@aitne-sh/aitne 0.1.4 → 0.1.6

package/agent-assets/task-flows/wiki.connect.md

@@ -0,0 +1,12 @@
+{context}
+
+## Task: Bridge two domains in the wiki
+
+Read `<wiki_command>` for `topic_a` and `topic_b`. Follow the `wiki-connect` skill:
+
+1. Search each topic independently and read enough matches to characterise each domain. Disambiguate string matches against `90_meta/taxonomy.md`.
+2. Surface bridges in four buckets — shared terminology, common references, structural analogies, and bridging concept candidates. Cite every bridge with at least one wiki path from each side. A bridge that can only cite one side belongs in the candidates list, not in the others.
+3. Write one connection report to `30_outputs/<YYYY-MM-DD>-connect-<slug-a>--<slug-b>.md` through the Wiki API with `x-process-key: wiki.connect`. Use the canonical slugs from `90_meta/taxonomy.md` when available.
+4. Append a one-line `log.md` entry referencing the output filename and both topics.
+
+If no real bridges exist, write the report anyway with empty sections marked `_(none)_` and a `## Summary` that names that directly — a "no connection" finding is still useful. Do not create new wiki notes from this flow; the bridging concept candidates section is a proposal for `wiki.compile` to pick up later. End with a short internal summary only.

package/agent-assets/task-flows/wiki.ingest_url.md

@@ -0,0 +1,35 @@
+{context}
+
+## Task: Ingest URL into the wiki
+
+A single `!ingest` call landed here. Read `<wiki_command>` for the target `url` and `<wiki_workspace>` for the destination workspace.
+
+You succeed if and only if you POST a new file to `/api/wiki/<workspace>/files/10_raw/<slug>.md` and the daemon responds with `{"ok":true,"path":"10_raw/<slug>.md"}`. There is no other definition of success. The vault file is created by that POST and nothing else — `Write` tool / shell redirection / other endpoints do not put a file in the vault.
+
+### Critical: the Bash command MUST start with literal `curl`
+
+The `Bash(curl *)` allow-list is prefix-matched. Wrappers (`echo '{...}' | curl …`, `cat <<JSON | curl … -d @-`, `bash -c "curl …"`, parentheses, chained `curl … ; curl …`) are silently denied under `dontAsk` — you get no error, no `PA_API_ERROR`, just an empty response. If a Bash call returns nothing, rewrite it to start with `curl`.
+
+Article bodies are typically multi-KB — use a heredoc redirected directly into curl (the command still starts with `curl`):
+
+```
+curl http://localhost:8321/api/wiki/<workspace>/files/10_raw/<slug>.md \
+  -X POST \
+  -H 'content-type: application/json' \
+  -H 'x-process-key: wiki.ingest_url' \
+  -d @- <<'JSON'
+{"content":"---\n…frontmatter…\n---\n\n# Title\n\n## Source extracts\n\n…"}
+JSON
+```
+
+The shim reads stdin when `-d @-` is passed, so the heredoc body lands as the JSON payload. Inside `<<'JSON'` (single-quoted marker) the body is verbatim — no shell escaping, only JSON escapes (`\"`, `\\`, `\n`). For short bodies (a few hundred bytes) inline `-d '<json>'` is fine.
+
+### Procedure
+
+1. Fetch the URL with the per-backend primitive (WebFetch on Claude, curl on Codex, web_fetch on Gemini).
+2. POST one new note at `10_raw/<slug>.md` via the daemon Wiki API with `-H 'x-process-key: wiki.ingest_url'`. Path is EXACTLY `10_raw/<slug>.md` — no nested folders like `10_raw/articles/...`.
+3. **Inspect the curl response.** Only `{"ok":true,"path":"10_raw/<slug>.md"}` counts as success. Anything else (4xx, 5xx, missing fields, hallucinated endpoint like `/api/send-message`, no response) means the file was NOT created — PATCH `log.md` with the failure reason and emit the failure DM.
+
+The `wiki-ingest` skill carries the full curl shapes, slug rules, error-code recovery table, and completion-DM format.
+
+End the turn with the single-line completion DM defined in the skill. The path you cite in the success DM must be byte-identical to the `path` field the daemon returned. Do not fabricate a path. Do not claim success without seeing `{"ok":true,...}`. The daemon forwards your final assistant text to the user — you must NOT also call `/api/send-message`, `/api/whatsapp/send`, `/api/notify-user`, `/api/dm`, or any other "send" endpoint; those do not exist.

