prismalens 0.2.0 → 0.4.0

package/dist/src/cli/listen.js

@@ -1,305 +1,569 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright 2026 Sumit Patel
-/**
- * `pl listen` (issue #58, Phase 1 R1) — the walking skeleton of unattended
- * investigation: a token-authed local HTTP receiver for Alertmanager webhooks.
- * Each firing alert runs the SAME seam chain as `investigate`/`serve`
- * (loadConfig → resolveRunSandbox → resolveInvestigation → conductRun with the
- * file session store), resolved PER PAYLOAD — config edits apply to the next
- * webhook without a restart. Alert grouping via a debounce window is implemented;
- * global caps (#62) and Slack notification are still future slices.
- */
+import {
+  createGroupingLayer,
+  deriveDedupeKey,
+  deriveGroupKey
+} from "../../chunk-SSEIMBQ2.js";
+import {
+  createFileSessionStore,
+  liveTimelineEntry,
+  resolveRepoSlug,
+  resolveRunSandbox
+} from "../../chunk-PVQVFRIV.js";
+import {
+  loadConfig
+} from "../../chunk-V6M6ISKI.js";
+import {
+  createSessionManager
+} from "../../chunk-CTKCK7QT.js";
+import {
+  isSynthConfigured,
+  pickServiceLabel,
+  resolveInvestigation
+} from "../../chunk-QDK5PAI3.js";
+import "../../chunk-CVSS5JPC.js";
+import "../../chunk-TGP6QTFO.js";
+import {
+  assertKnownFlags
+} from "../../chunk-PTBCAI34.js";
+import {
+  SeveritySchema,
+  conductRun
+} from "../../chunk-5BT3XQOG.js";
+import "../../chunk-6N4PHBII.js";
+import "../../chunk-XH6DIKTA.js";
+import "../../chunk-2Z7QZSIS.js";
+
+// src/cli/listen.ts
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { conductRun as engineConductRun } from "@prismalens/engine";
+
+// ../@prismalens/contracts/dist/schemas/webhook.js
+import { z } from "zod";
+var PrometheusAlertSchema = z.object({
+  status: z.enum(["firing", "resolved"]),
+  labels: z.record(z.string()),
+  annotations: z.record(z.string()).optional(),
+  startsAt: z.string(),
+  endsAt: z.string().optional(),
+  generatorURL: z.string().optional(),
+  fingerprint: z.string().optional()
+});
+var PrometheusWebhookSchema = z.object({
+  version: z.string().optional(),
+  groupKey: z.string().optional(),
+  truncatedAlerts: z.number().optional(),
+  status: z.enum(["firing", "resolved"]),
+  receiver: z.string().optional(),
+  groupLabels: z.record(z.string()).optional(),
+  commonLabels: z.record(z.string()).optional(),
+  commonAnnotations: z.record(z.string()).optional(),
+  externalURL: z.string().optional(),
+  alerts: z.array(PrometheusAlertSchema)
+});
+var PrometheusWebhookResponseSchema = z.object({
+  received: z.number().int(),
+  processed: z.number().int(),
+  alertIds: z.array(z.string().uuid())
+});
+var GenericWebhookSchema = z.object({
+  title: z.string().min(1),
+  description: z.string().optional(),
+  severity: SeveritySchema.optional(),
+  source: z.string().optional(),
+  sourceAlertId: z.string().optional(),
+  sourceUrl: z.string().optional(),
+  serviceId: z.string().uuid().optional(),
+  serviceName: z.string().optional(),
+  // Will be matched to service by name
+  tags: z.array(z.string()).optional(),
+  labels: z.record(z.string()).optional(),
+  rawPayload: z.record(z.unknown()).optional()
+});
+var GenericWebhookResponseSchema = z.object({
+  alertId: z.string().uuid(),
+  incidentId: z.string().uuid().optional(),
+  isNewIncident: z.boolean()
+});
+
+// src/cli/listen.ts
 import { defineCommand } from "citty";
 import { consola } from "consola";
-import { loadConfig } from "../config/loader.js";
-import { createCapsGate, } from "../core/caps.js";
-import { resolveRepoSlug } from "../core/detect-repo.js";
-import { createFileSessionStore } from "../core/file-session-store.js";
-import { isSynthConfigured, pickServiceLabel, resolveInvestigation, } from "../core/run-investigation.js";
-import { createSessionManager } from "../core/session.js";
-import { startListenServer, WEBHOOK_PATH, } from "../http/server.js";
-import { assertKnownFlags } from "./flags.js";
-import { createGroupingLayer } from "./grouping.js";
-import { liveTimelineEntry, resolveRunSandbox as realResolveRunSandbox, } from "./investigate.js";
-/**
- * The two external boundaries of the chain, injectable for tests: `conductRun`
- * spawns a harness, `resolveRunSandbox` probes/arms a sandbox. Everything else
- * (config loader, resolver, file store) runs real.
