@aitne/daemon 0.1.7 → 0.1.9

package/dist/observers/notion-poller.js

@@ -1,7 +1,18 @@
 import { recordObservation } from "../db/observations.js";
 import { readRuntimeState, writeRuntimeState } from "../db/runtime-state.js";
 import { createLogger } from "../logging.js";
+import { PollGuard } from "./poll-guard.js";
 const logger = createLogger("notion-poller");
+/**
+ * Wall-clock cap per tick. Notion's `dataSources.query` round-trip is
+ * normally 0.5-3s per page; with the per-call `MAX_PAGES` cap inside
+ * `NotionService.queryUpdatedSince` we walk at most 50 pages × 2 passes
+ * (active + trashed) × N databases. A 4-minute cap absorbs API slowness
+ * on a long cursor without letting one tick block the next interval.
+ * Combined with PollGuard's overlap guard this prevents both unbounded
+ * tick concurrency and silent hangs.
+ */
+const TICK_TIMEOUT_MS = 4 * 60 * 1000;
 function runtimeStateKey(databaseId) {
     return `notion-poller:cursor:${databaseId}`;
 }
@@ -34,6 +45,10 @@ export class NotionPoller {
     db;
     writeTracker;
     timer = null;
+    guard = new PollGuard({
+        name: "notion-poller",
+        tickTimeoutMs: TICK_TIMEOUT_MS,
+    });
     constructor(opts) {
         this.notionService = opts.notionService;
         this.databaseIds = opts.databaseIds;
@@ -58,7 +73,7 @@ export class NotionPoller {
             }
         }
         this.timer = setInterval(() => {
-            void this.pollAll();
+            void this.tick();
         }, this.pollIntervalMs);
         logger.info({
             databases: Object.keys(this.databaseIds),
@@ -70,12 +85,23 @@ export class NotionPoller {
             clearInterval(this.timer);
             this.timer = null;
         }
+        this.guard.abortInFlight(new Error("notion_poller_stopped"));
         logger.info("Notion poller stopped");
     }
-    async pollAll() {
+    async tick() {
+        try {
+            await this.guard.run((signal) => this.pollAll(signal));
+        }
+        catch (err) {
+            logger.error({ err }, "Notion poll tick failed");
+        }
+    }
+    async pollAll(signal) {
         for (const [label, dbId] of Object.entries(this.databaseIds)) {
+            if (signal.aborted)
+                return;
             try {
-                await this.pollDatabase(label, dbId);
+                await this.pollDatabase(label, dbId, signal);
             }
             catch (err) {
                 logger.error({ err, database: label }, "Notion poll failed");
@@ -83,7 +109,7 @@ export class NotionPoller {
         }
     }
     /** Poll one data source: active pages (by last_edited_time), then trashed pages. */
-    async pollDatabase(label, databaseId) {
+    async pollDatabase(label, databaseId, signal) {
         if (!this.notionService.available)
             return;
         const cursor = readRuntimeState(this.db, runtimeStateKey(databaseId)) ?? { lastEditedTime: new Date().toISOString(), trashedIds: [] };
@@ -94,7 +120,10 @@ export class NotionPoller {
         // page drops out of the in_trash-delta window on the next poll.
         const trashed = new Set(cursor.trashedIds);
         // Pass 1: active pages updated since the last cursor.
-        for await (const page of this.notionService.queryUpdatedSince(databaseId, cursor.lastEditedTime)) {
+        // `signal` is threaded into `queryUpdatedSince` so PollGuard's
+        // tick-timeout (or observer stop) terminates the inner pagination
+        // promptly instead of waiting for the Notion SDK to wind down.
+        for await (const page of this.notionService.queryUpdatedSince(databaseId, cursor.lastEditedTime, { signal })) {
             this.recordPageObservation(label, databaseId, page, "modified");
             // If a previously-trashed page now appears in the active query,
             // it has been restored. The `modified` observation above is
@@ -104,10 +133,19 @@ export class NotionPoller {
                 newestSeen = page.last_edited_time;
             }
         }
+        if (signal.aborted) {
+            // Persist whatever we made progress on before the abort so the
+            // next tick resumes from `newestSeen`, not the old cursor.
+            writeRuntimeState(this.db, runtimeStateKey(databaseId), {
+                lastEditedTime: newestSeen,
+                trashedIds: Array.from(trashed),
+            });
+            return;
+        }
         // Pass 2: in_trash pages updated since last cursor — detect archive
         // transitions. Only emit `deleted` for pages we haven't already
         // flagged as trashed.
-        for await (const page of this.notionService.queryUpdatedSince(databaseId, cursor.lastEditedTime, { inTrash: true })) {
+        for await (const page of this.notionService.queryUpdatedSince(databaseId, cursor.lastEditedTime, { inTrash: true, signal })) {
             if (!trashed.has(page.id)) {
                 this.recordPageObservation(label, databaseId, page, "deleted");
                 trashed.add(page.id);
@@ -181,4 +219,3 @@ export function extractPropertySummary(page) {
     }
     return parts.join(", ");
 }
-//# sourceMappingURL=notion-poller.js.map

