@aitne/daemon 0.1.0

package/dist/safety/risk-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/safety/risk-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAN,IAAY,QAUX;AAVD,WAAY,QAAQ;IAClB,4DAA4D;IAC5D,qCAAyB,CAAA;IACzB;;;OAGG;IACH,4CAAgC,CAAA;IAChC,uDAAuD;IACvD,+BAAmB,CAAA;AACrB,CAAC,EAVW,QAAQ,KAAR,QAAQ,QAUnB;AAED;;;;;GAKG;AACH,MAAM,QAAQ,GAA6B;IACzC,2BAA2B;IAC3B,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,yBAAyB;IACzB,aAAa,EAAE,QAAQ,CAAC,UAAU;IAClC,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,oBAAoB,EAAE,QAAQ,CAAC,OAAO;IACtC,eAAe,EAAE,QAAQ,CAAC,UAAU;IACpC,sBAAsB,EAAE,QAAQ,CAAC,UAAU;IAC3C,uBAAuB,EAAE,QAAQ,CAAC,UAAU;IAC5C,iBAAiB,EAAE,QAAQ,CAAC,UAAU;IAEtC,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,8DAA8D;IAC9D,wCAAwC,EAAE,QAAQ,CAAC,UAAU;IAE7D,oDAAoD;IACpD,8BAA8B,EAAE,QAAQ,CAAC,UAAU;IACnD,+BAA+B,EAAE,QAAQ,CAAC,UAAU;IACpD,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,kCAAkC,EAAE,QAAQ,CAAC,UAAU;IAEvD,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,uDAAuD;IACvD,eAAe,EAAE,QAAQ,CAAC,OAAO;IAEjC,kFAAkF;IAClF,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,6DAA6D;IAC7D,+DAA+D;IAC/D,kEAAkE;IAClE,uDAAuD;IACvD,qEAAqE;IACrE,uEAAuE;IACvE,8DAA8D;IAC9D,cAAc;IACd,mBAAmB,EAAE,QAAQ,CAAC,OAAO;IACrC,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,2DAA2D;IAC3D,oEAAoE;IACpE,yCAAyC;IACzC,gDAAgD,EAAE,QAAQ,CAAC,UAAU;IAErE,uCAAuC;IACvC,kFAAkF;IAClF,gFAAgF;IAChF,0EAA0E;IAC1E,8EAA8E;IAC9E,iFAAiF;IACjF,oBAAoB;IACpB,iBAAiB,EAAE,QAAQ,CAAC,UAAU;IACtC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;IACvC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;IACvC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;IAE1C,kDAAkD;IAClD,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,uCAAuC;IACvC,WAAW,EAAE,QAAQ,CAAC,UAAU;IAChC,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,2DAA2D;IAC3D,+CAA+C;IAC/C,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,mEAAmE;IACnE,kEAAkE;IAClE,gEAAgE;IAChE,sBAAsB;IACtB,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAE9C,uCAAuC;IACvC,4EAA4E;IAC5E,oEAAoE;IACpE,sCAAsC,EAAE,QAAQ,CAAC,UAAU;IAC3D,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,qDAAqD;IACrD,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,6BAA6B,EAAE,QAAQ,CAAC,UAAU;IAClD,aAAa,EAAE,QAAQ,CAAC,OAAO;IAC/B,YAAY,EAAE,QAAQ,CAAC,OAAO;IAC9B,mEAAmE;IACnE,sEAAsE;IACtE,+DAA+D;IAC/D,qEAAqE;IACrE,qEAAqE;IACrE,iCAAiC,EAAE,QAAQ,CAAC,OAAO;IACnD,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,mDAAmD;IACnD,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,aAAa,EAAE,QAAQ,CAAC,OAAO;IAC/B,aAAa,EAAE,QAAQ,CAAC,OAAO;IAC/B,oBAAoB,EAAE,QAAQ,CAAC,OAAO;IACtC,2BAA2B,EAAE,QAAQ,CAAC,OAAO;IAC7C,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,WAAW,EAAE,QAAQ,CAAC,OAAO;IAC7B,cAAc,EAAE,QAAQ,CAAC,OAAO;IAChC,WAAW,EAAE,QAAQ,CAAC,OAAO;IAC7B,gBAAgB,EAAE,QAAQ,CAAC,OAAO;IAClC,oBAAoB,EAAE,QAAQ,CAAC,OAAO;IACtC,aAAa,EAAE,QAAQ,CAAC,OAAO;IAC/B,gBAAgB,EAAE,QAAQ,CAAC,OAAO;IAClC,WAAW,EAAE,QAAQ,CAAC,OAAO;IAC7B,eAAe,EAAE,QAAQ,CAAC,OAAO;IACjC,oBAAoB,EAAE,QAAQ,CAAC,OAAO;IACtC,oBAAoB,EAAE,QAAQ,CAAC,OAAO;IACtC,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,yBAAyB,EAAE,QAAQ,CAAC,OAAO;IAC3C,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,sDAAsD;IACtD,wBAAwB,EAAE,QAAQ,CAAC,UAAU;IAE7C,wCAAwC;IACxC,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,+BAA+B,EAAE,QAAQ,CAAC,OAAO;IACjD,mEAAmE;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,iDAAiD;IACjD,qCAAqC,EAAE,QAAQ,CAAC,UAAU;IAE1D,yBAAyB;IACzB,4EAA4E;IAC5E,4DAA4D;IAC5D,kBAAkB,EAAE,QAAQ,CAAC,aAAa;IAC1C,mBAAmB,EAAE,QAAQ,CAAC,UAAU;IACxC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;IAC1C,wBAAwB,EAAE,QAAQ,CAAC,UAAU;IAC7C,0BAA0B,EAAE,QAAQ,CAAC,UAAU;IAC/C,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,6BAA6B,EAAE,QAAQ,CAAC,UAAU;IAClD,kFAAkF;IAClF,wBAAwB,EAAE,QAAQ,CAAC,UAAU;IAC7C,0BAA0B,EAAE,QAAQ,CAAC,UAAU;IAC/C,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,4BAA4B,EAAE,QAAQ,CAAC,UAAU;IACjD,sEAAsE;IACtE,iEAAiE;IACjE,oEAAoE;IACpE,oEAAoE;IACpE,iEAAiE;IACjE,iDAAiD;IACjD,8BAA8B,EAAE,QAAQ,CAAC,UAAU;IACnD,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,6BAA6B,EAAE,QAAQ,CAAC,UAAU;IAClD,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,2EAA2E;IAC3E,yEAAyE;IACzE,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,mEAAmE;IACnE,6DAA6D;IAC7D,4BAA4B,EAAE,QAAQ,CAAC,UAAU;IACjD,8BAA8B,EAAE,QAAQ,CAAC,UAAU;IACnD,+BAA+B,EAAE,QAAQ,CAAC,UAAU;IACpD,kFAAkF;IAClF,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,iEAAiE;IACjE,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