sparkecoder 0.1.114 → 0.1.116

package/dist/server/index.js

@@ -7654,6 +7654,48 @@ Headless workers never interfere with desktop workers (they don't touch the scre
 When you spawn a **desktop worker**, include a one-liner in the goal asking it to **record the session by default** (\`screencapture -v -V <seconds> -C\` on macOS) and return the recording path in its result, *unless* the task is long-running / boring / contains sensitive content. The recording lets you (and the user) replay what actually happened on screen. When the worker reports back, mention the recording path in your reply via the original channel.` : ""}
 
 Default bias: **when in doubt, decompose**. Two workers running in parallel and reporting independently is almost always better UX than one worker doing things sequentially.
+
+### How to write a worker goal (and what NOT to put in it)
+
+You delegate; the worker executes. Stay at the **what** level, not the **how**.
+
+**DO** put in the goal:
+
+- The end objective ("open the macOS Weather app and capture the forecast for Anchorage as a screen recording").
+- Which skills the worker should load up-front (\`load_skill recording\`, \`load_skill computer-use\`).
+- Acceptance criteria ("verify the city name is visible in the screenshot before reporting done").
+- Routing back ("post the recording URL to Slack channel C0123 thread 1700.001").
+
+**DO NOT** put in the goal (when you're inventing commands from memory):
+
+- Literal shell commands (\`screencapture -v -V 45 -C /tmp/...\`, \`osascript -e ...\`, \`cliclick kp:cmd+f\`).
+- Pre-written step-by-step bash that you're drafting from training-data recall.
+- The names of tools you can't see in your current toolset.
+
+If you have to reach for memory to write a command, **you're guessing** \u2014 your training data has lots of plausible-looking commands that are subtly wrong or stale. The worker will dutifully follow your wrong instructions instead of consulting the source of truth.
+
+**Exceptions \u2014 concrete steps ARE appropriate ONLY when relayed verbatim:**
+
+You CAN include literal step-by-step commands when one of these is true:
+
+1. **The user gave the steps to you.** Their message says "first run X, then Y, then commit" \u2192 forward those verbatim. That's the user's intent, not your guess.
+2. **A previous turn already established them.** An earlier worker reported "the deploy script lives at \`./scripts/deploy.sh --env prod\`" \u2192 you can hand that command to the next worker.
+3. **The conversation history contains them.** A documented \`bash\` invocation from earlier in the chat, an error message that revealed the right path, a CI log the user shared \u2014 anything already concrete in context.
+
+In all three cases, **label the source** in the goal: *"Per your instructions earlier: 1. run X, 2. run Y..."* or *"Reusing the command worker-foo found last turn: \`./scripts/deploy.sh\`"*.
+
+What you do NOT do:
+
+- **Don't paraphrase or "improve" a skill into the goal.** If the recording skill describes \`sparkecoder record start/stop\`, the goal just says *"per the recording skill, bracket the work with start/stop"* \u2014 never quote the exact command. The worker loads the skill and reads the canonical version itself. You quoting it just adds a way for the quote to drift behind the source of truth.
+- **Don't reason your way to a command.** "I think macOS uses \`open -a Weather\` to launch apps" is exactly the kind of training-data recall that produces stale or wrong commands. Don't include it.
+
+The rule is: **relay, never invent \u2014 and never quote a skill.** Your job is to (a) tell the worker which skills to load, (b) state the objective and acceptance criteria, (c) relay any concrete steps the user or prior context already established. Workers do the looking-up; you do the dispatching.
+
+Bad goal (don't do this):
+> "Start a screen recording with \`screencapture -v -V 45 -C /tmp/weather.mov &\`, then open Weather with \`open -a Weather\`, then click the search bar with cliclick, type 'Anchorage'..."
+
+Good goal (do this):
+> "Capture a 30\u201360s screen recording of opening the macOS Weather app and viewing the Anchorage, AK forecast. \`load_skill recording\` and \`load_skill computer-use\` first; use the canonical commands from those skills. Verify the Anchorage temperature is visible in a final screenshot before completing. Return the recording path + a one-line summary of the forecast."