package/dist/observers/observation-summarizer/index.d.ts

@@ -10,4 +10,3 @@ export { preFilterObservation, DEFAULT_LARGE_FILE_BYTES, type PreFilterConfig, t
 export { buildSummarizerPrompt, type SummarizerPrompt, type SummarizerPromptInput, type SummarizerSource, } from "./summarizer-prompts.js";
 export { parseSummarizerResponse, applyNoveltyFloor, SUMMARY_MAX_CHARS, type ParsedSummary, type ParseSummaryResult, type ParseFailureReason, } from "./response-parser.js";
 export { AnthropicSummarizerClient, UnsupportedSummarizerClient, type SummarizerLlmClient, type SummarizerLlmRequest, type SummarizerLlmResult, type SummarizerLlmErrorClass, type AnthropicSummarizerClientOptions, } from "./summarizer-client.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/observers/observation-summarizer/index.js

@@ -10,4 +10,3 @@ export { preFilterObservation, DEFAULT_LARGE_FILE_BYTES, } from "./pre-filter.js
 export { buildSummarizerPrompt, } from "./summarizer-prompts.js";
 export { parseSummarizerResponse, applyNoveltyFloor, SUMMARY_MAX_CHARS, } from "./response-parser.js";
 export { AnthropicSummarizerClient, UnsupportedSummarizerClient, } from "./summarizer-client.js";
-//# sourceMappingURL=index.js.map

package/dist/observers/observation-summarizer/pre-filter.d.ts

@@ -59,4 +59,3 @@ export type SkipReason = "agent_actor" | "deny_path" | "deny_basename" | "deny_p
  * @returns the deterministic decision; the worker handles persistence.
  */
 export declare function preFilterObservation(input: PreFilterObservationInput, config?: PreFilterConfig): PreFilterDecision;
-//# sourceMappingURL=pre-filter.d.ts.map

package/dist/observers/observation-summarizer/pre-filter.js

@@ -186,4 +186,3 @@ function pickSenderEmail(payload) {
     }
     return null;
 }
-//# sourceMappingURL=pre-filter.js.map

package/dist/observers/observation-summarizer/response-parser.d.ts

@@ -27,4 +27,3 @@ export declare const SUMMARY_MAX_CHARS = 120;
 export declare function parseSummarizerResponse(raw: string): ParseSummaryResult;
 /** Apply a novelty floor (e.g., VIP mail). The result clamps to 0..3. */
 export declare function applyNoveltyFloor(parsed: ParsedSummary, floor: 0 | 1 | 2 | 3 | undefined): ParsedSummary;
-//# sourceMappingURL=response-parser.d.ts.map

