@aitne/daemon 0.1.0

package/dist/observers/skill-curation-walker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-curation-walker.d.ts","sourceRoot":"","sources":["../../src/observers/skill-curation-walker.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAyB,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAQvE,UAAU,aAAa;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,mBAAoB,YAAW,QAAQ;IAQhD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAV1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,OAAO,CAAS;gBAGL,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EAChC,OAAO,GAAE,aAAkB;IAMvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,gEAAgE;IAC1D,OAAO,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAkBtE;AAED,+BAA+B;AAC/B,wBAAgB,SAAS,CACvB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,IAAI,EAAE,yBAAyB,EAC/B,QAAQ,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,EAC9C,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV,MAAM,CA6BR"}

package/dist/observers/skill-curation-walker.js

@@ -0,0 +1,216 @@
+// P22 §4.1 — structure-diff walker.
+//
+// Hourly. Walks `getContextDir(config)` once per skill in the curation
+// cohort and diffs the live snapshot against the latest applied overlay
+// payload. Differences become `structure_diff` signals (heading_add,
+// heading_remove, file_add, file_remove, frontmatter_change).
+//
+// Pure rule-based — no LLM. The walker is its own test surface (`structure_diff`
+// must not flag identifier-only changes after the diff classifier's normalizer
+// would normalize both sides).
+//
+// Idempotent: a re-run of the walker on the same vault with no changes
+// inserts zero new signals (existing unconsumed rows are matched by an
+// `idempotency_key` extracted from the payload).
+import { createLogger } from "../logging.js";
+import { buildKnowledgeMap, filterSnapshotByScope } from "../core/skill-curation/knowledge-map.js";
+import { loadAllCurationDeclarations, } from "../core/skill-curation/declarations.js";
+import { OverlayStore } from "../core/skill-curation/overlay-store.js";
+import { recordSignal, unconsumedSignalsForSkill } from "../core/skill-curation/signals.js";
+const logger = createLogger("skill-curation-walker");
+const ONE_HOUR_MS = 60 * 60 * 1000;
+export class SkillCurationWalker {
+    db;
+    contextDir;
+    skillsRoot;
+    dataDir;
+    name = "skill-curation-walker";
+    timer = null;
+    intervalMs;
+    now;
+    running = false;
+    constructor(db, contextDir, skillsRoot, dataDir, options = {}) {
+        this.db = db;
+        this.contextDir = contextDir;
+        this.skillsRoot = skillsRoot;
+        this.dataDir = dataDir;
+        this.intervalMs = options.intervalMs ?? ONE_HOUR_MS;
+        this.now = options.now ?? Date.now;
+    }
+    async start() {
+        if (this.timer)
+            return;
+        // Defer first run by 60s so daemon boot is not blocked by a vault scan.
+        this.timer = setInterval(() => {
+            this.runOnce().catch((err) => logger.error({ err }, "walker tick failed"));
+        }, this.intervalMs);
+    }
+    async stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    /** Public for tests + ad-hoc /api/skill-curation/walker/run. */
+    async runOnce() {
+        if (this.running)
+            return { inserted: 0, skills_walked: 0 };
+        this.running = true;
+        try {
+            const decls = loadAllCurationDeclarations(this.skillsRoot)
+                .filter((d) => d.declaration !== null);
+            if (decls.length === 0)
+                return { inserted: 0, skills_walked: 0 };
+            const snapshot = buildKnowledgeMap(this.contextDir);
+            const overlay = new OverlayStore(this.dataDir, this.skillsRoot);
+            let inserted = 0;
+            for (const decl of decls) {
+                inserted += diffSkill(this.db, decl, snapshot, overlay, this.now());
+            }
+            return { inserted, skills_walked: decls.length };
+        }
+        finally {
+            this.running = false;
+        }
+    }
+}
+/** Exported for unit tests. */
+export function diffSkill(db, decl, snapshot, overlay, now) {
+    if (!decl.declaration)
+        return 0;
+    let inserted = 0;
+    const existing = unconsumedSignalsForSkill(db, decl.slug);
+    const seenKeys = new Set();
+    for (const sig of existing) {
+        const k = safeParse(sig.payload_json)?.idempotency_key;
+        if (typeof k === "string")
+            seenKeys.add(k);
+    }
+    for (const section of decl.declaration.sections) {
+        const live = filterSnapshotByScope(snapshot, section.scope_paths);
+        const payload = overlay.readPayload(decl.slug, section.id, section.kind);
+        const observations = collectObservations(section.kind, payload, live);
+        for (const obs of observations) {
