@aitne/daemon 0.1.0

package/dist/safety/always-disallowed.js

@@ -0,0 +1,347 @@
+/**
+ * Absolute-block layer (EXECUTION-MODE-DESIGN.md §6).
+ *
+ * Patterns in `ALWAYS_DISALLOWED_TOOLS` are merged into every backend's
+ * effective `disallowedTools` regardless of execution mode (`strict` /
+ * `allow`) and regardless of any `allowedToolsOverride` the dashboard
+ * has set. This is the one non-optional defense: the agent cannot widen
+ * past it, even under Allow mode where the SDK-level permission gate is
+ * bypassed.
+ *
+ * Scope is deliberately narrow — four categories extracted directly from
+ * the existing risk taxonomy (recursive delete, privilege escalation,
+ * pipe-to-shell RCE, secret-file reads). Additions should be justified
+ * by a specific incident or concrete risk, not by speculative hardening.
+ *
+ * Coverage note: plain `curl` and `wget` are intentionally NOT blocked —
+ * the daemon-API chokepoint (`curl http://localhost:<port>/api/context/...`)
+ * is how skills write to memory. Only pipe-to-shell patterns (`curl | sh`,
+ * `wget | bash`, `bash <(...)`, `sh <(...)`) are blocked.
+ *
+ * Enforcement chokepoints (§6.2):
+ *   - Claude Code: merged into SDK `disallowedTools` in both strict and
+ *     allow branches. SDK rejects at pre-tool-invocation time.
+ *   - Gemini CLI: emitted as TOML deny rules in the admin policy, including
+ *     in allow mode where the normal whitelist policy is skipped.
+ *   - Codex CLI: Codex has no hook or admin-policy layer for shell commands.
+ *     Allow mode runs under `--dangerously-bypass-approvals-and-sandbox`,
+ *     which is a binary sandbox-off switch; the daemon cannot enforce
+ *     absolute-block there. Strict mode keeps the workspace-write sandbox
+ *     which denies writes outside cwd but does NOT pattern-match these
+ *     commands. Accepted gap, documented in 09-safety-cost.md.
+ */
+/**
+ * Tool patterns that remain denied across all modes. Pattern syntax
+ * matches the Claude Agent SDK: `Tool(argument-glob)` — Bash arguments
+ * are matched as shell-command globs, Read/Write/Edit arguments as path
+ * globs.
+ */
+export const ALWAYS_DISALLOWED_TOOLS = [
+    // ── Recursive delete ──
+    // Patterns are prefix-only (literal text + trailing `*`) so they map
+    // predictably through both the Claude SDK glob layer and the Gemini admin
+    // policy `commandPrefix` translator (gemini-cli-core.ts:1337) — the latter
+    // strips a single trailing `\s*\*$` and uses the remainder as a literal
+    // prefix, so a mid-pattern `*` would silently emit a broken rule.
+    //
+    // Coverage strategy: enumerate the short-flag bundles whose first 1-2
+    // characters identify the bundle as containing `r` or `R`, plus the
+    // long-form `--recursive`. The trailing `*` absorbs additional flag
+    // letters and the target path — `Bash(rm -rf*)` catches `rm -rf ~`,
+    // `rm -rfv ~`, `rm -rfvd ~`, `rm -rfi ~`, etc.
+    //
+    // Defense layering (informs which gaps are acceptable):
+    //   - Claude — both this glob list AND the `classifyAbsoluteBlock`
+    //     PreToolUse hook (claude-code-core.ts:1873-1884) run. The hook is
+    //     a regex superset of this list, so a glob miss still blocks.
+    //   - Gemini strict — this list is emitted at priority 999 (the in-tier
+    //     ceiling enforced by Gemini's PolicyFileSchema), AND the priority-100
+    //     catch-all denies all shell except curl/git, so the glob list is
+    //     belt-and-suspenders.
+    //   - Gemini allow / Codex allow — no catch-all, no hook surface for
+    //     shell commands. This list is the only defense.
