mixdog 0.9.67 → 0.9.69

package/src/runtime/channels/lib/owned-runtime.mjs

@@ -48,6 +48,11 @@ export function createOwnedRuntime({
   let _ownedRuntimeStopRequested = false;
   let bridgeOwnershipRefreshInFlight = null;
   let _memoryDrainTimer = null;
+  // Automation (scheduler + webhook server + relay tunnel) can outlive a
+  // failed/absent messaging backend: it is tracked separately so teardown and
+  // reload know it is running even while bridgeRuntimeConnected stays false.
+  let automationRunning = false;
+  let automationStartPromise = null;
   // Promise that resolves when the current startOwnedRuntime() run fully
   // settles (bridgeRuntimeStarting -> false). reloadRuntimeConfig awaits this
   // before issuing a restart so a backend swap that lands mid-start is not
@@ -133,6 +138,34 @@ function syncOwnedWebhookAndEventRuntime({ reload = false } = {}) {
     setWebhookServer(null);
   }
 }
+async function startAutomationRuntime() {
+  if (automationRunning) {
+    syncOwnedWebhookAndEventRuntime();
+    return;
+  }
+  if (automationStartPromise) return automationStartPromise;
+  if (!bridgeRuntimeStarting) _ownedRuntimeStopRequested = false;
+  const run = (async () => {
+    try {
+      const agentCfg = loadAgentConfig();
+      await initProviders(agentCfg.providers || {});
+    } catch (e) {
+      process.stderr.write(`mixdog: initProviders failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`);
+    }
+    if (_ownedRuntimeStopRequested) return;
+    scheduler.start();
+    startSnapshotWriter(scheduler);
+    syncOwnedWebhookAndEventRuntime();
+    automationRunning = true;
+    process.stderr.write('mixdog: automation runtime up without messaging backend\n');
+  })();
+  automationStartPromise = run;
+  try {
+    return await run;
+  } finally {
+    if (automationStartPromise === run) automationStartPromise = null;
+  }
+}
 let _ownedRuntimeSelfHealing = false;
 // Explicit restore path for an already-connected owner. The 3s ownership tick
 // must not run this implicitly: re-binding status on every tick can move the
@@ -272,9 +305,14 @@ async function startOwnedRuntime(options = {}) {
       if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
       return;
     }
-    scheduler.start();
-    startSnapshotWriter(scheduler);
+    // Reconnect after a degraded (automation-only) start must not double-arm
+    // the scheduler/snapshot timers; the webhook/event sync is idempotent.
+    if (!automationRunning) {
+      scheduler.start();
+      startSnapshotWriter(scheduler);
+    }
     syncOwnedWebhookAndEventRuntime();
+    automationRunning = true;
     if (restoreBinding) {
       if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
       const pendingTranscriptPath = forwarder.transcriptPath;
@@ -303,6 +341,23 @@ async function startOwnedRuntime(options = {}) {
     try { releaseOwnedChannelLocks(instanceId); } catch {}
     try { clearActiveInstance(instanceId); } catch {}
     if (_memoryDrainTimer) { clearInterval(_memoryDrainTimer); _memoryDrainTimer = null; }
+    // DEGRADED MODE (automation decoupling): a messaging connect failure —
+    // packaged runtime without discord.js, bad token, gateway outage — must
+    // not take schedules/webhooks down with it. Start the automation runtime
+    // anyway; sends stay dead (bridgeRuntimeConnected=false) but session
+    // runs, the webhook server, and the relay tunnel work.
+    if (!_ownedRuntimeStopRequested) {
+      if (automationRunning) {
+        // Already degraded-started by an earlier attempt; this run was only a
+        // messaging reconnect retry — the finally below settles the start.
+        return;
+      }
+      try {
+        await startAutomationRuntime();
+      } catch (e3) {
+        process.stderr.write(`mixdog: degraded automation start failed: ${e3 instanceof Error ? e3.message : String(e3)}\n`);
+      }
+    }
   } finally {
     settleInFlightStart();
   }
@@ -318,12 +373,15 @@ async function stopOwnedRuntime(reason) {
   // during that window (bridgeRuntimeStarting=true, getBridgeRuntimeConnected()
   // still false) we still need to tear that partial state down — otherwise
   // the port stays bound and active-instance.json stays stale.
-  if (!getBridgeRuntimeConnected() && !bridgeRuntimeStarting) return;
+  if (!getBridgeRuntimeConnected() && !bridgeRuntimeStarting && !automationRunning && !automationStartPromise) return;
   // If a start is in flight (bridgeRuntimeStarting=true), signal the in-flight
   // startOwnedRuntime() to abort right after its getBackend().connect() resolves.
   // Without this the in-flight start re-marks connected and re-launches
   // scheduler/webhook/heartbeat after we tear them down here.
-  if (bridgeRuntimeStarting) _ownedRuntimeStopRequested = true;
+  if (bridgeRuntimeStarting || automationStartPromise) _ownedRuntimeStopRequested = true;
+  if (automationStartPromise) {
+    try { await automationStartPromise; } catch {}
+  }
   const wasConnected = getBridgeRuntimeConnected();
   stopServerTyping();
   // Release the transcript fs.watch handle plus the forwarder's debounce/retry
@@ -335,6 +393,7 @@ async function stopOwnedRuntime(reason) {
   scheduler.stop();
   stopSnapshotWriter();
   await stopWebhookAndEventRuntime();
+  automationRunning = false;
   releaseOwnedChannelLocks(instanceId);
   clearActiveInstance(instanceId);
   try {
@@ -462,13 +521,14 @@ async function reloadRuntimeConfig() {
   } else if (nextBackend !== previousBackend) {
     try { await nextBackend.disconnect?.(); } catch {}
   }
-  if (getBridgeRuntimeConnected()) {
+  if (getBridgeRuntimeConnected() || automationRunning) {
     syncOwnedWebhookAndEventRuntime({ reload: true });
   } else {
     await stopWebhookAndEventRuntime();
   }
 }
   return {
+    startAutomationRuntime,
     startOwnedRuntime,
     stopOwnedRuntime,
     refreshBridgeOwnership,

