@aitne/daemon 0.1.0

package/dist/safety/risk-classifier.js

@@ -0,0 +1,763 @@
+import { createLogger } from "../logging.js";
+const logger = createLogger("risk-classifier");
+/**
+ * RiskTier — classifies the risk level of Daemon API operations.
+ *
+ * Convention: numeric enum → UPPER_CASE (EventPriority), string enum → PascalCase (RiskTier)
+ */
+export var RiskTier;
+(function (RiskTier) {
+    /** Safe to execute autonomously without any notification */
+    RiskTier["Autonomous"] = "autonomous";
+    /**
+     * Contains personal data (email, calendar, notes, context files).
+     * Enforced by X-Read-Token or Bearer auth when `enforceReadToken=true`.
+     */
+    RiskTier["ReadSensitive"] = "read_sensitive";
+    /** Requires explicit user approval before execution */
+    RiskTier["Approve"] = "approve";
+})(RiskTier || (RiskTier = {}));
+/**
+ * Risk classification per API endpoint.
+ *
+ * Keys use "METHOD /path" format for write operations that differ from
+ * the default GET risk level. Plain "/path" applies to all methods.
+ */
+const API_RISK = {
+    // ── Agent Internal API ──
+    // /api/schedule is Autonomous per DESIGN.md §8: the agent self-schedules
+    // as part of its normal operation. All methods are included — the agent
+    // reschedules (PATCH) and cancels (DELETE) its own tasks via the schedule
+    // skill, and the risk profile is identical to POST (single-row DB mutation,
+    // idempotent by row ID).
+    "/api/health": RiskTier.Autonomous,
+    // /api/escalate is a 410 Gone stub. Listed explicitly (rather than
+    // relying on the Approve default) so the boot audit's fingerprint
+    // stays stable — see the "Admin / dashboard surfaces" block below.
+    "POST /api/escalate": RiskTier.Approve,
+    "/api/schedule": RiskTier.Autonomous,
+    "PATCH /api/schedule/": RiskTier.Autonomous,
+    "DELETE /api/schedule/": RiskTier.Autonomous,
+    "/api/action/log": RiskTier.Autonomous,
+    // Profile-interview queue helper. Read-only, returns a single boolean
+    // (`{filled, sectionPresent}`) computed from a context-vault path. No
+    // secrets, no auth-sensitive content. Agent prose calls this from the
+    // morning routine (Layer 2 pre-pick), DM handler / scheduled.dm.md
+    // (Layer 3 fire-time / opportunity abort), and the user_profile_sweep
+    // (Layer 4 cross-check). See profile-interview-queue.md §3.5.
+    "GET /api/profile-questions/slot-filled": RiskTier.Autonomous,
+    // ── Recurring Schedules API (agent + dashboard) ──
+    "GET /api/recurring-schedules": RiskTier.Autonomous,
+    "POST /api/recurring-schedules": RiskTier.Autonomous,
+    "PATCH /api/recurring-schedules/": RiskTier.Autonomous,
+    "DELETE /api/recurring-schedules/": RiskTier.Autonomous,
+    // ── Automation Triggers API (docs/design/19-dashboard-ia-and-triggers.md) ──
+    // Dashboard-driven only — the agent does not configure its own triggers
+    // (the user defines them in the Git/<domain> page UI). Approve tier for
+    // both reads and writes: list responses reveal scheduling cadence and
+    // free-form prompts, which can carry personal context.
+    "/api/triggers": RiskTier.Approve,
+    // ── Unified Repositories API (docs/design/appendices/unified-repositories.md) ──
+    // Dashboard-driven only. Listing reveals registered local paths +
+    // GitHub slugs (sensitive in shared-screen scenarios), CRUD changes
+    // observer surface, and the run/init/scan endpoints spawn full agent
+    // sessions in either a temp dir or a registered local clone.
+    // Notify tier was abolished daemon-wide; Approve covers Bearer
+    // enforcement for the dashboard and the agent has no current code
+    // path that calls these without explicit user surface.
+    // The /run + /triggers/:id/run + /management/{init,scan} routes also
+    // write `agent_actions(action_type='repo_run')` rows for retrospective
+    // visibility — the route handlers are the chokepoint, not the
+    // classifier.
+    "/api/repositories": RiskTier.Approve,
+    // Agent-callable chokepoint for the architecture refresh flow. The
+    // outer `/api/repositories` Approve umbrella protects browser-facing
+    // CRUD; this endpoint is invoked by the agent session spawned for
+    // `git.project.refresh_architecture` (no Bearer in the workdir), so
+    // it gets an explicit Autonomous override. Body validation in the
+    // route caps the payload size and rejects begin/end-marker
+    // smuggling, so the blast radius is limited to the marker-bracketed
+    // Architecture block of one overview.md.
+    "PUT /api/repositories/{*}/architecture-section": RiskTier.Autonomous,
+    // ── Skills API (agent + dashboard) ──
+    // Agent manages user skills via the external-services skill (user-initiated DMs).
+    // Built-in skills are immutable by API construction (slug collision rejection).
+    // Reads and writes are both Autonomous — the agent calls via curl without
+    // tokens. Per DELEGATED-MODE-V2-DESIGN.md §4.5, the user-driven `deniedTools`
+    // setting is the primary defense; on-demand retrospective via /api/agent/actions
+    // covers awareness.
+    "GET /api/skills": RiskTier.Autonomous,
+    "POST /api/skills": RiskTier.Autonomous,
+    "PUT /api/skills/": RiskTier.Autonomous,
+    "DELETE /api/skills/": RiskTier.Autonomous,
+    // ── Docs & QA (DOCS_QA_BACKEND_DESIGN.md §10) ──
+    // Read endpoints serve operator-facing docs that are not personal data
+    // (sourced from agent-assets/docs/, mirrored to docs/user/ on first
+    // launch). The docs-search skill must be able to curl these without a
+    // Bearer token, so they're Autonomous.