,uBAAuB,EAAE,QAAQ,CAAC,aAAa;IAC/C,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,+BAA+B,EAAE,QAAQ,CAAC,UAAU;IACpD,wCAAwC,EAAE,QAAQ,CAAC,UAAU;IAC7D,0CAA0C,EAAE,QAAQ,CAAC,UAAU;IAC/D,gCAAgC,EAAE,QAAQ,CAAC,UAAU;IACrD,kCAAkC,EAAE,QAAQ,CAAC,UAAU;IACvD,uBAAuB,EAAE,QAAQ,CAAC,aAAa;IAC/C,6BAA6B,EAAE,QAAQ,CAAC,UAAU;IAClD,wBAAwB,EAAE,QAAQ,CAAC,UAAU;IAC7C,gCAAgC,EAAE,QAAQ,CAAC,UAAU;IAErD,qBAAqB;IACrB,aAAa,EAAE,QAAQ,CAAC,UAAU;IAElC,+BAA+B;IAC/B,uEAAuE;IACvE,0BAA0B,EAAE,QAAQ,CAAC,aAAa;IAClD,6BAA6B,EAAE,QAAQ,CAAC,aAAa;IACrD,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,4BAA4B,EAAE,QAAQ,CAAC,UAAU;IACjD,6BAA6B,EAAE,QAAQ,CAAC,UAAU;IAClD,6BAA6B,EAAE,QAAQ,CAAC,aAAa;IACrD,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,SAAS;IACT,qCAAqC,EAAE,QAAQ,CAAC,aAAa;IAC7D,kCAAkC,EAAE,QAAQ,CAAC,aAAa;IAE1D,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,uDAAuD;IACvD,gCAAgC,EAAE,QAAQ,CAAC,UAAU;IACrD,gCAAgC,EAAE,QAAQ,CAAC,aAAa;IACxD,mCAAmC,EAAE,QAAQ,CAAC,aAAa;IAC3D,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,kCAAkC,EAAE,QAAQ,CAAC,UAAU;IACvD,mCAAmC,EAAE,QAAQ,CAAC,UAAU;IACxD,mCAAmC,EAAE,QAAQ,CAAC,aAAa;IAC3D,sCAAsC,EAAE,QAAQ,CAAC,OAAO;IACxD,wCAAwC,EAAE,QAAQ,CAAC,OAAO;IAC1D,2CAA2C,EAAE,QAAQ,CAAC,OAAO;IAE7D,uBAAuB,EAAE,QAAQ,CAAC,aAAa;IAC/C,2BAA2B,EAAE,QAAQ,CAAC,aAAa;IACnD,wBAAwB,EAAE,QAAQ,CAAC,aAAa;IAChD,wBAAwB,EAAE,QAAQ,CAAC,aAAa;IAChD,wBAAwB,EAAE,QAAQ,CAAC,UAAU;IAC7C,0BAA0B,EAAE,QAAQ,CAAC,UAAU;IAC/C,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAEhD,8EAA8E;IAC9E,0BAA0B,EAAE,QAAQ,CAAC,UAAU;IAC/C,yBAAyB,EAAE,QAAQ,CAAC,aAAa;IACjD,0BAA0B,EAAE,QAAQ,CAAC,aAAa;IAClD,0BAA0B,EAAE,QAAQ,CAAC,UAAU;IAC/C,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,4BAA4B,EAAE,QAAQ,CAAC,UAAU;IACjD,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAEhD,0EAA0E;IAC1E,yBAAyB,EAAE,QAAQ,CAAC,aAAa;IACjD,2BAA2B,EAAE,QAAQ,CAAC,OAAO;IAC7C,wBAAwB,EAAE,QAAQ,CAAC,aAAa;IAChD,yBAAyB,EAAE,QAAQ,CAAC,OAAO;IAC3C,qCAAqC,EAAE,QAAQ,CAAC,OAAO;IACvD,2BAA2B,EAAE,QAAQ,CAAC,OAAO;IAC7C,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,wEAAwE;IACxE,yEAAyE;IACzE,mEAAmE;IACnE,4CAA4C,EAAE,QAAQ,CAAC,OAAO;IAC9D,4CAA4C,EAAE,QAAQ,CAAC,OAAO;IAC9D,+CAA+C,EAAE,QAAQ,CAAC,OAAO;IACjE,oCAAoC,EAAE,QAAQ,CAAC,OAAO;IACtD,2EAA2E;IAC3E,qDAAqD;IACrD,gDAAgD,EAAE,QAAQ,CAAC,OAAO;IAElE,sEAAsE;IACtE,2EAA2E;IAC3E,+DAA+D;IAC/D,qEAAqE;IACrE,+BAA+B;IAC/B,EAAE;IACF,qEAAqE;IACrE,wEAAwE;IACxE,2EAA2E;IAC3E,uEAAuE;IACvE,sCAAsC;IACtC,gBAAgB,EAAE,QAAQ,CAAC,aAAa;IACxC,sEAAsE;IACtE,qEAAqE;IACrE,sCAAsC;IACtC,sBAAsB,EAAE,QAAQ,CAAC,aAAa;IAC9C,iBAAiB,EAAE,QAAQ,CAAC,UAAU;IACtC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;IACvC,mBAAmB,EAAE,QAAQ,CAAC,UAAU;IACxC,uDAAuD;IACvD,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,6BAA6B,EAAE,QAAQ,CAAC,UAAU;IAClD,8BAA8B,EAAE,QAAQ,CAAC,UAAU;IACnD,iEAAiE;IACjE,sCAAsC,EAAE,QAAQ,CAAC,UAAU;IAC3D,yCAAyC,EAAE,QAAQ,CAAC,UAAU;IAC9D,yCAAyC,EAAE,QAAQ,CAAC,UAAU;IAC9D,sCAAsC,EAAE,QAAQ,CAAC,UAAU;IAC3D,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,uDAAuD;IACvD,kCAAkC,EAAE,QAAQ,CAAC,UAAU;IACvD,uCAAuC,EAAE,QAAQ,CAAC,UAAU;IAC5D,oCAAoC,EAAE,QAAQ,CAAC,UAAU;IAEzD,YAAY;IACZ,cAAc,EAAE,QAAQ,CAAC,UAAU;IACnC,iFAAiF;IACjF,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,gDAAgD;IAChD,2CAA2C;IAC3C,yCAAyC,EAAE,QAAQ,CAAC,UAAU;IAC9D,oBAAoB,EAAE,QAAQ,CAAC,OAAO;IAEtC,eAAe;IACf,iBAAiB,EAAE,QAAQ,CAAC,UAAU;IACtC,gCAAgC,EAAE,QAAQ,CAAC,UAAU;IAErD,kCAAkC;IAClC,0BAA0B,EAAE,QAAQ,CAAC,aAAa;IAClD,2BAA2B,EAAE,QAAQ,CAAC,aAAa;IACnD,mCAAmC,EAAE,QAAQ,CAAC,aAAa;IAC3D,6BAA6B,EAAE,QAAQ,CAAC,OAAO;IAE/C,2BAA2B;IAC3B,mBAAmB,EAAE,QAAQ,CAAC,aAAa;IAC3C,oBAAoB,EAAE,QAAQ,CAAC,aAAa;IAC5C,2BAA2B,EAAE,QAAQ,CAAC,aAAa;IACnD,qBAAqB,EAAE,QAAQ,CAAC,aAAa,EAAE,0BAA0B;IACzE,sBAAsB,EAAE,QAAQ,CAAC,OAAO;IAExC,8BAA8B;IAC9B,sBAAsB,EAAE,QAAQ,CAAC,UAAU;IAC3C,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IAEtD,wCAAwC;IACxC,gBAAgB,EAAE,QAAQ,CAAC,aAAa;IACxC,iBAAiB,EAAE,QAAQ,CAAC,aAAa;IACzC,wBAAwB,EAAE,QAAQ,CAAC,aAAa;IAChD,mBAAmB,EAAE,QAAQ,CAAC,OAAO,EAAiB,mBAAmB;IACzE,kCAAkC,EAAE,QAAQ,CAAC,UAAU,EAAG,kBAAkB;IAC5E,sCAAsC,EAAE,QAAQ,CAAC,UAAU,EAAE,sCAAsC;IAEnG,oCAAoC;IACpC,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,kCAAkC;IAClC,sBAAsB,EAAE,QAAQ,CAAC,aAAa;IAC9C,uBAAuB,EAAE,QAAQ,CAAC,aAAa;IAC/C,uBAAuB,EAAE,QAAQ,CAAC,OAAO;IACzC,yBAAyB,EAAE,QAAQ,CAAC,OAAO;IAC3C,0BAA0B,EAAE,QAAQ,CAAC,OAAO;IAC5C,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,kCAAkC,EAAE,QAAQ,CAAC,OAAO;IACpD,mCAAmC,EAAE,QAAQ,CAAC,UAAU;IACxD,mCAAmC,EAAE,QAAQ,CAAC,OAAO;IACrD,sCAAsC,EAAE,QAAQ,CAAC,OAAO;IACxD,uEAAuE;IACvE,gDAAgD;IAChD,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