package/src/runtime/channels/lib/scheduler.mjs

@@ -558,10 +558,10 @@ ${Scheduler.INSTANCE_UUID}`;
 `);
       return false;
     }
-    // target 'channel' (non-interactive) → dispatch to the schedule's
-    // channel_id, falling back to the resolved main channel. target 'session'
-    // (interactive) → inject into the Lead session with no channel id.
-    const channelId = type === "non-interactive"
+    // target 'channel' → relay the run result to the schedule's channel_id
+    // (falling back to the resolved main channel). target 'session' → no
+    // channel relay; the visible session run IS the surface.
+    const channelId = schedule.target === "channel"
       ? this.resolveChannel(schedule.channelId)
       : "";
     return await this.fireTimedPrompt(schedule, type, prompt, channelId, opts);
@@ -570,16 +570,8 @@ ${Scheduler.INSTANCE_UUID}`;
   async fireTimedPrompt(schedule, type, prompt, channelId, { awaitDispatch = false } = {}) {
     logSchedule(`firing ${schedule.name} (${type})
 `);
-    if (type === "interactive") {
-      if (this.injectFn) {
-        this.injectFn(channelId, schedule.name, " ", {
-          instruction: prompt,
-          type: "schedule"
-        });
-        return true;
-      }
-      return false;
-    }
+    // Legacy interactive Lead-session inject is retired: every schedule fire
+    // runs as its own visible session below (New-task parity, user decision).
     if (this.running.has(schedule.name)) return false;
     this.running.add(schedule.name);
     const presetId = schedule.model;
@@ -598,7 +590,7 @@ ${Scheduler.INSTANCE_UUID}`;
     const dispatch = runScheduleSession(schedule, { prompt })
       .then(({ result }) => {
         this.running.delete(schedule.name);
-        if (result && this.sendFn) {
+        if (result && channelId && this.sendFn) {
           this.sendFn(channelId, result).catch(
             (err) => process.stderr.write(`mixdog scheduler: ${schedule.name} relay failed: ${err}\n`)
           );