+    //
+    // Known gaps (accepted, mirroring the documented Codex allow-mode gap
+    // in 09-safety-cost.md §6.4):
+    //   1. `rm <files-first> --recursive` (flags after files) — needs a
+    //      middle wildcard the prefix-only family can't express.
+    //   2. Multi-letter bundles with `r`/`R` in position 3+ (e.g.
+    //      `rm -ifr ~`, `rm -vfr ~`). The classifier hook covers Claude;
+    //      Gemini strict-mode catch-all covers strict; Gemini allow-mode
+    //      and Codex allow-mode have the gap.
+    // Both gaps require the operator to consciously enable allow mode and
+    // produce an unusual flag ordering — front-loaded flags (the canonical
+    // form skills and scripts use) are fully covered.
+    "Bash(rm -rf *)",
+    "Bash(rm -rf /*)",
+    "Bash(rm -rf ~*)",
+    "Bash(rm -rf .*)",
+    "Bash(rm -r *)",
+    // Lowercase-r-first bundles with extra letters (-rfv, -rfvd, -rfi, -rfd,
+    // -rfI, -rv, -ri, -rd, -rI, etc.). The trailing `*` absorbs both extra
+    // flag chars AND the file argument.
+    "Bash(rm -rf*)",
+    "Bash(rm -rv*)",
+    "Bash(rm -ri*)",
+    "Bash(rm -rd*)",
+    "Bash(rm -rI*)",
+    // Lowercase-f-first bundles (-fr, -frv, -fri, etc.).
+    "Bash(rm -fr*)",
+    // Lowercase-v-first bundles containing r (-vr, -vrf, etc.).
+    "Bash(rm -vr*)",
+    // Lowercase-i-first bundles containing r.
+    "Bash(rm -ir*)",
+    // Lowercase-d-first bundles containing r.
+    "Bash(rm -dr*)",
+    // Capital-I-first bundles containing r.
+    "Bash(rm -Ir*)",
+    // Capital-R variants — first char and after lowercase letters.
+    "Bash(rm -R*)",
+    "Bash(rm -fR*)",
+    "Bash(rm -vR*)",
+    "Bash(rm -iR*)",
+    "Bash(rm -dR*)",
+    "Bash(rm -IR*)",
+    // Long form. `rm --recursive*` matches `rm --recursive`, `rm --recursive ~`,
+    // and any further trailing flags. The two compound forms below cover the
+    // canonical force-then-recursive idioms; other orderings (with extra
+    // unrelated flags between) fall under the documented gap above.
+    "Bash(rm --recursive*)",
+    "Bash(rm --force --recursive*)",
+    "Bash(rm --recursive --force*)",
+    // ── Privilege escalation ──
+    "Bash(sudo *)",
+    "Bash(doas *)",
+    "Bash(su *)",
+    // ── Pipe-to-shell remote code execution ──
+    // Blocks `curl <url> | sh`, `wget <url> | bash`, `bash <(curl ...)`, etc.
+    // Plain `curl http://localhost:<port>/...` is NOT blocked — skills rely
+    // on it as the daemon-API chokepoint.
+    "Bash(curl * | sh*)",
+    "Bash(curl * | bash*)",
+    "Bash(wget * | sh*)",
+    "Bash(wget * | bash*)",
+    "Bash(bash <(*)*)",
+    "Bash(sh <(*)*)",
+    // No-space process-substitution forms — `bash<(curl ...)` /
+    // `sh<(curl ...)` are valid bash and execute the substituted script via
+    // stdin redirect. Without these entries the agent can bypass the
+    // space-required forms above. Also catches `bash<file` / `sh<file`
+    // (run a script via stdin redirect) which has the same RCE shape.
+    "Bash(bash<*)",
+    "Bash(sh<*)",
+    // Indirect-eval RCE — `eval $(curl ...)`, `eval <(curl ...)`,
+    // `source <(curl ...)`, `source $(curl ...)`. Agents in this project
+    // never legitimately call `eval` or `source` (no skill or task-flow
+    // uses them), so a universal block is safer than trying to enumerate
+    // every fetch-and-execute idiom in shell. The classifier uses the
+    // same coverage so audit log entries categorize correctly.
