@aitne/daemon 0.1.7 → 0.1.9

package/dist/safety/risk-classifier.js

@@ -38,6 +38,27 @@ const API_RISK = {
     "/api/schedule": RiskTier.Autonomous,
     "PATCH /api/schedule/": RiskTier.Autonomous,
     "DELETE /api/schedule/": RiskTier.Autonomous,
+    // SCHEDULE_API_REDESIGN_PLAN.md §4.4 — agent-callable discovery
+    // endpoint cited by `schedule.model_unknown` / `schedule.frequency_unknown`
+    // / `schedule.days_of_week_invalid` validValues payloads. Read-only,
+    // no PII (registry shape + configured timezone), so Autonomous matches
+    // the rest of the /api/schedule surface and the explicit entry pins
+    // the audit fingerprint.
+    "GET /api/schedule/options": RiskTier.Autonomous,
+    // POST /api/schedule/batch is the morning-routine pipeline's bulk
+    // entry-point (docs/design/appendices/morning-routine-optimization.md
+    // §"POST /api/schedule/batch"). Same risk profile as POST /api/schedule:
+    // single-table DB inserts the agent originates from its own session,
+    // idempotent at the row level. No prefix-aliasing concerns since
+    // "PATCH /api/schedule/" only matches the per-id PATCH path.
+    "POST /api/schedule/batch": RiskTier.Autonomous,
+    // PATCH /api/agent-actions/self lets the running session write
+    // structured metadata into its own agent_actions row (used by the
+    // morning-routine pipeline's ⑥ AgentJournalAppender). Autonomous —
+    // the endpoint enforces same-row authn from x-pa-event-correlation-id
+    // + x-process-key headers, so a malicious request would have to forge
+    // the dispatcher-injected session identity.
+    "PATCH /api/agent-actions/self": RiskTier.Autonomous,
     "/api/action/log": RiskTier.Autonomous,
     // Profile-interview queue helper. Read-only, returns a single boolean
     // (`{filled, sectionPresent}`) computed from a context-vault path. No
@@ -121,7 +142,151 @@ const API_RISK = {
     "GET /api/config/character": RiskTier.Autonomous,
     "PATCH /api/config/character": RiskTier.Autonomous,
     "/api/config": RiskTier.Approve,
+    "GET /api/browser-history/status": RiskTier.Approve,
+    "GET /api/browser-history/research-clusters": RiskTier.Autonomous,
+    "GET /api/browser-history/research-clusters/{*}": RiskTier.Autonomous,
+    "GET /api/browser-history/yesterday-summary": RiskTier.Autonomous,
+    // BROWSER_HISTORY_INTEGRATION_PLAN §5.F2 P4a — pre-morning digest
+    // JSON endpoint. Read-only; serves the same Zod-validated shape the
+    // morning Stage B journal already reads from the markdown sidecar.
+    // No raw URLs / titles in the response (Layer 1 invariant), so
+    // Autonomous like the rest of the browser-history read surface.
+    "GET /api/browser-history/pre-morning-digest/{*}": RiskTier.Autonomous,
+    "GET /api/browser-history/shopping/{*}": RiskTier.Autonomous,
+    "GET /api/browser-history/reloads/today": RiskTier.Autonomous,
+    "GET /api/browser-history/reloads/weekly": RiskTier.Autonomous,
+    // BROWSER_HISTORY_INTEGRATION_PLAN P3 — engagement offers.
+    // Reads (`/offers/pending`) are autonomous; the agent surfaces open
+    // offers in the morning digest. Accept (`POST /offers/{*}/accept`)
+    // queues a process-key dispatch one step removed from external
+    // research / wiki writes — ReadSensitive so the dashboard's bearer
+    // is enforced but the agent's curl from the session workdir still
+    // works (the route enforces token presence via the same middleware
+    // as other ReadSensitive endpoints). Decline and mute are
+    // autonomous DB updates.
+    "GET /api/browser-history/offers/pending": RiskTier.Autonomous,
+    "POST /api/browser-history/offers/{*}/accept": RiskTier.ReadSensitive,
+    "POST /api/browser-history/offers/{*}/decline": RiskTier.Autonomous,
+    "POST /api/browser-history/offers/{*}/mute": RiskTier.Autonomous,
+    // Agent write-back after `routine.research_wiki_summary` successfully
+    // writes the wiki note. Stamps `wikiSummaryWrittenAt`; the only
+    // mutation is on the cluster row the agent is already permitted to
+    // read. Autonomous so the agent's curl from the session workdir works
+    // without a bearer.
