lastlight 0.1.8 → 0.2.0

package/dist/index.js

@@ -1,25 +1,90 @@
-import { mkdirSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync } from "fs";
 import { resolve } from "path";
 import { randomUUID } from "crypto";
-import { loadConfig, generateMcpConfig, resolveModel } from "./config.js";
+import { loadConfig, resolveModel, resolveVariant } from "./config.js";
 import { ConnectorRegistry, GitHubWebhookConnector, SlackConnector, SessionManager, MessageDeliveryService } from "./connectors/index.js";
-import { routeEvent } from "./engine/router.js";
-import { handleChatMessage } from "./engine/chat.js";
+import { dispatch } from "./engine/dispatcher.js";
+import { CHAT_SYSTEM_SUFFIX, handleChatMessage, loadAgentContext } from "./engine/chat.js";
+import { configureWorkflowAssets, validateAssets, getWorkflow } from "./workflows/loader.js";
+import { ChatRunner } from "./engine/chat-runner.js";
+import { buildReadSkillTool, loadChatSkillCatalogue } from "./engine/chat-skills.js";
 import { configureGitAuth } from "./engine/git-auth.js";
 import { StateDb } from "./state/db.js";
 import { CronScheduler } from "./cron/scheduler.js";
 import { getJobs } from "./cron/jobs.js";
+import { dispatchCronWorkflow } from "./cron/fanout.js";
 import { mountAdmin } from "./admin/index.js";
 import { cleanupOrphanedSandboxes } from "./sandbox/index.js";
+import { writeEgressFirewallConfigs, writeOtelCollectorConfig } from "./sandbox/egress-firewall-config.js";
+import { initTelemetry, shutdownTelemetry } from "./telemetry/index.js";
 import { authMiddleware } from "./admin/auth.js";
 import { GitHubClient } from "./engine/github.js";
+import { screenForInjection, flagPrefix } from "./engine/screen.js";
 import { runSimpleWorkflow } from "./workflows/simple.js";
 import { resumeOrphanedWorkflows } from "./workflows/resume.js";
+import { ProgressNotifier, GitHubTransport, SlackTransport, } from "./notify/index.js";
+/**
+ * Pre-flight validation — checks that config is sane before starting any
+ * services. Exits with code 78 (EX_CONFIG) on configuration errors so
+ * Docker's restart policy doesn't loop forever on a misconfigured container.
+ */
+function validateConfig(config) {
+    const fatal = (msg) => {
+        console.error(`\n[startup] FATAL: ${msg}`);
+        console.error("[startup] Fix your .env and restart.\n");
+        process.exit(78); // EX_CONFIG — sysexits.h convention
+    };
+    if (config.githubApp) {
+        const { appId, privateKeyPath, installationId } = config.githubApp;
+        if (!appId || !installationId) {
+            fatal("GITHUB_APP_ID and GITHUB_APP_INSTALLATION_ID are required when the GitHub App is configured.");
+        }
+        if (!existsSync(resolve(privateKeyPath))) {
+            fatal(`GITHUB_APP_PRIVATE_KEY_PATH points to "${privateKeyPath}" which does not exist.`);
+        }
+        try {
+            const content = readFileSync(resolve(privateKeyPath), "utf8");
+            if (!content.startsWith("-----BEGIN")) {
+                fatal(`GITHUB_APP_PRIVATE_KEY_PATH ("${privateKeyPath}") does not look like a PEM file.`);
+            }
+        }
+        catch (err) {
+            fatal(`Cannot read GITHUB_APP_PRIVATE_KEY_PATH ("${privateKeyPath}"): ${err.message}`);
+        }
+    }
+    if (!config.webhookSecret && config.githubApp) {
+        console.warn("[startup] WEBHOOK_SECRET is not set — webhook signature verification is disabled.");
+    }
+}
 async function main() {
     console.log("Last Light v2.0 — Agent SDK Harness");
     console.log("====================================");
-    // Load config
-    const config = loadConfig();
+    // Load and validate config + overlay assets before starting anything. These
+    // throw on a broken/empty overlay, a cron targeting a missing workflow, or a
+    // phase whose prompt/skill can't resolve — all unfixable by a restart, so we
+    // exit 78 (EX_CONFIG) to stop Docker's restart policy from looping.
+    let config;
+    try {
+        config = loadConfig();
+        configureWorkflowAssets({
+            builtInRoot: config.builtInRoot,
+            overlayRoot: config.overlayDir,
+            disabled: config.disabled,
+        });
+        validateAssets(config.routes);
+    }
+    catch (err) {
+        console.error(`\n[startup] FATAL: ${err.message}`);
+        console.error("[startup] Fix your config/overlay and restart.\n");
+        process.exit(78); // EX_CONFIG — sysexits.h convention
+    }
+    validateConfig(config);
+    const packageJson = JSON.parse(readFileSync(resolve("package.json"), "utf8"));
+    await initTelemetry(config.otel, { packageVersion: packageJson.version });
+    let telemetryShutdownStarted = false;
+    console.log(config.otel.enabled
+        ? `[otel] enabled service=${config.otel.serviceName} forwardToSandbox=${config.otel.forwardToSandbox} includeContent=${config.otel.includeContent}`
+        : "[otel] disabled");
     console.log(`[config] Port: ${config.port}, Model: ${config.model}`);
     const modelOverrides = Object.entries(config.models).filter(([k]) => k !== "default");
     if (modelOverrides.length > 0) {
@@ -32,14 +97,59 @@ async function main() {
         mkdirSync(resolve(config.stateDir, sub), { recursive: true });
     }
     console.log(`[state] State dir: ${config.stateDir}`);
-    // Generate MCP config file for the Agent SDK
-    const mcpConfig = generateMcpConfig(config);
-    const mcpConfigPath = resolve(config.mcpConfigPath);
-    writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2));
-    console.log(`[config] MCP config written to: ${mcpConfigPath}`);
-    // Configure git with GitHub App credentials — agents can git clone/push natively
-    // Non-fatal: if this fails (e.g., DNS not ready yet), the app still starts.
-    // Git auth is refreshed before each agent execution anyway.