package/src/runtime/channels/lib/tool-dispatch.mjs

@@ -27,6 +27,7 @@ function createToolDispatch({
     refreshBridgeOwnership,
     bindPersistedTranscriptIfAny,
     rebindCurrentTranscript,
+    startChannelBridge,
     stopOwnedRuntime,
     reloadRuntimeConfig,
   } = lifecycle;
@@ -60,7 +61,11 @@ function createToolDispatch({
                 notifyRemoteAcquired?.();
               }
               try {
-                await refreshBridgeOwnership({ restoreBinding: true });
+                if (typeof startChannelBridge === 'function') {
+                  await startChannelBridge();
+                } else {
+                  await refreshBridgeOwnership({ restoreBinding: true });
+                }
                 // An already-connected owner returns early from
                 // startOwnedRuntime(), so rebind explicitly to follow the
                 // current (parent-chain) session transcript.

package/src/runtime/channels/lib/webhook/relay-tunnel.mjs

@@ -9,7 +9,7 @@
 // of the box: no binary, no authtoken, no reserved domain.
 import * as http from "http";
 import { randomBytes, randomUUID } from "crypto";
-import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "fs";
 import { join } from "path";
 import WebSocket from "ws";
 import { DATA_DIR } from "../config.mjs";
@@ -41,13 +41,17 @@ export function loadOrCreateHookIdentity() {
     const parsed = JSON.parse(readFileSync(path, "utf8"));
     if (typeof parsed.deviceId === "string" && /^[0-9a-f-]{8,64}$/.test(parsed.deviceId)
       && typeof parsed.deviceSecret === "string" && parsed.deviceSecret.length >= 16) {
+      // The secret authenticates the webhook tunnel leg (whoever holds it can
+      // take over inbound deliveries), so clamp legacy world-readable files.
+      try { chmodSync(path, 0o600); } catch { /* windows/fs quirk */ }
       return { deviceId: parsed.deviceId, deviceSecret: parsed.deviceSecret };
     }
   } catch { /* first run */ }
   const identity = { deviceId: randomUUID(), deviceSecret: randomBytes(24).toString("hex") };
   try {
     mkdirSync(DATA_DIR, { recursive: true });
-    writeFileSync(path, JSON.stringify(identity, null, 2), "utf8");
+    writeFileSync(path, JSON.stringify(identity, null, 2), { encoding: "utf8", mode: 0o600 });
+    try { chmodSync(path, 0o600); } catch { /* windows/fs quirk */ }
   } catch (err) {
     logWebhook(`hook tunnel: identity persist failed — ${err?.message || err}`);
   }