+    "POST /api/browser-history/research-clusters/{*}/wiki-written": RiskTier.Autonomous,
+    // ── WEEKLY_INTERESTS_REFLECTION_PLAN.md §17 ──
+    // GET summary is read-only aggregate over cluster data; no PII / URL
+    // / title content surfaces. Same risk profile as `/research-clusters`.
+    "GET /api/browser-history/weekly-interests-summary": RiskTier.Autonomous,
+    // POST refresh / cleanup are dashboard-only — bearer-token-
+    // authenticated. Neither is listed in any skill's `allowed-tools`, so
+    // no LLM can call them; the scheduler invokes the same logic via a
+    // direct function call inside `dispatcher-scheduled-tasks.ts`'s
+    // pre-hook, bypassing the HTTP layer. Approve tier documents the
+    // bearer requirement and produces an audit row distinct from the
+    // autonomous-tier reflection runs.
+    "POST /api/browser-history/refresh-interests-reflection": RiskTier.Approve,
+    "POST /api/browser-history/cleanup-interests-reflection": RiskTier.Approve,
+    // ── Managed Chromium (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.10) ──
+    // The dashboard control surface for the managed Chromium Instance S.
+    // Reads (`status`, `setup-status`) are Autonomous so the dashboard
+    // status badge can poll without a bearer. Mutations that destroy
+    // state (`disconnect`, `enable=false`) are Approve. Mutations that
+    // spawn a UI Chromium for the user to type credentials into
+    // (`setup`, `setup-finish`, `reconnect`) are ReadSensitive: the
+    // dashboard's bearer auth is required, but the agent never reaches
+    // these routes (the skill body forbids them and the route layer's
+    // tier guard short-circuits before any DB mutation).
+    "GET /api/browser-history/managed/status": RiskTier.Autonomous,
+    "POST /api/browser-history/managed/setup": RiskTier.ReadSensitive,
+    "GET /api/browser-history/managed/setup-status": RiskTier.Autonomous,
+    "POST /api/browser-history/managed/setup-finish": RiskTier.ReadSensitive,
+    "POST /api/browser-history/managed/reconnect": RiskTier.ReadSensitive,
+    "POST /api/browser-history/managed/disconnect": RiskTier.Approve,
+    "POST /api/browser-history/managed/enable": RiskTier.Approve,
+    // Opt-in Playwright Chromium download. Approve-tier because the
+    // install touches the network and writes ~150 MiB into the user's
+    // Playwright cache — an autonomous agent must not trigger this on
+    // its own. The status sibling is autonomous-safe (read-only state).
+    "POST /api/browser-history/managed/install-chromium": RiskTier.Approve,
+    "GET /api/browser-history/managed/install-chromium/status": RiskTier.Autonomous,
+    // ── Browser Automation Sites (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §16.9) ──
+    // Phase B-2.5 per-site sign-in surface. Reads (`sites`,
+    // `sites/{*}/status`) are Autonomous so the dashboard's per-site
+    // card can poll without a bearer; the agent's auth-variant
+    // workflows also call `GET /sites` to discover whether the user
+    // has connected the site they need. Every mutation
+    // (`connect` / `finalize` / `reauth` / `disconnect`) is Approve —
+    // sign-in spawns a UI Chromium the user types credentials into, and
+    // the connect / reauth payloads change the persistent profile dir.
+    // The agent cannot trigger these (skill body forbids them; the
+    // route layer's tier guard short-circuits before any DB mutation).