+    console.log(`[state] Sessions dir: ${config.sessionsDir}`);
+    console.log(`[config] Sandbox backend: ${config.sandbox}`);
+    // Regenerate egress firewall configs (nginx ssl_preread + coredns) from
+    // the allowlist source of truth. Only meaningful for the docker backend;
+    // cheap enough to do unconditionally so a backend switch doesn't leave
+    // stale configs on disk. The docker backend forwards sandbox telemetry
+    // through the in-network OTEL collector (reached by IP), so the strict
+    // SNI allowlist no longer needs collector hosts — that hop happens on
+    // the collector's trusted outbound leg, not through the firewall.
+    const proxyDir = writeEgressFirewallConfigs(config.stateDir);
+    console.log(`[state] Egress firewall configs: ${proxyDir}`);
+    // Generate the in-network OTEL collector config (docker backend). Derived
+    // from the harness's OTEL_* backend env so the collector re-exports to the
+    // same backend the harness uses — with auth headers that stay host-side.
+    // Forwarding is gated on telemetry being active: when disabled (or sandbox
+    // forwarding off) the collector renders an inert debug-only config so the
+    // static collector IP can't be used as a sandbox exfil path.
+    const collectorConfigPath = writeOtelCollectorConfig(config.stateDir, {
+        active: config.otel.enabled && config.otel.forwardToSandbox,
+    });
+    console.log(`[state] OTEL collector config: ${collectorConfigPath} (forwarding ${config.otel.enabled && config.otel.forwardToSandbox ? "active" : "disabled"})`);
+    // Initialize state database first — ChatRunner needs SessionManager
+    // (DB-backed) at construction time.
+    const db = new StateDb(config.dbPath);
+    console.log(`[state] Database: ${config.dbPath}`);
+    // Session manager for messaging connectors (shared across Slack, Discord, etc.)
+    const sessionManager = new SessionManager(db.database);
+    // In-process chat runner backs the messaging chat skill. One pi-ai
+    // conversation per Slack/Discord thread; locked down to read-only
+    // GitHub tools plus a `read_skill` tool that exposes the curated
+    // chat skill catalogue. Skills are listed in the system prompt via
+    // an XML <available_skills> block; the agent pulls full SKILL.md on
+    // demand — same progressive-disclosure model the sandbox phases use.
+    const chatSkills = loadChatSkillCatalogue();
+    const readSkill = buildReadSkillTool(chatSkills.skills);
+    const chatRunner = new ChatRunner({
+        model: resolveModel(config.models, "chat"),
+        thinking: resolveVariant(config.variants, "chat"),
+        systemPrompt: loadAgentContext() + CHAT_SYSTEM_SUFFIX + chatSkills.catalogueXml,
+        github: config.githubApp,
+        extraTools: chatSkills.skills.length > 0
+            ? { tools: [readSkill.tool], execute: readSkill.execute }
+            : undefined,
+    }, sessionManager);
+    if (chatSkills.skills.length > 0) {
+        console.log(`[chat] Loaded ${chatSkills.skills.length} skill(s): ${chatSkills.skills.map((s) => s.name).join(", ")}`);
+    }
+    else {
+        console.warn("[chat] No skills loaded — frontmatter missing or no matching SKILL.md found");
+    }
+    // Configure git with GitHub App credentials — agents can git clone/push natively.
+    // Non-fatal: the token is refreshed before each agent execution anyway, so a
+    // transient failure here (DNS, rate limit) doesn't block startup.
     if (config.githubApp) {
         try {
             await configureGitAuth({
@@ -49,12 +159,9 @@ async function main() {
             });
         }
         catch (err) {
-            console.warn(`[git-auth] Initial git auth failed (will retry per-execution): ${err.message}`);
+            console.warn(`[git-auth] Initial token mint failed (will retry per-execution): ${err.message}`);
         }
     }
-    // Initialize state database
-    const db = new StateDb(config.dbPath);
-    console.log(`[state] Database: ${config.dbPath}`);
     // GitHub API client for harness-level operations (posting comments, fetching issues)
     const github = config.githubApp ? new GitHubClient(config.githubApp) : null;
     /**
@@ -66,7 +173,7 @@ async function main() {
      * The router still uses skill names for backwards compat — for the four
      * agent skills they're 1:1 with workflow names.
      */
-    const dispatchWorkflow = async (workflowName, context) => {
+    const dispatchWorkflow = async (workflowName, context, onRunStart) => {
         // Slack-initiated workflows (explore, /explore) carry a
         // `slack:{team}:{channel}:{thread}` triggerId and don't require a
         // managed `repo` — their postComment goes back to the Slack thread.
@@ -91,7 +198,7 @@ async function main() {
         }
         // Pluck the standard fields, leave the rest in `extra` for the workflow
         // template to consume.
-        const { _triggerType, repo: _r, issueNumber, prNumber, title, body, labels, sender, commentBody, triggerId: _triggerId, channelId, threadId, ...rest } = context;
+        const { _triggerType, repo: _r, issueNumber, prNumber, title, body, labels, sender, commentBody, triggerId: _triggerId, channelId, threadId, prePopulateBranch: ctxPrePopulateBranch, branch: ctxBranch, ...rest } = context;
         // Preserve channelId/threadId in extra so they're stored on the
         // workflow run context — needed by boot-time resume to rebuild the
         // Slack postComment callback after a harness restart.
@@ -100,6 +207,35 @@ async function main() {
             extra.channelId = channelId;
         if (typeof threadId === "string")
             extra.threadId = threadId;
+        // For PR-scoped read workflows, resolve the PR head ref and ask the
+        // sandbox to pre-clone the repo at that branch. The agent then enters
+        // a workspace that's already a checkout of the PR's actual code —
+        // saves a redundant clone_repo MCP call inside the session.
+        //
+        // pr-fix already plumbs `branch` through context (line ~709 below)
+        // because the architect/executor need the branch name to push to;
+        // we honor that here as the pre-populate branch too.
