lastlight 0.1.15 → 0.2.0

package/deploy/native/lastlight.env.example

@@ -0,0 +1,95 @@
+# ── Last Light — Native deploy env (systemd EnvironmentFile) ────────────
+# Path on the host: /etc/lastlight/lastlight.env
+# Mode 0640, owned by root:lastlight.
+#
+# Anything marked CHANGE_ME must be replaced before the service will start
+# (install.sh refuses to start the unit while placeholders are present).
+
+# ── GitHub App (required) ─────────────────────────────────────────────────
+GITHUB_APP_ID=CHANGE_ME
+GITHUB_APP_INSTALLATION_ID=CHANGE_ME
+# PEM is read by the harness at boot. install.sh locks down permissions if
+# you place it at /etc/lastlight/app.pem before running.
+GITHUB_APP_PRIVATE_KEY_PATH=/etc/lastlight/app.pem
+
+# Webhook receiver
+WEBHOOK_SECRET=CHANGE_ME
+# Listener port — Caddy/Nginx should reverse-proxy 443 → 127.0.0.1:PORT.
+PORT=8644
+
+# ── Model + provider API key ─────────────────────────────────────────────
+# pi-ai supports anthropic/…, openai/…, openrouter/<vendor>/<model>.
+LASTLIGHT_MODEL=anthropic/claude-sonnet-4-6
+# Set whichever matches LASTLIGHT_MODEL (or several if LASTLIGHT_MODELS
+# routes different phases to different providers).
+ANTHROPIC_API_KEY=CHANGE_ME
+# OPENAI_API_KEY=
+# OPENROUTER_API_KEY=
+
+# ── OpenTelemetry (optional, disabled by default) ────────────────────────
+# LASTLIGHT_OTEL_ENABLED=false
+# LASTLIGHT_OTEL_SERVICE_NAME=lastlight
+# LASTLIGHT_OTEL_INCLUDE_CONTENT=false
+# LASTLIGHT_OTEL_FORWARD_TO_SANDBOX=true
+# LASTLIGHT_OTEL_STRICT=false
+# OTEL_EXPORTER_OTLP_ENDPOINT=https://CHANGE_ME
+# OTEL_EXPORTER_OTLP_HEADERS=authorization=Bearer CHANGE_ME
+# docker backend routes sandbox telemetry through an in-network otel-collector
+# (re-exports to the endpoint above; headers stay host-side, any port works).
+# LASTLIGHT_OTEL_COLLECTOR_HOSTS is only used by the gondolin egress allowlist.
+# LASTLIGHT_OTEL_COLLECTOR_HOSTS=CHANGE_ME
+
+# Per-task model overrides (optional). JSON keyed by phase/skill name.
+# LASTLIGHT_MODELS={"architect":"openai/gpt-5.5","triage":"anthropic/claude-haiku-4-5-20251001"}
+
+# ── Web search (optional, explore workflow only) ─────────────────────────
+# Set any one to enable agentic-pi's `web_search` / `web_fetch` tools for
+# the explore workflow. Provider auto-detected from whichever key is set
+# (Tavily > Exa > Brave). Other workflows ignore these keys.
+# TAVILY_API_KEY=tvly-...
+# BRAVE_SEARCH_API_KEY=BSA...
+# EXA_API_KEY=...
+
+# Reasoning-effort default + per-task overrides (optional).
+# Values: off | minimal | low | medium | high | xhigh
+# LASTLIGHT_THINKING=medium
+# LASTLIGHT_THINKINGS={"architect":"high","reviewer":"high"}
+
+# ── Sandbox backend ───────────────────────────────────────────────────────
+# gondolin = agentic-pi's QEMU micro-VM (default, requires /dev/kvm).
+# docker   = sibling docker containers (requires docker socket access).
+# none     = unsandboxed in-process (dev only — agent reads/writes host fs).
+LASTLIGHT_SANDBOX=gondolin
+
+# ── State paths ───────────────────────────────────────────────────────────
+# systemd's StateDirectory= grants /var/lib/lastlight with the right mode.
+STATE_DIR=/var/lib/lastlight
+DB_PATH=/var/lib/lastlight/lastlight.db
+LASTLIGHT_SESSIONS_DIR=/var/lib/lastlight/agent-sessions
+
+# ── Admin dashboard ───────────────────────────────────────────────────────
+# HMAC secret for session tokens. Generate with: openssl rand -hex 32
+ADMIN_SECRET=CHANGE_ME
+# Optional: require a password for the dashboard. Leave unset to allow
+# anyone who can reach the listener (i.e. anyone past Caddy).
+# ADMIN_PASSWORD=
+
+# ── Slack (optional) ──────────────────────────────────────────────────────
+# Setting SLACK_BOT_TOKEN enables the chat skill and the Slack connector.
+# SLACK_BOT_TOKEN=xoxb-…
+# SLACK_APP_TOKEN=xapp-…
+# SLACK_DELIVERY_CHANNEL=C0123456789
+# SLACK_ALLOWED_USERS=U0123,U0456
+
+# Slack OAuth for dashboard login (optional)
+# SLACK_OAUTH_CLIENT_ID=
+# SLACK_OAUTH_CLIENT_SECRET=
+# SLACK_OAUTH_REDIRECT_URI=https://your-domain/admin/auth/slack/callback
+# SLACK_ALLOWED_WORKSPACE=
+
+# ── Approval gates (optional) ─────────────────────────────────────────────
+# Comma-separated list of gate names that should pause the runner.
+# APPROVAL_GATES=post_architect,post_reviewer
+
+# ── Bootstrap label (optional) ────────────────────────────────────────────
+# BOOTSTRAP_LABEL=lastlight:bootstrap