package/src/runtime/channels/lib/webhook.mjs

@@ -283,9 +283,21 @@ class WebhookServer {
       res.end(JSON.stringify({ error: "webhook secret required for endpoint" }));
       return false;
     }
+    // Config-file endpoints used to accept unsigned bodies with a warning. The
+    // payload reaches an agent, so unauthenticated input now needs an explicit
+    // opt-in (endpoint `allowUnsigned: true`, or config.allowUnsignedWebhooks).
+    const allowUnsigned = endpoint?.allowUnsigned === true
+      || this.config.endpoints?.[name]?.allowUnsigned === true
+      || this.config.allowUnsignedWebhooks === true;
+    if (!allowUnsigned) {
+      logWebhook(`${name}: rejected — unsigned request and no secret configured`);
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "webhook secret required for endpoint" }));
+      return false;
+    }
     if (!this.noSecretWarned) {
       this.noSecretWarned = true;
-      logWebhook(`warning \u2014 no webhook secret configured, skipping signature verification`);
+      logWebhook(`warning \u2014 unsigned webhooks explicitly allowed, skipping signature verification`);
     }
     return true;
   }
@@ -397,24 +409,27 @@ ${headersSummary}
 ${payload}
 <<<${_UNTRUSTED}_END>>>`;
   }
-  async _dispatchDelegate(name, role, model, fullPrompt, headers, deliveryId, res, channel) {
+  async _dispatchSessionRun(name, model, fullPrompt, headers, deliveryId, res, extra = {}) {
     await updateDeliveryStatus(name, deliveryId, "processing");
-    // Bridge dispatch must not be allowed to hang forever — without a
+    // Session dispatch must not be allowed to hang forever — without a
     // ceiling a stuck LLM call leaves the delivery in `processing`
     // for the lifetime of the process and dedup keeps re-running
-    // forever. 10 minutes covers the slowest delegate task we ship.
+    // forever. 10 minutes covers the slowest handler run we ship.
     const DISPATCH_TIMEOUT_MS = 10 * 60 * 1000;
     let timeoutHandle = null;
     const dispatchP = Promise.resolve(this.bridgeDispatch({
-      role,
-      preset: model,
+      model: model || null,
       prompt: fullPrompt,
-      cwd: this.config?.cwd,
+      // Endpoint-scoped project/workflow (New-task parity): the webhook row's
+      // cwd/workflow define the created session, not the worker's global cwd.
+      cwd: extra.cwd || this.config?.cwd || null,
+      workflow: extra.workflow || null,
+      attachments: extra.attachments || null,
+      delivery: extra.delivery || null,
       context: {
         source: "webhook",
         endpoint: name,
         deliveryId,
-        channel: channel || null,
         event: headers["x-github-event"] || null,
       },
     }));
@@ -427,54 +442,29 @@ ${payload}
     Promise.race([dispatchP, timeoutP]).then(() => {
       if (timeoutHandle) clearTimeout(timeoutHandle);
       void updateDeliveryStatus(name, deliveryId, "done").catch((e) => logWebhook(`${name}: delivery status update failed: ${e?.message || e}`));
-      logWebhook(`${name}: delegate dispatched to bridge (role=${role}, id=${deliveryId})`);
+      logWebhook(`${name}: webhook session run dispatched (id=${deliveryId})`);
     }).catch((err) => {
       if (timeoutHandle) clearTimeout(timeoutHandle);
       void updateDeliveryStatus(name, deliveryId, "failed", { error: String(err?.message || err) }).catch(() => {});
-      logWebhook(`${name}: delegate dispatch failed: ${err?.message || err}`);
