@aitne/daemon 0.1.7 → 0.1.9

package/dist/safety/audit.d.ts

@@ -1,6 +1,6 @@
 import type Database from "better-sqlite3";
 import type { AgentResult, BackendId, Event, IntegrationKey, MessageEvent } from "@aitne/shared";
-import type { BangCommandDetail, IAuditLogger } from "../core/dispatcher.js";
+import type { BangCommandDetail, DailyWriteAuditDetail, IAuditLogger } from "../core/dispatcher.js";
 export interface AuditEventRow {
     id: number;
     event_id: string;
@@ -36,6 +36,17 @@ export declare class AuditLogger implements IAuditLogger {
     private readonly hasSourceKindColumn;
     private readonly hasSourceRefColumn;
     constructor(db: Database.Database, options?: AuditLoggerOptions);
+    /**
+     * AGENT_DEFINITIONS_DESIGN.md §8.1 — resolver that maps a live event to the
+     * owning Agent slug for the in-flight firing, so every `logAction` row the
+     * run produces is stamped with `agent_actions.agent_id` without threading the
+     * slug through each caller (morning orchestrator, scheduled tasks, DMs). The
+     * dispatcher wires `AgentExecutionTracker.currentAgentId(correlationId)` here
+     * after both exist; until then (and for events with no resolved Agent) the
+     * stamp stays NULL, preserving the legacy row shape.
+     */
+    private agentIdResolver;
+    setAgentIdResolver(resolver: (event: Event) => string | null): void;
     logAction(params: {
         event: Event;
         model: string;
@@ -80,7 +91,28 @@ export declare class AuditLogger implements IAuditLogger {
             fallbackTriggered?: boolean;
             requestedBackend?: BackendId;
         };
+        dailyWrite?: DailyWriteAuditDetail | null;
     }): void;
+    /**
+     * morning-routine-optimization.md Phase 6 — pre-insert an `in_progress`
+     * sentinel row so a subsequent `PATCH /api/agent-actions/self` from
+     * inside the spawned session resolves to the same row that the eventual
+     * terminal-state `logAction` will settle. Used by the morning-routine
+     * pipeline orchestrator before launching Stage A; safe to call from any
+     * caller that wants the upsert path in `logAction` to fire.
+     *
+     * Returns the inserted rowid (`-1` when the INSERT failed — caller
+     * should still proceed since `logAction` will fall back to the
+     * legacy fresh-INSERT path).
+     */
+    insertInProgressRow(args: {
+        correlationId: string | null;
+        actionType: string;
+        trigger: "reactive" | "autonomous";
+        backend?: string;
+        modelId?: string;
+    }): number;
+    private findInProgressRowId;
     logSkip(event: Event, reason: string, trigger: "reactive" | "autonomous"): void;
     /**
      * Chat-attachments Phase 1 — log a successful upload (inbound or outbound)
@@ -107,10 +139,9 @@ export declare class AuditLogger implements IAuditLogger {
      * Optional partial-run context the dispatcher recovers from the catch
      * site (wall-clock duration) and from `BackendRouterHandledError`
      * (backend / model / failure kind+code). Without this, the row is a
-     * black hole: the dashboard shows "Duration: 0ms" for a 60-second run
-     * that hit `max_budget_usd` because the row was written with no
-     * timing/backend/model info — see drift-effects regression
-     * 2026-05-04 (today_refresh hit the $0.10 cap; row 62 was unfilled).
+     * black hole: the dashboard shows "Duration: 0ms" for a long run that
+     * hit `max_budget_usd` because the row was written with no
+     * timing/backend/model info.
