@aitne-sh/aitne 0.1.0

package/scripts/poc/google-connector-inheritance/REPORT.md

@@ -0,0 +1,197 @@
+# POC Report — Google Connector Inheritance
+
+**Date**: 2026-04-19
+**Environment**: Darwin 25.4.0 (macOS), Node 25.8.0
+**Goal**: Verify that headless Claude Code (via `@anthropic-ai/claude-agent-sdk`) and Codex CLI (`codex exec`) subprocesses inherit the user's installed Gmail / Calendar plugins and can actually invoke them.
+
+**Verdict**: ✅ **PASS for both Claude Code and Codex.** The proposed delegated-mode design is technically viable.
+
+---
+
+## 1. Claude Code — Agent SDK (`query()`)
+
+**SDK version**: `@anthropic-ai/claude-agent-sdk@0.2.98`
+**Transport**: SDK spawns a Claude Code CLI subprocess; inherits user config at `~/.claude/`.
+
+### 1.1 Tool manifest inheritance
+
+Probe script: `packages/daemon/scripts/poc/claude-sdk-probe.mjs`
+
+Captured from the `system { subtype: "init" }` message emitted at the start of every SDK session:
+
+```
+Total tools exposed:     238
+MCP servers inherited:   12
+  - plugin:discord:discord
+  - github
+  - google-workspace          ← local stdio MCP (not claude.ai hosted)
+  - claude.ai Indeed
+  - claude.ai Canva
+  - claude.ai Figma
+  - claude.ai Slack
+  - claude.ai Notion
+  - claude.ai Hugging Face
+  - claude.ai Gmail           ← hosted connector (OAuth'd via claude.ai)
+  - claude.ai Google Drive
+  - claude.ai Google Calendar ← hosted connector
+```
+
+Gmail/Calendar tool counts inherited:
+
+- `mcp__claude_ai_Gmail__*` — **10** tools (create_draft, search_threads, get_thread, list_labels, label_message, label_thread, list_drafts, create_label, unlabel_message, unlabel_thread)
+- `mcp__claude_ai_Google_Calendar__*` — **8** tools (create_event, delete_event, get_event, list_calendars, list_events, respond_to_event, suggest_time, update_event)
+- `mcp__google-workspace__*` — **96** tools (gcal_*, gmail_*)
+
+**Conclusion**: Zero config passed to `query()`. The subprocess automatically picks up every MCP the user has configured in Claude Code. Matches the `claude -p` CLI output exactly.
+
+### 1.2 Live invocation
+
+Probe script: `packages/daemon/scripts/poc/claude-sdk-invoke.mjs`
+
+Prompt: *"Call `mcp__claude_ai_Gmail__search_threads` with `newer_than:30d`, pageSize=3. Report whether it succeeded, thread count, first subject."*
+
+Result:
+
+```json
+{
+  "toolUses": [
+    { "name": "mcp__claude_ai_Gmail__search_threads",
+      "input": { "query": "newer_than:30d", "pageSize": 3 } }
+  ],
+  "toolResultsSummary": [ { "is_error": false, "previewLen": 500 } ],
+  "assistantText": "(a) Succeeded: Yes. (b) Threads returned: 3. (c) First thread subject: \"Security alert\"",
+  "result": { "subtype": "success", "durationMs": 10518, "costUsd": 0.115, "numTurns": 3 }
+}
+```
+
+**Conclusion**: The SDK's `query()` subprocess can not only *see* the Gmail connector but *invoke* it and receive real user-account data. Auth is already attached (no reauth prompt).
+
+---
+
+## 2. Codex CLI (`codex exec`)
+
+**CLI version**: `codex-cli 0.121.0`
+**Transport**: Daemon spawns `codex exec --json --skip-git-repo-check --model <id> ...` subprocess (see `packages/daemon/src/core/backends/codex-core.ts:617-631`).
+**Registered MCP servers** (`codex mcp list`):
+```
+google-workspace  /opt/homebrew/bin/node  .../google_workspace/dist/src/index.js  enabled
+```
+Plus Codex's own built-in `codex_apps` namespace (ChatGPT-style app connectors, bundled with the `codex@openai-codex` plugin).