+    "Bash(eval *)",
+    "Bash(source *)",
+    // ── Platform secret-management CLIs ──
+    "Bash(security *)", // macOS Keychain CLI
+    "Bash(secret-tool *)", // Linux libsecret CLI
+    "Bash(cmdkey *)", // Windows Credential Manager CLI
+    // ── Secret-file reads ──
+    "Read(.env)",
+    "Read(.env.*)",
+    "Read(**/.env)",
+    "Read(**/.env.*)",
+    "Read(id_rsa*)",
+    "Read(id_ed25519*)",
+    "Read(~/.ssh/**)",
+    "Read(~/.gnupg/**)",
+    "Read(~/.aws/**)",
+    "Read(~/.config/gcloud/**)",
+    "Read(~/.config/gh/hosts.yml)",
+    "Read(~/.netrc)",
+    "Read(~/Library/Keychains/**)",
+    "Read(~/.local/share/keyrings/**)",
+    // ── Daemon-managed secret surfaces ──
+    // These paths hold the agent's own keychain-encrypted blobs, WhatsApp
+    // session state, and backups. Reading them would exfil the secrets the
+    // daemon goes out of its way to keep off the agent's surface.
+    "Read(~/.personal-agent/backups/**)",
+    "Read(~/.personal-agent/whatsapp/auth/**)",
+    "Read(~/.personal-agent/secrets/**)",
+    // ── Secret-file writes ──
+    // Kept symmetrical to the read list — an agent that can WRITE .env or
+    // ~/.ssh/authorized_keys can leak via its own exfil channel even without
+    // read access. The `security.test.ts` drift guard enforces this symmetry
+    // on every Read(...) pattern above.
+    "Write(.env)", "Edit(.env)",
+    "Write(.env.*)", "Edit(.env.*)",
+    "Write(**/.env)", "Edit(**/.env)",
+    "Write(**/.env.*)", "Edit(**/.env.*)",
+    "Write(id_rsa*)", "Edit(id_rsa*)",
+    "Write(id_ed25519*)", "Edit(id_ed25519*)",
+    "Write(~/.ssh/**)", "Edit(~/.ssh/**)",
+    "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)",
+    "Write(~/.aws/**)", "Edit(~/.aws/**)",
+    "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)",
+    "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)",
+    "Write(~/.netrc)", "Edit(~/.netrc)",
+    "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)",
+    "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)",
+    "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)",
+    "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)",
+    "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)",
+    // ── Anthropic-cloud managed/scheduled agents ──
+    // Aitne is local-first by design: scheduling lives in `agent_schedule` +
+    // `recurring_schedules` and is driven by the daemon's own cron. The Claude
+    // Code SDK exposes a Cron* family that creates remote agents running on
+    // Anthropic's cloud — those wouldn't reach the local daemon (no
+    // `localhost:8321` path), would silently bypass the audit log, MD memory,
+    // and quiet hours, and would burn quota outside our cost telemetry. Block
+    // unconditionally so neither Safe nor Allow mode can spawn them.
+    // RemoteTrigger / PushNotification follow the same pattern: cloud-mediated
+    // wake-ups for the same managed-agent surface.
+    "CronCreate", "CronList", "CronDelete",
+    "RemoteTrigger", "PushNotification",
+];
+export function classifyAbsoluteBlock(toolName, rawArg) {
+    if (!rawArg)
+        return null;
+    const arg = rawArg.trim();
+    if (toolName === "Bash") {
+        // Recursive delete — runs as an independent PreToolUse `block` hook
+        // (claude-code-core.ts:1873-1884) on top of the SDK `disallowedTools`
+        // glob layer, so this regex MAY be broader than the static SDK list:
+        // anything it catches is blocked regardless of glob coverage. Keep it
+        // a strict superset of the `Bash(rm ...)` entries above so a glob-
+        // blocked invocation always carries the matching `recursive_delete`
+        // category in the `agent_actions` audit row (§6.3 invariant).
