lastlight 0.1.8 → 0.2.0

package/workflows/prompts/verify-browser.md

@@ -0,0 +1,93 @@
+You are running the **browser-QA pass** of a verify run — driving the claim's
+behaviour in a **real headless browser** and capturing **screenshot evidence**.
+A text-evidence verify already ran and posted its verdict; your job is to add
+visual proof (or to settle a claim that can only be shown in a rendered UI).
+Read the `browser-qa` skill for the driver contract and the `verify` skill for
+the investigator rules, then follow them. The `building` skill installs and runs
+the repo.
+
+**Stay in the browser.** Do **not** read, quote, or analyse the repo's source
+code — the text pass already covered the code. Your evidence is strictly what
+the browser shows: the driver's extracted text, assertion results, console
+errors, and the screenshots. No `index.html`/CSS walkthroughs, no "from the
+checked-in code" observations.
+
+## The claim to test
+
+{{#if commentBody}}
+**Claim / request:**
+{{commentBody}}
+{{/if}}
+{{#if issueTitle}}**Issue/PR title:** {{issueTitle}}{{/if}}
+{{#if issueBody}}
+**Issue/PR body:**
+{{issueBody}}
+{{/if}}
+
+Target repo: **{{owner}}/{{repo}}**
+{{#if issueNumber}}Target issue/PR: **#{{issueNumber}}**{{/if}}
+
+If the claim is purely about non-UI behaviour (a CLI, an API response, a pure
+function) the text pass already covered it — keep this pass short: note that the
+claim isn't UI-shaped and that no browser evidence was needed. Spend the effort
+where a rendered UI is the only place the claim shows.
+
+## First: confirm the browser is available
+
+Run the driver's probe before anything else:
+
+```
+node <browser-qa skill dir>/scripts/agent-browser.mjs doctor
+```
+
+(The `browser-qa` skill is staged into this phase's skill bundle — find its
+absolute path from the available-skills catalogue.) If `doctor` exits non-zero,
+the browser toolchain isn't present: say so plainly and stop — do not fake
+screenshots. This phase only runs on the docker QA image, so `doctor` should
+pass.
+
+## Workspace + run the app
+
+You are already inside the **{{repo}}** repo at branch {{branch}} — the harness
+pre-cloned it and your cwd is the repo root (no `cd`). For a PR claim, check out
+the PR head. Follow the `building` skill to install and start the app's
+dev-server in the background; wait until it's listening on `localhost`.
+
+## Drive the UI and capture evidence
+
+Author a `flow.json` (shape documented in the `browser-qa` skill), then run
+`agent-browser.mjs run flow.json --base-url http://localhost:<port>
+--out-dir {{issueDir}}`. Save every screenshot under **`{{issueDir}}/`** — the
+harness harvests that directory. Parse the JSON report (extracted text,
+assertion results, console errors) — that, not the images, is what you reason
+over. For a before/after regression claim, capture both states.
+
+## How your report is delivered — read carefully
+
+Your **final message is the report**, and the harness posts it for you{{#if issueNumber}} as
+a comment on **#{{issueNumber}}**{{/if}}{{#if !issueNumber}} back into the thread this request came from{{/if}}.
+Title it clearly as the **browser-QA evidence** so it reads as a supplement to
+the text verdict, not a competing one. Use the `verify` report shape
+(Environment / Evidence / **Conclusion: CONFIRMED | REFUTED | INCONCLUSIVE**).
+
+**Keep it tight** — a one-line environment summary, the evidence (screenshots +
+the key assertion/text/console results), and a one-sentence conclusion. No
+per-step narration, no code analysis, no long Coverage prose; a short
+"what was / wasn't exercised" is enough.
+
+**Embed each screenshot inline** so it renders in the comment.
+{{#if artifactBaseUrl}}Every PNG you saved to `<name>.png` is served publicly at
+`{{artifactBaseUrl}}/<name>.png`. Write a **raw Markdown image** for each one
+under Evidence — `!` then `[caption]` then the URL in parentheses — on its own
+line. Do **NOT** wrap it in backticks or a code fence; inside a code span it
+shows as literal text instead of rendering. For example, a screenshot saved as
+`home.png` becomes a line reading: an exclamation mark, `[Home]`, then
+`({{artifactBaseUrl}}/home.png)` with no spaces and no backticks.{{/if}}{{#if !artifactBaseUrl}}No
+public URL is configured, so reference each screenshot by filename (e.g.
+`after-login.png`) and note it's in the run's Artifacts view.{{/if}}
+
+**Do NOT post it yourself** with `github_add_issue_comment` — that would
+double-post. Never fabricate a screenshot or a pass; a clearly-evidenced
+**REFUTED** is a real finding. If screenshots couldn't be persisted (no
+server-mode build assets), still report what the DOM/text evidence showed and
+say the images weren't retained.