+    "GET /api/browser-automation/sites": RiskTier.Autonomous,
+    "POST /api/browser-automation/sites/{*}/connect": RiskTier.Approve,
+    "GET /api/browser-automation/sites/{*}/status": RiskTier.Autonomous,
+    "POST /api/browser-automation/sites/{*}/finalize": RiskTier.Approve,
+    "POST /api/browser-automation/sites/{*}/reauth": RiskTier.Approve,
+    "POST /api/browser-automation/sites/{*}/disconnect": RiskTier.Approve,
+    // ── Browser Automation Purchase (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.10) ──
+    // Phase B-4 experimental purchase surface. Token issuance is
+    // daemon-internal — there is NO `POST /purchase-tokens` route. The
+    // dashboard list endpoint is `Approve` rather than `Autonomous`
+    // because a token list reveals every in-flight purchase intent
+    // (site, displayed total, originating channels), and the agent has
+    // no legitimate path to read it (the workflow already holds the
+    // jti it minted for its own awaitReply polling). The DELETE path is
+    // dashboard-only (user "Cancel pending" button); the agent cannot
+    // cancel another workflow's token.
+    "GET /api/browser-automation/purchase-tokens": RiskTier.Approve,
+    "DELETE /api/browser-automation/purchase-tokens/{*}": RiskTier.Approve,
+    // Global master toggle. Read is Autonomous so the dashboard can poll
+    // status without a bearer; flipping is Approve (bearer-required).
+    "GET /api/browser-automation/b4/enabled": RiskTier.Autonomous,
+    "POST /api/browser-automation/b4/enabled": RiskTier.Approve,
+    // Per-site config + primary-channel selection — dashboard-only.
+    "GET /api/browser-automation/b4/site-configs": RiskTier.Autonomous,
+    "PATCH /api/browser-automation/sites/{*}/b4-config": RiskTier.Approve,
+    "GET /api/browser-automation/b4/primary-channels": RiskTier.Autonomous,
+    "PATCH /api/browser-automation/channels/{*}/{*}/primary": RiskTier.Approve,
+    // ── Browser Task (BROWSER_TASK_REDESIGN_PLAN.md §3) ──
+    // Open-ended natural-language browser sub-agent surface. POST is
+    // Autonomous — the only production caller today is the DM-agent
+    // `browser-task` skill, whose curl shim carries only `x-read-token`
+    // (sufficient for ReadSensitive, never enough for Approve). The
+    // historical Approve tier here assumed a Phase 2 "DM-agent adapter
+    // holds the dashboard bearer" path that was never wired, producing
+    // a 401 on every DM-driven dispatch. Matching the sibling agent-
+    // driven write paths (clarify + cancel, both Autonomous) keeps the
+    // surface coherent. Defense-in-depth that actually matters lives
+    // downstream and is independent of the API auth tier:
+    //   1. Host-header loopback gate + sec-fetch-site / origin checks
+    //      in `evaluateLoopbackBrowserGate` — CSRF protection survives
+    //      at Autonomous (only same-origin POSTs from the dashboard's
+    //      loopback origin reach the handler).
+    //   2. `x-pa-channel-ref` attestation against `listPrimaryChannels()`
+    //      inside the POST handler — a request whose channel is out of
+    //      the primary set is silently downgraded with a
+    //      `browser_task_channel_override` audit row.
+    //   3. Per-task global cap, user-curated `browserTaskHostnameDenylist`,
+    //      hardcoded payment-path block, and the B-4 final-confirm
+    //      token gate inside the runner.
+    //   4. Every dispatched task surfaces to the user via DM — there is
+    //      no covert dispatch path. A future dashboard re-run button
+    //      that calls this endpoint will still authenticate via Bearer
+    //      because the dashboard proxy attaches one by default; the
+    //      tier change only affects what's required, not what's offered.
+    // The list / detail / events / screenshot reads stay ReadSensitive
+    // because the task description + action log can carry personal
+    // context (account ids, free-text intent).
+    "POST /api/browser-task": RiskTier.Autonomous,
+    "GET /api/browser-task": RiskTier.ReadSensitive,
+    "GET /api/browser-task/{*}": RiskTier.ReadSensitive,
+    "GET /api/browser-task/{*}/events": RiskTier.ReadSensitive,
+    "GET /api/browser-task/{*}/screenshots/{*}": RiskTier.ReadSensitive,
+    "POST /api/browser-task/{*}/clarify": RiskTier.Autonomous,
+    "POST /api/browser-task/{*}/cancel": RiskTier.Autonomous,
     "/api/setup": RiskTier.Approve,
+    "POST /api/setup/redetect-browsers": RiskTier.Approve,
     // Management Mode Phase 2 — migration endpoint. Redundant with the
     // /api/setup prefix rule above (which already hits Approve) but named
     // explicitly so future refactors of the setup-tier rules don't
@@ -151,11 +316,39 @@ const API_RISK = {
     "/api/schedule/list": RiskTier.Approve,
     "POST /api/agent/regenerate": RiskTier.Approve,
     "POST /api/agent/run-now": RiskTier.Approve,
+    // Evening-review slimdown §2.2 — manual fire of the daily mechanical
+    // roadmap.md maintenance pass. Same Approve tier as the parent
+    // `/run-now`: the daemon's CLI / dashboard hold the Bearer token,
+    // agents do not.