+        let prePopulateBranch = typeof ctxPrePopulateBranch === "string" ? ctxPrePopulateBranch : undefined;
+        if (!prePopulateBranch && typeof ctxBranch === "string" && ctxBranch && workflowName === "pr-fix") {
+            prePopulateBranch = ctxBranch;
+        }
+        if (!prePopulateBranch &&
+            workflowName === "pr-review" &&
+            typeof prNumber === "number" &&
+            github &&
+            owner &&
+            repo) {
+            try {
+                const pr = await github.getPullRequest(owner, repo, prNumber);
+                prePopulateBranch = pr.head.ref;
+                console.log(`[dispatch] pr-review: pre-populating workspace at ${owner}/${repo}@${prePopulateBranch}`);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.warn(`[dispatch] pr-review: could not resolve PR head ref (${msg}); ` +
+                    `agent will need to clone via MCP`);
+            }
+        }
         const request = {
             owner,
             repo,
@@ -112,7 +248,64 @@ async function main() {
             sender: typeof sender === "string" ? sender : "unknown",
             triggerId: slackTriggerId,
             extra,
+            prePopulateBranch,
         };
+        // For workflows where the architect/agent needs to see the full issue
+        // history (e.g. a build greenlit by "@last-light lets build this!" needs
+        // the spec the explore phase wrote in earlier comments), fetch the real
+        // issue body and the comment thread, combine them into a single context
+        // blob, and screen the combined text in ONE SDK call.
+        //
+        // Why single-shot: screening per-comment fans out N concurrent SDK calls,
+        // and on a busy issue (16+ comments) that exhausts memory and trips the
+        // EventEmitter listener cap. The combined-context approach keeps screen
+        // cost at exactly one haiku call regardless of thread length.
+        //
+        // For comment-triggered builds the envelope's `body` field is the
+        // triggering comment, not the issue body — we explicitly fetch the
+        // real issue body here so the architect sees both the spec (issue body
+        // + thread) and the trigger (commentBody) cleanly separated.
+        const ENRICH_WORKFLOWS = new Set(["build", "pr-fix", "explore"]);
+        if (github &&
+            ENRICH_WORKFLOWS.has(workflowName) &&
+            request.issueNumber &&
+            owner && repo) {
+            try {
+                const [trueIssueBody, comments] = await Promise.all([
+                    github.getIssueBody(owner, repo, request.issueNumber),
+                    github.listIssueComments(owner, repo, request.issueNumber),
+                ]);
+                const formattedComments = comments
+                    .filter((c) => c.body.trim())
+                    .map((c) => `--- @${c.user} (${c.createdAt}) ---\n${c.body}`)
+                    .join("\n\n");
+                const combinedContext = [
+                    trueIssueBody ? `# Issue body\n\n${trueIssueBody}` : "",
+                    formattedComments ? `# Issue thread (oldest → newest)\n\n${formattedComments}` : "",
+                ]
+                    .filter(Boolean)
+                    .join("\n\n");
+                if (combinedContext) {
+                    // Single screening call over the entire combined context.
+                    const screen = await screenForInjection(combinedContext);
+                    const annotated = screen.flagged
+                        ? `${flagPrefix(screen.reason)}${combinedContext}`
+                        : combinedContext;
+                    (request.extra ||= {}).combinedContext = annotated;
+                    // Clear individual issueBody so simple.ts uses combinedContext
+                    // exclusively (avoids double-rendering the body).
+                    request.issueBody = "";
+                    if (screen.flagged) {
+                        console.warn(`[dispatch] Screener flagged combined issue context for ${owner}/${repo}#${request.issueNumber}: ${screen.reason || "no reason"}`);
+                    }
+                }
+            }
+            catch (err) {
+                const m = err instanceof Error ? err.message : String(err);
+                console.warn(`[dispatch] Failed to fetch/screen issue context: ${m}`);
+                // Non-fatal — workflow proceeds with whatever context the envelope had.
+            }
+        }
         const slackPost = slackTriggerId && slackConnector && typeof channelId === "string" && typeof threadId === "string"
             ? async (msg) => {
                 try {
@@ -124,7 +317,84 @@ async function main() {
                 }
             }
             : undefined;
+        // In-place "task list" progress checklist — opt-in per workflow via
+        // `status_checklist: true` in the YAML. Build a transport for whichever
+        // surface triggered the run (GitHub comment and/or Slack thread) and hand
+        // the runner a ProgressNotifier instead of letting it post a comment per
+        // phase. The notifier is created inside onRunStart because it needs the
+        // workflow-run id (only known once simple.ts creates the row) to persist
+        // its in-place update handles to scratch.notifier. better-sqlite3 is
+        // synchronous and simple.ts invokes onRunStart synchronously before the
+        // first reporter call, so the notifier is ready in time; the proxy guards
+        // the brief window before assignment.
+        // Which in-place surface(s) can the checklist edit? Knowable synchronously
+        // (transport existence needs only github/issue or slack/channel/thread —
+        // the run id is needed solely for persistence + resume handles).
+        const ghChecklist = !!(github && typeof issueNumber === "number");
+        const slackChecklist = !!(slackConnector && typeof channelId === "string" && typeof threadId === "string");
+        let statusChecklist = false;
+        try {
+            // Only activate the checklist when the workflow opts in AND there's a
+            // surface to render it on — otherwise leave `reporter` undefined so the
+            // runner keeps its legacy per-phase comment behavior instead of going
+            // silent.
