mixdog 0.9.66 → 0.9.68

package/src/runtime/channels/lib/webhook.mjs

@@ -1,10 +1,7 @@
 import * as http from "http";
-import { spawn, spawnSync } from "child_process";
 import { randomUUID } from "crypto";
-import { getWebhookAuthtoken } from "../../shared/config.mjs";
 import { logWebhook } from "./webhook/log.mjs";
 import { SIGNATURE_HEADERS, extractSignature, STRIPE_TOLERANCE_MS, verifySignature } from "./webhook/signature.mjs";
-import { detachedSpawnOpts } from "../../shared/spawn-flags.mjs";
 import {
   loadEndpointConfig,
   readEndpointSecret,
@@ -15,20 +12,7 @@ import {
   extractDeliveryId,
   buildHeadersSummary,
 } from "./webhook/deliveries.mjs";
-import {
-  NGROK_MAX_AGE_MS,
-  resolveNgrokBin,
-  normalizeDomain,
-  readNgrokMeta,
-  writeNgrokMeta,
-  clearNgrokMeta,
-  isLikelyNgrok,
-  isProcessAlive,
-  parseStrictPidLine,
-  resolvePortOwnerPid,
-  handleWebhookPortInUse,
-  checkNgrokHealth,
-} from "./webhook/ngrok.mjs";
+import { resolveHookRelayUrl, startHookTunnel } from "./webhook/relay-tunnel.mjs";
 
 class WebhookServer {
   config;
@@ -38,7 +22,7 @@ class WebhookServer {
   boundPort = 0;
   listenInFlight = false;
   noSecretWarned = false;
-  ngrokProcess = null;
+  hookTunnel = null;
   constructor(config) {
     this.config = config;
   }
@@ -311,42 +295,19 @@ class WebhookServer {
     const basePort = this.config.port || 3333;
     const maxPort = basePort + 7;
     let currentPort = basePort;
-    let baseReclaimAttempted = false;
     const tryListen = () => {
       this.server.listen(currentPort, () => {
         this.listenInFlight = false;
         this.boundPort = currentPort;
         logWebhook(`listening on port ${currentPort}`);
-        this.startNgrok();
+        this._startHookTunnel();
       });
     };
     this.server.on("error", (err) => {
-      if (err.code === "EADDRINUSE" && currentPort === basePort && !baseReclaimAttempted) {
-        baseReclaimAttempted = true;
-        void handleWebhookPortInUse(basePort, this.config.ngrokDomain || this.config.domain).then((result) => {
-          if (result.ok) {
-            currentPort = basePort;
-            logWebhook(`reclaimed base port ${basePort}, retrying bind`);
-            tryListen();
-            return;
-          }
-          if (result.bump && currentPort < maxPort) {
-            logWebhook(
-              `port ${basePort} not reclaimable (live non-ngrok PID ${result.ownerPid ?? "unknown"}), trying ${currentPort + 1}`,
-            );
-            currentPort++;
-            tryListen();
-            return;
-          }
-          if (err.code === "EADDRINUSE") {
-            logWebhook(`all ports ${basePort}-${maxPort} in use \u2014 webhook server disabled`);
-            this.listenInFlight = false;
-            this.server = null;
-          }
-        });
-        return;
-      }
       if (err.code === "EADDRINUSE" && currentPort < maxPort) {
+        // The relay tunnel forwards to whatever port this process binds, so
+        // port identity no longer matters (the ngrok-era domain↔port coupling
+        // is gone) — walk up the range.
         logWebhook(`port ${currentPort} already in use, trying ${currentPort + 1}`);
         currentPort++;
         tryListen();
@@ -364,166 +325,27 @@ class WebhookServer {
     });
     tryListen();
   }
-  /**
-   * Check if a previous ngrok process can be reused.
-   * Returns true if the existing ngrok is alive, healthy, and serving the right domain.
-   * Returns false otherwise. External processes are never killed; stale or
-   * incompatible metadata is ignored so another terminal's tunnel stays alive.
-   */
-  async reuseNgrokIfHealthy(domain, expectedPort = null) {
-    const meta = readNgrokMeta();
-    if (!meta || !(meta.pid > 0)) {
-      clearNgrokMeta();
-      return false;
-    }
-
-    const { pid } = meta;
-
-    // Metadata domain mismatch — different config. Do not kill another terminal's tunnel.