+    "POST /api/agent/run-now/roadmap-maintenance": RiskTier.Approve,
     // DELEGATED-MODE-V2-DESIGN.md §6.1 — agent-callable retrospective.
     // Autonomous tier so the DM session can read its own audit trail without
     // the dashboard-issued bearer (which agents don't have). Output is
     // redacted via secret-redaction before serialization.
     "GET /api/agent/actions": RiskTier.Autonomous,
+    // ── Agent Definitions (AGENT_DEFINITIONS_DESIGN.md §9.7) ──
+    // Reads + run-now are Autonomous: the list/detail/executions surface is
+    // structural metadata about the agent's own scheduled identities (no PII
+    // beyond what /api/schedule already exposes), and run-now enqueues a single
+    // `agent_schedule` row the agent could already create via the schedule skill
+    // (system-Agent run-now additionally DMs the owner in-handler — the §9.7
+    // Notify convention, since the RiskTier enum has no Notify value). PATCH /
+    // DELETE are Approve: they change `enabled` state / config overrides / delete
+    // user Agents, and the stop-warning ack is the explicit consent surface, so
+    // the dashboard's bearer token is required. `{*}` matches the `:slug`
+    // segment; the executions + run-now patterns carry an extra trailing literal.
+    // POST /api/agents (create) is Autonomous: it is the agent-facing replacement
+    // for the now-410 `POST /api/recurring-schedules` (also Autonomous) — the
+    // `agent-create` skill teaches the DM agent to create a recurring Agent for an
+    // ongoing cadence, the same recurring-task capability it already had. The
+    // loader rejects a one_shot/event definition; planCreate validates the rest.
+    "GET /api/agents": RiskTier.Autonomous,
+    "POST /api/agents": RiskTier.Autonomous,
+    "GET /api/agents/{*}": RiskTier.Autonomous,
+    "GET /api/agents/{*}/executions": RiskTier.Autonomous,
+    "POST /api/agents/{*}/run-now": RiskTier.Autonomous,
+    "PATCH /api/agents/{*}": RiskTier.Approve,
+    "DELETE /api/agents/{*}": RiskTier.Approve,
     // ── Wiki Builder (WIKI_BUILDER_DESIGN.md Phase 1) ──
     // Dashboard workspace settings stay owner-only. Agent-callable file,
     // search, and index routes are Autonomous at middleware level but enforce
@@ -190,47 +383,47 @@ const API_RISK = {
     // ── Context File API ──
     // GET reads contain personal notes, schedule, user profile — ReadSensitive.
     // Writes remain Autonomous (agent's own memory operations).
+    //
+    // CONTEXT_VAULT_REDESIGN_PLAN.md §7.1 — after the six-class restructure
+    // the per-path entries collapse to one row per class prefix. Legacy
+    // URLs (e.g. `PUT /api/context/today.md`) are normalised by the
+    // in-process alias resolver before reaching the classifier, so only
+    // canonical paths need to be enumerated here.
     "GET /api/context": RiskTier.ReadSensitive,
     "PUT /api/context/": RiskTier.Autonomous,
     "PATCH /api/context/": RiskTier.Autonomous,
-    "PUT /api/context/today": RiskTier.Autonomous,
-    "PATCH /api/context/today": RiskTier.Autonomous,
-    "PUT /api/context/tomorrow": RiskTier.Autonomous,
-    "PATCH /api/context/tomorrow": RiskTier.Autonomous,
-    // B-007 §5.1 — user profile lives at user/profile.md, area files under user/*.md.