 `;
 }
 function createSummaryPrompt(conversationHistory) {
@@ -10570,11 +10612,11 @@ ${p.text}` : p.text;
           const { isRemoteConfigured: isRemoteConfigured2, storageQueries: storageQueries2 } = await Promise.resolve().then(() => (init_remote(), remote_exports));
           if (!isRemoteConfigured2()) return [];
           const { readFile: readFile12 } = await import("fs/promises");
-          const { join: join16, basename: basename6 } = await import("path");
+          const { join: join17, basename: basename6 } = await import("path");
           const urls = [];
           for (const filePath of filePaths) {
             try {
-              const fullPath = filePath.startsWith("/") ? filePath : join16(this.session.workingDirectory, filePath);
+              const fullPath = filePath.startsWith("/") ? filePath : join17(this.session.workingDirectory, filePath);
               const fileName = basename6(fullPath);
               const ext = fileName.split(".").pop()?.toLowerCase() || "";
               const mimeMap = {
@@ -10778,6 +10820,121 @@ var init_session_lock = __esm({
   }
 });
 
+// src/orchestrator/webhook-events.ts
+import { existsSync as existsSync18, readFileSync as readFileSync9, appendFileSync as appendFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync7 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
+import { nanoid as nanoid10 } from "nanoid";
+function logFilePath() {
+  return join12(getAppDataDirectory(), "webhook-events.jsonl");
+}
+function ensureLoaded() {
+  if (cache !== null) return cache;
+  cache = [];
+  try {
+    const p = logFilePath();
+    if (!existsSync18(p)) return cache;
+    const lines = readFileSync9(p, "utf-8").split("\n").filter(Boolean);
+    for (const line of lines) {
+      try {
+        cache.push(JSON.parse(line));
+      } catch {
+      }
+    }
+    if (cache.length > MAX_EVENTS) {
+      cache = cache.slice(-MAX_EVENTS);
+      try {
+        writeFileSync3(p, cache.map((e) => JSON.stringify(e)).join("\n") + "\n");
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return cache;
+}
+function appendEvent(ev) {
+  const list = ensureLoaded();
+  list.push(ev);
+  if (list.length > MAX_EVENTS) list.shift();
+  try {
+    const p = logFilePath();
+    mkdirSync7(dirname6(p), { recursive: true });
+    appendFileSync3(p, JSON.stringify(ev) + "\n");
+  } catch {
+  }
+}
+function recordEvent(ev) {
+  const full = {
+    id: ev.id ?? nanoid10(),
+    ts: ev.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+    source: ev.source,
+    status: ev.status,
+    subtype: ev.subtype,
+    channel: ev.channel,
+    user: ev.user,
+    textSnippet: ev.textSnippet?.slice(0, 200),
+    dropReason: ev.dropReason,
+    error: ev.error,
+    sessionId: ev.sessionId,
+    durationMs: ev.durationMs,
+    meta: ev.meta
+  };
+  appendEvent(full);
+  return full.id;
+}
+function updateEvent(id, patch) {
+  const list = ensureLoaded();
+  const i = list.findIndex((e) => e.id === id);
+  if (i < 0) return;
+  list[i] = { ...list[i], ...patch };
+  try {
+    const p = logFilePath();
+    mkdirSync7(dirname6(p), { recursive: true });
+    writeFileSync3(p, list.map((e) => JSON.stringify(e)).join("\n") + "\n");
+  } catch {
+  }
+}
+function listEvents(filter = {}) {
+  const list = ensureLoaded();
+  const q = filter.q?.toLowerCase();
+  const sinceTs = filter.since ? Date.parse(filter.since) : -Infinity;
+  const beforeTs = filter.before ? Date.parse(filter.before) : Infinity;
+  const matched = list.filter((e) => {
+    if (filter.source && e.source !== filter.source) return false;
+    if (filter.status && e.status !== filter.status) return false;