-    if (meta.domain && normalizeDomain(meta.domain) !== normalizeDomain(domain)) {
-      logWebhook(`ngrok meta domain mismatch (${meta.domain} vs ${domain}), ignoring PID ${pid}`);
-      clearNgrokMeta();
-      return false;
-    }
-    if (expectedPort && meta.port && Number(meta.port) !== Number(expectedPort)) {
-      // A tunnel forwarding to the OLD local port cannot serve this server.
-      // Ignore the metadata and let this process try its own tunnel without
-      // touching the existing process.
-      logWebhook(`ngrok meta port mismatch (${meta.port} vs ${expectedPort}) — ignoring PID ${pid}`);
-      clearNgrokMeta();
-      return false;
-    }
-
-    // Stale check — older than 24 hours (ngrok session realistic lifetime;
-    // ngrok free-tier tunnels expire after ~2h but paid/reserved-domain
-    // tunnels survive much longer; 24h is a safe conservative ceiling).
-    if (meta.startedAt && (Date.now() - new Date(meta.startedAt).getTime()) > NGROK_MAX_AGE_MS) {
-      logWebhook(`ngrok meta stale (started ${meta.startedAt}), ignoring PID ${pid}`);
-      clearNgrokMeta();
-      return false;
-    }
-
-    // Check if process is alive
-    let alive = false;
-    try { process.kill(pid, 0); alive = true } catch {}
-
-    if (!alive) {
-      logWebhook(`ngrok PID ${pid} is dead, cleaning up`);
-      clearNgrokMeta();
-      return false;
-    }
-
-    // Process alive + domain matches — verify tunnel via 4040 API
-    const healthy = await checkNgrokHealth(domain, expectedPort);
-    if (healthy) {
-      logWebhook(`reusing ngrok (PID ${pid}, domain ${domain}, port ${meta.port})`);
-      return true;
-    }
-
-    // Alive but tunnel unhealthy. Leave it alone; it may belong to another terminal.
-    logWebhook(`ngrok PID ${pid} alive but tunnel unhealthy, ignoring`);
-    clearNgrokMeta();
-    return false;
-  }
-  async startNgrok() {
-    // Mutex: skip only when THIS process still owns a live ngrok child. Fresh
-    // daemon restarts always have ngrokProcess=null and must proceed; stale
-    // in-memory refs after exit must not block respawn.
-    if (this.ngrokProcess && this.ngrokProcess.exitCode == null && !this.ngrokProcess.killed) return;
-    if (this._ngrokStartPromise) return this._ngrokStartPromise;
-    this._ngrokStartPromise = this._doStartNgrok();
-    try { await this._ngrokStartPromise; } finally { this._ngrokStartPromise = null; }
-  }
-  async _doStartNgrok() {
-    const authtoken = getWebhookAuthtoken();
-    const domain = this.config.ngrokDomain || this.config.domain;
-    if (!authtoken || !domain) return;
-    let attempts = 0;
-    while (!this.boundPort) {
-      if (++attempts > 30) {
-        logWebhook("ngrok: gave up waiting for port");
-        return;
-      }
-      await new Promise((r) => setTimeout(r, 500));
-    }
-
-    // Try to reuse an existing ngrok process
-    const reused = await this.reuseNgrokIfHealthy(domain, this.boundPort);
-    if (reused) {
+  // Relay-backed public tunnel (replaces the ngrok child): one outbound
+  // WebSocket to the Mixdog relay serves every inbound webhook — no binary,
+  // no authtoken, no reserved domain.
+  _startHookTunnel() {
+    if (this.hookTunnel) return;
+    const relayUrl = resolveHookRelayUrl();
+    if (!relayUrl) {
+      logWebhook("hook tunnel disabled (MIXDOG_RELAY_URL=off)");
       return;
     }
-
-    let ngrokBin;
     try {
-      ngrokBin = resolveNgrokBin();
+      this.hookTunnel = startHookTunnel({ relayUrl, getLocalPort: () => this.boundPort });
+      logWebhook(`public hook base: ${this.hookTunnel.publicBase}`);
     } catch (err) {
-      if (!this._ngrokDisabledLogged) {
-        logWebhook(`ngrok disabled — ${err.message}`);
-        this._ngrokDisabledLogged = true;
-      }
-      return;
-    }
-    spawnSync(ngrokBin, ["config", "add-authtoken", authtoken], { stdio: "ignore", timeout: 1e4, windowsHide: true });
-    attempts = 0;
-    const waitAndStart = () => {
-      if (!this.boundPort) {
-        if (++attempts > 30) {
-          logWebhook("ngrok: gave up waiting for port");
-          return;
-        }
-        setTimeout(waitAndStart, 500);
-        return;
-      }
-      try {
-        // stdio fully ignored so Node does not pass inheritable stdio handles
-        // (bInheritHandles stays false on Windows). There is no portable Node API
-        // to mark the http.Server listen socket non-inheritable; detached ngrok
-        // can still inherit stale handles in edge cases — layer-1 port reclaim
-        // on EADDRINUSE is the guaranteed safety net.