,wEAAwE;IACxE,mEAAmE;IACnE,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,sCAAsC;IACtC,8BAA8B,EAAE,QAAQ,CAAC,OAAO;IAEhD,iCAAiC;IACjC,uEAAuE;IACvE,wDAAwD;IACxD,mBAAmB,EAAE,QAAQ,CAAC,OAAO;IACrC,qBAAqB,EAAE,QAAQ,CAAC,OAAO;IACvC,wBAAwB,EAAE,QAAQ,CAAC,OAAO;IAC1C,uEAAuE;IACvE,iEAAiE;IACjE,4EAA4E;IAC5E,wDAAwD;IACxD,wEAAwE;IACxE,4EAA4E;IAC5E,wEAAwE;IACxE,wCAAwC;IACxC,+BAA+B,EAAE,QAAQ,CAAC,OAAO;IACjD,+BAA+B,EAAE,QAAQ,CAAC,OAAO;IACjD,kCAAkC,EAAE,QAAQ,CAAC,OAAO;IAEpD,qDAAqD;IACrD,wEAAwE;IACxE,qEAAqE;IACrE,+BAA+B;IAC/B,uBAAuB,EAAE,QAAQ,CAAC,OAAO;IACzC,0BAA0B,EAAE,QAAQ,CAAC,OAAO;IAC5C,qEAAqE;IACrE,kEAAkE;IAClE,uEAAuE;IACvE,0DAA0D;IAC1D,kCAAkC,EAAE,QAAQ,CAAC,OAAO;IACpD,+CAA+C;IAC/C,EAAE;IACF,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,oEAAoE;IACpE,2BAA2B;IAC3B,EAAE;IACF,+DAA+D;IAC/D,qEAAqE;IACrE,kEAAkE;IAClE,gEAAgE;IAChE,0BAA0B;IAC1B,4DAA4D;IAC5D,gCAAgC;IAChC,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,+DAA+D;IAC/D,yBAAyB,EAAE,QAAQ,CAAC,OAAO;IAC3C,qCAAqC,EAAE,QAAQ,CAAC,OAAO;IACvD,wCAAwC,EAAE,QAAQ,CAAC,OAAO;IAC1D,oCAAoC,EAAE,QAAQ,CAAC,OAAO;IAEtD,yEAAyE;IACzE,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,sCAAsC,EAAE,QAAQ,CAAC,UAAU;IAE3D,mEAAmE;IACnE,uEAAuE;IACvE,wEAAwE;IACxE,qDAAqD;IACrD,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,uDAAuD;IACvD,kDAAkD;IAClD,qEAAqE;IACrE,8CAA8C;IAC9C,yBAAyB,EAAE,QAAQ,CAAC,OAAO;IAE3C,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,oEAAoE;IACpE,gEAAgE;IAChE,oEAAoE;IACpE,kEAAkE;IAClE,+DAA+D;IAC/D,EAAE;IACF,mEAAmE;IACnE,oEAAoE;IACpE,gEAAgE;IAChE,oBAAoB;IAEpB,6CAA6C;IAC7C,qCAAqC,EAAE,QAAQ,CAAC,OAAO;IACvD,mEAAmE;IACnE,gEAAgE;IAChE,sBAAsB,EAAE,QAAQ,CAAC,OAAO;IAExC,kEAAkE;IAClE,mEAAmE;IACnE,2DAA2D;IAC3D,mBAAmB,EAAE,QAAQ,CAAC,OAAO;IACrC,sBAAsB,EAAE,QAAQ,CAAC,OAAO;IAExC,kEAAkE;IAClE,gEAAgE;IAChE,2BAA2B;IAC3B,qBAAqB,EAAE,QAAQ,CAAC,OAAO;IACvC,sBAAsB,EAAE,QAAQ,CAAC,OAAO;IAExC,gEAAgE;IAChE,mEAAmE;IACnE,yDAAyD;IACzD,4BAA4B,EAAE,QAAQ,CAAC,OAAO;IAC9C,2BAA2B,EAAE,QAAQ,CAAC,OAAO;IAE7C,qEAAqE;IACrE,yBAAyB,EAAE,QAAQ,CAAC,OAAO;IAC3C,0BAA0B,EAAE,QAAQ,CAAC,OAAO;IAE5C,+DAA+D;IAC/D,gEAAgE;IAChE,qEAAqE;IACrE,qEAAqE;IACrE,8DAA8D;IAC9D,iDAAiD;IACjD,iBAAiB,EAAE,QAAQ,CAAC,OAAO;IAEnC,gDAAgD;IAChD,oEAAoE;IACpE,kEAAkE;IAClE,qEAAqE;IACrE,6CAA6C;IAC7C,mBAAmB,EAAE,QAAQ,CAAC,OAAO;IACrC,kCAAkC,EAAE,QAAQ,CAAC,OAAO;IAEpD,gDAAgD;IAChD,+BAA+B,EAAE,QAAQ,CAAC,OAAO;IACjD,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,iCAAiC,EAAE,QAAQ,CAAC,OAAO;IAEnD,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,uCAAuC;IACvC,2BAA2B,EAAE,QAAQ,CAAC,OAAO;IAE7C,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,0DAA0D;IAC1D,uBAAuB,EAAE,QAAQ,CAAC,OAAO;IACzC,yBAAyB,EAAE,QAAQ,CAAC,OAAO;IAE3C,kGAAkG;IAClG,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,+DAA+D;IAC/D,qEAAqE;IACrE,kEAAkE;IAClE,0DAA0D;IAC1D,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,sCAAsC;IACtC,wBAAwB,EAAE,QAAQ,CAAC,UAAU;IAC7C,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,yBAAyB,EAAE,QAAQ,CAAC,UAAU;IAC9C,2BAA2B,EAAE,QAAQ,CAAC,UAAU;IAChD,4BAA4B,EAAE,QAAQ,CAAC,UAAU;IACjD,qCAAqC,EAAE,QAAQ,CAAC,UAAU;IAC1D,wCAAwC,EAAE,QAAQ,CAAC,UAAU;IAC7D,yCAAyC,EAAE,QAAQ,CAAC,UAAU;IAC9D,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,qEAAqE;IACrE,sEAAsE;IACtE,yDAAyD;IACzD,6BAA6B,EAAE,QAAQ,CAAC,OAAO;IAE/C,uBAAuB,EAAE,QAAQ,CAAC,UAAU;IAC5C,wBAAwB,EAAE,QAAQ,CAAC,UAAU;IAC7C,uBAAuB,EAAE,QAAQ,CAAC,UAAU;IAE5C,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,mBAAmB,EAAE,QAAQ,CAAC,aAAa;IAC3C,2BAA2B,EAAE,QAAQ,CAAC,aAAa;IAEnD,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,yDAAyD;IACzD,gCAAgC,EAAE,QAAQ,CAAC,UAAU;IACrD,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,uCAAuC,EAAE,QAAQ,CAAC,UAAU;IAC5D,oCAAoC,EAAE,QAAQ,CAAC,UAAU;IACzD,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,6DAA6D;IAC7D,+BAA+B,EAAE,QAAQ,CAAC,UAAU;IACpD,oCAAoC,EAAE,QAAQ,CAAC,UAAU;IACzD,gCAAgC,EAAE,QAAQ,CAAC,UAAU;IACrD,oEAAoE;IACpE,0EAA0E;IAC1E,6EAA6E;IAC7E,kCAAkC,EAAE,QAAQ,CAAC,UAAU;IACvD,oCAAoC,EAAE,QAAQ,CAAC,OAAO;IACtD,mCAAmC,EAAE,QAAQ,CAAC,UAAU;IACxD,8BAA8B,EAAE,QAAQ,CAAC,UAAU;IACnD,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,sCAAsC;IACtC,sCAAsC,EAAE,QAAQ,CAAC,OAAO;IACxD,uEAAuE;IACvE,kEAAkE;IAClE,iCAAiC,EAAE,QAAQ,CAAC,UAAU;IACtD,0CAA0C,EAAE,QAAQ,CAAC,OAAO;CAE7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAc,EACd,IAAY;IAEZ,6BAA6B;IAC7B,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,SAAS,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEtD,qBAAqB;IACrB,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE5C,uEAAuE;IACvE,+CAA+C;IAC/C,