lastlight 0.1.8 → 0.2.0

package/dist/admin/routes.js

@@ -2,24 +2,137 @@ import { Hono } from "hono";
 import { timingSafeEqual, randomBytes } from "node:crypto";
 import { streamSSE } from "hono/streaming";
 import { getCookie, setCookie, deleteCookie } from "hono/cookie";
-import { Slack } from "arctic";
-import { unwrapLine } from "./sessions.js";
+import { Slack, GitHub } from "arctic";
 import { tailJsonl } from "./tail.js";
-import { listRunningContainers, killContainer, getContainerStats } from "./docker.js";
+import { listRunningContainers, killContainer, getContainerStats, listServerContainers, resolveServerContainer, getContainerLogs, streamContainerLogs, } from "./docker.js";
 import { authMiddleware, createToken } from "./auth.js";
+import { Cron } from "croner";
+import { getCronWorkflows, getWorkflow, listAgentWorkflows, loadWorkflowYamlRaw, loadPromptTemplate, loadSkillRaw, } from "../workflows/loader.js";
+import { getWorkflowTriggers, getWorkflowTriggerKinds, } from "../workflows/triggers.js";
+import { getManagedRepos } from "../managed-repos.js";
+import { getServerVersion } from "./version.js";
+import { BuildAssetStore, buildAssetIssueKey } from "../state/build-assets.js";
+/**
+ * Map a build-asset filename extension to a binary MIME type, or null when the
+ * file should be served as text/plain (markdown handoff docs). Binary artifacts
+ * — PNG screenshot evidence from browser QA, and `/demo`'s mp4/webm video — must
+ * be served as raw bytes, not utf-8 text, so the dashboard can render them in an
+ * <img>/<video> and GitHub can embed them.
+ */
+export function binaryMimeForArtifact(name) {
+    const ext = name.slice(name.lastIndexOf(".")).toLowerCase();
+    switch (ext) {
+        case ".png":
+            return "image/png";
+        case ".jpg":
+        case ".jpeg":
+            return "image/jpeg";
+        case ".gif":
+            return "image/gif";
+        case ".webp":
+            return "image/webp";
+        case ".svg":
+            return "image/svg+xml";
+        case ".mp4":
+            return "video/mp4";
+        case ".webm":
+            return "video/webm";
+        default:
+            return null;
+    }
+}
+/**
+ * Build an HTTP response for a binary artifact buffer, honoring a `Range`
+ * request so <video> elements can seek/stream (GitHub's inline player and
+ * browsers send `Range: bytes=…`; without 206 support, seeking — and some
+ * players — break). Artifacts are small (≤ a few MB), so we slice the in-memory
+ * buffer rather than streaming from disk. Returns 206 for a satisfiable range,
+ * 416 for an unsatisfiable one, else 200 with the full body. `Accept-Ranges:
+ * bytes` is always advertised.
+ */
+export function rangeResponse(rangeHeader, buf, mime, cacheControl) {
+    const total = buf.length;
+    const baseHeaders = {
+        "Content-Type": mime,
+        "Accept-Ranges": "bytes",
+        "Cache-Control": cacheControl,
+    };
+    const m = rangeHeader ? /^bytes=(\d*)-(\d*)$/.exec(rangeHeader.trim()) : null;
+    if (m) {
+        let start = m[1] ? parseInt(m[1], 10) : 0;
+        let end = m[2] ? parseInt(m[2], 10) : total - 1;
+        if (Number.isNaN(start))
+            start = 0;
+        if (Number.isNaN(end) || end >= total)
+            end = total - 1;
+        if (start > end || start >= total) {
+            return new Response(null, {
+                status: 416,
+                headers: { ...baseHeaders, "Content-Range": `bytes */${total}` },
+            });
+        }
+        const chunk = buf.subarray(start, end + 1);
+        return new Response(new Uint8Array(chunk), {
+            status: 206,
+            headers: {
+                ...baseHeaders,
+                "Content-Range": `bytes ${start}-${end}/${total}`,
+                "Content-Length": String(chunk.length),
+            },
+        });
+    }
+    return new Response(new Uint8Array(buf), {
+        status: 200,
+        headers: { ...baseHeaders, "Content-Length": String(total) },
+    });
+}
+/**
+ * Parse a JSON status column (`extension_status` / `skills_status`) into the
+ * object the dashboard renders. Tolerates null / malformed JSON (returns
+ * undefined) so a bad row never breaks the executions endpoint.
+ */
+function parseJsonColumn(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Check if a session is live by matching against running container taskIds.
  * Sessions are live if they were recently active (within 5 min) and a container
  * with a matching pattern is running.
  */
+/**
+ * A session is worth listing only if it actually produced something. A
+ * zero-message session is a run that died before writing any conversation
+ * (e.g. an aborted/duplicate task that left an empty jsonl behind) — it has
+ * nothing to render and previously surfaced as a phantom "live" row at the
+ * top of the list. Error-only runs still write an assistant error line, so
+ * they keep a non-zero count and remain visible.
+ */
+function hasContent(meta) {
+    return meta.message_count > 0;
+}
 function isSessionLive(meta, liveTaskIds) {
-    // A session is considered live if it has recent activity and no end marker
+    // Stale sessions are never live, regardless of containers.
     const lastActivity = meta.last_message_at ?? meta.started_at;
     const fiveMinAgo = Date.now() / 1000 - 300;
     if (lastActivity < fiveMinAgo)
         return false;
-    // Check if any running container's taskId appears related to this session
-    // Sessions don't directly map to taskIds, but recent + active = likely live
+    // Fallback-named sessions encode their taskId as `exec-<taskId>`, and that
+    // taskId is exactly what listRunningContainers parses from the sandbox
+    // container name — so we can match them precisely instead of guessing.