package/deploy/native/lastlight.service

@@ -0,0 +1,50 @@
+[Unit]
+Description=Last Light — GitHub repository maintenance agent
+Documentation=https://github.com/cliftonc/lastlight
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=lastlight
+Group=lastlight
+# gondolin needs /dev/kvm — group `kvm` is the standard accessor on Debian/Ubuntu.
+SupplementaryGroups=kvm
+
+WorkingDirectory=/opt/lastlight
+ExecStart=/usr/bin/node /opt/lastlight/dist/index.js
+EnvironmentFile=/etc/lastlight/lastlight.env
+
+# HOME drives where agentic-pi caches the gondolin guest image
+# (~/.cache/agentic-pi/images/). Pin it to the StateDirectory so the cache
+# survives redeploys and isn't recomputed on every restart.
+Environment=HOME=/var/lib/lastlight
+Environment=NODE_ENV=production
+
+Restart=on-failure
+RestartSec=5s
+LimitNOFILE=65536
+# 2 GB matches the docker-compose limit. Bursts during webhook fan-out +
+# in-process pi-ai chat; per-task gondolin VMs have their own memory budget.
+MemoryMax=2G
+
+# /var/lib/lastlight created with mode 0750, owned by lastlight:lastlight
+StateDirectory=lastlight
+StateDirectoryMode=0750
+LogsDirectory=lastlight
+LogsDirectoryMode=0750
+
+# Security hardening — the harness only writes to its state dir and logs.
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ReadWritePaths=/var/lib/lastlight /var/log/lastlight
+# Explicit /dev/kvm rule — ProtectSystem=strict alone doesn't gate /dev.
+DeviceAllow=/dev/kvm rw
+
+[Install]
+WantedBy=multi-user.target

package/deploy/sandbox-entrypoint.sh

@@ -1,76 +1,93 @@
 #!/usr/bin/env bash
 # Sandbox container entrypoint — runs as root after volumes are mounted.
-# Sets up permissions, Claude auth, skills, agent-context, MCP config,
-# git identity, then drops to agent user via gosu.
+# Used only when LASTLIGHT_SANDBOX=docker (the gondolin sandbox runs in
+# process and doesn't go through this script). Fixes permissions, writes
+# AGENTS.md, sets up git identity, then drops to the agent user via gosu.
 set -euo pipefail
 
 AGENT_HOME="/home/agent"
 WORKSPACE="$AGENT_HOME/workspace"
+# LASTLIGHT_WORKSPACE and LASTLIGHT_GIT_CREDENTIALS are set as image-level
+# ENV in sandbox.Dockerfile so they're visible to every `docker exec` call
+# the harness makes (not just the entrypoint's PID-1 tree). They show up in
+# this shell's env via that mechanism; no export needed here.
 