+
+### 2.1 Tool manifest inheritance
+
+Prompt: *"List every tool name containing gmail/calendar/google-workspace."*
+
+Captured tools (truncated for brevity):
+
+- `mcp__codex_apps__gmail._*` — **21** tools (`_search_emails`, `_read_email`, `_send_email`, `_create_draft`, `_apply_labels_to_emails`, `_archive_emails`, `_forward_emails`, `_get_profile`, etc.)
+- `mcp__codex_apps__google_calendar._*` — **11** tools (`_search_events`, `_create_event`, `_update_event`, `_respond_event`, `_get_availability`, etc.)
+- `mcp__google_workspace__.*` — ~100 tools (same local MCP as Claude Code)
+
+**Conclusion**: `codex exec` non-interactive mode inherits both the plugin-provided `codex_apps` connectors AND the user's configured `google-workspace` MCP.
+
+### 2.2 Live invocation
+
+Prompt: *"Call `mcp__codex_apps__gmail._search_emails` with `newer_than:30d`, max_results=3. Report success/count/first subject."*
+
+Result (trimmed from JSON stream):
+
+```
+mcp: codex_apps/gmail_search_emails started
+mcp: codex_apps/gmail_search_emails (completed)
+(a) succeeded: yes
+(b) emails returned: 3
+(c) first email subject: Security alert
+```
+
+**Conclusion**: Codex's native `codex_apps` Gmail connector is invocable from non-interactive `codex exec`, returns real user data. Same inbox state as Claude Code, confirming both are hitting the same underlying Google account.
+
+---
+
+## 3. Cross-backend summary
+
+| Property | Claude Code SDK | Codex CLI |
+|---|---|---|
+| CLI subprocess inherits user plugins | ✅ | ✅ |
+| Hosted Gmail connector available | ✅ `mcp__claude_ai_Gmail__*` (10) | ✅ `mcp__codex_apps__gmail._*` (21) |
+| Hosted Calendar connector available | ✅ `mcp__claude_ai_Google_Calendar__*` (8) | ✅ `mcp__codex_apps__google_calendar._*` (11) |
+| Local `google-workspace` MCP available | ✅ | ✅ |
+| Invocation returns real user data | ✅ | ✅ |
+| Auth prompt during invocation | ❌ (none) | ❌ (none) |
+| First-call latency | ~10 s (Claude) | ~5 s (Codex) |
+| Test cost | $0.12 | included in ChatGPT plan |
+
+**Both backends independently satisfy the Phase 0 success criterion** defined in `GOOGLE_AUTH_DELEGATION_DESIGN.md`.
+
+---
+
+## 4. Implications for the design
+
+### Confirmed assumptions
+
+1. **Daemon can spawn either backend headlessly and reach Gmail/Calendar without owning any OAuth tokens.** This is the foundational assumption of the delegated mode.
+2. **No GCP project, no OAuth JSON, no daemon-side credential management is required** for the delegated path.
+3. **Multi-backend compatibility is symmetric** between Claude Code and Codex for the core Gmail/Calendar use cases. Gemini CLI still needs verification but is not a blocker.
+4. **Each backend uses a different tool namespace** (`mcp__claude_ai_Gmail__*` vs `mcp__codex_apps__gmail._*`). Skills must be compiled per-backend.
+
+### Revised scope
+
+- **Initial delegated-mode support can span Claude Code AND Codex** (not Claude-only as hedged in the draft design). This simplifies fallback routing: `BackendRouter` may fall over main → fallback freely in delegated mode as long as both backends have a Google connector configured.
+- **Skill templates must be namespace-aware per backend**, not just mode-aware. The `SkillsCompiler` change from a `(backend, mode)` matrix remains, but the delegated-mode skill body for Claude Code vs Codex will reference different tool names.
+
+### New concerns surfaced by the POC
+
+1. **Feature parity gap between connectors**. Claude's 10 Gmail tools vs Codex's 21 — Codex exposes attachment reading, batch operations, forwarding, archiving; Claude's hosted connector is thinner. Design must degrade gracefully when a task-flow instruction isn't supported by the active backend.