- */
-import { notifyRun } from "../core/slack-notify.js";
-/**
- * Build the per-alert investigation executor the intake server drives — the
- * `handleInvestigate` chain (jsonrpc/server.ts) minus the RPC framing. Rejects
- * on a failed run (the server logs it and keeps serving); the sandbox is
- * CALLER-OWNED and destroyed in `finally` (ADR-0020), matching investigate/serve.
- */
-/**
- * Per-payload repo/cwd resolution (issue #58 AC5): the alert's service label
- * (`service`/`namespace`/`job`) → `services[name].repo` → a `repos` entry's
- * `local_path`, else the value itself when it is an existing local checkout.
- * No label / no catalog match / no checkout ⇒ the listen cwd, exactly like a
- * manual `pl investigate` run from that directory (single-player default).
- */
-export function resolveRepoPath(alert, config) {
-    const name = pickServiceLabel(alert);
-    if (!name) {
-        throw new Error(`Listen dispatch refused: alert is missing a service label (cannot resolve an investigation workspace).`);
-    }
-    const repoRef = config.services[name]?.repo;
-    if (!repoRef) {
-        throw new Error(`Listen dispatch refused: service "${name}" has no mapped repo in config (cannot resolve an investigation workspace).`);
+
+// src/core/caps.ts
+var HOUR_MS = 36e5;
+function createCapsGate() {
+  let active = 0;
+  const startsMs = [];
+  return {
+    get activeCount() {
+      return active;
+    },
+    tryDispatch(caps, nowMs) {
+      if (caps.maxConcurrent !== void 0 && active >= caps.maxConcurrent) {
+        return { allow: false, reason: "concurrency" };
+      }
+      const cutoff = nowMs - HOUR_MS;
+      while (startsMs.length > 0 && startsMs[0] <= cutoff) {
+        startsMs.shift();
+      }
+      if (caps.maxPerHour !== void 0 && startsMs.length >= caps.maxPerHour) {
+        return { allow: false, reason: "per_hour" };
+      }
+      active++;
+      startsMs.push(nowMs);
+      return { allow: true };
+    },
+    release() {
+      if (active > 0) active--;
     }
-    const localPath = config.repos[repoRef]?.local_path;
-    if (localPath)
-        return resolve(localPath);
-    if (existsSync(repoRef))
-        return resolve(repoRef);
-    throw new Error(`Listen dispatch refused: repo "${repoRef}" (mapped from service "${name}") does not exist locally (cannot resolve an investigation workspace).`);
+  };
 }
-export function createInvestigationRunner(options, deps = {}) {
-    const conductRun = deps.conductRun ?? engineConductRun;
-    const resolveRunSandbox = deps.resolveRunSandbox ?? realResolveRunSandbox;
-    const notify = deps.notify ?? notifyRun;
-    const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
-    // One gate for the server's lifetime; state (active count + hourly window)
-    // persists across payloads even though config is re-resolved per payload.