+    const t = Date.parse(e.ts);
+    if (t < sinceTs) return false;
+    if (t >= beforeTs) return false;
+    if (q) {
+      const hay = `${e.channel ?? ""} ${e.user ?? ""} ${e.textSnippet ?? ""} ${e.dropReason ?? ""} ${e.error ?? ""} ${e.subtype ?? ""}`.toLowerCase();
+      if (!hay.includes(q)) return false;
+    }
+    return true;
+  });
+  matched.reverse();
+  const offset = Math.max(0, filter.offset ?? 0);
+  const limit = Math.min(500, Math.max(1, filter.limit ?? 50));
+  return {
+    events: matched.slice(offset, offset + limit),
+    total: matched.length
+  };
+}
+function clearAllEvents() {
+  cache = [];
+  try {
+    writeFileSync3(logFilePath(), "");
+  } catch {
+  }
+}
+var MAX_EVENTS, cache;
+var init_webhook_events = __esm({
+  "src/orchestrator/webhook-events.ts"() {
+    "use strict";
+    init_config();
+    MAX_EVENTS = 1e3;
+    cache = null;
+  }
+});
+
 // src/orchestrator/daemon.ts
 var daemon_exports = {};
 __export(daemon_exports, {
@@ -10839,6 +10996,17 @@ async function runDaemonTurn(sessionId, events) {
   });
   const finishedAt = /* @__PURE__ */ new Date();
   const trimmed = text.trim();
+  recordEvent({
+    source: "daemon",
+    status: error ? "failed" : "completed",
+    channel: events[0]?.ref?.channel ?? void 0,
+    user: events[0]?.ref?.user,
+    textSnippet: trimmed.slice(0, 200),
+    error,
+    sessionId,
+    durationMs: finishedAt.getTime() - startedAt.getTime(),
+    meta: { triggeredBy: events.map((e) => e.content?.slice(0, 80)) }
+  });
   broadcast({ sessionId, text: trimmed, triggeredBy: events, startedAt, finishedAt, error });
 }
 var listeners;
@@ -10849,6 +11017,7 @@ var init_daemon = __esm({
     init_session_lock();
     init_db();
     init_inbox();
+    init_webhook_events();
     listeners = /* @__PURE__ */ new Map();
   }
 });
@@ -11023,8 +11192,8 @@ import { Hono as Hono9 } from "hono";
 import { serve } from "@hono/node-server";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve11, dirname as dirname7, join as join15 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve11, dirname as dirname8, join as join16 } from "path";
 import { spawn as spawn2 } from "child_process";
 import { createServer as createNetServer } from "net";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -11038,10 +11207,10 @@ init_checkpoints();
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z as z17 } from "zod";
-import { existsSync as existsSync18, mkdirSync as mkdirSync7, writeFileSync as writeFileSync3, readdirSync as readdirSync3, statSync as statSync2, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync8, writeFileSync as writeFileSync4, readdirSync as readdirSync3, statSync as statSync2, unlinkSync as unlinkSync3 } from "fs";
 import { readdir as readdir6 } from "fs/promises";
-import { join as join12, basename as basename5, extname as extname8, relative as relative9 } from "path";
-import { nanoid as nanoid10 } from "nanoid";
+import { join as join13, basename as basename5, extname as extname8, relative as relative9 } from "path";
+import { nanoid as nanoid11 } from "nanoid";
 
 // src/tasks/agent-status.ts
 init_questions();
@@ -11682,12 +11851,12 @@ sessions2.get("/:id/diff/:filePath", async (c) => {
 });
 function getAttachmentsDir(sessionId) {
   const appDataDir = getAppDataDirectory();
-  return join12(appDataDir, "attachments", sessionId);
+  return join13(appDataDir, "attachments", sessionId);
 }
 function ensureAttachmentsDir(sessionId) {
   const dir = getAttachmentsDir(sessionId);
-  if (!existsSync18(dir)) {
-    mkdirSync7(dir, { recursive: true });
+  if (!existsSync19(dir)) {
+    mkdirSync8(dir, { recursive: true });