package/workflows/prompts/verify-synth.md

@@ -0,0 +1,44 @@
+You are writing the **single final verdict** for a verify run. Two passes have
+already run: a text-evidence verification and (sometimes) a browser-QA pass.
+Your job is to **synthesize them into one concise comment** — the reader sees
+only your output, not the individual passes.
+
+This is a **pure writing task**. Do **not** run commands, install anything, read
+repo files, or start a server — everything you need is below. Do **not** post a
+comment yourself (`github_add_issue_comment`); your final message *is* the
+comment, delivered by the harness.
+
+## The claim
+
+{{#if commentBody}}{{commentBody}}{{/if}}{{#if issueTitle}} (issue/PR: {{issueTitle}}){{/if}}
+
+## Text-verification report
+
+{{verifyResult}}
+
+{{#if verifyBrowserResult}}
+## Browser-QA report (real headless browser + screenshots)
+
+{{verifyBrowserResult}}
+{{/if}}
+
+## Write the verdict
+
+Produce a tight Markdown comment:
+
+- **Lead with the conclusion** on its own line: **CONFIRMED**, **REFUTED**, or
+  **INCONCLUSIVE**. If the two passes disagree, reconcile them and say why the
+  combined evidence lands where it does (browser evidence is decisive for
+  rendered-UI behaviour; text evidence for everything else).
+- One short paragraph of the **key evidence** that settles it — the decisive
+  commands/output and assertion results, not a replay of both reports.
+{{#if verifyBrowserResult}}- **Embed the browser screenshots inline** exactly as they appear in the
+  browser-QA report above (the `![caption](https://…/<name>.png)` image
+  Markdown) so they render in this comment. Keep them; don't turn them into
+  plain links or drop them.{{/if}}
+- A one-line **coverage** note: what was exercised, and anything notable that
+  wasn't.
+
+Keep it short and decisive — no per-step narration, no restating both reports in
+full. If a pass reported a failure or a REFUTED, surface it plainly; don't bury
+it under the other pass.