-    const caps = deps.capsGate ?? createCapsGate();
-    return async (runId, alerts) => {
-        // Per payload, not once at startup: config (and thus repo/workspace/harness)
-        // is re-resolved for every alert, exactly like a fresh `pl investigate`.
-        const config = await loadConfig({
-            cwd,
-            ...(options.configPath ? { configPath: options.configPath } : {}),
-        });
-        const alertname = (alerts[0]?.labels?.alertname ?? undefined);
-        // AC5: the checkout under investigation follows the ALERT (service label →
-        // catalog), not the directory the server happened to start in.
-        // MUST be resolved before consuming caps so unmapped alerts do not exhaust budget.
-        let repoPath;
-        try {
-            repoPath = resolveRepoPath(alerts[0], config);
-        }
-        catch (err) {
-            const reason = err instanceof Error ? err.message : String(err);
-            console.error(JSON.stringify({
-                event: "dispatch_refused",
-                runId,
-                reason,
-                ...(alertname ? { alertname } : {}),
-            }));
-            options.log(`Refused run ${runId} (${reason})`);
-            const refusedSessions = createSessionManager(config.workspace.base_dir);
-            try {
-                await refusedSessions.recordSuppressed({
-                    runId,
-                    reason,
-                    ...(alertname ? { alertname } : {}),
-                });
-            }
-            finally {
-                refusedSessions.close?.();
-            }
-            return; // refused, never consume caps
-        }
-        const dispatchCaps = {
-            maxConcurrent: config.listen.caps.max_concurrent,
-            maxPerHour: config.listen.caps.max_per_hour,
-        };
-        const decision = caps.tryDispatch(dispatchCaps, Date.now());
-        if (!decision.allow) {
-            // Structured suppression log — match the repo convention
-            // (slack-notify.ts: console.error(JSON.stringify({ event, ... }))).
-            console.error(JSON.stringify({
-                event: "dispatch_suppressed",
-                runId,
-                reason: decision.reason,
-                ...(alertname ? { alertname } : {}),
-                maxConcurrent: dispatchCaps.maxConcurrent,
-                maxPerHour: dispatchCaps.maxPerHour,
-            }));
-            options.log(`Suppressed run ${runId} (${decision.reason} cap)`);
-            const suppressedSessions = createSessionManager(config.workspace.base_dir);
-            try {
-                await suppressedSessions.recordSuppressed({
-                    runId,
-                    reason: decision.reason,
-                    ...(alertname ? { alertname } : {}),
-                });
-            }
-            finally {
-                suppressedSessions.close?.();
-            }
-            return; // never arm a sandbox / call conductRun for a suppressed run
-        }
-        const harnessName = config.agent.default;
-        const { selection } = await resolveRunSandbox(harnessName, config.agent.sandbox, config);
-        let sessions;
-        try {
-            const resolved = resolveInvestigation({
-                alerts,
-                repo: repoPath,
-                ...(selection
-                    ? {
-                        sandbox: selection.sandbox,
-                        requestedSandbox: selection.requested,
-                    }
-                    : {}),
-                ...(config.listen.caps.max_turns !== undefined
-                    ? { maxTurns: config.listen.caps.max_turns }
-                    : {}),
-                isolateSettings: true,
-            }, config);
-            const { context, harness, synth, fidelity, maxBranches } = resolved;
-            const primaryAlert = context.alerts[0];
-            const repoSlug = await resolveRepoSlug(config.repo, repoPath);
-            sessions = createSessionManager(config.workspace.base_dir);
-            const fileSession = createFileSessionStore(sessions, {
-                runId,
-                alertname: primaryAlert.alertname,
-                agent: resolved.harnessName,
-                ...(repoSlug ? { repo: repoSlug } : {}),
-            });
-            options.log(`Investigating "${primaryAlert.alertname}" with ${resolved.harnessName} in ${repoPath} (run ${runId})`);
-            const outcome = await conductRun({
-                context,
-                harness,
-                synth,
-                fidelity,
-                runId,
-                ...(maxBranches !== undefined ? { maxBranches } : {}),
-            }, {
-                sink: (event) => {
-                    const entry = liveTimelineEntry(event);
-                    if (entry)
-                        options.log(entry);
-                },
-                store: fileSession.store,
-            });
-            if (config.listen.slack_webhook_url) {
-                try {
-                    await notify(config.listen.slack_webhook_url, primaryAlert.alertname, outcome);
-                }
-                catch (err) {
-                    // Fallback for an injected notify that violates the contract.