+    if (meta.id.startsWith("exec-")) {
+        return liveTaskIds.has(meta.id.slice("exec-".length));
+    }
+    // UUID-named sessions don't carry their taskId in the meta, so we can't map
+    // them to a specific container. Recent activity + at least one sandbox
+    // running (the caller gates on liveTaskIds being non-empty) is the best
+    // signal available — keeps live agent logs flowing for in-flight phases.
     return true;
 }
 /**
@@ -40,6 +153,7 @@ function mountSessionRoutes(app, sessions, prefix) {
         const liveTaskIds = new Set(containers.map((c) => c.taskId).filter(Boolean));
         const valid = metas
             .filter((m) => m !== null)
+            .filter(hasContent)
             .sort((a, b) => b.started_at - a.started_at)
             .slice(0, limit)
             .map((m) => ({ ...m, live: liveTaskIds.size > 0 && isSessionLive(m, liveTaskIds) }));
@@ -61,6 +175,7 @@ function mountSessionRoutes(app, sessions, prefix) {
                 const metas = await Promise.all(allIds.slice(0, limit * 2).map((id) => sessions.getSessionMeta(id)));
                 const valid = metas
                     .filter((m) => m !== null)
+                    .filter(hasContent)
                     .sort((a, b) => b.started_at - a.started_at)
                     .slice(0, limit)
                     .map((m) => ({ ...m, live: liveTaskIds.size > 0 && isSessionLive(m, liveTaskIds) }));
@@ -125,7 +240,7 @@ function mountSessionRoutes(app, sessions, prefix) {
             let msgIndex = sinceIndex;
             const tailer = await tailJsonl(filePath, (lines) => {
                 for (const { msg } of lines) {
-                    const unwrapped = unwrapLine(msg);
+                    const unwrapped = sessions.normalizeRawLine(msg);
                     for (const m of unwrapped) {
                         msgIndex++;
                         stream.writeSSE({ event: "message", data: JSON.stringify({ id: msgIndex, ...m }) });
@@ -152,11 +267,20 @@ function mountSessionRoutes(app, sessions, prefix) {
 export function createAdminRoutes(db, sessions, chatSessions, config) {
     const app = new Hono();
     const slackOAuthEnabled = Boolean(config.slackOAuthClientId && config.slackOAuthClientSecret);
+    const githubCredsSet = Boolean(config.githubOAuthClientId && config.githubOAuthClientSecret);
+    const githubOAuthEnabled = githubCredsSet && Boolean(config.githubAllowedOrg);
+    if (githubCredsSet && !config.githubAllowedOrg) {
+        console.error("[oauth] GitHub OAuth client id/secret are set but GITHUB_ALLOWED_ORG is empty. " +
+            "Set it to a GitHub org slug to restrict login to that org, or to \"*\" to " +
+            "explicitly allow any GitHub user. GitHub OAuth is disabled until this is set.");
+    }
+    const githubAllowAnyUser = config.githubAllowedOrg === "*";
     // Auth middleware
     app.use("/*", authMiddleware(config.adminPassword, config.adminSecret));
+    app.get("/config", (c) => c.json(config.publicConfig || { default: {}, overlay: null, merged: {}, sources: {} }));
     // Auth endpoints
     app.get("/auth-required", (c) => {
-        return c.json({ required: Boolean(config.adminPassword), slackOAuth: slackOAuthEnabled });
+        return c.json({ required: Boolean(config.adminPassword), slackOAuth: slackOAuthEnabled, githubOAuth: githubOAuthEnabled });
     });
     app.post("/login", async (c) => {
         if (!config.adminPassword) {
@@ -205,16 +329,16 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
         }
         try {
             const slack = new Slack(config.slackOAuthClientId, config.slackOAuthClientSecret, config.slackOAuthRedirectUri ?? "");
-            const tokens = await slack.validateAuthorizationCode(code);
-            const accessToken = tokens.accessToken();
             // "Sign in with Slack" issues OIDC-scoped tokens (openid + profile),
             // which Slack's classic auth.test endpoint rejects with invalid_auth.
             // Use the OIDC userInfo endpoint instead — it returns a JWT-style
             // payload with claims under namespaced URLs.
-            const userInfoRes = await fetch("https://slack.com/api/openid.connect.userInfo", {
+            const tokens = await slack.validateAuthorizationCode(code);
+            const accessToken = tokens.accessToken();
+            const res = await fetch("https://slack.com/api/openid.connect.userInfo", {
                 headers: { Authorization: `Bearer ${accessToken}` },
             });
-            const userInfo = (await userInfoRes.json());
+            const userInfo = (await res.json());
             if (userInfo.ok === false) {
                 console.error("Slack openid.connect.userInfo failed:", userInfo.error);
                 return c.json({ error: "Slack userInfo failed" }, 502);
@@ -242,6 +366,87 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
             return c.json({ error: "OAuth exchange failed" }, 502);
         }
     });
+    // GitHub OAuth routes (only active when GitHub OAuth env vars are configured)
+    app.get("/oauth/github/authorize", (c) => {
+        if (!githubOAuthEnabled) {
+            return c.json({ error: "GitHub OAuth not configured" }, 404);
+        }
+        const github = new GitHub(config.githubOAuthClientId, config.githubOAuthClientSecret, config.githubOAuthRedirectUri ?? "");
+        const state = randomBytes(16).toString("hex");
+        setCookie(c, "github_oauth_state", state, {
+            httpOnly: true,
+            sameSite: "Lax",
+            path: "/",
+            maxAge: 600, // 10 minutes
+        });
+        // `login` on GET /user needs no scope; read:org is only needed for the
+        // org-membership check, so skip it when the allowlist is "*".