+    "/api/docs": RiskTier.Autonomous,
+    // POST /api/docs/qa/messages enqueues a Q&A turn through the docs-QA
+    // SSE adapter — it is dashboard-tab input gated by the dashboard's
+    // Bearer auth, with the same blast-radius shape as /api/chat/messages
+    // (Approve), so it gets an explicit override on top of the
+    // Autonomous prefix (DOCS_QA_B7_DESIGN.md D6).
+    "POST /api/docs/qa/messages": RiskTier.Approve,
+    // GET /api/docs/qa/stream stays under the prefix's Autonomous tier
+    // — the explicit row is documentation-shaped per the rest of this
+    // file's style, so future readers can audit the QA endpoints by
+    // grepping `docs/qa`.
+    "GET /api/docs/qa/stream": RiskTier.Autonomous,
+    // ── Dashboard / Browser-facing API ──
+    // These endpoints are initiated by the dashboard rather than the autonomous
+    // agent loop, so they must never be reachable without an API token.
+    "GET /api/config/google-auth/callback": RiskTier.Autonomous,
+    // design/15-character.md §15.6 — dedicated agent-callable endpoint for the
+    // character (persona) field. The general /api/config surface stays Approve
+    // because it can touch secrets, OAuth tokens, and schedule hot-reloads.
+    // The character field is a single bounded style string, so a GET/PATCH
+    // scoped to it matches /api/skills' risk profile: Autonomous on both.
+    // Bearer-less callers (the agent's curl from a session workdir) can set
+    // tone/persona without the full config blast radius.
+    "GET /api/config/character": RiskTier.Autonomous,
+    "PATCH /api/config/character": RiskTier.Autonomous,
+    "/api/config": RiskTier.Approve,
+    "/api/setup": RiskTier.Approve,
+    // Management Mode Phase 2 — migration endpoint. Redundant with the
+    // /api/setup prefix rule above (which already hits Approve) but named
+    // explicitly so future refactors of the setup-tier rules don't
+    // accidentally drop this endpoint to a weaker tier. The blast radius
+    // is catastrophic: move files + rewrite DB + swap the context store.
+    "POST /api/setup/migrate-context": RiskTier.Approve,
+    // Knowledge import — owner uploads a Markdown / text file from the
+    // dashboard Knowledge page; the daemon emits a one-shot session that
+    // writes facts into user/*.md. Approve tier because the blast radius
+    // is the entire user/* tree. Bearer auth required.
+    "POST /api/knowledge/import": RiskTier.Approve,
+    "/api/system": RiskTier.Approve,
+    "/api/events": RiskTier.Approve,
+    "/api/conversations": RiskTier.Approve,
+    "DELETE /api/conversations": RiskTier.Approve,
+    "DELETE /api/conversations/": RiskTier.Approve,
+    "/api/cost": RiskTier.Approve,
+    "/api/metrics": RiskTier.Approve,
+    "/api/logs": RiskTier.Approve,
+    "/api/approvals": RiskTier.Approve,
+    "/api/notifications": RiskTier.Approve,
+    "/api/search": RiskTier.Approve,
+    "/api/snapshots": RiskTier.Approve,
+    "/api/chat": RiskTier.Approve,
+    "/api/commands": RiskTier.Approve,
+    "/api/schedule/next": RiskTier.Approve,
+    "/api/schedule/list": RiskTier.Approve,
+    "POST /api/agent/regenerate": RiskTier.Approve,
+    "POST /api/agent/run-now": RiskTier.Approve,
+    // DELEGATED-MODE-V2-DESIGN.md §6.1 — agent-callable retrospective.
+    // Autonomous tier so the DM session can read its own audit trail without
+    // the dashboard-issued bearer (which agents don't have). Output is
+    // redacted via secret-redaction before serialization.
+    "GET /api/agent/actions": RiskTier.Autonomous,
+    // ── Chat file attachments (Phase 1) ──
+    // Dashboard-initiated reads/uploads/deletes are owner-only. They fall
+    // under the `/api/chat` Approve umbrella so Bearer auth is enforced by
+    // the middleware — explicit entries are listed for auditability only.
+    "GET /api/chat/attachments/": RiskTier.Approve,
+    "POST /api/chat/attachments": RiskTier.Approve,
+    "DELETE /api/chat/attachments/": RiskTier.Approve,
+    // The outbound endpoint is the agent's path (curl from the session
+    // workdir, no Bearer). It validates `X-Turn-Token` in-handler instead,
+    // so the middleware must not force Bearer on it. Autonomous tier drops
+    // it from Approve's mandatory-Bearer check; the agent's calls land in
+    // agent_actions for the on-demand retrospective.
+    "POST /api/chat/outbound-attachments": RiskTier.Autonomous,
+    // ── Context File API ──
+    // GET reads contain personal notes, schedule, user profile — ReadSensitive.
+    // Writes remain Autonomous (agent's own memory operations).
+    "GET /api/context": RiskTier.ReadSensitive,
+    "PUT /api/context/": RiskTier.Autonomous,
+    "PATCH /api/context/": RiskTier.Autonomous,
+    "PUT /api/context/today": RiskTier.Autonomous,
+    "PATCH /api/context/today": RiskTier.Autonomous,
+    "PUT /api/context/tomorrow": RiskTier.Autonomous,
+    "PATCH /api/context/tomorrow": RiskTier.Autonomous,
+    // B-007 §5.1 — user profile lives at user/profile.md, area files under user/*.md.
+    "PUT /api/context/user/": RiskTier.Autonomous,
+    "PATCH /api/context/user/": RiskTier.Autonomous,
+    // B-007 §5.1 — management rules moved from context/management-rules.md to
+    // context/rules/management.md; mcp / journal-format / journal-export /
+    // redaction rules are Autonomous (post-Notify-abolition) — agent edits its
+    // own session-shaping rules, on-demand retrospective covers awareness.
+    "PUT /api/context/rules/": RiskTier.Autonomous,
+    "PATCH /api/context/rules/": RiskTier.Autonomous,
+    "PATCH /api/context/roadmap": RiskTier.Autonomous,
+    // Pure-utility ID minter — reads existing IDs, generates a fresh one.