-    "PUT /api/context/user/": RiskTier.Autonomous,
-    "PATCH /api/context/user/": RiskTier.Autonomous,
-    // B-007 §5.1 — management rules moved from context/management-rules.md to
-    // context/rules/management.md; mcp / journal-format / journal-export /
-    // redaction rules are Autonomous (post-Notify-abolition) — agent edits its
-    // own session-shaping rules, on-demand retrospective covers awareness.
-    "PUT /api/context/rules/": RiskTier.Autonomous,
-    "PATCH /api/context/rules/": RiskTier.Autonomous,
-    "PATCH /api/context/roadmap": RiskTier.Autonomous,
-    // Pure-utility ID minter — reads existing IDs, generates a fresh one.
-    // No write side-effect; the route's own write-lock guard handles
-    // concurrent-mint protection. Without this entry the call defaulted
-    // to Approve (fail-closed) and roadmap_refresh's task-flow Step 4.1
-    // collapsed onto fabricated placeholder IDs that then failed PUT
-    // validation with `Malformed roadmap id marker`.
-    "POST /api/context/roadmap/id": RiskTier.Autonomous,
-    "PUT /api/context/projects": RiskTier.Autonomous,
-    "PATCH /api/context/projects": RiskTier.Autonomous,
-    "PUT /api/context/weekly": RiskTier.Autonomous,
-    // B-007 §5.9 — day rotation endpoint (today.md → yesterday.md; synthesized
-    // daily/YYYY-MM-DD.md is written by the morning routine, not this path).
+    // identity/ ← user profile + area files
+    "PUT /api/context/identity/": RiskTier.Autonomous,
+    "PATCH /api/context/identity/": RiskTier.Autonomous,
+    // state/ — today, yesterday, scratch, inbox, activity, profile questions
+    "PUT /api/context/state/": RiskTier.Autonomous,
+    "PATCH /api/context/state/": RiskTier.Autonomous,
+    "DELETE /api/context/state/": RiskTier.Autonomous,
+    // plans/ — roadmap + projects
+    "PUT /api/context/plans/": RiskTier.Autonomous,
+    "PATCH /api/context/plans/": RiskTier.Autonomous,
+    // Pure-utility ID minter for the new plans/roadmap path. Reads
+    // existing IDs, generates a fresh one. No write side-effect.
+    "POST /api/context/plans/roadmap/id": RiskTier.Autonomous,
+    // policies/ — management, mcp, redaction, journal-format/-export,
+    // integrations.md, management-captures, routines, skills
+    "PUT /api/context/policies/": RiskTier.Autonomous,
+    "PATCH /api/context/policies/": RiskTier.Autonomous,
+    // DELETE on policies/ is intentionally scoped to routines/custom/*
+    // only — policy captures preserve `status: removed` rather than
+    // physically deleting, so blanket policies/ DELETE would defeat the
+    // §4.6 / §5.1 audit invariant. Custom routines have their own
+    // explicit route entry below.
+    "DELETE /api/context/policies/routines/custom/": RiskTier.Autonomous,
+    // journal/ — append-only narrative.
+    "PUT /api/context/journal/": RiskTier.Autonomous,
+    "PATCH /api/context/journal/": RiskTier.Autonomous,
+    // knowledge/ — dossiers, entities, wiki, repos.
+    "PUT /api/context/knowledge/": RiskTier.Autonomous,
+    "PATCH /api/context/knowledge/": RiskTier.Autonomous,
+    // Day rotation endpoint (today.md → yesterday.md; synthesized
+    // journal/daily/YYYY-MM-DD.md is written by the morning routine).
     "POST /api/context/archive-today": RiskTier.Autonomous,
-    // B-007 §5.8 — routines/<cadence>.md and routines/custom/<slug>.md
-    // shape scheduled behavior; Autonomous (matches rules tier).
-    "PUT /api/context/routines/": RiskTier.Autonomous,
-    "PATCH /api/context/routines/": RiskTier.Autonomous,
-    "DELETE /api/context/routines/": RiskTier.Autonomous,
-    // B-007 §5.9 — synthesized daily journal path is Autonomous (agent-owned output).
-    "PUT /api/context/daily/": RiskTier.Autonomous,
-    "PATCH /api/context/daily/": RiskTier.Autonomous,
-    // B-007 §5.1 — agent/journal.md (self-reflection) is agent-only.