+            statusChecklist =
+                getWorkflow(workflowName).status_checklist === true && (ghChecklist || slackChecklist);
+        }
+        catch {
+            /* unknown workflow — surfaced downstream by runSimpleWorkflow */
+        }
+        let notifier;
+        const reporterProxy = statusChecklist
+            ? {
+                start: (m) => notifier?.start(m) ?? Promise.resolve(),
+                step: (k, s, d) => notifier?.step(k, s, d) ?? Promise.resolve(),
+                insertStep: (st, b) => notifier?.insertStep(st, b) ?? Promise.resolve(),
+                note: (m) => notifier?.note(m) ?? Promise.resolve(),
+                footer: (m) => notifier?.footer(m) ?? Promise.resolve(),
+                noteTerminal: (m) => notifier?.noteTerminal(m) ?? Promise.resolve(),
+            }
+            : undefined;
+        const notifierOnRunStart = statusChecklist
+            ? (runId) => {
+                try {
+                    const saved = ((db.runs.getRun(runId)?.scratch?.notifier) ?? {});
+                    const persist = (patch) => {
+                        const cur = ((db.runs.getRun(runId)?.scratch?.notifier) ?? {});
+                        db.runs.mergeScratch(runId, { notifier: { ...cur, ...patch } });
+                    };
+                    const transports = [];
+                    if (ghChecklist && github && typeof issueNumber === "number") {
+                        transports.push(new GitHubTransport({
+                            github,
+                            owner,
+                            repo,
+                            issueNumber,
+                            commentId: saved.githubCommentId,
+                            save: (id) => persist({ githubCommentId: id }),
+                        }));
+                    }
+                    if (slackChecklist && slackConnector && typeof channelId === "string" && typeof threadId === "string") {
+                        transports.push(new SlackTransport({
+                            slack: slackConnector,
+                            channel: channelId,
+                            thread: threadId,
+                            ts: saved.slackTs,
+                            save: (ts) => persist({ slackTs: ts, slackChannel: channelId, slackThread: threadId }),
+                        }));
+                    }
+                    if (transports.length > 0)
+                        notifier = new ProgressNotifier(transports);
+                }
+                catch (err) {
+                    const m = err instanceof Error ? err.message : String(err);
+                    console.warn(`[dispatch] notifier setup failed: ${m}`);
+                }
+            }
+            : undefined;
         const callbacks = {
+            reporter: reporterProxy,
+            publicUrl: config.publicUrl,
             postComment: slackPost
                 ?? (github && issueNumber
                     ? async (msg) => {
@@ -147,15 +417,29 @@ async function main() {
                 }
             },
             onPhaseEnd: async (phase, result) => console.log(`[dispatch] ◀ ${workflowName}/${phase}: ${result.success ? "OK" : "FAILED"}`),
+            onRunStart: notifierOnRunStart
+                ? async (runId) => {
+                    // Synchronous notifier setup must finish before simple.ts calls
+                    // reporter.start() (the next statement after it invokes this), so
+                    // run it first, then chain any caller-provided onRunStart.
+                    notifierOnRunStart(runId);
+                    if (onRunStart)
+                        await onRunStart(runId);
+                }
+                : onRunStart,
         };
         try {
             const result = await runSimpleWorkflow(workflowName, request, {
-                mcpConfigPath,
                 model: config.model,
                 maxTurns: config.maxTurns,
                 stateDir: config.stateDir,
                 sandboxDir: config.sandboxDir,
-            }, callbacks, db, config.models, config.approval, config.bootstrapLabel);
+                sessionsDir: config.sessionsDir,
+                sandbox: config.sandbox,
+                buildAssets: config.buildAssets,
+                buildAssetsDir: config.buildAssetsDir,
+                otel: config.otel,
+            }, callbacks, db, config.models, config.approval, config.bootstrapLabel, config.variants);
             const summary = result.phases.map((p) => `${p.phase}=${p.success ? "ok" : "fail"}`).join(", ");
             if (result.paused) {
                 console.log(`[dispatch] ${workflowName} paused (${summary})`);
@@ -176,8 +460,6 @@ async function main() {
     };
     // Set up connector registry
     const registry = new ConnectorRegistry();
-    // Session manager for messaging connectors (shared across Slack, Discord, etc.)
-    const sessionManager = new SessionManager(db.database);
     // Message delivery service for cron output
     const delivery = new MessageDeliveryService();
     // GitHub webhook connector (optional — requires both webhook secret and GitHub App)
@@ -206,34 +488,59 @@ async function main() {
             delivery.register("slack", (msg) => slackConnector.sendToDeliveryChannel(msg));
         }
     }
+    // Construct the cron scheduler before mounting admin so the dashboard can
+    // list/toggle/edit registered cron jobs. Jobs are registered further down
+    // (after we know whether webhooks are enabled). The runner closes over
+    // `dispatchWorkflow`, which is defined earlier in this file.
+    const cron = new CronScheduler(db, async (workflowName, context) => {
+        const { dispatched, failures } = await dispatchCronWorkflow(workflowName, context, dispatchWorkflow);
+        if (failures > 0) {
+            console.warn(`[cron] ${workflowName}: ${failures}/${dispatched} dispatches failed`);
+        }
+    });
     // Mount admin dashboard (needs an HTTP server — use GitHub connector or create standalone)
     if (githubConnector) {
         mountAdmin(githubConnector.honoApp, db, {
+            cronScheduler: cron,
             stateDir: config.stateDir,
-            sessionsDir: resolve(process.env.CLAUDE_HOME_DIR || "./data/claude-home"),
+            sessionsDir: config.sessionsDir,
+            buildAssetsDir: config.buildAssetsDir,
+            buildAssets: config.buildAssets,
             adminPassword: process.env.ADMIN_PASSWORD ?? "",
             adminSecret: process.env.ADMIN_SECRET ?? "lastlight-dev-secret",
+            publicConfig: config.publicConfig,
             slackOAuthClientId: process.env.SLACK_OAUTH_CLIENT_ID,
             slackOAuthClientSecret: process.env.SLACK_OAUTH_CLIENT_SECRET,
             slackOAuthRedirectUri: process.env.SLACK_OAUTH_REDIRECT_URI,
             slackAllowedWorkspace: process.env.SLACK_ALLOWED_WORKSPACE,
-            adminNotifier: slackConnector
-                ? (msg) => slackConnector.sendToDeliveryChannel(msg)
-                : undefined,
+            githubOAuthClientId: process.env.GITHUB_OAUTH_CLIENT_ID,
+            githubOAuthClientSecret: process.env.GITHUB_OAUTH_CLIENT_SECRET,
+            githubOAuthRedirectUri: process.env.GITHUB_OAUTH_REDIRECT_URI,
+            githubAllowedOrg: process.env.GITHUB_ALLOWED_ORG,
             resumeWorkflow: async (workflowRun, sender) => {
                 if (!github) {
                     console.warn(`[admin] Cannot resume workflow ${workflowRun.id}: GitHub App not configured`);
                     return;
                 }
-                const [owner, repo] = workflowRun.triggerId.includes("/")
+                // Derive owner/repo for the resume dispatch. Prefer the triggerId
+                // (owner/repo#N) but fall back to the stored repo + context.owner so a
+                // run keyed on a non-GitHub triggerId (e.g. a Slack-thread override)
+                // still resumes from the dashboard/focused-approval flow.