      *
      * Tokens / cost / num_turns are intentionally NOT passed: an aborted
      * SDK stream doesn't surface a usable AgentResult, so any value here
@@ -149,6 +180,7 @@ export declare class AuditLogger implements IAuditLogger {
             fallbackTriggered?: boolean;
             requestedBackend?: BackendId;
         };
+        dailyWrite?: DailyWriteAuditDetail | null;
     }): void;
     private emitInsertedRow;
 }
@@ -160,4 +192,3 @@ export declare class AuditLogger implements IAuditLogger {
  */
 export declare function bangStatusToResult(status: BangCommandDetail["status"]): "success" | "skipped" | "failed";
 export {};
-//# sourceMappingURL=audit.d.ts.map

package/dist/safety/audit.js

@@ -38,8 +38,21 @@ export class AuditLogger {
         this.hasSourceKindColumn = this.actionColumns.has("source_kind");
         this.hasSourceRefColumn = this.actionColumns.has("source_ref");
     }
+    /**
+     * AGENT_DEFINITIONS_DESIGN.md §8.1 — resolver that maps a live event to the
+     * owning Agent slug for the in-flight firing, so every `logAction` row the
+     * run produces is stamped with `agent_actions.agent_id` without threading the
+     * slug through each caller (morning orchestrator, scheduled tasks, DMs). The
+     * dispatcher wires `AgentExecutionTracker.currentAgentId(correlationId)` here
+     * after both exist; until then (and for events with no resolved Agent) the
+     * stamp stays NULL, preserving the legacy row shape.
+     */
+    agentIdResolver = null;
+    setAgentIdResolver(resolver) {
+        this.agentIdResolver = resolver;
+    }
     logAction(params) {
-        const { event, model, costUsd, usage, modelUsage, durationMs, numTurns, trigger, backend, costSource, contextUpdated = false, advisorCallCount = 0, dmFreshness, prePass, } = params;
+        const { event, model, costUsd, usage, modelUsage, durationMs, numTurns, trigger, backend, costSource, contextUpdated = false, advisorCallCount = 0, dmFreshness, prePass, dailyWrite, } = params;
         try {
             const modelUsageJson = Object.keys(modelUsage).length > 0
                 ? JSON.stringify(modelUsage)
@@ -114,6 +127,16 @@ export class AuditLogger {
                 columns.splice(columns.length - 2, 0, "source_ref");
                 values.splice(values.length, 0, typeof event.data.workspace === "string" ? event.data.workspace : null);
             }
+            // AGENT_DEFINITIONS_DESIGN.md §5.3 / §8.1 — stamp the owning Agent slug
+            // when the in-flight firing resolved to one. The `agent_id` column ships
+            // since migration 0007, so no column-existence guard is needed; an
+            // unresolved firing leaves it NULL (legacy row shape). The in_progress
+            // UPDATE path below carries it automatically (the generic column loop).
+            const resolvedAgentId = this.agentIdResolver?.(event) ?? null;
+            if (resolvedAgentId !== null) {
+                columns.splice(columns.length - 2, 0, "agent_id");
+                values.splice(values.length, 0, resolvedAgentId);
+            }
             const detailPayload = {};
             // STAGE-C-DM-FRESHNESS-PLAN §Task 4 — persist DM freshness telemetry
             // into `detail`. Inserted only when supplied so non-DM rows stay
@@ -151,10 +174,78 @@ export class AuditLogger {
                         : {}),
                 };
             }
+            // daily-journal-daemon-write.md §4.11 — Stage B daily journal
+            // compose outcome. Lands on the same INSERT/UPSERT as the row's
+            // terminal `result`, no post-UPDATE required.
+            if (dailyWrite) {
+                detailPayload.dailyWrite = dailyWrite;
+            }
             if (Object.keys(detailPayload).length > 0) {
                 columns.splice(columns.length - 2, 0, "detail");
                 values.splice(values.length, 0, JSON.stringify(detailPayload));
             }
+            // morning-routine-optimization.md Phase 6 — UPSERT semantics for the
+            // in_progress sentinel row. The orchestrator pre-inserts a row with
+            // `result='in_progress'` before Stage A starts so the agent's
+            // `PATCH /api/agent-actions/self` can resolve and write the
+            // structured metadata side-channel that ⑥ AgentJournalAppender
+            // consumes. Without this branch, `logAction` would INSERT a fresh
+            // terminal row and leave the in_progress row orphaned — the
+            // appender's "most recent row wins" walk would then read the
+            // terminal row's empty metadata, defeating the whole structured-
+            // self-report pathway.