+        const scopes = githubAllowAnyUser ? [] : ["read:org"];
+        const url = github.createAuthorizationURL(state, scopes);
+        return c.redirect(url.toString());
+    });
+    app.get("/oauth/github/callback", async (c) => {
+        if (!githubOAuthEnabled) {
+            return c.json({ error: "GitHub OAuth not configured" }, 404);
+        }
+        // Redirect the user back to the dashboard login screen with a short,
+        // URL-safe error code. The SPA maps this code to a human-readable
+        // message so the user sees the login card with an inline error instead
+        // of a raw JSON body.
+        const fail = (code) => c.redirect(`/admin/?error=${encodeURIComponent(code)}`);
+        const storedState = getCookie(c, "github_oauth_state");
+        deleteCookie(c, "github_oauth_state", { path: "/" });
+        const { code, state } = c.req.query();
+        if (!storedState || !state || storedState !== state) {
+            return fail("oauth_state");
+        }
+        if (!code) {
+            return fail("oauth_code");
+        }
+        try {
+            const github = new GitHub(config.githubOAuthClientId, config.githubOAuthClientSecret, config.githubOAuthRedirectUri ?? "");
+            const tokens = await github.validateAuthorizationCode(code);
+            const accessToken = tokens.accessToken();
+            const res = await fetch("https://api.github.com/user", {
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                    "User-Agent": "lastlight-admin",
+                    Accept: "application/vnd.github+json",
+                },
+            });
+            const userInfo = (await res.json());
+            let memberStatus;
+            if (userInfo.login && !githubAllowAnyUser) {
+                const org = config.githubAllowedOrg;
+                const memberRes = await fetch(`https://api.github.com/orgs/${encodeURIComponent(org)}/members/${encodeURIComponent(userInfo.login)}`, {
+                    headers: {
+                        Authorization: `Bearer ${accessToken}`,
+                        "User-Agent": "lastlight-admin",
+                        Accept: "application/vnd.github+json",
+                    },
+                    redirect: "manual",
+                });
+                memberStatus = memberRes.status;
+            }
+            if (!userInfo.login) {
+                console.error("GitHub /user failed: missing login field");
+                return fail("github_userinfo");
+            }
+            const login = userInfo.login;
+            // Only 204 No Content means confirmed member. 302 means caller lacks
+            // read:org visibility; 404 means not a member. Both cases are rejected.
+            if (!githubAllowAnyUser && memberStatus !== 204) {
+                console.warn(`[oauth] GitHub login rejected: ${login} not a confirmed member of ${config.githubAllowedOrg} (status ${memberStatus})`);
+                return fail("github_org");
+            }
+            const token = createToken(config.adminSecret, "github");
+            return c.redirect(`/admin/?token=${encodeURIComponent(token)}`);
+        }
+        catch (err) {
+            console.error("GitHub OAuth exchange failed:", err);
+            return fail("oauth_exchange");
+        }
+    });
     // Health
     app.get("/health", (c) => {
         return c.json({ status: "ok", stateDir: config.stateDir });
@@ -254,7 +459,7 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
     // Stats — running count uses live Docker containers, not stale DB records
     app.get("/stats", async (c) => {
         const [stats, containers] = await Promise.all([
-            Promise.resolve(db.executionStats()),
+            Promise.resolve(db.executions.executionStats()),
             listRunningContainers(),
         ]);
         stats.running = containers.length;
@@ -264,36 +469,13 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
     app.get("/stats/daily", (c) => {
         const daysParam = c.req.query("days");
         const days = Math.min(Math.max(1, parseInt(daysParam ?? "30", 10) || 30), 90);
-        return c.json({ daily: db.dailyStats(days) });
+        return c.json({ daily: db.executions.dailyStats(days) });
     });
     // Hourly aggregated stats (rolling last N hours, default 24)
     app.get("/stats/hourly", (c) => {
         const hoursParam = c.req.query("hours");
         const hours = Math.min(Math.max(1, parseInt(hoursParam ?? "24", 10) || 24), 168);
-        return c.json({ hourly: db.hourlyStats(hours) });
-    });
-    // API rate limits
-    app.get("/rate-limits", (c) => {
-        return c.json({ limits: db.getRateLimits() });
-    });
-    // Component health states (e.g. host-claude-auth degraded after auth failure)
-    app.get("/system-status", (c) => {
-        return c.json({ statuses: db.listSystemStatus() });
-    });
-    // Manually trigger a recheck of the host claude CLI auth.
-    // Force-runs the check even if the state is currently degraded; the
-    // notifier only fires on actual state transitions, so calling this
-    // endpoint repeatedly while degraded does NOT spam the admin.
-    app.post("/system-status/host-claude-auth/recheck", async (c) => {
-        try {
-            const { checkApiUsage } = await import("../cron/rate-limits.js");
-            await checkApiUsage(db, config.adminNotifier, { force: true });
-            const status = db.getSystemStatus("host-claude-auth");
-            return c.json({ status });
-        }
-        catch (err) {
-            return c.json({ error: err.message }, 500);
-        }
+        return c.json({ hourly: db.executions.hourlyStats(hours) });
     });
     // Running Docker containers
     app.get("/containers", async (c) => {
@@ -305,6 +487,61 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
         const stats = await getContainerStats();
         return c.json({ stats });
     });
+    // ── Server logs ───────────────────────────────────────────────────────────
+    // Raw `docker logs` for the lastlight-* containers (the agent harness + the
+    // egress sidecars + otel-collector). Lets an operator read the actual
+    // server/process logs over the admin API instead of SSHing to the host. The
+    // requested container is resolved against the live container list, so an
+    // arbitrary name can never reach `docker logs`.
+    app.get("/server/containers", async (c) => {
+        return c.json({ containers: await listServerContainers() });
+    });
+    // Version + drift (core/overlay) for the dashboard "update available" banner.