+            const idempotencyKey = `${decl.slug}:${section.id}:${obs.sub_kind}:${obs.target}`;
+            if (seenKeys.has(idempotencyKey))
+                continue;
+            recordSignal(db, {
+                skill_slug: decl.slug,
+                section_id: section.id,
+                signal_type: "structure_diff",
+                payload: { ...obs, idempotency_key: idempotencyKey },
+                observed_at: now,
+            });
+            seenKeys.add(idempotencyKey);
+            inserted++;
+        }
+    }
+    return inserted;
+}
+function collectObservations(kind, payload, live) {
+    const out = [];
+    switch (kind) {
+        case "knowledge_layout": {
+            const knownPaths = new Set();
+            const knownHeadings = new Map();
+            if (payload && payload.kind === "knowledge_layout") {
+                for (const f of payload.files) {
+                    knownPaths.add(f.path.toLowerCase());
+                    knownHeadings.set(f.path.toLowerCase(), new Set(f.sections.map((s) => stripHeading(s.heading))));
+                }
+            }
+            const livePaths = new Set(live.map((f) => f.path.toLowerCase()));
+            for (const lp of livePaths) {
+                if (!knownPaths.has(lp))
+                    out.push({ sub_kind: "file_add", target: lp });
+            }
+            for (const kp of knownPaths) {
+                if (!livePaths.has(kp))
+                    out.push({ sub_kind: "file_remove", target: kp });
+            }
+            for (const f of live) {
+                const known = knownHeadings.get(f.path.toLowerCase());
+                if (!known)
+                    continue; // file_add reported above
+                const liveHeadings = new Set(f.headings);
+                for (const h of liveHeadings) {
+                    if (!known.has(h))
+                        out.push({ sub_kind: "heading_add", target: `${f.path}#${h}` });
+                }
+                for (const h of known) {
+                    if (!liveHeadings.has(h))
+                        out.push({ sub_kind: "heading_remove", target: `${f.path}#${h}` });
+                }
+            }
+            break;
+        }
+        case "frontmatter_schema": {
+            if (payload && payload.kind === "frontmatter_schema") {
+                for (const ft of payload.file_types) {
+                    for (const f of live.filter((lf) => simpleGlobMatch(lf.path, ft.glob))) {
+                        const present = new Set(Object.keys(f.frontmatter));
+                        for (const required of ft.required) {
+                            if (!present.has(required.key)) {
+                                out.push({ sub_kind: "frontmatter_change", target: `${f.path}#${required.key}`, detail: { missing: true } });
+                            }
+                        }
+                    }
+                }
+            }
+            break;
+        }
+        case "routing_table":
+        case "search_recipes": {
+            if (payload) {
+                const known = (() => {
+                    if (payload.kind === "routing_table")
+                        return payload.rules.map((r) => r.destination_path.toLowerCase());
+                    /* c8 ignore next 2 */
+                    if (payload.kind === "search_recipes")
+                        return payload.recipes.map((r) => r.lookup_path.toLowerCase());
+                    return [];
+                })();
+                const livePaths = new Set(live.map((f) => f.path.toLowerCase()));
+                for (const k of known) {
+                    if (k.includes("*"))
+                        continue;
+                    if (!livePaths.has(k) && !live.some((f) => f.path.toLowerCase().endsWith("/" + k))) {
+                        out.push({ sub_kind: "file_remove", target: k });
+                    }
+                }
+            }
+            break;
+        }
+        case "convention_notes":
+        case "cross_references": {
+            // No structural diff: conventions are statements of fact, cross-refs
+            // are owner-curated. Walker emits no signals; other channels (owner
+            // correction, agent feedback) drive these kinds.
+            break;
+        }
+    }
+    return out;
+}
+function stripHeading(s) {
+    return s.replace(/^##{1,2}\s+/, "").trim();
+}
+function simpleGlobMatch(path, pattern) {
+    if (!pattern.includes("*"))
+        return path === pattern;
+    const re = new RegExp("^" +
+        pattern
+            .replace(/[.+?^${}()|[\]\\]/g, "\\$&")
+            .replace(/\*\*/g, ".*")
+            .replace(/\*/g, "[^/]*") +
+        "$");
+    return re.test(path);
+}
+function safeParse(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=skill-curation-walker.js.map