+      logWebhook(`${name}: webhook session run failed: ${err?.message || err}`);
     });
     res.writeHead(202, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ status: "accepted", handler: "delegate", id: deliveryId }));
+    res.end(JSON.stringify({ status: "accepted", handler: "session", id: deliveryId }));
   }
   async handleWebhook(name, body, headers, res, deliveryId, endpoint) {
-    // A PG endpoint row is the folder-handler equivalent: routing is by
-    // channel_id presence — WITH a channel → delegate dispatch to the row's
-    // role/model and report to that channel; WITHOUT → interactive enqueue
-    // into the current (Lead) session. Parser-only endpoints (no table row)
-    // fall through to the event pipeline below.
+    // A PG endpoint row runs as a VISIBLE webhook session (user decision):
+    // no Lead injection, no channel delivery — the run lands in Recent like
+    // a schedule run, and its session content IS the result surface.
+    // Parser-only endpoints (no table row) fall through to the event
+    // pipeline below.
     if (endpoint) {
       try {
-        const { channelId, role, model, instructions } = endpoint;
+        const { model, instructions, cwd, workflow, attachments, delivery } = endpoint;
         const payloadContent = this._buildFencedPayload(body, headers);
-        if (channelId) {
-          if (!role) {
-            await updateDeliveryStatus(name, deliveryId, "failed", { error: "delegate mode requires role" });
-            logWebhook(`${name}: delegate mode requires role - rejected`);
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ status: "rejected", error: "delegate mode requires role" }));
-            return;
-          } else if (!model) {
-            await updateDeliveryStatus(name, deliveryId, "failed", { error: "delegate mode requires model" });
-            logWebhook(`${name}: delegate mode requires model - rejected`);
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ status: "rejected", error: "delegate mode requires model" }));
-            return;
-          } else if (!this.bridgeDispatch) {
-            throw new Error(`[webhook] delegate mode requires bridgeDispatch`);
-          } else {
-            const fullPrompt = `${instructions}\n\n${payloadContent}`;
-            await this._dispatchDelegate(name, role, model, fullPrompt, headers, deliveryId, res, channelId);
-            return;
-          }
-        }
-        if (this.eventPipeline) {
-          await updateDeliveryStatus(name, deliveryId, "processing");
-          this.eventPipeline.enqueueDirect(name, payloadContent, channelId, "interactive", instructions);
-          await updateDeliveryStatus(name, deliveryId, "done");
-          logWebhook(`${name}: interactive enqueued (id=${deliveryId})`);
-        }
-        res.writeHead(202, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ status: "accepted", handler: "interactive", id: deliveryId }));
+        if (!this.bridgeDispatch) throw new Error(`[webhook] session dispatch requires bridgeDispatch`);
+        const fullPrompt = `${instructions}\n\n${payloadContent}`;
+        await this._dispatchSessionRun(name, model || null, fullPrompt, headers, deliveryId, res,
+          { cwd: cwd || null, workflow: workflow || null, attachments: attachments || null, delivery: delivery || null });
         return;
       } catch (err) {
         await updateDeliveryStatus(name, deliveryId, "failed", { error: String(err?.message || err) });