package/workflows/prompts/verify.md

@@ -0,0 +1,63 @@
+You are **verifying a claim** — testing whether a stated behaviour is actually
+true and reporting the evidence. Read the `verify` skill for the full procedure
+and investigator rules, then follow it. It uses the `building` skill for
+installing and running the repo. This prompt gives you the claim and how your
+report is delivered.
+
+## The claim to test
+
+{{#if commentBody}}
+**Claim / request:**
+{{commentBody}}
+{{/if}}
+{{#if issueTitle}}**Issue/PR title:** {{issueTitle}}{{/if}}
+{{#if issueBody}}
+**Issue/PR body:**
+{{issueBody}}
+{{/if}}
+
+Target repo: **{{owner}}/{{repo}}**
+{{#if issueNumber}}Target issue/PR: **#{{issueNumber}}**{{/if}}
+
+If no explicit claim is given and this is a PR, read the PR description + diff
+and pick the single most important, most testable claim it makes — and say which
+claim you chose.
+
+## Workspace
+
+You are already inside the **{{repo}}** repo at branch {{branch}} — the harness
+pre-cloned it and your cwd is the repo root. Git is configured; no clone, no
+`cd`. For a PR claim, check out the PR head (see the `pr-review`/`building`
+workspace notes); for a before/after claim, `git fetch` the base ref too.
+
+## First — is this even a text-checkable claim?
+
+You have **bash, file read, and the github tools** — no browser, no
+screenshots, no video. Before doing any setup, judge whether the claim is
+**purely about a rendered UI** (visual layout, mobile rendering, a click/render
+flow that only shows in a browser). If it is, **do not install/build/guess** —
+a dedicated browser-QA pass runs after you and owns it. Say in one line that the
+claim is UI-shaped and defer it to the browser pass, conclude **INCONCLUSIVE
+(UI-only — deferred to browser QA)**, and stop. Spend your effort only on claims
+bash can actually settle.
+
+## Evidence — what you can and can't capture
+
+For a text-checkable claim, prove it with test output, command stdout/stderr,
+exit codes, `curl` against a dev-server you start, and log/file excerpts.
+
+## How your report is delivered — read carefully
+
+Your **final message is the report**, and the harness posts it for you:
+{{#if issueNumber}}
+- as a comment on **#{{issueNumber}}**.
+{{/if}}
+{{#if !issueNumber}}
+- back into the thread this request came from.
+{{/if}}
+
+Make your final message the complete report in the shape the `verify` skill
+defines (Environment / Evidence / **Conclusion: CONFIRMED | REFUTED |
+INCONCLUSIVE**). **Do NOT post it yourself** with `github_add_issue_comment` —
+that would double-post. The only acceptable result that contradicts the claim is
+a clearly-evidenced **REFUTED**; surface it, don't bury it.

package/workflows/qa-test.yaml

@@ -0,0 +1,87 @@
+kind: qa-test
+name: qa-test
+description: |
+  Run an automated QA flow against a repo's CLI or locally-served app and report
+  step-level pass/fail with evidence. It installs and runs the code in the
+  sandbox, exercises a flow (CLI invocations or curl against a dev-server),
+  optionally drives the UI in a real browser, then posts a single per-step QA
+  report. Does not modify code.
+
+  Delivery is a single in-place status comment (`status_checklist`): the run
+  shows its phases ticking off, then a final `synthesize` phase folds the text
+  report and (when it ran) the browser evidence into ONE combined report,
+  delivered as the comment's footer via `final_message`. No comment-per-phase.
+  Posted on the originating issue/PR for GitHub runs, or into the Slack thread
+  for Slack runs. The agents therefore do NOT post anything themselves.
+
+  When the host runs the docker backend with the browser-QA image built, the
+  gated `qa_browser` phase drives a real headless Chromium against the
+  locally-served app and captures step-level screenshot evidence; everywhere
+  else it is silently skipped (graceful degradation) and the text report stands
+  alone. The synthesis runs either way.
+
+  Triggered by:
+    - a `@last-light qa-test <target> [-- steps]` comment on an issue/PR
+    - manual CLI: tsx src/cli.ts qa-test owner/repo#N -- "<steps>"
+
+status_checklist: true
+final_message: "{{synthesisResult}}"
+
+phases:
+  - name: phase_0
+    label: Context
+    type: context
+    depends_on: []
+
+  - name: qa_test
+    label: QA Test
+    depends_on: [phase_0]
+    prompt: prompts/qa-test.md
+    # qa-test: the flow procedure + report shape (primary).
+    # building: install + run the repo to exercise the flow.
+    skills: [qa-test, building]
+    model: "{{models.qa-test}}"
+    variant: "{{variants.qa-test}}"
+    output_var: qaResult
+    messages:
+      on_start: "Running the QA flow — installing, running, and exercising each step..."
+      on_success: "Text QA flow complete."
+      on_failure: "I couldn't complete the QA run — see the logs for details."
+
+  # Browser-QA pass (Tier B). Gated to the docker backend AND the enriched
+  # `lastlight-sandbox-qa:latest` image (Playwright + Chromium). On gondolin, or
+  # a docker host without that image, the scheduler silently skips this phase.
+  # It is terminal (nothing depends on it) — `synthesize` depends only on
+  # `qa_test`, so it still runs (after this phase, by declaration order) and
+  # folds in `qaBrowserResult` only when this phase actually produced it.
+  - name: qa_browser
+    label: QA Test (browser)
+    depends_on: [qa_test]
+    prompt: prompts/qa-browser.md
+    skills: [qa-test, building, browser-qa]
+    model: "{{models.qa-test}}"
+    variant: "{{variants.qa-test}}"
+    requires_sandbox: docker
+    sandbox_image: qa
+    output_var: qaBrowserResult
+    messages:
+      on_start: "Browser QA available — driving the UI and capturing screenshots..."
+      on_success: "Browser QA complete — screenshots captured."
+      on_skipped_done: "Browser QA unavailable on this host — text report stands."
+
+  # Synthesis. Depends only on `qa_test` (always runs after the gated browser
+  # phase by declaration order, and never skips when that phase is gated out).
+  # Reads the prior reports from phaseOutputs and writes ONE combined report;
+  # its output (`synthesisResult`) becomes the comment footer via the
+  # workflow-level `final_message`. Pure composition — no skills, no repo work.
+  - name: synthesize
+    label: Summary
+    depends_on: [qa_test]
+    prompt: prompts/qa-synth.md
+    model: "{{models.qa-test}}"
+    variant: "{{variants.qa-test}}"
+    output_var: synthesisResult
+    messages:
+      on_start: "Synthesizing the final report..."
+      on_success: "Report posted below."
+      on_failure: "I couldn't synthesize the final report — see the logs."