   }
   return dir;
 }
@@ -11698,12 +11867,12 @@ sessions2.get("/:id/attachments", async (c) => {
     return c.json({ error: "Session not found" }, 404);
   }
   const dir = getAttachmentsDir(sessionId);
-  if (!existsSync18(dir)) {
+  if (!existsSync19(dir)) {
     return c.json({ sessionId, attachments: [], count: 0 });
   }
   const files = readdirSync3(dir);
   const attachments = files.map((filename) => {
-    const filePath = join12(dir, filename);
+    const filePath = join13(dir, filename);
     const stats = statSync2(filePath);
     return {
       id: filename.split("_")[0],
@@ -11735,12 +11904,12 @@ sessions2.post("/:id/attachments", async (c) => {
         return c.json({ error: "No file provided" }, 400);
       }
       const dir = ensureAttachmentsDir(sessionId);
-      const id = nanoid10(10);
+      const id = nanoid11(10);
       const ext = extname8(file.name) || "";
       const safeFilename = `${id}_${basename5(file.name).replace(/[^a-zA-Z0-9._-]/g, "_")}`;
-      const filePath = join12(dir, safeFilename);
+      const filePath = join13(dir, safeFilename);
       const arrayBuffer = await file.arrayBuffer();
-      writeFileSync3(filePath, Buffer.from(arrayBuffer));
+      writeFileSync4(filePath, Buffer.from(arrayBuffer));
       return c.json({
         id,
         filename: file.name,
@@ -11761,16 +11930,16 @@ sessions2.post("/:id/attachments", async (c) => {
       return c.json({ error: "Missing filename or data" }, 400);
     }
     const dir = ensureAttachmentsDir(sessionId);
-    const id = nanoid10(10);
+    const id = nanoid11(10);
     const ext = extname8(body.filename) || "";
     const safeFilename = `${id}_${basename5(body.filename).replace(/[^a-zA-Z0-9._-]/g, "_")}`;
-    const filePath = join12(dir, safeFilename);
+    const filePath = join13(dir, safeFilename);
     let base64Data = body.data;
     if (base64Data.includes(",")) {
       base64Data = base64Data.split(",")[1];
     }
     const buffer = Buffer.from(base64Data, "base64");
-    writeFileSync3(filePath, buffer);
+    writeFileSync4(filePath, buffer);
     return c.json({
       id,
       filename: body.filename,
@@ -11793,7 +11962,7 @@ sessions2.delete("/:id/attachments/:attachmentId", async (c) => {
     return c.json({ error: "Session not found" }, 404);
   }
   const dir = getAttachmentsDir(sessionId);
-  if (!existsSync18(dir)) {
+  if (!existsSync19(dir)) {
     return c.json({ error: "Attachment not found" }, 404);
   }
   const files = readdirSync3(dir);
@@ -11801,7 +11970,7 @@ sessions2.delete("/:id/attachments/:attachmentId", async (c) => {
   if (!file) {
     return c.json({ error: "Attachment not found" }, 404);
   }
-  const filePath = join12(dir, file);
+  const filePath = join13(dir, file);
   unlinkSync3(filePath);
   return c.json({ success: true, id: attachmentId });
 });
@@ -11884,7 +12053,7 @@ async function listWorkspaceFiles(baseDir, currentDir, query, limit, results = [
     const entries = await readdir6(currentDir, { withFileTypes: true });
     for (const entry2 of entries) {
       if (results.length >= limit * 2) break;
-      const fullPath = join12(currentDir, entry2.name);
+      const fullPath = join13(currentDir, entry2.name);
       const relativePath = relative9(baseDir, fullPath);
       if (entry2.isDirectory() && IGNORED_DIRECTORIES.has(entry2.name)) {
         continue;
@@ -11932,7 +12101,7 @@ sessions2.get(
       return c.json({ error: "Session not found" }, 404);
     }
     const workingDirectory = session.workingDirectory;
-    if (!existsSync18(workingDirectory)) {
+    if (!existsSync19(workingDirectory)) {
       return c.json({
         sessionId,