package/dist/observers/observation-summarizer/response-parser.js

@@ -16,17 +16,18 @@ export function parseSummarizerResponse(raw) {
     if (slice === null) {
         return { ok: false, reason: "no_json_object", rawSnippet: snippet(raw) };
     }
-    let parsed;
+    // `extractJsonObject` only returns a `{...}`-shaped slice (or `null`,
+    // already handled above). A `JSON.parse` of that slice either throws
+    // (handled by the catch) or evaluates to a non-null object — never a
+    // falsy primitive or array — so a separate `!parsed || typeof !==
+    // "object"` guard would be dead defensive code.
+    let obj;
     try {
-        parsed = JSON.parse(slice);
+        obj = JSON.parse(slice);
     }
     catch {
         return { ok: false, reason: "invalid_json", rawSnippet: snippet(slice) };
     }
-    if (!parsed || typeof parsed !== "object") {
-        return { ok: false, reason: "invalid_json", rawSnippet: snippet(slice) };
-    }
-    const obj = parsed;
     const summaryValue = obj["summary"];
     if (typeof summaryValue !== "string" || summaryValue.length === 0) {
         return { ok: false, reason: "missing_summary", rawSnippet: snippet(slice) };
@@ -103,4 +104,3 @@ function coerceNovelty(value) {
 function snippet(s) {
     return s.length > 200 ? `${s.slice(0, 200)}...` : s;
 }
-//# sourceMappingURL=response-parser.js.map

package/dist/observers/observation-summarizer/summarizer-client.d.ts

@@ -80,4 +80,3 @@ export declare class UnsupportedSummarizerClient implements SummarizerLlmClient
     constructor(backendId: BackendId, modelId: string);
     call(): Promise<SummarizerLlmResult>;
 }
-//# sourceMappingURL=summarizer-client.d.ts.map

package/dist/observers/observation-summarizer/summarizer-client.js

@@ -182,4 +182,3 @@ function readAnthropicUsage(json) {
 function numberOr(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
-//# sourceMappingURL=summarizer-client.js.map

package/dist/observers/observation-summarizer/summarizer-prompts.d.ts

@@ -48,4 +48,3 @@ export declare const __PAYLOAD_CAPS_FOR_TEST: {
     readonly generic: number;
 };
 export {};
-//# sourceMappingURL=summarizer-prompts.d.ts.map

package/dist/observers/observation-summarizer/summarizer-prompts.js

@@ -283,4 +283,3 @@ function truncateBytes(s, maxBytes) {
 }
 /** Test-only re-export so tests can sanity-check the cap table without recompiling. */
 export const __PAYLOAD_CAPS_FOR_TEST = PAYLOAD_CAPS;
-//# sourceMappingURL=summarizer-prompts.js.map

package/dist/observers/observation-summarizer/worker.d.ts

@@ -63,6 +63,8 @@ export declare class ObservationSummarizerWorker implements Observer {
     private readonly enqueued;
     private readonly inFlight;
     private readonly callTimestamps;
+    private lastAuthMissingWarnAt;
+    private static readonly AUTH_MISSING_WARN_COOLDOWN_MS;
     private started;
     private stopped;
     private workersIdle;
@@ -103,4 +105,3 @@ export declare class ObservationSummarizerWorker implements Observer {
     private evictExpiredCallTimestamps;
 }
 export type { PreFilterDecision, ObservationSummaryRow };
-//# sourceMappingURL=worker.d.ts.map

package/dist/observers/observation-summarizer/worker.js

@@ -48,6 +48,12 @@ export class ObservationSummarizerWorker {
     inFlight = new Set();
     // Sliding-window LLM-call timestamps for rate limiting.
     callTimestamps = [];
+    // Throttle the auth_missing warning. Without this guard every pending
+    // observation produces a "Summarizer LLM call failed" log line, drowning
+    // real signals. The actionable info — "no API key is configured" —
+    // only needs to be surfaced once per cooldown window.
+    lastAuthMissingWarnAt = 0;
+    static AUTH_MISSING_WARN_COOLDOWN_MS = 5 * 60_000;
     started = false;
     stopped = false;
     workersIdle = 0;
@@ -222,6 +228,25 @@ export class ObservationSummarizerWorker {
         });
         const result = await this.callLlm(prompt);
         if (!result.ok) {
+            // auth_missing is a user-config issue, not a per-row failure. Mark
+            // the row 'skipped' so the hourly_check fallback path picks it up
+            // (same posture as `unsupported_backend`) and warn at most once
+            // per cooldown window so a missing ANTHROPIC_API_KEY does not spam
+            // the log with one entry per pending observation.
+            if (result.errorClass === "auth_missing") {
+                const now = this.now().getTime();
+                if (now - this.lastAuthMissingWarnAt >= ObservationSummarizerWorker.AUTH_MISSING_WARN_COOLDOWN_MS) {
+                    this.lastAuthMissingWarnAt = now;
+                    logger.warn({
+                        backend: this.client.backendId,
+                        model: this.client.modelId,
+                        cooldownMs: ObservationSummarizerWorker.AUTH_MISSING_WARN_COOLDOWN_MS,
+                        hint: "Set ANTHROPIC_API_KEY in env or store it via the dashboard. Pending rows are being marked 'skipped' and the hourly_check fallback path will read them directly.",
+                    }, "Summarizer LLM auth missing — falling back to skip, future warnings suppressed within cooldown");
+                }
+                this.persist(row.id, { status: "skipped", summaryText: null, novelty: null });
+                return;
+            }
             logger.warn({ id, errorClass: result.errorClass, source: row.source }, "Summarizer LLM call failed — marking row failed");
             this.persist(row.id, {
                 status: result.errorClass === "unsupported_backend" ? "skipped" : "failed",
@@ -308,4 +333,3 @@ function clampInt(value, min, max) {
         return min;
     return Math.min(max, Math.max(min, Math.floor(value)));
 }
-//# sourceMappingURL=worker.js.map