package/workflows/security-feedback.yaml

@@ -0,0 +1,25 @@
+kind: health
+name: security-feedback
+description: |
+  Process maintainer feedback on a security-labelled issue (usually a
+  per-run scan summary). Classifies the comment and acts:
+
+    - create-issues — break selected findings out into individual issues
+      that can later be fed to the `build` skill (the primary flow)
+    - accept-risk / false-positive — update SECURITY.md via PR to
+      suppress the finding in future scans
+    - reopen — ask the maintainer to re-run `@last-light security-review`
+    - discuss / ignore — reply conversationally or do nothing
+
+  The scan-summary issue grammar is defined in
+  `skills/security-review/SKILL.md § Issue format`; this skill's parser
+  mirrors it (version-checked on entry).
+
+  Triggered by:
+    - @last-light mention on issues labelled "security"
+
+phases:
+  - name: feedback
+    label: Security feedback
+    skill: security-feedback
+    model: "{{models.security}}"

package/workflows/security-review.yaml

@@ -0,0 +1,29 @@
+kind: health
+name: security-review
+description: |
+  Scan the target repository for security issues using open-source tools
+  (npm audit, semgrep, gitleaks) plus AI code review. Files ONE summary
+  issue per run (Renovate-style) containing a GitHub task list of every
+  finding grouped by Critical / High / Medium / Low. Honours SECURITY.md
+  for known false positives and accepted risks.
+
+  Maintainers break findings out into individual issues by commenting on
+  the summary issue (see the `security-feedback` skill — which handles
+  `@last-light create issues for the criticals`, per-item accept-risk /
+  false-positive commands, and conversational follow-ups).
+
+  Each invocation scans exactly ONE repo. The weekly cron fans out into
+  one independent run per managed repo.
+
+  Triggered by:
+    - weekly cron (Monday 10:00, fans out over every managed repo)
+    - manual CLI: tsx src/cli.ts security owner/repo
+    - @last-light security-review in a GitHub comment
+    - Slack: "security review cliftonc/repo"
+
+phases:
+  - name: scan
+    label: Security scan
+    skill: security-review
+    model: "{{models.security}}"
+    variant: "{{variants.security}}"