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QAChB,6EAA6E;QAC7E,qBAAqB;QACrB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,oBAAoB;QACpB,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjE,kCAAkC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QAChB,6EAA6E;QAC7E,qBAAqB;QACrB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,oBAAoB;QACpB,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvC,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,IAAI,EAAE,EAChB,oEAAoE,CACrE,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,wDAAwD,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,UAAU,CAAC;AAC7B,CAAC;AAuBD,MAAM,UAAU,wBAAwB,CACtC,MAAqC;IAErC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAqB,EAAE,CAAC;IAE1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS;QAC5E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAEvE,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnB,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,8BAA8B,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;uDAIuD;AACvD,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,cAAc,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACzE,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;2EAK2E;AAC3E,qBAAqB;AACrB,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC;AACD,oBAAoB"}

package/dist/scheduler/hourly-check-gate.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Stage-1 deterministic gate for the three-stage hourly_check funnel
+ * (cost-reduction-structural §B). Pure function over a `HourlyCheckSignals`
+ * snapshot — no DB handle, no clock, no I/O. The dispatcher computes the
+ * snapshot via `computeHourlyCheckSignals`, then asks this module which
+ * stage to enter.
+ *
+ * The four possible decisions:
+ *   - `stage0_silent`: consume observations, append a single Agent Log
+ *     line via the daemon-direct writer, return. No LLM call.
+ *   - `stage2`: lite-tier triage (only when `stage2Enabled`). Strict
+ *     JSON-only output decides log_only vs escalate.
+ *   - `stage3`: existing full hourly_check session.
+ *
+ * Shadow mode is enforced one layer up by the dispatcher — this gate
+ * always returns the canonical decision, and the dispatcher decides
+ * whether to honour it or proceed straight to Stage 3 with the gate
+ * verdict logged for telemetry.
+ */
+import type { HourlyCheckSignals } from "../db/hourly-check-signals.js";
+export type HourlyCheckGateStage = "stage0_silent" | "stage2" | "stage3";
+export interface HourlyCheckGateConfig {
+    /**
+     * Hours since the last Stage 3 run after which the gate force-runs at
+     * least Stage 2 (or Stage 3 if novelty is high). Bounds the worst case
+     * where Stage 0/1 keeps short-circuiting on a quiet day.
+     */
+    heartbeatHours: number;
+    /**
+     * When `false`, low-signal cases bypass Stage 2 entirely and route to
+     * Stage 3. The cautious default — Stage 2 only takes effect after
+     * shadow telemetry validates the decision boundary.
+     */
+    stage2Enabled: boolean;
+    /**
+     * Below this threshold, `pendingObsCount` alone does not imply
+     * Stage 3. Default 0 — any pending observation hits the low-signal
+     * branch which routes to Stage 2 or Stage 3 depending on the flag.
+     */
+    pendingObsLowSignalCeiling?: number;
+}
+export interface HourlyCheckGateDecision {
+    stage: HourlyCheckGateStage;
+    /** Short, telemetry-friendly explanation. */
+    reason: string;
+    /** Snapshot at decision time (echoed for the audit row). */
+    signals: HourlyCheckSignals;
+}
+export declare function decideStage(signals: HourlyCheckSignals, config: HourlyCheckGateConfig): HourlyCheckGateDecision;
+/**
+ * The dispatcher logs every cron tick to `agent_actions` regardless of
+ * which stage runs. Helper that builds the JSON payload from a decision
+ * so the schema stays consistent across stages and call-sites.
+ */
+export declare function buildGateAuditDetail(decision: HourlyCheckGateDecision, extra: {
+    mode: HourlyCheckGateMode;
+    /** Whether the gate's verdict was honoured (live) or shadowed. */
+    appliedDecision: HourlyCheckGateStage | "stage3_shadow";
+    /** Stage-2 LLM verdict, when Stage 2 ran. */
+    stage2Verdict?: "log_only" | "escalate" | "failed";
+    /** Forced-run flag from `/api/agent/run-now` etc. */
+    forced?: boolean;
+}): Record<string, unknown>;
+/**
+ * Build the `<gate_decision>` block injected into Stage 3's prompt so
+ * the routine knows *why* it was escalated and can prioritize.