package/src/runtime/channels/lib/worker-main.mjs

@@ -331,6 +331,7 @@ const {
 // flags + ownership timer + memory-drain timer; shares config/backend/
 // bridgeRuntimeConnected/webhookServer/eventPipeline with the worker via get/set.
 const {
+  startAutomationRuntime,
   startOwnedRuntime,
   stopOwnedRuntime,
   refreshBridgeOwnership,
@@ -456,88 +457,31 @@ scheduler.setSendHandler(async (channelId, text) => {
 function wireWebhookHandlers() {
   if (!webhookServer) return;
   webhookServer.setEventPipeline(eventPipeline);
-  webhookServer.setBridgeDispatch(async ({ role, preset, prompt, cwd, context }) => {
-    // Delegate-mode webhook → bridge orchestrator. Each bridge progress /
-    // final event is forwarded to the Lead via the same channel-notify
-    // path used by schedule & event-queue (injectAndRecord). Silent
-    // lifecycle pings keep routing only to Discord.
-    const [{ createStandaloneAgent }, cfgMod, reg, mgr] = await Promise.all([
-      import("../../../standalone/agent-tool.mjs"),
-      import("../../agent/orchestrator/config.mjs"),
-      import("../../agent/orchestrator/providers/registry.mjs"),
-      import("../../agent/orchestrator/session/manager.mjs"),
-    ]);
-    const agentTool = createStandaloneAgent({
-      cfgMod,
-      reg,
-      mgr,
-      dataDir: cfgMod.getPluginData(),
-      cwd,
+  // Webhook fires run as sessions (schedules parity). Delivery mode:
+  // 'app' (default) → the Automations session row IS the surface;
+  // 'channel'/'both' → the run result also relays to the main channel.
+  webhookServer.setBridgeDispatch(async ({ prompt, model, cwd, workflow, attachments, delivery, context }) => {
+    const { runWebhookSession } = await import("../../shared/webhook-session-run.mjs");
+    const run = await runWebhookSession({
+      name: context?.endpoint || "webhook",
+      model: model || null,
+      cwd: cwd || null,
+      workflow: workflow || null,
+      attachments: attachments || null,
+      delivery: delivery || null,
+      prompt,
     });
-    const channelId = resolveWebhookChannelId(context?.channel);
-    const endpoint = context?.endpoint || "unknown";
-    const event = context?.event || null;
-    const deliveryId = context?.deliveryId || null;
-    const label = `webhook:${endpoint}`;
-    const instruction = `Webhook review from role=${role} on endpoint "${endpoint}"`
-      + (event ? ` (event=${event})` : "")
-      + (deliveryId ? ` (delivery=${deliveryId})` : "")
-      + ". Relay the finding to the user naturally — summarize clearly, call out any issues, and note what needs a decision.";
-    const notifyFn = (text, meta = {}) => {
-      if (!text) return;
-      // Webhook skip protocol: when the agent worker emits a `[meta:silent]`
-      // marker (optionally behind model/role tag prefixes), the event is a
-      // no-op (label-only, dedup, "nothing to report"). Drop the message
-      // entirely — neither Lead inject nor Discord forward — instead of the
-      // partial `silent_to_agent` semantics that still audit to Discord.
-      const raw = String(text);
-      if (/^\s*(?:\[[^\]\n]+\]\s*)*\[meta:silent\]/.test(raw)) return;
-      // Deterministic findings-count drop. Code-review handlers emit a
-      // structured `[[findings:N]]` token (N = number of issues). The RELAY —
-      // not the worker's prose — decides: N==0 => clean review, drop entirely
-      // (no Lead inject, no Discord forward). Token absent => fail-safe forward
-      // so a real finding is never silently dropped if the worker omits it.
-      const fc = raw.match(/\[\[findings:(\d+)\]\]/i);
-      if (fc && Number(fc[1]) === 0) return;
-      // Lifecycle pings (started / iter echoes, marked silent_to_agent) are
-      // channel noise for an automated webhook review — drop them entirely so
-      // a skip stays fully silent and only the final answer reaches the
-      // channel. The final [meta:silent] skip result is already dropped above.
-      if (meta?.silent_to_agent === true) return;
-      // Strip the verdict token before surfacing (findings present, N>0).
-      const surfaced = raw.replace(/\[\[findings:\d+\]\]/gi, "").replace(/[^\S\n]{2,}/g, " ").trim();
-      injectAndRecord(channelId, label, surfaced || raw, {
-        type: "webhook",
-        instruction,
-      });
-    };
-    // Per-terminal cwd under the daemon's single channels worker. A webhook