+            //
+            // The branch is generic on `(event_id, action_type, 'in_progress')`
+            // so any other pre-insertion pattern (delegated_task header rows
+            // already use a parallel `completeTaskHeader` path; this branch is
+            // for routine-style sessions that fan through `processResult`)
+            // inherits the same settle semantics. The lookup is `event_id IS ?`
+            // so a NULL correlationId matches a NULL row, preserving the
+            // legacy fresh-INSERT path for events that have never carried a
+            // correlationId.
+            const inProgressId = this.findInProgressRowId(event.correlationId, event.type);
+            if (inProgressId !== null) {
+                // UPDATE in-place — preserves the `metadata` JSON column the agent
+                // wrote via `/api/agent-actions/self`, the existing started_at,
+                // and the row's id (so any FK references stay valid). Drop
+                // `started_at` from the column set since the in-progress INSERT
+                // already populated it; `completed_at` flips from NULL to
+                // datetime('now') as part of the settle.
+                const assignments = [];
+                const updateValues = [];
+                for (let i = 0; i < columns.length; i++) {
+                    const column = columns[i];
+                    if (column === "event_id" || column === "action_type")
+                        continue;
+                    if (column === "started_at")
+                        continue;
+                    if (column === "completed_at") {
+                        assignments.push(`${column} = datetime('now')`);
+                        continue;
+                    }
+                    if (column === "detail") {
+                        assignments.push(`${column} = json(?)`);
+                        updateValues.push(values[i]);
+                        continue;
+                    }
+                    assignments.push(`${column} = ?`);
+                    updateValues.push(values[i]);
+                }
+                try {
+                    this.db
+                        .prepare(`UPDATE agent_actions SET ${assignments.join(", ")} WHERE id = ?`)
+                        .run(...updateValues, inProgressId);
+                    this.emitInsertedRow(inProgressId, event.type);
+                    return;
+                }
+                catch (err) {
+                    // Fall through to INSERT on UPDATE failure (e.g. row was
+                    // garbage-collected between SELECT and UPDATE). Logged here
+                    // so the operator can spot the race; downstream readers see
+                    // the fresh terminal row that the INSERT below produces.
+                    logger.warn({ err, event: event.type, inProgressId }, "in_progress row UPDATE failed — falling back to INSERT");
+                }
+            }
             const placeholders = columns
                 .map((column) => {
                 if (column === "started_at" || column === "completed_at") {
@@ -176,13 +267,88 @@ export class AuditLogger {
             logger.error({ err, event: event.type }, "Failed to log action");
         }
     }
+    /**
+     * morning-routine-optimization.md Phase 6 — pre-insert an `in_progress`
+     * sentinel row so a subsequent `PATCH /api/agent-actions/self` from
+     * inside the spawned session resolves to the same row that the eventual
+     * terminal-state `logAction` will settle. Used by the morning-routine
+     * pipeline orchestrator before launching Stage A; safe to call from any
+     * caller that wants the upsert path in `logAction` to fire.
+     *
+     * Returns the inserted rowid (`-1` when the INSERT failed — caller
+     * should still proceed since `logAction` will fall back to the
+     * legacy fresh-INSERT path).