+    // Best-effort: an unreachable remote yields latest=null (behind=false), never
+    // a false positive. The authoritative view is `lastlight server status`.
+    app.get("/server/info", async (c) => {
+        try {
+            return c.json(await getServerVersion());
+        }
+        catch (err) {
+            return c.json({ error: `version lookup failed: ${err.message}` }, 500);
+        }
+    });
+    app.get("/server/logs", async (c) => {
+        const name = await resolveServerContainer(c.req.query("container"));
+        if (!name)
+            return c.json({ error: "no matching lastlight container" }, 404);
+        const tail = Math.min(Math.max(parseInt(c.req.query("tail") ?? "200", 10) || 200, 1), 5000);
+        const since = c.req.query("since") || undefined;
+        try {
+            const lines = await getContainerLogs(name, { tail, since });
+            return c.json({ container: name, lines });
+        }
+        catch (err) {
+            return c.json({ error: `docker logs failed: ${err.message}` }, 500);
+        }
+    });
+    app.get("/server/logs/stream", (c) => {
+        return streamSSE(c, async (stream) => {
+            const name = await resolveServerContainer(c.req.query("container"));
+            if (!name) {
+                await stream.writeSSE({ data: JSON.stringify({ error: "no matching lastlight container" }) });
+                return;
+            }
+            const tail = Math.min(Math.max(parseInt(c.req.query("tail") ?? "100", 10) || 100, 1), 5000);
+            let stopped = false;
+            const stop = streamContainerLogs(name, { tail }, (line) => {
+                if (!stopped)
+                    void stream.writeSSE({ data: line });
+            });
+            stream.onAbort(() => { stopped = true; stop(); });
+            // Hold the SSE open until the client disconnects.
+            while (!stopped) {
+                await stream.sleep(15000);
+            }
+            stop();
+        });
+    });
     // Kill a sandbox container and mark related DB executions as failed
     app.delete("/containers/:name", async (c) => {
         const name = c.req.param("name");
@@ -319,11 +556,11 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
                 const taskId = match[1];
                 // Mark any running executions with matching skill as failed. Phase
                 // skill keys are `<workflowName>:<phaseName>` — match on the colon.
-                const skills = db.runningExecutions()
+                const skills = db.executions.runningExecutions()
                     .filter((e) => e.skill.includes(":") || e.skill === "pr-fix")
                     .filter((e) => taskId.includes(e.triggerId?.replace(/[^a-z0-9]/gi, "") || "---"));
                 for (const e of skills) {
-                    db.recordFinish(e.id, { success: false, error: "terminated via admin dashboard" });
+                    db.executions.recordFinish(e.id, { success: false, error: "terminated via admin dashboard" });
                 }
             }
             return c.json({ killed: name });
@@ -336,9 +573,71 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
     app.get("/executions", (c) => {
         const limit = Number(c.req.query("limit") ?? 100);
         const offset = Number(c.req.query("offset") ?? 0);
-        const executions = db.allExecutions(limit, offset);
+        const executions = db.executions.allExecutions(limit, offset);
         return c.json({ executions });
     });
+    // Free-text log search — the backbone of remote debugging via the CLI
+    // (`lastlight logs search`). Two scopes:
+    //   - errors   (default): substring match over the executions ledger
+    //                         (error / skill / repo) — fast, indexed-ish.
+    //   - messages: grep the most-recent session transcripts for matching
+    //               conversation content, returning a snippet. Bounded by
+    //               `maxSessions` so a deep history can't make this unbounded.
+    //   - all:      both, errors first.
+    app.get("/log-search", async (c) => {
+        const q = (c.req.query("q") ?? "").trim();
+        if (!q)
+            return c.json({ error: "missing 'q' query parameter" }, 400);
+        const scope = (c.req.query("scope") ?? "errors");
+        const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 200);
+        const results = [];
+        if (scope === "errors" || scope === "all") {
+            for (const r of db.executions.searchErrors(q, limit)) {
+                results.push({
+                    source: "error",
+                    executionId: r.id,
+                    sessionId: r.sessionId,
+                    workflowRunId: r.workflowRunId,
+                    skill: r.skill,
+                    repo: r.repo,
+                    startedAt: r.startedAt,
+                    success: r.success,
+                    snippet: r.error ?? r.skill,
+                });
+            }
+        }
+        if (scope === "messages" || scope === "all") {
+            const needle = q.toLowerCase();
+            const maxSessions = 200; // newest-first cap on transcripts scanned
+            const ids = sessions.listSessionIds().slice(0, maxSessions);
+            outer: for (const id of ids) {
+                let msgs;
+                try {
+                    msgs = (await sessions.read(id));
+                }
+                catch {
+                    continue;
+                }
+                for (const { index, msg } of msgs) {
+                    const text = JSON.stringify(msg.content ?? "");
+                    const at = text.toLowerCase().indexOf(needle);
+                    if (at === -1)
+                        continue;
+                    const start = Math.max(0, at - 60);
+                    results.push({
+                        source: "message",
+                        sessionId: id,
+                        messageIndex: index,
+                        role: msg.role,
+                        snippet: text.slice(start, at + needle.length + 120),
+                    });
+                    if (results.length >= limit)
+                        break outer;
+                }
+            }
+        }
+        return c.json({ results: results.slice(0, limit) });
+    });
     // Workflow runs — paginated, optional filters by date, workflow name, and
     // status. Returns `total` so the dashboard can drive a "load more" pager.