package/dist/observers/skill-curation-walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-curation-walker.js","sourceRoot":"","sources":["../../src/observers/skill-curation-walker.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,iDAAiD;AAGjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EACL,2BAA2B,GAE5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAG5F,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAErD,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAQnC,MAAM,OAAO,mBAAmB;IAQX;IACA;IACA;IACA;IAVV,IAAI,GAAG,uBAAuB,CAAC;IAChC,KAAK,GAA0B,IAAI,CAAC;IAC3B,UAAU,CAAS;IACnB,GAAG,CAAe;IAC3B,OAAO,GAAG,KAAK,CAAC;IAExB,YACmB,EAAqB,EACrB,UAAkB,EAClB,UAAkB,EAClB,OAAe,EAChC,UAAyB,EAAE;QAJV,OAAE,GAAF,EAAE,CAAmB;QACrB,eAAU,GAAV,UAAU,CAAQ;QAClB,eAAU,GAAV,UAAU,CAAQ;QAClB,YAAO,GAAP,OAAO,CAAQ;QAGhC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;QACpD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,wEAAwE;QACxE,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC7E,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC;iBACvD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAED,+BAA+B;AAC/B,MAAM,UAAU,SAAS,CACvB,EAAqB,EACrB,IAA+B,EAC/B,QAA8C,EAC9C,OAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAoC,EAAE,eAAe,CAAC;QAC3F,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,cAAc,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAClF,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC;gBAAE,SAAS;YAC3C,YAAY,CAAC,EAAE,EAAE;gBACf,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,WAAW,EAAE,gBAAgB;gBAC7B,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE;gBACpD,WAAW,EAAE,GAAG;aACjB,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC7B,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD,SAAS,mBAAmB,CAC1B,IAAiB,EACjB,OAAoC,EACpC,IAA8C;IAE9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;YACrD,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACnD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC9B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACrC,aAAa,CAAC,GAAG,CACf,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EACpB,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CACxD,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACjE,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACtD,IAAI,CAAC,KAAK;oBAAE,SAAS,CAAC,0BAA0B;gBAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACzC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrF,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/F,CAAC;YACH,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACrD,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;wBACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;wBACpD,KAAK,MAAM,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;4BACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;4BAC/G,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,eAAe,CAAC;QACrB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;oBAClB,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;wBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC;oBACxG,sBAAsB;oBACtB,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;wBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;oBACtG,OAAO,EAAc,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC;gBACL,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACjE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnF,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,iDAAiD;YACjD,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,KAAK,OAAO,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,GAAG;QACD,OAAO;aACJ,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC;aACrC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC1B,GAAG,CACN,CAAC;IACF,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACtD,CAAC"}