+    // No write side-effect; the route's own write-lock guard handles
+    // concurrent-mint protection. Without this entry the call defaulted
+    // to Approve (fail-closed) and roadmap_refresh's task-flow Step 4.1
+    // collapsed onto fabricated placeholder IDs that then failed PUT
+    // validation with `Malformed roadmap id marker`.
+    "POST /api/context/roadmap/id": RiskTier.Autonomous,
+    "PUT /api/context/projects": RiskTier.Autonomous,
+    "PATCH /api/context/projects": RiskTier.Autonomous,
+    "PUT /api/context/weekly": RiskTier.Autonomous,
+    // B-007 §5.9 — day rotation endpoint (today.md → yesterday.md; synthesized
+    // daily/YYYY-MM-DD.md is written by the morning routine, not this path).
+    "POST /api/context/archive-today": RiskTier.Autonomous,
+    // B-007 §5.8 — routines/<cadence>.md and routines/custom/<slug>.md
+    // shape scheduled behavior; Autonomous (matches rules tier).
+    "PUT /api/context/routines/": RiskTier.Autonomous,
+    "PATCH /api/context/routines/": RiskTier.Autonomous,
+    "DELETE /api/context/routines/": RiskTier.Autonomous,
+    // B-007 §5.9 — synthesized daily journal path is Autonomous (agent-owned output).
+    "PUT /api/context/daily/": RiskTier.Autonomous,
+    "PATCH /api/context/daily/": RiskTier.Autonomous,
+    // B-007 §5.1 — agent/journal.md (self-reflection) is agent-only.
+    "PUT /api/context/agent/": RiskTier.Autonomous,
+    "PATCH /api/context/agent/": RiskTier.Autonomous,
+    "GET /api/context/list": RiskTier.ReadSensitive,
+    // B-008 P7 — Vault Health surface. `health` returns a structural drift
+    // report (no user prose), so Autonomous. `repair/stub` copies a template
+    // file into the vault — Autonomous (agent self-repair); the dashboard
+    // path remains unauthenticated-with-browser-gate per the agent-callable
+    // pattern, and every call lands in agent_actions for retrospective.
+    "GET /api/context/health": RiskTier.Autonomous,
+    "POST /api/context/repair/stub": RiskTier.Autonomous,
+    "POST /api/context/lock/morning-routine": RiskTier.Autonomous,
+    "DELETE /api/context/lock/morning-routine": RiskTier.Autonomous,
+    "POST /api/context/lock/roadmap": RiskTier.Autonomous,
+    "DELETE /api/context/lock/roadmap": RiskTier.Autonomous,
+    "GET /api/observations": RiskTier.ReadSensitive,
+    "GET /api/observations/stats": RiskTier.Autonomous,
+    "POST /api/observations": RiskTier.Autonomous,
+    "POST /api/observations/consume": RiskTier.Autonomous,
+    // ── Notification ──
+    "/api/notify": RiskTier.Autonomous,
+    // ── External Service Proxy ──
+    // GET reads return personal calendar/email/notes data — ReadSensitive.
+    "GET /api/calendar/events": RiskTier.ReadSensitive,
+    "GET /api/calendar/calendars": RiskTier.ReadSensitive,
+    "POST /api/calendar/events": RiskTier.Autonomous,
+    "PATCH /api/calendar/events": RiskTier.Autonomous,
+    "DELETE /api/calendar/events": RiskTier.Autonomous,
+    "POST /api/calendar/freebusy": RiskTier.ReadSensitive,
+    // SETUP-FLOW-REDESIGN-PLAN §5.5 / §6.1 — Outlook on-demand calendar
+    // reads (no observer in v1). Read-sensitive matches the Google
+    // calendar list/get tier; the agent never writes via these routes
+    // today.
+    "GET /api/calendar/outlook/calendars": RiskTier.ReadSensitive,
+    "GET /api/calendar/outlook/events": RiskTier.ReadSensitive,
+    // Apple Calendar (iCloud CalDAV) — same tiers as Google Calendar for the
+    // event-level routes; credential setters require Approve so the agent
+    // cannot quietly write app-specific passwords on the user's behalf even
+    // though the curl allowlist would otherwise permit it.
+    "GET /api/apple-calendar/status": RiskTier.Autonomous,
+    "GET /api/apple-calendar/events": RiskTier.ReadSensitive,
+    "GET /api/apple-calendar/calendars": RiskTier.ReadSensitive,
+    "POST /api/apple-calendar/events": RiskTier.Autonomous,
+    "PATCH /api/apple-calendar/events": RiskTier.Autonomous,
+    "DELETE /api/apple-calendar/events": RiskTier.Autonomous,
+    "POST /api/apple-calendar/freebusy": RiskTier.ReadSensitive,
+    "POST /api/apple-calendar/credentials": RiskTier.Approve,
+    "DELETE /api/apple-calendar/credentials": RiskTier.Approve,
+    "POST /api/apple-calendar/default-calendar": RiskTier.Approve,
+    "GET /api/notion/query": RiskTier.ReadSensitive,
+    "GET /api/notion/databases": RiskTier.ReadSensitive,
+    "GET /api/notion/search": RiskTier.ReadSensitive,
+    "GET /api/notion/pages/": RiskTier.ReadSensitive,
+    "POST /api/notion/pages": RiskTier.Autonomous,
+    "PATCH /api/notion/pages/": RiskTier.Autonomous,
+    "DELETE /api/notion/pages/": RiskTier.Autonomous,
+    // Obsidian: status is low-sensitivity metadata; notes/search contain content.