     // `status=active` is shorthand for ('running','paused') — used by the
@@ -358,7 +657,7 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
         else if (statusParam) {
             statuses = statusParam.split(",").filter(Boolean);
         }
-        const { runs, total } = db.listWorkflowRuns({
+        const { runs, total } = db.runs.list({
             limit,
             offset,
             sinceIso: since,
@@ -369,11 +668,11 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
     });
     // Distinct workflow names — used to populate the dashboard's filter row.
     app.get("/workflow-names", (c) => {
-        return c.json({ names: db.distinctWorkflowNames() });
+        return c.json({ names: db.runs.distinctNames() });
     });
     app.get("/workflow-runs/:id", (c) => {
         const id = c.req.param("id");
-        const run = db.getWorkflowRun(id);
+        const run = db.runs.getRun(id);
         if (!run)
             return c.json({ error: "workflow run not found" }, 404);
         return c.json({ workflowRun: run });
@@ -383,10 +682,10 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
     // (and usage metrics) for any phase the user clicks.
     app.get("/workflow-runs/:id/executions", (c) => {
         const id = c.req.param("id");
-        const run = db.getWorkflowRun(id);
+        const run = db.runs.getRun(id);
         if (!run)
             return c.json({ error: "workflow run not found" }, 404);
-        const rows = db.getExecutionsForWorkflowRun(run.id, run.triggerId, run.workflowName);
+        const rows = db.executions.getExecutionsForWorkflowRun(run.id, run.triggerId, run.workflowName);
         const prefix = `${run.workflowName}:`;
         const executions = rows.map((r) => ({
             id: r.id,
@@ -407,32 +706,99 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
             outputTokens: r.outputTokens,
             apiDurationMs: r.apiDurationMs,
             stopReason: r.stopReason,
+            extensions: parseJsonColumn(r.extensionStatus),
+            skills: parseJsonColumn(r.skillsStatus),
         }));
         return c.json({ executions });
     });
-    app.post("/workflow-runs/:id/cancel", (c) => {
+    // All approvals (pending + resolved) for a workflow run, oldest first. Powers
+    // the pipeline's approval-gate nodes + the detail panel's read-only approval
+    // history (status, who responded, when, and any comment). The global
+    // /approvals endpoint only lists pending ones, so it can't show history.
+    app.get("/workflow-runs/:id/approvals", (c) => {
+        const id = c.req.param("id");
+        const run = db.runs.getRun(id);
+        if (!run)
+            return c.json({ error: "workflow run not found" }, 404);
+        const approvals = db.approvals.listForWorkflow(run.id);
+        return c.json({ approvals });
+    });
+    app.post("/workflow-runs/:id/cancel", async (c) => {
         const id = c.req.param("id");
-        const run = db.getWorkflowRun(id);
+        const run = db.runs.getRun(id);
         if (!run)
             return c.json({ error: "workflow run not found" }, 404);
         if (run.status !== "running" && run.status !== "paused") {
             return c.json({ error: `cannot cancel a run with status '${run.status}'` }, 400);
         }
-        db.cancelWorkflowRun(id);
-        return c.json({ cancelled: id });
+        db.runs.cancelRun(id);
+        // Flipping the DB row alone only stops the runner before the NEXT phase.
+        // Kill any sandbox container currently executing a phase of this run so
+        // the in-flight phase stops too. Container names are
+        //   lastlight-sandbox-<taskId>-<uuid>
+        // where taskId is the linear run's taskId or the DAG's phase-scoped
+        // `<taskId>-<phaseName>`, both of which start with the stored taskId.
+        const storedTaskId = run.context?.taskId;
+        let killed = [];
+        if (typeof storedTaskId === "string" && storedTaskId) {
+            try {
+                const containers = await listRunningContainers();
+                const matches = containers.filter((ctr) => ctr.taskId && ctr.taskId.startsWith(storedTaskId));
+                await Promise.all(matches.map(async (ctr) => {
+                    try {
+                        await killContainer(ctr.name);
+                        killed.push(ctr.name);
+                    }
+                    catch (err) {
+                        console.warn(`[cancel] failed to kill ${ctr.name}:`, err);
+                    }
+                }));
+                // Mark execution rows belonging to THIS cancelled run as failed.
+                // Matching by workflowRunId (the run's id) instead of triggerId
+                // avoids clobbering a sibling run that happens to share the same
+                // trigger — e.g. two webhook deliveries for the same PR that
+                // raced before dedup closed.
+                for (const e of db.executions.runningExecutions()) {
+                    if (e.workflowRunId === id) {
+                        db.executions.recordFinish(e.id, { success: false, error: "cancelled via admin dashboard" });
+                    }
+                }
+            }
+            catch (err) {
+                console.warn(`[cancel] container enumeration failed:`, err);
+            }
+        }
+        return c.json({ cancelled: id, killedContainers: killed });
     });
     // ── Workflow definitions ─────────────────────────────────────────
     //
     // The dashboard's pipeline visualisation fetches definitions from here so
     // it can render exactly the phases the YAML file declares — including
     // user-defined custom workflows. No hardcoded phase list, no fallback.
-    app.get("/workflows/:name", async (c) => {
+    // List all agent workflows for the dashboard's Workflows browser.
+    app.get("/workflows", (c) => {
+        const defs = listAgentWorkflows();
+        const overrides = db.getAllWorkflowOverrides();
+        const workflows = defs.map((def) => ({
+            name: def.name,
+            kind: def.kind,
+            description: def.description,
+            trigger: def.trigger,
+            phaseCount: def.phases.length,
+            hasDag: def.phases.some((p) => Array.isArray(p.depends_on) && p.depends_on.length > 0),
+            triggerKinds: getWorkflowTriggerKinds(def.name),
+            enabled: overrides.get(def.name)?.enabled ?? true,
+        }));
+        workflows.sort((a, b) => a.name.localeCompare(b.name));
+        return c.json({ workflows });
+    });
+    app.get("/workflows/:name", (c) => {
         const name = c.req.param("name");
         try {
-            const { getWorkflow } = await import("../workflows/loader.js");
             const def = getWorkflow(name);
             // Return only the dashboard-relevant subset (no prompt template paths,
-            // no model overrides) — keeps the surface small and stable.