package/dist/safety/absolute-block-audit.d.ts

@@ -0,0 +1,22 @@
+import type Database from "better-sqlite3";
+import type { BackendId, ExecutionPermissionMode } from "@aitne/shared";
+import type { AbsoluteBlockMatch } from "./always-disallowed.js";
+/**
+ * Record an `agent_actions` row with `action_type = 'blocked_absolute'` so
+ * the dashboard can surface that the absolute-block layer is doing useful
+ * work (EXECUTION-MODE-DESIGN.md §6.3).
+ *
+ * Best-effort: failures do not throw. The authoritative enforcement is
+ * the SDK-level `disallowedTools` / TOML deny-rule rejection; this row
+ * is observability only. If the DB is transiently unavailable, a warning
+ * logs and the hook still returns the block decision to the caller.
+ */
+export declare function recordAbsoluteBlockAudit(params: {
+    db: Database.Database | undefined;
+    backend: BackendId;
+    mode: ExecutionPermissionMode;
+    match: AbsoluteBlockMatch;
+    toolName: string;
+    sessionId?: number | null;
+}): void;
+//# sourceMappingURL=absolute-block-audit.d.ts.map

package/dist/safety/absolute-block-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"absolute-block-audit.d.ts","sourceRoot":"","sources":["../../src/safety/absolute-block-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC;IAClC,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,IAAI,CAqBP"}

package/dist/safety/absolute-block-audit.js

@@ -0,0 +1,32 @@
+import { createLogger } from "../logging.js";
+const logger = createLogger("absolute-block-audit");
+/**
+ * Record an `agent_actions` row with `action_type = 'blocked_absolute'` so
+ * the dashboard can surface that the absolute-block layer is doing useful
+ * work (EXECUTION-MODE-DESIGN.md §6.3).
+ *
+ * Best-effort: failures do not throw. The authoritative enforcement is
+ * the SDK-level `disallowedTools` / TOML deny-rule rejection; this row
+ * is observability only. If the DB is transiently unavailable, a warning
+ * logs and the hook still returns the block decision to the caller.
+ */
+export function recordAbsoluteBlockAudit(params) {
+    const { db, backend, mode, match, toolName, sessionId } = params;
+    if (!db)
+        return;
+    try {
+        const detail = JSON.stringify({
+            category: match.category,
+            toolName,
+            redacted: match.redacted,
+            mode,
+            sessionId: sessionId ?? null,
+        });
+        db.prepare(`INSERT INTO agent_actions (action_type, trigger, result, detail, backend)
+         VALUES (?, ?, ?, ?, ?)`).run("blocked_absolute", "absolute_block_layer", "failed", detail, backend);
+    }
+    catch (err) {
+        logger.warn({ err, backend, category: match.category }, "failed to record blocked_absolute audit row");
+    }
+}
+//# sourceMappingURL=absolute-block-audit.js.map

package/dist/safety/absolute-block-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"absolute-block-audit.js","sourceRoot":"","sources":["../../src/safety/absolute-block-audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAOxC;IACC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACjE,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,CACR;gCAC0B,CAC3B,CAAC,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC1C,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/safety/agent-write-tracker.d.ts

@@ -0,0 +1,42 @@
+/**
+ * AgentWriteTracker — short-lived, in-memory record of paths the agent is
+ * currently writing via the daemon API. Observers consult it to classify
+ * file-change events as `actor='agent'` vs `actor='user'`, which gives the
+ * hourly-check dispatcher a way to ignore its own writes.
+ *
+ * Two marking modes:
+ *  1. **Content-hash mode** — caller passes the exact bytes they wrote.
+ *     `isMarked` confirms both the path AND a hash match. Used by the
+ *     context file API (PUT /api/context/today etc.) where we control the
+ *     full content. Robust against false positives where the user edits
+ *     the same path within the TTL window.
+ *  2. **Path-only mode** — caller passes `undefined` for content. `isMarked`
+ *     returns true for any observation on that path within the TTL. Used
+ *     by append-style writes (Obsidian CLI `append`, `daily:append`) where
+ *     the post-write file content depends on whatever was already on disk
+ *     and the daemon can't deterministically compute the hash.
+ *
+ * In path-only mode there's a small false-positive risk: if the user edits
+ * the same note within the TTL window, that user edit gets attributed to
+ * the agent. Missing a user observation is cheaper than a loop where the
+ * agent re-triggers itself.
+ *
+ * **Per-mark TTL override**: the default TTL is tuned for real-time file
+ * system watchers that fire within milliseconds (chokidar/Obsidian). For
+ * polled sources (Notion, Calendar) whose observation lag is measured in
+ * minutes, the caller MUST pass `opts.ttlMs` large enough to outlive the
+ * poll cadence — otherwise every agent write is seen as a fresh user
+ * edit and the hourly_check can loop on its own output.
+ */
+export declare class AgentWriteTracker {
+    private readonly ttlMs;
+    private readonly recentWrites;
+    constructor(ttlMs?: number);
+    markWriting(absolutePath: string, content?: string | null, opts?: {
+        ttlMs?: number;
+    }): void;
+    isMarked(absolutePath: string, content: string | null | undefined): boolean;
+    cleanup(now?: number): void;
+    private hashContent;
+}
+//# sourceMappingURL=agent-write-tracker.d.ts.map