package/agent-assets/task-flows/wiki.lint.md

@@ -0,0 +1,13 @@
+{context}
+
+## Task: Audit wiki health
+
+Read `<wiki_command>` for the target workspace. Follow the `wiki-lint` skill:
+
+1. Inventory the workspace via `GET /api/wiki/{{workspace_name}}/index` and read `90_meta/schemas/*` for the current schema.
+2. Run every check the skill enumerates (orphans, broken wikilinks, missing frontmatter, stale content, term inconsistencies, taxonomy candidates, index drift). Empty findings are still reported.
+3. Write exactly one health report to `90_meta/health/<YYYY-MM-DD>.md` through the Wiki API with `x-process-key: wiki.lint`. The report must include the `## Action items` and `## Summary` sections in the exact order documented by the skill.
+4. If — and only if — there are taxonomy candidates, append a `# Candidates` section to `90_meta/taxonomy.md` with `mode: "append"`. The owner reviews this before any promotion happens; do not edit the existing `## Topics` section.
+5. Append a concise summary line to `log.md`.
+
+Do not modify content layers (`10_raw/`, `20_wiki/`, `30_outputs/`). End with a short internal summary only.

package/agent-assets/task-flows/wiki.trace.md

@@ -0,0 +1,13 @@
+{context}
+
+## Task: Trace an idea's evolution across the wiki
+
+Read `<wiki_command>` for the `topic`. Follow the `wiki-trace` skill:
+
+1. Search across all layers (`10_raw/`, `20_wiki/`, `30_outputs/`) and read the matches that look load-bearing. Use `90_meta/taxonomy.md` to canonicalise the topic slug.
+2. Order findings chronologically using the most authoritative date available (asserted dates → output filename dates → file `mtime`). Mark any date that came from `mtime` as "discovered on" rather than "happened on".
+3. Group into two to five phases of stable framing. For each phase, name the dominant question, the new evidence, and what changed compared to the previous phase. Cite every claim with a wiki path.
+4. Write one timeline report to `30_outputs/<YYYY-MM-DD>-trace-<slug>.md` through the Wiki API with `x-process-key: wiki.trace`. Follow the section order documented by the skill.
+5. Append a one-line `log.md` entry referencing the output filename and the topic.
+
+If the wiki has fewer than two distinct sources on the topic, keep the report short and say so directly in `## Summary` — do not pad it with speculation. End with a short internal summary only.

package/agent-assets/wiki-seeds/schemas/output.md

@@ -0,0 +1,12 @@
+# Output Schema
+
+Outputs live under `30_outputs/` and answer a specific user question from the wiki.
+
+## Required Shape
+
+- Question
+- Short answer
+- Evidence
+- Source links
+- Follow-up gaps
+

package/agent-assets/wiki-seeds/schemas/raw.md

@@ -0,0 +1,13 @@
+# Raw Note Schema
+
+Raw notes live under `10_raw/` and preserve source facts before synthesis.
+
+## Required Shape
+
+- Source URL
+- Retrieved timestamp
+- Source title when available
+- Extracted facts
+- Quotes or snippets only when they are short and necessary
+- Open questions
+

package/agent-assets/wiki-seeds/schemas/wiki.md

@@ -0,0 +1,12 @@
+# Wiki Note Schema
+
+Wiki notes live under `20_wiki/` and contain synthesized, cited knowledge.
+
+## Required Shape
+
+- Summary
+- Key facts
+- Source links
+- Related notes
+- Unknowns or conflicts
+

package/agent-assets/wiki-seeds/taxonomy.md

@@ -0,0 +1,13 @@
+# Wiki Taxonomy
+
+This file defines canonical topic names, aliases, merge rules, and review notes for the internal wiki workspace.
+
+## Topics
+
+- Add canonical topics as `wiki.compile` discovers stable subjects.
+
+## Merge Rules
+
+- Prefer preserving source attribution over collapsing similar claims too aggressively.
+- Keep ambiguous or conflicting facts visible until a later compile pass resolves them.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aitne-sh/aitne",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Aitne — a local-first, proactive personal AI agent. A long-running TypeScript daemon is the nervous system; Claude Code (or Codex / Gemini CLI) is the brain. All persistent memory lives in local Markdown files.",
   "keywords": [
     "ai",
@@ -31,16 +31,21 @@
   },
   "files": [
     "bin",
-    "scripts",
     "personal-agent.mjs",
     "agent-assets",
+    "scripts/start.mjs",
+    "scripts/run-node.mjs",
+    "scripts/browser.mjs",
+    "scripts/rm-paths.mjs",
+    "scripts/lib/",
+    "scripts/commands/*.mjs",
     "LICENSE",
     "README.md"
   ],
   "dependencies": {
-    "@aitne/daemon": "0.1.4",
-    "@aitne/dashboard": "0.1.4",
-    "@aitne/shared": "0.1.4"
+    "@aitne/daemon": "0.1.6",
+    "@aitne/dashboard": "0.1.6",
+    "@aitne/shared": "0.1.6"
   },
   "devDependencies": {
     "@typescript-eslint/eslint-plugin": "^8.58.1",
@@ -62,7 +67,6 @@
     "build": "turbo run build",
     "start": "node bin/aitne.mjs start",
     "stop": "node bin/aitne.mjs stop",
-    "restart": "node bin/aitne.mjs restart",
     "status": "node bin/aitne.mjs status",
     "logs": "node bin/aitne.mjs logs",
     "dev": "node bin/aitne.mjs dev",