package/workflows/verify.yaml

@@ -0,0 +1,85 @@
+kind: verify
+name: verify
+description: |
+  Verify a behaviour claim against a repo or PR and report whether the evidence
+  confirms or refutes it. It installs and runs the code in the sandbox, captures
+  bash/text evidence, optionally drives the UI in a real browser, then posts a
+  single CONFIRMED / REFUTED / INCONCLUSIVE verdict. Does not modify code.
+
+  Delivery is a single in-place status comment (`status_checklist`): the run
+  shows its phases ticking off, then a final `synthesize` phase folds the text
+  verdict and (when it ran) the browser evidence into ONE combined verdict,
+  delivered as the comment's footer via `final_message`. No comment-per-phase.
+  Posted on the originating issue/PR for GitHub runs, or into the Slack thread
+  for Slack runs. The agents therefore do NOT post anything themselves.
+
+  When the host runs the docker backend with the browser-QA image built, the
+  gated `verify_browser` phase drives the UI in a real headless Chromium and
+  captures screenshot evidence; everywhere else it is silently skipped (graceful
+  degradation) and the text verdict stands alone. The synthesis runs either way.
+
+  Triggered by:
+    - a `@last-light verify <claim>` comment on an issue/PR
+    - manual CLI: tsx src/cli.ts verify owner/repo#N -- "<claim>"
+
+status_checklist: true
+final_message: "{{synthesisResult}}"
+
+phases:
+  - name: phase_0
+    label: Context
+    type: context
+    depends_on: []
+
+  - name: verify
+    label: Verify
+    depends_on: [phase_0]
+    prompt: prompts/verify.md
+    # verify: the investigator procedure + report shape (primary).
+    # building: install + run the repo to capture evidence.
+    skills: [verify, building]
+    model: "{{models.verify}}"
+    variant: "{{variants.verify}}"
+    output_var: verifyResult
+    messages:
+      on_start: "Verifying the claim — installing, running, and capturing evidence..."
+      on_success: "Text verification complete."
+      on_failure: "I couldn't complete the verification — see the logs for details."
+
+  # Browser-QA pass (Tier B). Gated to the docker backend AND the enriched
+  # `lastlight-sandbox-qa:latest` image (Playwright + Chromium). On gondolin, or
+  # a docker host without that image, the scheduler silently skips this phase.
+  # It is terminal (nothing depends on it) — `synthesize` depends only on
+  # `verify`, so it still runs (after this phase, by declaration order) and
+  # folds in `verifyBrowserResult` only when this phase actually produced it.
+  - name: verify_browser
+    label: Verify (browser)
+    depends_on: [verify]
+    prompt: prompts/verify-browser.md
+    skills: [verify, building, browser-qa]
+    model: "{{models.verify}}"
+    variant: "{{variants.verify}}"
+    requires_sandbox: docker
+    sandbox_image: qa
+    output_var: verifyBrowserResult
+    messages:
+      on_start: "Browser QA available — driving the UI and capturing screenshots..."
+      on_success: "Browser QA complete — screenshots captured."
+      on_skipped_done: "Browser QA unavailable on this host — text verdict stands."
+
+  # Synthesis. Depends only on `verify` (always runs after the gated browser
+  # phase by declaration order, and never skips when that phase is gated out).
+  # Reads the prior reports from phaseOutputs and writes ONE concise combined
+  # verdict; its output (`synthesisResult`) becomes the comment footer via the
+  # workflow-level `final_message`. Pure composition — no skills, no repo work.
+  - name: synthesize
+    label: Summary
+    depends_on: [verify]
+    prompt: prompts/verify-synth.md
+    model: "{{models.verify}}"
+    variant: "{{variants.verify}}"
+    output_var: synthesisResult
+    messages:
+      on_start: "Synthesizing the final verdict..."
+      on_success: "Verdict posted below."
+      on_failure: "I couldn't synthesize the final verdict — see the logs."