-        this.ngrokProcess = spawn(ngrokBin, ["http", String(this.boundPort), "--url=" + domain], {
-          stdio: ["ignore", "ignore", "ignore"],
-          ...detachedSpawnOpts,
-        });
-        this.ngrokProcess.unref();
-        if (this.ngrokProcess.pid) {
-          writeNgrokMeta({
-            pid: this.ngrokProcess.pid,
-            domain,
-            port: this.boundPort,
-            startedAt: new Date().toISOString(),
-            binaryPath: ngrokBin,
-          });
-        }
-        this.ngrokProcess.on("exit", () => {
-          this.ngrokProcess = null;
-          clearNgrokMeta();
-        });
-        this.ngrokProcess.on("error", () => {
-          this.ngrokProcess = null;
-          clearNgrokMeta();
-        });
-        logWebhook(`ngrok tunnel started: ${domain} \u2192 localhost:${this.boundPort} (PID ${this.ngrokProcess.pid})`);
-      } catch (e) {
-        logWebhook(`ngrok start failed: ${e}`);
-      }
-    };
-    setTimeout(waitAndStart, 1e3);
-    // Hold the outer startNgrok() mutex (`_ngrokStartPromise`) until
-    // waitAndStart actually spawns ngrok OR exhausts its 30-attempt
-    // budget. Pre-fix the mutex released as soon as the setTimeout was
-    // scheduled, letting a duplicate startNgrok() call within the wait
-    // window arm a second timer and spawn a second ngrok process.
-    // Deadline: 1s initial + 30 × 500ms attempts = 16s, +1.5s slack.
-    const _deadline = Date.now() + 17500;
-    while (!this.ngrokProcess && Date.now() < _deadline) {
-      await new Promise((r) => setTimeout(r, 100));
+      logWebhook(`hook tunnel start failed: ${err?.message || err}`);
     }
   }
   stop() {
-    // Intentionally do NOT kill ngrok — let it survive across MCP restarts.
-    // The next start() can reuse it if reuseNgrokIfHealthy() validates it.
-    if (this.ngrokProcess) {
-      this.ngrokProcess = null;
+    if (this.hookTunnel) {
+      try { this.hookTunnel.close(); } catch { /* already closed */ }
+      this.hookTunnel = null;
     }
     let closed = Promise.resolve();
     if (this.server) {
@@ -538,7 +360,7 @@ class WebhookServer {
         }
       });
     }
-    logWebhook("stopped (ngrok left running for reuse)");
+    logWebhook("stopped");
     return closed;
   }
   // reloadConfig(webhookCfg, options?)
@@ -575,24 +397,27 @@ ${headersSummary}
 ${payload}
 <<<${_UNTRUSTED}_END>>>`;
   }
-  async _dispatchDelegate(name, role, model, fullPrompt, headers, deliveryId, res, channel) {
+  async _dispatchSessionRun(name, model, fullPrompt, headers, deliveryId, res, extra = {}) {
     await updateDeliveryStatus(name, deliveryId, "processing");
-    // Bridge dispatch must not be allowed to hang forever — without a
+    // Session dispatch must not be allowed to hang forever — without a
     // ceiling a stuck LLM call leaves the delivery in `processing`
     // for the lifetime of the process and dedup keeps re-running
-    // forever. 10 minutes covers the slowest delegate task we ship.
+    // forever. 10 minutes covers the slowest handler run we ship.
     const DISPATCH_TIMEOUT_MS = 10 * 60 * 1000;
     let timeoutHandle = null;
     const dispatchP = Promise.resolve(this.bridgeDispatch({
-      role,
-      preset: model,
+      model: model || null,
       prompt: fullPrompt,
-      cwd: this.config?.cwd,
+      // Endpoint-scoped project/workflow (New-task parity): the webhook row's
+      // cwd/workflow define the created session, not the worker's global cwd.