+ */
+export declare function renderGateDecisionBlock(decision: HourlyCheckGateDecision, extra: {
+    mode: HourlyCheckGateMode;
+    forced?: boolean;
+}): string;
+export type HourlyCheckGateMode = "off" | "shadow" | "live";
+//# sourceMappingURL=hourly-check-gate.d.ts.map

package/dist/scheduler/hourly-check-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hourly-check-gate.d.ts","sourceRoot":"","sources":["../../src/scheduler/hourly-check-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEzE,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAKD,wBAAgB,WAAW,CACzB,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,qBAAqB,GAC5B,uBAAuB,CAyDzB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE;IACL,IAAI,EAAE,mBAAmB,CAAC;IAC1B,kEAAkE;IAClE,eAAe,EAAE,oBAAoB,GAAG,eAAe,CAAC;IACxD,6CAA6C;IAC7C,aAAa,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACnD,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GACA,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACrD,MAAM,CAiBR;AAED,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC"}

package/dist/scheduler/hourly-check-gate.js

@@ -0,0 +1,128 @@
+/**
+ * Stage-1 deterministic gate for the three-stage hourly_check funnel
+ * (cost-reduction-structural §B). Pure function over a `HourlyCheckSignals`
+ * snapshot — no DB handle, no clock, no I/O. The dispatcher computes the
+ * snapshot via `computeHourlyCheckSignals`, then asks this module which
+ * stage to enter.
+ *
+ * The four possible decisions:
+ *   - `stage0_silent`: consume observations, append a single Agent Log
+ *     line via the daemon-direct writer, return. No LLM call.
+ *   - `stage2`: lite-tier triage (only when `stage2Enabled`). Strict
+ *     JSON-only output decides log_only vs escalate.
+ *   - `stage3`: existing full hourly_check session.
+ *
+ * Shadow mode is enforced one layer up by the dispatcher — this gate
+ * always returns the canonical decision, and the dispatcher decides
+ * whether to honour it or proceed straight to Stage 3 with the gate
+ * verdict logged for telemetry.
+ */
+const HIGH_NOVELTY_FLOOR = 3;
+const ESCALATE_NOVELTY_FLOOR = 2;
+export function decideStage(signals, config) {
+    // Heartbeat: even on quiet days, exercise Stage 2/3 every N hours so
+    // the gate's signal compute is exercised end-to-end. We pick Stage 3
+    // when there is *some* novelty pending, Stage 2 otherwise — Stage 2
+    // is the cheaper lite-tier shape and Stage 3 wastes context if there
+    // is nothing to act on. If Stage 2 is disabled, the cautious fallback
+    // is Stage 3.
+    if (signals.hoursSinceLastStage3Run >= config.heartbeatHours) {
+        if (numericNovelty(signals.maxNoveltyScore) >= ESCALATE_NOVELTY_FLOOR) {
+            return decision("stage3", "heartbeat_due_with_novelty", signals);
+        }
+        return decision(config.stage2Enabled ? "stage2" : "stage3", "heartbeat_due", signals);
+    }
+    // Hard escalate: any high-priority signal goes straight to Stage 3.
+    if (numericNovelty(signals.maxNoveltyScore) >= HIGH_NOVELTY_FLOOR) {
+        return decision("stage3", "high_novelty", signals);
+    }
+    if (signals.calendarHasConflict) {
+        return decision("stage3", "calendar_conflict", signals);
+    }
+    if (signals.vipMailUnreadCount > 0) {
+        return decision("stage3", "vip_mail_unread", signals);
+    }
+    if (signals.agentPlanOverdueCount > 0) {
+        return decision("stage3", "agent_plan_overdue", signals);
+    }
+    if (signals.scheduleApproachingCount > 0) {
+        return decision("stage3", "schedule_approaching", signals);
+    }
+    // No signals at all → Stage 0 silent.
+    if (signals.pendingObsCount === 0 && !signals.calendarHas24hChange) {
+        return decision("stage0_silent", "no_signals", signals);
+    }
+    // Low signals only → Stage 2 if enabled, else Stage 3 (cautious default).
+    // The pendingObsLowSignalCeiling lets an operator widen the silent-skip
+    // band ("at most N noise observations is still nothing to act on"); the
+    // default 0 leaves the design's conservative posture intact.
+    const ceiling = Math.max(0, config.pendingObsLowSignalCeiling ?? 0);
+    if (signals.pendingObsCount <= ceiling
+        && !signals.calendarHas24hChange) {
+        return decision("stage0_silent", "low_signal_under_ceiling", signals);
+    }
+    return decision(config.stage2Enabled ? "stage2" : "stage3", "low_signal_default", signals);
+}
+/**
+ * The dispatcher logs every cron tick to `agent_actions` regardless of
+ * which stage runs. Helper that builds the JSON payload from a decision
+ * so the schema stays consistent across stages and call-sites.
+ */
+export function buildGateAuditDetail(decision, extra) {
+    return {
+        stage_reached: extra.appliedDecision,
+        gate_stage: decision.stage,
+        gate_reason: decision.reason,
+        mode: extra.mode,
+        forced: extra.forced ?? false,
+        ...(extra.stage2Verdict ? { stage2_verdict: extra.stage2Verdict } : {}),
+        signal_snapshot: {
+            pendingObsCount: decision.signals.pendingObsCount,
+            maxNoveltyScore: decision.signals.maxNoveltyScore,
+            noveltyDistribution: decision.signals.noveltyDistribution,
+            vipMailUnreadCount: decision.signals.vipMailUnreadCount,
+            calendarHas24hChange: decision.signals.calendarHas24hChange,
+            calendarHasConflict: decision.signals.calendarHasConflict,
+            agentPlanOverdueCount: decision.signals.agentPlanOverdueCount,
+            scheduleApproachingCount: decision.signals.scheduleApproachingCount,
+            hoursSinceLastStage3Run: serializeHours(decision.signals.hoursSinceLastStage3Run),
+        },
+    };
+}
+/**
+ * Build the `<gate_decision>` block injected into Stage 3's prompt so
+ * the routine knows *why* it was escalated and can prioritize.
+ */
+export function renderGateDecisionBlock(decision, extra) {
+    return [
+        "<gate_decision>",
+        `  triggered_by: ${decision.stage === "stage3" ? "stage1" : "stage2_escalation"}`,
+        `  reason: ${decision.reason}`,
+        `  mode: ${extra.mode}`,
+        `  forced: ${extra.forced ? "true" : "false"}`,
+        `  signals_snapshot: ${JSON.stringify({
+            maxNovelty: decision.signals.maxNoveltyScore,
+            pendingObs: decision.signals.pendingObsCount,
+            vipMail: decision.signals.vipMailUnreadCount,
+            calConflict: decision.signals.calendarHasConflict,
+            agentPlanOverdue: decision.signals.agentPlanOverdueCount,
+            scheduleApproaching: decision.signals.scheduleApproachingCount,
+        })}`,
+        "</gate_decision>",
+    ].join("\n");
+}
+function numericNovelty(score) {
+    // Cautious default — null (no summary done yet) is treated as 2 so a
+    // backlog of unsummarized observations does NOT silently skip the
+    // routine. The design doc calls this out explicitly under "edge cases".