+        //
+        // Coverage:
+        //   1. `-[a-zA-Z]*[rR][a-zA-Z]*` — any short-flag bundle directly
+        //      after `rm` that contains `r` or `R` (catches `-r`, `-rf`,
+        //      `-rfv`, `-fr`, `-Rf`, `-fRv`, `-irf`, etc.).
+        //   2. `--recursive` immediately after `rm`.
+        //   3. `--recursive` after intervening flags/words (e.g.
+        //      `rm --force --recursive ~`, `rm -f --recursive bar`).
+        //      The `[^|&;\`\n]*?` keeps the lookahead from crossing shell
+        //      command separators — `rm foo && cat --recursive` won't
+        //      misfire because the `&&` is excluded.
+        //
+        // The `(?:^|[;&|`(\n]\s*)` anchor requires `rm` to be the first
+        // token of a command (start-of-string, or after a shell separator
+        // / subshell open). This avoids false positives on text that
+        // happens to contain `rm` mid-stream — e.g. `echo rm --recursive`
+        // or `grep "rm -rf" file`.
+        const cmdStart = "(?:^|[;&|`(\\n]\\s*)";
+        if (new RegExp(`${cmdStart}rm\\s+(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)\\b`).test(arg)
+            || new RegExp(`${cmdStart}rm\\b[^|&;\`\\n]*?\\s--recursive\\b`).test(arg)) {
+            return { category: "recursive_delete", redacted: firstToken(arg) };
+        }
+        if (/(^|\s)(sudo|doas|su)(\s|$)/.test(arg)) {
+            return { category: "privilege_escalation", redacted: firstToken(arg) };
+        }
+        // Pipe-to-shell and indirect-eval RCE.
+        //
+        // Coverage (kept in sync with the `ALWAYS_DISALLOWED_TOOLS` entries
+        // in this file — the SDK list is the authoritative block layer; the
+        // patterns below are observability and must categorize anything the
+        // SDK rejects):
+        //
+        //   1. `curl … | sh` / `wget … | bash` and any chain ending in
+        //      pipe-to-(sh|bash).
+        //   2. `bash <(…)` / `sh <(…)` — process substitution into a shell.
+        //      `\s*` (not `\s+`) so the no-space forms `bash<(…)` and
+        //      `sh<(…)`, which are valid bash, are also caught.
+        //   3. `<(curl …)` / `<(wget …)` regardless of the calling command —
+        //      catches `python <(curl …)`, `source <(curl …)`, etc.
+        //   4. Any `eval` / `source` invocation. The SDK list blocks both
+        //      universally because no skill or task-flow uses them; the
+        //      classifier mirrors that to keep audit categories accurate.
+        //   5. `. <(curl …)` — POSIX dot sourcing process substitution.
+        //      The leading `(?:^|[\s;&|`])` keeps the rule from matching
+        //      a substring of `..` or a relative path like `./script.sh`.
+        //   6. Language interpreter executing fetched code via `-c` / `-e` /
+        //      `--eval` (`python -c "$(curl …)"`, `node -e "$(curl …)"`,
+        //      `perl -e "$(wget …)"`). The SDK glob layer cannot easily
+        //      express the `$(curl)` shape, so this is classifier-only —
+        //      the realistic block surface for these idioms is the
+        //      `curl|wget` substring inside an interpreter invocation, and
+        //      the operator gets a labelled `agent_actions` row even if the
+        //      SDK lets it through (Codex allow-mode gap, §6.4).
+        // `eval`/`source` must appear as the leading executable of a command, not
+        // anywhere in the argument. The original `\b(?:eval|source)\b\s+\S/` form
+        // false-positives on ordinary English words inside JSON payloads — e.g.