+      cwd: extra.cwd || this.config?.cwd || null,
+      workflow: extra.workflow || null,
+      attachments: extra.attachments || null,
+      delivery: extra.delivery || null,
       context: {
         source: "webhook",
         endpoint: name,
         deliveryId,
-        channel: channel || null,
         event: headers["x-github-event"] || null,
       },
     }));
@@ -605,54 +430,29 @@ ${payload}
     Promise.race([dispatchP, timeoutP]).then(() => {
       if (timeoutHandle) clearTimeout(timeoutHandle);
       void updateDeliveryStatus(name, deliveryId, "done").catch((e) => logWebhook(`${name}: delivery status update failed: ${e?.message || e}`));
-      logWebhook(`${name}: delegate dispatched to bridge (role=${role}, id=${deliveryId})`);
+      logWebhook(`${name}: webhook session run dispatched (id=${deliveryId})`);
     }).catch((err) => {
       if (timeoutHandle) clearTimeout(timeoutHandle);
       void updateDeliveryStatus(name, deliveryId, "failed", { error: String(err?.message || err) }).catch(() => {});
-      logWebhook(`${name}: delegate dispatch failed: ${err?.message || err}`);
+      logWebhook(`${name}: webhook session run failed: ${err?.message || err}`);
     });
     res.writeHead(202, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ status: "accepted", handler: "delegate", id: deliveryId }));
+    res.end(JSON.stringify({ status: "accepted", handler: "session", id: deliveryId }));
   }
   async handleWebhook(name, body, headers, res, deliveryId, endpoint) {
-    // A PG endpoint row is the folder-handler equivalent: routing is by
-    // channel_id presence — WITH a channel → delegate dispatch to the row's
-    // role/model and report to that channel; WITHOUT → interactive enqueue
-    // into the current (Lead) session. Parser-only endpoints (no table row)
-    // fall through to the event pipeline below.
+    // A PG endpoint row runs as a VISIBLE webhook session (user decision):
+    // no Lead injection, no channel delivery — the run lands in Recent like
+    // a schedule run, and its session content IS the result surface.
+    // Parser-only endpoints (no table row) fall through to the event
+    // pipeline below.
     if (endpoint) {
       try {
-        const { channelId, role, model, instructions } = endpoint;
+        const { model, instructions, cwd, workflow, attachments, delivery } = endpoint;
         const payloadContent = this._buildFencedPayload(body, headers);
-        if (channelId) {
-          if (!role) {
-            await updateDeliveryStatus(name, deliveryId, "failed", { error: "delegate mode requires role" });
-            logWebhook(`${name}: delegate mode requires role - rejected`);
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ status: "rejected", error: "delegate mode requires role" }));
-            return;
-          } else if (!model) {
-            await updateDeliveryStatus(name, deliveryId, "failed", { error: "delegate mode requires model" });
-            logWebhook(`${name}: delegate mode requires model - rejected`);
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ status: "rejected", error: "delegate mode requires model" }));
-            return;
-          } else if (!this.bridgeDispatch) {
-            throw new Error(`[webhook] delegate mode requires bridgeDispatch`);
-          } else {
-            const fullPrompt = `${instructions}\n\n${payloadContent}`;
-            await this._dispatchDelegate(name, role, model, fullPrompt, headers, deliveryId, res, channelId);
-            return;
-          }
-        }
-        if (this.eventPipeline) {
-          await updateDeliveryStatus(name, deliveryId, "processing");
-          this.eventPipeline.enqueueDirect(name, payloadContent, channelId, "interactive", instructions);
-          await updateDeliveryStatus(name, deliveryId, "done");
-          logWebhook(`${name}: interactive enqueued (id=${deliveryId})`);
-        }
-        res.writeHead(202, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ status: "accepted", handler: "interactive", id: deliveryId }));
+        if (!this.bridgeDispatch) throw new Error(`[webhook] session dispatch requires bridgeDispatch`);
+        const fullPrompt = `${instructions}\n\n${payloadContent}`;
+        await this._dispatchSessionRun(name, model || null, fullPrompt, headers, deliveryId, res,
+          { cwd: cwd || null, workflow: workflow || null, attachments: attachments || null, delivery: delivery || null });
         return;
       } catch (err) {
         await updateDeliveryStatus(name, deliveryId, "failed", { error: String(err?.message || err) });
@@ -673,8 +473,8 @@ ${payload}
   }
   /** Get the webhook URL for an endpoint name */
   getUrl(name) {
-    if (this.config.ngrokDomain) {
-      return `https://${this.config.ngrokDomain}/webhook/${name}`;
+    if (this.hookTunnel) {
+      return `${this.hookTunnel.publicBase}/webhook/${name}`;
     }
     return `http://localhost:${this.boundPort || this.config.port}/webhook/${name}`;
   }

package/src/runtime/channels/lib/worker-main.mjs

@@ -331,6 +331,7 @@ const {
 // flags + ownership timer + memory-drain timer; shares config/backend/
 // bridgeRuntimeConnected/webhookServer/eventPipeline with the worker via get/set.