+    return score ?? ESCALATE_NOVELTY_FLOOR;
+}
+function decision(stage, reason, signals) {
+    return { stage, reason, signals };
+}
+function serializeHours(value) {
+    if (!Number.isFinite(value))
+        return null;
+    return Number(value.toFixed(2));
+}
+//# sourceMappingURL=hourly-check-gate.js.map

package/dist/scheduler/hourly-check-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hourly-check-gate.js","sourceRoot":"","sources":["../../src/scheduler/hourly-check-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAmCH,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,UAAU,WAAW,CACzB,OAA2B,EAC3B,MAA6B;IAE7B,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,sEAAsE;IACtE,cAAc;IACd,IAAI,OAAO,CAAC,uBAAuB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC7D,IAAI,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,sBAAsB,EAAE,CAAC;YACtE,OAAO,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,QAAQ,CACb,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC1C,eAAe,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAClE,OAAO,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,wBAAwB,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACnE,OAAO,QAAQ,CAAC,eAAe,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,0BAA0B,IAAI,CAAC,CAAC,CAAC;IACpE,IACE,OAAO,CAAC,eAAe,IAAI,OAAO;WAC/B,CAAC,OAAO,CAAC,oBAAoB,EAChC,CAAC;QACD,OAAO,QAAQ,CAAC,eAAe,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,QAAQ,CACb,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC1C,oBAAoB,EACpB,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAiC,EACjC,KAQC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,eAAe;QACpC,UAAU,EAAE,QAAQ,CAAC,KAAK;QAC1B,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK;QAC7B,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,eAAe,EAAE;YACf,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe;YACjD,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe;YACjD,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB;YACzD,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB;YACvD,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,oBAAoB;YAC3D,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB;YACzD,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,qBAAqB;YAC7D,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,wBAAwB;YACnE,uBAAuB,EAAE,cAAc,CACrC,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CACzC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAiC,EACjC,KAAsD;IAEtD,OAAO;QACL,iBAAiB;QACjB,mBAAmB,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,EAAE;QACjF,aAAa,QAAQ,CAAC,MAAM,EAAE;QAC9B,WAAW,KAAK,CAAC,IAAI,EAAE;QACvB,aAAa,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAC9C,uBAAuB,IAAI,CAAC,SAAS,CAAC;YACpC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe;YAC5C,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe;YAC5C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB;YAC5C,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB;YACjD,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,qBAAqB;YACxD,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,wBAAwB;SAC/D,CAAC,EAAE;QACJ,kBAAkB;KACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAID,SAAS,cAAc,CAAC,KAAoB;IAC1C,qEAAqE;IACrE,kEAAkE;IAClE,wEAAwE;IACxE,OAAO,KAAK,IAAI,sBAAsB,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CACf,KAA2B,EAC3B,MAAc,EACd,OAA2B;IAE3B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/secrets/backend-api-key-env.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Mirrors keychain-stored backend auth into `process.env` so the existing
+ * Claude SDK / Codex CLI / Gemini CLI subprocesses pick it up without
+ * per-spawn-site refactoring. Both direct API keys (Anthropic / OpenAI /
+ * Google) and Claude's cloud-provider modes (Bedrock / Vertex / Foundry)
+ * flow through this single chokepoint — see
+ * `@aitne/shared/backend-api-key-config` for the typed config.
+ *
+ * **Precedence** (highest first):
+ *   1. Keychain (set via the dashboard API)
+ *   2. Original shell env captured at daemon startup
+ *   3. CLI login / OAuth (the SDK/CLI's native auth, used when neither of
+ *      the above is set)
+ *
+ * The "original shell env" snapshot is captured *before* the first sync
+ * for the **superset** of env vars any provider could set, so a UI-driven
+ * clear (DELETE /backends/:id/api-key) or a provider switch (e.g.
+ * Anthropic → Bedrock) can restore the operator's shell-set values
+ * byte-for-byte instead of blanket-deleting them. This keeps
+ * `aitne start && export ANTHROPIC_API_KEY=...` workflows intact.
+ */
+import { type ApiKeyProvider, type BackendId } from "@aitne/shared";
+import type { SecretBroker } from "./secret-broker.js";
+/**
+ * Env vars each backend's **direct API key** mode uses, exposed for
+ * backwards-compatible tests / status helpers that want the legacy
+ * "primary env var name" view. The full superset for env mirroring is
+ * exposed via `getManagedApiKeyEnvVars` (in @aitne/shared).
+ */
+export declare const BACKEND_API_KEY_ENV_VARS: Record<BackendId, readonly string[]>;
+/** The value source actually in effect after a sync call. */
+export type ApiKeySource = "keychain" | "shell" | "none";
+export interface BackendApiKeySyncResult {
+    source: ApiKeySource;
+    /** Active provider when source==='keychain'. Null otherwise. */
+    provider: ApiKeyProvider | null;
+    /** True when the sync changed `process.env` for this backend. */
+    changed: boolean;
+}
+/**
+ * Capture the current `process.env` values for every backend's full
+ * managed env-var set (across all providers). MUST be called once at
+ * daemon startup, *before* the first `syncBackendApiKeyToEnv` call, so
+ * the snapshot reflects what the operator set in their shell rather than
+ * what we mirrored from keychain.
+ *
+ * Idempotent — repeated calls overwrite the snapshot with the current
+ * env. Tests rely on this to reset between cases.
+ */
+export declare function captureOriginalShellEnv(env?: NodeJS.ProcessEnv): void;
+/**
+ * Resolve the effective auth config for a backend (keychain > shell >
+ * none) and mirror it into `process.env`. Call this at startup once for
+ * each backend, and again after every UI mutation (PUT/DELETE
+ * /backends/:id/api-key).
+ *
+ * Per-env-var semantics (matters for cloud providers, where switching
+ * Anthropic → Bedrock means clearing `ANTHROPIC_API_KEY` and setting
+ * `CLAUDE_CODE_USE_BEDROCK=1` + AWS_*):
+ *  - **Keychain set**: every env var the active provider needs is set
+ *    to the stored value. Every other env var in the managed superset
+ *    is restored to its captured shell value (or deleted when the
+ *    operator never exported it). This isolates the active provider
+ *    from stale env from a previous provider — the keychain is the
+ *    single source of truth.
+ *  - **Falling back to shell**: every env var in the managed superset
+ *    is restored to *exactly* what the operator originally set
+ *    (including `undefined` for vars they did not export). This avoids
+ *    silently introducing env vars the user never set — preserving the
+ *    pre-feature behaviour byte-for-byte.
+ *  - **Nothing configured**: every env var in the managed superset is
+ *    deleted (so the cores fall through to their CLI login / OAuth
+ *    branch).
+ *
+ * Returns the resolved source so the caller can log without leaking the
+ * value itself.