+        // `printf '... source: gmail ...' | curl -X PUT ...` was getting blocked
+        // because the string literal contained the word "source". Mirror the
+        // existing `cmdStart` anchor used by the `rm` rule (declared above), so
+        // `eval`/`source` only triggers when invoked as a command at start-of-line
+        // or after a shell separator.
+        if (/\b(?:curl|wget)\b[^|]*\|\s*(?:sh|bash)\b/.test(arg)
+            || /\b(?:bash|sh)\s*<\(/.test(arg)
+            || /<\(\s*(?:curl|wget)\b/.test(arg)
+            || new RegExp(`${cmdStart}(?:eval|source)\\b\\s+\\S`).test(arg)
+            || /(?:^|[\s;&|`])\.\s+<\(\s*(?:curl|wget)\b/.test(arg)
+            || /\b(?:python|python3|node|deno|perl|ruby|php)\b[^|]*?(?:-c|-e|--eval|--exec)\b[^|]*?\$\([^)]*?\b(?:curl|wget)\b/.test(arg)) {
+            return { category: "pipe_to_shell", redacted: firstToken(arg) };
+        }
+        if (/(^|\s)(security|secret-tool|cmdkey)\b/.test(arg)) {
+            return { category: "secret_cli", redacted: firstToken(arg) };
+        }
+        return null;
+    }
+    if (toolName === "Read") {
+        if (looksLikeSecretPath(arg)) {
+            return { category: "secret_read", redacted: redactPath(arg) };
+        }
+        return null;
+    }
+    if (toolName === "Write" || toolName === "Edit") {
+        if (looksLikeSecretPath(arg)) {
+            return { category: "secret_write", redacted: redactPath(arg) };
+        }
+        return null;
+    }
+    return null;
+}
+function firstToken(cmd) {
+    const m = cmd.match(/^\s*([^\s;&|]+)/);
+    /* c8 ignore start — regex always matches a possibly-empty string; the
+       null branch is defensive against a future regex tweak. */
+    return m ? m[1] : "";
+    /* c8 ignore stop */
+}
+/**
+ * Return true when `raw` looks like a path to a credential / secret file.
+ *
+ * Exported so the observation summarizer's pre-filter (and any other
+ * read-side denylist enforcement) can mirror this layer without
+ * duplicating the pattern table — see
+ * `docs/design/appendices/cost-reduction-structural.md` §A "Privacy".
+ */
+export function looksLikeSecretPath(raw) {
+    // Trim obvious quoting. We deliberately don't resolve `~` / relative
+    // paths — the classifier runs against the string the agent passed.
+    const p = raw.replace(/^["']|["']$/g, "");
+    const patterns = [
+        /(^|\/)\.env(\..+)?$/,
+        /(^|\/)id_(rsa|ed25519|ecdsa|dsa)(\b|\.)/,
+        /\.ssh(\/|$)/,
+        /\.gnupg(\/|$)/,
+        /\.aws(\/|$)/,
+        /\.config\/gcloud(\/|$)/,
+        /\.config\/gh\/hosts\.yml$/,
+        /\.netrc$/,
+        /Library\/Keychains(\/|$)/,
+        /\.local\/share\/keyrings(\/|$)/,
+        /\.personal-agent\/(backups|whatsapp\/auth|secrets)(\/|$)/,
+    ];
+    return patterns.some((r) => r.test(p));
+}
+function redactPath(raw) {
+    // Keep last path segment for operator context, strip the rest.
