@aitne/daemon 0.1.0

package/dist/core/prompts.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Task flow loader — reads event-type templates from agent-assets/task-flows/*.md.
+ *
+ * These define WHAT the agent should do and in what order.
+ * HOW to do it (API calls, behavioral rules) lives in agent-assets/skills/.
+ *
+ * Flows are injected as part of the user message by the dispatcher.
+ * The {context} placeholder is replaced with the ContextBuilder output.
+ */
+import { type IntegrationKey, type IntegrationState } from "@aitne/shared";
+/**
+ * Initialize the task-flow loader.
+ *
+ * `workspaceDir` resolves the bundled directory at
+ * `<workspaceDir>/agent-assets/task-flows/`. `dataDir` (P5) resolves the
+ * user-override directory at `<dataDir>/task-flows/` — when present, the
+ * loader checks the override directory before falling back to the bundled
+ * one for the SAME filename (`<eventType>.md` or
+ * `<eventType>.<variant-suffix>.md`). This mirrors the bundled directory
+ * layout exactly so users can override either the base flow or a specific
+ * backend/delegated variant by dropping a file with the matching name.
+ *
+ * Subsequent calls update the directories (useful for tests). `dataDir`
+ * is optional so legacy callers that haven't been threaded through
+ * `config.dataDir` keep working — those callers see no override layer
+ * and fall straight through to the bundled directory.
+ */
+export declare function initTaskFlows(workspaceDir: string, dataDir?: string): void;
+/**
+ * Test-only: clear the loader state so a fresh `initTaskFlows` call
+ * starts from defaults. Production callers should not need this.
+ */
+export declare function resetTaskFlowsForTest(): void;
+/**
+ * Resolve the user override directory. Returns null when `initTaskFlows`
+ * was called without a `dataDir` (legacy paths) — the rest of the loader
+ * treats null as "no override layer present".
+ */
+export declare function getUserTaskFlowsDir(): string | null;
+/**
+ * Get the task flow template for a given event type.
+ *
+ * Fallback chain:
+ *   1. Integration variant (`<eventType>.delegated.<backend>.md`) when any
+ *      touched integration is delegated and the variant file exists
+ *   2. Event-specific template (`<eventType>.md`)
+ *   3. Custom routine generic template (`routine.custom.md`) — only when
+ *      `eventType` is of the form `routine.custom.<slug>` (B-007 §5.8 Q3)
+ *   4. Default template (`default.md`)
+ *
+ * After resolution, the template runs through `applyIntegrationModeFilter`
+ * so `<!-- mode:<predicate>:<key> -->` blocks inside any flow file (base
+ * or variant) collapse to the right branch for the current integration
+ * state. Integration-state-aware filtering is the surgical alternative to
+ * authoring whole-file variants when the only delta is a few endpoint
+ * references — see DELEGATED-MODE-V2-DESIGN.md §4.7.1.
+ */
+export declare function getTaskFlow(eventType: string, backendId?: string, integrations?: Partial<Record<IntegrationKey, IntegrationState>>): string;
+/**
+ * Assemble the final prompt by loading the task-flow template and
+ * appending the configured set of vault policy blocks + review-context
+ * (B-007 §5.8, B-004 Phase 1). The production dispatcher has its own
+ * assembly path that threads runtime settings through; this module-level
+ * helper exists for tests and tooling that need a self-contained prompt
+ * builder. Caller must pass explicit B-004 flags — there is no runtime
+ * settings reader here.
+ */
+export declare function assemblePrompt(eventType: string, opts?: {
+    backendId?: string;
+    processKey?: string;
+    contextDir?: string;
+    flags?: Record<string, unknown>;
+    reviewContextFlags?: {
+        useReviewDossiers: boolean;
+        useContextIndex: boolean;
+    };
+    integrations?: Partial<Record<IntegrationKey, IntegrationState>>;
+}): string;
+/**
+ * Enumerate every known task-flow file across the bundled and user
+ * directories. Used by the dashboard's per-event override editor (P5
+ * `/connections/git`) to populate the dropdown of available keys with a
+ * per-row "user-overridden" badge.
+ *
+ * Each entry surfaces the filename minus the `.md` suffix as `key` so
+ * variant filenames (`git.push.detected.delegated.claude.md`) appear as
+ * distinct rows the user can override independently. The base flow lives
+ * alongside its variants in the same listing — there is no implicit
+ * grouping, and the UI is responsible for any visual hierarchy.
+ *
+ * `hasOverride: true` means a same-named file exists in
+ * `<dataDir>/task-flows/`; the bundled file may or may not also exist
+ * (a user-only key — supported, just unusual).
+ */
+export interface TaskFlowListEntry {
+    key: string;
+    hasBundled: boolean;
+    hasOverride: boolean;
+}
+export declare function listTaskFlows(): TaskFlowListEntry[];
+/**
+ * Read both the user override and the bundled body for a single
+ * task-flow key. Returns `null` for either side that doesn't exist on
+ * disk so the caller can render "no override" / "user-only" states
+ * without a separate existence probe.
+ */
+export declare function readTaskFlowSources(key: string): {
+    bundled: string | null;
+    override: string | null;
+};
+//# sourceMappingURL=prompts.d.ts.map