package/scripts/check-redaction-coverage.mjs

@@ -1,109 +0,0 @@
-#!/usr/bin/env node
-// Roadmap §2.5 / §9.2 — redaction static guard.
-//
-// Fails (exit 1) if any production source file outside the single
-// permitted module (`auth-health-monitor.ts`) contains a raw SQL
-// assignment to `auth_detail` or `last_error`. The permitted module
-// owns the `writeAuthFailureDetail` / `writeAuthOkDetail` helpers,
-// which apply `redactSensitiveString` unconditionally — every other
-// caller is required to go through them.
-//
-// Exemptions:
-//   - test files (*.test.ts)         — they seed raw fixtures, not
-//                                       production writes
-//   - `auth-health-monitor.ts`        — the helpers themselves
-//
-// A match prints file:line:matching-line and exits non-zero. The full
-// scan runs in well under a second; it is intended to be wired into
-// `pnpm test`'s preamble (or a CI step) so that a new offending write
-// cannot silently land alongside a green test suite.
-
-import { execFileSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { dirname, relative, resolve } from "node:path";
-import { existsSync } from "node:fs";
-
-const here = dirname(fileURLToPath(import.meta.url));
-const root = resolve(here, "..");
-const searchRoot = resolve(root, "packages/daemon/src");
-
-if (!existsSync(searchRoot)) {
-  console.error(`check-redaction-coverage: ${searchRoot} does not exist`);
-  process.exit(1);
-}
-
-// Pattern matches any assignment target `auth_detail =` or
-// `last_error =`, regardless of placeholder style (`?` / `@name` /
-// `:name` / `NULL` / literal). The rg -P flag uses PCRE so we can
-// write a single union.
-const PATTERN = String.raw`(auth_detail|last_error)\s*=`;
-
-const EXEMPT_PATHS = new Set([
-  "packages/daemon/src/core/backends/auth-health-monitor.ts",
-  // `mail_accounts.last_error` is a separate column from the `backends`
-  // table's `last_error` that the redaction helpers guard. The redaction
-  // helper enforces scrubbing of model-auth detail strings; mail-poll
-  // errors are IMAP/Graph status messages that never carry secrets
-  // (credentials live in the encrypted blob store and are never inlined
-  // into error text — see mail-poller.ts `handlePollError`).
-  "packages/daemon/src/services/mail/account-registry.ts",
-]);
-
-let rgOutput = "";
-try {
-  rgOutput = execFileSync(
-    "rg",
-    [
-      "--no-heading",
-      "--line-number",
-      "--with-filename",
-      "--glob",
-      "!**/*.test.ts",
-      "--glob",
-      "!**/*.d.ts",
-      "-e",
-      PATTERN,
-      searchRoot,
-    ],
-    { encoding: "utf8" },
-  );
-} catch (err) {
-  // rg exits 1 when there are zero matches — that is the success case.
-  if (err.status === 1 && !err.stdout) {
-    process.exit(0);
-  }
-  // rg exits 2 on actual errors. Surface them.
-  console.error("check-redaction-coverage: rg failed");
-  console.error(err.stderr?.toString() ?? err.message);
-  process.exit(2);
-}
-
-const lines = rgOutput.split("\n").filter((line) => line.length > 0);
-const offenders = [];
-for (const line of lines) {
-  // Each rg line is `absolute-path:line:content`. Convert to a repo
-  // relative path so the exemption check is stable.
-  const firstColon = line.indexOf(":");
-  const secondColon = line.indexOf(":", firstColon + 1);
-  if (firstColon < 0 || secondColon < 0) continue;
-  const absPath = line.slice(0, firstColon);
-  const relPath = relative(root, absPath).replace(/\\/g, "/");
-  if (EXEMPT_PATHS.has(relPath)) continue;
-  offenders.push(`${relPath}:${line.slice(firstColon + 1)}`);
-}
-
-if (offenders.length > 0) {
-  console.error(
-    "check-redaction-coverage: found raw auth_detail / last_error writes outside the helper module.",
-  );
-  console.error(
-    "All writes must go through writeAuthFailureDetail / writeAuthOkDetail in packages/daemon/src/core/backends/auth-health-monitor.ts (roadmap §9.2).",
-  );
-  console.error("");
-  for (const line of offenders) {
-    console.error(`  ${line}`);
-  }
-  process.exit(1);
-}
-
-process.exit(0);