package/dist/safety/agent-write-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-write-tracker.d.ts","sourceRoot":"","sources":["../../src/safety/agent-write-tracker.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;gBAElC,KAAK,SAAS;IAE3C,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACxB,IAAI;IAWP,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAsB3E,OAAO,CAAC,GAAG,SAAa,GAAG,IAAI;IAQ/B,OAAO,CAAC,WAAW;CAGpB"}

package/dist/safety/agent-write-tracker.js

@@ -0,0 +1,82 @@
+import { createHash } from "node:crypto";
+import { createLogger } from "../logging.js";
+const logger = createLogger("agent-write-tracker");
+/**
+ * AgentWriteTracker — short-lived, in-memory record of paths the agent is
+ * currently writing via the daemon API. Observers consult it to classify
+ * file-change events as `actor='agent'` vs `actor='user'`, which gives the
+ * hourly-check dispatcher a way to ignore its own writes.
+ *
+ * Two marking modes:
+ *  1. **Content-hash mode** — caller passes the exact bytes they wrote.
+ *     `isMarked` confirms both the path AND a hash match. Used by the
+ *     context file API (PUT /api/context/today etc.) where we control the
+ *     full content. Robust against false positives where the user edits
+ *     the same path within the TTL window.
+ *  2. **Path-only mode** — caller passes `undefined` for content. `isMarked`
+ *     returns true for any observation on that path within the TTL. Used
+ *     by append-style writes (Obsidian CLI `append`, `daily:append`) where
+ *     the post-write file content depends on whatever was already on disk
+ *     and the daemon can't deterministically compute the hash.
+ *
+ * In path-only mode there's a small false-positive risk: if the user edits
+ * the same note within the TTL window, that user edit gets attributed to
+ * the agent. Missing a user observation is cheaper than a loop where the
+ * agent re-triggers itself.
+ *
+ * **Per-mark TTL override**: the default TTL is tuned for real-time file
+ * system watchers that fire within milliseconds (chokidar/Obsidian). For
+ * polled sources (Notion, Calendar) whose observation lag is measured in
+ * minutes, the caller MUST pass `opts.ttlMs` large enough to outlive the
+ * poll cadence — otherwise every agent write is seen as a fresh user
+ * edit and the hourly_check can loop on its own output.
+ */
+export class AgentWriteTracker {
+    ttlMs;
+    recentWrites = new Map();
+    constructor(ttlMs = 30_000) {
+        this.ttlMs = ttlMs;
+    }
+    markWriting(absolutePath, content, opts) {
+        const mode = typeof content === "string" ? "content-hash" : "path-only";
+        const ttlMs = opts?.ttlMs ?? this.ttlMs;
+        this.recentWrites.set(absolutePath, {
+            expiresAt: Date.now() + ttlMs,
+            contentHash: typeof content === "string" ? this.hashContent(content) : null,
+        });
+        logger.debug({ path: absolutePath, mode, ttlMs }, "Write marked for agent attribution");
+        this.cleanup();
+    }
+    isMarked(absolutePath, content) {
+        const entry = this.recentWrites.get(absolutePath);
+        if (!entry) {
+            return false;
+        }
+        if (Date.now() > entry.expiresAt) {
+            this.recentWrites.delete(absolutePath);
+            return false;
+        }
+        // Path-only mark: no content comparison, any observation on this path
+        // within the TTL window is considered agent-originated.
+        if (entry.contentHash === null) {
+            return true;
+        }
+        // Content-hash mark: require an exact byte match to tolerate rapid
+        // user edits of the same path within the TTL.
+        if (typeof content !== "string") {
+            return false;
+        }
+        return entry.contentHash === this.hashContent(content);
+    }
+    cleanup(now = Date.now()) {
+        for (const [path, entry] of this.recentWrites.entries()) {
+            if (entry.expiresAt <= now) {
+                this.recentWrites.delete(path);
+            }
+        }
+    }
+    hashContent(content) {
+        return createHash("sha256").update(content).digest("hex");
+    }
+}
+//# sourceMappingURL=agent-write-tracker.js.map