-    "PUT /api/context/agent/": RiskTier.Autonomous,
-    "PATCH /api/context/agent/": RiskTier.Autonomous,
     "GET /api/context/list": RiskTier.ReadSensitive,
     // B-008 P7 — Vault Health surface. `health` returns a structural drift
     // report (no user prose), so Autonomous. `repair/stub` copies a template
@@ -387,9 +580,6 @@ const API_RISK = {
     "GET /api/receipts/summary": RiskTier.ReadSensitive,
     "POST /api/receipts/": RiskTier.ReadSensitive, // binary receipt download
     "PATCH /api/receipts/": RiskTier.Approve,
-    // ── Travel Time (Phase B) ──
-    "GET /api/travel-time": RiskTier.Autonomous,
-    "GET /api/travel-time/for-event/": RiskTier.Autonomous,
     // ── Books & Reading (Phase C, F-10) ──
     "GET /api/books": RiskTier.ReadSensitive,
     "GET /api/books/": RiskTier.ReadSensitive,
@@ -427,6 +617,10 @@ const API_RISK = {
     // Dashboard-initiated. Reads are Approve (contain auth status detail).
     // Recovery writes are Approve (credential file writes).
     "GET /api/backends": RiskTier.Approve,
+    // Live opencode model catalogue. Read-only — enumerates providers + models
+    // already configured on the operator's opencode server. Approve tier matches
+    // the parent `GET /api/backends` (which already returns auth status detail).
+    "GET /api/backends/opencode/live-models": RiskTier.Approve,
     "POST /api/backends/": RiskTier.Approve,
     "PUT /api/backends/main": RiskTier.Approve,
     // Provider API key configuration (ANTHROPIC_API_KEY / OPENAI_API_KEY /
@@ -451,21 +645,12 @@ const API_RISK = {
     // misuse can falsify the cached features map until the next live probe
     // overwrites it. Same trust level as the mode flip above.
     "POST /api/integrations/{*}/probe": RiskTier.Approve,
-    // RESERVED — POST /api/integrations/{*}/invoke
-    //
-    // The route handler is commented out as of 2026-05-01 (/exec-only
-    // migration). Risk-classifier entries are keyed on the route pattern,
-    // and a request to a commented-out route never reaches this map. The
-    // classification is preserved here so a future reactivation lands
-    // back at the same tier without re-deriving it. See the RESERVED
-    // block in `packages/daemon/src/api/routes/integrations.ts` for the
-    // reactivation conditions.
-    //
-    // Original rationale: Autonomous — the agent calls freely from
-    // cross-backend skill prose, and the user's `deniedTools` setting is
-    // the chokepoint enforced inside the handler. Approve is reserved
-    // for daemon-config posture changes (§4.5.2); tool-level safety
-    // stays at the deny list.
+    // RESERVED — POST /api/integrations/{*}/invoke. The route is unmounted
+    // today (superseded by /exec). The classification is preserved
+    // commented-out so a future reactivation lands back at Autonomous tier
+    // without re-deriving the rationale: the agent calls freely from
+    // cross-backend skill prose and the user's `deniedTools` is the
+    // chokepoint; Approve is reserved for daemon-config posture changes.
     // "POST /api/integrations/{*}/invoke": RiskTier.Autonomous,
     // delegated-sync opt-in surface
     // (docs/design/appendices/delegated-sync-opt-in.md). Approve tier:
@@ -497,19 +682,12 @@ const API_RISK = {
     // `/api/integrations/{*}/exec` (Autonomous), where the integration's
     // user-curated deny list is the safety floor.
     "POST /api/delegated/run": RiskTier.Approve,
-    // ── Admin / dashboard surfaces (post-audit baseline 2026-04-29) ──
-    // Until `auditRiskClassifications` landed, every entry below would
-    // fall through to the conservative Approve default. The audit then
-    // surfaced 33 such routes at boot — useful as a one-time triage but
-    // noisy as a recurring warning. Listing each surface explicitly
-    // here pins the audit's fingerprint to "0 unclassified" so a single
-    // future regression (the next `roadmap/id`-style oversight) shows
-    // up as exactly one new line, not buried in a 33-row baseline.