 # ── Fix workspace ownership (bind-mounts may be root-owned on macOS) ──
 chown -R agent:agent "$WORKSPACE" 2>/dev/null || true
 chown agent:agent "$AGENT_HOME"
 
-# ── ~/.claude as a real directory ──
-# Skills symlinked from baked-in /app/skills. Auth linked from shared volume.
-mkdir -p "$AGENT_HOME/.claude"
-chown agent:agent "$AGENT_HOME/.claude"
+# Ensure ~/.config exists and is agent-owned before any root-side mkdir
+# below claims it (some tools write here at startup).
+mkdir -p "$AGENT_HOME/.config"
+chown agent:agent "$AGENT_HOME/.config"
 
-# Skills: direct symlink to baked-in path
-ln -sfn /app/skills "$AGENT_HOME/.claude/skills"
+# ── Shared package-manager cache (issue #107) ──
+# /cache is a Docker named volume shared across every sandbox so npm / pnpm /
+# yarn reuse already-downloaded tarballs. A freshly-created volume is root-owned,
+# and a cache seeded by an older image (when `agent` had a different UID) leaves
+# children owned by the wrong UID — which blocks npm/pnpm/yarn writes (e.g.
+# /cache/npm/_logs). Self-heal: if the subdir OR any immediate child isn't
+# agent-owned, chown -R it. The recursive pass runs only when something is
+# actually wrong, so a warm, correctly-owned cache stays cheap.
+if [ -d /cache ]; then
+  for sub in npm pnpm yarn; do
+    mkdir -p "/cache/$sub"
+    if [ -n "$(find "/cache/$sub" -maxdepth 1 ! -user agent -print -quit 2>/dev/null)" ]; then
+      chown -R agent:agent "/cache/$sub" 2>/dev/null || true
+    fi
+  done
+fi
 
-# Keep the shared app PEM unreadable by the unprivileged agent by default.
+# ── App PEM: keep shared copy unreadable by the agent by default ──
 if [ -f /data/secrets/app.pem ]; then
   chmod 600 /data/secrets/app.pem 2>/dev/null || true
 fi
 
 # Optionally materialize an agent-readable PEM for high-trust runs only.
+# The harness forwards GITHUB_APP_PRIVATE_KEY_PATH into the sandbox env so
+# any tool inside that needs the App key can find it.
 if [ "${ALLOW_APP_PEM:-0}" = "1" ] && [ -f /data/secrets/app.pem ]; then
-  cp /data/secrets/app.pem "$AGENT_HOME/.claude/app.pem"
-  chown agent:agent "$AGENT_HOME/.claude/app.pem"
-  chmod 600 "$AGENT_HOME/.claude/app.pem"
-  export GITHUB_APP_PRIVATE_KEY_PATH="$AGENT_HOME/.claude/app.pem"
+  cp /data/secrets/app.pem "$AGENT_HOME/.config/app.pem"
+  chown agent:agent "$AGENT_HOME/.config/app.pem"
+  chmod 600 "$AGENT_HOME/.config/app.pem"
+  export GITHUB_APP_PRIVATE_KEY_PATH="$AGENT_HOME/.config/app.pem"
 else
   export GITHUB_APP_PRIVATE_KEY_PATH=""
 fi
 