-                    // The real notifyRun never rejects.
-                    options.log(`Slack notification failed with error: ${err}`);
-                }
-            }
-            if (!outcome.report) {
-                throw new Error(outcome.error ?? "investigation produced no evidence");
-            }
-            options.log(`Report saved for run ${runId}`);
-        }
-        finally {
-            caps.release();
-            // Close this run's sqlite connection — the runner opens one PER alert,
-            // so leaving it open would leak a handle on every webhook.
-            sessions?.close?.();
-            // The listen path owns the boundary's lifecycle (ADR-0020) — torn down
-            // whichever way the run exited (report, no-evidence, error, or throw).
-            if (selection)
-                await selection.sandbox.destroy();
-        }
-    };
+
+// src/http/server.ts
+import { timingSafeEqual } from "node:crypto";
+import {
+  createServer
+} from "node:http";
+var DEFAULT_MAX_PENDING = 8;
+var WEBHOOK_PATH = "/webhooks/alertmanager";
+function isAuthorized(req, token) {
+  const header = req.headers.authorization;
+  if (!header?.startsWith("Bearer ")) return false;
+  const presented = Buffer.from(header.slice("Bearer ".length));
+  const expected = Buffer.from(token);
+  return presented.length === expected.length && timingSafeEqual(presented, expected);
 }
-/**
- * The command body behind `pl listen`, separated from citty so it's testable:
- * load config, demand a token, start the intake server wired to the real (or
- * injected) investigation chain. Returns the running server (the caller owns
- * `close()`; the CLI just lets it hold the event loop open).
- */
-export async function startListenFromConfig(options, deps = {}) {
-    const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
-    const config = await loadConfig({
-        cwd,
-        ...(options.configPath ? { configPath: options.configPath } : {}),
-    });
-    if (!isSynthConfigured(config)) {
-        options.log("No Tier-1 provider configured (checked env + _FILE for: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, OLLAMA_API_KEY) — reports will be RAW harness pass-through (un-synthesized). This is supported.");
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+async function readBody(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > MAX_BODY_BYTES) return null;
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+async function startListenServer(options) {
+  const maxPending = options.maxPending ?? DEFAULT_MAX_PENDING;
+  const reply = (res, status, body) => {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+  };
+  const handle = async (req, res) => {
+    const path = (req.url ?? "").split("?", 1)[0];
+    if (path !== WEBHOOK_PATH) {
+      reply(res, 404, { error: "not found" });
+      return;
     }
-    if (!config.listen.token) {
-        // An open intake is not a mode — refuse to start rather than serve unauthenticated.
-        throw new Error("config is missing listen.token (required — intake auth). Add listen.token to prismalens.config.yaml.");
+    if (req.method !== "POST") {
+      res.setHeader("allow", "POST");
+      reply(res, 405, { error: "method not allowed" });
+      return;
     }
-    const sessions = createSessionManager(config.workspace.base_dir);
-    // Startup reaper (#136): mark any orphaned "running" runs from a previous
-    // dead listener as errored, so pl status reflects reality.
-    const staleRuns = await sessions.list({ status: ["running"] });
-    // Liveness guard: only reap runs whose updatedAt is older than the max possible
-    // run duration (wall-clock cap if configured, else 1 hour) plus 5 minutes slack.