package/deploy/mcp-config.tmpl.json

@@ -1,14 +0,0 @@
-{
-  "mcpServers": {
-    "github": {
-      "command": "node",
-      "args": ["/app/mcp-github-app/src/index.js"],
-      "env": {
-        "GITHUB_APP_ID": "${GITHUB_APP_ID}",
-        "GITHUB_APP_PRIVATE_KEY_PATH": "${GITHUB_APP_PRIVATE_KEY_PATH}",
-        "GITHUB_APP_INSTALLATION_ID": "${GITHUB_APP_INSTALLATION_ID}",
-        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
-      }
-    }
-  }
-}

package/dist/cron/rate-limits.d.ts

@@ -1,26 +0,0 @@
-import type { StateDb } from "../state/db.js";
-/** Component name used for the host claude CLI auth state in system_status. */
-export declare const HOST_CLAUDE_AUTH_COMPONENT = "host-claude-auth";
-/**
- * Optional notifier — called once when the auth state transitions to degraded.
- * Pass a SlackConnector's `sendToDeliveryChannel` (or any other channel).
- */
-export type AdminNotifier = (text: string) => Promise<void>;
-/**
- * Check Claude usage limits by making a minimal Agent SDK call
- * and parsing the stream-json output for rate_limit_event and usage data.
- *
- * Works with Claude subscriptions (no API key needed).
- *
- * Behavior:
- * - If the host claude CLI returns "Not logged in" / authentication_failed,
- *   marks `system_status.host-claude-auth` as `degraded`, notifies the admin
- *   on the first transition, and halts subsequent runs until cleared.
- * - The capacity check creates a JSONL session file as a side effect — we
- *   delete it after parsing so it doesn't pollute the dashboard Sessions list.
- */
-export interface CheckApiUsageOptions {
-    /** Bypass the auth-degraded early return — used by manual rechecks. */
-    force?: boolean;
-}
-export declare function checkApiUsage(db: StateDb, notifyAdmin?: AdminNotifier, opts?: CheckApiUsageOptions): Promise<void>;