package/dist/observers/obsidian-watcher.d.ts

@@ -87,4 +87,3 @@ export declare class ObsidianWatcher implements Observer {
      */
     handleChange(filePath: string, changeType: "created" | "modified" | "deleted"): void;
 }
-//# sourceMappingURL=obsidian-watcher.d.ts.map

package/dist/observers/obsidian-watcher.js

@@ -163,4 +163,3 @@ export class ObsidianWatcher {
         }, this.debounceSeconds * 1000));
     }
 }
-//# sourceMappingURL=obsidian-watcher.js.map

package/dist/observers/poll-guard.d.ts

@@ -0,0 +1,62 @@
+import { raceWithAbort } from "../core/abort-utils.js";
+export { raceWithAbort };
+export interface PollGuardOptions {
+    /** Human-readable name for logging (e.g. "calendar-poller"). */
+    name: string;
+    /**
+     * Wall-clock cap per tick. When exceeded, the AbortSignal fires and the
+     * tick is logged at warn level. The in-flight promise is NOT awaited
+     * beyond this point — the next tick can resume once the previous
+     * `run()` returns (which it will if `fn` honors the signal, either
+     * directly or via {@link raceWithAbort}).
+     *
+     * 0 or undefined disables the timeout (overlap guard still applies).
+     */
+    tickTimeoutMs?: number;
+}
+/**
+ * Shared overlap+timeout guard for observer pollers.
+ *
+ * Combines the two patterns that several existing pollers already do
+ * inline — `mail-poller`'s `inFlight` flag (overlap prevention) and a
+ * per-tick wall-clock cap that the audit found missing on
+ * `CalendarPoller`, `NotionPoller`, and `ImminentEventScheduler`.
+ *
+ * Contract: callers MUST honor the AbortSignal in long-running work.
+ * For SDK calls that don't natively support `signal`, wrap them with
+ * {@link raceWithAbort} — the underlying call leaks (continues in the
+ * background until it naturally completes or the transport times out),
+ * but the poller's promise resolves so `inFlight` can reset and the
+ * next tick is unblocked.
+ *
+ * What this does NOT do:
+ *  - Kill the in-flight work directly (PollGuard is signal-only).
+ *  - Reset `inFlight` if `fn` ignores both the signal and never resolves.
+ *    That failure mode is a poller bug — surface it loudly via the
+ *    timeout warning rather than silently allowing concurrent ticks
+ *    that could race on shared DB state.
+ */
+export declare class PollGuard {
+    private readonly name;
+    private readonly tickTimeoutMs;
+    private inFlight;
+    private currentAborter;
+    private skipCount;
+    constructor(options: PollGuardOptions);
+    /**
+     * Run `fn` once with overlap protection. Returns `true` if `fn` ran
+     * (regardless of whether it threw), `false` if a previous tick was
+     * still in flight and this call was skipped.
+     *
+     * Errors from `fn` are re-thrown to the caller — the guard does not
+     * swallow them. Callers wrap their own `try/catch` for logging policy.
+     */
+    run(fn: (signal: AbortSignal) => Promise<void>): Promise<boolean>;
+    /**
+     * Cancel any in-flight tick. Safe to call from `observer.stop()` even
+     * when no tick is running.
+     */
+    abortInFlight(reason?: unknown): void;
+    /** Test seam. */
+    isInFlight(): boolean;
+}