-# Auth: link children of shared claude-home (sessions, settings, etc.)
-if [ -d /data/claude-home ]; then
-  # Ensure auth files are readable by agent (they may be owned by a different user)
-  chmod -R a+rX /data/claude-home/ 2>/dev/null || true
-  chmod a+r /data/claude-home/.credentials.json 2>/dev/null || true
-
-  for item in /data/claude-home/* /data/claude-home/.credentials.json /data/claude-home/.claude.json; do
-    [ ! -e "$item" ] && continue
-    base="$(basename "$item")"
-    [ "$base" = "skills" ] && continue  # don't override our skills
-    ln -sfn "$item" "$AGENT_HOME/.claude/$base"
-  done
-
-  # Ensure session logs are written to the shared volume so the dashboard can read them
-  mkdir -p /data/claude-home/projects
-  chown agent:agent /data/claude-home/projects
-  ln -sfn /data/claude-home/projects "$AGENT_HOME/.claude/projects"
+# ── AGENTS.md — agentic-pi auto-loads this from cwd as the agent's
+# system context (same convention as CLAUDE.md). ──
+if [ ! -f "$WORKSPACE/AGENTS.md" ]; then
+  cat /app/agent-context/*.md > "$WORKSPACE/AGENTS.md" 2>/dev/null || true
 fi
-
-# ── Agent context (CLAUDE.md) into workspace root ──
-cat /app/agent-context/*.md > "$WORKSPACE/CLAUDE.md" 2>/dev/null || true
-chown agent:agent "$WORKSPACE/CLAUDE.md" 2>/dev/null || true
-
-# ── MCP config from template ──
-envsubst '$GITHUB_APP_ID $GITHUB_APP_INSTALLATION_ID $GITHUB_APP_PRIVATE_KEY_PATH $GITHUB_TOKEN' \
-  < /app/mcp-config.tmpl.json > "$WORKSPACE/.mcp.json"
-chown agent:agent "$WORKSPACE/.mcp.json"
+chown agent:agent "$WORKSPACE/AGENTS.md" 2>/dev/null || true
 
 # ── Git identity and auth (system-wide so it applies regardless of exec user) ──
 git config --system user.name "last-light[bot]"
 git config --system user.email "last-light[bot]@users.noreply.github.com"
 
-# If the harness passed a GIT_TOKEN, set up credential helper so git just works
 if [ -n "${GIT_TOKEN:-}" ]; then
-  git config --system credential.helper \
-    '!f() { echo "username=x-access-token"; echo "password='"$GIT_TOKEN"'"; }; f'
+  # Reject tokens containing characters that would break the URL line in
+  # the credentials file (newline, '@', ':', '/', whitespace). Real GitHub
+  # tokens are alphanumeric + underscore — the wider charset here is
+  # defensive against future format changes.
+  if ! printf %s "$GIT_TOKEN" | grep -Eq '^[A-Za-z0-9_-]+$'; then
+    echo "ERROR: GIT_TOKEN contains characters outside [A-Za-z0-9_-]; refusing to write credentials file" >&2
+    exit 1
+  fi
+  # Write the file as the agent user (mode 600) so the helper can read it
+  # after the entrypoint drops privileges. Path is set by us above; the
+  # `store --file=<path>` value goes into git's config as argv-split (no
+  # shell), so the only constraint is no-whitespace in the path.
+  install -m 600 -o agent -g agent /dev/null "$LASTLIGHT_GIT_CREDENTIALS"
+  printf 'https://x-access-token:%s@github.com\n' "$GIT_TOKEN" > "$LASTLIGHT_GIT_CREDENTIALS"
+  chown agent:agent "$LASTLIGHT_GIT_CREDENTIALS"
+  git config --system credential.helper "store --file=$LASTLIGHT_GIT_CREDENTIALS"
 fi
 
+# ── Sentinel for harness waitForReady() ──
+touch "$WORKSPACE/.ready"
+chown agent:agent "$WORKSPACE/.ready"
+
 # ── Drop to agent user ──
 exec gosu agent "$@"

package/dist/admin/auth.d.ts

@@ -1,5 +1,5 @@
 import type { Context, Next } from "hono";
-export declare function createToken(secret: string, method?: "password" | "slack"): string;
+export declare function createToken(secret: string, method?: "password" | "slack" | "github"): string;
 export declare function verifyToken(token: string, secret: string): boolean;
 export declare function authMiddleware(password: string, secret: string): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
     error: string;