-    // result is injected to ownerConn() — the connection whose session.leadPid
-    // equals active-instance ownerLeadPid — so the worker must run in THAT
-    // owner terminal's cwd. Read the sentinel keyed by ownerLeadPid; cwd-tool
-    // writes session-cwd-<leadPid>.txt per connection, so write and read meet
-    // on the same leadPid key no matter which terminal holds the owner seat.
-    // Falls back to the session entry position; never the plugin CACHE root.
-    const ownerPid = getActiveOwnerPid(readActiveInstance());
-    const ownerCwd = (ownerPid && readLastSessionCwd(ownerPid)) || captureOriginalUserCwd();
-    return agentTool.execute(
-      { type: "spawn", agent: role, preset, prompt, cwd: cwd || ownerCwd },
-      { callerCwd: cwd || ownerCwd, invocationSource: "webhook", notifyFn },
-    );
+    const mode = String(delivery || "app");
+    if ((mode === "channel" || mode === "both") && run?.result && backend?.sendMessage) {
+      const target = scheduler.resolveChannel("");
+      if (target) {
+        void bindingReady.then(() => backend.sendMessage(target, run.result))
+          .catch((err) => dropTrace("send.webhook.err", { channelId: target, err: String(err) }));
+      }
+    }
+    return run;
   });
 }
-function resolveWebhookChannelId(channelFlag) {
-  // Single main channel: the endpoint's `channel` frontmatter is a boolean-ish
-  // flag (any non-empty value except "false" → post to the main channel). A raw
-  // channel id is still honored verbatim for owner-authored overrides.
-  const main = config?.channelId || "";
-  if (channelFlag == null) return main;
-  const v = String(channelFlag).trim();
-  if (v === "" || v.toLowerCase() === "false") return "";
-  // A pure-digit / snowflake-looking value is treated as an explicit id;
-  // anything else (legacy labels like "main") maps to the main channel.
-  return /^-?\d+$/.test(v) ? v : main;
-}
 function wireEventQueueHandlers(eventQueue) {
   if (!eventQueue) return;
   eventQueue.setInjectHandler((channelId, name, content, options) => {
@@ -669,6 +613,7 @@ const {
         recoverUnsyncedTail: true,
       });
     },
+    startChannelBridge: () => start({ messaging: true }),
     stopOwnedRuntime,
     reloadRuntimeConfig,
   },
@@ -707,7 +652,24 @@ async function init(_sharedMcp) {
     injectAndRecord(channelId, name, content, options);
   });
 }
-async function start() {
+function ensureConfigWatcher() {
+  if (_configWatcher) return;
+  try {
+    _configWatcher = fs.watch(path.join(DATA_DIR, "mixdog-config.json"), () => {
+      invalidateConfigReadCache();
+      if (_reloadDebounce) clearTimeout(_reloadDebounce);
+      _reloadDebounce = setTimeout(() => { reloadRuntimeConfig().catch(() => {}); }, 500);
+    });
+  } catch {}
+}
+async function start(options = {}) {
+  if (options?.messaging === false) {
+    channelBridgeActive = false;
+    writeBridgeState(false);
+    await startAutomationRuntime();
+    ensureConfigWatcher();
+    return;
+  }
   channelBridgeActive = true;
   writeBridgeState(true);
   // Daemon model: this runtime is the machine-global singleton bridge owner
@@ -729,18 +691,9 @@ async function start() {
   // ownership timer — the singleton daemon guarantees exactly one owner.
   armBridgeOwnershipTimer();
   // Hot-reload config on file change (schedules/webhooks/events).
-  if (!_configWatcher) {
-    try {
-      _configWatcher = fs.watch(path.join(DATA_DIR, "mixdog-config.json"), () => {
-        // Cross-process edit landed on disk; drop this process's short-TTL raw
-        // config cache synchronously so the debounced reload (and any readAll
-        // in between) sees the fresh file immediately, not up to TTL stale.
-        invalidateConfigReadCache();
-        if (_reloadDebounce) clearTimeout(_reloadDebounce);
-        _reloadDebounce = setTimeout(() => { reloadRuntimeConfig().catch(() => {}); }, 500);
-      });
-    } catch {}
-  }
+  // Cross-process edits invalidate the raw config cache before the debounced
+  // reload so both messaging and automation-only daemon modes stay current.
+  ensureConfigWatcher();
   // Pre-warm the whisper-server manager once at owner startup so the first
   // voice transcription does not pay cold-start cost. Non-blocking: failures
   // (e.g. runtime not installed) are swallowed; per-request ensureReady retries.