+ */
+export interface SyncBackendApiKeyOptions {
+    /**
+     * Daemon data directory. Required when the Codex backend uses the
+     * `azure-openai` provider — the daemon writes a managed `config.toml`
+     * to `<dataDir>/codex-home/` and points `CODEX_HOME` there. Pass
+     * `null` (the default) when the caller hasn't wired it through; in
+     * that case Azure config materialization is skipped and a warning is
+     * logged so the operator can correct the wiring without crashing.
+     */
+    dataDir?: string | null;
+}
+export declare function syncBackendApiKeyToEnv(broker: SecretBroker, backendId: BackendId, env?: NodeJS.ProcessEnv, opts?: SyncBackendApiKeyOptions): Promise<BackendApiKeySyncResult>;
+/**
+ * Read-only inspector — reports whether a value is currently effective in
+ * `process.env`, which source it came from, the active provider (when
+ * keychain), and the env var names the source populates. Used by the
+ * GET /backends/:id/api-key route so the dashboard can render
+ * "configured (keychain, bedrock)" / "configured (shell)" / "not
+ * configured" without ever returning the secret value itself.
+ */
+export declare function describeBackendApiKey(broker: SecretBroker, backendId: BackendId, env?: NodeJS.ProcessEnv): Promise<{
+    configured: boolean;
+    source: ApiKeySource;
+    provider: ApiKeyProvider | null;
+    envVarNames: readonly string[];
+}>;
+//# sourceMappingURL=backend-api-key-env.d.ts.map

package/dist/secrets/backend-api-key-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-api-key-env.d.ts","sourceRoot":"","sources":["../../src/secrets/backend-api-key-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAIL,KAAK,cAAc,EAEnB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAIzE,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAEzD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,YAAY,CAAC;IACrB,gEAAgE;IAChE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;CAClB;AAcD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,IAAI,CASN;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CA+DlC;AAiBD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC;IACT,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,CAAC,CA2BD"}

package/dist/secrets/backend-api-key-env.js

@@ -0,0 +1,197 @@
+/**
+ * Mirrors keychain-stored backend auth into `process.env` so the existing
+ * Claude SDK / Codex CLI / Gemini CLI subprocesses pick it up without
+ * per-spawn-site refactoring. Both direct API keys (Anthropic / OpenAI /
+ * Google) and Claude's cloud-provider modes (Bedrock / Vertex / Foundry)
+ * flow through this single chokepoint — see
+ * `@aitne/shared/backend-api-key-config` for the typed config.
+ *
+ * **Precedence** (highest first):
+ *   1. Keychain (set via the dashboard API)
+ *   2. Original shell env captured at daemon startup
+ *   3. CLI login / OAuth (the SDK/CLI's native auth, used when neither of
+ *      the above is set)
+ *
+ * The "original shell env" snapshot is captured *before* the first sync
+ * for the **superset** of env vars any provider could set, so a UI-driven
+ * clear (DELETE /backends/:id/api-key) or a provider switch (e.g.
+ * Anthropic → Bedrock) can restore the operator's shell-set values
+ * byte-for-byte instead of blanket-deleting them. This keeps
+ * `aitne start && export ANTHROPIC_API_KEY=...` workflows intact.
+ */
+import { BACKEND_IDS, getApiKeyEnvAssignments, getManagedApiKeyEnvVars, } from "@aitne/shared";
+import { clearCodexAzureConfig, materializeCodexAzureConfig, } from "./codex-home-materializer.js";
+/**
+ * Env vars each backend's **direct API key** mode uses, exposed for
+ * backwards-compatible tests / status helpers that want the legacy
+ * "primary env var name" view. The full superset for env mirroring is
+ * exposed via `getManagedApiKeyEnvVars` (in @aitne/shared).
+ */
+export const BACKEND_API_KEY_ENV_VARS = {
+    claude: ["ANTHROPIC_API_KEY"],
+    codex: ["OPENAI_API_KEY"],
+    gemini: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+};
+/**
+ * Per-backend snapshot of the original shell-set env values, captured
+ * before any keychain mirroring. Used to restore the shell value on
+ * UI-driven clear or provider switch.
+ */
+const originalShellEnvByBackend = new Map();
+/**
+ * Capture the current `process.env` values for every backend's full
+ * managed env-var set (across all providers). MUST be called once at
+ * daemon startup, *before* the first `syncBackendApiKeyToEnv` call, so
+ * the snapshot reflects what the operator set in their shell rather than
+ * what we mirrored from keychain.
+ *
+ * Idempotent — repeated calls overwrite the snapshot with the current
+ * env. Tests rely on this to reset between cases.
+ */
+export function captureOriginalShellEnv(env = process.env) {
+    originalShellEnvByBackend.clear();
+    for (const backendId of BACKEND_IDS) {
+        const snapshot = {};
+        for (const envName of getManagedApiKeyEnvVars(backendId)) {
+            snapshot[envName] = env[envName];
+        }
+        originalShellEnvByBackend.set(backendId, snapshot);
+    }
+}
+/**
+ * Whether the backend had any non-empty shell value when capture ran.
+ * Used to label the resolved source as "shell" vs "none" without
+ * collapsing the per-alias structure of the snapshot.
+ * Caller must already hold a reference to the snapshot.
+ */
+function shellSnapshotHasValue(snapshot, backendId) {
+    for (const envName of getManagedApiKeyEnvVars(backendId)) {
+        if (snapshot[envName]?.trim())
+            return true;
+    }
+    return false;
+}
+/**
+ * Set a single env var to `value`, or delete it when `value === undefined`.
+ * Returns true when the env actually changed.
+ */
+function setOrDelete(envName, value, env) {
+    const current = env[envName];
+    if (value === undefined) {
+        if (current === undefined)
+            return false;
+        delete env[envName];
+        return true;
+    }
+    if (current === value)
+        return false;
+    env[envName] = value;
+    return true;
+}
+export async function syncBackendApiKeyToEnv(broker, backendId, env = process.env, opts = {}) {
+    const config = await broker.getBackendApiKeyConfig(backendId);
+    const managed = getManagedApiKeyEnvVars(backendId);
+    let changed = false;
+    if (config) {
+        const assignments = getApiKeyEnvAssignments(config);
+        const snapshot = originalShellEnvByBackend.get(backendId);
+        // Codex Azure OpenAI requires a managed config.toml file in addition
+        // to env vars. Write it now so CODEX_HOME points at a directory
+        // codex CLI can read from, leaving the operator's `~/.codex/`
+        // untouched. When `dataDir` isn't wired through, skip silently with
+        // a warning — the env var alone (without config.toml) won't make
+        // codex switch to Azure, but we still set AZURE_OPENAI_API_KEY in
+        // case a future codex version reads it directly.
+        if (config.provider === "azure-openai" && opts.dataDir) {
+            const home = materializeCodexAzureConfig(opts.dataDir, config);
+            assignments.CODEX_HOME = home;
+        }
+        else if (backendId === "codex" && config.provider !== "azure-openai") {
+            // Switching off Azure → tear down the managed config so an
+            // accidentally-set CODEX_HOME from a previous session never
+            // points at a stale config.toml.