         workingDirectory,
@@ -12046,8 +12215,8 @@ init_config();
 import { Hono as Hono2 } from "hono";
 import { zValidator as zValidator2 } from "@hono/zod-validator";
 import { z as z18 } from "zod";
-import { existsSync as existsSync19, mkdirSync as mkdirSync8, writeFileSync as writeFileSync4 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "fs";
+import { join as join14 } from "path";
 
 // src/server/resumable-stream.ts
 import { createResumableStreamContext } from "resumable-stream/generic";
@@ -12134,7 +12303,7 @@ var streamContext = createResumableStreamContext({
 
 // src/server/routes/agents.ts
 init_checkpoints();
-import { nanoid as nanoid11 } from "nanoid";
+import { nanoid as nanoid12 } from "nanoid";
 init_stream_proxy();
 init_recorder();
 init_remote();
@@ -12254,12 +12423,12 @@ var rejectSchema = z18.object({
 var streamAbortControllers = /* @__PURE__ */ new Map();
 function getAttachmentsDirectory(sessionId) {
   const appDataDir = getAppDataDirectory();
-  return join13(appDataDir, "attachments", sessionId);
+  return join14(appDataDir, "attachments", sessionId);
 }
 async function saveAttachmentToDisk(sessionId, attachment, index) {
   const attachmentsDir = getAttachmentsDirectory(sessionId);
-  if (!existsSync19(attachmentsDir)) {
-    mkdirSync8(attachmentsDir, { recursive: true });
+  if (!existsSync20(attachmentsDir)) {
+    mkdirSync9(attachmentsDir, { recursive: true });
   }
   let filename = attachment.filename;
   if (!filename) {
@@ -12277,8 +12446,8 @@ async function saveAttachmentToDisk(sessionId, attachment, index) {
     attachment.mediaType = resized.mediaType;
     attachment.data = buffer.toString("base64");
   }
-  const filePath = join13(attachmentsDir, filename);
-  writeFileSync4(filePath, buffer);
+  const filePath = join14(attachmentsDir, filename);
+  writeFileSync5(filePath, buffer);
   return filePath;
 }
 function stripDataUrlPrefix2(data) {
@@ -12714,7 +12883,7 @@ ${prompt}` });
       });
     } catch {
     }
-    const streamId = `stream_${id}_${nanoid11(10)}`;
+    const streamId = `stream_${id}_${nanoid12(10)}`;
     console.log(`[STREAM] Creating stream ${streamId} for session ${id}`);
     await activeStreamQueries.create(id, streamId);
     const stream = await streamContext.resumableStream(
@@ -12919,7 +13088,7 @@ agents.post(
     });
     const session = agent.getSession();
     const enrichedPrompt = enrichPromptWithDevtoolsContext(session.id, body.prompt);
-    const streamId = `stream_${session.id}_${nanoid11(10)}`;
+    const streamId = `stream_${session.id}_${nanoid12(10)}`;
     await createCheckpoint(session.id, session.workingDirectory, 0);
     await activeStreamQueries.create(session.id, streamId);
     const createQuickStreamProducer = () => {
@@ -13238,26 +13407,26 @@ init_config();
 import { Hono as Hono3 } from "hono";
 import { zValidator as zValidator3 } from "@hono/zod-validator";
 import { z as z19 } from "zod";
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname6, join as join14 } from "path";
+import { dirname as dirname7, join as join15 } from "path";
 var __filename = fileURLToPath3(import.meta.url);
-var __dirname = dirname6(__filename);
+var __dirname = dirname7(__filename);
 var possiblePaths = [
-  join14(__dirname, "../package.json"),
+  join15(__dirname, "../package.json"),
   // From dist/server -> dist/../package.json
-  join14(__dirname, "../../package.json"),
+  join15(__dirname, "../../package.json"),
   // From dist/server (if nested differently)
-  join14(__dirname, "../../../package.json"),
+  join15(__dirname, "../../../package.json"),
   // From src/server/routes (development)