+                let [owner, repo] = workflowRun.triggerId.includes("/")
                     ? workflowRun.triggerId.replace(/#\d+$/, "").split("/")
                     : ["", ""];
+                if (!owner || !repo) {
+                    const ctxOwner = workflowRun.context?.owner || "";
+                    const storedRepo = workflowRun.repo || "";
+                    owner = ctxOwner || (storedRepo.includes("/") ? storedRepo.split("/")[0] : "");
+                    repo = storedRepo.includes("/") ? storedRepo.split("/")[1] : storedRepo;
+                }
                 const issueNumber = workflowRun.issueNumber;
                 if (!owner || !repo || !issueNumber) {
                     console.warn(`[admin] Cannot resume workflow ${workflowRun.id}: missing owner/repo/issueNumber`);
                     return;
                 }
-                db.resumeWorkflowRun(workflowRun.id);
+                db.runs.setRunning(workflowRun.id);
                 console.log(`[admin] Resuming ${workflowRun.workflowName} for ${owner}/${repo}#${issueNumber} after dashboard approval by ${sender}`);
                 dispatchWorkflow(workflowRun.workflowName, {
                     repo: `${owner}/${repo}`,
@@ -312,429 +619,91 @@ async function main() {
         return c.json({ accepted: true, owner, repo, issueNumber }, 202);
     });
     // Handle events from any connector
+    // Handle events from any connector. The dispatcher turns each EventEnvelope
+    // into a workflow dispatch (or in-process handler run) through one testable
+    // seam; every per-event branch lives in src/engine/dispatcher.ts. main()
+    // only constructs the deps and relays the typed outcome.
+    const dispatchDeps = {
+        db,
+        github,
+        dispatchWorkflow,
+        sessionManager,
+        // One in-process chat turn. handleChatMessage manages session resume via
+        // sessionManager internally; the dispatcher uses resumeAgentSessionId only
+        // to decide whether to persist a newly-minted agent session id.
+        runChat: (message, messagingSessionId, sender) => handleChatMessage(message, messagingSessionId, sender, sessionManager, { chatRunner, sessionsHomeDir: config.sessionsDir }, { model: resolveModel(config.models, "chat"), maxTurns: 10 }),
+        reviewPostsCheck: config.reviewPostsCheck,
+        publicUrl: config.publicUrl,
+    };
+    // One chat turn over HTTP — `lastlight chat` without a messaging platform.
+    // Routes through the SAME dispatcher seam Slack uses (forcing the chat
+    // handler), so the executions row, agent-session resume, and telemetry are
+    // recorded identically and the turn shows up in the dashboard Chat tab. The
+    // synthetic envelope's reply() just captures the assistant text to return.
+    githubConnector?.honoApp.post("/api/chat", async (c) => {
+        const body = await c.req.json().catch(() => ({}));
+        const message = typeof body.message === "string" ? body.message : "";
+        if (!message.trim())
+            return c.json({ error: "Missing 'message'" }, 400);
+        const user = typeof body.user === "string" && body.user ? body.user : "cli";
+        const threadId = typeof body.thread === "string" && body.thread ? body.thread : null;
+        const session = sessionManager.getOrCreateSession({
+            platform: "cli", channelId: user, threadId, userId: user,
+        });
+        let reply = "";
+        const envelope = {
+            id: session.id,
+            source: "cli",
+            type: "message",
+            sender: user,
+            senderIsBot: false,
+            body: message,
+            raw: { cli: true },
+            reply: async (msg) => { reply = msg; },
+            timestamp: new Date(),
+        };
+        const outcome = await dispatch(envelope, {
+            ...dispatchDeps,
+            route: async () => ({
+                action: "handler",
+                handler: "chat",
+                context: { sessionId: session.id, message, sender: user },
+            }),
+        });
+        return c.json({ text: reply, thread: threadId ?? session.id, sessionId: session.id, outcome: outcome.kind });
+    });
     registry.onEvent(async (envelope) => {
         console.log(`[event] ${envelope.source}:${envelope.type} from ${envelope.sender}${envelope.repo ? ` on ${envelope.repo}` : ""}`);
-        const route = await routeEvent(envelope, { db });
-        if (route.action === "ignore") {
-            console.log(`[event] Ignored: ${route.reason}`);
-            return;
-        }
-        if (route.action === "reply") {
-            await envelope.reply(route.message);
-            return;
-        }
-        const { skill, context } = route;
-        // Chat messages: handle directly (no sandbox, low latency)
-        if (skill === "chat") {
-            const messagingSessionId = context.sessionId;
-            const message = context.message;
-            const sender = context.sender;
-            // Look up the existing Agent SDK session id for this Slack thread.
-            // First message has none → fresh session; subsequent messages resume.
-            const messagingSession = sessionManager.getSession(messagingSessionId);
-            const resumeAgentSessionId = messagingSession?.agentSessionId ?? undefined;
-            // Record an executions row so chat usage shows up in dashboard stats
-            // alongside sandbox runs. triggerId is the messaging-session id, so a
-            // whole Slack thread groups together with `GROUP BY trigger_id`.
-            const executionId = randomUUID();
-            db.recordStart({
-                id: executionId,
-                triggerType: "chat",
-                triggerId: messagingSessionId,
-                skill: "chat",
-                startedAt: new Date().toISOString(),
-            });
-            try {
-                const result = await handleChatMessage(message, messagingSessionId, sender, sessionManager, {
-                    mcpConfigPath,
-                    model: resolveModel(config.models, "chat"),
-                    maxTurns: 10,
-                }, resumeAgentSessionId);
-                // Persist the Agent SDK session id on the first turn so the next
-                // turn in this thread can resume into the same jsonl. We always
-                // overwrite — if the SDK rotated the id (e.g. resume failed and it
-                // started a fresh session) we want the latest one.