+    const p = raw.replace(/^["']|["']$/g, "");
+    const segs = p.split("/");
+    /* c8 ignore start — String.split always returns a non-empty array, so
+       `segs[segs.length - 1]` is always defined; the `?? ""` fallback is
+       defensive only. */
+    const tail = segs[segs.length - 1] ?? "";
+    return tail.length > 0 ? `.../${tail}` : "<unknown>";
+    /* c8 ignore stop */
+}
+//# sourceMappingURL=always-disallowed.js.map

package/dist/safety/always-disallowed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"always-disallowed.js","sourceRoot":"","sources":["../../src/safety/always-disallowed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,yBAAyB;IACzB,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,+CAA+C;IAC/C,EAAE;IACF,wDAAwD;IACxD,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,2BAA2B;IAC3B,qEAAqE;IACrE,qDAAqD;IACrD,EAAE;IACF,sEAAsE;IACtE,8BAA8B;IAC9B,oEAAoE;IACpE,6DAA6D;IAC7D,8DAA8D;IAC9D,qEAAqE;IACrE,qEAAqE;IACrE,0CAA0C;IAC1C,sEAAsE;IACtE,uEAAuE;IACvE,kDAAkD;IAClD,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,yEAAyE;IACzE,uEAAuE;IACvE,oCAAoC;IACpC,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,qDAAqD;IACrD,eAAe;IACf,4DAA4D;IAC5D,eAAe;IACf,0CAA0C;IAC1C,eAAe;IACf,0CAA0C;IAC1C,eAAe;IACf,wCAAwC;IACxC,eAAe;IACf,+DAA+D;IAC/D,cAAc;IACd,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,6EAA6E;IAC7E,yEAAyE;IACzE,qEAAqE;IACrE,gEAAgE;IAChE,uBAAuB;IACvB,+BAA+B;IAC/B,+BAA+B;IAE/B,6BAA6B;IAC7B,cAAc;IACd,cAAc;IACd,YAAY;IAEZ,4CAA4C;IAC5C,0EAA0E;IAC1E,wEAAwE;IACxE,sCAAsC;IACtC,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,4DAA4D;IAC5D,wEAAwE;IACxE,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,cAAc;IACd,YAAY;IACZ,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,2DAA2D;IAC3D,cAAc;IACd,gBAAgB;IAEhB,wCAAwC;IACxC,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,iCAAiC;IAEnD,0BAA0B;IAC1B,YAAY;IACZ,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,2BAA2B;IAC3B,8BAA8B;IAC9B,gBAAgB;IAChB,8BAA8B;IAC9B,kCAAkC;IAElC,uCAAuC;IACvC,sEAAsE;IACtE,uEAAuE;IACvE,8DAA8D;IAC9D,oCAAoC;IACpC,0CAA0C;IAC1C,oCAAoC;IAEpC,2BAA2B;IAC3B,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,oCAAoC;IACpC,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;IAC/B,gBAAgB,EAAE,eAAe;IACjC,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,mBAAmB;IACzC,kBAAkB,EAAE,iBAAiB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,kBAAkB,EAAE,iBAAiB;IACrC,4BAA4B,EAAE,2BAA2B;IACzD,+BAA+B,EAAE,8BAA8B;IAC/D,iBAAiB,EAAE,gBAAgB;IACnC,+BAA+B,EAAE,8BAA8B;IAC/D,mCAAmC,EAAE,kCAAkC;IACvE,qCAAqC,EAAE,oCAAoC;IAC3E,2CAA2C,EAAE,0CAA0C;IACvF,qCAAqC,EAAE,oCAAoC;IAE3E,iDAAiD;IACjD,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,2EAA2E;IAC3E,+CAA+C;IAC/C,YAAY,EAAE,UAAU,EAAE,YAAY;IACtC,eAAe,EAAE,kBAAkB;CAC3B,CAAC;AA0BX,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE1B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,EAAE;QACF,YAAY;QACZ,kEAAkE;QAClE,iEAAiE;QACjE,oDAAoD;QACpD,6CAA6C;QAC7C,yDAAyD;QACzD,6DAA6D;QAC7D,kEAAkE;QAClE,8DAA8D;QAC9D,6CAA6C;QAC7C,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,kEAAkE;QAClE,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACxC,IACE,IAAI,MAAM,CAAC,GAAG,QAAQ,kDAAkD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;eAChF,IAAI,MAAM,CAAC,GAAG,QAAQ,qCAAqC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EACzE,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,uCAAuC;QACvC,EAAE;QACF,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,gBAAgB;QAChB,EAAE;QACF,+DAA+D;QAC/D,0BAA0B;QAC1B,oEAAoE;QACpE,8DAA8D;QAC9D,wDAAwD;QACxD,qEAAqE;QACrE,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,mEAAmE;QACnE,oEAAoE;QACpE,yDAAyD;QACzD,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,8BAA8B;