 const {
+  startAutomationRuntime,
   startOwnedRuntime,
   stopOwnedRuntime,
   refreshBridgeOwnership,
@@ -456,88 +457,31 @@ scheduler.setSendHandler(async (channelId, text) => {
 function wireWebhookHandlers() {
   if (!webhookServer) return;
   webhookServer.setEventPipeline(eventPipeline);
-  webhookServer.setBridgeDispatch(async ({ role, preset, prompt, cwd, context }) => {
-    // Delegate-mode webhook → bridge orchestrator. Each bridge progress /
-    // final event is forwarded to the Lead via the same channel-notify
-    // path used by schedule & event-queue (injectAndRecord). Silent
-    // lifecycle pings keep routing only to Discord.
-    const [{ createStandaloneAgent }, cfgMod, reg, mgr] = await Promise.all([
-      import("../../../standalone/agent-tool.mjs"),
-      import("../../agent/orchestrator/config.mjs"),
-      import("../../agent/orchestrator/providers/registry.mjs"),
-      import("../../agent/orchestrator/session/manager.mjs"),
-    ]);
-    const agentTool = createStandaloneAgent({
-      cfgMod,
-      reg,
-      mgr,
-      dataDir: cfgMod.getPluginData(),
-      cwd,
+  // Webhook fires run as sessions (schedules parity). Delivery mode:
+  // 'app' (default) → the Automations session row IS the surface;
+  // 'channel'/'both' → the run result also relays to the main channel.
+  webhookServer.setBridgeDispatch(async ({ prompt, model, cwd, workflow, attachments, delivery, context }) => {
+    const { runWebhookSession } = await import("../../shared/webhook-session-run.mjs");
+    const run = await runWebhookSession({
+      name: context?.endpoint || "webhook",
+      model: model || null,
+      cwd: cwd || null,
+      workflow: workflow || null,
+      attachments: attachments || null,
+      delivery: delivery || null,
+      prompt,
     });
-    const channelId = resolveWebhookChannelId(context?.channel);
-    const endpoint = context?.endpoint || "unknown";
-    const event = context?.event || null;
-    const deliveryId = context?.deliveryId || null;
-    const label = `webhook:${endpoint}`;
-    const instruction = `Webhook review from role=${role} on endpoint "${endpoint}"`
-      + (event ? ` (event=${event})` : "")
-      + (deliveryId ? ` (delivery=${deliveryId})` : "")
-      + ". Relay the finding to the user naturally — summarize clearly, call out any issues, and note what needs a decision.";
-    const notifyFn = (text, meta = {}) => {
-      if (!text) return;
-      // Webhook skip protocol: when the agent worker emits a `[meta:silent]`
-      // marker (optionally behind model/role tag prefixes), the event is a
-      // no-op (label-only, dedup, "nothing to report"). Drop the message
-      // entirely — neither Lead inject nor Discord forward — instead of the
-      // partial `silent_to_agent` semantics that still audit to Discord.
-      const raw = String(text);
-      if (/^\s*(?:\[[^\]\n]+\]\s*)*\[meta:silent\]/.test(raw)) return;
-      // Deterministic findings-count drop. Code-review handlers emit a
-      // structured `[[findings:N]]` token (N = number of issues). The RELAY —
-      // not the worker's prose — decides: N==0 => clean review, drop entirely
-      // (no Lead inject, no Discord forward). Token absent => fail-safe forward
-      // so a real finding is never silently dropped if the worker omits it.
-      const fc = raw.match(/\[\[findings:(\d+)\]\]/i);
-      if (fc && Number(fc[1]) === 0) return;
-      // Lifecycle pings (started / iter echoes, marked silent_to_agent) are
-      // channel noise for an automated webhook review — drop them entirely so
-      // a skip stays fully silent and only the final answer reaches the
-      // channel. The final [meta:silent] skip result is already dropped above.