-    const runWallClockMs = config.agent.limits.wall_clock_ms || 60 * 60 * 1000;
-    const staleThresholdMs = runWallClockMs + 5 * 60 * 1000;
-    const now = Date.now();
-    for (const run of staleRuns) {
-        const updatedTime = new Date(run.updatedAt).getTime();
-        if (now - updatedTime > staleThresholdMs) {
-            await sessions.update(run.runId, {
-                status: "errored",
-                error: "listener process died mid-investigation (interrupted)",
-            });
-            options.log(`Reaped stale run ${run.runId} from a previous listener`);
-        }
+    if (!isAuthorized(req, options.token)) {
+      reply(res, 401, { error: "unauthorized" });
+      return;
     }
-    const grouping = createGroupingLayer({
-        windowMs: config.listen.grouping_window_ms,
-        sessions,
-        runInvestigation: createInvestigationRunner(options, deps),
-        log: options.log,
+    if (options.grouping.isShuttingDown()) {
+      reply(res, 503, { error: "server is shutting down" });
+      req.destroy();
+      return;
+    }
+    const raw = await readBody(req);
+    if (raw === null) {
+      reply(res, 413, { error: "request body too large" });
+      req.destroy();
+      return;
+    }
+    let payloadObj;
+    try {
+      payloadObj = JSON.parse(raw);
+    } catch {
+      reply(res, 400, { error: "request body is not valid JSON" });
+      return;
+    }
+    const parsed = PrometheusWebhookSchema.safeParse(payloadObj);
+    if (!parsed.success) {
+      const reason = parsed.error.issues.map((i) => `${i.path.join(".") || "payload"}: ${i.message}`).join("; ");
+      reply(res, 400, { error: `invalid Alertmanager payload \u2014 ${reason}` });
+      return;
+    }
+    const firing = parsed.data.alerts.filter(
+      (a) => a.status === "firing"
+    );
+    const payload = payloadObj;
+    const pendingGroups = options.grouping.pendingGroups();
+    const newGroupCount = options.grouping.newGroupCount(firing, payload);
+    if (newGroupCount > 0 && pendingGroups > 0 && pendingGroups + newGroupCount > maxPending) {
+      reply(res, 503, {
+        error: `investigation queue full (${pendingGroups} pending, max ${maxPending}) \u2014 retry later`
+      });
+      return;
+    }
+    reply(res, 202, {
+      received: parsed.data.alerts.length,
+      accepted: firing.length
     });
-    const server = await startListenServer({
-        host: options.host ?? config.listen.host,
-        port: config.listen.port,
-        token: config.listen.token,
-        maxPending: config.listen.max_pending,
-        grouping,
-        log: options.log,
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const fingerprint = firing.length > 0 ? deriveDedupeKey(firing[0]) : "none";
+    const groupKey = firing.length > 0 ? deriveGroupKey(firing[0], payload) : "none";
+    console.error(
+      JSON.stringify({
+        event: "intake_accepted",
+        timestamp,
+        fingerprint,
+        groupKey,
+        alertCount: parsed.data.alerts.length,
+        acceptedCount: firing.length
+      })
+    );
+    options.grouping.admit(firing, payload);
+  };
+  const server = createServer((req, res) => {
+    handle(req, res).catch(() => {
+      if (!res.headersSent) reply(res, 500, { error: "internal error" });
+      else res.end();
     });
-    // grouping holds a connection for the server's lifetime; release it on close
-    // (server.close already drains grouping via shutdown()).