+            // no model overrides) — keeps the surface small and stable for the
+            // run-detail pipeline. Use /workflows/:name/full for the editor.
             return c.json({
                 workflow: {
                     name: def.name,
@@ -453,32 +819,383 @@ export function createAdminRoutes(db, sessions, chatSessions, config) {
             return c.json({ error: `workflow definition not found: ${name}`, detail: msg }, 404);
         }
     });
+    // Full structured definition: every phase field, used by the definition
+    // browser to render phase details and the diagram.
+    app.get("/workflows/:name/full", (c) => {
+        const name = c.req.param("name");
+        try {
+            const def = getWorkflow(name);
+            return c.json({
+                workflow: def,
+                triggers: getWorkflowTriggers(name),
+                enabled: db.isWorkflowEnabled(name),
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return c.json({ error: `workflow definition not found: ${name}`, detail: msg }, 404);
+        }
+    });
+    // Toggle the kill switch. Mirrors POST /crons/:name/toggle. Persisted to
+    // `workflow_overrides`; reads happen on every dispatch in
+    // `runSimpleWorkflow`, so the change applies to in-flight cron ticks and
+    // webhook dispatches without needing a restart.
+    app.post("/workflows/:name/toggle", async (c) => {
+        const name = c.req.param("name");
+        try {
+            // Validate the name actually exists before persisting an override.
+            getWorkflow(name);
+        }
+        catch {
+            return c.json({ error: `unknown workflow: ${name}` }, 404);
+        }
+        const current = db.isWorkflowEnabled(name);
+        const next = !current;
+        db.setWorkflowEnabled(name, next, "admin");
+        return c.json({ name, enabled: next });
+    });
+    // Raw YAML file content — preserves comments and formatting for the
+    // dashboard's syntax-highlighted YAML view.
+    app.get("/workflows/:name/yaml", (c) => {
+        const name = c.req.param("name");
+        if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+            return c.json({ error: "invalid workflow name" }, 400);
+        }
+        try {
+            const yaml = loadWorkflowYamlRaw(name);
+            return c.text(yaml, 200, { "Content-Type": "text/plain; charset=utf-8" });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return c.json({ error: `workflow yaml not found: ${name}`, detail: msg }, 404);
+        }
+    });
+    // Read a prompt template referenced by a phase (e.g. ?path=prompts/architect.md).
+    // Path is validated by `loadPromptTemplate` to live within workflowDir.
+    app.get("/workflows/:name/prompt", (c) => {
+        const name = c.req.param("name");
+        const promptPath = c.req.query("path");
+        if (!promptPath)
+            return c.json({ error: "missing ?path query" }, 400);
+        if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+            return c.json({ error: "invalid workflow name" }, 400);
+        }
+        // Restrict to the prompts/ subdirectory — workflows reference templates
+        // via `prompts/foo.md` (loader.ts:resolvePromptPath also catches escapes).
+        if (!promptPath.startsWith("prompts/") || promptPath.includes("..")) {
+            return c.json({ error: "prompt path must be under prompts/" }, 400);
+        }
+        try {
+            const text = loadPromptTemplate(promptPath);
+            return c.text(text, 200, { "Content-Type": "text/plain; charset=utf-8" });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return c.json({ error: `prompt not found`, detail: msg }, 404);
+        }
+    });
+    // Read a skill's SKILL.md file. Used by the phase detail drawer when a
+    // phase declares `skill: <name>`.
+    app.get("/skills/:name", (c) => {
+        const name = c.req.param("name");
+        try {
+            const text = loadSkillRaw(name);
+            return c.text(text, 200, { "Content-Type": "text/plain; charset=utf-8" });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return c.json({ error: `skill not found: ${name}`, detail: msg }, 404);
+        }
+    });
+    // ── Build assets (server mode) ─────────────────────────────────
+    // Read-only views of the externalized handoff docs (architect-plan.md, …)
+    // that live in the server store when `buildAssets.location: server`. The
+    // store itself rejects path traversal on every segment. With no store dir
+    // configured (repo mode) the list endpoints report empty rather than 404 so
+    // the dashboard tab degrades gracefully.
+    const buildAssetStore = config.buildAssetsDir ? new BuildAssetStore(config.buildAssetsDir) : null;
+    // List the run keys (issue-N / <workflow>-<id>) stored for ?repo=owner/repo.
+    app.get("/artifacts", (c) => {
+        const repoParam = c.req.query("repo");
+        if (!repoParam || !repoParam.includes("/")) {
+            return c.json({ error: "missing or invalid ?repo=owner/repo" }, 400);
+        }
+        if (!buildAssetStore)
+            return c.json({ keys: [] });
+        const [owner, repo] = repoParam.split("/", 2);
+        try {
+            return c.json({ keys: buildAssetStore.listKeys(owner, repo) });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
+        }
+    });
+    // List the doc filenames stored for one run.
+    app.get("/artifacts/:owner/:repo/:key", (c) => {
+        if (!buildAssetStore)
+            return c.json({ files: [] });
+        const { owner, repo, key } = c.req.param();
+        try {
+            return c.json({ files: buildAssetStore.listFiles({ owner, repo, issueKey: key }) });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
+        }
+    });
+    // Read one doc. Binary artifacts (PNG screenshot evidence, /demo mp4/webm) are
+    // served as raw bytes with the right Content-Type and Range support (so the
+    // dashboard <video> can seek); everything else is text/plain (the dashboard
+    // renders it with marked/DOMPurify).