package/dist/observers/poll-guard.js

@@ -0,0 +1,88 @@
+import { createLogger } from "../logging.js";
+import { raceWithAbort } from "../core/abort-utils.js";
+export { raceWithAbort };
+const logger = createLogger("poll-guard");
+/**
+ * Shared overlap+timeout guard for observer pollers.
+ *
+ * Combines the two patterns that several existing pollers already do
+ * inline — `mail-poller`'s `inFlight` flag (overlap prevention) and a
+ * per-tick wall-clock cap that the audit found missing on
+ * `CalendarPoller`, `NotionPoller`, and `ImminentEventScheduler`.
+ *
+ * Contract: callers MUST honor the AbortSignal in long-running work.
+ * For SDK calls that don't natively support `signal`, wrap them with
+ * {@link raceWithAbort} — the underlying call leaks (continues in the
+ * background until it naturally completes or the transport times out),
+ * but the poller's promise resolves so `inFlight` can reset and the
+ * next tick is unblocked.
+ *
+ * What this does NOT do:
+ *  - Kill the in-flight work directly (PollGuard is signal-only).
+ *  - Reset `inFlight` if `fn` ignores both the signal and never resolves.
+ *    That failure mode is a poller bug — surface it loudly via the
+ *    timeout warning rather than silently allowing concurrent ticks
+ *    that could race on shared DB state.
+ */
+export class PollGuard {
+    name;
+    tickTimeoutMs;
+    inFlight = false;
+    currentAborter = null;
+    skipCount = 0;
+    constructor(options) {
+        this.name = options.name;
+        this.tickTimeoutMs = options.tickTimeoutMs ?? 0;
+    }
+    /**
+     * Run `fn` once with overlap protection. Returns `true` if `fn` ran
+     * (regardless of whether it threw), `false` if a previous tick was
+     * still in flight and this call was skipped.
+     *
+     * Errors from `fn` are re-thrown to the caller — the guard does not
+     * swallow them. Callers wrap their own `try/catch` for logging policy.
+     */
+    async run(fn) {
+        if (this.inFlight) {
+            this.skipCount += 1;
+            logger.debug({ name: this.name, skipCount: this.skipCount }, "Skipping tick — previous run still in flight");
+            return false;
+        }
+        if (this.skipCount > 0) {
+            logger.warn({ name: this.name, skipped: this.skipCount }, "Resumed after skipping ticks");
+            this.skipCount = 0;
+        }
+        this.inFlight = true;
+        const aborter = new AbortController();
+        this.currentAborter = aborter;
+        let timer;
+        if (this.tickTimeoutMs > 0) {
+            timer = setTimeout(() => {
+                logger.warn({ name: this.name, tickTimeoutMs: this.tickTimeoutMs }, "Poll tick exceeded wall-clock — aborting");
+                aborter.abort(new Error(`poll_tick_timeout:${this.name}:${this.tickTimeoutMs}ms`));
+            }, this.tickTimeoutMs);
+            timer.unref?.();
+        }
+        try {
+            await fn(aborter.signal);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            this.currentAborter = null;
+            this.inFlight = false;
+        }
+        return true;
+    }
+    /**
+     * Cancel any in-flight tick. Safe to call from `observer.stop()` even
+     * when no tick is running.
+     */
+    abortInFlight(reason) {
+        this.currentAborter?.abort(reason);
+    }
+    /** Test seam. */
+    isInFlight() {
+        return this.inFlight;
+    }
+}

package/dist/observers/primary-vault-watcher.d.ts

@@ -70,4 +70,3 @@ export declare class PrimaryVaultWatcher implements Observer {
     private spinUpInnerIfTargeted;
     private teardownInner;
 }
-//# sourceMappingURL=primary-vault-watcher.d.ts.map

package/dist/observers/primary-vault-watcher.js

@@ -112,4 +112,3 @@ export class PrimaryVaultWatcher {
         }
     }
 }
-//# sourceMappingURL=primary-vault-watcher.js.map