-  join14(process.cwd(), "package.json")
+  join15(process.cwd(), "package.json")
   // From current working directory
 ];
 var currentVersion = "0.0.0";
 var packageName = "sparkecoder";
 for (const packageJsonPath of possiblePaths) {
   try {
-    const packageJson = JSON.parse(readFileSync9(packageJsonPath, "utf-8"));
+    const packageJson = JSON.parse(readFileSync10(packageJsonPath, "utf-8"));
     if (packageJson.name === "sparkecoder") {
       currentVersion = packageJson.version || "0.0.0";
       packageName = packageJson.name || "sparkecoder";
@@ -13707,7 +13876,7 @@ init_config();
 import { Hono as Hono5 } from "hono";
 import { zValidator as zValidator5 } from "@hono/zod-validator";
 import { z as z21 } from "zod";
-import { nanoid as nanoid12 } from "nanoid";
+import { nanoid as nanoid13 } from "nanoid";
 init_questions();
 var tasks = new Hono5();
 var taskAbortControllers = /* @__PURE__ */ new Map();
@@ -13788,7 +13957,7 @@ tasks.post(
     const taskId = agent.sessionId;
     const abortController = new AbortController();
     taskAbortControllers.set(taskId, abortController);
-    const streamId = `stream_${taskId}_${nanoid12(10)}`;
+    const streamId = `stream_${taskId}_${nanoid13(10)}`;
     await activeStreamQueries.create(taskId, streamId);
     const taskStreamProducer = () => {
       const { readable, writable } = new TransformStream();
@@ -14014,6 +14183,7 @@ function verifySlackSignature(opts) {
 // src/server/routes/slack.ts
 init_client3();
 init_slack();
+init_webhook_events();
 init_inbox();
 var recentlyHandled = /* @__PURE__ */ new Map();
 var MAX_RECENT = 1e3;
@@ -14054,7 +14224,17 @@ slack.post("/events", async (c) => {
   }
   if (payload?.type === "event_callback" && payload?.event) {
     const ev = payload.event;
+    const auditId = recordEvent({
+      source: "slack",
+      status: "received",
+      subtype: ev.type === "message" ? `message.${ev.channel_type ?? "channels"}` : ev.type,
+      channel: ev.channel,
+      user: ev.user,
+      textSnippet: typeof ev.text === "string" ? ev.text : void 0,
+      meta: { ts: ev.ts, thread_ts: ev.thread_ts, team: ev.team, event_subtype: ev.subtype }
+    });
     if (alreadyHandled(ev.channel, ev.ts)) {
+      updateEvent(auditId, { status: "dropped", dropReason: "duplicate_delivery" });
       return c.json({ ok: true });
     }
     const { event: inbound, dropReason } = slackEventToInboundResult(ev);
@@ -14064,6 +14244,7 @@ slack.post("/events", async (c) => {
         const ours = isThreadOwned(ev.channel, ev.thread_ts) || await threadBelongsToUs(ev.channel, ev.thread_ts);
         if (!ours) {
           console.log(`[slack] dropping thread reply in unknown thread: channel=${ev.channel} thread=${ev.thread_ts}`);
+          updateEvent(auditId, { status: "dropped", dropReason: "thread_not_owned" });
           return c.json({ ok: true });
         }
       }
@@ -14076,8 +14257,12 @@ slack.post("/events", async (c) => {
       const orchestratorId = await findOrCreateOrchestratorId();
       if (orchestratorId) {
         pushToInbox(orchestratorId, inbound);
+        updateEvent(auditId, { status: "routed", sessionId: orchestratorId });
+      } else {
+        updateEvent(auditId, { status: "error", error: "no orchestrator session available" });
       }
     } else if (dropReason) {
+      updateEvent(auditId, { status: "dropped", dropReason });
       const userFacingDrops = ["user_not_allowed", "channel_not_allowed", "dm_blocked"];
       if (userFacingDrops.includes(dropReason)) {
         console.log(`[slack] dropped event from user=${payload.event.user} channel=${payload.event.channel}: ${dropReason}`);