package/dist/cron/rate-limits.js

@@ -1,193 +0,0 @@
-/** Component name used for the host claude CLI auth state in system_status. */
-export const HOST_CLAUDE_AUTH_COMPONENT = "host-claude-auth";
-export async function checkApiUsage(db, notifyAdmin, opts = {}) {
-    // Halt early if we're already in a degraded state — operator must clear it
-    // (e.g. after `claude /login` + recheck) before this cron resumes.
-    // The recheck endpoint passes force:true to bypass this.
-    const existing = db.getSystemStatus(HOST_CLAUDE_AUTH_COMPONENT);
-    if (!opts.force && existing?.state === "degraded") {
-        console.log(`[usage] Skipping capacity check — host claude auth is degraded since ${existing.since}. Run claude /login on the host and trigger a recheck to resume.`);
-        return;
-    }
-    const now = new Date().toISOString();
-    let capacityCheckSessionId = "";
-    let authFailed = false;
-    let authFailureReason = "";
-    // ── Capacity & rate limit check via claude CLI ──
-    try {
-        const { execFile } = await import("child_process");
-        const { promisify } = await import("util");
-        const exec = promisify(execFile);
-        let stdout = "";
-        try {
-            // NOTE: do NOT pass --bare here. --bare disables OAuth credential
-            // reading and requires ANTHROPIC_API_KEY, which we don't have on this
-            // host (we authenticate via `claude /login` to a Claude subscription).
-            const result = await exec("claude", [
-                "--print", "reply with just: ok",
-                "--output-format", "stream-json",
-                "--verbose",
-                "--max-turns", "1",
-                "--model", process.env.CLAUDE_MODEL || "claude-sonnet-4-6",
-            ], {
-                timeout: 30_000,
-                env: { ...process.env, HOME: process.env.HOME || "/home/lastlight" },
-            });
-            stdout = result.stdout;
-        }
-        catch (execErr) {
-            // Non-zero exit (e.g. auth_failed) — claude still emits stream-json on stdout
-            stdout = execErr.stdout?.toString() || "";
-            if (!stdout) {
-                // No output at all — propagate the underlying failure
-                throw execErr;
-            }
-        }
-        // Parse each JSON line from the stream output
-        for (const line of stdout.split("\n")) {
-            if (!line.startsWith("{"))
-                continue;
-            try {
-                const msg = JSON.parse(line);
-                // Capture session id so we can delete the JSONL file afterwards
-                if (msg.type === "system" && msg.subtype === "init" && msg.session_id) {
-                    capacityCheckSessionId = msg.session_id;
-                }
-                // Detect "Not logged in" — claude emits a synthetic assistant message
-                // with error: "authentication_failed" when the host CLI has no creds.
-                if (msg.type === "assistant" && msg.error === "authentication_failed") {
-                    authFailed = true;
-                    const text = msg.message?.content?.[0]?.text || "Not logged in";
-                    authFailureReason = text;
-                }
-                // Rate limit info from subscription
-                if (msg.type === "rate_limit_event" && msg.rate_limit_info) {
-                    const info = msg.rate_limit_info;
-                    db.updateRateLimit("subscription:status", info.status === "allowed" ? 1 : 0, now);
-                    db.updateRateLimit("subscription:type", 0, info.rateLimitType || "unknown");
-                    if (info.resetsAt) {
-                        db.updateRateLimit("subscription:resets_at", info.resetsAt, new Date(info.resetsAt * 1000).toISOString());
-                    }
-                    if (info.overageStatus) {
-                        db.updateRateLimit("subscription:overage_status", info.overageStatus === "allowed" ? 1 : 0, now);
-                    }
-                    if (info.overageResetsAt) {
-                        db.updateRateLimit("subscription:overage_resets_at", info.overageResetsAt, new Date(info.overageResetsAt * 1000).toISOString());
-                    }
-                    db.updateRateLimit("subscription:using_overage", info.isUsingOverage ? 1 : 0, now);
-                    console.log(`[usage] Subscription: ${info.status}, type=${info.rateLimitType}, overage=${info.isUsingOverage ? "yes" : "no"} (${info.overageStatus})`);
-                }
-                // Result with cost and usage breakdown
-                if (msg.type === "result") {
-                    if (msg.total_cost_usd !== undefined) {
-                        // Store as cents to keep as integer
-                        db.updateRateLimit("usage:last_check_cost_cents", Math.round(msg.total_cost_usd * 100), now);
-                    }
-                    if (msg.usage) {
-                        db.updateRateLimit("usage:last_check_input_tokens", msg.usage.input_tokens || 0, now);