+    app.get("/artifacts/:owner/:repo/:key/:doc", (c) => {
+        if (!buildAssetStore)
+            return c.json({ error: "build-assets store not configured" }, 404);
+        const { owner, repo, key, doc } = c.req.param();
+        try {
+            const binMime = binaryMimeForArtifact(doc);
+            if (binMime) {
+                const buf = buildAssetStore.readBuffer({ owner, repo, issueKey: key }, doc);
+                if (buf === undefined)
+                    return c.json({ error: `doc not found: ${doc}` }, 404);
+                return rangeResponse(c.req.header("range"), buf, binMime, "no-store");
+            }
+            const content = buildAssetStore.read({ owner, repo, issueKey: key }, doc);
+            if (content === undefined)
+                return c.json({ error: `doc not found: ${doc}` }, 404);
+            return c.text(content, 200, { "Content-Type": "text/plain; charset=utf-8" });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
+        }
+    });
+    // Overwrite one doc with the raw markdown request body. The store creates
+    // the run dir on demand and rejects path traversal on every segment.
+    app.put("/artifacts/:owner/:repo/:key/:doc", async (c) => {
+        if (!buildAssetStore)
+            return c.json({ error: "build-assets store not configured" }, 404);
+        const { owner, repo, key, doc } = c.req.param();
+        try {
+            const body = await c.req.text();
+            buildAssetStore.write({ owner, repo, issueKey: key }, doc, body);
+            return c.json({ ok: true });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
+        }
+    });
     // ── Approval Gates ─────────────────────────────────────────────
     app.get("/approvals", (c) => {
-        const approvals = db.listPendingApprovals();
+        const approvals = db.approvals.listPending();
         return c.json({ approvals });
     });
+    // Single approval, enriched with an `artifactRef` the focused approval view
+    // uses to open the right doc. `artifactRef` is null when the gate carries no
+    // artifact. In server mode the ref points at the editable store doc; in repo
+    // mode it carries a GitHub blob URL (the doc is committed on the branch).
+    app.get("/approvals/:id", (c) => {
+        const approval = db.approvals.getById(c.req.param("id"));
+        if (!approval)
+            return c.json({ error: "approval not found" }, 404);
+        const run = db.runs.getRun(approval.workflowRunId);
+        let artifactRef = null;
+        if (approval.artifact && run && run.repo) {
+            // `workflow_runs.repo` is the BARE repo name and `owner` lives in
+            // run.context (set by simple.ts) — except in tests / legacy rows that
+            // may store "owner/repo". Handle both: prefer context.owner, else split.
+            const ctx = run.context ?? {};
+            const ctxOwner = typeof ctx.owner === "string" ? ctx.owner : undefined;
+            const repo = run.repo.includes("/") ? run.repo.split("/")[1] : run.repo;
+            const owner = ctxOwner ?? (run.repo.includes("/") ? run.repo.split("/")[0] : "");
+            if (owner && repo) {
+                const mode = config.buildAssets ?? "repo";
+                const issueKey = buildAssetIssueKey(run.workflowName, run.issueNumber, run.id);
+                const issueDir = typeof ctx.issueDir === "string" ? ctx.issueDir : `.lastlight/${issueKey}`;
+                const branch = typeof ctx.branch === "string" ? ctx.branch : undefined;
+                const githubUrl = mode === "repo" && branch
+                    ? `https://github.com/${owner}/${repo}/blob/${encodeURIComponent(branch)}/${issueDir}/${approval.artifact}`
+                    : undefined;
+                artifactRef = { mode, owner, repo, issueKey, doc: approval.artifact, githubUrl };
+            }
+        }
+        return c.json({ approval, artifactRef, run: run ?? null });
+    });
     app.post("/approvals/:id/respond", async (c) => {
         const id = c.req.param("id");
         const body = await c.req.json();
-        const approval = db.getApproval(id);
+        const approval = db.approvals.getById(id);
         if (!approval)
             return c.json({ error: "approval not found" }, 404);
         if (approval.status !== "pending")
             return c.json({ error: `already ${approval.status}` }, 400);
-        db.respondToApproval(id, body.decision, "admin", body.reason);
-        const workflowRun = db.getWorkflowRun(approval.workflowRunId);
         if (body.decision === "rejected") {
-            if (workflowRun) {
-                db.finishWorkflowRun(approval.workflowRunId, "failed", `Rejected via dashboard: ${body.reason || "no reason"}`);
+            // One transaction: respond 'rejected' + fail the run.
+            db.runs.resolveGateAndFail(id, "admin", body.reason);
+        }
+        else {
+            // Record the approval, then let resumeWorkflow flip the run back to
+            // `running` — but only as part of an actual dispatch. resumeWorkflow
+            // validates the target (GitHub App present, triggerId is an owner/repo#N
+            // issue) and calls setRunning right before dispatching, so a
+            // non-resumable approval (no resumeWorkflow wired, App down, or a
+            // non-issue trigger) leaves the run paused rather than flipping it to
+            // `running` with no worker. We deliberately do NOT use the atomic
+            // resolveGateAndResume here: unlike the GitHub/Slack path, the dashboard
+            // can't prove a dispatch will follow before responding.
+            //
+            // respond() is a compare-and-set on the still-pending row, so a racing
+            // responder (the status check above is a TOCTOU read) changes 0 rows.
+            // Only the winner resumes — the loser must not dispatch a second time.