-                if (result.agentSessionId && result.agentSessionId !== resumeAgentSessionId) {
-                    sessionManager.setAgentSessionId(messagingSessionId, result.agentSessionId);
-                }
-                db.recordFinish(executionId, {
-                    success: result.success,
-                    error: result.error,
-                    turns: result.turns,
-                    durationMs: result.durationMs,
-                    sessionId: result.agentSessionId,
-                    costUsd: result.costUsd,
-                    inputTokens: result.inputTokens,
-                    cacheCreationInputTokens: result.cacheCreationInputTokens,
-                    cacheReadInputTokens: result.cacheReadInputTokens,
-                    outputTokens: result.outputTokens,
-                    apiDurationMs: result.apiDurationMs,
-                    stopReason: result.stopReason,
-                });
-                await envelope.reply(result.text);
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                console.error(`[event] Chat error:`, msg);
-                db.recordFinish(executionId, {
-                    success: false,
-                    error: msg,
-                    durationMs: 0,
-                });
-                await envelope.reply("Sorry, I encountered an error. Please try again.");
-            }
-            return;
-        }
-        // Chat reset: deactivate the session and confirm
-        if (skill === "chat-reset") {
-            const sessionId = context.sessionId;
-            if (sessionId) {
-                sessionManager.deactivateSession(sessionId);
-            }
-            await envelope.reply("Session reset. Starting fresh.");
-            return;
-        }
-        // Status report: return running executions
-        if (skill === "status-report") {
-            const running = db.runningExecutions();
-            if (running.length === 0) {
-                await envelope.reply("No tasks currently running.");
-            }
-            else {
-                const lines = running.map((r) => `• *${r.skill}*${r.repo ? ` on ${r.repo}` : ""}${r.issueNumber ? ` #${r.issueNumber}` : ""} (started ${r.startedAt})`);
-                await envelope.reply(`Running tasks:\n${lines.join("\n")}`);
-            }
-            return;
-        }
-        // Check if already running for this trigger
-        const triggerId = String(envelope.issueNumber || envelope.id);
-        if (db.isRunning(skill, triggerId)) {
-            console.log(`[event] Skipping: ${skill} already running for ${triggerId}`);
-            // Notify messaging users that the task is already in progress
-            if (envelope.type === "message") {
-                await envelope.reply(`That task is already running. Use /status to check progress.`);
-            }
-            return;
-        }
-        // PR fix: lightweight fix-and-push, no full build cycle
-        if (skill === "pr-fix" && context.prNumber && context.repo) {
-            const repoStr = context.repo;
-            const [owner, repo] = repoStr.includes("/") ? repoStr.split("/") : ["", repoStr];
-            const prNumber = context.prNumber;
-            if (!owner || !repo) {
-                console.error(`[event] Invalid repo format: ${repoStr}`);
-                return;
-            }
-            // Fetch PR details and CI failures
-            let prTitle = context.title || "";
-            let prBody = context.body || "";
-            let branch = "";
-            let failedChecks = "";
-            if (github) {
-                try {
-                    const pr = await github.getPullRequest(owner, repo, prNumber);
-                    prTitle = prTitle || pr.title;
-                    prBody = prBody || pr.body || "";
-                    branch = pr.head.ref;
-                    // Fetch CI failures for the PR's head commit
-                    failedChecks = await github.getFailedChecks(owner, repo, pr.head.sha);
-                }
-                catch (err) {
-                    console.warn(`[event] Could not fetch PR: ${err.message}`);
-                }
-            }
-            if (!branch) {
-                console.error(`[event] Could not determine branch for PR #${prNumber}`);
-                return;
-            }
-            console.log(`[event] PR fix for ${repoStr}#${prNumber} on branch ${branch}`);
-            const ciSection = failedChecks && !failedChecks.includes("No failed checks")
-                ? `CI FAILURES (from GitHub Actions — fix these first):\n${failedChecks}`
-                : "";
-            dispatchWorkflow("pr-fix", {
-                repo: repoStr,
-                prNumber,
-                title: prTitle,
-                body: prBody,
-                commentBody: context.commentBody || "",
-                sender: context.sender || "unknown",
-                branch,
-                failedChecks,
-                ciSection,
-                _triggerType: "webhook",
-            }).catch((err) => {
-                console.error(`[event] PR fix failed:`, err);
-            });
-            return;
-        }
-        // Explore reply: free-form user reply on a paused socratic explore
-        // run. Resolve the reply gate with the message body, merge it into
-        // scratch.socratic.qa so the next iteration sees the answer, and
-        // re-dispatch the workflow to continue the loop.
-        if (skill === "explore-reply") {
-            const workflowRunId = context.workflowRunId;
-            const replyText = context.reply || "";
-            const sender = context.sender || "unknown";
-            const run = db.getWorkflowRun(workflowRunId);
-            if (!run) {
-                console.warn(`[event] explore-reply: run ${workflowRunId} not found`);
-                return;
-            }
-            const pending = db.getPendingApprovalForWorkflow(workflowRunId);
-            if (!pending || pending.kind !== "reply") {
-                console.warn(`[event] explore-reply: no pending reply gate on ${workflowRunId}`);
-                return;
-            }
-            db.resolveReplyGate(pending.id, replyText, sender);
-            // Append the QA entry to scratch.socratic.qa. The runner reads this
-            // via {{scratch.socratic.qa}} on the next iteration.
-            const prevScratch = (run.scratch || {});
-            const prevSocratic = (prevScratch.socratic || {});
-            const qaList = Array.isArray(prevSocratic.qa) ? [...prevSocratic.qa] : [];
-            qaList.push({
-                question: prevSocratic.lastOutput ?? "",
-                answer: replyText,
-                sender,
-                at: new Date().toISOString(),
-            });
-            db.updateWorkflowRunScratch(workflowRunId, {
-                socratic: { ...prevSocratic, qa: qaList },
-            });
-            // Set currentPhase to the phase BEFORE the loop owner so the
-            // runner's nextPhaseAfter lands back on the loop phase for the
-            // next iteration. Walk the workflow definition to find it.
-            try {
-                const { getWorkflow } = await import("./workflows/loader.js");
-                const def = getWorkflow(run.workflowName);
-                // Find the phase that owns this gate (pattern: socratic_iter_N)
-                const gateParts = pending.gate.match(/^(.+)_iter_\d+$/);
-                const owningPhaseName = gateParts ? gateParts[1] : null;
-                if (owningPhaseName) {
-                    const ownIdx = def.phases.findIndex((p) => p.name === owningPhaseName);
-                    const priorPhase = ownIdx > 0 ? def.phases[ownIdx - 1].name : owningPhaseName;
-                    db.updateWorkflowPhase(workflowRunId, priorPhase, {
-                        phase: priorPhase,
-                        timestamp: new Date().toISOString(),
-                        success: true,
-                        summary: `Resumed after reply on gate: ${pending.gate}`,
-                    });
-                }
-            }
-            catch (err) {
-                console.warn(`[event] explore-reply: could not resolve owning phase:`, err);
-            }
-            db.resumeWorkflowRun(workflowRunId);
-            // Re-dispatch. Use channelId/threadId from the current event context
-            // (the router captured them from the reply envelope), not from stored
-            // workflow context — they were never persisted there.