+    "GET /api/obsidian/status": RiskTier.Autonomous,
+    "GET /api/obsidian/notes": RiskTier.ReadSensitive,
+    "GET /api/obsidian/search": RiskTier.ReadSensitive,
+    "POST /api/obsidian/notes": RiskTier.Autonomous,
+    "PUT /api/obsidian/notes": RiskTier.Autonomous,
+    "PATCH /api/obsidian/notes": RiskTier.Autonomous,
+    "DELETE /api/obsidian/notes": RiskTier.Autonomous,
+    "PATCH /api/obsidian/daily": RiskTier.Autonomous,
+    // ── Multi-mail provider (Phase 1 scope gate + Phase 2 Outlook routes) ──
+    "GET /api/mail/providers": RiskTier.ReadSensitive,
+    "PATCH /api/mail/providers": RiskTier.Approve,
+    "GET /api/mail/accounts": RiskTier.ReadSensitive,
+    "POST /api/mail/accounts": RiskTier.Approve,
+    "POST /api/mail/accounts/device-code": RiskTier.Approve,
+    "PATCH /api/mail/accounts/": RiskTier.Approve,
+    "DELETE /api/mail/accounts/": RiskTier.Approve,
+    // BYOA client-config — stores the Azure AD clientId/tenant. The payload
+    // itself is not a secret (public OAuth client model), but writes reshape
+    // trust for every Outlook account so the write path is owner-only.
+    "GET /api/config/mail/outlook/client-config": RiskTier.Approve,
+    "PUT /api/config/mail/outlook/client-config": RiskTier.Approve,
+    "DELETE /api/config/mail/outlook/client-config": RiskTier.Approve,
+    "POST /api/config/mail/app-password": RiskTier.Approve,
+    // App-password rotation: rewrites credentials for an existing IMAP account
+    // — same blast radius as initial create, owner-only.
+    "POST /api/config/mail/app-password/{*}/refresh": RiskTier.Approve,
+    // ── Multi-mail provider per-account operations (Phase 5 §3.3, §8) ──
+    // Routes are split by blast radius, not by body content, so the classifier
+    // stays path-based. `{*}` is a single-segment placeholder (see
+    // {@link matchesPattern}). Pattern keys win over flat-prefix keys of
+    // equal literal-prefix length.
+    //
+    // Flat-prefix defaults (catch-all for any new /api/mail/* route that
+    // hasn't been classified explicitly yet — Autonomous for all writes per
+    // DELEGATED-MODE-V2-DESIGN.md §4.5.1. Explicit patterns below override the
+    // catch-alls via the longest-literal-prefix tiebreaker; deniedTools is
+    // the safety control, not the tier.):
+    "GET /api/mail/": RiskTier.ReadSensitive,
+    // Cross-account local FTS5 search — ReadSensitive like any mail read.
+    // Listed explicitly so the rule is obvious in review even though the
+    // GET catch-all above would cover it.
+    "GET /api/mail/search": RiskTier.ReadSensitive,
+    "POST /api/mail/": RiskTier.Autonomous,
+    "PATCH /api/mail/": RiskTier.Autonomous,
+    "DELETE /api/mail/": RiskTier.Autonomous,
+    // Draft CRUD — drafts are inert until explicitly sent.
+    "POST /api/mail/{*}/drafts": RiskTier.Autonomous,
+    "PATCH /api/mail/{*}/drafts/": RiskTier.Autonomous,
+    "DELETE /api/mail/{*}/drafts/": RiskTier.Autonomous,
+    // Reversible metadata ops (mark-read, labels, archive, untrash).
+    "POST /api/mail/{*}/messages/{*}/read": RiskTier.Autonomous,
+    "POST /api/mail/{*}/messages/{*}/archive": RiskTier.Autonomous,
+    "POST /api/mail/{*}/messages/{*}/untrash": RiskTier.Autonomous,
+    "POST /api/mail/{*}/messages/{*}/tags": RiskTier.Autonomous,
+    // Destructive / outbound — Autonomous; deniedTools is the safety control
+    // (DELEGATED-MODE-V2-DESIGN.md §4.5). The wizard pre-populates a starter
+    // denylist on first delegated setup so a fresh install blocks _send / trash
+    // by default; the user opts out explicitly per §4.5.4.
+    "POST /api/mail/{*}/messages/send": RiskTier.Autonomous,
+    "POST /api/mail/{*}/messages/{*}/trash": RiskTier.Autonomous,
+    "POST /api/mail/{*}/drafts/{*}/send": RiskTier.Autonomous,
+    // ── Git ──
+    "GET /api/git": RiskTier.Autonomous,
+    // Git project document templates + Re-template (P6 git-lifecycle-and-triggers.md
+    // Decision 8). The editor (GET/PUT), apply (POST :kind/apply), and status
+    // (GET retemplate/status) are dashboard-driven and change durable assets,
+    // so they sit at Approve-tier — matching `/api/task-flows` whose blast
+    // radius is the same shape (free-form prose the agent picks up verbatim).
+    // The per-file reporter (POST retemplate/file) is the exception: the
+    // re-template task-flow runs as an autonomous session and posts per-file
+    // progress over curl from the session workdir, which carries no Bearer
+    // token. It must therefore be Autonomous, mirroring `/api/observations`
+    // and the `/api/context/*` write surface. The exact-match rule wins over
+    // the path-only `/api/git/templates` prefix per
+    // `findExplicitRiskClassification` step 1.