+2. **`google-workspace` local MCP is the lowest common denominator**. If the user has it installed on both backends, the skill can target it uniformly (~100 tools covering nearly the full API). This may be the cleanest skill-writing target, with `mcp__claude_ai_*` / `mcp__codex_apps__*` as optional shortcuts.
+3. **Invocation cost is non-trivial** ($0.12 for a 3-turn Claude exec on Opus). At hourly-check cadence across multiple accounts, this adds real spend. The design's "single-account only in delegated mode" restriction should stay.
+4. **Tool-name drift risk**. `mcp__claude_ai_Gmail__*` namespace could change if Anthropic renames connectors. Skill prompts that hardcode tool names may break. Mitigation: instruct the agent with role descriptions rather than exact tool names ("use your Gmail search tool") and let the agent discover names at runtime.
+
+---
+
+## 5. Recommended next step
+
+The design doc's Phase 0 is **unblocked**. Proceed to Phase 1 (config plumbing + mode toggle), with one amendment:
+
+- Update `GOOGLE_AUTH_DELEGATION_DESIGN.md` §4.4 to reflect that Claude Code + Codex both qualify as "Google-capable backends" from day one.
+- Defer Gemini CLI verification to a separate task; it does not block initial shipping.
+
+Artifacts:
+
+- `packages/daemon/scripts/poc/claude-sdk-probe.mjs` — SDK tool manifest probe
+- `packages/daemon/scripts/poc/claude-sdk-invoke.mjs` — SDK live invocation probe
+- This report (`scripts/poc/google-connector-inheritance/REPORT.md`)
+
+---
+
+## Appendix — Raw excerpts
+
+### A. SDK init message key fields
+
+```json
+{
+  "systemInit": {
+    "model": "claude-opus-4-6[1m]",
+    "toolCount": 238,
+    "mcpServerCount": 12,
+    "mcpServerNames": [
+      "plugin:discord:discord", "github", "google-workspace",
+      "claude.ai Indeed", "claude.ai Canva", "claude.ai Figma",
+      "claude.ai Slack", "claude.ai Notion", "claude.ai Hugging Face",
+      "claude.ai Gmail", "claude.ai Google Drive", "claude.ai Google Calendar"
+    ]
+  }
+}
+```
+
+### B. Codex config snippet
+
+```
+~/.codex/config.toml
+  model = "gpt-5.4"
+
+codex mcp list
+  Name              Command                 Args                                                              Status
+  google-workspace  /opt/homebrew/bin/node  /Users/shuto/Projects/mcp_server/google_workspace/dist/...        enabled
+```
+
+Codex `codex_apps` connectors are bundled with the `codex@openai-codex` Claude Code plugin (per `~/.claude/plugins/installed_plugins.json`); no separate registration is needed.

package/scripts/poc/google-connector-inheritance/claude-sdk-probe.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+// POC: Verify whether @anthropic-ai/claude-agent-sdk subprocess
+// inherits the user's installed Gmail / Calendar / google-workspace plugins.
+//
+// Mirrors the invocation style used by packages/daemon/src/core/backends/claude-code-core.ts.
+// Run from repo root:  node scripts/poc/google-connector-inheritance/claude-sdk-probe.mjs
+
+import { query } from "@anthropic-ai/claude-agent-sdk";
+
+const prompt =
+  'Print every tool name you have access to whose name contains "gmail", "calendar", or "google-workspace" (case-insensitive). ' +
+  'One tool name per line. No prose, no markdown fences. If none, print "NONE". Do not call the tools.';
+
+async function main() {
+  const toolNames = new Set();
+  let finalText = "";
+  let systemInit = null;
+  let result = null;
+
+  const iter = query({
+    prompt,
+    options: {
+      // Do NOT set mcpServers — we are testing default inheritance.
+      // Do NOT pass cwd — let it default so user-level ~/.claude/ config applies.