-    return {
-        ...server,
-        async close() {
-            await server.close();
-            sessions.close?.();
-        },
-    };
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(options.port, options.host ?? "127.0.0.1", () => resolve2());
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    throw new Error("listen server bound to a non-TCP address");
+  }
+  return {
+    port: address.port,
+    host: address.address,
+    close: () => {
+      options.grouping.shutdown();
+      return new Promise((resolve2, reject) => {
+        server.close((err) => err ? reject(err) : resolve2());
+      });
+    }
+  };
 }
-export default defineCommand({
-    meta: {
-        name: "listen",
-        description: "Start a token-authed local HTTP listener for Alertmanager webhooks; each firing alert triggers an investigation (Phase 1 R1).\n\nPort and token are configured in the `listen:` block of prismalens.config.yaml (or via PRISMALENS_LISTEN_TOKEN env var).\n\nExamples:\n  $ pl listen\n  $ pl listen --config my-stack.yaml",
-    },
-    args: {
-        config: {
-            type: "string",
-            description: "Path to prismalens.config.yaml (else global→project hierarchy).",
+
+// src/core/slack-notify.ts
+function buildSlackMessage(input) {
+  const { alertname, runId, outcome } = input;
+  if (outcome.failureKind === "cancelled") {
+    return "";
+  }
+  if (outcome.failureKind === "error") {
+    return `${alertname}
+Investigation errored: ${outcome.error ?? "unknown error"}
+Run ${runId} \u2014 pl report ${runId}`;
+  }
+  if (outcome.failureKind === "no-evidence") {
+    return `${alertname}
+Investigated \u2014 insufficient evidence to determine a cause.
+Run ${runId} \u2014 pl report ${runId}`;
+  }
+  const report = outcome.report;
+  if (!report) {
+    return "";
+  }
+  let message = `${alertname}
+${report.summary}
+Root cause: ${report.rootCause ?? "not determined"}`;
+  if (report.hypotheses.length > 0) {
+    const topHypothesis = report.hypotheses[0];
+    message += `
+Top hypothesis: ${topHypothesis.statement} (${topHypothesis.evidence.length} evidence)`;
+  }
+  message += `
+Run ${runId} \u2014 pl report ${runId}`;
+  return message;
+}
+async function postToSlack(webhookUrl, text) {
+  const res = await fetch(webhookUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ text }),
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!res.ok) {
+    throw new Error(`Slack webhook returned ${res.status}`);
+  }
+}
+async function notifyRun(webhookUrl, alertname, outcome) {
+  try {
+    const text = buildSlackMessage({
+      alertname,
+      runId: outcome.runId,
+      outcome
+    });
+    if (!text) {
+      return;
+    }
+    await postToSlack(webhookUrl, text);
+  } catch (err) {
+    console.error(
+      JSON.stringify({
+        event: "slack_delivery_failed",
+        runId: outcome.runId,
+        error: err instanceof Error ? err.message : String(err)
+      })
+    );
+  }
+}
+
+// src/cli/listen.ts
+function resolveRepoPath(alert, config) {
+  const name = pickServiceLabel(alert);
+  if (!name) {
+    throw new Error(
+      `Listen dispatch refused: alert is missing a service label (cannot resolve an investigation workspace).`
+    );
+  }
+  const repoRef = config.services[name]?.repo;
+  if (!repoRef) {
+    throw new Error(
+      `Listen dispatch refused: service "${name}" has no mapped repo in config (cannot resolve an investigation workspace).`
+    );
+  }
+  const localPath = config.repos[repoRef]?.local_path;
+  if (localPath) return resolve(localPath);
+  if (existsSync(repoRef)) return resolve(repoRef);
+  throw new Error(
+    `Listen dispatch refused: repo "${repoRef}" (mapped from service "${name}") does not exist locally (cannot resolve an investigation workspace).`
+  );
+}
+function createInvestigationRunner(options, deps = {}) {
+  const conductRun2 = deps.conductRun ?? conductRun;
+  const resolveRunSandbox2 = deps.resolveRunSandbox ?? resolveRunSandbox;
+  const notify = deps.notify ?? notifyRun;
+  const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
+  const caps = deps.capsGate ?? createCapsGate();
+  return async (runId, alerts) => {
+    const config = await loadConfig({
+      cwd,
+      ...options.configPath ? { configPath: options.configPath } : {}
+    });
+    const alertname = alerts[0]?.labels?.alertname ?? void 0;
+    let repoPath;
+    try {
+      repoPath = resolveRepoPath(alerts[0], config);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      console.error(
+        JSON.stringify({
+          event: "dispatch_refused",
+          runId,
+          reason,
+          ...alertname ? { alertname } : {}
+        })
+      );
+      options.log(`Refused run ${runId} (${reason})`);
+      const refusedSessions = createSessionManager(config.workspace.dir);
+      try {
+        await refusedSessions.recordSuppressed({