package/dist/core/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../src/core/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAavB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAI1E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAgBD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAEnD;AAuED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,GAC/D,MAAM,CAWR;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,kBAAkB,CAAC,EAAE;QACnB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;CAC7D,GACL,MAAM,CAoBR;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,aAAa,IAAI,iBAAiB,EAAE,CAWnD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG;IAChD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAcA"}

package/dist/core/prompts.js

@@ -0,0 +1,267 @@
+/**
+ * Task flow loader — reads event-type templates from agent-assets/task-flows/*.md.
+ *
+ * These define WHAT the agent should do and in what order.
+ * HOW to do it (API calls, behavioral rules) lives in agent-assets/skills/.
+ *
+ * Flows are injected as part of the user message by the dispatcher.
+ * The {context} placeholder is replaced with the ContextBuilder output.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { applyIntegrationModeFilter, isCustomRoutineKey, selectTaskFlowVariantSuffix, substituteBrandTokens, } from "@aitne/shared";
+import { appendPolicyBlocks, createPromptInjectionBudget, } from "./policy-files.js";
+import { appendReviewContextBlocks } from "./review-context.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+let taskFlowsDir = null;
+let userTaskFlowsDir = null;
+const flowCache = new Map();
+/**
+ * Initialize the task-flow loader.
+ *
+ * `workspaceDir` resolves the bundled directory at
+ * `<workspaceDir>/agent-assets/task-flows/`. `dataDir` (P5) resolves the
+ * user-override directory at `<dataDir>/task-flows/` — when present, the
+ * loader checks the override directory before falling back to the bundled
+ * one for the SAME filename (`<eventType>.md` or
+ * `<eventType>.<variant-suffix>.md`). This mirrors the bundled directory
+ * layout exactly so users can override either the base flow or a specific
+ * backend/delegated variant by dropping a file with the matching name.
+ *
+ * Subsequent calls update the directories (useful for tests). `dataDir`
+ * is optional so legacy callers that haven't been threaded through
+ * `config.dataDir` keep working — those callers see no override layer
+ * and fall straight through to the bundled directory.
+ */
+export function initTaskFlows(workspaceDir, dataDir) {
+    taskFlowsDir = join(workspaceDir, "agent-assets", "task-flows");
+    userTaskFlowsDir = dataDir ? join(dataDir, "task-flows") : null;
+    flowCache.clear();
+}
+/**
+ * Test-only: clear the loader state so a fresh `initTaskFlows` call
+ * starts from defaults. Production callers should not need this.
+ */
+export function resetTaskFlowsForTest() {
+    taskFlowsDir = null;
+    userTaskFlowsDir = null;
+    flowCache.clear();
+}
+function resolveTaskFlowsDir() {
+    if (taskFlowsDir)
+        return taskFlowsDir;
+    // Fallback: resolve from this file's location (4 levels up from packages/daemon/src/core/)
+    // Works in both source (vitest) and compiled (dist/core/) layouts.
+    const fallback = join(__dirname, "..", "..", "..", "..", "agent-assets", "task-flows");
+    if (existsSync(fallback)) {
+        taskFlowsDir = fallback;
+        return fallback;
+    }
+    throw new Error("Task flows directory not found. Call initTaskFlows(workspaceDir) at startup.");
+}
+/**
+ * Resolve the user override directory. Returns null when `initTaskFlows`
+ * was called without a `dataDir` (legacy paths) — the rest of the loader
+ * treats null as "no override layer present".
+ */
+export function getUserTaskFlowsDir() {
+    return userTaskFlowsDir;
+}
+/**
+ * Resolve a task-flow file by exact filename. Mirrors the bundled-vs-user
+ * lookup contract: user dir wins, bundled is the fallback. Used by both
+ * `loadFlow` (for `<key>.md`) and `loadFlowVariant` (for
+ * `<key>.<suffix>.md`) so the override semantics stay consistent.
+ *
+ * User-side reads are intentionally uncached — the user can hot-edit
+ * their override file from the dashboard or directly on disk, and a
+ * stale cache would silently shadow their changes. File I/O on a single
+ * MD file is microseconds; the savings aren't worth the correctness
+ * risk. Bundled files are immutable once shipped, so the cache key
+ * suffix `:bundled:<filename>` keeps the existing speedup.
+ */
+function readFlowFile(filename) {
+    const cacheKey = `:bundled:${filename}`;
+    if (userTaskFlowsDir) {
+        const userPath = join(userTaskFlowsDir, filename);
+        if (existsSync(userPath)) {
+            try {
+                return substituteBrandTokens(readFileSync(userPath, "utf-8"));
+            }
+            catch {
+                // Fall through to the bundled file — a corrupt user override
+                // shouldn't take down the dispatcher. The dashboard validates
+                // user input on PUT so this only fires on out-of-band damage.
+            }
+        }
+    }
+    const cached = flowCache.get(cacheKey);
+    if (cached !== undefined)
+        return cached;
+    const dir = resolveTaskFlowsDir();
+    const bundledPath = join(dir, filename);
+    if (!existsSync(bundledPath))
+        return null;
+    const content = substituteBrandTokens(readFileSync(bundledPath, "utf-8"));
+    flowCache.set(cacheKey, content);
+    return content;
+}
+function loadFlow(eventType) {
+    return readFlowFile(`${eventType}.md`);
+}
+/**
+ * Load a task-flow variant for a specific backend + integration state.
+ * Tries `<eventType>.<suffix>.md` first (e.g. `routine.morning_routine.delegated.claude.md`),
+ * falling back to `<eventType>.md` when the variant file doesn't exist.