+    },
+  });
+
+  for await (const msg of iter) {
+    if (msg.type === "system" && msg.subtype === "init") {
+      systemInit = {
+        model: msg.model,
+        tools: Array.isArray(msg.tools) ? msg.tools : [],
+        mcpServers: Array.isArray(msg.mcp_servers) ? msg.mcp_servers : [],
+      };
+      for (const t of systemInit.tools) toolNames.add(t);
+    } else if (msg.type === "assistant" && msg.message?.content) {
+      for (const block of msg.message.content) {
+        if (block.type === "text") finalText += block.text;
+      }
+    } else if (msg.type === "result") {
+      result = {
+        subtype: msg.subtype,
+        durationMs: msg.duration_ms,
+        costUsd: msg.total_cost_usd,
+        numTurns: msg.num_turns,
+      };
+    }
+  }
+
+  const googleToolsInInit = [...toolNames].filter((t) =>
+    /gmail|calendar|google-workspace/i.test(t),
+  );
+
+  const report = {
+    sdkVersion: (await import("@anthropic-ai/claude-agent-sdk/package.json", { with: { type: "json" } })).default.version,
+    systemInit: systemInit
+      ? {
+          model: systemInit.model,
+          toolCount: systemInit.tools.length,
+          mcpServerCount: systemInit.mcpServers.length,
+          mcpServerNames: systemInit.mcpServers.map((s) => s.name ?? s),
+        }
+      : null,
+    googleToolsInInit,
+    assistantTextGoogleTools: finalText
+      .split(/\r?\n/)
+      .map((l) => l.trim())
+      .filter((l) => /gmail|calendar|google-workspace/i.test(l)),
+    result,
+    rawAssistantText: finalText.slice(0, 2000),
+  };
+
+  console.log(JSON.stringify(report, null, 2));
+}
+
+main().catch((err) => {
+  console.error("POC failed:", err);
+  process.exit(1);
+});

package/scripts/remint-roadmap-ids.mjs

@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+// Re-mint fabricated roadmap-entry IDs in roadmap.md.
+//
+// Background: when `POST /api/context/roadmap/id` is misclassified
+// (e.g. the 2026-04-28 incident where it landed in the default-Approve
+// fail-closed bucket), the agent's `roadmap_refresh` task-flow falls
+// through to inventing IDs inline. Sonnet's typical fabrications follow
+// an obvious `[0-9][a-f][0-9][a-f][0-9][a-f]` alternation pattern
+// (`1a2b3c`, `4d5e6f`, `0d1e2f`, …) instead of the daemon's randomly
+// distributed `[a-f0-9]{6}`. Even after the underlying classifier bug
+// is patched, those fabricated IDs persist in roadmap.md because the
+// task-flow's "merge-by-id" rule preserves existing entries verbatim.
+//
+// This script:
+//   1. Reads the active vault's `roadmap.md` via the daemon API.
+//   2. Detects fabricated IDs by the alternation heuristic (or all
+//      IDs when `--all` is set).
+//   3. Mints a fresh daemon-owned ID for each via
+//      `POST /api/context/roadmap/id`.
+//   4. Rewrites the file via `PUT /api/context/roadmap`.
+//
+// The mint endpoint (now Autonomous) does not require auth, but PUT
+// does — the script reads the bearer token from the macOS keychain
+// the same way the daemon stores it.
+//
+// Usage:
+//   node scripts/remint-roadmap-ids.mjs            # detect + remint
+//   node scripts/remint-roadmap-ids.mjs --dry-run  # print plan only
+//   node scripts/remint-roadmap-ids.mjs --all      # remint every id
+//   node scripts/remint-roadmap-ids.mjs --port 8321 # override port
+//
+// Other vault files (agent-journal.md, dossiers/roadmap.md, project
+// notes) are NOT rewritten — the script logs every replacement so the
+// operator can grep their vault for stale references.
+//
+// IMPORTANT: the live mint+PUT path has only been exercised via
+// `--dry-run` — back up the vault (or rely on the daemon's snapshot
+// table) before running without `--dry-run`. Live execution requires
+// `--yes` to avoid accidental writes.
+
+import { execFileSync } from "node:child_process";
+import { argv, exit } from "node:process";
+
+// Heuristic mirror of `looksFabricatedRoadmapId` in
+// packages/daemon/src/core/roadmap-ids.ts (kept inline so the script
+// has no dist dependency). Unit-tested in roadmap-ids.test.ts; if you
+// change the regex below, update both sites.