-                        db.updateRateLimit("usage:last_check_output_tokens", msg.usage.output_tokens || 0, now);
-                    }
-                }
-            }
-            catch { /* skip unparseable lines */ }
-        }
-    }
-    catch (err) {
-        // The capacity check is best-effort — log and continue. Cleanup + status
-        // handling below should still run regardless of the failure mode.
-        db.updateRateLimit("subscription:status", 0, now);
-        console.warn(`[usage] Capacity check failed: ${err.message}`);
-    }
-    // If the call surfaced an auth failure, mark the component degraded and
-    // notify the admin once on transition. Subsequent runs early-return above.
-    if (authFailed) {
-        const transitioned = db.setSystemStatus(HOST_CLAUDE_AUTH_COMPONENT, "degraded", authFailureReason || "Host claude CLI is not logged in");
-        if (transitioned) {
-            console.error(`[usage] Host claude auth is now DEGRADED: ${authFailureReason}`);
-            if (notifyAdmin) {
-                const msg = `:rotating_light: *Last Light: host claude CLI auth degraded*\n` +
-                    `Reason: ${authFailureReason}\n` +
-                    `Action: run \`docker exec -it --user lastlight lastlight-agent-1 claude /login\` and then trigger a recheck.\n` +
-                    `The capacity-check cron is now halted to prevent log spam.`;
-                try {
-                    await notifyAdmin(msg);
-                }
-                catch (notifyErr) {
-                    console.error(`[usage] Failed to notify admin: ${notifyErr.message}`);
-                }
-            }
-        }
-    }
-    else {
-        // Successful run — clear any prior degraded state
-        const existing = db.getSystemStatus(HOST_CLAUDE_AUTH_COMPONENT);
-        if (existing && existing.state !== "ok") {
-            db.setSystemStatus(HOST_CLAUDE_AUTH_COMPONENT, "ok");
-            console.log(`[usage] Host claude auth recovered — state cleared`);
-            if (notifyAdmin) {
-                try {
-                    await notifyAdmin(`:white_check_mark: Last Light: host claude CLI auth recovered. Capacity-check cron resuming normal operation.`);
-                }
-                catch { /* non-fatal */ }
-            }
-        }
-        else if (!existing) {
-            // First-ever successful run — initialize the state
-            db.setSystemStatus(HOST_CLAUDE_AUTH_COMPONENT, "ok");
-        }
-    }
-    // Run JSONL cleanup regardless of outcome (try/finally semantics).
-    {
-        // Delete the session JSONL file the capacity check created so it doesn't
-        // pollute the dashboard Sessions list. Best-effort — ignore failures.
-        if (capacityCheckSessionId) {
-            try {
-                const { unlink } = await import("fs/promises");
-                const { join } = await import("path");
-                const home = process.env.HOME || "/home/lastlight";
-                // claude encodes the project's cwd as the directory name, replacing
-                // path separators with dashes. e.g. /app -> -app
-                const projectDir = process.cwd().replace(/\//g, "-");
-                const sessionFile = join(home, ".claude", "projects", projectDir, `${capacityCheckSessionId}.jsonl`);
-                await unlink(sessionFile);
-            }
-            catch {
-                /* file may not exist or claude may not have written it — ignore */
-            }
-        }
-    }
-    // ── Usage stats from our own execution records ──
-    try {
-        const stats = computeUsageStats(db);
-        db.updateRateLimit("usage:executions_1h", stats.lastHour, now);
-        db.updateRateLimit("usage:executions_24h", stats.last24h, now);
-        db.updateRateLimit("usage:turns_1h", stats.turnsLastHour, now);
-        db.updateRateLimit("usage:turns_24h", stats.turnsLast24h, now);
-        console.log(`[usage] Last 1h: ${stats.lastHour} executions, ${stats.turnsLastHour} turns | ` +
-            `24h: ${stats.last24h} executions, ${stats.turnsLast24h} turns`);
-    }
-    catch (err) {
-        console.error(`[usage] Stats computation failed: ${err.message}`);
-    }
-}
-function computeUsageStats(db) {
-    const now = Date.now();
-    const oneHourAgo = new Date(now - 60 * 60 * 1000).toISOString();
-    const oneDayAgo = new Date(now - 24 * 60 * 60 * 1000).toISOString();
-    const raw = db.database;
-    const h1 = raw.prepare(`
-    SELECT COUNT(*) as count, COALESCE(SUM(turns), 0) as turns
-    FROM executions WHERE started_at >= ?
-  `).get(oneHourAgo);
-    const h24 = raw.prepare(`
-    SELECT COUNT(*) as count, COALESCE(SUM(turns), 0) as turns
-    FROM executions WHERE started_at >= ?
-  `).get(oneDayAgo);
-    return {
-        lastHour: h1.count,
-        turnsLastHour: h1.turns,
-        last24h: h24.count,
-        turnsLast24h: h24.turns,
-    };
-}
-//# sourceMappingURL=rate-limits.js.map