+     */
+    insertInProgressRow(args) {
+        try {
+            const columns = ["event_id", "action_type", "trigger", "result"];
+            const valuePlaceholders = ["?", "?", "?", "?"];
+            const values = [
+                args.correlationId,
+                args.actionType,
+                args.trigger,
+                "in_progress",
+            ];
+            columns.push("started_at");
+            valuePlaceholders.push("datetime('now')");
+            if (this.hasBackendColumn) {
+                columns.push("backend");
+                valuePlaceholders.push("?");
+                values.push(args.backend ?? null);
+            }
+            if (args.modelId !== undefined) {
+                columns.push("model_used");
+                valuePlaceholders.push("?");
+                values.push(args.modelId);
+            }
+            const result = this.db
+                .prepare(`INSERT INTO agent_actions (${columns.join(", ")}) VALUES (${valuePlaceholders.join(", ")})`)
+                .run(...values);
+            return Number(result.lastInsertRowid);
+        }
+        catch (err) {
+            logger.error({ err, actionType: args.actionType, correlationId: args.correlationId }, "Failed to insert in_progress agent_actions row");
+            return -1;
+        }
+    }
+    findInProgressRowId(correlationId, actionType) {
+        try {
+            // SQLite `IS` handles NULL equality and is identical to `=` for
+            // non-NULL operands, so a single predicate covers both the
+            // correlated and uncorrelated cases.
+            const row = this.db
+                .prepare(`SELECT id FROM agent_actions
+            WHERE event_id IS ?
+              AND action_type = ?
+              AND result = 'in_progress'
+            ORDER BY id DESC
+            LIMIT 1`)
+                .get(correlationId ?? null, actionType);
+            return row ? row.id : null;
+        }
+        catch {
+            return null;
+        }
+    }
     logSkip(event, reason, trigger) {
         try {
-            const insertResult = this.db
-                .prepare(`INSERT INTO agent_actions
-         (event_id, action_type, trigger, result, error, started_at)
-         VALUES (?, ?, ?, 'skipped', ?, datetime('now'))`)
-                .run(event.correlationId, event.type, trigger, reason);
+            // AGENT_DEFINITIONS_DESIGN.md §8.1 — stamp the owning Agent when the
+            // in-flight firing resolved to one (e.g. a review routine skipped by the
+            // morning-pending gate), so the skip row is attributable. Pre-`begin`
+            // skips (setup-mode / cost-cap) resolve to NULL — no execution context
+            // exists yet — which is the legacy row shape.
+            const resolvedAgentId = this.agentIdResolver?.(event) ?? null;
+            const insertResult = resolvedAgentId !== null
+                ? this.db
+                    .prepare(`INSERT INTO agent_actions
+               (event_id, action_type, trigger, result, error, agent_id, started_at)
+               VALUES (?, ?, ?, 'skipped', ?, ?, datetime('now'))`)
+                    .run(event.correlationId, event.type, trigger, reason, resolvedAgentId)
+                : this.db
+                    .prepare(`INSERT INTO agent_actions
+               (event_id, action_type, trigger, result, error, started_at)
+               VALUES (?, ?, ?, 'skipped', ?, datetime('now'))`)
+                    .run(event.correlationId, event.type, trigger, reason);
             this.emitInsertedRow(Number(insertResult.lastInsertRowid), event.type);
         }
         catch (err) {
@@ -246,10 +412,9 @@ export class AuditLogger {
      * Optional partial-run context the dispatcher recovers from the catch
      * site (wall-clock duration) and from `BackendRouterHandledError`
      * (backend / model / failure kind+code). Without this, the row is a
-     * black hole: the dashboard shows "Duration: 0ms" for a 60-second run
-     * that hit `max_budget_usd` because the row was written with no
-     * timing/backend/model info — see drift-effects regression
-     * 2026-05-04 (today_refresh hit the $0.10 cap; row 62 was unfilled).
+     * black hole: the dashboard shows "Duration: 0ms" for a long run that
+     * hit `max_budget_usd` because the row was written with no
+     * timing/backend/model info.
      *
      * Tokens / cost / num_turns are intentionally NOT passed: an aborted
      * SDK stream doesn't surface a usable AgentResult, so any value here
@@ -276,18 +441,38 @@ export class AuditLogger {
                 "failed",
                 error.message,
             ];
+            // Optional columns are inserted BEFORE the started_at/completed_at
+            // tail (`columns.length - 2`) and APPENDED to `values` (which has
+            // no started_at/completed_at entries — those are SQL expressions
+            // in the INSERT placeholder map). The lockstep invariant
+            // `columns.length - 2 === values.length` is what makes the
+            // in_progress UPSERT branch's iteration `values[i]` align with
+            // columns[i]: any other splice pattern (e.g. inserting at
+            // `columns.length`, AFTER the timestamps) would shift columns
+            // ahead of values and the UPDATE assignments would bind the wrong
+            // value to each column. Mirrors the identically-shaped block in
+            // `logAction` (above).