package/dist/admin/auth.js

@@ -41,7 +41,9 @@ export function authMiddleware(password, secret) {
             path.endsWith("/health") ||
             path.endsWith("/auth-required") ||
             path.endsWith("/oauth/slack/authorize") ||
-            path.endsWith("/oauth/slack/callback")) {
+            path.endsWith("/oauth/slack/callback") ||
+            path.endsWith("/oauth/github/authorize") ||
+            path.endsWith("/oauth/github/callback")) {
             return next();
         }
         const header = c.req.header("Authorization");

package/dist/admin/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/admin/auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS;AAErD,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAA6B;IACvE,MAAM,OAAO,GAAqC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC7G,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAyB,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,IACE,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QACjC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzC,4CAA4C;QAC5C,IACE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EACtC,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,8DAA8D;QAC9D,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAEtD,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/admin/auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS;AAErD,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAwC;IAClF,MAAM,OAAO,GAAqC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC7G,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAyB,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,IACE,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QACjC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzC,4CAA4C;QAC5C,IACE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EACvC,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,8DAA8D;QAC9D,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAEtD,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/admin/chat-session-reader.d.ts

@@ -1,22 +1,25 @@
 import type { StateDb } from "../state/db.js";
-import type { SessionSource, SessionMeta, JsonlMessage } from "./sessions.js";
+import { SessionLog, type JsonlMessage } from "../session-log.js";
+import type { SessionSource, SessionMeta } from "./sessions.js";
 /**
  * DB-backed chat-session reader. Drop-in replacement for SessionReader on
  * the chat path: same public surface (`mountSessionRoutes` works against it
  * unchanged), but listing comes from the executions table grouped by Slack
  * thread, and message reads target the single jsonl file owned by that
- * thread's agent SDK session id — no scanning of unrelated `agent-*.jsonl`
- * sidechain files in `claude-home/projects/-app/`.
+ * thread's pi-ai session id. SessionLog owns the on-disk CHAT_PROJECT_SLUG
+ * path resolution, so this reader does not scan unrelated `agent-*.jsonl`
+ * sidechain files from other in-process Agent SDK runs.
  *
  * Conceptual mapping:
  * - SessionMeta.id      ← messaging_session.id (= Slack thread / executions.trigger_id)
- * - jsonl on disk       ← claude-home/projects/-app/<agent_session_id>.jsonl
- *                         (resolved via messaging_sessions.agent_session_id)
+ * - jsonl on disk       ← SessionLog CHAT_PROJECT_SLUG file for
+ *                         messaging_sessions.agent_session_id
  */
 export declare class ChatSessionReader implements SessionSource {
     private db;
-    private claudeHomeDir;
-    constructor(db: StateDb, claudeHomeDir: string);
+    private sessionLog;
+    constructor(db: StateDb, sessionsHomeDir: string);
+    constructor(db: StateDb, sessionLog: SessionLog);
     /** All chat thread ids (= Slack threads) that have at least one chat execution. */
     listSessionIds(): string[];
     exists(id: string): boolean;
@@ -32,11 +35,5 @@ export declare class ChatSessionReader implements SessionSource {
      * Agent SDK installation).
      */
     getFilePath(id: string): string | null;
-    /**
-     * Read one specific jsonl file end-to-end. Crucially, we DO NOT walk
-     * sibling `agent-*.jsonl` files like SessionReader does — those are
-     * unrelated sidechain spawns from other in-process Agent SDK runs and
-     * would pollute the conversation view.
-     */
-    private readSingleFile;
+    normalizeRawLine(raw: Record<string, unknown>): JsonlMessage[];
 }