+            if (opts.dataDir)
+                clearCodexAzureConfig(opts.dataDir);
+        }
+        for (const name of managed) {
+            const next = name in assignments ? assignments[name] : snapshot?.[name];
+            changed = setOrDelete(name, next, env) || changed;
+        }
+        return { source: "keychain", provider: config.provider, changed };
+    }
+    // No keychain config — if this is the codex backend, also tear down
+    // any stale managed config.toml from a previous Azure session.
+    if (backendId === "codex" && opts.dataDir) {
+        clearCodexAzureConfig(opts.dataDir);
+    }
+    const snapshot = originalShellEnvByBackend.get(backendId);
+    if (snapshot) {
+        // Restore each env var to its original value — preserves "user
+        // exported only ANTHROPIC_API_KEY" exactly as it was before the
+        // daemon launched. Byte-for-byte backwards compat for shell-set
+        // operators.
+        for (const name of managed) {
+            const original = snapshot[name];
+            changed = setOrDelete(name, original, env) || changed;
+        }
+        return {
+            source: shellSnapshotHasValue(snapshot, backendId) ? "shell" : "none",
+            provider: null,
+            changed,
+        };
+    }
+    // No snapshot at all (e.g. captureOriginalShellEnv was never called —
+    // can only happen in malformed test harnesses). Defensive clear.
+    for (const name of managed) {
+        changed = setOrDelete(name, undefined, env) || changed;
+    }
+    return { source: "none", provider: null, changed };
+}
+/**
+ * Resolve which env vars are "active" for the current configured state —
+ * either the keys the active provider populates (when keychain wins), or
+ * the legacy primary names (when shell or nothing is configured). Used
+ * by the GET /backends/:id/api-key route so the dashboard can render
+ * "Sets `ANTHROPIC_API_KEY`" / "Sets `CLAUDE_CODE_USE_BEDROCK` + AWS_*"
+ * without having to re-derive the assignments.
+ */
+function resolveActiveEnvVarNames(backendId, config) {
+    return Object.keys(getApiKeyEnvAssignments(config));
+}
+/**
+ * Read-only inspector — reports whether a value is currently effective in
+ * `process.env`, which source it came from, the active provider (when
+ * keychain), and the env var names the source populates. Used by the
+ * GET /backends/:id/api-key route so the dashboard can render
+ * "configured (keychain, bedrock)" / "configured (shell)" / "not
+ * configured" without ever returning the secret value itself.
+ */
+export async function describeBackendApiKey(broker, backendId, env = process.env) {
+    const config = await broker.getBackendApiKeyConfig(backendId);
+    if (config) {
+        return {
+            configured: true,
+            source: "keychain",
+            provider: config.provider,
+            envVarNames: resolveActiveEnvVarNames(backendId, config),
+        };
+    }
+    const legacyEnvVarNames = BACKEND_API_KEY_ENV_VARS[backendId];
+    for (const name of legacyEnvVarNames) {
+        if (env[name]?.trim()) {
+            return {
+                configured: true,
+                source: "shell",
+                provider: null,
+                envVarNames: legacyEnvVarNames,
+            };
+        }
+    }
+    return {
+        configured: false,
+        source: "none",
+        provider: null,
+        envVarNames: legacyEnvVarNames,
+    };
+}
+//# sourceMappingURL=backend-api-key-env.js.map

package/dist/secrets/backend-api-key-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-api-key-env.js","sourceRoot":"","sources":["../../src/secrets/backend-api-key-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAGtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAyC;IAC5E,MAAM,EAAE,CAAC,mBAAmB,CAAC;IAC7B,KAAK,EAAE,CAAC,gBAAgB,CAAC;IACzB,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;CAC7C,CAAC;AAkBF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,QAAQ,GAA0B,EAAE,CAAC;QAC3C,KAAK,MAAM,OAAO,IAAI,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,yBAAyB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,QAA+B,EAC/B,SAAoB;IAEpB,KAAK,MAAM,OAAO,IAAI,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,OAAe,EACf,KAAyB,EACzB,GAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACpC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAyCD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,SAAoB,EACpB,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1D,qEAAqE;QACrE,gEAAgE;QAChE,8DAA8D;QAC9D,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,iDAAiD;QACjD,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/D,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC;QAChC,CAAC;aAAM,IAAI,SAAS,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACvE,2DAA2D;YAC3D,4DAA4D;YAC5D,iCAAiC;YACjC,IAAI,IAAI,CAAC,OAAO;gBAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GACR,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,oEAAoE;IACpE,+DAA+D;IAC/D,IAAI,SAAS,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,aAAa;QACb,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC;QACxD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACrE,QAAQ,EAAE,IAAI;YACd,OAAO;SACR,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,SAAoB,EACpB,MAA2B;IAE3B,OAAO,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAoB,EACpB,SAAoB,EACpB,MAAyB,OAAO,CAAC,GAAG;IAOpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACtB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,iBAAiB;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,iBAAiB;KAC/B,CAAC;AACJ,CAAC"}

package/dist/secrets/codex-home-materializer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Codex CLI's Azure OpenAI mode requires a `[model_providers.azure]`
+ * block in `config.toml` — env vars alone cannot configure it. To honor
+ * the env-mirror chokepoint without trampling the operator's personal
+ * `~/.codex/` configuration, the daemon writes a managed config.toml to
+ * `<PA_DATA_DIR>/codex-home/config.toml` and points `CODEX_HOME` at that
+ * directory for spawned codex subprocesses.
+ *
+ * The user's `~/.codex/` is never touched.
+ *
+ * Lifecycle:
+ *   - On startup / sync with an `azure-openai` config: ensure the dir
+ *     exists, write/refresh config.toml (chmod 0600), set `CODEX_HOME`.
+ *   - On clear / switch to direct openai: remove the file (best-effort)
+ *     and unset `CODEX_HOME` so codex falls back to `~/.codex/`.
+ */
+import { type AzureOpenAiApiKeyConfig } from "@aitne/shared";
+/** Resolve the path the daemon manages for codex Azure config. */
+export declare function resolveCodexHomePath(dataDir: string): string;
+/**
+ * Write `config.toml` to the managed `CODEX_HOME` directory and return
+ * the directory path. Idempotent — safe to call on every sync.
+ *
+ * Sets file permissions to 0600 because the file embeds the
+ * `AZURE_OPENAI_API_KEY` env-key reference (not the key itself, but the
+ * config still expresses production routing — treat as sensitive).
+ */
+export declare function materializeCodexAzureConfig(dataDir: string, config: AzureOpenAiApiKeyConfig): string;
+/**
+ * Remove the managed `config.toml` file (and its parent dir if empty).
+ * Best-effort: missing-file is fine, permission errors are logged but
+ * not thrown.
+ */
+export declare function clearCodexAzureConfig(dataDir: string): void;
+//# sourceMappingURL=codex-home-materializer.d.ts.map

package/dist/secrets/codex-home-materializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-home-materializer.d.ts","sourceRoot":"","sources":["../../src/secrets/codex-home-materializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,eAAe,CAAC;AAQvB,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,uBAAuB,GAC9B,MAAM,CAeR;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAmB3D"}