QAC9B,IACE,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC;eACjD,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;eAC/B,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;eACjC,IAAI,MAAM,CAAC,GAAG,QAAQ,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;eAC5D,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC;eACpD,gHAAgH,CAAC,IAAI,CAAC,GAAG,CAAC,EAC7H,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC;gEAC4D;IAC5D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrB,oBAAoB;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAa;QACzB,qBAAqB;QACrB,yCAAyC;QACzC,aAAa;QACb,eAAe;QACf,aAAa;QACb,wBAAwB;QACxB,2BAA2B;QAC3B,UAAU;QACV,0BAA0B;QAC1B,gCAAgC;QAChC,0DAA0D;KAC3D,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B;;yBAEqB;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,oBAAoB;AACtB,CAAC"}

package/dist/safety/audit.d.ts

@@ -0,0 +1,118 @@
+import type Database from "better-sqlite3";
+import type { Event, AgentResult, MessageEvent } from "@aitne/shared";
+import type { BangCommandDetail, IAuditLogger } from "../core/dispatcher.js";
+export interface AuditEventRow {
+    id: number;
+    event_id: string;
+    action_type: string;
+    trigger: string;
+    model_used: string | null;
+    cost_usd: number;
+    tokens_input: number;
+    tokens_output: number;
+    duration_ms: number;
+    num_turns: number;
+    result: string;
+    detail: string | null;
+    started_at: string;
+    completed_at: string | null;
+    error: string | null;
+}
+interface AuditLoggerOptions {
+    onRowInserted?: (row: AuditEventRow) => void;
+}
+export declare function loadAuditEventRow(db: Database.Database, rowId: number): AuditEventRow | undefined;
+export declare class AuditLogger implements IAuditLogger {
+    private readonly db;
+    private readonly options;
+    private readonly actionColumns;
+    private readonly hasCacheCreationTokensColumn;
+    private readonly hasCacheReadTokensColumn;
+    private readonly hasModelUsageJsonColumn;
+    private readonly hasBackendColumn;
+    private readonly hasCostSourceColumn;
+    private readonly hasContextUpdatedColumn;
+    private readonly hasAdvisorCallCountColumn;
+    constructor(db: Database.Database, options?: AuditLoggerOptions);
+    logAction(params: {
+        event: Event;
+        model: string;
+        costUsd: number;
+        usage: AgentResult["usage"];
+        modelUsage: AgentResult["modelUsage"];
+        durationMs: number;
+        numTurns: number;
+        trigger: "reactive" | "autonomous";
+        backend?: AgentResult["backendId"];
+        costSource?: AgentResult["costSource"];
+        contextUpdated?: boolean;
+        advisorCallCount?: number;
+        /**
+         * STAGE-C-DM-FRESHNESS-PLAN §Task 4 — DM-only freshness telemetry.
+         * Persisted into `agent_actions.detail` as `{ dm_freshness: ... }` so
+         * the `dm_freshness_metrics` view can compute resume rate, p95 lag,
+         * loud/quiet write counts seen mid-session, and refetch-hit rate.
+         */
+        dmFreshness?: {
+            resumed: boolean;
+            agentLogLagMinutes: number;
+            loudWritesSinceSessionStart: number;
+            quietWritesSinceSessionStart: number;
+            refetchedToday: boolean;
+            triggerMatched: boolean;
+        };
+    }): void;
+    logSkip(event: Event, reason: string, trigger: "reactive" | "autonomous"): void;
+    /**
+     * Chat-attachments Phase 1 — log a successful upload (inbound or outbound)
+     * to `agent_actions`. Shares the `agent_actions` table with agent-turn
+     * actions so the dashboard cost/events views can surface attachment
+     * activity alongside agent execution without a second table.