+ * Variant selection runs through the same user-override layer as
+ * `loadFlow` so users can override either layer independently — drop
+ * `git.push.detected.delegated.claude.md` in `<dataDir>/task-flows/`
+ * to retarget only the cross-backend Claude variant.
+ */
+function loadFlowVariant(eventType, backendId, integrations) {
+    const suffix = selectTaskFlowVariantSuffix(eventType, backendId, integrations);
+    if (suffix !== "direct") {
+        const variant = readFlowFile(`${eventType}.${suffix}.md`);
+        if (variant !== null)
+            return variant;
+    }
+    // Fall back to the canonical file (covers direct mode and missing variants)
+    return loadFlow(eventType);
+}
+/**
+ * Get the task flow template for a given event type.
+ *
+ * Fallback chain:
+ *   1. Integration variant (`<eventType>.delegated.<backend>.md`) when any
+ *      touched integration is delegated and the variant file exists
+ *   2. Event-specific template (`<eventType>.md`)
+ *   3. Custom routine generic template (`routine.custom.md`) — only when
+ *      `eventType` is of the form `routine.custom.<slug>` (B-007 §5.8 Q3)
+ *   4. Default template (`default.md`)
+ *
+ * After resolution, the template runs through `applyIntegrationModeFilter`
+ * so `<!-- mode:<predicate>:<key> -->` blocks inside any flow file (base
+ * or variant) collapse to the right branch for the current integration
+ * state. Integration-state-aware filtering is the surgical alternative to
+ * authoring whole-file variants when the only delta is a few endpoint
+ * references — see DELEGATED-MODE-V2-DESIGN.md §4.7.1.
+ */
+export function getTaskFlow(eventType, backendId, integrations) {
+    const raw = resolveTaskFlowSource(eventType, backendId, integrations);
+    if (!raw)
+        return raw;
+    // Mode-conditional sections are stripped only when we know the session
+    // backend (from `backendId`). Tooling that doesn't carry one (legacy
+    // tests, prompt previews) keeps the markers visible — better than
+    // collapsing them with a placeholder backend that may misroute prose.
+    if (backendId && integrations) {
+        return applyIntegrationModeFilter(raw, integrations, backendId);
+    }
+    return raw;
+}
+function resolveTaskFlowSource(eventType, backendId, integrations) {
+    if (backendId && integrations) {
+        const variant = loadFlowVariant(eventType, backendId, integrations);
+        if (variant !== null)
+            return variant;
+    }
+    const direct = loadFlow(eventType);
+    if (direct !== null)
+        return direct;
+    if (isCustomRoutineKey(eventType)) {
+        const custom = loadFlow("routine.custom");
+        if (custom !== null)
+            return custom;
+    }
+    return loadFlow("default") ?? "";
+}
+/**
+ * Assemble the final prompt by loading the task-flow template and
+ * appending the configured set of vault policy blocks + review-context
+ * (B-007 §5.8, B-004 Phase 1). The production dispatcher has its own
+ * assembly path that threads runtime settings through; this module-level
+ * helper exists for tests and tooling that need a self-contained prompt
+ * builder. Caller must pass explicit B-004 flags — there is no runtime
+ * settings reader here.
+ */
+export function assemblePrompt(eventType, opts = {}) {
+    const base = getTaskFlow(eventType, opts.backendId, opts.integrations);
+    if (!opts.contextDir)
+        return base;
+    const budget = createPromptInjectionBudget();
+    const withPolicies = appendPolicyBlocks(base, {
+        contextDir: opts.contextDir,
+        processKey: opts.processKey ?? eventType,
+        flags: opts.flags,
+        budget,
+    });
+    const reviewFlags = opts.reviewContextFlags ?? {
+        useReviewDossiers: false,
+        useContextIndex: false,
+    };
+    return appendReviewContextBlocks(withPolicies, {
+        contextDir: opts.contextDir,
+        processKey: opts.processKey ?? eventType,
+        flags: reviewFlags,
+        budget,
+    });
+}
+export function listTaskFlows() {
+    const bundled = listMdFilesByKey(resolveTaskFlowsDir());
+    const overrides = userTaskFlowsDir ? listMdFilesByKey(userTaskFlowsDir) : new Set();
+    const allKeys = new Set([...bundled, ...overrides]);
+    return [...allKeys]
+        .sort((a, b) => a.localeCompare(b))
+        .map((key) => ({
+        key,
+        hasBundled: bundled.has(key),
+        hasOverride: overrides.has(key),
+    }));
+}
+/**
+ * Read both the user override and the bundled body for a single
+ * task-flow key. Returns `null` for either side that doesn't exist on
+ * disk so the caller can render "no override" / "user-only" states
+ * without a separate existence probe.
+ */
+export function readTaskFlowSources(key) {
+    const bundled = (() => {
+        const dir = resolveTaskFlowsDir();
+        const path = join(dir, `${key}.md`);
+        if (!existsSync(path))
+            return null;
+        return readFileSync(path, "utf-8");
+    })();
+    const override = (() => {
+        if (!userTaskFlowsDir)
+            return null;
+        const path = join(userTaskFlowsDir, `${key}.md`);
+        if (!existsSync(path))
+            return null;
+        return readFileSync(path, "utf-8");
+    })();
+    return { bundled, override };
+}
+function listMdFilesByKey(dir) {
+    if (!existsSync(dir))
+        return new Set();
+    try {
+        return new Set(readdirSync(dir)
+            .filter((name) => name.endsWith(".md"))
+            .filter((name) => {
+            // Skip directories that happen to end in `.md` (rare; defensive).
+            try {
+                return statSync(join(dir, name)).isFile();
+            }
+            catch {
+                return false;
+            }
+        })
+            .map((name) => name.slice(0, -3)));
+    }
+    catch {
+        return new Set();
+    }
+}
+//# sourceMappingURL=prompts.js.map