             if (typeof context?.durationMs === "number" && context.durationMs >= 0) {
-                columns.splice(columns.length, 0, "duration_ms");
+                columns.splice(columns.length - 2, 0, "duration_ms");
                 values.splice(values.length, 0, Math.round(context.durationMs));
             }
             if (context?.modelId) {
-                columns.splice(columns.length, 0, "model_used");
+                columns.splice(columns.length - 2, 0, "model_used");
                 values.splice(values.length, 0, context.modelId);
             }
             if (this.hasBackendColumn && context?.backendId) {
-                columns.splice(columns.length, 0, "backend");
+                columns.splice(columns.length - 2, 0, "backend");
                 values.splice(values.length, 0, context.backendId);
             }
+            // AGENT_DEFINITIONS_DESIGN.md §8.1 — stamp the owning Agent when the
+            // in-flight firing resolved to one, so a FAILED routine's audit row is
+            // attributable to its Agent (the same resolver `logAction` uses). The
+            // in_progress UPSERT loop below carries it via the generic column path.
+            const resolvedAgentId = this.agentIdResolver?.(event) ?? null;
+            if (resolvedAgentId !== null) {
+                columns.splice(columns.length - 2, 0, "agent_id");
+                values.splice(values.length, 0, resolvedAgentId);
+            }
             const detailPayload = {};
             if (context?.failureKind)
                 detailPayload.failureKind = context.failureKind;
@@ -316,8 +501,15 @@ export class AuditLogger {
                         : {}),
                 };
             }
+            // daily-journal-daemon-write.md §4.11 — Stage B daily journal
+            // compose outcome (failure-path twin of the success-path block
+            // above). Lets the streak detector see `ok: false, reason: ...`
+            // rows when Stage B threw mid-flight.
+            if (context?.dailyWrite) {
+                detailPayload.dailyWrite = context.dailyWrite;
+            }
             if (Object.keys(detailPayload).length > 0) {
-                columns.splice(columns.length, 0, "detail");
+                columns.splice(columns.length - 2, 0, "detail");
                 values.splice(values.length, 0, JSON.stringify(detailPayload));
             }
             // Backdate started_at so the dashboard "Started" column reflects when
@@ -329,6 +521,62 @@ export class AuditLogger {
             const startedAtExpr = backdateSeconds > 0
                 ? `datetime('now', '-${backdateSeconds.toFixed(3)} seconds')`
                 : "datetime('now')";
+            // UPSERT semantics for the in_progress sentinel row — mirrors the
+            // identically-shaped branch in `logAction` (lines 297-344). Callers
+            // (notably the morning-routine pipeline orchestrator) pre-insert a
+            // `result='in_progress'` row before spawning Stage A so the agent's
+            // `PATCH /api/agent-actions/self` can resolve and write structured
+            // metadata; without this branch a subsequent throw inside the same
+            // stage would leave the in_progress row orphaned AND emit a parallel
+            // `result='failed'` row, causing `loadMorningRoutineActionRows`
+            // (which picks the most-recent matching row) to read whichever
+            // landed last and producing misleading audit-trail entries. The
+            // UPDATE preserves the row's original `started_at` and `metadata`
+            // column so any agent-side PATCH writes that landed before the
+            // throw survive the settle.
+            //
+            // Lookup is `event_id IS ?` so a NULL correlationId matches a NULL
+            // row — same NULL-tolerant predicate `logAction` uses.
+            const inProgressId = this.findInProgressRowId(event.correlationId, event.type);
+            if (inProgressId !== null) {
+                const assignments = [];
+                const updateValues = [];
+                for (let i = 0; i < columns.length; i++) {
+                    const column = columns[i];
+                    // event_id / action_type / started_at are immutable on settle —
+                    // event_id/action_type are the lookup key; started_at was
+                    // captured at the pre-insert and IS the actual start time.