-    //
-    // Every entry is Approve by intent (not by default fallback). None
-    // of these routes are agent-callable: secrets / messaging-pairing /
-    // backend-config / dashboard polling are all Bearer-gated UI or
-    // admin operations.
+    // ── Admin / dashboard surfaces ──
+    // Routes below are Approve by intent, not by fallback. Pinning them
+    // explicitly keeps `auditRiskClassifications` at zero so a future
+    // regression surfaces as exactly one new line. None are agent-callable:
+    // secrets / messaging-pairing / backend-config / dashboard polling are
+    // all Bearer-gated UI or admin operations.
     // Snapshot restore — rollback via dashboard.
     "POST /api/context/restore-snapshot/": RiskTier.Approve,
     // Catch-all DELETE under /api/context. Retention sweeps for daily/
@@ -555,7 +733,7 @@ const API_RISK = {
     "GET /api/dashboard/dm-freshness": RiskTier.Approve,
     // Activity tab read-mirror (Memory → Activity). Dashboard-only — surfaces
     // the wider activity-source union used by the runner so the UI can flag
-    // recently-stopped tasks whose `_activity/<source>.md` is still on disk
+    // recently-stopped tasks whose `state/activity/<source>.md` is still on disk
     // for the 90-day window. Not agent-callable; same Approve tier as the
     // rest of the dashboard read surfaces.
     "GET /api/activity-sources": RiskTier.Approve,
@@ -794,4 +972,52 @@ function literalPrefixLength(key) {
     return idx < 0 ? key.length : idx;
 }
 /* c8 ignore stop */
-//# sourceMappingURL=risk-classifier.js.map
+/** Strip a trailing `{*}` placeholder from `path` so callers can
+ *  substring-match user skill bodies against the literal prefix. No
+ *  ReadSensitive entry carries `{*}` today (only the Autonomous /
+ *  Approve ones do), so the truthy branch is currently unreachable;
+ *  preserved for future paths and parked out of the coverage gate. */
+/* c8 ignore start */
+function stripWildcardSuffix(path) {
+    return path.includes("{*}")
+        ? path.slice(0, path.indexOf("{*}")).replace(/\/+$/, "")
+        : path;
+}
+/* c8 ignore stop */
+/**
+ * Return every `/api/*` path that `API_RISK` classifies as
+ * `RiskTier.ReadSensitive` for GET requests, with `{*}` placeholders
+ * stripped to the literal prefix segment. Used by the drift-guard test
+ * in `skills-compiler.test.ts` to assert
+ * `READ_SENSITIVE_API_PREFIXES` covers every read-sensitive GET
+ * surface — so a new endpoint added to `API_RISK` cannot silently
+ * regress the Codex banner emission contract
+ * (docs/design/appendices/skills-unification.md Phase 1 §"Codex read-sensitive banner
+ * inheritance").
+ *
+ * Returns sorted unique strings; trailing `/` is preserved as it appears
+ * in `API_RISK` so the caller can distinguish prefix-style keys from
+ * exact paths.
+ */
+export function listReadSensitiveGetPathKeys() {
+    const out = new Set();
+    for (const [key, tier] of Object.entries(API_RISK)) {
+        if (tier !== RiskTier.ReadSensitive)
+            continue;
+        // Every ReadSensitive entry in `API_RISK` today carries an explicit
+        // "METHOD /api/path" prefix, so the methodless / non-/api/ branches
+        // are defensive and currently unreachable.
+        const hasMethod = key.includes(" ");
+        const method = hasMethod ? key.split(" ")[0] : /* c8 ignore next */ "GET";
+        const path = hasMethod ? key.split(" ")[1] : /* c8 ignore next */ key;
+        if (method !== "GET") /* c8 ignore next */
+            continue;
+        if (!path.startsWith("/api/")) /* c8 ignore next */
+            continue;
+        // Strip `{*}` placeholders to the literal prefix so callers can
+        // substring-match user skill bodies against it.
+        const literalPrefix = stripWildcardSuffix(path);
+        out.add(literalPrefix);
+    }
+    return [...out].sort();
+}

package/dist/safety/subprocess-block-scanner.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Per-event absolute-block observability for CLI backends.