package/dist/core/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/core/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,GAItB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,IAAI,YAAY,GAAkB,IAAI,CAAC;AACvC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,OAAgB;IAClE,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAChE,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,YAAY,GAAG,IAAI,CAAC;IACpB,gBAAgB,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,2FAA2F;IAC3F,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IACvF,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,YAAY,GAAG,QAAQ,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,QAAQ,GAAG,YAAY,QAAQ,EAAE,CAAC;IACxC,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,qBAAqB,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;gBAC7D,8DAA8D;gBAC9D,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,OAAO,YAAY,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,SAAiB,EACjB,SAAoB,EACpB,YAA+D;IAE/D,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAE/E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,SAAS,IAAI,MAAM,KAAK,CAAC,CAAC;QAC1D,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;IACvC,CAAC;IAED,4EAA4E;IAC5E,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,SAAkB,EAClB,YAAgE;IAEhE,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;QAC9B,OAAO,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,SAAsB,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,SAA6B,EAC7B,YAEa;IAEb,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,SAAsB,EAAE,YAAY,CAAC,CAAC;QACjF,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,OAUI,EAAE;IAEN,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE;QAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;QACxC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI;QAC7C,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,KAAK;KACvB,CAAC;IACF,OAAO,yBAAyB,CAAC,YAAY,EAAE;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;QACxC,KAAK,EAAE,WAAW;QAClB,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAwBD,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,GAAG;QACH,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;KAChC,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAI7C,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;QACpB,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;QACrB,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CACZ,WAAW,CAAC,GAAG,CAAC;aACb,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aACtC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,kEAAkE;YAClE,IAAI,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/core/quiet-hours-sync.d.ts