-            const isSlack = run.triggerId.startsWith("slack:");
-            const replyChannelId = context.channelId;
-            const replyThreadId = context.threadId;
-            // Reconstruct owner/repo from the stored workflow context.
-            const storedCtx = (run.context || {});
-            const storedOwner = storedCtx.owner;
-            const resumeRepo = storedOwner && run.repo
-                ? `${storedOwner}/${run.repo}`
-                : run.repo || undefined;
-            console.log(`[event] explore-reply: resuming ${workflowRunId} after reply from ${sender}`);
-            dispatchWorkflow("explore", {
-                repo: resumeRepo || (isSlack ? undefined : run.triggerId.split("#")[0]),
-                issueNumber: run.issueNumber,
-                sender,
-                _triggerType: envelope.type === "message" ? "chat" : "webhook",
-                triggerId: isSlack ? run.triggerId : undefined,
-                channelId: replyChannelId,
-                threadId: replyThreadId,
-            }).catch((err) => console.error(`[event] explore-reply resume failed:`, err));
-            return;
-        }
-        // Approval responses
-        if (skill === "approval-response") {
-            const decision = context.decision;
-            const sender = context.sender || "unknown";
-            const reason = context.reason;
-            const triggerId = context.repo && context.issueNumber
-                ? `${context.repo}#${context.issueNumber}`
-                : undefined;
-            const approval = context.workflowRunId
-                ? db.getPendingApprovalForWorkflow(context.workflowRunId)
-                : triggerId
-                    ? db.getPendingApprovalByTrigger(triggerId)
-                    : null;
-            if (!approval) {
-                await envelope.reply("No pending approval found.");
-                return;
-            }
-            db.respondToApproval(approval.id, decision, sender, reason);
-            if (decision === "approved") {
-                // Re-trigger the build cycle — resume logic in orchestrator will pick up from DB state
-                const workflowRun = db.getWorkflowRun(approval.workflowRunId);
-                if (workflowRun && !github) {
-                    await envelope.reply("Approval recorded, but cannot resume: GitHub App is not configured. Configure GITHUB_APP_ID and related env vars to enable build resumption.");
-                    return;
-                }
-                if (workflowRun && github) {
-                    await envelope.reply(`Approved by ${sender}. Resuming \`${workflowRun.workflowName}\`...`);
-                    const [owner, repo] = workflowRun.triggerId.includes("/")
-                        ? workflowRun.triggerId.replace(/#\d+$/, "").split("/")
-                        : ["", ""];
-                    const issueNumber = workflowRun.issueNumber;
-                    if (owner && repo && issueNumber) {
-                        db.resumeWorkflowRun(workflowRun.id);
-                        dispatchWorkflow(workflowRun.workflowName, {
-                            repo: `${owner}/${repo}`,
-                            issueNumber,
-                            title: `Issue #${issueNumber}`,
-                            body: "",
-                            sender,
-                            _triggerType: "approval",
-                        }).catch((err) => console.error(`[approval] Resume failed:`, err));
-                    }
-                }
-            }
-            else {
-                const workflowRun = db.getWorkflowRun(approval.workflowRunId);
-                if (workflowRun) {
-                    db.finishWorkflowRun(approval.workflowRunId, "failed", `Rejected by ${sender}: ${reason || "no reason given"}`);
-                }
-                await envelope.reply(`Rejected by ${sender}. Build cycle aborted.${reason ? ` Reason: ${reason}` : ""}`);
-            }
-            return;
-        }
-        // Build requests: route to the programmatic orchestrator instead of the SKILL.md
-        if (skill === "github-orchestrator" && context.issueNumber && context.repo) {
-            const repoStr = context.repo;
-            const [owner, repo] = repoStr.includes("/") ? repoStr.split("/") : ["", repoStr];
-            const issueNumber = context.issueNumber;
-            if (!owner || !repo) {
-                console.error(`[event] Invalid repo format: ${repoStr}`);
-                return;
-            }
-            // Fetch full issue details if we don't have them
-            let issueTitle = context.title || "";
-            let issueBody = context.body || "";
-            let issueLabels = context.labels || [];
-            if (github && (!issueTitle || !issueBody || issueLabels.length === 0)) {
-                try {
-                    const issue = await github.getIssue(owner, repo, issueNumber);
-                    issueTitle = issueTitle || issue.title;
-                    issueBody = issueBody || issue.body || "";
-                    if (issueLabels.length === 0) {
-                        issueLabels = (issue.labels || []).map((l) => typeof l === "string" ? l : l.name).filter(Boolean);
-                    }
-                }
-                catch (err) {
-                    console.warn(`[event] Could not fetch issue: ${err.message}`);
-                }
-            }
-            const executionId = randomUUID();
-            db.recordStart({
-                id: executionId,
-                triggerType: envelope.type === "message" ? "chat" : "webhook",
-                triggerId: String(issueNumber),
-                skill: "build-cycle",
-                repo: repoStr,
-                issueNumber,
-                startedAt: new Date().toISOString(),
-            });
-            if (envelope.type === "message") {
-                await envelope.reply(`Starting build cycle for ${repoStr}#${issueNumber}...`);
+        try {
+            const outcome = await dispatch(envelope, dispatchDeps);
+            if (outcome.kind === "ignored") {
+                console.log(`[event] Ignored: ${outcome.reason}`);
             }
-            else if (github) {
-                // GitHub-triggered builds: react with 🚀 on the triggering comment so
-                // the user sees an instant ack before guardrails / architect / etc.
-                // start running. Non-fatal if it fails.