package/dist/admin/chat-session-reader.js

@@ -1,38 +1,38 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as readline from "node:readline";
-import { unwrapLine } from "./sessions.js";
+import { CHAT_PROJECT_SLUG, SessionLog, } from "../session-log.js";
 /**
  * DB-backed chat-session reader. Drop-in replacement for SessionReader on
  * the chat path: same public surface (`mountSessionRoutes` works against it
  * unchanged), but listing comes from the executions table grouped by Slack
  * thread, and message reads target the single jsonl file owned by that
- * thread's agent SDK session id — no scanning of unrelated `agent-*.jsonl`
- * sidechain files in `claude-home/projects/-app/`.
+ * thread's pi-ai session id. SessionLog owns the on-disk CHAT_PROJECT_SLUG
+ * path resolution, so this reader does not scan unrelated `agent-*.jsonl`
+ * sidechain files from other in-process Agent SDK runs.
  *
  * Conceptual mapping:
  * - SessionMeta.id      ← messaging_session.id (= Slack thread / executions.trigger_id)
- * - jsonl on disk       ← claude-home/projects/-app/<agent_session_id>.jsonl
- *                         (resolved via messaging_sessions.agent_session_id)
+ * - jsonl on disk       ← SessionLog CHAT_PROJECT_SLUG file for
+ *                         messaging_sessions.agent_session_id
  */
 export class ChatSessionReader {
     db;
-    claudeHomeDir;
-    constructor(db, claudeHomeDir) {
+    sessionLog;
+    constructor(db, sessionsHomeDirOrLog) {
         this.db = db;
-        this.claudeHomeDir = claudeHomeDir;
+        this.sessionLog = typeof sessionsHomeDirOrLog === "string"
+            ? new SessionLog(sessionsHomeDirOrLog)
+            : sessionsHomeDirOrLog;
     }
     /** All chat thread ids (= Slack threads) that have at least one chat execution. */
     listSessionIds() {
         // Soft cap at 500 — anything older than that almost certainly won't be
         // surfaced after the dashboard's per-tab filters anyway.
-        return this.db.listChatThreads(500).map((t) => t.triggerId);
+        return this.db.executions.listChatThreads(500).map((t) => t.triggerId);
     }
     exists(id) {
-        return this.db.getChatThread(id) !== null;
+        return this.db.executions.getChatThread(id) !== null;
     }
     async getSessionMeta(id) {
-        const t = this.db.getChatThread(id);
+        const t = this.db.executions.getChatThread(id);
         if (!t)
             return null;
         const startedAt = new Date(t.firstStartedAt).getTime() / 1000;
@@ -51,13 +51,17 @@ export class ChatSessionReader {
             conversation_message_count: t.turnCount,
             last_assistant_content: t.lastAssistantContent,
             agentIds: [],
+            platform: t.platform,
         };
     }
     async read(id) {
-        const file = this.getFilePath(id);
-        if (!file)
+        const thread = this.db.executions.getChatThread(id);
+        if (!thread?.agentSessionId)
             return [];
-        return this.readSingleFile(file);
+        return this.sessionLog.readNormalizedSession("chat", thread.agentSessionId, {
+            includeAgents: false,
+            skipEmptySystem: true,
+        });
     }
     /**
      * Resolve a thread id to its on-disk Agent SDK jsonl. Returns null if
@@ -66,43 +70,15 @@ export class ChatSessionReader {
      * Agent SDK installation).
      */
     getFilePath(id) {
-        const thread = this.db.getChatThread(id);
+        const thread = this.db.executions.getChatThread(id);
         if (!thread || !thread.agentSessionId)
             return null;
-        const file = path.join(this.claudeHomeDir, "projects", "-app", `${thread.agentSessionId}.jsonl`);
-        if (!fs.existsSync(file))
-            return null;
-        return file;
+        return this.sessionLog.pathForProject(CHAT_PROJECT_SLUG, thread.agentSessionId, {
+            requireExists: true,
+        });
     }
-    /**
-     * Read one specific jsonl file end-to-end. Crucially, we DO NOT walk
-     * sibling `agent-*.jsonl` files like SessionReader does — those are
-     * unrelated sidechain spawns from other in-process Agent SDK runs and
-     * would pollute the conversation view.
-     */
-    async readSingleFile(file) {
-        const out = [];
-        const stream = fs.createReadStream(file, { encoding: "utf8" });
-        const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
-        for await (const line of rl) {
-            if (!line.trim())
-                continue;
-            try {
-                const raw = JSON.parse(line);
-                const msgs = unwrapLine(raw);
-                for (const msg of msgs) {
-                    if (msg.role === "system" && !msg.content)
-                        continue;
-                    const timestamp = msg.timestamp ?? raw.timestamp ?? "";
-                    out.push({ timestamp, msg });
-                }
-            }
-            catch {
-                // skip malformed line
-            }
-        }
-        out.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
-        return out.map((m, i) => ({ index: i, msg: m.msg }));
+    normalizeRawLine(raw) {
+        return this.sessionLog.normalizeLine(raw);
     }
 }
 //# sourceMappingURL=chat-session-reader.js.map