@@ -0,0 +1,15 @@
+import type Database from "better-sqlite3";
+/**
+ * SCHEDULED-DM-IMPLEMENTATION-PLAN §6.7 — retime every enabled
+ * `dm_session` recurring row whose `task_context.pin_to_quiet_hours_end
+ * === true` so the briefing tracks the user's quiet-hours edge.
+ * Rows with the pin flag false (user-pinned via DM) are left alone.
+ *
+ * Recomputes `next_run_at` from the updated rule and clears the
+ * existing pending `agent_schedule` row so the reconciler emits the
+ * next occurrence at the new time. Pure DB logic — exported as its
+ * own module so the dashboard config PATCH can call it AND tests can
+ * exercise it without spinning up a Hono app.
+ */
+export declare function syncDmSessionTimesToQuietHours(db: Database.Database, newQuietHoursEnd: string): void;
+//# sourceMappingURL=quiet-hours-sync.d.ts.map

package/dist/core/quiet-hours-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quiet-hours-sync.d.ts","sourceRoot":"","sources":["../../src/core/quiet-hours-sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAO3C;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,gBAAgB,EAAE,MAAM,GACvB,IAAI,CA0CN"}

package/dist/core/quiet-hours-sync.js

@@ -0,0 +1,51 @@
+import { formatSqliteDatetime, } from "@aitne/shared";
+import { computeNextOccurrence } from "./recurrence.js";
+/**
+ * SCHEDULED-DM-IMPLEMENTATION-PLAN §6.7 — retime every enabled
+ * `dm_session` recurring row whose `task_context.pin_to_quiet_hours_end
+ * === true` so the briefing tracks the user's quiet-hours edge.
+ * Rows with the pin flag false (user-pinned via DM) are left alone.
+ *
+ * Recomputes `next_run_at` from the updated rule and clears the
+ * existing pending `agent_schedule` row so the reconciler emits the
+ * next occurrence at the new time. Pure DB logic — exported as its
+ * own module so the dashboard config PATCH can call it AND tests can
+ * exercise it without spinning up a Hono app.
+ */
+export function syncDmSessionTimesToQuietHours(db, newQuietHoursEnd) {
+    const tableExists = db
+        .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='recurring_schedules'")
+        .get();
+    if (!tableExists)
+        return;
+    const rows = db
+        .prepare(`SELECT id, recurrence_rule, task_context
+       FROM recurring_schedules
+       WHERE task_type = 'dm_session' AND enabled = 1`)
+        .all();
+    for (const row of rows) {
+        let ctx;
+        let rule;
+        try {
+            ctx = JSON.parse(row.task_context || "{}");
+            rule = JSON.parse(row.recurrence_rule);
+        }
+        catch {
+            continue;
+        }
+        if (ctx.pin_to_quiet_hours_end !== true)
+            continue;
+        if (rule.time === newQuietHoursEnd)
+            continue;
+        const updated = { ...rule, time: newQuietHoursEnd };
+        const next = computeNextOccurrence(updated, new Date());
+        const nextRunAt = next ? formatSqliteDatetime(next) : null;
+        db.prepare(`UPDATE recurring_schedules
+       SET recurrence_rule = ?, next_run_at = ?, updated_at = CURRENT_TIMESTAMP
+       WHERE id = ?`).run(JSON.stringify(updated), nextRunAt, row.id);
+        db.prepare(`UPDATE agent_schedule
+       SET status = 'skipped'
+       WHERE recurring_schedule_id = ? AND status = 'pending'`).run(row.id);
+    }
+}
+//# sourceMappingURL=quiet-hours-sync.js.map