+            const changed = db.approvals.respond(id, "approved", "admin", body.reason);
+            if (changed !== 1) {
+                return c.json({ error: "already resolved" }, 409);
+            }
+            const workflowRun = db.runs.getRun(approval.workflowRunId);
+            if (workflowRun && config.resumeWorkflow) {
+                config.resumeWorkflow(workflowRun, "admin").catch((err) => {
+                    console.error(`[admin] Failed to resume workflow ${workflowRun.id}:`, err);
+                });
             }
         }
-        else if (body.decision === "approved" && workflowRun && config.resumeWorkflow) {
-            config.resumeWorkflow(workflowRun, "admin").catch((err) => {
-                console.error(`[admin] Failed to resume workflow ${workflowRun.id}:`, err);
+        return c.json({ status: body.decision });
+    });
+    // ── Crons ──────────────────────────────────────────────────────
+    // List every cron defined in workflows/cron-*.yaml, merged with the
+    // override row (if any) and the live scheduler state.
+    app.get("/crons", (c) => {
+        const overrides = db.getAllCronOverrides();
+        const liveByName = new Map((config.cronScheduler?.list() ?? []).map((j) => [j.name, j]));
+        const defs = getCronWorkflows();
+        const crons = defs.map((def) => {
+            const override = overrides.get(def.name) ?? null;
+            const enabled = override ? override.enabled : true;
+            const live = liveByName.get(def.name) ?? null;
+            const recentFailures = db.executions.consecutiveFailures(def.workflow);
+            // Find the most recent workflow_run for this cron's workflow
+            const recent = db.runs.listRecent(50).find((r) => r.workflowName === def.workflow);
+            return {
+                name: def.name,
+                workflow: def.workflow,
+                schedule: override?.schedule ?? def.schedule,
+                originalSchedule: def.schedule,
+                enabled,
+                registered: !!live,
+                nextRun: live?.nextRun?.toISOString() ?? null,
+                lastRun: recent?.startedAt ?? null,
+                lastStatus: recent?.status ?? null,
+                recentFailures,
+                context: { repos: getManagedRepos(), ...def.context },
+                override: override
+                    ? {
+                        updatedAt: override.updatedAt,
+                        updatedBy: override.updatedBy,
+                        hasScheduleOverride: override.schedule != null,
+                    }
+                    : null,
+            };
+        });
+        return c.json({ crons });
+    });
+    // Toggle the enabled bit for a cron. Updates the scheduler in lockstep so
+    // the change takes effect immediately (no restart).
+    app.post("/crons/:name/toggle", async (c) => {
+        if (!config.cronScheduler) {
+            return c.json({ error: "cron scheduler not configured" }, 503);
+        }
+        const name = c.req.param("name");
+        const def = getCronWorkflows().find((d) => d.name === name);
+        if (!def)
+            return c.json({ error: `cron not found: ${name}` }, 404);
+        const override = db.getCronOverride(name);
+        const currentlyEnabled = override ? override.enabled : true;
+        const nextEnabled = !currentlyEnabled;
+        db.setCronOverride(name, { enabled: nextEnabled, updatedBy: "admin" });
+        if (nextEnabled) {
+            // Re-register with the (possibly overridden) schedule
+            const schedule = override?.schedule || def.schedule;
+            if (config.cronScheduler.has(name)) {
+                config.cronScheduler.update({
+                    name,
+                    schedule,
+                    workflow: def.workflow,
+                    context: { repos: getManagedRepos(), ...def.context },
+                });
+            }
+            else {
+                config.cronScheduler.register({
+                    name,
+                    schedule,
+                    workflow: def.workflow,
+                    context: { repos: getManagedRepos(), ...def.context },
+                });
+            }
+        }
+        else {
+            config.cronScheduler.unregister(name);
+        }
+        return c.json({ name, enabled: nextEnabled });
+    });
+    // Persist a schedule override and apply it to the scheduler. Validates the
+    // expression with croner before saving so a bad expression returns 400 and
+    // the live cron isn't disturbed.
+    app.post("/crons/:name/schedule", async (c) => {
+        if (!config.cronScheduler) {
+            return c.json({ error: "cron scheduler not configured" }, 503);
+        }
+        const name = c.req.param("name");
+        const def = getCronWorkflows().find((d) => d.name === name);
+        if (!def)
+            return c.json({ error: `cron not found: ${name}` }, 404);
+        const body = await c.req.json();
+        const schedule = (body.schedule ?? "").trim();
+        if (!schedule)
+            return c.json({ error: "schedule is required" }, 400);
+        try {
+            // Construct a paused Cron purely to validate the pattern, then dispose.
+            const probe = new Cron(schedule, { paused: true }, () => { });
+            probe.stop();
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return c.json({ error: `invalid schedule: ${msg}` }, 400);
+        }
+        db.setCronOverride(name, { schedule, updatedBy: "admin" });
+        const override = db.getCronOverride(name);
+        if (override?.enabled !== false) {
+            config.cronScheduler.update({
+                name,
+                schedule,
+                workflow: def.workflow,
+                context: { repos: getManagedRepos(), ...def.context },
             });
         }
-        return c.json({ status: body.decision });
+        return c.json({ name, schedule });
+    });
+    // Drop the override row and re-register the cron at its YAML default.
+    app.delete("/crons/:name/override", (c) => {
+        if (!config.cronScheduler) {
+            return c.json({ error: "cron scheduler not configured" }, 503);
+        }
+        const name = c.req.param("name");
+        const def = getCronWorkflows().find((d) => d.name === name);
+        if (!def)
+            return c.json({ error: `cron not found: ${name}` }, 404);
+        db.clearCronOverride(name);
+        if (config.cronScheduler.has(name)) {
+            config.cronScheduler.update({
+                name,
+                schedule: def.schedule,
+                workflow: def.workflow,
+                context: { repos: getManagedRepos(), ...def.context },
+            });
+        }
+        else {
+            config.cronScheduler.register({
+                name,
+                schedule: def.schedule,
+                workflow: def.workflow,
+                context: { repos: getManagedRepos(), ...def.context },
+            });
+        }
+        return c.json({ name, schedule: def.schedule, enabled: true });
     });
     return app;
 }