package/dist/observers/repository-management-cron.d.ts

@@ -67,4 +67,3 @@ export declare class RepositoryManagementCron implements Observer {
     private resolveContextDir;
     private buildEvent;
 }
-//# sourceMappingURL=repository-management-cron.d.ts.map

package/dist/observers/repository-management-cron.js

@@ -163,4 +163,3 @@ export class RepositoryManagementCron {
         };
     }
 }
-//# sourceMappingURL=repository-management-cron.js.map

package/dist/observers/skill-curation-walker.d.ts

@@ -30,4 +30,3 @@ export declare class SkillCurationWalker implements Observer {
 /** Exported for unit tests. */
 export declare function diffSkill(db: Database.Database, decl: LoadedCurationDeclaration, snapshot: ReturnType<typeof buildKnowledgeMap>, overlay: OverlayStore, now: number): number;
 export {};
-//# sourceMappingURL=skill-curation-walker.d.ts.map

package/dist/observers/skill-curation-walker.js

@@ -213,4 +213,3 @@ function safeParse(s) {
         return null;
     }
 }
-//# sourceMappingURL=skill-curation-walker.js.map

package/dist/safety/absolute-block-audit.d.ts

@@ -10,6 +10,21 @@ import type { AbsoluteBlockMatch } from "./always-disallowed.js";
  * the SDK-level `disallowedTools` / TOML deny-rule rejection; this row
  * is observability only. If the DB is transiently unavailable, a warning
  * logs and the hook still returns the block decision to the caller.
+ *
+ * Two semantic call sites, discriminated via the `result` parameter:
+ *
+ *   - `result: 'failed'` (default) — the Claude SDK PreToolUse hook
+ *     authoritatively rejected the call. The audit row truthfully reports
+ *     a denied invocation. `trigger='absolute_block_layer'`.
+ *
+ *   - `result: 'partial'` — a CLI backend (Codex, Gemini) observed a
+ *     `tool_use`-shaped stream event whose input matches an absolute-block
+ *     pattern. The actual rejection (or not) happens inside the subprocess
+ *     sandbox / admin policy, where the daemon cannot directly observe
+ *     the outcome. `trigger='absolute_block_stream_observation'` so an
+ *     audit-log filter can keep the two streams cleanly separated.
+ *     `detail.observation: 'stream'` mirrors the trigger discrimination
+ *     for consumers that prefer the JSON detail field.
  */
 export declare function recordAbsoluteBlockAudit(params: {
     db: Database.Database | undefined;
@@ -18,5 +33,6 @@ export declare function recordAbsoluteBlockAudit(params: {
     match: AbsoluteBlockMatch;
     toolName: string;
     sessionId?: number | null;
+    /** Audit row outcome — see the function docstring. */
+    result?: "failed" | "partial";
 }): void;
-//# sourceMappingURL=absolute-block-audit.d.ts.map