+const ROADMAP_ID_RE = /^rm-\d{8}-[a-f0-9]{6}$/;
+const ROADMAP_ID_COMMENT_RE = /<!--\s*id:\s*(rm-\d{8}-[a-f0-9]{6})\s*-->/g;
+const FABRICATED_SUFFIX_RE = /^[0-9][a-f][0-9][a-f][0-9][a-f]$/;
+
+function parseArgs(args) {
+  const opts = { dryRun: false, all: false, port: 8321, yes: false };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--dry-run") opts.dryRun = true;
+    else if (a === "--all") opts.all = true;
+    else if (a === "--yes") opts.yes = true;
+    else if (a === "--port") opts.port = Number(args[++i]);
+    else if (a === "--help" || a === "-h") {
+      process.stdout.write(
+        "Usage: remint-roadmap-ids.mjs [--dry-run] [--all] [--yes] [--port N]\n"
+          + "  --dry-run  print plan, do not write\n"
+          + "  --all      remint every id (default: only fabricated-looking ones)\n"
+          + "  --yes      required to perform live writes (omit for dry-run safety)\n"
+          + "  --port N   override daemon port (default 8321)\n",
+      );
+      exit(0);
+    } else {
+      process.stderr.write(`Unknown argument: ${a}\n`);
+      exit(2);
+    }
+  }
+  return opts;
+}
+
+function readApiToken() {
+  try {
+    return execFileSync(
+      "security",
+      [
+        "find-generic-password",
+        "-s",
+        "com.personal-agent.secret.apiToken",
+        "-w",
+      ],
+      { encoding: "utf-8" },
+    ).trim();
+  } catch (err) {
+    process.stderr.write(
+      `Failed to read API token from macOS keychain: ${err.message}\n`,
+    );
+    process.stderr.write(
+      "(The script needs the daemon's apiToken to PUT the rewritten roadmap.)\n",
+    );
+    exit(1);
+  }
+}
+
+async function fetchJson(url, init = {}) {
+  const res = await fetch(url, init);
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`${init.method ?? "GET"} ${url} → ${res.status}: ${text}`);
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+function suffixOf(id) {
+  // `rm-YYYYMMDD-xxxxxx` → `xxxxxx`
+  const dash = id.lastIndexOf("-");
+  return dash >= 0 ? id.slice(dash + 1) : id;
+}
+
+function looksFabricated(id) {
+  return FABRICATED_SUFFIX_RE.test(suffixOf(id));
+}
+
+function findIdsInBody(body) {
+  const ids = new Set();
+  for (const m of body.matchAll(ROADMAP_ID_COMMENT_RE)) ids.add(m[1]);
+  return [...ids];
+}
+
+async function main() {
+  const opts = parseArgs(argv.slice(2));
+  if (!opts.dryRun && !opts.yes) {
+    process.stderr.write(
+      "Live execution requires --yes (or use --dry-run to preview). Refusing to write.\n",
+    );
+    exit(2);
+  }
+  const base = `http://127.0.0.1:${opts.port}`;
+  const token = readApiToken();
+
+  // 1. Read current roadmap.md (Bearer covers both ReadSensitive and
+  //    Approve tiers, so we always send it).
+  const authHeaders = { Authorization: `Bearer ${token}` };
+  const roadmap = await fetchJson(`${base}/api/context/roadmap`, {
+    headers: authHeaders,
+  }).catch((err) => {
+    process.stderr.write(`Failed to read roadmap.md: ${err.message}\n`);
+    exit(1);
+  });
+  const body =
+    typeof roadmap === "object" && roadmap !== null && "content" in roadmap
+      ? String(roadmap.content)
+      : String(roadmap);
+
+  const allIds = findIdsInBody(body);
+  if (allIds.length === 0) {
+    process.stdout.write("No roadmap IDs found in roadmap.md — nothing to do.\n");
+    return;
+  }
+
+  const targets = opts.all
+    ? allIds.filter((id) => ROADMAP_ID_RE.test(id))
+    : allIds.filter(looksFabricated);
+
+  if (targets.length === 0) {
+    process.stdout.write(
+      `Scanned ${allIds.length} ID(s). None match the fabrication heuristic. Use --all to force re-mint.\n`,
+    );
+    return;
+  }
+
+  process.stdout.write(
+    opts.all
+      ? `Re-minting all ${targets.length} ID(s) (--all flag set):\n`
+      : `Found ${targets.length} fabricated-looking ID(s) (of ${allIds.length} total):\n`,
+  );
+  for (const id of targets) process.stdout.write(`  - ${id}\n`);
+
+  // 2. Mint replacements (daemon refuses to mint a duplicate against
+  //    the live file, so we feed it the IDs already in flight to
+  //    avoid collisions when it scans).