+ *
+ * Claude has a PreToolUse hook that authoritatively rejects matching tool
+ * calls (`claude-tool-collection.ts:makeAbsoluteBlockHook`). Codex (sandbox)
+ * and Gemini (admin TOML) enforce their own rejection layers, but those
+ * happen inside the subprocess where the daemon can't observe directly.
+ *
+ * This module gives the daemon a stream-side observability hook: when a
+ * `tool_use`-shaped event surfaces from the subprocess, we run
+ * `classifyAbsoluteBlock` against the input. On a hit we record an
+ * `agent_actions.blocked_absolute` row with `result='partial'` to
+ * indicate "attempt detected; underlying enforcement happened out-of-band".
+ *
+ * Audit row semantics:
+ *   - Claude PreToolUse path → `result='failed'` (SDK rejected).
+ *   - CLI stream path (this module) → `result='partial'` (attempt observed,
+ *     enforcement decided by sandbox/policy and not always echoed back to
+ *     the daemon).
+ *
+ * Pure module — `extract*` helpers return classification candidates so the
+ * scanner stays unit-testable without a DB.
+ */
+import type Database from "better-sqlite3";
+import type { BackendId, ExecutionPermissionMode } from "@aitne/shared";
+import { type AbsoluteBlockMatch } from "./always-disallowed.js";
+/**
+ * Best-effort extraction of the (toolName, arg) pair to classify from a
+ * Codex stream `item`. Codex reports shell calls under several historical
+ * shapes — `item.command` as a joined string, `item.action.command` as
+ * an argv array, or a generic `item.input.command` field. We probe each
+ * defensively.
+ *
+ * Returns the synthetic Bash-style toolName and the joined command string
+ * so the caller can route through `classifyAbsoluteBlock("Bash", ...)`.
+ * Returns null when the event isn't a shell call we can recognise — the
+ * caller treats null as "nothing to audit", not as an error.
+ */
+export declare function extractCodexShellCall(item: unknown): {
+    toolName: "Bash";
+    arg: string;
+} | null;
+/**
+ * Best-effort extraction from a Gemini `tool_use` stream event. Gemini's
+ * built-in shell tool is `run_shell_command` (gemini-cli ≥ 0.30); file
+ * I/O surfaces as `read_file` / `write_file` / `replace`. The classifier
+ * is symmetric to Claude's PreToolUse hook — Bash for shells, Read for
+ * read-file, Write/Edit for write-file/replace.
+ */
+export declare function extractGeminiToolUseTarget(toolName: string | undefined, args: Record<string, unknown> | undefined): {
+    toolName: "Bash" | "Read" | "Write" | "Edit";
+    arg: string;
+} | null;
+/**
+ * Best-effort extraction from an opencode `tool_use` part (pulled from
+ * the final `session.prompt` response, see §5.3 — opencode 1.14.50 does
+ * NOT stream `message.part.updated` events). The tool names are
+ * opencode's built-in surface — `bash` (shell), `read` (file read),
+ * `write` (file write), `edit` (str_replace edit), `apply_patch` (multi-
+ * file patch). The classifier is symmetric to Claude's PreToolUse hook:
+ * Bash for shells, Read for reads, Write/Edit for writes.
+ *
+ * Apply-patch (multi-file patch) is collapsed to a single Write entry
+ * keyed on the first file path the input declares — finer-grained
+ * coverage would require parsing the patch body, which is documented
+ * gap.
+ */
+export declare function extractOpencodeToolUseTarget(toolName: string | undefined, input: Record<string, unknown> | undefined): {
+    toolName: "Bash" | "Read" | "Write" | "Edit";
+    arg: string;
+} | null;
+export interface StreamObservationDeps {
+    db: Database.Database | undefined;
+    backend: BackendId;
+    mode: ExecutionPermissionMode;
+    sessionId?: number | null;
+}
+/**
+ * Run `classifyAbsoluteBlock` against the candidate and, on match, write
+ * an `agent_actions.blocked_absolute` row with `result='partial'`. Returns
+ * the match (or null) so the caller can opt to log/decorate stream output.
+ *
+ * Best-effort: any DB write failure is swallowed by the audit helper.
+ */
+export declare function auditStreamObservation(candidate: {
+    toolName: string;
+    arg: string;
+}, deps: StreamObservationDeps): AbsoluteBlockMatch | null;