package/dist/admin/chat-session-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat-session-reader.js","sourceRoot":"","sources":["../../src/admin/chat-session-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAiB;IACpB,EAAE,CAAU;IACZ,aAAa,CAAS;IAE9B,YAAY,EAAW,EAAE,aAAqB;QAC5C,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,mFAAmF;IACnF,cAAc;QACZ,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC9D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAClE,mEAAmE;QACnE,8CAA8C;QAC9C,OAAO;YACL,EAAE;YACF,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;YACnE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;YACnE,aAAa,EAAE,CAAC,CAAC,SAAS;YAC1B,eAAe,EAAE,CAAC;YAClB,0BAA0B,EAAE,CAAC,CAAC,SAAS;YACvC,sBAAsB,EAAE,CAAC,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,EAAU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CACpB,IAAI,CAAC,aAAa,EAClB,UAAU,EACV,MAAM,EACN,GAAG,MAAM,CAAC,cAAc,QAAQ,CACjC,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,MAAM,GAAG,GAAoD,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;gBACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO;wBAAE,SAAS;oBACpD,MAAM,SAAS,GAAI,GAAG,CAAC,SAAoB,IAAK,GAAG,CAAC,SAAoB,IAAI,EAAE,CAAC;oBAC/E,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"chat-session-reader.js","sourceRoot":"","sources":["../../src/admin/chat-session-reader.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,UAAU,GAEX,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,EAAE,CAAU;IACZ,UAAU,CAAa;IAI/B,YAAY,EAAW,EAAE,oBAAyC;QAChE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,GAAG,OAAO,oBAAoB,KAAK,QAAQ;YACxD,CAAC,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC;YACtC,CAAC,CAAC,oBAAoB,CAAC;IAC3B,CAAC;IAED,mFAAmF;IACnF,cAAc;QACZ,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC9D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAClE,mEAAmE;QACnE,8CAA8C;QAC9C,OAAO;YACL,EAAE;YACF,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;YACnE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;YACnE,aAAa,EAAE,CAAC,CAAC,SAAS;YAC1B,eAAe,EAAE,CAAC;YAClB,0BAA0B,EAAE,CAAC,CAAC,SAAS;YACvC,sBAAsB,EAAE,CAAC,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,cAAc;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE;YAC1E,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,EAAU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE;YAC9E,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,GAA4B;QAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/admin/docker.d.ts

@@ -22,3 +22,40 @@ export declare function killContainer(containerName: string): Promise<void>;
  */
 export declare function getContainerStats(): Promise<ContainerStats[]>;
 export declare function listRunningContainers(): Promise<ContainerInfo[]>;
+export interface ServerContainer {
+    name: string;
+    /** Short label derived from the compose name: lastlight-<service>-<n>. */
+    service: string;
+    status: string;
+    image: string;
+}
+/**
+ * Every `lastlight-*` container (the agent plus the egress sidecars,
+ * otel-collector, dozzle, and any live sandboxes) — running or stopped. Used
+ * by the server-logs endpoints so an operator can read the harness/docker logs
+ * over the admin API instead of SSHing to the host.
+ */
+export declare function listServerContainers(): Promise<ServerContainer[]>;
+/**
+ * Resolve a requested container (by full name OR short service label) to a real
+ * `lastlight-*` container name, validated against the live list. Returns null
+ * if nothing matches — callers reject the request, so an arbitrary container
+ * name can never reach `docker logs`. With no request, defaults to the agent.
+ */
+export declare function resolveServerContainer(requested?: string): Promise<string | null>;
+/**
+ * One-shot `docker logs` for a container, newest `tail` lines. `--timestamps`
+ * lets us interleave the container's stdout and stderr (captured on separate
+ * fds) back into chronological order — RFC3339 prefixes sort lexically.
+ */
+export declare function getContainerLogs(name: string, opts?: {
+    tail?: number;
+    since?: string;
+}): Promise<string[]>;
+/**
+ * Follow `docker logs -f` for a container, invoking `onLine` per line from both
+ * stdout and stderr. Returns a stop function that kills the child process.
+ */
+export declare function streamContainerLogs(name: string, opts: {
+    tail?: number;
+}, onLine: (line: string) => void): () => void;