+    "POST /api/git/templates/retemplate/file": RiskTier.Autonomous,
+    "/api/git/templates": RiskTier.Approve,
+    // ── GitHub ──
+    "GET /api/github": RiskTier.Autonomous,
+    "POST /api/github/pulls/comment": RiskTier.Autonomous,
+    // ── Travel Bookings (Phase B) ──
+    "GET /api/travel-bookings": RiskTier.ReadSensitive,
+    "GET /api/travel-bookings/": RiskTier.ReadSensitive,
+    "GET /api/travel-bookings/upcoming": RiskTier.ReadSensitive,
+    "PATCH /api/travel-bookings/": RiskTier.Approve,
+    // ── Receipts (Phase B) ──
+    "GET /api/receipts": RiskTier.ReadSensitive,
+    "GET /api/receipts/": RiskTier.ReadSensitive,
+    "GET /api/receipts/summary": RiskTier.ReadSensitive,
+    "POST /api/receipts/": RiskTier.ReadSensitive, // binary receipt download
+    "PATCH /api/receipts/": RiskTier.Approve,
+    // ── Travel Time (Phase B) ──
+    "GET /api/travel-time": RiskTier.Autonomous,
+    "GET /api/travel-time/for-event/": RiskTier.Autonomous,
+    // ── Books & Reading (Phase C, F-10) ──
+    "GET /api/books": RiskTier.ReadSensitive,
+    "GET /api/books/": RiskTier.ReadSensitive,
+    "GET /api/books/summary": RiskTier.ReadSensitive,
+    "PATCH /api/books/": RiskTier.Approve, // user corrections
+    "POST /api/books/import-clippings": RiskTier.Autonomous, // bulk data write
+    "POST /api/books/import-notebook-html": RiskTier.Autonomous, // Kindle Notebook Export email ingest
+    // ── MCP Servers (B-003 Phase 2) ──
+    // Mutations are Approve tier because an MCP server is effectively arbitrary
+    // code with tool-level access to the agent. Probe is Autonomous — it spawns
+    // a subprocess / opens an outbound HTTP call to the server the user just
+    // configured, but it does not commit any agent-visible state until the
+    // enable flip (which is Approve).
+    "GET /api/mcp/servers": RiskTier.ReadSensitive,
+    "GET /api/mcp/servers/": RiskTier.ReadSensitive,
+    "POST /api/mcp/servers": RiskTier.Approve,
+    "PATCH /api/mcp/servers/": RiskTier.Approve,
+    "DELETE /api/mcp/servers/": RiskTier.Approve,
+    "POST /api/mcp/servers/{*}/probe": RiskTier.Autonomous,
+    "POST /api/mcp/servers/{*}/enable": RiskTier.Approve,
+    "POST /api/mcp/servers/{*}/disable": RiskTier.Autonomous,
+    "PUT /api/mcp/servers/{*}/secrets/": RiskTier.Approve,
+    "DELETE /api/mcp/servers/{*}/secrets/": RiskTier.Approve,
+    // Phase 3 kill switch — Autonomous. Contracts tool surface; per-server
+    // enable (which expands surface) stays Approve.
+    "POST /api/mcp/disable-all": RiskTier.Autonomous,
+    // Gemini-side MCP installer — shells out to `gemini extensions install`
+    // / `gemini mcp add`, modifying ~/.gemini/* config and potentially
+    // launching an OAuth browser flow. Approve tier matches the per-server
+    // mutation routes above: an MCP install expands the agent's tool
+    // surface and the install URL is a trust delegation to a third-party
+    // GitHub release / hosted MCP server.
+    "POST /api/mcp/gemini-install": RiskTier.Approve,
+    // ── Backends / Auth Recovery ──
+    // Dashboard-initiated. Reads are Approve (contain auth status detail).
+    // Recovery writes are Approve (credential file writes).
+    "GET /api/backends": RiskTier.Approve,
+    "POST /api/backends/": RiskTier.Approve,
+    "PUT /api/backends/main": RiskTier.Approve,
+    // Provider API key configuration (ANTHROPIC_API_KEY / OPENAI_API_KEY /
+    // GEMINI_API_KEY+GOOGLE_API_KEY). Approve tier across the board:
+    //  - GET returns whether a key is configured + which env source — sensitive
+    //    metadata that reveals the operator's auth posture.
+    //  - PUT writes a provider credential to the OS keychain and mirrors it
+    //    into process.env, redirecting every subsequent agent call to that key.
+    //  - DELETE removes the key, restoring the captured shell-set value (if
+    //    any) or falling back to CLI/OAuth.
+    "GET /api/backends/{*}/api-key": RiskTier.Approve,
+    "PUT /api/backends/{*}/api-key": RiskTier.Approve,
+    "DELETE /api/backends/{*}/api-key": RiskTier.Approve,
+    // ── Integrations (delegation framework, Phase 1) ──
+    // Dashboard-only mutations — mode changes rewrite `integrations.md` and
+    // (in later phases) stop pollers / gate routes. Approve tier matches
+    // the `/api/backends` profile.
+    "GET /api/integrations": RiskTier.Approve,
+    "PATCH /api/integrations/": RiskTier.Approve,
+    // Phase 2: connector probe endpoint. Approve-tier — the request body
+    // accepts a tool list that bypasses the live MCP enumerator, so a
+    // misuse can falsify the cached features map until the next live probe
+    // overwrites it. Same trust level as the mode flip above.
+    "POST /api/integrations/{*}/probe": RiskTier.Approve,
+    // RESERVED — POST /api/integrations/{*}/invoke
+    //
+    // The route handler is commented out as of 2026-05-01 (/exec-only
+    // migration). Risk-classifier entries are keyed on the route pattern,
+    // and a request to a commented-out route never reaches this map. The
+    // classification is preserved here so a future reactivation lands
+    // back at the same tier without re-deriving it. See the RESERVED
+    // block in `packages/daemon/src/api/routes/integrations.ts` for the
+    // reactivation conditions.
+    //
+    // Original rationale: Autonomous — the agent calls freely from
+    // cross-backend skill prose, and the user's `deniedTools` setting is
+    // the chokepoint enforced inside the handler. Approve is reserved
+    // for daemon-config posture changes (§4.5.2); tool-level safety
+    // stays at the deny list.
+    // "POST /api/integrations/{*}/invoke": RiskTier.Autonomous,
+    // delegated-sync opt-in surface
+    // (docs/design/appendices/delegated-sync-opt-in.md). Approve tier:
+    // dashboard-only schedule writes that change which background cadences
+    // spend AI tokens. Run Now is the only POST and is also Approve — it
+    // triggers a paid subprocess invocation, never agent-callable.
+    "GET /api/delegated-sync": RiskTier.Approve,
+    "PATCH /api/delegated-sync/cadences/": RiskTier.Approve,
+    "PATCH /api/delegated-sync/active-hours": RiskTier.Approve,
+    "POST /api/delegated-sync/cadences/": RiskTier.Approve,
+    // INTEGRATION-DRIFT-DETECTION-PLAN.md §6.0 — drift-detection chokepoint.