+                    if (column === "event_id" || column === "action_type")
+                        continue;
+                    if (column === "started_at")
+                        continue;
+                    if (column === "completed_at") {
+                        assignments.push(`${column} = datetime('now')`);
+                        continue;
+                    }
+                    if (column === "detail") {
+                        assignments.push(`${column} = json(?)`);
+                        updateValues.push(values[i]);
+                        continue;
+                    }
+                    assignments.push(`${column} = ?`);
+                    updateValues.push(values[i]);
+                }
+                try {
+                    this.db
+                        .prepare(`UPDATE agent_actions SET ${assignments.join(", ")} WHERE id = ?`)
+                        .run(...updateValues, inProgressId);
+                    this.emitInsertedRow(inProgressId, event.type);
+                    logger.error({ event: event.type, error: error.message }, "Event error");
+                    return;
+                }
+                catch (err) {
+                    // Fall through to INSERT on UPDATE failure (e.g. row was
+                    // garbage-collected between SELECT and UPDATE). Mirrors the
+                    // identical defensive fall-through in `logAction`.
+                    logger.warn({ err, event: event.type, inProgressId }, "in_progress row UPDATE in logError failed — falling back to INSERT");
+                }
+            }
             const placeholders = columns
                 .map((column) => {
                 if (column === "started_at")
@@ -381,7 +629,7 @@ export function bangStatusToResult(status) {
             return "failed";
         case "skipped":
         case "paused_decline":
+        case "paused_blocked":
             return "skipped";
     }
 }
-//# sourceMappingURL=audit.js.map

package/dist/safety/integration-write-tracker.d.ts

@@ -55,4 +55,3 @@ export interface MarkIntegrationWriteOptions {
  * strictly preferable to surfacing a 500 to the user.
  */
 export declare function markIntegrationWrite(db: Database.Database, integration: IntegrationKey, itemId: string, opts?: MarkIntegrationWriteOptions): void;
-//# sourceMappingURL=integration-write-tracker.d.ts.map

package/dist/safety/integration-write-tracker.js

@@ -38,4 +38,3 @@ export function markIntegrationWrite(db, integration, itemId, opts = {}) {
         logger.warn({ err, integration, itemId }, "failed to mark integration write — next reconcile may attribute as user");
     }
 }
-//# sourceMappingURL=integration-write-tracker.js.map

package/dist/safety/outbound-purchase-guard.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Outbound-purchase-template guard — the daemon-internal chokepoint
+ * that refuses any agent-tool-originated outbound message carrying the
+ * §17.7 reserved structural markers.
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.7 / §13 step 54.
+ *
+ * The classifier (`automation/purchase-tokens.ts:classifyPurchaseConfirmationTemplate`)
+ * detects the markers. This module is the wiring layer that asserts /
+ * audits / refuses. Daemon-side outbound (the
+ * `purchase-system-message-sender` module) bypasses this guard because
+ * its `sendSystemMessage` requires the unforgeable handler capability.
+ *
+ * Wired in two places:
+ *   - POST /api/notify (the LLM's primary "send DM" route)
+ *   - The bang-command `notify()` wrapper (LLM-driven `!`-command
+ *     replies — defence-in-depth in case a future bang handler echoes
+ *     attacker-controlled content)
+ *
+ * The wrapper writes an `agent_actions` audit row on a match so an
+ * operator can see exactly which agent path tried to spoof.