package/dist/core/quiet-hours-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quiet-hours-sync.js","sourceRoot":"","sources":["../../src/core/quiet-hours-sync.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,GAErB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAC5C,EAAqB,EACrB,gBAAwB;IAExB,MAAM,WAAW,GAAG,EAAE;SACnB,OAAO,CACN,kFAAkF,CACnF;SACA,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;sDAEgD,CACjD;SACA,GAAG,EAAqE,CAAC;IAE5E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAA4B,CAAC;QACjC,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;YAC3C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAmB,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,sBAAsB,KAAK,IAAI;YAAE,SAAS;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;YAAE,SAAS;QAE7C,MAAM,OAAO,GAAmB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,EAAE,CAAC,OAAO,CACR;;oBAEc,CACf,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,EAAE,CAAC,OAAO,CACR;;8DAEwD,CACzD,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/core/read-sensitive-token-manager.d.ts

@@ -0,0 +1,19 @@
+export interface ReadSensitiveTokenManager {
+    issue(scope: string): string;
+    revoke(scope: string): void;
+    isValid(token: string): boolean;
+}
+/**
+ * Rotates daemon read tokens per session/workdir scope.
+ *
+ * Each call to `issue(scope)` replaces the previously-issued token for that
+ * scope, so one leaked token does not grant read-sensitive access to every
+ * other concurrent agent session.
+ */
+export declare class ScopedReadSensitiveTokenManager implements ReadSensitiveTokenManager {
+    private readonly tokensByScope;
+    issue(scope: string): string;
+    revoke(scope: string): void;
+    isValid(token: string): boolean;
+}
+//# sourceMappingURL=read-sensitive-token-manager.d.ts.map

package/dist/core/read-sensitive-token-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-sensitive-token-manager.d.ts","sourceRoot":"","sources":["../../src/core/read-sensitive-token-manager.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,qBAAa,+BAAgC,YAAW,yBAAyB;IAC/E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAE3D,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAM5B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI3B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAWhC"}

package/dist/core/read-sensitive-token-manager.js

@@ -0,0 +1,29 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+/**
+ * Rotates daemon read tokens per session/workdir scope.
+ *
+ * Each call to `issue(scope)` replaces the previously-issued token for that
+ * scope, so one leaked token does not grant read-sensitive access to every
+ * other concurrent agent session.
+ */
+export class ScopedReadSensitiveTokenManager {
+    tokensByScope = new Map();
+    issue(scope) {
+        const token = randomBytes(24).toString("base64url");
+        this.tokensByScope.set(scope, token);
+        return token;
+    }
+    revoke(scope) {
+        this.tokensByScope.delete(scope);
+    }
+    isValid(token) {
+        for (const current of this.tokensByScope.values()) {
+            if (token.length === current.length
+                && timingSafeEqual(Buffer.from(token), Buffer.from(current))) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=read-sensitive-token-manager.js.map

package/dist/core/read-sensitive-token-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-sensitive-token-manager.js","sourceRoot":"","sources":["../../src/core/read-sensitive-token-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQ3D;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IACzB,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3D,KAAK,CAAC,KAAa;QACjB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,IACE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;mBAC5B,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC5D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/core/recurrence.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Recurrence calculation — pure functions for computing next occurrence
+ * from a recurrence rule and a reference date.
+ *
+ * All internal computation uses the configured timezone so that "09:00 daily"
+ * always fires at 09:00 local, even across DST transitions.
+ */
+import type { RecurrenceRule } from "@aitne/shared";
+export type { RecurrenceRule };
+/**
+ * Compute the next occurrence of a recurring schedule after `referenceUtc`.
+ *
+ * Returns a UTC Date, or null if no valid occurrence can be computed
+ * (e.g. malformed rule).
+ *
+ * @param rule       The recurrence rule (timezone resolved internally if missing)
+ * @param referenceUtc  The reference point. Next occurrence is strictly after this instant.
+ */
+export declare function computeNextOccurrence(rule: RecurrenceRule, referenceUtc: Date): Date | null;
+/**
+ * Format a recurrence rule as a human-readable summary.
+ */
+export declare function formatRecurrenceLabel(rule: RecurrenceRule): string;
+//# sourceMappingURL=recurrence.d.ts.map

package/dist/core/recurrence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recurrence.d.ts","sourceRoot":"","sources":["../../src/core/recurrence.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,YAAY,EAAE,cAAc,EAAE,CAAC;AAiE/B;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,IAAI,GACjB,IAAI,GAAG,IAAI,CAgBb;AAuFD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAoBlE"}