-      if (meta?.silent_to_agent === true) return;
-      // Strip the verdict token before surfacing (findings present, N>0).
-      const surfaced = raw.replace(/\[\[findings:\d+\]\]/gi, "").replace(/[^\S\n]{2,}/g, " ").trim();
-      injectAndRecord(channelId, label, surfaced || raw, {
-        type: "webhook",
-        instruction,
-      });
-    };
-    // Per-terminal cwd under the daemon's single channels worker. A webhook
-    // result is injected to ownerConn() — the connection whose session.leadPid
-    // equals active-instance ownerLeadPid — so the worker must run in THAT
-    // owner terminal's cwd. Read the sentinel keyed by ownerLeadPid; cwd-tool
-    // writes session-cwd-<leadPid>.txt per connection, so write and read meet
-    // on the same leadPid key no matter which terminal holds the owner seat.
-    // Falls back to the session entry position; never the plugin CACHE root.
-    const ownerPid = getActiveOwnerPid(readActiveInstance());
-    const ownerCwd = (ownerPid && readLastSessionCwd(ownerPid)) || captureOriginalUserCwd();
-    return agentTool.execute(
-      { type: "spawn", agent: role, preset, prompt, cwd: cwd || ownerCwd },
-      { callerCwd: cwd || ownerCwd, invocationSource: "webhook", notifyFn },
-    );
+    const mode = String(delivery || "app");
+    if ((mode === "channel" || mode === "both") && run?.result && backend?.sendMessage) {
+      const target = scheduler.resolveChannel("");
+      if (target) {
+        void bindingReady.then(() => backend.sendMessage(target, run.result))
+          .catch((err) => dropTrace("send.webhook.err", { channelId: target, err: String(err) }));
+      }
+    }
+    return run;
   });
 }
-function resolveWebhookChannelId(channelFlag) {
-  // Single main channel: the endpoint's `channel` frontmatter is a boolean-ish
-  // flag (any non-empty value except "false" → post to the main channel). A raw
-  // channel id is still honored verbatim for owner-authored overrides.
-  const main = config?.channelId || "";
-  if (channelFlag == null) return main;
-  const v = String(channelFlag).trim();
-  if (v === "" || v.toLowerCase() === "false") return "";
-  // A pure-digit / snowflake-looking value is treated as an explicit id;
-  // anything else (legacy labels like "main") maps to the main channel.
-  return /^-?\d+$/.test(v) ? v : main;
-}
 function wireEventQueueHandlers(eventQueue) {
   if (!eventQueue) return;
   eventQueue.setInjectHandler((channelId, name, content, options) => {
@@ -669,6 +613,7 @@ const {
         recoverUnsyncedTail: true,
       });
     },
+    startChannelBridge: () => start({ messaging: true }),
     stopOwnedRuntime,
     reloadRuntimeConfig,
   },
@@ -707,7 +652,24 @@ async function init(_sharedMcp) {
     injectAndRecord(channelId, name, content, options);
   });
 }
-async function start() {
+function ensureConfigWatcher() {
+  if (_configWatcher) return;
+  try {
+    _configWatcher = fs.watch(path.join(DATA_DIR, "mixdog-config.json"), () => {
+      invalidateConfigReadCache();
+      if (_reloadDebounce) clearTimeout(_reloadDebounce);
+      _reloadDebounce = setTimeout(() => { reloadRuntimeConfig().catch(() => {}); }, 500);
+    });
+  } catch {}
+}
+async function start(options = {}) {
+  if (options?.messaging === false) {
+    channelBridgeActive = false;
+    writeBridgeState(false);
+    await startAutomationRuntime();
+    ensureConfigWatcher();
+    return;
+  }
   channelBridgeActive = true;
   writeBridgeState(true);
   // Daemon model: this runtime is the machine-global singleton bridge owner
@@ -729,18 +691,9 @@ async function start() {
   // ownership timer — the singleton daemon guarantees exactly one owner.
   armBridgeOwnershipTimer();
   // Hot-reload config on file change (schedules/webhooks/events).
-  if (!_configWatcher) {
-    try {
-      _configWatcher = fs.watch(path.join(DATA_DIR, "mixdog-config.json"), () => {
-        // Cross-process edit landed on disk; drop this process's short-TTL raw
-        // config cache synchronously so the debounced reload (and any readAll
-        // in between) sees the fresh file immediately, not up to TTL stale.