+    // Autonomous: the agent's hourly_check delegated variant POSTs the
+    // result of its connector fetch to compute a structural diff. Defense
+    // layers (window-key allowlist + per-call audit row) live inside the
+    // handler. Daemon-internal callers (CalendarPoller, DelegatedSyncWorker)
+    // call the pure `reconcile()` function directly and bypass this route.
+    "POST /api/integrations/{*}/reconcile": RiskTier.Autonomous,
+    // DELEGATED-TASK-MODE-DESIGN.md §4.1 — Phase 1 task mode for known
+    // integrations. Autonomous, parallel to `/api/integrations/{*}/invoke`
+    // (RPC mode); the per-integration `deniedTools` plus `allowDestructive`
+    // gate enforce the safety floor without bearer auth.
+    "POST /api/integrations/{*}/exec": RiskTier.Autonomous,
+    // DELEGATED-TASK-MODE-DESIGN.md §4.2 — Phase 2 generic task mode for
+    // unregistered MCPs. Approve tier (Bearer required) per the design's
+    // "wider blast radius than /exec" rationale: there is no registered
+    // integration's `deniedTools` to act as a chokepoint, so trust moves
+    // up to dashboard / operator invocation. Diverges from
+    // `/api/integrations/{*}/invoke` (Autonomous) and
+    // `/api/integrations/{*}/exec` (Autonomous), where the integration's
+    // user-curated deny list is the safety floor.
+    "POST /api/delegated/run": RiskTier.Approve,
+    // ── Admin / dashboard surfaces (post-audit baseline 2026-04-29) ──
+    // Until `auditRiskClassifications` landed, every entry below would
+    // fall through to the conservative Approve default. The audit then
+    // surfaced 33 such routes at boot — useful as a one-time triage but
+    // noisy as a recurring warning. Listing each surface explicitly
+    // here pins the audit's fingerprint to "0 unclassified" so a single
+    // future regression (the next `roadmap/id`-style oversight) shows
+    // up as exactly one new line, not buried in a 33-row baseline.
+    //
+    // Every entry is Approve by intent (not by default fallback). None
+    // of these routes are agent-callable: secrets / messaging-pairing /
+    // backend-config / dashboard polling are all Bearer-gated UI or
+    // admin operations.
+    // Snapshot restore — rollback via dashboard.
+    "POST /api/context/restore-snapshot/": RiskTier.Approve,
+    // Catch-all DELETE under /api/context. Retention sweeps for daily/
+    // and weekly/ go through dedicated handlers, not this fallback.
+    "DELETE /api/context/": RiskTier.Approve,
+    // Secrets — never agent-callable. Single prefix per method covers
+    // writes for every platform (slack/telegram/discord/notion/github/
+    // google/{credentials,token}) and the DELETE-by-name path.
+    "PUT /api/secrets/": RiskTier.Approve,
+    "DELETE /api/secrets/": RiskTier.Approve,
+    // Messaging admin — pairing flows, token tests, status. Dashboard
+    // only; agents talk to messaging via internal channel adapters,
+    // never this HTTP surface.
+    "GET /api/messaging/": RiskTier.Approve,
+    "POST /api/messaging/": RiskTier.Approve,
+    // Backends config writes (defaults / advisor pin). The existing
+    // `PUT /api/backends/main` exact entry above documents per-process
+    // bindings; these two cover the remaining global writes.
+    "PUT /api/backends/defaults": RiskTier.Approve,
+    "PUT /api/backends/advisor": RiskTier.Approve,
+    // Process-config — per-ProcessKey backend overrides, dashboard only.
+    "GET /api/process-config": RiskTier.Approve,
+    "PUT /api/process-config/": RiskTier.Approve,
+    // ── Task-flow overrides (P5 git-lifecycle-and-triggers.md) ──
+    // Dashboard-only writes that store free-form prompt prose under
+    // <dataDir>/task-flows/<key>.md. Reads expose the bundled body too —
+    // not a personal-data risk, but Approve-tier matches `/api/triggers`
+    // (dashboard-driven) since the override changes how the agent
+    // dispatches every matching event going forward.
+    "/api/task-flows": RiskTier.Approve,
+    // ── Git accounts (P5 multi-account remotes) ──
+    // Approve tier on every method. PAT writes via PUT carry secrets in
+    // the body; metadata edits change which credential a watched repo
+    // resolves to. Probe is Approve too — it shells out to `gh api user`
+    // which counts against the user's API quota.
+    "/api/git-accounts": RiskTier.Approve,
+    "POST /api/git-accounts/{*}/probe": RiskTier.Approve,
+    // Dashboard polling — Bearer-gated UI surfaces.
+    "GET /api/dashboard/next-check": RiskTier.Approve,
+    // STAGE-C-DM-FRESHNESS-PLAN §Task 4 — DM-freshness aggregate served
+    // to the dashboard's observability panel. Read-only roll-up of
+    // agent_actions; same Bearer-gated tier as other dashboard reads.
+    "GET /api/dashboard/dm-freshness": RiskTier.Approve,
+    // Activity tab read-mirror (Memory → Activity). Dashboard-only — surfaces
+    // the wider activity-source union used by the runner so the UI can flag
+    // recently-stopped tasks whose `_activity/<source>.md` is still on disk
+    // for the 90-day window. Not agent-callable; same Approve tier as the
+    // rest of the dashboard read surfaces.
+    "GET /api/activity-sources": RiskTier.Approve,
+    // Voice transcription opt-in surface (docs/design/appendices/voice-
+    // transcription.md). Both endpoints are owner-only via the dashboard's
+    // Settings → Advanced → Voice Mode card. Status is polled every 2s
+    // while installing; install kicks off the model download, persists
+    // `voiceTranscriptionEnabled=true`, and triggers a daemon self-restart
+    // on success — same blast-radius shape as `/api/setup/*`.