package/dist/safety/agent-write-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-write-tracker.js","sourceRoot":"","sources":["../../src/safety/agent-write-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAcnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,iBAAiB;IAGC;IAFZ,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/D,YAA6B,QAAQ,MAAM;QAAd,UAAK,GAAL,KAAK,CAAS;IAAG,CAAC;IAE/C,WAAW,CACT,YAAoB,EACpB,OAAuB,EACvB,IAAyB;QAEzB,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,WAAW,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;SAC5E,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,YAAoB,EAAE,OAAkC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,sEAAsE;QACtE,wDAAwD;QACxD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mEAAmE;QACnE,8CAA8C;QAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;CACF"}

package/dist/safety/always-disallowed.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Absolute-block layer (EXECUTION-MODE-DESIGN.md §6).
+ *
+ * Patterns in `ALWAYS_DISALLOWED_TOOLS` are merged into every backend's
+ * effective `disallowedTools` regardless of execution mode (`strict` /
+ * `allow`) and regardless of any `allowedToolsOverride` the dashboard
+ * has set. This is the one non-optional defense: the agent cannot widen
+ * past it, even under Allow mode where the SDK-level permission gate is
+ * bypassed.
+ *
+ * Scope is deliberately narrow — four categories extracted directly from
+ * the existing risk taxonomy (recursive delete, privilege escalation,
+ * pipe-to-shell RCE, secret-file reads). Additions should be justified
+ * by a specific incident or concrete risk, not by speculative hardening.
+ *
+ * Coverage note: plain `curl` and `wget` are intentionally NOT blocked —
+ * the daemon-API chokepoint (`curl http://localhost:<port>/api/context/...`)
+ * is how skills write to memory. Only pipe-to-shell patterns (`curl | sh`,
+ * `wget | bash`, `bash <(...)`, `sh <(...)`) are blocked.
+ *
+ * Enforcement chokepoints (§6.2):
+ *   - Claude Code: merged into SDK `disallowedTools` in both strict and
+ *     allow branches. SDK rejects at pre-tool-invocation time.
+ *   - Gemini CLI: emitted as TOML deny rules in the admin policy, including
+ *     in allow mode where the normal whitelist policy is skipped.
+ *   - Codex CLI: Codex has no hook or admin-policy layer for shell commands.
+ *     Allow mode runs under `--dangerously-bypass-approvals-and-sandbox`,
+ *     which is a binary sandbox-off switch; the daemon cannot enforce
+ *     absolute-block there. Strict mode keeps the workspace-write sandbox
+ *     which denies writes outside cwd but does NOT pattern-match these
+ *     commands. Accepted gap, documented in 09-safety-cost.md.
+ */
+/**
+ * Tool patterns that remain denied across all modes. Pattern syntax
+ * matches the Claude Agent SDK: `Tool(argument-glob)` — Bash arguments
+ * are matched as shell-command globs, Read/Write/Edit arguments as path
+ * globs.
+ */