+          runId,
+          reason,
+          ...alertname ? { alertname } : {}
+        });
+      } finally {
+        refusedSessions.close?.();
+      }
+      return;
+    }
+    const dispatchCaps = {
+      maxConcurrent: config.listen.caps.max_concurrent,
+      maxPerHour: config.listen.caps.max_per_hour
+    };
+    const decision = caps.tryDispatch(dispatchCaps, Date.now());
+    if (!decision.allow) {
+      console.error(
+        JSON.stringify({
+          event: "dispatch_suppressed",
+          runId,
+          reason: decision.reason,
+          ...alertname ? { alertname } : {},
+          maxConcurrent: dispatchCaps.maxConcurrent,
+          maxPerHour: dispatchCaps.maxPerHour
+        })
+      );
+      options.log(`Suppressed run ${runId} (${decision.reason} cap)`);
+      const suppressedSessions = createSessionManager(config.workspace.dir);
+      try {
+        await suppressedSessions.recordSuppressed({
+          runId,
+          reason: decision.reason,
+          ...alertname ? { alertname } : {}
+        });
+      } finally {
+        suppressedSessions.close?.();
+      }
+      return;
+    }
+    const harnessName = config.agent.default;
+    const { selection } = await resolveRunSandbox2(
+      harnessName,
+      config.agent.sandbox,
+      config
+    );
+    let sessions;
+    try {
+      const resolved = resolveInvestigation(
+        {
+          alerts,
+          repo: repoPath,
+          ...selection ? {
+            sandbox: selection.sandbox,
+            requestedSandbox: selection.requested
+          } : {},
+          ...config.listen.caps.max_turns !== void 0 ? { maxTurns: config.listen.caps.max_turns } : {},
+          isolateSettings: true
         },
-        host: {
-            type: "string",
-            description: "Bind host (default 127.0.0.1).",
+        config
+      );
+      const { context, harness, synth, fidelity, maxBranches } = resolved;
+      const primaryAlert = context.alerts[0];
+      const repoSlug = await resolveRepoSlug(config.repo, repoPath);
+      sessions = createSessionManager(config.workspace.dir);
+      const fileSession = createFileSessionStore(sessions, {
+        runId,
+        alertname: primaryAlert.alertname,
+        agent: resolved.harnessName,
+        ...repoSlug ? { repo: repoSlug } : {}
+      });
+      options.log(
+        `Investigating "${primaryAlert.alertname}" with ${resolved.harnessName} in ${repoPath} (run ${runId})`
+      );
+      const outcome = await conductRun2(
+        {
+          context,
+          harness,
+          synth,
+          fidelity,
+          runId,
+          ...maxBranches !== void 0 ? { maxBranches } : {}
         },
-    },
-    /* v8 ignore start — process-global glue (cwd + consola binding); the body it
-       delegates to is fully covered via startListenFromConfig tests */
-    async run({ args, cmd }) {
-        try {
-            assertKnownFlags(args, cmd);
-            const server = await startListenFromConfig({
-                cwd: process.cwd(),
-                ...(args.config ? { configPath: args.config } : {}),
-                ...(args.host ? { host: args.host } : {}),
-                log: (line) => consola.log(line),
-            });
-            consola.success(`Listening for Alertmanager webhooks on http://${server.host}:${server.port}${WEBHOOK_PATH}`);
+        {
+          sink: (event) => {
+            const entry = liveTimelineEntry(event);
+            if (entry) options.log(entry);
+          },
+          store: fileSession.store
         }
-        catch (err) {
-            consola.error(err instanceof Error ? err.message : String(err));
-            process.exit(1);
+      );
+      if (config.listen.slack_webhook_url) {
+        try {
+          await notify(
+            config.listen.slack_webhook_url,
+            primaryAlert.alertname,
+            outcome
+          );
+        } catch (err) {
+          options.log(`Slack notification failed with error: ${err}`);
         }
+      }
+      if (!outcome.report) {
+        throw new Error(outcome.error ?? "investigation produced no evidence");
+      }
+      options.log(`Report saved for run ${runId}`);
+    } finally {
+      caps.release();
+      sessions?.close?.();
+      if (selection) await selection.sandbox.destroy();
+    }
+  };
+}
+async function startListenFromConfig(options, deps = {}) {
+  const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
+  const config = await loadConfig({
+    cwd,
+    ...options.configPath ? { configPath: options.configPath } : {}
+  });
+  if (!isSynthConfigured(config)) {
+    options.log(
+      "No Tier-1 provider configured (checked env + _FILE for: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, OLLAMA_API_KEY) \u2014 reports will be RAW harness pass-through (un-synthesized). This is supported."