+    "GET /api/voice/status": RiskTier.Approve,
+    "POST /api/voice/install": RiskTier.Approve,
+    // ── Management Registry & Entities (docs/design/21-management-registry-and-entities.md §13.1) ──
+    // The agent registers / modifies / stops managed tasks via curl from
+    // its session workdir; the Notify-tier intent in §13.1 maps onto the
+    // current Autonomous + DM-confirmation pattern (the §13.1 "Notify"
+    // label predates the abolition of a separate Notify tier — see
+    // recurring-schedules' identical Autonomous classification at top of
+    // this file). The destructive-confirmation invariant lives in the
+    // skill prompts (DM before stop), not in HTTP risk tiers.
+    //
+    // Reads are Autonomous because the rendered file content is also
+    // injected into the prompt via policy-files.ts wildcard ref — the
+    // GET surface adds no new disclosure.
+    "GET /api/managed-tasks": RiskTier.Autonomous,
+    "POST /api/managed-tasks": RiskTier.Autonomous,
+    "GET /api/managed-tasks/": RiskTier.Autonomous,
+    "PATCH /api/managed-tasks/": RiskTier.Autonomous,
+    "DELETE /api/managed-tasks/": RiskTier.Autonomous,
+    "POST /api/managed-tasks/{*}/run-now": RiskTier.Autonomous,
+    "POST /api/managed-tasks/{*}/rename-app": RiskTier.Autonomous,
+    "PATCH /api/managed-tasks/{*}/run-result": RiskTier.Autonomous,
+    // Aggregate audit feed for the dashboard's Settings → Management →
+    // History tab. Browser-only — the agent's per-mt history reads through
+    // `GET /api/managed-tasks/:id/runs` (Autonomous, scoped to one row);
+    // this surface returns every `management_task.*` and `sot_binding.*`
+    // row, which is the same disclosure shape as `/api/conversations` and
+    // gets the same Approve tier so Bearer auth is required.
+    "GET /api/management-history": RiskTier.Approve,
+    "GET /api/sot-bindings": RiskTier.Autonomous,
+    "GET /api/sot-bindings/": RiskTier.Autonomous,
+    "PUT /api/sot-bindings": RiskTier.Autonomous,
+    // Entity-mirror lookup contract (§7.6). Mirror rows surface only the
+    // path/title/sources of L2 entity files — the same content the agent
+    // would otherwise read via /api/context/* (already ReadSensitive). The
+    // mirror returns whichever subset of frontmatter the watcher cached, so
+    // we mark it ReadSensitive and require a token, matching /api/context.
+    "GET /api/entities": RiskTier.ReadSensitive,
+    "GET /api/entities/by-path": RiskTier.ReadSensitive,
+    // ── Skill curation (P22 — appendix p22-skill-self-optimization.md) ──
+    // Read endpoints are Autonomous — the optimizer agent is gated by
+    // its own runToken, and the dashboard reads them with the standard
+    // bearer auth. No PII flows through these routes; the payloads are
+    // structural metadata about the agent's own skill files.
+    "GET /api/skill-curation/skills": RiskTier.Autonomous,
+    "GET /api/skill-curation/skills/": RiskTier.Autonomous,
+    "GET /api/skill-curation/signals": RiskTier.Autonomous,
+    "GET /api/skill-curation/knowledge-map": RiskTier.Autonomous,
+    "GET /api/skill-curation/proposals/": RiskTier.Autonomous,
+    // Mutation endpoints are Autonomous — the optimizer agent's runToken
+    // (HMAC, one-time, scoped to a single run) is the auth surface, enforced
+    // inside the route. Per design §2.1 the chokepoint applies every passing
+    // proposal atomically; there are no per-proposal approve/reject/revert
+    // routes. The only roll-back path is the system-driven auto-revert
+    // (`auto-revert.ts`), which never crosses the HTTP boundary.
+    "POST /api/skill-curation/runs": RiskTier.Autonomous,
+    "POST /api/skill-curation/proposals": RiskTier.Autonomous,
+    "POST /api/skill-curation/runs/": RiskTier.Autonomous,
+    // P22 §6.1 — settings + listing surfaces consumed by the dashboard.
+    // GETs are Autonomous (no PII; framework metadata only). PATCH writes the
+    // operator's curation config to runtime_state and re-derives cron — Approve.
+    "GET /api/settings/skill-curation": RiskTier.Autonomous,
+    "PATCH /api/settings/skill-curation": RiskTier.Approve,
+    "GET /api/skill-curation/proposals": RiskTier.Autonomous,
+    "GET /api/skill-curation/runs": RiskTier.Autonomous,
+    // P22 §6.4 — owner-only "Run optimization now" button. Approve tier so
+    // a stolen agent token (e.g. the optimizer's own runToken) cannot bypass
+    // the cadence gate by forging a manual run. Dashboard auth fires from
+    // the bearer token, not the runToken.
+    "POST /api/skill-curation/runs/manual": RiskTier.Approve,
+    // §5.4 orphan-overlay surface — read is Autonomous, discard is Approve
+    // because it deletes a previously-applied overlay file from disk.
+    "GET /api/skill-curation/orphans": RiskTier.Autonomous,
+    "POST /api/skill-curation/orphans/discard": RiskTier.Approve,
+};
+/**
+ * Find an *explicit* risk classification for a (method, path), without
+ * falling back to the default-Approve / default-Autonomous tiers.
+ *
+ * Returns the matched tier when an entry in `API_RISK` covers the route
+ * (via exact, path-only, pattern, or prefix match) and `null` when the
+ * route would only be served by the conservative default.
+ *
+ * Used by both `classifyRisk` (which adds the default fallback) and
+ * `auditRiskClassifications` (which surfaces unclassified routes at boot).