package/dist/safety/absolute-block-audit.js

@@ -9,11 +9,34 @@ const logger = createLogger("absolute-block-audit");
  * the SDK-level `disallowedTools` / TOML deny-rule rejection; this row
  * is observability only. If the DB is transiently unavailable, a warning
  * logs and the hook still returns the block decision to the caller.
+ *
+ * Two semantic call sites, discriminated via the `result` parameter:
+ *
+ *   - `result: 'failed'` (default) — the Claude SDK PreToolUse hook
+ *     authoritatively rejected the call. The audit row truthfully reports
+ *     a denied invocation. `trigger='absolute_block_layer'`.
+ *
+ *   - `result: 'partial'` — a CLI backend (Codex, Gemini) observed a
+ *     `tool_use`-shaped stream event whose input matches an absolute-block
+ *     pattern. The actual rejection (or not) happens inside the subprocess
+ *     sandbox / admin policy, where the daemon cannot directly observe
+ *     the outcome. `trigger='absolute_block_stream_observation'` so an
+ *     audit-log filter can keep the two streams cleanly separated.
+ *     `detail.observation: 'stream'` mirrors the trigger discrimination
+ *     for consumers that prefer the JSON detail field.
  */
 export function recordAbsoluteBlockAudit(params) {
-    const { db, backend, mode, match, toolName, sessionId } = params;
+    const { db, backend, mode, match, toolName, sessionId, result } = params;
     if (!db)
         return;
+    const effectiveResult = result ?? "failed";
+    // Trigger is derived from `result` so the (action_type, trigger, result)
+    // triple is internally consistent: a reader that filters on any one of
+    // those three columns sees the same partition between authoritative
+    // PreToolUse rejections and CLI stream observations.
+    const trigger = effectiveResult === "partial"
+        ? "absolute_block_stream_observation"
+        : "absolute_block_layer";
     try {
         const detail = JSON.stringify({
             category: match.category,
@@ -21,12 +44,14 @@ export function recordAbsoluteBlockAudit(params) {
             redacted: match.redacted,
             mode,
             sessionId: sessionId ?? null,
+            ...(effectiveResult === "partial"
+                ? { observation: "stream" }
+                : {}),
         });
         db.prepare(`INSERT INTO agent_actions (action_type, trigger, result, detail, backend)
-         VALUES (?, ?, ?, ?, ?)`).run("blocked_absolute", "absolute_block_layer", "failed", detail, backend);
+         VALUES (?, ?, ?, ?, ?)`).run("blocked_absolute", trigger, effectiveResult, detail, backend);
     }
     catch (err) {
         logger.warn({ err, backend, category: match.category }, "failed to record blocked_absolute audit row");
     }
 }
-//# sourceMappingURL=absolute-block-audit.js.map

package/dist/safety/agent-write-tracker.d.ts

@@ -31,12 +31,52 @@
 export declare class AgentWriteTracker {
     private readonly ttlMs;
     private readonly recentWrites;
-    constructor(ttlMs?: number);
+    /**
+     * Parallel commit-tracking map keyed by `<repoPath>::<sha-lower>`. Used by
+     * `GitWatcher` to flip observations of agent-originated commits from
+     * `actor='user'` / `'unknown'` to `actor='agent'` so the hourly_check
+     * pending-floor does not count the daemon's own commits as user
+     * activity (C1).
+     */
+    private readonly recentCommits;
+    private readonly commitTtlMs;
+    constructor(ttlMs?: number, opts?: {
+        commitTtlMs?: number;
+    });
     markWriting(absolutePath: string, content?: string | null, opts?: {
         ttlMs?: number;
     }): void;
+    /**
+     * Remove a mark for `absolutePath`, regardless of mode (content-hash or
+     * path-only). Used by writers that mark **before** the visible-write
+     * boundary (C2 fix — `markWriting` must precede `writeFileAtomically` /
+     * `writeFileSync` so FS-watch consumers see a populated tracker the
+     * moment the rename/write completes). If the write throws, the caller
+     * rolls the mark back via `unmark` so a stale mark cannot suppress a
+     * later legitimate user edit. Idempotent — `Map.delete` on an unknown
+     * key is a no-op, so callers can `unmark` unconditionally in a catch.
+     */
+    unmark(absolutePath: string): void;
     isMarked(absolutePath: string, content: string | null | undefined): boolean;
     cleanup(now?: number): void;
     private hashContent;
+    /**
+     * Register a git SHA the daemon just committed in `repoPath`. The next
+     * `GitWatcher` observation of that SHA is flipped from `actor='user'` /
+     * `'unknown'` to `actor='agent'` via `isAgentCommit`, which keeps the
+     * hourly_check pending-floor from counting the daemon's own commits as
+     * user activity (the loop bug described in C1).
+     *
+     * Production callers pass the full 40-char SHA from `git rev-parse HEAD`.
+     * The minimum-length guard (≥7 hex chars) prevents accidental cross-repo
+     * collisions when tests feed abbreviated hashes. Malformed input is a
+     * silent no-op rather than an error — this is best-effort attribution,
+     * never a correctness gate.
+     */
+    markAgentCommit(repoPath: string, sha: string, opts?: {
+        ttlMs?: number;
+    }): void;
+    isAgentCommit(repoPath: string, sha: string): boolean;
+    private commitKey;
+    private cleanupCommits;
 }
-//# sourceMappingURL=agent-write-tracker.d.ts.map