+     *
+     * Uses a minimal column set like `logSkip`/`logError`: no token/cost
+     * accounting (an upload is always zero-cost) and no model_used. The
+     * direction is encoded in `action_type` so cost queries that group by
+     * action_type bucket uploads separately from turns.
+     */
+    logAttachment(params: {
+        direction: "inbound" | "outbound";
+        attachmentId: string;
+        mimeType: string;
+        sizeBytes: number;
+        provenance: string;
+        originalFilename: string;
+    }): void;
+    logBangCommand(event: MessageEvent, detail: BangCommandDetail): void;
+    logError(event: Event, error: Error, trigger: "reactive" | "autonomous", 
+    /**
+     * Optional partial-run context the dispatcher recovers from the catch
+     * site (wall-clock duration) and from `BackendRouterHandledError`
+     * (backend / model / failure kind+code). Without this, the row is a
+     * black hole: the dashboard shows "Duration: 0ms" for a 60-second run
+     * that hit `max_budget_usd` because the row was written with no
+     * timing/backend/model info — see drift-effects regression
+     * 2026-05-04 (today_refresh hit the $0.10 cap; row 62 was unfilled).
+     *
+     * Tokens / cost / num_turns are intentionally NOT passed: an aborted
+     * SDK stream doesn't surface a usable AgentResult, so any value here
+     * would be a guess. duration_ms + backend + failure shape are
+     * recoverable and that's what we record.
+     */
+    context?: {
+        durationMs?: number;
+        backendId?: import("@aitne/shared").BackendId;
+        modelId?: string;
+        failureKind?: string;
+        failureCode?: string;
+    }): void;
+    private emitInsertedRow;
+}
+/**
+ * Map a `BangCommandDetail.status` to the `agent_actions.result` value
+ * permitted by the schema's CHECK constraint
+ * (`success | failed | partial | skipped | in_progress`). See docs/design/
+ * backlog/messaging-bang-commands.md §6.6 for the rationale.
+ */
+export declare function bangStatusToResult(status: BangCommandDetail["status"]): "success" | "skipped" | "failed";
+export {};
+//# sourceMappingURL=audit.d.ts.map

package/dist/safety/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/safety/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACb,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,UAAU,kBAAkB;IAC1B,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;CAC9C;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,KAAK,EAAE,MAAM,GACZ,aAAa,GAAG,SAAS,CAU3B;AAED,qBAAa,WAAY,YAAW,YAAY;IAW5C,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IACvD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAU;gBAGjC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,OAAO,GAAE,kBAAuB;IAkBnD,SAAS,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,UAAU,GAAG,YAAY,CAAC;QACnC,OAAO,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;QACnC,UAAU,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;QACvC,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B;;;;;WAKG;QACH,WAAW,CAAC,EAAE;YACZ,OAAO,EAAE,OAAO,CAAC;YACjB,kBAAkB,EAAE,MAAM,CAAC;YAC3B,2BAA2B,EAAE,MAAM,CAAC;YACpC,4BAA4B,EAAE,MAAM,CAAC;YACrC,cAAc,EAAE,OAAO,CAAC;YACxB,cAAc,EAAE,OAAO,CAAC;SACzB,CAAC;KACH,GAAG,IAAI;IAoIR,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,YAAY,GAAG,IAAI;IAqB/E;;;;;;;;;;OAUG;IACH,aAAa,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC;QAClC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,IAAI;IA8BR,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI;IA6BpE,QAAQ,CACN,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,UAAU,GAAG,YAAY;IAClC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,OAAO,eAAe,EAAE,SAAS,CAAC;QAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GACA,IAAI;IA6EP,OAAO,CAAC,eAAe;CAkBxB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,GAClC,SAAS,GAAG,SAAS,GAAG,QAAQ,CAUlC"}