-        invalidateConfigReadCache();
-        if (_reloadDebounce) clearTimeout(_reloadDebounce);
-        _reloadDebounce = setTimeout(() => { reloadRuntimeConfig().catch(() => {}); }, 500);
-      });
-    } catch {}
-  }
+  // Cross-process edits invalidate the raw config cache before the debounced
+  // reload so both messaging and automation-only daemon modes stay current.
+  ensureConfigWatcher();
   // Pre-warm the whisper-server manager once at owner startup so the first
   // voice transcription does not pay cold-start cost. Non-blocking: failures
   // (e.g. runtime not installed) are swallowed; per-request ensureReady retries.

package/src/runtime/shared/automation-attachments.mjs

@@ -0,0 +1,72 @@
+/**
+ * Stored automation attachments (schedule/webhook rows) → askSession content.
+ * Attachment shape (persisted as jsonb): { kind: 'image'|'text'|'pdf', name,
+ * mimeType, data } — image/pdf data is base64, text data is plain text.
+ * Text files inline into the prompt body; images/PDFs become the same
+ * content parts the desktop composer submits ({type:'image'} /
+ * {type:'file'}), so provider media normalization treats them identically.
+ */
+
+export const AUTOMATION_ATTACHMENT_KINDS = ['image', 'text', 'pdf'];
+export const MAX_AUTOMATION_ATTACHMENTS = 8;
+// Base64 total across image/pdf items; text totals separately.
+export const MAX_AUTOMATION_BINARY_TOTAL = 8_000_000;
+export const MAX_AUTOMATION_TEXT_TOTAL = 200_000;
+
+/** Validate + strip a stored/list attachments value to the persisted shape (or null). */
+export function normalizeAutomationAttachments(value) {
+  if (!Array.isArray(value) || value.length === 0) return null;
+  const out = [];
+  let binaryTotal = 0;
+  let textTotal = 0;
+  for (const entry of value.slice(0, MAX_AUTOMATION_ATTACHMENTS)) {
+    if (!entry || typeof entry !== 'object') continue;
+    const kind = String(entry.kind || '').trim();
+    const data = typeof entry.data === 'string' ? entry.data : '';
+    if (!AUTOMATION_ATTACHMENT_KINDS.includes(kind) || !data) continue;
+    if (kind === 'text') {
+      textTotal += data.length;
+      if (textTotal > MAX_AUTOMATION_TEXT_TOTAL) {
+        throw new Error('text attachments are too large together (200 KB max)');
+      }
+    } else {
+      binaryTotal += data.length;
+      if (binaryTotal > MAX_AUTOMATION_BINARY_TOTAL) {
+        throw new Error('image/PDF attachments are too large together (8 MB max)');
+      }
+    }
+    out.push({
+      kind,
+      name: String(entry.name || '').slice(0, 200) || `attachment-${out.length + 1}`,
+      mimeType: String(entry.mimeType || (kind === 'pdf' ? 'application/pdf' : kind === 'image' ? 'image/png' : 'text/plain')),
+      data,
+    });
+  }
+  return out.length ? out : null;
+}
+
+/**
+ * Build the askSession prompt content: plain string when there are no
+ * attachments, otherwise a parts array (text + image/file blocks).
+ */
+export function automationPromptContent(promptText, attachments) {
+  const rows = Array.isArray(attachments) ? attachments : [];
+  let text = String(promptText || '');
+  const textFiles = rows.filter((entry) => entry?.kind === 'text' && entry.data);
+  if (textFiles.length) {
+    text += '\n\n' + textFiles
+      .map((entry) => `--- Attached file: ${entry.name} ---\n${entry.data}`)
+      .join('\n\n');
+  }
+  const parts = [];
+  for (const entry of rows) {
+    if (!entry || typeof entry.data !== 'string' || !entry.data) continue;
+    if (entry.kind === 'image') {
+      parts.push({ type: 'image', data: entry.data, mimeType: entry.mimeType || 'image/png' });
+    } else if (entry.kind === 'pdf') {
+      parts.push({ type: 'file', data: entry.data, mimeType: entry.mimeType || 'application/pdf', filename: entry.name });
+    }
+  }
+  if (parts.length === 0) return text;
+  return [{ type: 'text', text }, ...parts];
+}