+ */
+import type Database from "better-sqlite3";
+import { type PurchaseConfirmationTemplateMatch } from "../services/browser-history/automation/purchase-tokens.js";
+export declare class OutboundPurchaseTemplateError extends Error {
+    readonly match: PurchaseConfirmationTemplateMatch;
+    readonly origin: string;
+    constructor(match: PurchaseConfirmationTemplateMatch, origin: string);
+}
+export interface AuditOutboundRefusalInput {
+    db: Database.Database;
+    origin: string;
+    marker: string;
+    /** Truncated preview of the offending body — first 80 chars. NEVER
+     *  log the full message; an attacker-controlled body that smuggles a
+     *  legitimate-looking marker should not bloat the audit. */
+    preview: string;
+}
+/** Persist a structured `agent_actions` row so the dashboard's
+ *  "Recent agent activity" view surfaces the refusal. Best-effort —
+ *  a DB write failure is logged but never re-thrown (the caller's
+ *  refusal path is the load-bearing signal).
+ *
+ *  Implementation note: `result` is `'failed'` (not `'blocked'`) because
+ *  the `agent_actions.result` CHECK constraint only permits the canonical
+ *  settle states (success / failed / partial / skipped / in_progress).
+ *  A literal `'blocked'` would silently violate the constraint and the
+ *  try/catch would swallow the audit — losing every refusal row. The
+ *  `action_type='purchase_template_refused'` is the discriminator that
+ *  lets dashboards / queries distinguish this from a real agent failure.
+ *  Mirrors the `blocked_absolute` precedent in `absolute-block-audit.ts`. */
+export declare function auditOutboundRefusal(input: AuditOutboundRefusalInput): void;
+/**
+ * Throw `OutboundPurchaseTemplateError` if the message body carries a
+ * reserved marker. Pure-ish — when given a DB handle, also audits the
+ * refusal. The `origin` argument identifies which agent path is the
+ * caller (e.g., `"api.notify"`, `"bang.commands"`) so the audit row
+ * can pinpoint the surface that mis-routed.
+ */
+export declare function assertOutboundAllowedForAgent(body: string, origin: string, db?: Database.Database): void;

package/dist/safety/outbound-purchase-guard.js

@@ -0,0 +1,82 @@
+/**
+ * Outbound-purchase-template guard — the daemon-internal chokepoint
+ * that refuses any agent-tool-originated outbound message carrying the
+ * §17.7 reserved structural markers.
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.7 / §13 step 54.
+ *
+ * The classifier (`automation/purchase-tokens.ts:classifyPurchaseConfirmationTemplate`)
+ * detects the markers. This module is the wiring layer that asserts /
+ * audits / refuses. Daemon-side outbound (the
+ * `purchase-system-message-sender` module) bypasses this guard because
+ * its `sendSystemMessage` requires the unforgeable handler capability.
+ *
+ * Wired in two places:
+ *   - POST /api/notify (the LLM's primary "send DM" route)
+ *   - The bang-command `notify()` wrapper (LLM-driven `!`-command
+ *     replies — defence-in-depth in case a future bang handler echoes
+ *     attacker-controlled content)
+ *
+ * The wrapper writes an `agent_actions` audit row on a match so an
+ * operator can see exactly which agent path tried to spoof.
+ */
+import { createLogger } from "../logging.js";
+import { classifyPurchaseConfirmationTemplate, } from "../services/browser-history/automation/purchase-tokens.js";
+const logger = createLogger("outbound-purchase-guard");
+export class OutboundPurchaseTemplateError extends Error {
+    match;
+    origin;
+    constructor(match, origin) {
+        super(`outbound message refused — reserved purchase-template marker "${match.marker}" detected (origin=${origin})`);
+        this.match = match;
+        this.origin = origin;
+        this.name = "OutboundPurchaseTemplateError";
+    }
+}
+/** Persist a structured `agent_actions` row so the dashboard's
+ *  "Recent agent activity" view surfaces the refusal. Best-effort —
+ *  a DB write failure is logged but never re-thrown (the caller's
+ *  refusal path is the load-bearing signal).
+ *
+ *  Implementation note: `result` is `'failed'` (not `'blocked'`) because
+ *  the `agent_actions.result` CHECK constraint only permits the canonical
+ *  settle states (success / failed / partial / skipped / in_progress).
+ *  A literal `'blocked'` would silently violate the constraint and the
+ *  try/catch would swallow the audit — losing every refusal row. The
+ *  `action_type='purchase_template_refused'` is the discriminator that
+ *  lets dashboards / queries distinguish this from a real agent failure.