@@ -14140,13 +14325,30 @@ async function sendDeniedReply(event) {
 init_webhooks_store();
 init_webhook();
 init_inbox();
+init_webhook_events();
 import { Hono as Hono7 } from "hono";
 var inbox = new Hono7();
 inbox.post("/:token", async (c) => {
   const token = c.req.param("token");
-  if (!token || token.length < 16) return c.json({ error: "invalid token" }, 401);
+  if (!token || token.length < 16) {
+    recordEvent({
+      source: "inbox",
+      status: "dropped",
+      dropReason: "invalid_token_format",
+      meta: { tokenLen: token?.length ?? 0 }
+    });
+    return c.json({ error: "invalid token" }, 401);
+  }
   const lookup = await findByToken(token);
-  if (!lookup) return c.json({ error: "unknown token" }, 404);
+  if (!lookup) {
+    recordEvent({
+      source: "inbox",
+      status: "dropped",
+      dropReason: "unknown_token",
+      meta: { tokenPrefix: token.slice(0, 8) + "\u2026" }
+    });
+    return c.json({ error: "unknown token" }, 404);
+  }
   let body;
   const contentType = c.req.header("content-type") || "";
   try {
@@ -14168,6 +14370,14 @@ inbox.post("/:token", async (c) => {
   pushToInbox(lookup.orchestratorSessionId, event);
   void recordHit(lookup.orchestratorSessionId, lookup.webhook.id).catch(() => {
   });
+  recordEvent({
+    source: "inbox",
+    status: "routed",
+    channel: lookup.webhook.name,
+    textSnippet: typeof body === "string" ? body : JSON.stringify(body).slice(0, 200),
+    sessionId: lookup.orchestratorSessionId,
+    meta: { wake: lookup.webhook.wake, webhookId: lookup.webhook.id }
+  });
   return c.json({ ok: true, queued: true, wake: lookup.webhook.wake });
 });
 
@@ -14179,6 +14389,7 @@ init_webhooks_store();
 init_messenger();
 init_store();
 init_pool();
+init_webhook_events();
 import { Hono as Hono8 } from "hono";
 import { zValidator as zValidator6 } from "@hono/zod-validator";
 import { z as z22 } from "zod";
@@ -14237,6 +14448,24 @@ function webhookPrefix() {
   const token = cfg?.webhooks?.token;
   return token ? `/w/${token}` : "/api";
 }
+integrations.get("/events", async (c) => {
+  const q = c.req.query();
+  const filter = {
+    source: q.source,
+    status: q.status,
+    q: q.q,
+    since: q.since,
+    before: q.before,
+    limit: q.limit ? Math.min(500, Math.max(1, parseInt(q.limit, 10))) : 50,
+    offset: q.offset ? Math.max(0, parseInt(q.offset, 10)) : 0
+  };
+  const { events, total } = listEvents(filter);
+  return c.json({ events, total, limit: filter.limit, offset: filter.offset });
+});
+integrations.delete("/events", async (c) => {
+  clearAllEvents();
+  return c.json({ ok: true });
+});
 integrations.get("/", async (c) => {
   const cfg = getConfig();
   return c.json({
@@ -14599,13 +14828,13 @@ var DEFAULT_WEB_PORT = 6969;
 var WEB_PORT_SEQUENCE = [6969, 6970, 6971, 6972, 6973, 6974, 6975, 6976, 6977, 6978];
 function getWebDirectory() {
   try {
-    const currentDir = dirname7(fileURLToPath4(import.meta.url));
+    const currentDir = dirname8(fileURLToPath4(import.meta.url));
     const webDir = resolve11(currentDir, "..", "web");
-    if (existsSync20(webDir) && existsSync20(join15(webDir, "package.json"))) {
+    if (existsSync21(webDir) && existsSync21(join16(webDir, "package.json"))) {
       return webDir;
     }
     const altWebDir = resolve11(currentDir, "..", "..", "web");
-    if (existsSync20(altWebDir) && existsSync20(join15(altWebDir, "package.json"))) {
+    if (existsSync21(altWebDir) && existsSync21(join16(altWebDir, "package.json"))) {
       return altWebDir;
     }
     return null;
@@ -14663,23 +14892,23 @@ async function findWebPort(preferredPort) {