package/dist/admin/docker.js

@@ -1,4 +1,4 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 const exec = promisify(execFile);
 export async function killContainer(containerName) {
@@ -99,4 +99,89 @@ export async function listRunningContainers() {
         return [];
     }
 }
+/**
+ * Every `lastlight-*` container (the agent plus the egress sidecars,
+ * otel-collector, dozzle, and any live sandboxes) — running or stopped. Used
+ * by the server-logs endpoints so an operator can read the harness/docker logs
+ * over the admin API instead of SSHing to the host.
+ */
+export async function listServerContainers() {
+    try {
+        const { stdout } = await exec("docker", [
+            "ps", "-a",
+            "--filter", "name=lastlight-",
+            "--format", "{{json .}}",
+        ]);
+        if (!stdout.trim())
+            return [];
+        return stdout.trim().split("\n").map((line) => {
+            const c = JSON.parse(line);
+            const name = c.Names ?? c.Name ?? "";
+            return {
+                name,
+                service: name.replace(/^lastlight-/, "").replace(/-\d+$/, ""),
+                status: c.Status ?? "",
+                image: c.Image ?? "",
+            };
+        });
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Resolve a requested container (by full name OR short service label) to a real
+ * `lastlight-*` container name, validated against the live list. Returns null
+ * if nothing matches — callers reject the request, so an arbitrary container
+ * name can never reach `docker logs`. With no request, defaults to the agent.
+ */
+export async function resolveServerContainer(requested) {
+    const containers = await listServerContainers();
+    if (requested) {
+        const hit = containers.find((c) => c.name === requested || c.service === requested);
+        return hit?.name ?? null;
+    }
+    const agent = containers.find((c) => c.service === "agent" || c.name.includes("-agent-"));
+    return agent?.name ?? containers[0]?.name ?? null;
+}
+/**
+ * One-shot `docker logs` for a container, newest `tail` lines. `--timestamps`
+ * lets us interleave the container's stdout and stderr (captured on separate
+ * fds) back into chronological order — RFC3339 prefixes sort lexically.
+ */
+export async function getContainerLogs(name, opts = {}) {
+    const args = ["logs", "--timestamps", "--tail", String(opts.tail ?? 200)];
+    if (opts.since)
+        args.push("--since", opts.since);
+    args.push(name);
+    const { stdout, stderr } = await exec("docker", args, { maxBuffer: 32 * 1024 * 1024 });
+    const lines = [
+        ...(stdout ? stdout.split("\n") : []),
+        ...(stderr ? stderr.split("\n") : []),
+    ].filter((l) => l.length > 0);
+    lines.sort((a, b) => a.slice(0, 30).localeCompare(b.slice(0, 30)));
+    return lines;
+}
+/**
+ * Follow `docker logs -f` for a container, invoking `onLine` per line from both
+ * stdout and stderr. Returns a stop function that kills the child process.
+ */
+export function streamContainerLogs(name, opts, onLine) {
+    const child = spawn("docker", [
+        "logs", "-f", "--timestamps", "--tail", String(opts.tail ?? 200), name,
+    ]);
+    const handle = (buf) => {
+        for (const line of buf.toString().split("\n"))
+            if (line)
+                onLine(line);
+    };
+    child.stdout?.on("data", handle);
+    child.stderr?.on("data", handle);
+    return () => {
+        try {
+            child.kill("SIGKILL");
+        }
+        catch { /* already dead */ }
+    };
+}
 //# sourceMappingURL=docker.js.map