-                const commentId = envelope.raw?.comment?.id;
-                if (commentId) {
-                    github
-                        .reactToComment(owner, repo, commentId, "rocket")
-                        .catch((err) => {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        console.warn(`[event] Could not react to trigger comment: ${msg}`);
-                    });
-                }
+            else if (outcome.kind === "skipped") {
+                console.log(`[event] Skipped: ${outcome.reason}`);
             }
-            dispatchWorkflow("build", {
-                repo: repoStr,
-                issueNumber,
-                title: issueTitle || `Issue #${issueNumber}`,
-                body: issueBody,
-                labels: issueLabels,
-                commentBody: context.commentBody,
-                sender: context.sender || "unknown",
-                _triggerType: envelope.type === "message" ? "chat" : "webhook",
-            }).then((result) => {
-                db.recordFinish(executionId, {
-                    success: result.success,
-                    error: result.success ? undefined : "Build cycle failed",
-                    durationMs: 0,
-                });
-                if (envelope.type === "message") {
-                    envelope.reply(result.success ? `Build cycle complete.` : `Build cycle failed.`);
-                }
-            }).catch((err) => {
-                console.error(`[event] Build cycle failed:`, err);
-                db.recordFinish(executionId, { success: false, error: err.message, durationMs: 0 });
-            });
-            return;
         }
-        // For messaging-triggered skills, acknowledge and reply when done.
-        // The router still uses skill names — they map 1:1 to workflow YAML names
-        // for the four agent skills (issue-triage, pr-review, repo-health, issue-comment).
-        if (envelope.type === "message") {
-            await envelope.reply(`Starting *${skill}*... I'll report back when it's done.`);
-            dispatchWorkflow(skill, { ...context, _triggerType: "chat" }).then(async (result) => {
-                if (result.paused) {
-                    // Workflow paused at a gate (approval or reply) — don't say
-                    // "completed", the workflow itself already posted instructions.
-                }
-                else if (result.success) {
-                    await envelope.reply(`*${skill}* completed.`);
-                }
-                else {
-                    await envelope.reply(`*${skill}* failed${result.error ? `: ${result.error}` : ""}.`);
-                }
-            }).catch(async (err) => {
-                const msg = err instanceof Error ? err.message : String(err);
-                console.error(`[event] workflow ${skill} threw: ${msg}`);
-                await envelope.reply(`*${skill}* failed: ${msg}`);
-            });
-            return;
-        }
-        // Run workflow asynchronously (webhook triggers)
-        dispatchWorkflow(skill, { ...context, _triggerType: "webhook" }).catch((err) => {
+        catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            console.error(`[event] Unhandled error in workflow ${skill}: ${msg}`);
-        });
-    });
-    // Set up cron scheduler — each cron tick dispatches an agent workflow by name
-    const cron = new CronScheduler(db, async (workflowName, context) => {
-        await dispatchWorkflow(workflowName, { ...context, _triggerType: "cron" });
+            console.error(`[event] dispatch threw: ${msg}`);
+        }
     });
+    // Cron jobs — fan out from each tick into one workflow run per managed repo
+    // (see dispatchCronWorkflow). The scheduler itself was constructed earlier
+    // so the admin dashboard could be wired with it.
     const webhooksEnabled = !!(config.webhookSecret && config.githubApp);
-    const jobs = getJobs({ webhooksEnabled });
+    const jobs = getJobs({ webhooksEnabled, db });
     for (const job of jobs) {
         cron.register(job);
     }
     if (webhooksEnabled) {
         console.log("[cron] Webhooks enabled — skipping issue/PR polling crons");
     }
-    // API usage/capacity checker — runs every 30 minutes, no sandbox needed.
-    // Passes a Slack notifier so the cron can alert the admin if the host
-    // claude CLI auth degrades (it then halts itself until cleared).
-    const { checkApiUsage } = await import("./cron/rate-limits.js");
-    const adminNotifier = slackConnector
-        ? (msg) => slackConnector.sendToDeliveryChannel(msg)
-        : undefined;
-    cron.registerDirect({
-        name: "check-api-usage",
-        schedule: "*/30 * * * *",
-        handler: () => checkApiUsage(db, adminNotifier),
-    });
     // Start everything
     await registry.startAll();
     console.log("[main] All connectors started");
     console.log("[main] Cron jobs registered");
+    // Chat runs in-process via pi-ai — no long-lived server to boot.
     // Boot-time recovery: any workflow_runs left in 'running' state from a
     // previous harness lifetime have already had their sandbox containers
     // killed by cleanupOrphanedSandboxes(). Mark their stale execution rows as
@@ -745,15 +714,21 @@ async function main() {
         db,
         github,
         config: {
-            mcpConfigPath,
             model: config.model,
             maxTurns: config.maxTurns,
             stateDir: config.stateDir,
             sandboxDir: config.sandboxDir,
+            sessionsDir: config.sessionsDir,
+            sandbox: config.sandbox,
+            buildAssets: config.buildAssets,
+            buildAssetsDir: config.buildAssetsDir,
+            otel: config.otel,
         },
         models: config.models,
+        variants: config.variants,
         approvalConfig: config.approval,
         bootstrapLabel: config.bootstrapLabel,
+        publicUrl: config.publicUrl,
         slackPoster: slackConnector
             ? (channelId, threadId, msg) => slackConnector.sendMessage(channelId, threadId, msg).then(() => { })
             : undefined,
@@ -764,6 +739,10 @@ async function main() {
         console.log("\n[main] Shutting down...");
         cron.stopAll();
         await registry.stopAll();
+        if (!telemetryShutdownStarted) {
+            telemetryShutdownStarted = true;
+            await shutdownTelemetry();
+        }
         db.close();
         process.exit(0);
     };
@@ -772,6 +751,13 @@ async function main() {
 }
 main().catch((err) => {
     console.error("[main] Fatal error:", err);
-    process.exit(1);
+    // Exit 78 (EX_CONFIG) to signal Docker restart policy that looping won't help.
+    // Common causes: bad PEM, wrong App ID, missing env vars.
+    const msg = err?.message || "";
+    const isConfig = msg.includes("could not be decoded") ||
+        msg.includes("not found") ||
+        msg.includes("ENOENT") ||
+        msg.includes("required");
+    process.exit(isConfig ? 78 : 1);
 });
 //# sourceMappingURL=index.js.map