   return { port: preferredPort, alreadyRunning: false };
 }
 function hasProductionBuild(webDir) {
-  const buildIdPath = join15(webDir, ".next", "BUILD_ID");
-  return existsSync20(buildIdPath);
+  const buildIdPath = join16(webDir, ".next", "BUILD_ID");
+  return existsSync21(buildIdPath);
 }
 function hasSourceFiles(webDir) {
-  const appDir = join15(webDir, "src", "app");
-  const pagesDir = join15(webDir, "src", "pages");
-  const rootAppDir = join15(webDir, "app");
-  const rootPagesDir = join15(webDir, "pages");
-  return existsSync20(appDir) || existsSync20(pagesDir) || existsSync20(rootAppDir) || existsSync20(rootPagesDir);
+  const appDir = join16(webDir, "src", "app");
+  const pagesDir = join16(webDir, "src", "pages");
+  const rootAppDir = join16(webDir, "app");
+  const rootPagesDir = join16(webDir, "pages");
+  return existsSync21(appDir) || existsSync21(pagesDir) || existsSync21(rootAppDir) || existsSync21(rootPagesDir);
 }
 function getStandaloneServerPath(webDir) {
   const possiblePaths2 = [
-    join15(webDir, ".next", "standalone", "server.js"),
-    join15(webDir, ".next", "standalone", "web", "server.js")
+    join16(webDir, ".next", "standalone", "server.js"),
+    join16(webDir, ".next", "standalone", "web", "server.js")
   ];
   for (const serverPath of possiblePaths2) {
-    if (existsSync20(serverPath)) {
+    if (existsSync21(serverPath)) {
       return serverPath;
     }
   }
@@ -14719,15 +14948,15 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
     if (!quiet) console.log(`  \u2713 Web UI already running at http://localhost:${actualPort}`);
     return { process: null, port: actualPort };
   }
-  const usePnpm = existsSync20(join15(webDir, "pnpm-lock.yaml"));
-  const useNpm = !usePnpm && existsSync20(join15(webDir, "package-lock.json"));
+  const usePnpm = existsSync21(join16(webDir, "pnpm-lock.yaml"));
+  const useNpm = !usePnpm && existsSync21(join16(webDir, "package-lock.json"));
   const pkgManager = usePnpm ? "pnpm" : useNpm ? "npm" : "npx";
   const { NODE_OPTIONS, TSX_TSCONFIG_PATH, ...cleanEnv } = process.env;
   const apiUrl = publicUrl || `http://127.0.0.1:${apiPort}`;
   const runtimeConfig = { apiBaseUrl: apiUrl };
-  const runtimeConfigPath = join15(webDir, "runtime-config.json");
+  const runtimeConfigPath = join16(webDir, "runtime-config.json");
   try {
-    writeFileSync5(runtimeConfigPath, JSON.stringify(runtimeConfig, null, 2));
+    writeFileSync6(runtimeConfigPath, JSON.stringify(runtimeConfig, null, 2));
     if (!quiet) console.log(`  \u{1F4DD} Runtime config written to ${runtimeConfigPath}`);
   } catch (err) {
     if (!quiet) console.warn(`  \u26A0 Could not write runtime config: ${err}`);
@@ -14747,7 +14976,7 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
   if (standaloneServerPath) {
     command = "node";
     args = ["server.js"];
-    cwd = dirname7(standaloneServerPath);
+    cwd = dirname8(standaloneServerPath);
     webEnv.PORT = String(actualPort);
     webEnv.HOSTNAME = "0.0.0.0";
     if (!quiet) console.log("  \u{1F4E6} Starting Web UI from standalone build...");
@@ -14940,8 +15169,8 @@ async function startServer(options = {}) {
   if (options.workingDirectory) {
     config.resolvedWorkingDirectory = options.workingDirectory;
   }
-  if (!existsSync20(config.resolvedWorkingDirectory)) {
-    mkdirSync9(config.resolvedWorkingDirectory, { recursive: true });
+  if (!existsSync21(config.resolvedWorkingDirectory)) {
+    mkdirSync10(config.resolvedWorkingDirectory, { recursive: true });
     if (!options.quiet) console.log(`\u{1F4C1} Created agent workspace: ${config.resolvedWorkingDirectory}`);
   }
   if (!config.resolvedRemoteServer.url) {