+  const mapping = new Map();
+  for (const oldId of targets) {
+    if (opts.dryRun) {
+      mapping.set(oldId, "<would mint>");
+      continue;
+    }
+    const minted = await fetchJson(`${base}/api/context/roadmap/id`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      // Body is intentionally empty — the mint endpoint defaults
+      // creationDate to today, which is what we want for a re-mint.
+      body: "{}",
+    }).catch((err) => {
+      process.stderr.write(`Mint failed for ${oldId}: ${err.message}\n`);
+      exit(1);
+    });
+    if (!minted || typeof minted.id !== "string" || !ROADMAP_ID_RE.test(minted.id)) {
+      process.stderr.write(`Mint returned malformed response for ${oldId}\n`);
+      exit(1);
+    }
+    if ([...mapping.values()].includes(minted.id)) {
+      // The daemon-side existingIds dedup only sees what's in the
+      // file; back-to-back mint calls within the same script run
+      // could collide. Retry once.
+      process.stderr.write(`Mint collision on ${minted.id}, retrying…\n`);
+      const retry = await fetchJson(`${base}/api/context/roadmap/id`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: "{}",
+      });
+      mapping.set(oldId, retry.id);
+    } else {
+      mapping.set(oldId, minted.id);
+    }
+  }
+
+  process.stdout.write("\nPlanned replacements:\n");
+  for (const [oldId, newId] of mapping)
+    process.stdout.write(`  ${oldId}  →  ${newId}\n`);
+
+  if (opts.dryRun) {
+    process.stdout.write("\n[--dry-run] No file written.\n");
+    return;
+  }
+
+  // 3. Substitute IDs in the body. Use a literal regex per ID so a
+  //    fabricated ID that happens to be a substring of another ID
+  //    (extremely unlikely given the date prefix but cheap to guard)
+  //    can't double-replace.
+  let updated = body;
+  for (const [oldId, newId] of mapping) {
+    const escaped = oldId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    updated = updated.replace(new RegExp(escaped, "g"), newId);
+  }
+
+  // 4. PUT the rewritten roadmap.
+  await fetchJson(`${base}/api/context/roadmap`, {
+    method: "PUT",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({ content: updated }),
+  });
+
+  process.stdout.write(
+    `\nRewrote roadmap.md with ${mapping.size} re-minted ID(s).\n`,
+  );
+  process.stdout.write(
+    "If other vault files (agent-journal.md, dossiers/, projects/) reference the old IDs above, grep + update them manually.\n",
+  );
+}
+
+main().catch((err) => {
+  process.stderr.write(`Unhandled error: ${err.stack ?? err.message}\n`);
+  exit(1);
+});

package/scripts/rm-paths.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import { rm } from "node:fs/promises";
+import path from "node:path";
+
+/**
+ * Cross-platform rm -rf for build artifacts. Each path is resolved
+ * relative to the caller's CWD so per-package `clean` scripts can call
+ * `node ../../scripts/rm-paths.mjs dist` without juggling absolute paths.
+ *
+ * `recursive: true, force: true` matches the `rm -rf` semantics:
+ * non-existent paths are ignored, directories are removed recursively.
+ */
+
+const targets = process.argv.slice(2);
+if (targets.length === 0) {
+  console.error("Usage: rm-paths.mjs <path>...");
+  process.exit(1);
+}
+
+for (const target of targets) {
+  await rm(path.resolve(target), { recursive: true, force: true });
+}