+ *
+ * Lookup order:
+ * 1. Exact match: "METHOD /path" (e.g., "POST /api/calendar/events")
+ * 2. Path-only match: "/path" (e.g., "/api/health")
+ * 3. Pattern match: keys containing `{*}` placeholder — longest literal
+ *    prefix wins ties (multi-account routes like
+ *    `POST /api/mail/{*}/messages/send`)
+ * 4. Prefix match: longest matching `path.startsWith(...)` key
+ */
+export function findExplicitRiskClassification(method, path) {
+    // 1. Exact match with method
+    const methodKey = `${method} ${path}`;
+    if (methodKey in API_RISK)
+        return API_RISK[methodKey];
+    // 2. Path-only match
+    if (path in API_RISK)
+        return API_RISK[path];
+    // 3. Pattern match — `{*}` placeholder matches a single non-empty path
+    //    segment. Longer literal prefix wins ties.
+    const patternCandidates = Object.entries(API_RISK)
+        .filter(([key]) => key.includes("{*}"))
+        .filter(([key]) => {
+        // Every API_RISK key is `METHOD path`; the space-less fallback is defensive.
+        /* c8 ignore start */
+        const keyPath = key.includes(" ") ? key.split(" ")[1] : key;
+        const keyMethod = key.includes(" ") ? key.split(" ")[0] : null;
+        /* c8 ignore stop */
+        if (keyMethod && keyMethod !== method)
+            return false;
+        return matchesPattern(keyPath, path);
+    })
+        .sort((a, b) => literalPrefixLength(b[0]) - literalPrefixLength(a[0]));
+    if (patternCandidates.length > 0)
+        return patternCandidates[0][1];
+    // 4. Prefix match (longest first)
+    const candidates = Object.entries(API_RISK)
+        .filter(([key]) => !key.includes("{*}"))
+        .filter(([key]) => {
+        // Every API_RISK key is `METHOD path`; the space-less fallback is defensive.
+        /* c8 ignore start */
+        const keyPath = key.includes(" ") ? key.split(" ")[1] : key;
+        const keyMethod = key.includes(" ") ? key.split(" ")[0] : null;
+        /* c8 ignore stop */
+        if (keyMethod && keyMethod !== method)
+            return false;
+        return path.startsWith(keyPath);
+    })
+        .sort((a, b) => b[0].length - a[0].length);
+    if (candidates.length > 0)
+        return candidates[0][1];
+    return null;
+}
+/**
+ * Classify the risk tier of an API request.
+ *
+ * Wraps `findExplicitRiskClassification` with the conservative default:
+ * unknown /api/* routes → Approve (fail-closed); other paths → Autonomous.
+ */
+export function classifyRisk(method, path) {
+    const explicit = findExplicitRiskClassification(method, path);
+    if (explicit !== null)
+        return explicit;
+    // Unknown daemon API routes must fail closed so newly-added browser-facing
+    // endpoints do not become anonymously reachable just because API_RISK was
+    // not updated yet.
+    if (path.startsWith("/api/")) {
+        logger.warn({ method, path }, "No risk classification found for /api route, defaulting to Approve");
+        return RiskTier.Approve;
+    }
+    logger.debug({ method, path }, "No risk classification found, defaulting to Autonomous");
+    return RiskTier.Autonomous;
+}
+export function auditRiskClassifications(routes) {
+    const seen = new Set();
+    const unclassified = [];
+    for (const route of routes) {
+        const method = route.method.toUpperCase();
+        // Hono represents catch-all middleware with method "ALL" or "*" — those
+        // are never agent-callable endpoints and don't need a classification.
+        if (method === "ALL" || method === "OPTIONS" || method === "HEAD")
+            continue;
+        if (!route.path.startsWith("/api/") && route.path !== "/api")
+            continue;
+        const dedupKey = `${method} ${route.path}`;
+        if (seen.has(dedupKey))
+            continue;
+        seen.add(dedupKey);
+        // Substitute Hono `:param` segments with a representative literal so
+        // `{*}`-patterned entries in API_RISK match. The matcher's `{*}`
+        // accepts any single non-empty segment, so the substitute value is
+        // arbitrary — `_` keeps audit log lines readable.
+        const normalizedPath = route.path.replace(/:[^/]+/g, "_");
+        if (findExplicitRiskClassification(method, normalizedPath) === null) {
+            unclassified.push({ method, path: route.path });
+        }
+    }
+    return unclassified;
+}
+/** Turn a key path with `{*}` placeholders into a segment regex matcher.
+ *  Each `{*}` matches a single non-empty URL segment (no `/`). Remaining
+ *  trailing path after the last literal segment is allowed — this keeps
+ *  prefix-style keys working, e.g. `/api/mail/{*}/messages/` matches both
+ *  `.../messages/abc` and `.../messages/abc/trash`. */
+function matchesPattern(keyPath, actualPath) {
+    const segments = keyPath.split("/");
+    const actualSegments = actualPath.split("/");
+    if (actualSegments.length < segments.length)
+        return false;
+    // Compare segment-by-segment; `{*}` accepts any single non-empty segment.
+    // Trailing segments in `actualPath` beyond the key length are treated as
+    // a prefix match (keeps `endsWith:"/"` style keys matching).
+    const endsWithSlash = keyPath.endsWith("/");
+    const compareLen = endsWithSlash ? segments.length - 1 : segments.length;
+    if (!endsWithSlash && actualSegments.length !== segments.length)
+        return false;
+    for (let i = 0; i < compareLen; i++) {
+        const s = segments[i];
+        if (s === "{*}") {
+            if (!actualSegments[i] || actualSegments[i].length === 0)
+                return false;
+            continue;
+        }
+        if (s !== actualSegments[i])
+            return false;
+    }
+    return true;
+}
+/** Count characters before the first `{*}` (or whole length if none) —
+ *  used to rank pattern candidates by specificity. Defensive against future
+ *  overlapping `{*}` keys: today no two `{*}` entries in `API_RISK` match
+ *  the same `(method, path)` pair, so the sort comparator never invokes
+ *  this helper. The function exists so the first overlapping pair added
+ *  picks the more specific entry instead of relying on iteration order. */
+/* c8 ignore start */
+function literalPrefixLength(key) {
+    const idx = key.indexOf("{*}");
+    return idx < 0 ? key.length : idx;
+}
+/* c8 ignore stop */
+//# sourceMappingURL=risk-classifier.js.map