package/src/runtime/shared/automation-attachments.mjs

@@ -0,0 +1,72 @@
+/**
+ * Stored automation attachments (schedule/webhook rows) → askSession content.
+ * Attachment shape (persisted as jsonb): { kind: 'image'|'text'|'pdf', name,
+ * mimeType, data } — image/pdf data is base64, text data is plain text.
+ * Text files inline into the prompt body; images/PDFs become the same
+ * content parts the desktop composer submits ({type:'image'} /
+ * {type:'file'}), so provider media normalization treats them identically.
+ */
+
+export const AUTOMATION_ATTACHMENT_KINDS = ['image', 'text', 'pdf'];
+export const MAX_AUTOMATION_ATTACHMENTS = 8;
+// Base64 total across image/pdf items; text totals separately.
+export const MAX_AUTOMATION_BINARY_TOTAL = 8_000_000;
+export const MAX_AUTOMATION_TEXT_TOTAL = 200_000;
+
+/** Validate + strip a stored/list attachments value to the persisted shape (or null). */
+export function normalizeAutomationAttachments(value) {
+  if (!Array.isArray(value) || value.length === 0) return null;
+  const out = [];
+  let binaryTotal = 0;
+  let textTotal = 0;
+  for (const entry of value.slice(0, MAX_AUTOMATION_ATTACHMENTS)) {
+    if (!entry || typeof entry !== 'object') continue;
+    const kind = String(entry.kind || '').trim();
+    const data = typeof entry.data === 'string' ? entry.data : '';
+    if (!AUTOMATION_ATTACHMENT_KINDS.includes(kind) || !data) continue;
+    if (kind === 'text') {
+      textTotal += data.length;
+      if (textTotal > MAX_AUTOMATION_TEXT_TOTAL) {
+        throw new Error('text attachments are too large together (200 KB max)');
+      }
+    } else {
+      binaryTotal += data.length;
+      if (binaryTotal > MAX_AUTOMATION_BINARY_TOTAL) {
+        throw new Error('image/PDF attachments are too large together (8 MB max)');
+      }
+    }
+    out.push({
+      kind,
+      name: String(entry.name || '').slice(0, 200) || `attachment-${out.length + 1}`,
+      mimeType: String(entry.mimeType || (kind === 'pdf' ? 'application/pdf' : kind === 'image' ? 'image/png' : 'text/plain')),
+      data,
+    });
+  }
+  return out.length ? out : null;
+}
+
+/**
+ * Build the askSession prompt content: plain string when there are no
+ * attachments, otherwise a parts array (text + image/file blocks).
+ */
+export function automationPromptContent(promptText, attachments) {
+  const rows = Array.isArray(attachments) ? attachments : [];
+  let text = String(promptText || '');
+  const textFiles = rows.filter((entry) => entry?.kind === 'text' && entry.data);
+  if (textFiles.length) {
+    text += '\n\n' + textFiles
+      .map((entry) => `--- Attached file: ${entry.name} ---\n${entry.data}`)
+      .join('\n\n');
+  }
+  const parts = [];
+  for (const entry of rows) {
+    if (!entry || typeof entry.data !== 'string' || !entry.data) continue;
+    if (entry.kind === 'image') {
+      parts.push({ type: 'image', data: entry.data, mimeType: entry.mimeType || 'image/png' });
+    } else if (entry.kind === 'pdf') {
+      parts.push({ type: 'file', data: entry.data, mimeType: entry.mimeType || 'application/pdf', filename: entry.name });
+    }
+  }
+  if (parts.length === 0) return text;
+  return [{ type: 'text', text }, ...parts];
+}

package/src/runtime/shared/automation-workflow.mjs

@@ -0,0 +1,41 @@
+/**
+ * Resolve a stored automation workflow id (schedule/webhook row) into
+ * createSession options: the workflow summary meta plus the WORKFLOW.md
+ * context block, exactly like a desktop New task session gets for the
+ * active workflow. An empty/unknown id resolves to the default pack via
+ * loadWorkflowPack's fallback; resolution failures degrade to no workflow
+ * context (the session still runs with the base lead ruleset).
+ */
+import { createWorkflowHelpers } from '../../session-runtime/workflow.mjs';
+import { STANDALONE_ROOT, STANDALONE_DATA_DIR } from '../../session-runtime/runtime-paths.mjs';
+import { readMarkdownDocument, normalizeAgentPermissionOrNone } from './markdown-frontmatter.mjs';
+
+let _helpers = null;
+function helpers() {
+  if (!_helpers) {
+    _helpers = createWorkflowHelpers({
+      rootDir: STANDALONE_ROOT,
+      dataDir: STANDALONE_DATA_DIR,
+      readMarkdownDocument,
+      normalizeAgentPermissionOrNone,
+    });
+  }
+  return _helpers;
+}
+
+/** { workflow, workflowContext } createSession opts for a workflow id, or {} when unset/unresolvable. */
+export function automationWorkflowOpts(workflowId) {
+  const id = String(workflowId || '').trim();
+  if (!id) return {};
+  try {
+    const h = helpers();
+    const pack = h.loadWorkflowPack(undefined, id);
+    if (!pack) return {};
+    return {
+      workflow: h.workflowSummary(pack),
+      workflowContext: h.workflowContextBlock({ workflow: { active: id } }, undefined),
+    };
+  } catch {
+    return {};
+  }
+}