+export declare const ALWAYS_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Bash(rm -rf .*)", "Bash(rm -r *)", "Bash(rm -rf*)", "Bash(rm -rv*)", "Bash(rm -ri*)", "Bash(rm -rd*)", "Bash(rm -rI*)", "Bash(rm -fr*)", "Bash(rm -vr*)", "Bash(rm -ir*)", "Bash(rm -dr*)", "Bash(rm -Ir*)", "Bash(rm -R*)", "Bash(rm -fR*)", "Bash(rm -vR*)", "Bash(rm -iR*)", "Bash(rm -dR*)", "Bash(rm -IR*)", "Bash(rm --recursive*)", "Bash(rm --force --recursive*)", "Bash(rm --recursive --force*)", "Bash(sudo *)", "Bash(doas *)", "Bash(su *)", "Bash(curl * | sh*)", "Bash(curl * | bash*)", "Bash(wget * | sh*)", "Bash(wget * | bash*)", "Bash(bash <(*)*)", "Bash(sh <(*)*)", "Bash(bash<*)", "Bash(sh<*)", "Bash(eval *)", "Bash(source *)", "Bash(security *)", "Bash(secret-tool *)", "Bash(cmdkey *)", "Read(.env)", "Read(.env.*)", "Read(**/.env)", "Read(**/.env.*)", "Read(id_rsa*)", "Read(id_ed25519*)", "Read(~/.ssh/**)", "Read(~/.gnupg/**)", "Read(~/.aws/**)", "Read(~/.config/gcloud/**)", "Read(~/.config/gh/hosts.yml)", "Read(~/.netrc)", "Read(~/Library/Keychains/**)", "Read(~/.local/share/keyrings/**)", "Read(~/.personal-agent/backups/**)", "Read(~/.personal-agent/whatsapp/auth/**)", "Read(~/.personal-agent/secrets/**)", "Write(.env)", "Edit(.env)", "Write(.env.*)", "Edit(.env.*)", "Write(**/.env)", "Edit(**/.env)", "Write(**/.env.*)", "Edit(**/.env.*)", "Write(id_rsa*)", "Edit(id_rsa*)", "Write(id_ed25519*)", "Edit(id_ed25519*)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)", "Write(~/.netrc)", "Edit(~/.netrc)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)", "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)", "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)", "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)", "CronCreate", "CronList", "CronDelete", "RemoteTrigger", "PushNotification"];
+/**
+ * Structured classification of an attempted command or path against the
+ * absolute-block list, used by the §6.3 audit path.
+ *
+ * Returns the matched category (or null) — the caller is responsible for
+ * inserting the `agent_actions` row. Pattern matching is intentionally
+ * loose string-based heuristics, not full shell parsing: the purpose is
+ * observability, and the SDK-level `disallowedTools` rejection remains
+ * the authoritative block regardless of what this classifier says.
+ */
+export type AbsoluteBlockCategory = "recursive_delete" | "privilege_escalation" | "pipe_to_shell" | "secret_cli" | "secret_read" | "secret_write";
+export interface AbsoluteBlockMatch {
+    category: AbsoluteBlockCategory;
+    /** Redacted form of the offending arg — path for Read/Write, first token for Bash. */
+    redacted: string;
+}
+export declare function classifyAbsoluteBlock(toolName: string, rawArg: string | undefined): AbsoluteBlockMatch | null;
+/**
+ * Return true when `raw` looks like a path to a credential / secret file.
+ *
+ * Exported so the observation summarizer's pre-filter (and any other
+ * read-side denylist enforcement) can mirror this layer without
+ * duplicating the pattern table — see
+ * `docs/design/appendices/cost-reduction-structural.md` §A "Privacy".
+ */
+export declare function looksLikeSecretPath(raw: string): boolean;
+//# sourceMappingURL=always-disallowed.d.ts.map

package/dist/safety/always-disallowed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"always-disallowed.d.ts","sourceRoot":"","sources":["../../src/safety/always-disallowed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,smEAyK1B,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,sBAAsB,GACtB,eAAe,GACf,YAAY,GACZ,aAAa,GACb,cAAc,CAAC;AAEnB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,kBAAkB,GAAG,IAAI,CA0G3B;AAUD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkBxD"}