+    );
+  }
+  if (!config.listen.token) {
+    throw new Error(
+      "config is missing listen.token (required \u2014 intake auth). Add listen.token to prismalens.config.yaml."
+    );
+  }
+  const sessions = createSessionManager(config.workspace.dir);
+  const staleRuns = await sessions.list({ status: ["running"] });
+  const runWallClockMs = config.agent.limits.wall_clock_ms || 60 * 60 * 1e3;
+  const staleThresholdMs = runWallClockMs + 5 * 60 * 1e3;
+  const now = Date.now();
+  for (const run of staleRuns) {
+    const updatedTime = new Date(run.updatedAt).getTime();
+    if (now - updatedTime > staleThresholdMs) {
+      await sessions.update(run.runId, {
+        status: "errored",
+        error: "listener process died mid-investigation (interrupted)"
+      });
+      options.log(`Reaped stale run ${run.runId} from a previous listener`);
+    }
+  }
+  const grouping = createGroupingLayer({
+    windowMs: config.listen.grouping_window_ms,
+    sessions,
+    runInvestigation: createInvestigationRunner(options, deps),
+    log: options.log
+  });
+  const server = await startListenServer({
+    host: options.host ?? config.listen.host,
+    port: config.listen.port,
+    token: config.listen.token,
+    maxPending: config.listen.max_pending,
+    grouping,
+    log: options.log
+  });
+  return {
+    ...server,
+    async close() {
+      await server.close();
+      sessions.close?.();
+    }
+  };
+}
+var listen_default = defineCommand({
+  meta: {
+    name: "listen",
+    description: "Start a token-authed local HTTP listener for Alertmanager webhooks; each firing alert triggers an investigation (Phase 1 R1).\n\nPort and token are configured in the `listen:` block of prismalens.config.yaml (or via PRISMALENS_LISTEN_TOKEN env var).\n\nExamples:\n  $ pl listen\n  $ pl listen --config my-stack.yaml"
+  },
+  args: {
+    config: {
+      type: "string",
+      description: "Path to prismalens.config.yaml (else global\u2192project hierarchy)."
     },
-    /* v8 ignore stop */
+    host: {
+      type: "string",
+      description: "Bind host (default 127.0.0.1)."
+    }
+  },
+  /* v8 ignore start — process-global glue (cwd + consola binding); the body it
+     delegates to is fully covered via startListenFromConfig tests */
+  async run({ args, cmd }) {
+    try {
+      assertKnownFlags(args, cmd);
+      const server = await startListenFromConfig({
+        cwd: process.cwd(),
+        ...args.config ? { configPath: args.config } : {},
+        ...args.host ? { host: args.host } : {},
+        log: (line) => consola.log(line)
+      });
+      consola.success(
+        `Listening for Alertmanager webhooks on http://${server.host}:${server.port}${WEBHOOK_PATH}`
+      );
+    } catch (err) {
+      consola.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+  /* v8 ignore stop */
 });
-//# sourceMappingURL=listen.js.map
+export {
+  createInvestigationRunner,
+  listen_default as default,
+  resolveRepoPath,
+  startListenFromConfig
+};