatusJson,
+  type OpenPrsSnapshot,
+} from "./state.js";
 import { PiAuthWatch } from "@quickchatai/pi-quickreview/src/authwatch.js";
 import { SessionCommandSupervisor } from "./session-command-supervisor.js";
 import { readRoundProgress } from "./requiredpasses.js";
@@ -313,13 +326,18 @@ export interface Daemon {
   firstHealthyReconcileAt(): Date | null;
 }
 
+/** The webhook HMAC secret — or "" under the polling shape, which takes no
+ * webhooks and needs no secret (the `/webhook` route then refuses every
+ * delivery, webhook.ts). `[github] auth = "user"` is always polling. */
 function readWebhookSecret(cfg: Config): string {
+  if (!webhooksEnabled(cfg)) return "";
   return readFileSync(join(cfg.github.secrets_dir, "webhook_secret"), "utf8").trim();
 }
 
-/** The real adapter: token minter → mutation gate (dry-run aware) → adapter. */
+/** The real adapter: credential (`[github] auth`) → mutation gate (dry-run
+ * aware) → adapter. */
 function buildGitHubAdapter(cfg: Config, stateDir: string): GitHubAdapter {
-  const minter = new TokenMinter(cfg.github.secrets_dir);
+  const minter = githubCredential(cfg.github);
   const gate: MutationGate = new MutationGate(
     cfg.dry_run,
     join(stateDir, "dryrun"),
@@ -496,7 +514,8 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
         dir: join(stateDir, "posting-receipts"),
         repo: cfg.github.repo,
         dryRun: cfg.dry_run,
-        botLogins: [cfg.github.bot_login, `${cfg.github.app_slug}[bot]`],
+        botLogins: ownLogins(cfg.github),
+        personMode: isPersonMode(cfg.github),
         adapter: deps.postingDelivery,
         current: (job) => {
           const pr = store.getPr(job.pr);
@@ -587,7 +606,7 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
     log,
     isDraining: () => store.drainState().draining,
     botLogin: cfg.github.bot_login,
-    ownerActorAlias: appActorAlias(cfg.github.bot_login, cfg.github.app_slug),
+    ownerActorAlias: ownActorAlias(cfg.github),
     // The author asked for a person on a review thread.
     //
     // There is no park to put them in: the state event is a deliberate no-op
@@ -606,7 +625,7 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
         { type: "human_requested" },
         {},
         {
-          botLogin: cfg.github.bot_login,
+          botLogin: botAccountLogin(cfg.github),
           reason: "pingpong:human-requested",
         },
       );
@@ -806,10 +825,15 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
   const outcomes = new OutcomeCapture({
     store,
     botLogin: cfg.github.bot_login,
+    personMode: isPersonMode(cfg.github),
     ...(deps.outcomeGit ? { git: deps.outcomeGit } : {}),
     ...(deps.now ? { now: deps.now } : {}),
   });
 
+  /** The open PRs the last listing reconcile pass saw (status.json `open_prs`). */
+  let openPrs: OpenPrsSnapshot | undefined;
+  /** The last reconcile pass (status.json `poll`): null until one has ended. */
+  let lastPoll: { at: string; ok: boolean; error?: string } | null = null;
   let firstReconcileSeen = false;
   let firstHealthyReconcileAt: Date | null = null;
   // Deploy-window drain auto-lift: only the boot's first reconcile pass may
@@ -866,6 +890,7 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
     const bootFirstPass = !firstReconcileSeen;
     firstReconcileSeen = true;
     let completed = false;
+    let thrown: unknown = undefined;
     await guard("reconcile", async () => {
       const report = await reconcileOnce({
         cfg,
@@ -892,7 +917,17 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
         // sweep reads session transcripts and is not needed for that, so it
         // starts on the next pass to keep the boot pass short.
         receiptSweep: !bootFirstPass,
+      }).catch((err: unknown) => {
+        thrown = err;
+        throw err;
       });
+      lastPoll = {
+        at: report.ran_at,
+        ok: report.errors.length === 0,
+        ...(report.errors[0] !== undefined ? { error: report.errors[0] } : {}),
+      };
+      // The board's "review a PR" list: kept from the last pass that listed.
+      if (report.open_list) openPrs = { listed_at: report.ran_at, prs: report.open_list };
       log(
         `reconcile: open=${report.open_prs} triggered=${report.triggered.length} ` +
           `closed=${report.closed.length} captured=${report.captured_comments} ` +
@@ -933,6 +968,15 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
       }
       completed = true;
     });
+    if (thrown !== undefined)
+      lastPoll = {
+        at: (deps.now ? deps.now() : new Date()).toISOString(),
+        ok: false,
+        error: `the reconcile pass failed: ${thrown instanceof Error ? thrown.message : JSON.stringify(thrown)}`,
+      };
+    // The poll's outcome reaches status.json now, not at the next heartbeat:
+    // "working" is judged on it.
+    writeStatus();
     return completed;
   };
 
@@ -1097,6 +1141,13 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
               ...(job.deferred_at ? { deferred_since: job.deferred_at } : {}),
             };
         }
+      if (openPrs) snapshot.open_prs = openPrs;
+      snapshot.poll = {
+        last_at: lastPoll?.at ?? null,
+        ok: lastPoll?.ok ?? null,
+        ...(lastPoll?.error !== undefined ? { error: lastPoll.error } : {}),
+        interval_s: cfg.daemon.poll_interval_s,
+      };
       if (deps.runHost) snapshot.run_host = deps.runHost;
       writeStatusJson(stateDir, snapshot);
     } catch (err) {

package/src/debuground.ts

@@ -123,6 +123,8 @@ export interface DebugRoundSpec {
   cwd: string;
   /** The login's owner dir: read-only, borrowed from. */
   agent_dir: string;
+  /** The login's dir when it is not `agent_dir` (the worker spec's). */
+  login_dir?: string;
   /** Where the pi's own agent dir (the blanked login copy) is made. */
   borrow_dir: string;
   /** The window the borrowed login must outlast. */
@@ -603,6 +605,7 @@ export class DebugRoundManager {
       root: spec.root,
       cwd: spec.cwd,
       agent_dir: spec.agent_dir,
+      ...(spec.login_dir !== undefined ? { login_dir: spec.login_dir } : {}),
       borrow_dir: borrow,
       idle_ms: this.idleMs,
       ...(file !== undefined ? { session_file: file } : {}),