+ *  Mirrors the `blocked_absolute` precedent in `absolute-block-audit.ts`. */
+export function auditOutboundRefusal(input) {
+    try {
+        input.db
+            .prepare(`INSERT INTO agent_actions
+           (action_type, trigger, result, detail, completed_at, source_kind)
+         VALUES (?, ?, ?, ?, CURRENT_TIMESTAMP, ?)`)
+            .run("purchase_template_refused", input.origin, "failed", JSON.stringify({ marker: input.marker, preview: input.preview }), "agent");
+    }
+    catch (err) {
+        logger.warn({ err, origin: input.origin }, "failed to write purchase_template_refused audit row");
+    }
+}
+/**
+ * Throw `OutboundPurchaseTemplateError` if the message body carries a
+ * reserved marker. Pure-ish — when given a DB handle, also audits the
+ * refusal. The `origin` argument identifies which agent path is the
+ * caller (e.g., `"api.notify"`, `"bang.commands"`) so the audit row
+ * can pinpoint the surface that mis-routed.
+ */
+export function assertOutboundAllowedForAgent(body, origin, db) {
+    const match = classifyPurchaseConfirmationTemplate(body);
+    if (!match)
+        return;
+    if (db) {
+        auditOutboundRefusal({
+            db,
+            origin,
+            marker: match.marker,
+            preview: body.slice(0, 80),
+        });
+    }
+    logger.warn({ origin, marker: match.marker, preview: body.slice(0, 80) }, "outbound message refused — reserved purchase-template marker");
+    throw new OutboundPurchaseTemplateError(match, origin);
+}

package/dist/safety/risk-classifier.d.ts

@@ -47,12 +47,12 @@ export declare function classifyRisk(method: string, path: string): RiskTier;
  *
  * Why this exists: `API_RISK` is hand-maintained. When a developer adds
  * a new route in `routes/*.ts` but forgets to update the classifier
- * table, the request hits the runtime warning at line ~480 only after
- * the first call — and then 401s because Approve-tier requires a Bearer
- * the agent can't supply. We saw this with `POST /api/context/roadmap/id`
- * (7×401 + 4×400 retry spiral inside roadmap_refresh, 2026-04-28).
+ * table, the request hits the runtime warning only after the first call
+ * — and then 401s because Approve-tier requires a Bearer the agent can't
+ * supply, producing a user-visible retry spiral. The boot audit catches
+ * the omission before any traffic flows.
  *
- * Hono parameterized segments (`/integrations/:key/invoke`) are
+ * Hono parameterized segments (`/integrations/:key/exec`) are
  * normalized to a representative literal so `{*}`-pattern entries in
  * `API_RISK` match them. Routes that don't start with `/api/` are
  * skipped (default-Autonomous is intentional there — webhooks, root).
@@ -62,4 +62,19 @@ export interface AuditableRoute {
     path: string;
 }
 export declare function auditRiskClassifications(routes: ReadonlyArray<AuditableRoute>): AuditableRoute[];
-//# sourceMappingURL=risk-classifier.d.ts.map
+/**
+ * Return every `/api/*` path that `API_RISK` classifies as
+ * `RiskTier.ReadSensitive` for GET requests, with `{*}` placeholders
+ * stripped to the literal prefix segment. Used by the drift-guard test
+ * in `skills-compiler.test.ts` to assert
+ * `READ_SENSITIVE_API_PREFIXES` covers every read-sensitive GET
+ * surface — so a new endpoint added to `API_RISK` cannot silently
+ * regress the Codex banner emission contract
+ * (docs/design/appendices/skills-unification.md Phase 1 §"Codex read-sensitive banner
+ * inheritance").
+ *
+ * Returns sorted unique strings; trailing `/` is preserved as it appears
+ * in `API_RISK` so the caller can distinguish prefix-style keys from
+ * exact paths.
+ */
+export declare function listReadSensitiveGetPathKeys(): readonly string[];